diff --git a/components/engine/CHANGELOG.md b/components/engine/CHANGELOG.md
index 26185624e0..18668ce549 100644
--- a/components/engine/CHANGELOG.md
+++ b/components/engine/CHANGELOG.md
@@ -5,6 +5,92 @@ information on the list of deprecated flags and APIs please have a look at
 https://docs.docker.com/engine/deprecated/ where target removal dates can also
 be found.
 
+## 17.05.0-ce (2017-05-04)
+
+### Builder
+
++ Add multi-stage build support [#31257](https://github.com/docker/docker/pull/31257) [#32063](https://github.com/docker/docker/pull/32063)
++ Allow using build-time args (`ARG`) in `FROM` [#31352](https://github.com/docker/docker/pull/31352)
++ Add an option for specifying build target [#32496](https://github.com/docker/docker/pull/32496)
+* Accept `-f -` to read Dockerfile from `stdin`, but use local context for building [#31236](https://github.com/docker/docker/pull/31236)
+* The values of default build time arguments (e.g `HTTP_PROXY`) are no longer displayed in docker image history unless a corresponding `ARG` instruction is written in the Dockerfile. [#31584](https://github.com/docker/docker/pull/31584)
+- Fix setting command if a custom shell is used in a parent image [#32236](https://github.com/docker/docker/pull/32236)
+- Fix `docker build --label` when the label includes single quotes and a space [#31750](https://github.com/docker/docker/pull/31750)
+
+### Client
+
+* Add `--mount` flag to `docker run` and `docker create` [#32251](https://github.com/docker/docker/pull/32251)
+* Add `--type=secret` to `docker inspect` [#32124](https://github.com/docker/docker/pull/32124)
+* Add `--format` option to `docker secret ls` [#31552](https://github.com/docker/docker/pull/31552)
+* Add `--filter` option to `docker secret ls` [#30810](https://github.com/docker/docker/pull/30810)
+* Add `--filter scope=<swarm|local>` to `docker network ls` [#31529](https://github.com/docker/docker/pull/31529)
+* Add `--cpus` support to `docker update` [#31148](https://github.com/docker/docker/pull/31148)
+* Add label filter to `docker system prune` and other `prune` commands [#30740](https://github.com/docker/docker/pull/30740)
+* `docker stack rm` now accepts multiple stacks as input [#32110](https://github.com/docker/docker/pull/32110)
+* Improve `docker version --format` option when the client has downgraded the API version [#31022](https://github.com/docker/docker/pull/31022)
+* Prompt when using an encrypted client certificate to connect to a docker daemon [#31364](https://github.com/docker/docker/pull/31364)
+* Display created tags on successful `docker build` [#32077](https://github.com/docker/docker/pull/32077)
+* Cleanup compose convert error messages [#32087](https://github.com/moby/moby/pull/32087)
+
+### Contrib
+
++ Add support for building docker debs for Ubuntu 17.04 Zesty on amd64 [#32435](https://github.com/docker/docker/pull/32435)
+
+### Daemon
+
+- Fix `--api-cors-header` being ignored if `--api-enable-cors` is not set [#32174](https://github.com/docker/docker/pull/32174)
+- Cleanup docker tmp dir on start [#31741](https://github.com/docker/docker/pull/31741)
+- Deprecate `--graph` flag in favor or `--data-root`  [#28696](https://github.com/docker/docker/pull/28696)
+
+### Logging
+
++ Add support for logging driver plugins [#28403](https://github.com/docker/docker/pull/28403)
+* Add support for showing logs of individual tasks to `docker service logs`, and add `/task/{id}/logs` REST endpoint [#32015](https://github.com/docker/docker/pull/32015)
+* Add `--log-opt env-regex` option to match environment variables using a regular expression [#27565](https://github.com/docker/docker/pull/27565)
+
+### Networking
+
++ Allow user to replace, and customize the ingress network [#31714](https://github.com/docker/docker/pull/31714)
+- Fix UDP traffic in containers not working after the container is restarted [#32505](https://github.com/docker/docker/pull/32505)
+- Fix files being written to `/var/lib/docker` if a different data-root is set [#32505](https://github.com/docker/docker/pull/32505)
+
+### Runtime
+
+- Ensure health probe is stopped when a container exits [#32274](https://github.com/docker/docker/pull/32274)
+
+### Swarm Mode
+
++ Add update/rollback order for services (`--update-order` / `--rollback-order`) [#30261](https://github.com/docker/docker/pull/30261)
++ Add support for synchronous `service create` and `service update` [#31144](https://github.com/docker/docker/pull/31144)
++ Add support for "grace periods" on healthchecks through the `HEALTHCHECK --start-period` and `--health-start-period` flag to
+  `docker service create`, `docker service update`, `docker create`, and `docker run` to support containers with an initial startup
+  time [#28938](https://github.com/docker/docker/pull/28938)
+* `docker service create` now omits fields that are not specified by the user, when possible. This will allow defaults to be applied inside the manager [#32284](https://github.com/docker/docker/pull/32284)
+* `docker service inspect` now shows default values for fields that are not specified by the user [#32284](https://github.com/docker/docker/pull/32284)
+* Move `docker service logs` out of experimental [#32462](https://github.com/docker/docker/pull/32462)
+* Add support for Credential Spec and SELinux to services to the API [#32339](https://github.com/docker/docker/pull/32339)
+* Add `--entrypoint` flag to `docker service create` and `docker service update` [#29228](https://github.com/docker/docker/pull/29228)
+* Add `--network-add` and `--network-rm` to `docker service update` [#32062](https://github.com/docker/docker/pull/32062)
+* Add `--credential-spec` flag to `docker service create` and `docker service update` [#32339](https://github.com/docker/docker/pull/32339)
+* Add `--filter mode=<global|replicated>` to `docker service ls` [#31538](https://github.com/docker/docker/pull/31538)
+* Resolve network IDs on the client side, instead of in the daemon when creating services [#32062](https://github.com/docker/docker/pull/32062)
+* Add `--format` option to `docker node ls` [#30424](https://github.com/docker/docker/pull/30424)
+* Add `--prune` option to `docker stack deploy` to remove services that are no longer defined in the docker-compose file [#31302](https://github.com/docker/docker/pull/31302)
+* Add `PORTS` column for `docker service ls` when using `ingress` mode [#30813](https://github.com/docker/docker/pull/30813)
+- Fix unnescessary re-deploying of tasks when environment-variables are used [#32364](https://github.com/docker/docker/pull/32364)
+- Fix `docker stack deploy` not supporting `endpoint_mode` when deploying from a docker compose file  [#32333](https://github.com/docker/docker/pull/32333)
+- Proceed with startup if cluster component cannot be created to allow recovering from a broken swarm setup [#31631](https://github.com/docker/docker/pull/31631)
+
+### Security
+
+* Allow setting SELinux type or MCS labels when using `--ipc=container:` or `--ipc=host` [#30652](https://github.com/docker/docker/pull/30652)
+
+
+### Deprecation
+
+- Deprecate `--api-enable-cors` daemon flag. This flag was marked deprecated in Docker 1.6.0 but not listed in deprecated features [#32352](https://github.com/docker/docker/pull/32352)
+- Remove Ubuntu 12.04 (Precise Pangolin) as supported platform. Ubuntu 12.04 is EOL, and no longer receives updates [#32520](https://github.com/docker/docker/pull/32520)
+
 ## 17.04.0-ce (2017-04-05)
 
 ### Builder
diff --git a/components/engine/Dockerfile b/components/engine/Dockerfile
index ddcd3e9daa..a1e7a2a691 100644
--- a/components/engine/Dockerfile
+++ b/components/engine/Dockerfile
@@ -40,7 +40,6 @@ RUN apt-get update && apt-get install -y \
 	bsdmainutils \
 	btrfs-tools \
 	build-essential \
-	clang \
 	cmake \
 	createrepo \
 	curl \
@@ -52,7 +51,6 @@ RUN apt-get update && apt-get install -y \
 	less \
 	libapparmor-dev \
 	libcap-dev \
-	libltdl-dev \
 	libnl-3-dev \
 	libprotobuf-c0-dev \
 	libprotobuf-dev \
@@ -90,17 +88,6 @@ RUN cd /usr/local/lvm2 \
 	&& make install_device-mapper
 # See https://git.fedorahosted.org/cgit/lvm2.git/tree/INSTALL
 
-# Configure the container for OSX cross compilation
-ENV OSX_SDK MacOSX10.11.sdk
-ENV OSX_CROSS_COMMIT a9317c18a3a457ca0a657f08cc4d0d43c6cf8953
-RUN set -x \
-	&& export OSXCROSS_PATH="/osxcross" \
-	&& git clone https://github.com/tpoechtrager/osxcross.git $OSXCROSS_PATH \
-	&& ( cd $OSXCROSS_PATH && git checkout -q $OSX_CROSS_COMMIT) \
-	&& curl -sSL https://s3.dockerproject.org/darwin/v2/${OSX_SDK}.tar.xz -o "${OSXCROSS_PATH}/tarballs/${OSX_SDK}.tar.xz" \
-	&& UNATTENDED=yes OSX_VERSION_MIN=10.6 ${OSXCROSS_PATH}/build.sh
-ENV PATH /osxcross/target/bin:$PATH
-
 # Install seccomp: the version shipped upstream is too old
 ENV SECCOMP_VERSION 2.3.2
 RUN set -x \
@@ -127,14 +114,6 @@ RUN curl -fsSL "https://golang.org/dl/go${GO_VERSION}.linux-amd64.tar.gz" \
 ENV PATH /go/bin:/usr/local/go/bin:$PATH
 ENV GOPATH /go
 
-# Compile Go for cross compilation
-ENV DOCKER_CROSSPLATFORMS \
-	linux/386 linux/arm \
-	darwin/amd64 \
-	freebsd/amd64 freebsd/386 freebsd/arm \
-	windows/amd64 windows/386 \
-	solaris/amd64
-
 # Dependency for golint
 ENV GO_TOOLS_COMMIT 823804e1ae08dbb14eb807afc7db9993bc9e3cc3
 RUN git clone https://github.com/golang/tools.git /go/src/golang.org/x/tools \
@@ -186,7 +165,7 @@ RUN set -x \
 	&& rm -rf "$GOPATH"
 
 # Get the "docker-py" source so we can run their integration tests
-ENV DOCKER_PY_COMMIT 4a08d04aef0595322e1b5ac7c52f28a931da85a5
+ENV DOCKER_PY_COMMIT a962578e515185cf06506050b2200c0b81aa84ef
 # To run integration tests docker-pycreds is required.
 # Before running the integration tests conftest.py is
 # loaded which results in loads auth.py that
@@ -215,16 +194,13 @@ RUN useradd --create-home --gid docker unprivilegeduser
 
 VOLUME /var/lib/docker
 WORKDIR /go/src/github.com/docker/docker
-ENV DOCKER_BUILDTAGS apparmor pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS apparmor seccomp selinux
 
 # Let us use a .bashrc file
 RUN ln -sfv $PWD/.bashrc ~/.bashrc
 # Add integration helps to bashrc
 RUN echo "source $PWD/hack/make/.integration-test-helpers" >> /etc/bash.bashrc
 
-# Register Docker's bash completion.
-RUN ln -sv $PWD/contrib/completion/bash/docker /etc/bash_completion.d/docker
-
 # Get useful and necessary Hub images so we can "docker load" locally instead of pulling
 COPY contrib/download-frozen-image-v2.sh /go/src/github.com/docker/docker/contrib/
 RUN ./contrib/download-frozen-image-v2.sh /docker-frozen-images \
@@ -238,7 +214,7 @@ RUN ./contrib/download-frozen-image-v2.sh /docker-frozen-images \
 # Please edit hack/dockerfile/install-binaries.sh to update them.
 COPY hack/dockerfile/binaries-commits /tmp/binaries-commits
 COPY hack/dockerfile/install-binaries.sh /tmp/install-binaries.sh
-RUN /tmp/install-binaries.sh tomlv vndr runc containerd tini proxy bindata dockercli
+RUN /tmp/install-binaries.sh tomlv vndr runc containerd tini proxy dockercli
 ENV PATH=/usr/local/cli:$PATH
 
 # Wrap all commands in the "docker-in-docker" script to allow nested containers
diff --git a/components/engine/Dockerfile.aarch64 b/components/engine/Dockerfile.aarch64
index b96d473d5b..209d92e0ac 100644
--- a/components/engine/Dockerfile.aarch64
+++ b/components/engine/Dockerfile.aarch64
@@ -37,7 +37,6 @@ RUN apt-get update && apt-get install -y \
 	libapparmor-dev \
 	libc6-dev \
 	libcap-dev \
-	libltdl-dev \
 	libsystemd-dev \
 	libyaml-dev \
 	mercurial \
@@ -142,7 +141,7 @@ RUN set -x \
 	&& rm -rf "$GOPATH"
 
 # Get the "docker-py" source so we can run their integration tests
-ENV DOCKER_PY_COMMIT 4a08d04aef0595322e1b5ac7c52f28a931da85a5
+ENV DOCKER_PY_COMMIT a962578e515185cf06506050b2200c0b81aa84ef
 # Before running the integration tests conftest.py is
 # loaded which results in loads auth.py that
 # imports the docker-pycreds module.
@@ -171,7 +170,7 @@ RUN useradd --create-home --gid docker unprivilegeduser
 
 VOLUME /var/lib/docker
 WORKDIR /go/src/github.com/docker/docker
-ENV DOCKER_BUILDTAGS apparmor pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS apparmor seccomp selinux
 
 # Let us use a .bashrc file
 RUN ln -sfv $PWD/.bashrc ~/.bashrc
diff --git a/components/engine/Dockerfile.armhf b/components/engine/Dockerfile.armhf
index fe190a3fd0..6103c5a3ad 100644
--- a/components/engine/Dockerfile.armhf
+++ b/components/engine/Dockerfile.armhf
@@ -39,7 +39,6 @@ RUN apt-get update && apt-get install -y \
 	net-tools \
 	libapparmor-dev \
 	libcap-dev \
-	libltdl-dev \
 	libsystemd-journal-dev \
 	libtool \
 	mercurial \
@@ -137,7 +136,7 @@ RUN set -x \
 	&& rm -rf "$GOPATH"
 
 # Get the "docker-py" source so we can run their integration tests
-ENV DOCKER_PY_COMMIT e2655f658408f9ad1f62abdef3eb6ed43c0cf324
+ENV DOCKER_PY_COMMIT a962578e515185cf06506050b2200c0b81aa84ef
 RUN git clone https://github.com/docker/docker-py.git /docker-py \
 	&& cd /docker-py \
 	&& git checkout -q $DOCKER_PY_COMMIT \
@@ -152,7 +151,7 @@ RUN useradd --create-home --gid docker unprivilegeduser
 
 VOLUME /var/lib/docker
 WORKDIR /go/src/github.com/docker/docker
-ENV DOCKER_BUILDTAGS apparmor pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS apparmor seccomp selinux
 
 # Let us use a .bashrc file
 RUN ln -sfv $PWD/.bashrc ~/.bashrc
diff --git a/components/engine/Dockerfile.ppc64le b/components/engine/Dockerfile.ppc64le
index d61205573a..e64153800c 100644
--- a/components/engine/Dockerfile.ppc64le
+++ b/components/engine/Dockerfile.ppc64le
@@ -40,7 +40,6 @@ RUN apt-get update && apt-get install -y \
 	net-tools \
 	libapparmor-dev \
 	libcap-dev \
-	libltdl-dev \
 	libsystemd-journal-dev \
 	libtool \
 	mercurial \
@@ -143,7 +142,7 @@ RUN set -x \
 	&& rm -rf "$GOPATH"
 
 # Get the "docker-py" source so we can run their integration tests
-ENV DOCKER_PY_COMMIT e2655f658408f9ad1f62abdef3eb6ed43c0cf324
+ENV DOCKER_PY_COMMIT a962578e515185cf06506050b2200c0b81aa84ef
 RUN git clone https://github.com/docker/docker-py.git /docker-py \
 	&& cd /docker-py \
 	&& git checkout -q $DOCKER_PY_COMMIT \
@@ -158,7 +157,7 @@ RUN useradd --create-home --gid docker unprivilegeduser
 
 VOLUME /var/lib/docker
 WORKDIR /go/src/github.com/docker/docker
-ENV DOCKER_BUILDTAGS apparmor pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS apparmor seccomp selinux
 
 # Let us use a .bashrc file
 RUN ln -sfv $PWD/.bashrc ~/.bashrc
diff --git a/components/engine/Dockerfile.s390x b/components/engine/Dockerfile.s390x
index c568480ecd..c69da3c969 100644
--- a/components/engine/Dockerfile.s390x
+++ b/components/engine/Dockerfile.s390x
@@ -36,7 +36,6 @@ RUN apt-get update && apt-get install -y \
 	net-tools \
 	libapparmor-dev \
 	libcap-dev \
-	libltdl-dev \
 	libsystemd-journal-dev \
 	libtool \
 	mercurial \
@@ -136,7 +135,7 @@ RUN set -x \
 	&& rm -rf "$GOPATH"
 
 # Get the "docker-py" source so we can run their integration tests
-ENV DOCKER_PY_COMMIT e2655f658408f9ad1f62abdef3eb6ed43c0cf324
+ENV DOCKER_PY_COMMIT a962578e515185cf06506050b2200c0b81aa84ef
 RUN git clone https://github.com/docker/docker-py.git /docker-py \
 	&& cd /docker-py \
 	&& git checkout -q $DOCKER_PY_COMMIT \
diff --git a/components/engine/Dockerfile.solaris b/components/engine/Dockerfile.solaris
index bb342e5e6a..4198b138b1 100644
--- a/components/engine/Dockerfile.solaris
+++ b/components/engine/Dockerfile.solaris
@@ -15,6 +15,5 @@ RUN pkg install --accept \
 		developer/gcc-*
 
 ENV GOPATH /go/:/usr/lib/gocode/1.5/
-ENV DOCKER_CROSSPLATFORMS solaris/amd64
 WORKDIR /go/src/github.com/docker/docker
 COPY . /go/src/github.com/docker/docker
diff --git a/components/engine/Makefile b/components/engine/Makefile
index 14bf91308c..c2078fd579 100644
--- a/components/engine/Makefile
+++ b/components/engine/Makefile
@@ -17,7 +17,7 @@ export DOCKER_GITCOMMIT
 # to allow things like `make KEEPBUNDLE=1 binary` easily
 # `project/PACKAGERS.md` have some limited documentation of some of these
 DOCKER_ENVS := \
-	$(if $(DOCKER_CROSSPLATFORMS), -e DOCKER_CROSSPLATFORMS) \
+	-e DOCKER_CROSSPLATFORMS \
 	-e BUILD_APT_MIRROR \
 	-e BUILDFLAGS \
 	-e KEEPBUNDLE \
@@ -134,12 +134,6 @@ init-go-pkg-cache:
 install: ## install the linux binaries
 	KEEPBUNDLE=1 hack/make.sh install-binary
 
-manpages: ## Generate man pages from go source and markdown
-	docker build ${DOCKER_BUILD_ARGS} -t docker-manpage-dev -f "man/$(DOCKERFILE)" ./man
-	docker run --rm \
-		-v $(PWD):/go/src/github.com/docker/docker/ \
-		docker-manpage-dev
-
 rpm: build ## build the rpm packages
 	$(DOCKER_RUN_DOCKER) hack/make.sh dynbinary build-rpm
 
@@ -149,9 +143,6 @@ run: build ## run the docker daemon in a container
 shell: build ## start a shell inside the build env
 	$(DOCKER_RUN_DOCKER) bash
 
-yaml-docs-gen: build ## generate documentation YAML files consumed by docs repo
-	$(DOCKER_RUN_DOCKER) sh -c 'hack/make.sh yaml-docs-generator && ( root=$$(pwd); cd bundles/latest/yaml-docs-generator; mkdir docs; ./yaml-docs-generator --root $${root} --target $$(pwd)/docs )'
-
 test: build ## run the unit, integration and docker-py tests
 	$(DOCKER_RUN_DOCKER) hack/make.sh dynbinary cross test-unit test-integration-cli test-docker-py
 
diff --git a/components/engine/api/common.go b/components/engine/api/common.go
index 9df6255c08..61a3692de1 100644
--- a/components/engine/api/common.go
+++ b/components/engine/api/common.go
@@ -21,7 +21,7 @@ import (
 // Common constants for daemon and client.
 const (
 	// DefaultVersion of Current REST API
-	DefaultVersion string = "1.30"
+	DefaultVersion string = "1.31"
 
 	// NoBaseImageSpecifier is the symbol used by the FROM
 	// command to specify that no base image is to be used.
@@ -126,7 +126,7 @@ func MatchesContentType(contentType, expectedType string) bool {
 // LoadOrCreateTrustKey attempts to load the libtrust key at the given path,
 // otherwise generates a new one
 func LoadOrCreateTrustKey(trustKeyPath string) (libtrust.PrivateKey, error) {
-	err := system.MkdirAll(filepath.Dir(trustKeyPath), 0700)
+	err := system.MkdirAll(filepath.Dir(trustKeyPath), 0700, "")
 	if err != nil {
 		return nil, err
 	}
diff --git a/components/engine/api/server/backend/build/backend.go b/components/engine/api/server/backend/build/backend.go
index bf171441ca..fe98c087b8 100644
--- a/components/engine/api/server/backend/build/backend.go
+++ b/components/engine/api/server/backend/build/backend.go
@@ -4,9 +4,10 @@ import (
 	"fmt"
 
 	"github.com/docker/distribution/reference"
+	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/backend"
 	"github.com/docker/docker/builder"
-	"github.com/docker/docker/builder/dockerfile"
+	"github.com/docker/docker/builder/fscache"
 	"github.com/docker/docker/image"
 	"github.com/docker/docker/pkg/stringid"
 	"github.com/pkg/errors"
@@ -16,19 +17,24 @@ import (
 // ImageComponent provides an interface for working with images
 type ImageComponent interface {
 	SquashImage(from string, to string) (string, error)
-	TagImageWithReference(image.ID, reference.Named) error
+	TagImageWithReference(image.ID, string, reference.Named) error
+}
+
+// Builder defines interface for running a build
+type Builder interface {
+	Build(context.Context, backend.BuildConfig) (*builder.Result, error)
 }
 
 // Backend provides build functionality to the API router
 type Backend struct {
-	manager        *dockerfile.BuildManager
+	builder        Builder
+	fsCache        *fscache.FSCache
 	imageComponent ImageComponent
 }
 
 // NewBackend creates a new build backend from components
-func NewBackend(components ImageComponent, builderBackend builder.Backend) *Backend {
-	manager := dockerfile.NewBuildManager(builderBackend)
-	return &Backend{imageComponent: components, manager: manager}
+func NewBackend(components ImageComponent, builder Builder, fsCache *fscache.FSCache) (*Backend, error) {
+	return &Backend{imageComponent: components, builder: builder, fsCache: fsCache}, nil
 }
 
 // Build builds an image from a Source
@@ -39,7 +45,7 @@ func (b *Backend) Build(ctx context.Context, config backend.BuildConfig) (string
 		return "", err
 	}
 
-	build, err := b.manager.Build(ctx, config)
+	build, err := b.builder.Build(ctx, config)
 	if err != nil {
 		return "", err
 	}
@@ -57,6 +63,15 @@ func (b *Backend) Build(ctx context.Context, config backend.BuildConfig) (string
 	return imageID, err
 }
 
+// PruneCache removes all cached build sources
+func (b *Backend) PruneCache(ctx context.Context) (*types.BuildCachePruneReport, error) {
+	size, err := b.fsCache.Prune()
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to prune build cache")
+	}
+	return &types.BuildCachePruneReport{SpaceReclaimed: size}, nil
+}
+
 func squashBuild(build *builder.Result, imageComponent ImageComponent) (string, error) {
 	var fromID string
 	if build.FromImage != nil {
diff --git a/components/engine/api/server/backend/build/tag.go b/components/engine/api/server/backend/build/tag.go
index 5c3918a3e1..e2de4c13bb 100644
--- a/components/engine/api/server/backend/build/tag.go
+++ b/components/engine/api/server/backend/build/tag.go
@@ -3,9 +3,11 @@ package build
 import (
 	"fmt"
 	"io"
+	"runtime"
 
 	"github.com/docker/distribution/reference"
 	"github.com/docker/docker/image"
+	"github.com/docker/docker/pkg/system"
 	"github.com/pkg/errors"
 )
 
@@ -33,7 +35,12 @@ func NewTagger(backend ImageComponent, stdout io.Writer, names []string) (*Tagge
 // TagImages creates image tags for the imageID
 func (bt *Tagger) TagImages(imageID image.ID) error {
 	for _, rt := range bt.repoAndTags {
-		if err := bt.imageComponent.TagImageWithReference(imageID, rt); err != nil {
+		// TODO @jhowardmsft LCOW support. Will need revisiting.
+		platform := runtime.GOOS
+		if platform == "windows" && system.LCOWSupported() {
+			platform = "linux"
+		}
+		if err := bt.imageComponent.TagImageWithReference(imageID, platform, rt); err != nil {
 			return err
 		}
 		fmt.Fprintf(bt.stdout, "Successfully tagged %s\n", reference.FamiliarString(rt))
diff --git a/components/engine/api/server/httputils/errors.go b/components/engine/api/server/httputils/errors.go
index 40ff351495..82da21c2a0 100644
--- a/components/engine/api/server/httputils/errors.go
+++ b/components/engine/api/server/httputils/errors.go
@@ -9,6 +9,7 @@ import (
 	"github.com/docker/docker/api/types/versions"
 	"github.com/gorilla/mux"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
 )
 
 // httpStatusError is an interface
@@ -44,11 +45,17 @@ func GetHTTPErrorStatusCode(err error) int {
 	case inputValidationError:
 		statusCode = http.StatusBadRequest
 	default:
+		statusCode = statusCodeFromGRPCError(err)
+		if statusCode != http.StatusInternalServerError {
+			return statusCode
+		}
+
 		// FIXME: this is brittle and should not be necessary, but we still need to identify if
 		// there are errors falling back into this logic.
 		// If we need to differentiate between different possible error types,
 		// we should create appropriate error types that implement the httpStatusError interface.
 		errStr := strings.ToLower(errMsg)
+
 		for _, status := range []struct {
 			keyword string
 			code    int
@@ -66,6 +73,7 @@ func GetHTTPErrorStatusCode(err error) int {
 			{"this node", http.StatusServiceUnavailable},
 			{"needs to be unlocked", http.StatusServiceUnavailable},
 			{"certificates have expired", http.StatusServiceUnavailable},
+			{"repository does not exist", http.StatusNotFound},
 		} {
 			if strings.Contains(errStr, status.keyword) {
 				statusCode = status.code
@@ -102,3 +110,36 @@ func MakeErrorHandler(err error) http.HandlerFunc {
 		}
 	}
 }
+
+// statusCodeFromGRPCError returns status code according to gRPC error
+func statusCodeFromGRPCError(err error) int {
+	switch grpc.Code(err) {
+	case codes.InvalidArgument: // code 3
+		return http.StatusBadRequest
+	case codes.NotFound: // code 5
+		return http.StatusNotFound
+	case codes.AlreadyExists: // code 6
+		return http.StatusConflict
+	case codes.PermissionDenied: // code 7
+		return http.StatusForbidden
+	case codes.FailedPrecondition: // code 9
+		return http.StatusBadRequest
+	case codes.Unauthenticated: // code 16
+		return http.StatusUnauthorized
+	case codes.OutOfRange: // code 11
+		return http.StatusBadRequest
+	case codes.Unimplemented: // code 12
+		return http.StatusNotImplemented
+	case codes.Unavailable: // code 14
+		return http.StatusServiceUnavailable
+	default:
+		// codes.Canceled(1)
+		// codes.Unknown(2)
+		// codes.DeadlineExceeded(4)
+		// codes.ResourceExhausted(8)
+		// codes.Aborted(10)
+		// codes.Internal(13)
+		// codes.DataLoss(15)
+		return http.StatusInternalServerError
+	}
+}
diff --git a/components/engine/api/server/httputils/httputils_write_json.go b/components/engine/api/server/httputils/httputils_write_json.go
index 4787cc3c33..562c127e86 100644
--- a/components/engine/api/server/httputils/httputils_write_json.go
+++ b/components/engine/api/server/httputils/httputils_write_json.go
@@ -1,5 +1,3 @@
-// +build go1.7
-
 package httputils
 
 import (
diff --git a/components/engine/api/server/httputils/httputils_write_json_go16.go b/components/engine/api/server/httputils/httputils_write_json_go16.go
deleted file mode 100644
index bdc6981738..0000000000
--- a/components/engine/api/server/httputils/httputils_write_json_go16.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// +build go1.6,!go1.7
-
-package httputils
-
-import (
-	"encoding/json"
-	"net/http"
-)
-
-// WriteJSON writes the value v to the http response stream as json with standard json encoding.
-func WriteJSON(w http.ResponseWriter, code int, v interface{}) error {
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(code)
-	enc := json.NewEncoder(w)
-	return enc.Encode(v)
-}
diff --git a/components/engine/api/server/middleware/debug.go b/components/engine/api/server/middleware/debug.go
index 8c8567669b..b931f1906b 100644
--- a/components/engine/api/server/middleware/debug.go
+++ b/components/engine/api/server/middleware/debug.go
@@ -64,7 +64,7 @@ func maskSecretKeys(inp interface{}) {
 	if form, ok := inp.(map[string]interface{}); ok {
 	loop0:
 		for k, v := range form {
-			for _, m := range []string{"password", "secret", "jointoken", "unlockkey"} {
+			for _, m := range []string{"password", "secret", "jointoken", "unlockkey", "signingcakey"} {
 				if strings.EqualFold(m, k) {
 					form[k] = "*****"
 					continue loop0
diff --git a/components/engine/api/server/router/build/backend.go b/components/engine/api/server/router/build/backend.go
index 835b11abba..defffd3ef0 100644
--- a/components/engine/api/server/router/build/backend.go
+++ b/components/engine/api/server/router/build/backend.go
@@ -1,6 +1,7 @@
 package build
 
 import (
+	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/backend"
 	"golang.org/x/net/context"
 )
@@ -10,6 +11,9 @@ type Backend interface {
 	// Build a Docker image returning the id of the image
 	// TODO: make this return a reference instead of string
 	Build(context.Context, backend.BuildConfig) (string, error)
+
+	// Prune build cache
+	PruneCache(context.Context) (*types.BuildCachePruneReport, error)
 }
 
 type experimentalProvider interface {
diff --git a/components/engine/api/server/router/build/build.go b/components/engine/api/server/router/build/build.go
index dcf0c53953..78f5ae2f2f 100644
--- a/components/engine/api/server/router/build/build.go
+++ b/components/engine/api/server/router/build/build.go
@@ -24,5 +24,6 @@ func (r *buildRouter) Routes() []router.Route {
 func (r *buildRouter) initRoutes() {
 	r.routes = []router.Route{
 		router.NewPostRoute("/build", r.postBuild, router.WithCancel),
+		router.NewPostRoute("/build/prune", r.postPrune, router.WithCancel),
 	}
 }
diff --git a/components/engine/api/server/router/build/build_routes.go b/components/engine/api/server/router/build/build_routes.go
index 21487f7e85..baa1da303f 100644
--- a/components/engine/api/server/router/build/build_routes.go
+++ b/components/engine/api/server/router/build/build_routes.go
@@ -127,10 +127,19 @@ func newImageBuildOptions(ctx context.Context, r *http.Request) (*types.ImageBui
 		}
 		options.CacheFrom = cacheFrom
 	}
+	options.SessionID = r.FormValue("session")
 
 	return options, nil
 }
 
+func (br *buildRouter) postPrune(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+	report, err := br.backend.PruneCache(ctx)
+	if err != nil {
+		return err
+	}
+	return httputils.WriteJSON(w, http.StatusOK, report)
+}
+
 func (br *buildRouter) postBuild(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	var (
 		notVerboseBuffer = bytes.NewBuffer(nil)
diff --git a/components/engine/api/server/router/image/backend.go b/components/engine/api/server/router/image/backend.go
index 3b9ed96147..9a588a71a9 100644
--- a/components/engine/api/server/router/image/backend.go
+++ b/components/engine/api/server/router/image/backend.go
@@ -35,12 +35,12 @@ type imageBackend interface {
 
 type importExportBackend interface {
 	LoadImage(inTar io.ReadCloser, outStream io.Writer, quiet bool) error
-	ImportImage(src string, repository, tag string, msg string, inConfig io.ReadCloser, outStream io.Writer, changes []string) error
+	ImportImage(src string, repository, platform string, tag string, msg string, inConfig io.ReadCloser, outStream io.Writer, changes []string) error
 	ExportImage(names []string, outStream io.Writer) error
 }
 
 type registryBackend interface {
-	PullImage(ctx context.Context, image, tag string, metaHeaders map[string][]string, authConfig *types.AuthConfig, outStream io.Writer) error
+	PullImage(ctx context.Context, image, tag, platform string, metaHeaders map[string][]string, authConfig *types.AuthConfig, outStream io.Writer) error
 	PushImage(ctx context.Context, image, tag string, metaHeaders map[string][]string, authConfig *types.AuthConfig, outStream io.Writer) error
 	SearchRegistryForImages(ctx context.Context, filtersArgs string, term string, limit int, authConfig *types.AuthConfig, metaHeaders map[string][]string) (*registry.SearchResults, error)
 }
diff --git a/components/engine/api/server/router/image/image_routes.go b/components/engine/api/server/router/image/image_routes.go
index 465182caa1..232d795683 100644
--- a/components/engine/api/server/router/image/image_routes.go
+++ b/components/engine/api/server/router/image/image_routes.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"runtime"
 	"strconv"
 	"strings"
 
@@ -17,6 +18,7 @@ import (
 	"github.com/docker/docker/api/types/versions"
 	"github.com/docker/docker/pkg/ioutils"
 	"github.com/docker/docker/pkg/streamformatter"
+	"github.com/docker/docker/pkg/system"
 	"github.com/docker/docker/registry"
 	"golang.org/x/net/context"
 )
@@ -85,6 +87,41 @@ func (s *imageRouter) postImagesCreate(ctx context.Context, w http.ResponseWrite
 	)
 	defer output.Close()
 
+	// TODO @jhowardmsft LCOW Support: Eventually we will need an API change
+	// so that platform comes from (for example) r.Form.Get("platform"). For
+	// the initial implementation, we assume that the platform is the
+	// runtime OS of the host. It will also need a validation function such
+	// as below which should be called after getting it from the API.
+	//
+	// Ensures the requested platform is valid and normalized
+	//func validatePlatform(req string) (string, error) {
+	//	req = strings.ToLower(req)
+	//	if req == "" {
+	//		req = runtime.GOOS // default to host platform
+	//	}
+	//	valid := []string{runtime.GOOS}
+	//
+	//	if runtime.GOOS == "windows" && system.LCOWSupported() {
+	//		valid = append(valid, "linux")
+	//	}
+	//
+	//	for _, item := range valid {
+	//		if req == item {
+	//			return req, nil
+	//		}
+	//	}
+	//	return "", fmt.Errorf("invalid platform requested: %s", req)
+	//}
+	//
+	// And in the call-site:
+	//	if platform, err = validatePlatform(platform); err != nil {
+	//		return err
+	//	}
+	platform := runtime.GOOS
+	if platform == "windows" && system.LCOWSupported() {
+		platform = "linux"
+	}
+
 	w.Header().Set("Content-Type", "application/json")
 
 	if image != "" { //pull
@@ -106,13 +143,13 @@ func (s *imageRouter) postImagesCreate(ctx context.Context, w http.ResponseWrite
 			}
 		}
 
-		err = s.backend.PullImage(ctx, image, tag, metaHeaders, authConfig, output)
+		err = s.backend.PullImage(ctx, image, tag, platform, metaHeaders, authConfig, output)
 	} else { //import
 		src := r.Form.Get("fromSrc")
 		// 'err' MUST NOT be defined within this block, we need any error
 		// generated from the download to be available to the output
 		// stream processing below
-		err = s.backend.ImportImage(src, repo, tag, message, r.Body, output, r.Form["changes"])
+		err = s.backend.ImportImage(src, repo, platform, tag, message, r.Body, output, r.Form["changes"])
 	}
 	if err != nil {
 		if !output.Flushed() {
diff --git a/components/engine/api/server/router/network/network_routes.go b/components/engine/api/server/router/network/network_routes.go
index 05faffddb1..6f2041e35e 100644
--- a/components/engine/api/server/router/network/network_routes.go
+++ b/components/engine/api/server/router/network/network_routes.go
@@ -98,6 +98,14 @@ func (n *networkRouter) getNetwork(ctx context.Context, w http.ResponseWriter, r
 			return errors.NewBadRequestError(err)
 		}
 	}
+	scope := r.URL.Query().Get("scope")
+
+	isMatchingScope := func(scope, term string) bool {
+		if term != "" {
+			return scope == term
+		}
+		return true
+	}
 
 	// In case multiple networks have duplicate names, return error.
 	// TODO (yongtang): should we wrap with version here for backward compatibility?
@@ -112,15 +120,15 @@ func (n *networkRouter) getNetwork(ctx context.Context, w http.ResponseWriter, r
 
 	nw := n.backend.GetNetworks()
 	for _, network := range nw {
-		if network.ID() == term {
+		if network.ID() == term && isMatchingScope(network.Info().Scope(), scope) {
 			return httputils.WriteJSON(w, http.StatusOK, *n.buildDetailedNetworkResources(network, verbose))
 		}
-		if network.Name() == term {
+		if network.Name() == term && isMatchingScope(network.Info().Scope(), scope) {
 			// No need to check the ID collision here as we are still in
 			// local scope and the network ID is unique in this scope.
 			listByFullName[network.ID()] = *n.buildDetailedNetworkResources(network, verbose)
 		}
-		if strings.HasPrefix(network.ID(), term) {
+		if strings.HasPrefix(network.ID(), term) && isMatchingScope(network.Info().Scope(), scope) {
 			// No need to check the ID collision here as we are still in
 			// local scope and the network ID is unique in this scope.
 			listByPartialID[network.ID()] = *n.buildDetailedNetworkResources(network, verbose)
@@ -129,10 +137,10 @@ func (n *networkRouter) getNetwork(ctx context.Context, w http.ResponseWriter, r
 
 	nr, _ := n.cluster.GetNetworks()
 	for _, network := range nr {
-		if network.ID == term {
+		if network.ID == term && isMatchingScope(network.Scope, scope) {
 			return httputils.WriteJSON(w, http.StatusOK, network)
 		}
-		if network.Name == term {
+		if network.Name == term && isMatchingScope(network.Scope, scope) {
 			// Check the ID collision as we are in swarm scope here, and
 			// the map (of the listByFullName) may have already had a
 			// network with the same ID (from local scope previously)
@@ -140,7 +148,7 @@ func (n *networkRouter) getNetwork(ctx context.Context, w http.ResponseWriter, r
 				listByFullName[network.ID] = network
 			}
 		}
-		if strings.HasPrefix(network.ID, term) {
+		if strings.HasPrefix(network.ID, term) && isMatchingScope(network.Scope, scope) {
 			// Check the ID collision as we are in swarm scope here, and
 			// the map (of the listByPartialID) may have already had a
 			// network with the same ID (from local scope previously)
@@ -410,6 +418,9 @@ func buildIpamResources(r *types.NetworkResource, nwInfo libnetwork.NetworkInfo)
 
 	if !hasIpv6Conf {
 		for _, ip6Info := range ipv6Info {
+			if ip6Info.IPAMData.Pool == nil {
+				continue
+			}
 			iData := network.IPAMConfig{}
 			iData.Subnet = ip6Info.IPAMData.Pool.String()
 			iData.Gateway = ip6Info.IPAMData.Gateway.String()
diff --git a/components/engine/api/server/router/session/backend.go b/components/engine/api/server/router/session/backend.go
new file mode 100644
index 0000000000..ad4cc1bc50
--- /dev/null
+++ b/components/engine/api/server/router/session/backend.go
@@ -0,0 +1,12 @@
+package session
+
+import (
+	"net/http"
+
+	"golang.org/x/net/context"
+)
+
+// Backend abstracts an session receiver from an http request.
+type Backend interface {
+	HandleHTTPRequest(ctx context.Context, w http.ResponseWriter, r *http.Request) error
+}
diff --git a/components/engine/api/server/router/session/session.go b/components/engine/api/server/router/session/session.go
new file mode 100644
index 0000000000..977a9c42c1
--- /dev/null
+++ b/components/engine/api/server/router/session/session.go
@@ -0,0 +1,29 @@
+package session
+
+import "github.com/docker/docker/api/server/router"
+
+// sessionRouter is a router to talk with the session controller
+type sessionRouter struct {
+	backend Backend
+	routes  []router.Route
+}
+
+// NewRouter initializes a new session router
+func NewRouter(b Backend) router.Router {
+	r := &sessionRouter{
+		backend: b,
+	}
+	r.initRoutes()
+	return r
+}
+
+// Routes returns the available routers to the session controller
+func (r *sessionRouter) Routes() []router.Route {
+	return r.routes
+}
+
+func (r *sessionRouter) initRoutes() {
+	r.routes = []router.Route{
+		router.Experimental(router.NewPostRoute("/session", r.startSession)),
+	}
+}
diff --git a/components/engine/api/server/router/session/session_routes.go b/components/engine/api/server/router/session/session_routes.go
new file mode 100644
index 0000000000..ef9753c6ea
--- /dev/null
+++ b/components/engine/api/server/router/session/session_routes.go
@@ -0,0 +1,16 @@
+package session
+
+import (
+	"net/http"
+
+	apierrors "github.com/docker/docker/api/errors"
+	"golang.org/x/net/context"
+)
+
+func (sr *sessionRouter) startSession(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
+	err := sr.backend.HandleHTTPRequest(ctx, w, r)
+	if err != nil {
+		return apierrors.NewBadRequestError(err)
+	}
+	return nil
+}
diff --git a/components/engine/api/server/router/system/system.go b/components/engine/api/server/router/system/system.go
index f8a851cfe3..a64631e8aa 100644
--- a/components/engine/api/server/router/system/system.go
+++ b/components/engine/api/server/router/system/system.go
@@ -2,6 +2,7 @@ package system
 
 import (
 	"github.com/docker/docker/api/server/router"
+	"github.com/docker/docker/builder/fscache"
 	"github.com/docker/docker/daemon/cluster"
 )
 
@@ -11,13 +12,15 @@ type systemRouter struct {
 	backend Backend
 	cluster *cluster.Cluster
 	routes  []router.Route
+	builder *fscache.FSCache
 }
 
 // NewRouter initializes a new system router
-func NewRouter(b Backend, c *cluster.Cluster) router.Router {
+func NewRouter(b Backend, c *cluster.Cluster, fscache *fscache.FSCache) router.Router {
 	r := &systemRouter{
 		backend: b,
 		cluster: c,
+		builder: fscache,
 	}
 
 	r.routes = []router.Route{
diff --git a/components/engine/api/server/router/system/system_routes.go b/components/engine/api/server/router/system/system_routes.go
index 7d3ba9a6ec..30fb000e1d 100644
--- a/components/engine/api/server/router/system/system_routes.go
+++ b/components/engine/api/server/router/system/system_routes.go
@@ -17,6 +17,7 @@ import (
 	timetypes "github.com/docker/docker/api/types/time"
 	"github.com/docker/docker/api/types/versions"
 	"github.com/docker/docker/pkg/ioutils"
+	pkgerrors "github.com/pkg/errors"
 	"golang.org/x/net/context"
 )
 
@@ -75,6 +76,11 @@ func (s *systemRouter) getDiskUsage(ctx context.Context, w http.ResponseWriter,
 	if err != nil {
 		return err
 	}
+	builderSize, err := s.builder.DiskUsage()
+	if err != nil {
+		return pkgerrors.Wrap(err, "error getting build cache usage")
+	}
+	du.BuilderSize = builderSize
 
 	return httputils.WriteJSON(w, http.StatusOK, du)
 }
diff --git a/components/engine/api/swagger.yaml b/components/engine/api/swagger.yaml
index 14b5e4864c..b4c1bd8b15 100644
--- a/components/engine/api/swagger.yaml
+++ b/components/engine/api/swagger.yaml
@@ -19,10 +19,10 @@ produces:
 consumes:
   - "application/json"
   - "text/plain"
-basePath: "/v1.30"
+basePath: "/v1.31"
 info:
   title: "Docker Engine API"
-  version: "1.30"
+  version: "1.31"
   x-logo:
     url: "https://docs.docker.com/images/logo-docker-main.png"
   description: |
@@ -52,10 +52,11 @@ info:
 
     The API uses an open schema model, which means server may add extra properties to responses. Likewise, the server will ignore any extra query parameters and request body properties. When you write clients, you need to ignore additional properties in responses to ensure they do not break when talking to newer Docker daemons.
 
-    This documentation is for version 1.30 of the API, which was introduced with Docker 17.06. Use this table to find documentation for previous versions of the API:
+    This documentation is for version 1.31 of the API. Use this table to find documentation for previous versions of the API:
 
     Docker version  | API version | Changes
     ----------------|-------------|---------
+    17.06.x | [1.30](https://docs.docker.com/engine/api/v1.30/) | [API changes](https://docs.docker.com/engine/api/version-history/#v1-30-api-changes)
     17.05.x | [1.29](https://docs.docker.com/engine/api/v1.29/) | [API changes](https://docs.docker.com/engine/api/version-history/#v1-29-api-changes)
     17.04.x | [1.28](https://docs.docker.com/engine/api/v1.28/) | [API changes](https://docs.docker.com/engine/api/version-history/#v1-28-api-changes)
     17.03.1 | [1.27](https://docs.docker.com/engine/api/v1.27/) | [API changes](https://docs.docker.com/engine/api/version-history/#v1-27-api-changes)
@@ -2698,6 +2699,11 @@ paths:
   /containers/json:
     get:
       summary: "List containers"
+      description: |
+        Returns a list of containers. For details on the format, see [the inspect endpoint](#operation/ContainerInspect).
+
+        Note that it uses a different, smaller representation of a container than inspecting a single container. For example,
+        the list of linked containers is not propagated .
       operationId: "ContainerList"
       produces:
         - "application/json"
@@ -4739,6 +4745,27 @@ paths:
           schema:
             $ref: "#/definitions/ErrorResponse"
       tags: ["Image"]
+  /build/prune:
+    post:
+      summary: "Delete builder cache"
+      produces:
+        - "application/json"
+      operationId: "BuildPrune"
+      responses:
+        200:
+          description: "No error"
+          schema:
+            type: "object"
+            properties:
+              SpaceReclaimed:
+                description: "Disk space reclaimed in bytes"
+                type: "integer"
+                format: "int64"
+        500:
+          description: "Server error"
+          schema:
+            $ref: "#/definitions/ErrorResponse"
+      tags: ["Image"]
   /images/create:
     post:
       summary: "Create an image"
@@ -6431,6 +6458,10 @@ paths:
           description: "Detailed inspect output for troubleshooting"
           type: "boolean"
           default: false
+        - name: "scope"
+          in: "query"
+          description: "Filter the network by scope (swarm, global, or local)"
+          type: "string"
       tags: ["Network"]
 
     delete:
@@ -8471,3 +8502,46 @@ paths:
           type: "string"
           required: true
       tags: ["Distribution"]
+  /session:
+    post:
+      summary: "Initialize interactive session"
+      description: |
+        Start a new interactive session with a server. Session allows server to call back to the client for advanced capabilities.
+
+        > **Note**: This endpoint is *experimental* and only available if the daemon is started with experimental
+        > features enabled. The specifications for this endpoint may still change in a future version of the API.
+
+        ### Hijacking
+
+        This endpoint hijacks the HTTP connection to HTTP2 transport that allows the client to expose gPRC services on that connection.
+
+        For example, the client sends this request to upgrade the connection:
+
+        ```
+        POST /session HTTP/1.1
+        Upgrade: h2c
+        Connection: Upgrade
+        ```
+
+        The Docker daemon will respond with a `101 UPGRADED` response follow with the raw stream:
+
+        ```
+        HTTP/1.1 101 UPGRADED
+        Connection: Upgrade
+        Upgrade: h2c
+        ```
+      operationId: "Session"
+      produces:
+        - "application/vnd.docker.raw-stream"
+      responses:
+        101:
+          description: "no error, hijacking successful"
+        400:
+          description: "bad parameter"
+          schema:
+            $ref: "#/definitions/ErrorResponse"
+        500:
+          description: "server error"
+          schema:
+            $ref: "#/definitions/ErrorResponse"
+      tags: ["Session (experimental)"]
diff --git a/components/engine/api/types/backend/build.go b/components/engine/api/types/backend/build.go
index 5de35e6d88..300d358969 100644
--- a/components/engine/api/types/backend/build.go
+++ b/components/engine/api/types/backend/build.go
@@ -7,6 +7,18 @@ import (
 	"github.com/docker/docker/pkg/streamformatter"
 )
 
+// PullOption defines different modes for accessing images
+type PullOption int
+
+const (
+	// PullOptionNoPull only returns local images
+	PullOptionNoPull PullOption = iota
+	// PullOptionForcePull always tries to pull a ref from the registry first
+	PullOptionForcePull
+	// PullOptionPreferLocal uses local image if it exists, otherwise pulls
+	PullOptionPreferLocal
+)
+
 // ProgressWriter is a data object to transport progress streams to the client
 type ProgressWriter struct {
 	Output             io.Writer
@@ -25,7 +37,8 @@ type BuildConfig struct {
 
 // GetImageAndLayerOptions are the options supported by GetImageAndReleasableLayer
 type GetImageAndLayerOptions struct {
-	ForcePull  bool
+	PullOption PullOption
 	AuthConfig map[string]types.AuthConfig
 	Output     io.Writer
+	Platform   string
 }
diff --git a/components/engine/api/types/client.go b/components/engine/api/types/client.go
index 0ce2c94303..18a1263f10 100644
--- a/components/engine/api/types/client.go
+++ b/components/engine/api/types/client.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
-	"github.com/docker/go-units"
+	units "github.com/docker/go-units"
 )
 
 // CheckpointCreateOptions holds parameters to create a checkpoint from a container
@@ -178,6 +178,11 @@ type ImageBuildOptions struct {
 	SecurityOpt []string
 	ExtraHosts  []string // List of extra hosts
 	Target      string
+	SessionID   string
+
+	// TODO @jhowardmsft LCOW Support: This will require extending to include
+	// `Platform string`, but is ommited for now as it's hard-coded temporarily
+	// to avoid API changes.
 }
 
 // ImageBuildResponse holds information
diff --git a/components/engine/api/types/configs.go b/components/engine/api/types/configs.go
index 20c19f2132..e4d2ce6e36 100644
--- a/components/engine/api/types/configs.go
+++ b/components/engine/api/types/configs.go
@@ -16,6 +16,7 @@ type ContainerCreateConfig struct {
 	HostConfig       *container.HostConfig
 	NetworkingConfig *network.NetworkingConfig
 	AdjustCPUShares  bool
+	Platform         string
 }
 
 // ContainerRmConfig holds arguments for the container remove
diff --git a/components/engine/api/types/types.go b/components/engine/api/types/types.go
index c905466e29..2473497c89 100644
--- a/components/engine/api/types/types.go
+++ b/components/engine/api/types/types.go
@@ -320,6 +320,7 @@ type ContainerJSONBase struct {
 	Name            string
 	RestartCount    int
 	Driver          string
+	Platform        string
 	MountLabel      string
 	ProcessLabel    string
 	AppArmorProfile string
@@ -468,6 +469,12 @@ type NetworkDisconnect struct {
 	Force     bool
 }
 
+// NetworkInspectOptions holds parameters to inspect network
+type NetworkInspectOptions struct {
+	Scope   string
+	Verbose bool
+}
+
 // Checkpoint represents the details of a checkpoint
 type Checkpoint struct {
 	Name string // Name is the name of the checkpoint
@@ -482,10 +489,11 @@ type Runtime struct {
 // DiskUsage contains response of Engine API:
 // GET "/system/df"
 type DiskUsage struct {
-	LayersSize int64
-	Images     []*ImageSummary
-	Containers []*Container
-	Volumes    []*Volume
+	LayersSize  int64
+	Images      []*ImageSummary
+	Containers  []*Container
+	Volumes     []*Volume
+	BuilderSize int64
 }
 
 // ContainersPruneReport contains the response for Engine API:
@@ -509,6 +517,12 @@ type ImagesPruneReport struct {
 	SpaceReclaimed uint64
 }
 
+// BuildCachePruneReport contains the response for Engine API:
+// POST "/build/prune"
+type BuildCachePruneReport struct {
+	SpaceReclaimed uint64
+}
+
 // NetworksPruneReport contains the response for Engine API:
 // POST "/networks/prune"
 type NetworksPruneReport struct {
diff --git a/components/engine/builder/builder.go b/components/engine/builder/builder.go
index 1aea99ea90..e480601d46 100644
--- a/components/engine/builder/builder.go
+++ b/components/engine/builder/builder.go
@@ -11,6 +11,7 @@ import (
 	"github.com/docker/docker/api/types/backend"
 	"github.com/docker/docker/api/types/container"
 	containerpkg "github.com/docker/docker/container"
+	"github.com/docker/docker/layer"
 	"golang.org/x/net/context"
 )
 
@@ -42,11 +43,7 @@ type Backend interface {
 	// ContainerCreateWorkdir creates the workdir
 	ContainerCreateWorkdir(containerID string) error
 
-	// ContainerCopy copies/extracts a source FileInfo to a destination path inside a container
-	// specified by a container object.
-	// TODO: extract in the builder instead of passing `decompress`
-	// TODO: use containerd/fs.changestream instead as a source
-	CopyOnBuild(containerID string, destPath string, srcRoot string, srcPath string, decompress bool) error
+	CreateImage(config []byte, parent string, platform string) (Image, error)
 
 	ImageCacheBuilder
 }
@@ -81,7 +78,7 @@ type Result struct {
 // ImageCacheBuilder represents a generator for stateful image cache.
 type ImageCacheBuilder interface {
 	// MakeImageCache creates a stateful image cache.
-	MakeImageCache(cacheFrom []string) ImageCache
+	MakeImageCache(cacheFrom []string, platform string) ImageCache
 }
 
 // ImageCache abstracts an image cache.
@@ -96,10 +93,13 @@ type ImageCache interface {
 type Image interface {
 	ImageID() string
 	RunConfig() *container.Config
+	MarshalJSON() ([]byte, error)
 }
 
 // ReleaseableLayer is an image layer that can be mounted and released
 type ReleaseableLayer interface {
 	Release() error
 	Mount() (string, error)
+	Commit(platform string) (ReleaseableLayer, error)
+	DiffID() layer.DiffID
 }
diff --git a/components/engine/builder/dockerfile/builder.go b/components/engine/builder/dockerfile/builder.go
index f507766220..80cfaf0bc2 100644
--- a/components/engine/builder/dockerfile/builder.go
+++ b/components/engine/builder/dockerfile/builder.go
@@ -5,7 +5,9 @@ import (
 	"fmt"
 	"io"
 	"io/ioutil"
+	"runtime"
 	"strings"
+	"time"
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/api/types"
@@ -14,9 +16,15 @@ import (
 	"github.com/docker/docker/builder"
 	"github.com/docker/docker/builder/dockerfile/command"
 	"github.com/docker/docker/builder/dockerfile/parser"
+	"github.com/docker/docker/builder/fscache"
 	"github.com/docker/docker/builder/remotecontext"
+	"github.com/docker/docker/client/session"
+	"github.com/docker/docker/pkg/archive"
+	"github.com/docker/docker/pkg/chrootarchive"
+	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/streamformatter"
 	"github.com/docker/docker/pkg/stringid"
+	"github.com/docker/docker/pkg/system"
 	"github.com/pkg/errors"
 	"golang.org/x/net/context"
 	"golang.org/x/sync/syncmap"
@@ -35,18 +43,33 @@ var validCommitCommands = map[string]bool{
 	"workdir":     true,
 }
 
+// SessionGetter is object used to get access to a session by uuid
+type SessionGetter interface {
+	Get(ctx context.Context, uuid string) (session.Caller, error)
+}
+
 // BuildManager is shared across all Builder objects
 type BuildManager struct {
+	archiver  *archive.Archiver
 	backend   builder.Backend
 	pathCache pathCache // TODO: make this persistent
+	sg        SessionGetter
+	fsCache   *fscache.FSCache
 }
 
 // NewBuildManager creates a BuildManager
-func NewBuildManager(b builder.Backend) *BuildManager {
-	return &BuildManager{
+func NewBuildManager(b builder.Backend, sg SessionGetter, fsCache *fscache.FSCache, idMappings *idtools.IDMappings) (*BuildManager, error) {
+	bm := &BuildManager{
 		backend:   b,
 		pathCache: &syncmap.Map{},
+		sg:        sg,
+		archiver:  chrootarchive.NewArchiver(idMappings),
+		fsCache:   fsCache,
 	}
+	if err := fsCache.RegisterTransport(remotecontext.ClientSessionRemote, NewClientSessionTransport()); err != nil {
+		return nil, err
+	}
+	return bm, nil
 }
 
 // Build starts a new build from a BuildConfig
@@ -60,12 +83,30 @@ func (bm *BuildManager) Build(ctx context.Context, config backend.BuildConfig) (
 	if err != nil {
 		return nil, err
 	}
-	if source != nil {
-		defer func() {
+	defer func() {
+		if source != nil {
 			if err := source.Close(); err != nil {
 				logrus.Debugf("[BUILDER] failed to remove temporary context: %v", err)
 			}
-		}()
+		}
+	}()
+
+	// TODO @jhowardmsft LCOW support - this will require rework to allow both linux and Windows simultaneously.
+	// This is an interim solution to hardcode to linux if LCOW is turned on.
+	if dockerfile.Platform == "" {
+		dockerfile.Platform = runtime.GOOS
+		if dockerfile.Platform == "windows" && system.LCOWSupported() {
+			dockerfile.Platform = "linux"
+		}
+	}
+
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	if src, err := bm.initializeClientSession(ctx, cancel, config.Options); err != nil {
+		return nil, err
+	} else if src != nil {
+		source = src
 	}
 
 	builderOptions := builderOptions{
@@ -73,16 +114,55 @@ func (bm *BuildManager) Build(ctx context.Context, config backend.BuildConfig) (
 		ProgressWriter: config.ProgressWriter,
 		Backend:        bm.backend,
 		PathCache:      bm.pathCache,
+		Archiver:       bm.archiver,
+		Platform:       dockerfile.Platform,
 	}
+
 	return newBuilder(ctx, builderOptions).build(source, dockerfile)
 }
 
+func (bm *BuildManager) initializeClientSession(ctx context.Context, cancel func(), options *types.ImageBuildOptions) (builder.Source, error) {
+	if options.SessionID == "" || bm.sg == nil {
+		return nil, nil
+	}
+	logrus.Debug("client is session enabled")
+
+	ctx, cancelCtx := context.WithTimeout(ctx, sessionConnectTimeout)
+	defer cancelCtx()
+
+	c, err := bm.sg.Get(ctx, options.SessionID)
+	if err != nil {
+		return nil, err
+	}
+	go func() {
+		<-c.Context().Done()
+		cancel()
+	}()
+	if options.RemoteContext == remotecontext.ClientSessionRemote {
+		st := time.Now()
+		csi, err := NewClientSessionSourceIdentifier(ctx, bm.sg,
+			options.SessionID, []string{"/"})
+		if err != nil {
+			return nil, err
+		}
+		src, err := bm.fsCache.SyncFrom(ctx, csi)
+		if err != nil {
+			return nil, err
+		}
+		logrus.Debugf("sync-time: %v", time.Since(st))
+		return src, nil
+	}
+	return nil, nil
+}
+
 // builderOptions are the dependencies required by the builder
 type builderOptions struct {
 	Options        *types.ImageBuildOptions
 	Backend        builder.Backend
 	ProgressWriter backend.ProgressWriter
 	PathCache      pathCache
+	Archiver       *archive.Archiver
+	Platform       string
 }
 
 // Builder is a Dockerfile builder
@@ -98,6 +178,7 @@ type Builder struct {
 	docker    builder.Backend
 	clientCtx context.Context
 
+	archiver         *archive.Archiver
 	buildStages      *buildStages
 	disableCommit    bool
 	buildArgs        *buildArgs
@@ -105,14 +186,32 @@ type Builder struct {
 	pathCache        pathCache
 	containerManager *containerManager
 	imageProber      ImageProber
+
+	// TODO @jhowardmft LCOW Support. This will be moved to options at a later
+	// stage, however that cannot be done now as it affects the public API
+	// if it were.
+	platform string
 }
 
 // newBuilder creates a new Dockerfile builder from an optional dockerfile and a Options.
+// TODO @jhowardmsft LCOW support: Eventually platform can be moved into the builder
+// options, however, that would be an API change as it shares types.ImageBuildOptions.
 func newBuilder(clientCtx context.Context, options builderOptions) *Builder {
 	config := options.Options
 	if config == nil {
 		config = new(types.ImageBuildOptions)
 	}
+
+	// @jhowardmsft LCOW Support. For the time being, this is interim. Eventually
+	// will be moved to types.ImageBuildOptions, but it can't for now as that would
+	// be an API change.
+	if options.Platform == "" {
+		options.Platform = runtime.GOOS
+	}
+	if options.Platform == "windows" && system.LCOWSupported() {
+		options.Platform = "linux"
+	}
+
 	b := &Builder{
 		clientCtx:        clientCtx,
 		options:          config,
@@ -121,13 +220,16 @@ func newBuilder(clientCtx context.Context, options builderOptions) *Builder {
 		Aux:              options.ProgressWriter.AuxFormatter,
 		Output:           options.ProgressWriter.Output,
 		docker:           options.Backend,
+		archiver:         options.Archiver,
 		buildArgs:        newBuildArgs(config.BuildArgs),
 		buildStages:      newBuildStages(),
 		imageSources:     newImageSources(clientCtx, options),
 		pathCache:        options.PathCache,
-		imageProber:      newImageProber(options.Backend, config.CacheFrom, config.NoCache),
+		imageProber:      newImageProber(options.Backend, config.CacheFrom, options.Platform, config.NoCache),
 		containerManager: newContainerManager(options.Backend),
+		platform:         options.Platform,
 	}
+
 	return b
 }
 
@@ -258,6 +360,17 @@ func BuildFromConfig(config *container.Config, changes []string) (*container.Con
 		return nil, err
 	}
 
+	// TODO @jhowardmsft LCOW support. For now, if LCOW enabled, switch to linux.
+	// Also explicitly set the platform. Ultimately this will be in the builder
+	// options, but we can't do that yet as it would change the API.
+	if dockerfile.Platform == "" {
+		dockerfile.Platform = runtime.GOOS
+	}
+	if dockerfile.Platform == "windows" && system.LCOWSupported() {
+		dockerfile.Platform = "linux"
+	}
+	b.platform = dockerfile.Platform
+
 	// ensure that the commands are valid
 	for _, n := range dockerfile.AST.Children {
 		if !validCommitCommands[n.Value] {
@@ -274,7 +387,7 @@ func BuildFromConfig(config *container.Config, changes []string) (*container.Con
 	}
 	dispatchState := newDispatchState()
 	dispatchState.runConfig = config
-	return dispatchFromDockerfile(b, dockerfile, dispatchState)
+	return dispatchFromDockerfile(b, dockerfile, dispatchState, nil)
 }
 
 func checkDispatchDockerfile(dockerfile *parser.Node) error {
@@ -286,7 +399,7 @@ func checkDispatchDockerfile(dockerfile *parser.Node) error {
 	return nil
 }
 
-func dispatchFromDockerfile(b *Builder, result *parser.Result, dispatchState *dispatchState) (*container.Config, error) {
+func dispatchFromDockerfile(b *Builder, result *parser.Result, dispatchState *dispatchState, source builder.Source) (*container.Config, error) {
 	shlex := NewShellLex(result.EscapeToken)
 	ast := result.AST
 	total := len(ast.Children)
@@ -297,6 +410,7 @@ func dispatchFromDockerfile(b *Builder, result *parser.Result, dispatchState *di
 			stepMsg: formatStep(i, total),
 			node:    n,
 			shlex:   shlex,
+			source:  source,
 		}
 		if _, err := b.dispatch(opts); err != nil {
 			return nil, err
diff --git a/components/engine/builder/dockerfile/builder_unix.go b/components/engine/builder/dockerfile/builder_unix.go
index 76a7ce74f9..5ea63da824 100644
--- a/components/engine/builder/dockerfile/builder_unix.go
+++ b/components/engine/builder/dockerfile/builder_unix.go
@@ -2,4 +2,6 @@
 
 package dockerfile
 
-var defaultShell = []string{"/bin/sh", "-c"}
+func defaultShellForPlatform(platform string) []string {
+	return []string{"/bin/sh", "-c"}
+}
diff --git a/components/engine/builder/dockerfile/builder_windows.go b/components/engine/builder/dockerfile/builder_windows.go
index 37e9fbcf4b..7bfef3238b 100644
--- a/components/engine/builder/dockerfile/builder_windows.go
+++ b/components/engine/builder/dockerfile/builder_windows.go
@@ -1,3 +1,8 @@
 package dockerfile
 
-var defaultShell = []string{"cmd", "/S", "/C"}
+func defaultShellForPlatform(platform string) []string {
+	if platform == "linux" {
+		return []string{"/bin/sh", "-c"}
+	}
+	return []string{"cmd", "/S", "/C"}
+}
diff --git a/components/engine/builder/dockerfile/clientsession.go b/components/engine/builder/dockerfile/clientsession.go
new file mode 100644
index 0000000000..647e4537c3
--- /dev/null
+++ b/components/engine/builder/dockerfile/clientsession.go
@@ -0,0 +1,78 @@
+package dockerfile
+
+import (
+	"time"
+
+	"github.com/docker/docker/builder/fscache"
+	"github.com/docker/docker/builder/remotecontext"
+	"github.com/docker/docker/client/session"
+	"github.com/docker/docker/client/session/filesync"
+	"github.com/pkg/errors"
+	"golang.org/x/net/context"
+)
+
+const sessionConnectTimeout = 5 * time.Second
+
+// ClientSessionTransport is a transport for copying files from docker client
+// to the daemon.
+type ClientSessionTransport struct{}
+
+// NewClientSessionTransport returns new ClientSessionTransport instance
+func NewClientSessionTransport() *ClientSessionTransport {
+	return &ClientSessionTransport{}
+}
+
+// Copy data from a remote to a destination directory.
+func (cst *ClientSessionTransport) Copy(ctx context.Context, id fscache.RemoteIdentifier, dest string, cu filesync.CacheUpdater) error {
+	csi, ok := id.(*ClientSessionSourceIdentifier)
+	if !ok {
+		return errors.New("invalid identifier for client session")
+	}
+
+	return filesync.FSSync(ctx, csi.caller, filesync.FSSendRequestOpt{
+		SrcPaths:     csi.srcPaths,
+		DestDir:      dest,
+		CacheUpdater: cu,
+	})
+}
+
+// ClientSessionSourceIdentifier is an identifier that can be used for requesting
+// files from remote client
+type ClientSessionSourceIdentifier struct {
+	srcPaths  []string
+	caller    session.Caller
+	sharedKey string
+	uuid      string
+}
+
+// NewClientSessionSourceIdentifier returns new ClientSessionSourceIdentifier instance
+func NewClientSessionSourceIdentifier(ctx context.Context, sg SessionGetter, uuid string, sources []string) (*ClientSessionSourceIdentifier, error) {
+	csi := &ClientSessionSourceIdentifier{
+		uuid:     uuid,
+		srcPaths: sources,
+	}
+	caller, err := sg.Get(ctx, uuid)
+	if err != nil {
+		return nil, errors.Wrapf(err, "failed to get session for %s", uuid)
+	}
+
+	csi.caller = caller
+	return csi, nil
+}
+
+// Transport returns transport identifier for remote identifier
+func (csi *ClientSessionSourceIdentifier) Transport() string {
+	return remotecontext.ClientSessionRemote
+}
+
+// SharedKey returns shared key for remote identifier. Shared key is used
+// for finding the base for a repeated transfer.
+func (csi *ClientSessionSourceIdentifier) SharedKey() string {
+	return csi.caller.SharedKey()
+}
+
+// Key returns unique key for remote identifier. Requests with same key return
+// same data.
+func (csi *ClientSessionSourceIdentifier) Key() string {
+	return csi.uuid
+}
diff --git a/components/engine/builder/dockerfile/containerbackend.go b/components/engine/builder/dockerfile/containerbackend.go
index aa8001ae60..7b241f3d3b 100644
--- a/components/engine/builder/dockerfile/containerbackend.go
+++ b/components/engine/builder/dockerfile/containerbackend.go
@@ -28,10 +28,11 @@ func newContainerManager(docker builder.ExecBackend) *containerManager {
 }
 
 // Create a container
-func (c *containerManager) Create(runConfig *container.Config, hostConfig *container.HostConfig) (container.ContainerCreateCreatedBody, error) {
+func (c *containerManager) Create(runConfig *container.Config, hostConfig *container.HostConfig, platform string) (container.ContainerCreateCreatedBody, error) {
 	container, err := c.backend.ContainerCreate(types.ContainerCreateConfig{
 		Config:     runConfig,
 		HostConfig: hostConfig,
+		Platform:   platform,
 	})
 	if err != nil {
 		return container, err
diff --git a/components/engine/builder/dockerfile/copy.go b/components/engine/builder/dockerfile/copy.go
index 77f0a44d55..0026bdc158 100644
--- a/components/engine/builder/dockerfile/copy.go
+++ b/components/engine/builder/dockerfile/copy.go
@@ -13,10 +13,12 @@ import (
 
 	"github.com/docker/docker/builder"
 	"github.com/docker/docker/builder/remotecontext"
-	"github.com/docker/docker/pkg/httputils"
+	"github.com/docker/docker/pkg/archive"
+	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/ioutils"
 	"github.com/docker/docker/pkg/progress"
 	"github.com/docker/docker/pkg/streamformatter"
+	"github.com/docker/docker/pkg/symlink"
 	"github.com/docker/docker/pkg/system"
 	"github.com/docker/docker/pkg/urlutil"
 	"github.com/pkg/errors"
@@ -35,6 +37,10 @@ type copyInfo struct {
 	hash string
 }
 
+func (c copyInfo) fullPath() (string, error) {
+	return symlink.FollowSymlinkInScope(filepath.Join(c.root, c.path), c.root)
+}
+
 func newCopyInfoFromSource(source builder.Source, path string, hash string) copyInfo {
 	return copyInfo{root: source.Root(), path: path, hash: hash}
 }
@@ -149,7 +155,7 @@ func (o *copier) calcCopyInfo(origPath string, allowWildcards bool) ([]copyInfo,
 		var err error
 		o.source, err = imageSource.Source()
 		if err != nil {
-			return nil, errors.Wrapf(err, "failed to copy")
+			return nil, errors.Wrapf(err, "failed to copy from %s", imageSource.ImageID())
 		}
 	}
 
@@ -292,7 +298,6 @@ func errOnSourceDownload(_ string) (builder.Source, string, error) {
 }
 
 func downloadSource(output io.Writer, stdout io.Writer, srcURL string) (remote builder.Source, p string, err error) {
-	// get filename from URL
 	u, err := url.Parse(srcURL)
 	if err != nil {
 		return
@@ -303,8 +308,7 @@ func downloadSource(output io.Writer, stdout io.Writer, srcURL string) (remote b
 		return
 	}
 
-	// Initiate the download
-	resp, err := httputils.Download(srcURL)
+	resp, err := remotecontext.GetWithStatusError(srcURL)
 	if err != nil {
 		return
 	}
@@ -355,6 +359,83 @@ func downloadSource(output io.Writer, stdout io.Writer, srcURL string) (remote b
 		return
 	}
 
-	lc, err := remotecontext.NewLazyContext(tmpDir)
+	lc, err := remotecontext.NewLazySource(tmpDir)
 	return lc, filename, err
 }
+
+type copyFileOptions struct {
+	decompress bool
+	archiver   *archive.Archiver
+}
+
+func performCopyForInfo(dest copyInfo, source copyInfo, options copyFileOptions) error {
+	srcPath, err := source.fullPath()
+	if err != nil {
+		return err
+	}
+	destPath, err := dest.fullPath()
+	if err != nil {
+		return err
+	}
+
+	archiver := options.archiver
+
+	src, err := os.Stat(srcPath)
+	if err != nil {
+		return errors.Wrapf(err, "source path not found")
+	}
+	if src.IsDir() {
+		return copyDirectory(archiver, srcPath, destPath)
+	}
+	if options.decompress && archive.IsArchivePath(srcPath) {
+		return archiver.UntarPath(srcPath, destPath)
+	}
+
+	destExistsAsDir, err := isExistingDirectory(destPath)
+	if err != nil {
+		return err
+	}
+	// dest.path must be used because destPath has already been cleaned of any
+	// trailing slash
+	if endsInSlash(dest.path) || destExistsAsDir {
+		// source.path must be used to get the correct filename when the source
+		// is a symlink
+		destPath = filepath.Join(destPath, filepath.Base(source.path))
+	}
+	return copyFile(archiver, srcPath, destPath)
+}
+
+func copyDirectory(archiver *archive.Archiver, source, dest string) error {
+	if err := archiver.CopyWithTar(source, dest); err != nil {
+		return errors.Wrapf(err, "failed to copy directory")
+	}
+	return fixPermissions(source, dest, archiver.IDMappings.RootPair())
+}
+
+func copyFile(archiver *archive.Archiver, source, dest string) error {
+	rootIDs := archiver.IDMappings.RootPair()
+
+	if err := idtools.MkdirAllAndChownNew(filepath.Dir(dest), 0755, rootIDs); err != nil {
+		return errors.Wrapf(err, "failed to create new directory")
+	}
+	if err := archiver.CopyFileWithTar(source, dest); err != nil {
+		return errors.Wrapf(err, "failed to copy file")
+	}
+	return fixPermissions(source, dest, rootIDs)
+}
+
+func endsInSlash(path string) bool {
+	return strings.HasSuffix(path, string(os.PathSeparator))
+}
+
+// isExistingDirectory returns true if the path exists and is a directory
+func isExistingDirectory(path string) (bool, error) {
+	destStat, err := os.Stat(path)
+	switch {
+	case os.IsNotExist(err):
+		return false, nil
+	case err != nil:
+		return false, err
+	}
+	return destStat.IsDir(), nil
+}
diff --git a/components/engine/builder/dockerfile/copy_test.go b/components/engine/builder/dockerfile/copy_test.go
new file mode 100644
index 0000000000..aee225b5ff
--- /dev/null
+++ b/components/engine/builder/dockerfile/copy_test.go
@@ -0,0 +1,45 @@
+package dockerfile
+
+import (
+	"testing"
+
+	"github.com/docker/docker/pkg/testutil/tempfile"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsExistingDirectory(t *testing.T) {
+	tmpfile := tempfile.NewTempFile(t, "file-exists-test", "something")
+	defer tmpfile.Remove()
+	tmpdir := tempfile.NewTempDir(t, "dir-exists-test")
+	defer tmpdir.Remove()
+
+	var testcases = []struct {
+		doc      string
+		path     string
+		expected bool
+	}{
+		{
+			doc:      "directory exists",
+			path:     tmpdir.Path,
+			expected: true,
+		},
+		{
+			doc:      "path doesn't exist",
+			path:     "/bogus/path/does/not/exist",
+			expected: false,
+		},
+		{
+			doc:      "file exists",
+			path:     tmpfile.Name(),
+			expected: false,
+		},
+	}
+
+	for _, testcase := range testcases {
+		result, err := isExistingDirectory(testcase.path)
+		if !assert.NoError(t, err) {
+			continue
+		}
+		assert.Equal(t, testcase.expected, result, testcase.doc)
+	}
+}
diff --git a/components/engine/builder/dockerfile/copy_unix.go b/components/engine/builder/dockerfile/copy_unix.go
new file mode 100644
index 0000000000..326d95bb39
--- /dev/null
+++ b/components/engine/builder/dockerfile/copy_unix.go
@@ -0,0 +1,36 @@
+// +build !windows
+
+package dockerfile
+
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/docker/docker/pkg/idtools"
+)
+
+func fixPermissions(source, destination string, rootIDs idtools.IDPair) error {
+	skipChownRoot, err := isExistingDirectory(destination)
+	if err != nil {
+		return err
+	}
+
+	// We Walk on the source rather than on the destination because we don't
+	// want to change permissions on things we haven't created or modified.
+	return filepath.Walk(source, func(fullpath string, info os.FileInfo, err error) error {
+		// Do not alter the walk root iff. it existed before, as it doesn't fall under
+		// the domain of "things we should chown".
+		if skipChownRoot && source == fullpath {
+			return nil
+		}
+
+		// Path is prefixed by source: substitute with destination instead.
+		cleaned, err := filepath.Rel(source, fullpath)
+		if err != nil {
+			return err
+		}
+
+		fullpath = filepath.Join(destination, cleaned)
+		return os.Lchown(fullpath, rootIDs.UID, rootIDs.GID)
+	})
+}
diff --git a/components/engine/builder/dockerfile/copy_windows.go b/components/engine/builder/dockerfile/copy_windows.go
new file mode 100644
index 0000000000..78f5b09457
--- /dev/null
+++ b/components/engine/builder/dockerfile/copy_windows.go
@@ -0,0 +1,8 @@
+package dockerfile
+
+import "github.com/docker/docker/pkg/idtools"
+
+func fixPermissions(source, destination string, rootIDs idtools.IDPair) error {
+	// chown is not supported on Windows
+	return nil
+}
diff --git a/components/engine/builder/dockerfile/dispatchers.go b/components/engine/builder/dockerfile/dispatchers.go
index dd5714ecb0..1f74241248 100644
--- a/components/engine/builder/dockerfile/dispatchers.go
+++ b/components/engine/builder/dockerfile/dispatchers.go
@@ -23,8 +23,10 @@ import (
 	"github.com/docker/docker/api/types/strslice"
 	"github.com/docker/docker/builder"
 	"github.com/docker/docker/builder/dockerfile/parser"
+	"github.com/docker/docker/image"
 	"github.com/docker/docker/pkg/jsonmessage"
 	"github.com/docker/docker/pkg/signal"
+	"github.com/docker/docker/pkg/system"
 	"github.com/docker/go-connections/nat"
 	"github.com/pkg/errors"
 )
@@ -195,6 +197,7 @@ func (b *Builder) getImageMount(fromFlag *Flag) (*imageMount, error) {
 		return nil, nil
 	}
 
+	var localOnly bool
 	imageRefOrID := fromFlag.Value
 	stage, err := b.buildStages.get(fromFlag.Value)
 	if err != nil {
@@ -202,8 +205,9 @@ func (b *Builder) getImageMount(fromFlag *Flag) (*imageMount, error) {
 	}
 	if stage != nil {
 		imageRefOrID = stage.ImageID()
+		localOnly = true
 	}
-	return b.imageSources.Get(imageRefOrID)
+	return b.imageSources.Get(imageRefOrID, localOnly)
 }
 
 // FROM imagename[:tag | @digest] [AS build-stage-name]
@@ -251,10 +255,8 @@ func parseBuildStageName(args []string) (string, error) {
 	return stageName, nil
 }
 
-// scratchImage is used as a token for the empty base image. It uses buildStage
-// as a convenient implementation of builder.Image, but is not actually a
-// buildStage.
-var scratchImage builder.Image = &buildStage{}
+// scratchImage is used as a token for the empty base image.
+var scratchImage builder.Image = &image.Image{}
 
 func (b *Builder) getFromImage(shlex *ShellLex, name string) (builder.Image, error) {
 	substitutionArgs := []string{}
@@ -267,18 +269,22 @@ func (b *Builder) getFromImage(shlex *ShellLex, name string) (builder.Image, err
 		return nil, err
 	}
 
-	if im, ok := b.buildStages.getByName(name); ok {
-		return im, nil
+	var localOnly bool
+	if stage, ok := b.buildStages.getByName(name); ok {
+		name = stage.ImageID()
+		localOnly = true
 	}
 
-	// Windows cannot support a container with no base image.
+	// Windows cannot support a container with no base image unless it is LCOW.
 	if name == api.NoBaseImageSpecifier {
 		if runtime.GOOS == "windows" {
-			return nil, errors.New("Windows does not support FROM scratch")
+			if b.platform == "windows" || (b.platform != "windows" && !system.LCOWSupported()) {
+				return nil, errors.New("Windows does not support FROM scratch")
+			}
 		}
 		return scratchImage, nil
 	}
-	imageMount, err := b.imageSources.Get(name)
+	imageMount, err := b.imageSources.Get(name, localOnly)
 	if err != nil {
 		return nil, err
 	}
@@ -325,7 +331,7 @@ func processOnBuild(req dispatchRequest) error {
 			}
 		}
 
-		if _, err := dispatchFromDockerfile(req.builder, dockerfile, dispatchState); err != nil {
+		if _, err := dispatchFromDockerfile(req.builder, dockerfile, dispatchState, req.source); err != nil {
 			return err
 		}
 	}
@@ -397,7 +403,7 @@ func workdir(req dispatchRequest) error {
 	}
 
 	comment := "WORKDIR " + runConfig.WorkingDir
-	runConfigWithCommentCmd := copyRunConfig(runConfig, withCmdCommentString(comment))
+	runConfigWithCommentCmd := copyRunConfig(runConfig, withCmdCommentString(comment, req.builder.platform))
 	containerID, err := req.builder.probeAndCreate(req.state, runConfigWithCommentCmd)
 	if err != nil || containerID == "" {
 		return err
@@ -415,7 +421,7 @@ func workdir(req dispatchRequest) error {
 // the current SHELL which defaults to 'sh -c' under linux or 'cmd /S /C' under
 // Windows, in the event there is only one argument The difference in processing:
 //
-// RUN echo hi          # sh -c echo hi       (Linux)
+// RUN echo hi          # sh -c echo hi       (Linux and LCOW)
 // RUN echo hi          # cmd /S /C echo hi   (Windows)
 // RUN [ "echo", "hi" ] # echo hi
 //
@@ -431,7 +437,7 @@ func run(req dispatchRequest) error {
 	stateRunConfig := req.state.runConfig
 	args := handleJSONArgs(req.args, req.attributes)
 	if !req.attributes["json"] {
-		args = append(getShell(stateRunConfig), args...)
+		args = append(getShell(stateRunConfig, req.builder.platform), args...)
 	}
 	cmdFromArgs := strslice.StrSlice(args)
 	buildArgs := req.builder.buildArgs.FilterAllowed(stateRunConfig.Env)
@@ -516,7 +522,7 @@ func cmd(req dispatchRequest) error {
 	runConfig := req.state.runConfig
 	cmdSlice := handleJSONArgs(req.args, req.attributes)
 	if !req.attributes["json"] {
-		cmdSlice = append(getShell(runConfig), cmdSlice...)
+		cmdSlice = append(getShell(runConfig, req.builder.platform), cmdSlice...)
 	}
 
 	runConfig.Cmd = strslice.StrSlice(cmdSlice)
@@ -668,7 +674,7 @@ func entrypoint(req dispatchRequest) error {
 		runConfig.Entrypoint = nil
 	default:
 		// ENTRYPOINT echo hi
-		runConfig.Entrypoint = strslice.StrSlice(append(getShell(runConfig), parsed[0]))
+		runConfig.Entrypoint = strslice.StrSlice(append(getShell(runConfig, req.builder.platform), parsed[0]))
 	}
 
 	// when setting the entrypoint if a CMD was not explicitly set then
diff --git a/components/engine/builder/dockerfile/dispatchers_test.go b/components/engine/builder/dockerfile/dispatchers_test.go
index 91d00758d4..b3672fce1b 100644
--- a/components/engine/builder/dockerfile/dispatchers_test.go
+++ b/components/engine/builder/dockerfile/dispatchers_test.go
@@ -63,7 +63,7 @@ func newBuilderWithMockBackend() *Builder {
 			Backend: mockBackend,
 		}),
 		buildStages:      newBuildStages(),
-		imageProber:      newImageProber(mockBackend, nil, false),
+		imageProber:      newImageProber(mockBackend, nil, runtime.GOOS, false),
 		containerManager: newContainerManager(mockBackend),
 	}
 	return b
@@ -194,7 +194,7 @@ func TestFromScratch(t *testing.T) {
 	req := defaultDispatchReq(b, "scratch")
 	err := from(req)
 
-	if runtime.GOOS == "windows" {
+	if runtime.GOOS == "windows" && !system.LCOWSupported() {
 		assert.EqualError(t, err, "Windows does not support FROM scratch")
 		return
 	}
@@ -202,7 +202,12 @@ func TestFromScratch(t *testing.T) {
 	require.NoError(t, err)
 	assert.True(t, req.state.hasFromImage())
 	assert.Equal(t, "", req.state.imageID)
-	assert.Equal(t, []string{"PATH=" + system.DefaultPathEnv}, req.state.runConfig.Env)
+	// Windows does not set the default path. TODO @jhowardmsft LCOW support. This will need revisiting as we get further into the implementation
+	expected := "PATH=" + system.DefaultPathEnv(runtime.GOOS)
+	if runtime.GOOS == "windows" {
+		expected = ""
+	}
+	assert.Equal(t, []string{expected}, req.state.runConfig.Env)
 }
 
 func TestFromWithArg(t *testing.T) {
@@ -469,7 +474,7 @@ func TestRunWithBuildArgs(t *testing.T) {
 
 	runConfig := &container.Config{}
 	origCmd := strslice.StrSlice([]string{"cmd", "in", "from", "image"})
-	cmdWithShell := strslice.StrSlice(append(getShell(runConfig), "echo foo"))
+	cmdWithShell := strslice.StrSlice(append(getShell(runConfig, runtime.GOOS), "echo foo"))
 	envVars := []string{"|1", "one=two"}
 	cachedCmd := strslice.StrSlice(append(envVars, cmdWithShell...))
 
@@ -483,10 +488,10 @@ func TestRunWithBuildArgs(t *testing.T) {
 	}
 
 	mockBackend := b.docker.(*MockBackend)
-	mockBackend.makeImageCacheFunc = func(_ []string) builder.ImageCache {
+	mockBackend.makeImageCacheFunc = func(_ []string, _ string) builder.ImageCache {
 		return imageCache
 	}
-	b.imageProber = newImageProber(mockBackend, nil, false)
+	b.imageProber = newImageProber(mockBackend, nil, runtime.GOOS, false)
 	mockBackend.getImageFunc = func(_ string) (builder.Image, builder.ReleaseableLayer, error) {
 		return &mockImage{
 			id:     "abcdef",
diff --git a/components/engine/builder/dockerfile/evaluator.go b/components/engine/builder/dockerfile/evaluator.go
index deeda66b05..69e3f6d0f2 100644
--- a/components/engine/builder/dockerfile/evaluator.go
+++ b/components/engine/builder/dockerfile/evaluator.go
@@ -22,6 +22,7 @@ package dockerfile
 import (
 	"bytes"
 	"fmt"
+	"runtime"
 	"strings"
 
 	"github.com/docker/docker/api/types/container"
@@ -171,11 +172,9 @@ func (b *Builder) dispatch(options dispatchOptions) (*dispatchState, error) {
 		buildsFailed.WithValues(metricsUnknownInstructionError).Inc()
 		return nil, fmt.Errorf("unknown instruction: %s", upperCasedCmd)
 	}
-	if err := f(newDispatchRequestFromOptions(options, b, args)); err != nil {
-		return nil, err
-	}
 	options.state.updateRunConfig()
-	return options.state, nil
+	err = f(newDispatchRequestFromOptions(options, b, args))
+	return options.state, err
 }
 
 type dispatchOptions struct {
@@ -230,14 +229,19 @@ func (s *dispatchState) beginStage(stageName string, image builder.Image) {
 }
 
 // Add the default PATH to runConfig.ENV if one exists for the platform and there
-// is no PATH set. Note that windows won't have one as it's set by HCS
+// is no PATH set. Note that Windows containers on Windows won't have one as it's set by HCS
 func (s *dispatchState) setDefaultPath() {
-	if system.DefaultPathEnv == "" {
+	// TODO @jhowardmsft LCOW Support - This will need revisiting later
+	platform := runtime.GOOS
+	if platform == "windows" && system.LCOWSupported() {
+		platform = "linux"
+	}
+	if system.DefaultPathEnv(platform) == "" {
 		return
 	}
 	envMap := opts.ConvertKVStringsToMap(s.runConfig.Env)
 	if _, ok := envMap["PATH"]; !ok {
-		s.runConfig.Env = append(s.runConfig.Env, "PATH="+system.DefaultPathEnv)
+		s.runConfig.Env = append(s.runConfig.Env, "PATH="+system.DefaultPathEnv(platform))
 	}
 }
 
diff --git a/components/engine/builder/dockerfile/evaluator_test.go b/components/engine/builder/dockerfile/evaluator_test.go
index 544a93fc30..72d7ce10e3 100644
--- a/components/engine/builder/dockerfile/evaluator_test.go
+++ b/components/engine/builder/dockerfile/evaluator_test.go
@@ -158,7 +158,7 @@ func executeTestCase(t *testing.T, testCase dispatchTestCase) {
 		}
 	}()
 
-	context, err := remotecontext.MakeTarSumContext(tarStream)
+	context, err := remotecontext.FromArchive(tarStream)
 
 	if err != nil {
 		t.Fatalf("Error when creating tar context: %s", err)
diff --git a/components/engine/builder/dockerfile/imagecontext.go b/components/engine/builder/dockerfile/imagecontext.go
index f89cc8d9ce..64b2572b85 100644
--- a/components/engine/builder/dockerfile/imagecontext.go
+++ b/components/engine/builder/dockerfile/imagecontext.go
@@ -6,37 +6,29 @@ import (
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/api/types/backend"
-	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/builder"
 	"github.com/docker/docker/builder/remotecontext"
+	dockerimage "github.com/docker/docker/image"
 	"github.com/pkg/errors"
 	"golang.org/x/net/context"
 )
 
 type buildStage struct {
-	id     string
-	config *container.Config
+	id string
 }
 
-func newBuildStageFromImage(image builder.Image) *buildStage {
-	return &buildStage{id: image.ImageID(), config: image.RunConfig()}
+func newBuildStage(imageID string) *buildStage {
+	return &buildStage{id: imageID}
 }
 
 func (b *buildStage) ImageID() string {
 	return b.id
 }
 
-func (b *buildStage) RunConfig() *container.Config {
-	return b.config
-}
-
-func (b *buildStage) update(imageID string, runConfig *container.Config) {
+func (b *buildStage) update(imageID string) {
 	b.id = imageID
-	b.config = runConfig
 }
 
-var _ builder.Image = &buildStage{}
-
 // buildStages tracks each stage of a build so they can be retrieved by index
 // or by name.
 type buildStages struct {
@@ -48,12 +40,12 @@ func newBuildStages() *buildStages {
 	return &buildStages{byName: make(map[string]*buildStage)}
 }
 
-func (s *buildStages) getByName(name string) (builder.Image, bool) {
+func (s *buildStages) getByName(name string) (*buildStage, bool) {
 	stage, ok := s.byName[strings.ToLower(name)]
 	return stage, ok
 }
 
-func (s *buildStages) get(indexOrName string) (builder.Image, error) {
+func (s *buildStages) get(indexOrName string) (*buildStage, error) {
 	index, err := strconv.Atoi(indexOrName)
 	if err == nil {
 		if err := s.validateIndex(index); err != nil {
@@ -78,7 +70,7 @@ func (s *buildStages) validateIndex(i int) error {
 }
 
 func (s *buildStages) add(name string, image builder.Image) error {
-	stage := newBuildStageFromImage(image)
+	stage := newBuildStage(image.ImageID())
 	name = strings.ToLower(name)
 	if len(name) > 0 {
 		if _, ok := s.byName[name]; ok {
@@ -90,26 +82,38 @@ func (s *buildStages) add(name string, image builder.Image) error {
 	return nil
 }
 
-func (s *buildStages) update(imageID string, runConfig *container.Config) {
-	s.sequence[len(s.sequence)-1].update(imageID, runConfig)
+func (s *buildStages) update(imageID string) {
+	s.sequence[len(s.sequence)-1].update(imageID)
 }
 
-type getAndMountFunc func(string) (builder.Image, builder.ReleaseableLayer, error)
+type getAndMountFunc func(string, bool) (builder.Image, builder.ReleaseableLayer, error)
 
 // imageSources mounts images and provides a cache for mounted images. It tracks
 // all images so they can be unmounted at the end of the build.
 type imageSources struct {
 	byImageID map[string]*imageMount
+	mounts    []*imageMount
 	getImage  getAndMountFunc
 	cache     pathCache // TODO: remove
 }
 
+// TODO @jhowardmsft LCOW Support: Eventually, platform can be moved to options.Options.Platform,
+// and removed from builderOptions, but that can't be done yet as it would affect the API.
 func newImageSources(ctx context.Context, options builderOptions) *imageSources {
-	getAndMount := func(idOrRef string) (builder.Image, builder.ReleaseableLayer, error) {
+	getAndMount := func(idOrRef string, localOnly bool) (builder.Image, builder.ReleaseableLayer, error) {
+		pullOption := backend.PullOptionNoPull
+		if !localOnly {
+			if options.Options.PullParent {
+				pullOption = backend.PullOptionForcePull
+			} else {
+				pullOption = backend.PullOptionPreferLocal
+			}
+		}
 		return options.Backend.GetImageAndReleasableLayer(ctx, idOrRef, backend.GetImageAndLayerOptions{
-			ForcePull:  options.Options.PullParent,
+			PullOption: pullOption,
 			AuthConfig: options.Options.AuthConfigs,
 			Output:     options.ProgressWriter.Output,
+			Platform:   options.Platform,
 		})
 	}
 
@@ -119,22 +123,22 @@ func newImageSources(ctx context.Context, options builderOptions) *imageSources
 	}
 }
 
-func (m *imageSources) Get(idOrRef string) (*imageMount, error) {
+func (m *imageSources) Get(idOrRef string, localOnly bool) (*imageMount, error) {
 	if im, ok := m.byImageID[idOrRef]; ok {
 		return im, nil
 	}
 
-	image, layer, err := m.getImage(idOrRef)
+	image, layer, err := m.getImage(idOrRef, localOnly)
 	if err != nil {
 		return nil, err
 	}
 	im := newImageMount(image, layer)
-	m.byImageID[image.ImageID()] = im
+	m.Add(im)
 	return im, nil
 }
 
 func (m *imageSources) Unmount() (retErr error) {
-	for _, im := range m.byImageID {
+	for _, im := range m.mounts {
 		if err := im.unmount(); err != nil {
 			logrus.Error(err)
 			retErr = err
@@ -143,6 +147,16 @@ func (m *imageSources) Unmount() (retErr error) {
 	return
 }
 
+func (m *imageSources) Add(im *imageMount) {
+	switch im.image {
+	case nil:
+		im.image = &dockerimage.Image{}
+	default:
+		m.byImageID[im.image.ImageID()] = im
+	}
+	m.mounts = append(m.mounts, im)
+}
+
 // imageMount is a reference to an image that can be used as a builder.Source
 type imageMount struct {
 	image  builder.Image
@@ -164,7 +178,7 @@ func (im *imageMount) Source() (builder.Source, error) {
 		if err != nil {
 			return nil, errors.Wrapf(err, "failed to mount %s", im.image.ImageID())
 		}
-		source, err := remotecontext.NewLazyContext(mountPath)
+		source, err := remotecontext.NewLazySource(mountPath)
 		if err != nil {
 			return nil, errors.Wrapf(err, "failed to create lazycontext for %s", mountPath)
 		}
@@ -180,6 +194,7 @@ func (im *imageMount) unmount() error {
 	if err := im.layer.Release(); err != nil {
 		return errors.Wrapf(err, "failed to unmount previous build image %s", im.image.ImageID())
 	}
+	im.layer = nil
 	return nil
 }
 
@@ -187,6 +202,10 @@ func (im *imageMount) Image() builder.Image {
 	return im.image
 }
 
+func (im *imageMount) Layer() builder.ReleaseableLayer {
+	return im.layer
+}
+
 func (im *imageMount) ImageID() string {
 	return im.image.ImageID()
 }
diff --git a/components/engine/builder/dockerfile/imageprobe.go b/components/engine/builder/dockerfile/imageprobe.go
index 3a3942888c..3433612de5 100644
--- a/components/engine/builder/dockerfile/imageprobe.go
+++ b/components/engine/builder/dockerfile/imageprobe.go
@@ -19,13 +19,13 @@ type imageProber struct {
 	cacheBusted bool
 }
 
-func newImageProber(cacheBuilder builder.ImageCacheBuilder, cacheFrom []string, noCache bool) ImageProber {
+func newImageProber(cacheBuilder builder.ImageCacheBuilder, cacheFrom []string, platform string, noCache bool) ImageProber {
 	if noCache {
 		return &nopProber{}
 	}
 
 	reset := func() builder.ImageCache {
-		return cacheBuilder.MakeImageCache(cacheFrom)
+		return cacheBuilder.MakeImageCache(cacheFrom, platform)
 	}
 	return &imageProber{cache: reset(), reset: reset}
 }
diff --git a/components/engine/builder/dockerfile/internals.go b/components/engine/builder/dockerfile/internals.go
index 2d02e57a69..c0d6081d06 100644
--- a/components/engine/builder/dockerfile/internals.go
+++ b/components/engine/builder/dockerfile/internals.go
@@ -12,6 +12,7 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/backend"
 	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/image"
 	"github.com/docker/docker/pkg/stringid"
 	"github.com/pkg/errors"
 )
@@ -24,7 +25,7 @@ func (b *Builder) commit(dispatchState *dispatchState, comment string) error {
 		return errors.New("Please provide a source image with `from` prior to commit")
 	}
 
-	runConfigWithCommentCmd := copyRunConfig(dispatchState.runConfig, withCmdComment(comment))
+	runConfigWithCommentCmd := copyRunConfig(dispatchState.runConfig, withCmdComment(comment, b.platform))
 	hit, err := b.probeCache(dispatchState, runConfigWithCommentCmd)
 	if err != nil || hit {
 		return err
@@ -37,7 +38,6 @@ func (b *Builder) commit(dispatchState *dispatchState, comment string) error {
 	return b.commitContainer(dispatchState, id, runConfigWithCommentCmd)
 }
 
-// TODO: see if any args can be dropped
 func (b *Builder) commitContainer(dispatchState *dispatchState, id string, containerConfig *container.Config) error {
 	if b.disableCommit {
 		return nil
@@ -60,7 +60,47 @@ func (b *Builder) commitContainer(dispatchState *dispatchState, id string, conta
 	}
 
 	dispatchState.imageID = imageID
-	b.buildStages.update(imageID, dispatchState.runConfig)
+	b.buildStages.update(imageID)
+	return nil
+}
+
+func (b *Builder) exportImage(state *dispatchState, imageMount *imageMount, runConfig *container.Config) error {
+	newLayer, err := imageMount.Layer().Commit(b.platform)
+	if err != nil {
+		return err
+	}
+
+	// add an image mount without an image so the layer is properly unmounted
+	// if there is an error before we can add the full mount with image
+	b.imageSources.Add(newImageMount(nil, newLayer))
+
+	parentImage, ok := imageMount.Image().(*image.Image)
+	if !ok {
+		return errors.Errorf("unexpected image type")
+	}
+
+	newImage := image.NewChildImage(parentImage, image.ChildConfig{
+		Author:          state.maintainer,
+		ContainerConfig: runConfig,
+		DiffID:          newLayer.DiffID(),
+		Config:          copyRunConfig(state.runConfig),
+	}, parentImage.OS)
+
+	// TODO: it seems strange to marshal this here instead of just passing in the
+	// image struct
+	config, err := newImage.MarshalJSON()
+	if err != nil {
+		return errors.Wrap(err, "failed to encode image config")
+	}
+
+	exportedImage, err := b.docker.CreateImage(config, state.imageID, parentImage.OS)
+	if err != nil {
+		return errors.Wrapf(err, "failed to export image")
+	}
+
+	state.imageID = exportedImage.ImageID()
+	b.imageSources.Add(newImageMount(exportedImage, newLayer))
+	b.buildStages.update(state.imageID)
 	return nil
 }
 
@@ -70,25 +110,47 @@ func (b *Builder) performCopy(state *dispatchState, inst copyInstruction) error
 	// TODO: should this have been using origPaths instead of srcHash in the comment?
 	runConfigWithCommentCmd := copyRunConfig(
 		state.runConfig,
-		withCmdCommentString(fmt.Sprintf("%s %s in %s ", inst.cmdName, srcHash, inst.dest)))
-	containerID, err := b.probeAndCreate(state, runConfigWithCommentCmd)
-	if err != nil || containerID == "" {
+		withCmdCommentString(fmt.Sprintf("%s %s in %s ", inst.cmdName, srcHash, inst.dest), b.platform))
+	hit, err := b.probeCache(state, runConfigWithCommentCmd)
+	if err != nil || hit {
 		return err
 	}
 
-	// Twiddle the destination when it's a relative path - meaning, make it
-	// relative to the WORKINGDIR
-	dest, err := normaliseDest(inst.cmdName, state.runConfig.WorkingDir, inst.dest)
+	imageMount, err := b.imageSources.Get(state.imageID, true)
+	if err != nil {
+		return errors.Wrapf(err, "failed to get destination image %q", state.imageID)
+	}
+	destInfo, err := createDestInfo(state.runConfig.WorkingDir, inst, imageMount)
 	if err != nil {
 		return err
 	}
 
+	opts := copyFileOptions{
+		decompress: inst.allowLocalDecompression,
+		archiver:   b.archiver,
+	}
 	for _, info := range inst.infos {
-		if err := b.docker.CopyOnBuild(containerID, dest, info.root, info.path, inst.allowLocalDecompression); err != nil {
-			return err
+		if err := performCopyForInfo(destInfo, info, opts); err != nil {
+			return errors.Wrapf(err, "failed to copy files")
 		}
 	}
-	return b.commitContainer(state, containerID, runConfigWithCommentCmd)
+	return b.exportImage(state, imageMount, runConfigWithCommentCmd)
+}
+
+func createDestInfo(workingDir string, inst copyInstruction, imageMount *imageMount) (copyInfo, error) {
+	// Twiddle the destination when it's a relative path - meaning, make it
+	// relative to the WORKINGDIR
+	dest, err := normaliseDest(workingDir, inst.dest)
+	if err != nil {
+		return copyInfo{}, errors.Wrapf(err, "invalid %s", inst.cmdName)
+	}
+
+	destMount, err := imageMount.Source()
+	if err != nil {
+		return copyInfo{}, errors.Wrapf(err, "failed to mount copy source")
+	}
+
+	return newCopyInfoFromSource(destMount, dest, ""), nil
 }
 
 // For backwards compat, if there's just one info then use it as the
@@ -128,9 +190,9 @@ func withCmd(cmd []string) runConfigModifier {
 
 // withCmdComment sets Cmd to a nop comment string. See withCmdCommentString for
 // why there are two almost identical versions of this.
-func withCmdComment(comment string) runConfigModifier {
+func withCmdComment(comment string, platform string) runConfigModifier {
 	return func(runConfig *container.Config) {
-		runConfig.Cmd = append(getShell(runConfig), "#(nop) ", comment)
+		runConfig.Cmd = append(getShell(runConfig, platform), "#(nop) ", comment)
 	}
 }
 
@@ -138,9 +200,9 @@ func withCmdComment(comment string) runConfigModifier {
 // A few instructions (workdir, copy, add) used a nop comment that is a single arg
 // where as all the other instructions used a two arg comment string. This
 // function implements the single arg version.
-func withCmdCommentString(comment string) runConfigModifier {
+func withCmdCommentString(comment string, platform string) runConfigModifier {
 	return func(runConfig *container.Config) {
-		runConfig.Cmd = append(getShell(runConfig), "#(nop) "+comment)
+		runConfig.Cmd = append(getShell(runConfig, platform), "#(nop) "+comment)
 	}
 }
 
@@ -167,9 +229,9 @@ func withEntrypointOverride(cmd []string, entrypoint []string) runConfigModifier
 
 // getShell is a helper function which gets the right shell for prefixing the
 // shell-form of RUN, ENTRYPOINT and CMD instructions
-func getShell(c *container.Config) []string {
+func getShell(c *container.Config, platform string) []string {
 	if 0 == len(c.Shell) {
-		return append([]string{}, defaultShell[:]...)
+		return append([]string{}, defaultShellForPlatform(platform)[:]...)
 	}
 	return append([]string{}, c.Shell[:]...)
 }
@@ -182,7 +244,7 @@ func (b *Builder) probeCache(dispatchState *dispatchState, runConfig *container.
 	fmt.Fprint(b.Stdout, " ---> Using cache\n")
 
 	dispatchState.imageID = string(cachedID)
-	b.buildStages.update(dispatchState.imageID, runConfig)
+	b.buildStages.update(dispatchState.imageID)
 	return true, nil
 }
 
@@ -194,13 +256,13 @@ func (b *Builder) probeAndCreate(dispatchState *dispatchState, runConfig *contai
 	}
 	// Set a log config to override any default value set on the daemon
 	hostConfig := &container.HostConfig{LogConfig: defaultLogConfig}
-	container, err := b.containerManager.Create(runConfig, hostConfig)
+	container, err := b.containerManager.Create(runConfig, hostConfig, b.platform)
 	return container.ID, err
 }
 
 func (b *Builder) create(runConfig *container.Config) (string, error) {
 	hostConfig := hostConfigFromOptions(b.options)
-	container, err := b.containerManager.Create(runConfig, hostConfig)
+	container, err := b.containerManager.Create(runConfig, hostConfig, b.platform)
 	if err != nil {
 		return "", err
 	}
diff --git a/components/engine/builder/dockerfile/internals_test.go b/components/engine/builder/dockerfile/internals_test.go
index 4cba2c9842..8073cc6713 100644
--- a/components/engine/builder/dockerfile/internals_test.go
+++ b/components/engine/builder/dockerfile/internals_test.go
@@ -2,6 +2,7 @@ package dockerfile
 
 import (
 	"fmt"
+	"runtime"
 	"testing"
 
 	"github.com/docker/docker/api/types"
@@ -97,9 +98,9 @@ func TestCopyRunConfig(t *testing.T) {
 		},
 		{
 			doc:       "Set the command to a comment",
-			modifiers: []runConfigModifier{withCmdComment("comment")},
+			modifiers: []runConfigModifier{withCmdComment("comment", runtime.GOOS)},
 			expected: &container.Config{
-				Cmd: append(defaultShell, "#(nop) ", "comment"),
+				Cmd: append(defaultShellForPlatform(runtime.GOOS), "#(nop) ", "comment"),
 				Env: defaultEnv,
 			},
 		},
diff --git a/components/engine/builder/dockerfile/internals_unix.go b/components/engine/builder/dockerfile/internals_unix.go
index 17102cb443..f4784e1cca 100644
--- a/components/engine/builder/dockerfile/internals_unix.go
+++ b/components/engine/builder/dockerfile/internals_unix.go
@@ -12,7 +12,7 @@ import (
 
 // normaliseDest normalises the destination of a COPY/ADD command in a
 // platform semantically consistent way.
-func normaliseDest(cmdName, workingDir, requested string) (string, error) {
+func normaliseDest(workingDir, requested string) (string, error) {
 	dest := filepath.FromSlash(requested)
 	endsInSlash := strings.HasSuffix(requested, string(os.PathSeparator))
 	if !system.IsAbs(requested) {
diff --git a/components/engine/builder/dockerfile/internals_windows.go b/components/engine/builder/dockerfile/internals_windows.go
index 81a0386251..bb3285925f 100644
--- a/components/engine/builder/dockerfile/internals_windows.go
+++ b/components/engine/builder/dockerfile/internals_windows.go
@@ -12,7 +12,7 @@ import (
 
 // normaliseDest normalises the destination of a COPY/ADD command in a
 // platform semantically consistent way.
-func normaliseDest(cmdName, workingDir, requested string) (string, error) {
+func normaliseDest(workingDir, requested string) (string, error) {
 	dest := filepath.FromSlash(requested)
 	endsInSlash := strings.HasSuffix(dest, string(os.PathSeparator))
 
@@ -32,7 +32,7 @@ func normaliseDest(cmdName, workingDir, requested string) (string, error) {
 	// we only want to validate where the DriveColon part has been supplied.
 	if filepath.IsAbs(dest) {
 		if strings.ToUpper(string(dest[0])) != "C" {
-			return "", fmt.Errorf("Windows does not support %s with a destinations not on the system drive (C:)", cmdName)
+			return "", fmt.Errorf("Windows does not support destinations not on the system drive (C:)")
 		}
 		dest = dest[2:] // Strip the drive letter
 	}
@@ -44,7 +44,7 @@ func normaliseDest(cmdName, workingDir, requested string) (string, error) {
 		}
 		if !system.IsAbs(dest) {
 			if string(workingDir[0]) != "C" {
-				return "", fmt.Errorf("Windows does not support %s with relative paths when WORKDIR is not the system drive", cmdName)
+				return "", fmt.Errorf("Windows does not support relative paths when WORKDIR is not the system drive")
 			}
 			dest = filepath.Join(string(os.PathSeparator), workingDir[2:], dest)
 			// Make sure we preserve any trailing slash
diff --git a/components/engine/builder/dockerfile/internals_windows_test.go b/components/engine/builder/dockerfile/internals_windows_test.go
index 868a6671a3..b4c8d4b3cb 100644
--- a/components/engine/builder/dockerfile/internals_windows_test.go
+++ b/components/engine/builder/dockerfile/internals_windows_test.go
@@ -2,16 +2,22 @@
 
 package dockerfile
 
-import "testing"
+import (
+	"fmt"
+	"testing"
+
+	"github.com/docker/docker/pkg/testutil"
+	"github.com/stretchr/testify/assert"
+)
 
 func TestNormaliseDest(t *testing.T) {
 	tests := []struct{ current, requested, expected, etext string }{
-		{``, `D:\`, ``, `Windows does not support TEST with a destinations not on the system drive (C:)`},
-		{``, `e:/`, ``, `Windows does not support TEST with a destinations not on the system drive (C:)`},
+		{``, `D:\`, ``, `Windows does not support destinations not on the system drive (C:)`},
+		{``, `e:/`, ``, `Windows does not support destinations not on the system drive (C:)`},
 		{`invalid`, `./c1`, ``, `Current WorkingDir invalid is not platform consistent`},
 		{`C:`, ``, ``, `Current WorkingDir C: is not platform consistent`},
 		{`C`, ``, ``, `Current WorkingDir C is not platform consistent`},
-		{`D:\`, `.`, ``, "Windows does not support TEST with relative paths when WORKDIR is not the system drive"},
+		{`D:\`, `.`, ``, "Windows does not support relative paths when WORKDIR is not the system drive"},
 		{``, `D`, `D`, ``},
 		{``, `./a1`, `.\a1`, ``},
 		{``, `.\b1`, `.\b1`, ``},
@@ -32,20 +38,16 @@ func TestNormaliseDest(t *testing.T) {
 		{`C:\wdm`, `foo/bar/`, `\wdm\foo\bar\`, ``},
 		{`C:\wdn`, `foo\bar/`, `\wdn\foo\bar\`, ``},
 	}
-	for _, i := range tests {
-		got, err := normaliseDest("TEST", i.current, i.requested)
-		if err != nil && i.etext == "" {
-			t.Fatalf("TestNormaliseDest Got unexpected error %q for %s %s. ", err.Error(), i.current, i.requested)
-		}
-		if i.etext != "" && ((err == nil) || (err != nil && err.Error() != i.etext)) {
-			if err == nil {
-				t.Fatalf("TestNormaliseDest Expected an error for %s %s but didn't get one", i.current, i.requested)
-			} else {
-				t.Fatalf("TestNormaliseDest Wrong error text for %s %s - %s", i.current, i.requested, err.Error())
+	for _, testcase := range tests {
+		msg := fmt.Sprintf("Input: %s, %s", testcase.current, testcase.requested)
+		actual, err := normaliseDest(testcase.current, testcase.requested)
+		if testcase.etext == "" {
+			if !assert.NoError(t, err, msg) {
+				continue
 			}
-		}
-		if i.etext == "" && got != i.expected {
-			t.Fatalf("TestNormaliseDest Expected %q for %q and %q. Got %q", i.expected, i.current, i.requested, got)
+			assert.Equal(t, testcase.expected, actual, msg)
+		} else {
+			testutil.ErrorContains(t, err, testcase.etext)
 		}
 	}
 }
diff --git a/components/engine/builder/dockerfile/mockbackend_test.go b/components/engine/builder/dockerfile/mockbackend_test.go
index 08ce18c2e8..adc22762e0 100644
--- a/components/engine/builder/dockerfile/mockbackend_test.go
+++ b/components/engine/builder/dockerfile/mockbackend_test.go
@@ -1,6 +1,7 @@
 package dockerfile
 
 import (
+	"encoding/json"
 	"io"
 
 	"github.com/docker/docker/api/types"
@@ -8,6 +9,7 @@ import (
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/builder"
 	containerpkg "github.com/docker/docker/container"
+	"github.com/docker/docker/layer"
 	"golang.org/x/net/context"
 )
 
@@ -16,7 +18,7 @@ type MockBackend struct {
 	containerCreateFunc func(config types.ContainerCreateConfig) (container.ContainerCreateCreatedBody, error)
 	commitFunc          func(string, *backend.ContainerCommitConfig) (string, error)
 	getImageFunc        func(string) (builder.Image, builder.ReleaseableLayer, error)
-	makeImageCacheFunc  func(cacheFrom []string) builder.ImageCache
+	makeImageCacheFunc  func(cacheFrom []string, platform string) builder.ImageCache
 }
 
 func (m *MockBackend) ContainerAttachRaw(cID string, stdin io.ReadCloser, stdout, stderr io.Writer, stream bool, attached chan struct{}) error {
@@ -69,13 +71,17 @@ func (m *MockBackend) GetImageAndReleasableLayer(ctx context.Context, refOrID st
 	return &mockImage{id: "theid"}, &mockLayer{}, nil
 }
 
-func (m *MockBackend) MakeImageCache(cacheFrom []string) builder.ImageCache {
+func (m *MockBackend) MakeImageCache(cacheFrom []string, platform string) builder.ImageCache {
 	if m.makeImageCacheFunc != nil {
-		return m.makeImageCacheFunc(cacheFrom)
+		return m.makeImageCacheFunc(cacheFrom, platform)
 	}
 	return nil
 }
 
+func (m *MockBackend) CreateImage(config []byte, parent string, platform string) (builder.Image, error) {
+	return nil, nil
+}
+
 type mockImage struct {
 	id     string
 	config *container.Config
@@ -89,6 +95,11 @@ func (i *mockImage) RunConfig() *container.Config {
 	return i.config
 }
 
+func (i *mockImage) MarshalJSON() ([]byte, error) {
+	type rawImage mockImage
+	return json.Marshal(rawImage(*i))
+}
+
 type mockImageCache struct {
 	getCacheFunc func(parentID string, cfg *container.Config) (string, error)
 }
@@ -109,3 +120,11 @@ func (l *mockLayer) Release() error {
 func (l *mockLayer) Mount() (string, error) {
 	return "mountPath", nil
 }
+
+func (l *mockLayer) Commit(string) (builder.ReleaseableLayer, error) {
+	return nil, nil
+}
+
+func (l *mockLayer) DiffID() layer.DiffID {
+	return layer.DiffID("abcdef")
+}
diff --git a/components/engine/builder/dockerfile/parser/line_parsers_test.go b/components/engine/builder/dockerfile/parser/line_parsers_test.go
index cd6d57af3a..cf0b21bb51 100644
--- a/components/engine/builder/dockerfile/parser/line_parsers_test.go
+++ b/components/engine/builder/dockerfile/parser/line_parsers_test.go
@@ -64,3 +64,11 @@ func TestNodeFromLabels(t *testing.T) {
 	assert.Equal(t, expected, node)
 
 }
+
+func TestParseNameValWithoutVal(t *testing.T) {
+	directive := Directive{}
+	// In Config.Env, a variable without `=` is removed from the environment. (#31634)
+	// However, in Dockerfile, we don't allow "unsetting" an environment variable. (#11922)
+	_, err := parseNameVal("foo", "ENV", &directive)
+	assert.Error(t, err, "ENV must have two arguments")
+}
diff --git a/components/engine/builder/dockerfile/parser/parser.go b/components/engine/builder/dockerfile/parser/parser.go
index 0729fa539d..a1f7a74570 100644
--- a/components/engine/builder/dockerfile/parser/parser.go
+++ b/components/engine/builder/dockerfile/parser/parser.go
@@ -7,11 +7,13 @@ import (
 	"fmt"
 	"io"
 	"regexp"
+	"runtime"
 	"strconv"
 	"strings"
 	"unicode"
 
 	"github.com/docker/docker/builder/dockerfile/command"
+	"github.com/docker/docker/pkg/system"
 	"github.com/pkg/errors"
 )
 
@@ -79,22 +81,28 @@ func (node *Node) AddChild(child *Node, startLine, endLine int) {
 }
 
 var (
-	dispatch           map[string]func(string, *Directive) (*Node, map[string]bool, error)
-	tokenWhitespace    = regexp.MustCompile(`[\t\v\f\r ]+`)
-	tokenEscapeCommand = regexp.MustCompile(`^#[ \t]*escape[ \t]*=[ \t]*(?P<escapechar>.).*$`)
-	tokenComment       = regexp.MustCompile(`^#.*$`)
+	dispatch             map[string]func(string, *Directive) (*Node, map[string]bool, error)
+	tokenWhitespace      = regexp.MustCompile(`[\t\v\f\r ]+`)
+	tokenEscapeCommand   = regexp.MustCompile(`^#[ \t]*escape[ \t]*=[ \t]*(?P<escapechar>.).*$`)
+	tokenPlatformCommand = regexp.MustCompile(`^#[ \t]*platform[ \t]*=[ \t]*(?P<platform>.*)$`)
+	tokenComment         = regexp.MustCompile(`^#.*$`)
 )
 
 // DefaultEscapeToken is the default escape token
 const DefaultEscapeToken = '\\'
 
+// DefaultPlatformToken is the platform assumed for the build if not explicitly provided
+var DefaultPlatformToken = runtime.GOOS
+
 // Directive is the structure used during a build run to hold the state of
 // parsing directives.
 type Directive struct {
 	escapeToken           rune           // Current escape token
+	platformToken         string         // Current platform token
 	lineContinuationRegex *regexp.Regexp // Current line continuation regex
 	processingComplete    bool           // Whether we are done looking for directives
 	escapeSeen            bool           // Whether the escape directive has been seen
+	platformSeen          bool           // Whether the platform directive has been seen
 }
 
 // setEscapeToken sets the default token for escaping characters in a Dockerfile.
@@ -107,29 +115,61 @@ func (d *Directive) setEscapeToken(s string) error {
 	return nil
 }
 
-// processLine looks for a parser directive '# escapeToken=<char>. Parser
-// directives must precede any builder instruction or other comments, and cannot
-// be repeated.
-func (d *Directive) processLine(line string) error {
+// setPlatformToken sets the default platform for pulling images in a Dockerfile.
+func (d *Directive) setPlatformToken(s string) error {
+	s = strings.ToLower(s)
+	valid := []string{runtime.GOOS}
+	if runtime.GOOS == "windows" && system.LCOWSupported() {
+		valid = append(valid, "linux")
+	}
+	for _, item := range valid {
+		if s == item {
+			d.platformToken = s
+			return nil
+		}
+	}
+	return fmt.Errorf("invalid PLATFORM '%s'. Must be one of %v", s, valid)
+}
+
+// possibleParserDirective looks for one or more parser directives '# escapeToken=<char>' and
+// '# platform=<string>'. Parser directives must precede any builder instruction
+// or other comments, and cannot be repeated.
+func (d *Directive) possibleParserDirective(line string) error {
 	if d.processingComplete {
 		return nil
 	}
-	// Processing is finished after the first call
-	defer func() { d.processingComplete = true }()
 
 	tecMatch := tokenEscapeCommand.FindStringSubmatch(strings.ToLower(line))
-	if len(tecMatch) == 0 {
-		return nil
-	}
-	if d.escapeSeen == true {
-		return errors.New("only one escape parser directive can be used")
-	}
-	for i, n := range tokenEscapeCommand.SubexpNames() {
-		if n == "escapechar" {
-			d.escapeSeen = true
-			return d.setEscapeToken(tecMatch[i])
+	if len(tecMatch) != 0 {
+		for i, n := range tokenEscapeCommand.SubexpNames() {
+			if n == "escapechar" {
+				if d.escapeSeen == true {
+					return errors.New("only one escape parser directive can be used")
+				}
+				d.escapeSeen = true
+				return d.setEscapeToken(tecMatch[i])
+			}
 		}
 	}
+
+	// TODO @jhowardmsft LCOW Support: Eventually this check can be removed,
+	// but only recognise a platform token if running in LCOW mode.
+	if runtime.GOOS == "windows" && system.LCOWSupported() {
+		tpcMatch := tokenPlatformCommand.FindStringSubmatch(strings.ToLower(line))
+		if len(tpcMatch) != 0 {
+			for i, n := range tokenPlatformCommand.SubexpNames() {
+				if n == "platform" {
+					if d.platformSeen == true {
+						return errors.New("only one platform parser directive can be used")
+					}
+					d.platformSeen = true
+					return d.setPlatformToken(tpcMatch[i])
+				}
+			}
+		}
+	}
+
+	d.processingComplete = true
 	return nil
 }
 
@@ -137,6 +177,7 @@ func (d *Directive) processLine(line string) error {
 func NewDefaultDirective() *Directive {
 	directive := Directive{}
 	directive.setEscapeToken(string(DefaultEscapeToken))
+	directive.setPlatformToken(runtime.GOOS)
 	return &directive
 }
 
@@ -201,6 +242,7 @@ func newNodeFromLine(line string, directive *Directive) (*Node, error) {
 type Result struct {
 	AST         *Node
 	EscapeToken rune
+	Platform    string
 }
 
 // Parse reads lines from a Reader, parses the lines into an AST and returns
@@ -213,34 +255,36 @@ func Parse(rwc io.Reader) (*Result, error) {
 
 	var err error
 	for scanner.Scan() {
-		bytes := scanner.Bytes()
-		switch currentLine {
-		case 0:
-			bytes, err = processFirstLine(d, bytes)
-			if err != nil {
-				return nil, err
-			}
-		default:
-			bytes = processLine(bytes, true)
+		bytesRead := scanner.Bytes()
+		if currentLine == 0 {
+			// First line, strip the byte-order-marker if present
+			bytesRead = bytes.TrimPrefix(bytesRead, utf8bom)
+		}
+		bytesRead, err = processLine(d, bytesRead, true)
+		if err != nil {
+			return nil, err
 		}
 		currentLine++
 
 		startLine := currentLine
-		line, isEndOfLine := trimContinuationCharacter(string(bytes), d)
+		line, isEndOfLine := trimContinuationCharacter(string(bytesRead), d)
 		if isEndOfLine && line == "" {
 			continue
 		}
 
 		for !isEndOfLine && scanner.Scan() {
-			bytes := processLine(scanner.Bytes(), false)
+			bytesRead, err := processLine(d, scanner.Bytes(), false)
+			if err != nil {
+				return nil, err
+			}
 			currentLine++
 
 			// TODO: warn this is being deprecated/removed
-			if isEmptyContinuationLine(bytes) {
+			if isEmptyContinuationLine(bytesRead) {
 				continue
 			}
 
-			continuationLine := string(bytes)
+			continuationLine := string(bytesRead)
 			continuationLine, isEndOfLine = trimContinuationCharacter(continuationLine, d)
 			line += continuationLine
 		}
@@ -251,8 +295,7 @@ func Parse(rwc io.Reader) (*Result, error) {
 		}
 		root.AddChild(child, startLine, currentLine)
 	}
-
-	return &Result{AST: root, EscapeToken: d.escapeToken}, nil
+	return &Result{AST: root, EscapeToken: d.escapeToken, Platform: d.platformToken}, nil
 }
 
 func trimComments(src []byte) []byte {
@@ -279,16 +322,10 @@ func trimContinuationCharacter(line string, d *Directive) (string, bool) {
 
 // TODO: remove stripLeftWhitespace after deprecation period. It seems silly
 // to preserve whitespace on continuation lines. Why is that done?
-func processLine(token []byte, stripLeftWhitespace bool) []byte {
+func processLine(d *Directive, token []byte, stripLeftWhitespace bool) ([]byte, error) {
 	if stripLeftWhitespace {
 		token = trimWhitespace(token)
 	}
-	return trimComments(token)
-}
-
-func processFirstLine(d *Directive, token []byte) ([]byte, error) {
-	token = bytes.TrimPrefix(token, utf8bom)
-	token = trimWhitespace(token)
-	err := d.processLine(string(token))
+	err := d.possibleParserDirective(string(token))
 	return trimComments(token), err
 }
diff --git a/components/engine/builder/dockerignore/dockerignore.go b/components/engine/builder/dockerignore/dockerignore.go
index 2db67be799..cc22381339 100644
--- a/components/engine/builder/dockerignore/dockerignore.go
+++ b/components/engine/builder/dockerignore/dockerignore.go
@@ -38,8 +38,23 @@ func ReadAll(reader io.Reader) ([]string, error) {
 		if pattern == "" {
 			continue
 		}
-		pattern = filepath.Clean(pattern)
-		pattern = filepath.ToSlash(pattern)
+		// normalize absolute paths to paths relative to the context
+		// (taking care of '!' prefix)
+		invert := pattern[0] == '!'
+		if invert {
+			pattern = strings.TrimSpace(pattern[1:])
+		}
+		if len(pattern) > 0 {
+			pattern = filepath.Clean(pattern)
+			pattern = filepath.ToSlash(pattern)
+			if len(pattern) > 1 && pattern[0] == '/' {
+				pattern = pattern[1:]
+			}
+		}
+		if invert {
+			pattern = "!" + pattern
+		}
+
 		excludes = append(excludes, pattern)
 	}
 	if err := scanner.Err(); err != nil {
diff --git a/components/engine/builder/dockerignore/dockerignore_test.go b/components/engine/builder/dockerignore/dockerignore_test.go
index 948f9d886b..bda38745cc 100644
--- a/components/engine/builder/dockerignore/dockerignore_test.go
+++ b/components/engine/builder/dockerignore/dockerignore_test.go
@@ -25,7 +25,7 @@ func TestReadAll(t *testing.T) {
 	}
 
 	diName := filepath.Join(tmpDir, ".dockerignore")
-	content := fmt.Sprintf("test1\n/test2\n/a/file/here\n\nlastfile")
+	content := fmt.Sprintf("test1\n/test2\n/a/file/here\n\nlastfile\n# this is a comment\n! /inverted/abs/path\n!\n! \n")
 	err = ioutil.WriteFile(diName, []byte(content), 0777)
 	if err != nil {
 		t.Fatal(err)
@@ -42,16 +42,28 @@ func TestReadAll(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	if len(di) != 7 {
+		t.Fatalf("Expected 5 entries, got %v", len(di))
+	}
 	if di[0] != "test1" {
 		t.Fatal("First element is not test1")
 	}
-	if di[1] != "/test2" {
-		t.Fatal("Second element is not /test2")
+	if di[1] != "test2" { // according to https://docs.docker.com/engine/reference/builder/#dockerignore-file, /foo/bar should be treated as foo/bar
+		t.Fatal("Second element is not test2")
 	}
-	if di[2] != "/a/file/here" {
-		t.Fatal("Third element is not /a/file/here")
+	if di[2] != "a/file/here" { // according to https://docs.docker.com/engine/reference/builder/#dockerignore-file, /foo/bar should be treated as foo/bar
+		t.Fatal("Third element is not a/file/here")
 	}
 	if di[3] != "lastfile" {
 		t.Fatal("Fourth element is not lastfile")
 	}
+	if di[4] != "!inverted/abs/path" {
+		t.Fatal("Fifth element is not !inverted/abs/path")
+	}
+	if di[5] != "!" {
+		t.Fatalf("Sixth element is not !, but %s", di[5])
+	}
+	if di[6] != "!" {
+		t.Fatalf("Sixth element is not !, but %s", di[6])
+	}
 }
diff --git a/components/engine/builder/fscache/fscache.go b/components/engine/builder/fscache/fscache.go
new file mode 100644
index 0000000000..802db96de0
--- /dev/null
+++ b/components/engine/builder/fscache/fscache.go
@@ -0,0 +1,602 @@
+package fscache
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"sort"
+	"sync"
+	"time"
+
+	"github.com/Sirupsen/logrus"
+	"github.com/boltdb/bolt"
+	"github.com/docker/docker/builder"
+	"github.com/docker/docker/builder/remotecontext"
+	"github.com/docker/docker/client/session/filesync"
+	"github.com/docker/docker/pkg/directory"
+	"github.com/docker/docker/pkg/stringid"
+	"github.com/pkg/errors"
+	"github.com/tonistiigi/fsutil"
+	"golang.org/x/net/context"
+	"golang.org/x/sync/singleflight"
+)
+
+const dbFile = "fscache.db"
+const cacheKey = "cache"
+const metaKey = "meta"
+
+// Backend is a backing implementation for FSCache
+type Backend interface {
+	Get(id string) (string, error)
+	Remove(id string) error
+}
+
+// FSCache allows syncing remote resources to cached snapshots
+type FSCache struct {
+	opt        Opt
+	transports map[string]Transport
+	mu         sync.Mutex
+	g          singleflight.Group
+	store      *fsCacheStore
+}
+
+// Opt defines options for initializing FSCache
+type Opt struct {
+	Backend  Backend
+	Root     string // for storing local metadata
+	GCPolicy GCPolicy
+}
+
+// GCPolicy defines policy for garbage collection
+type GCPolicy struct {
+	MaxSize         uint64
+	MaxKeepDuration time.Duration
+}
+
+// NewFSCache returns new FSCache object
+func NewFSCache(opt Opt) (*FSCache, error) {
+	store, err := newFSCacheStore(opt)
+	if err != nil {
+		return nil, err
+	}
+	return &FSCache{
+		store:      store,
+		opt:        opt,
+		transports: make(map[string]Transport),
+	}, nil
+}
+
+// Transport defines a method for syncing remote data to FSCache
+type Transport interface {
+	Copy(ctx context.Context, id RemoteIdentifier, dest string, cs filesync.CacheUpdater) error
+}
+
+// RemoteIdentifier identifies a transfer request
+type RemoteIdentifier interface {
+	Key() string
+	SharedKey() string
+	Transport() string
+}
+
+// RegisterTransport registers a new transport method
+func (fsc *FSCache) RegisterTransport(id string, transport Transport) error {
+	fsc.mu.Lock()
+	defer fsc.mu.Unlock()
+	if _, ok := fsc.transports[id]; ok {
+		return errors.Errorf("transport %v already exists", id)
+	}
+	fsc.transports[id] = transport
+	return nil
+}
+
+// SyncFrom returns a source based on a remote identifier
+func (fsc *FSCache) SyncFrom(ctx context.Context, id RemoteIdentifier) (builder.Source, error) { // cacheOpt
+	trasportID := id.Transport()
+	fsc.mu.Lock()
+	transport, ok := fsc.transports[id.Transport()]
+	if !ok {
+		fsc.mu.Unlock()
+		return nil, errors.Errorf("invalid transport %s", trasportID)
+	}
+
+	logrus.Debugf("SyncFrom %s %s", id.Key(), id.SharedKey())
+	fsc.mu.Unlock()
+	sourceRef, err, _ := fsc.g.Do(id.Key(), func() (interface{}, error) {
+		var sourceRef *cachedSourceRef
+		sourceRef, err := fsc.store.Get(id.Key())
+		if err == nil {
+			return sourceRef, nil
+		}
+
+		// check for unused shared cache
+		sharedKey := id.SharedKey()
+		if sharedKey != "" {
+			r, err := fsc.store.Rebase(sharedKey, id.Key())
+			if err == nil {
+				sourceRef = r
+			}
+		}
+
+		if sourceRef == nil {
+			var err error
+			sourceRef, err = fsc.store.New(id.Key(), sharedKey)
+			if err != nil {
+				return nil, errors.Wrap(err, "failed to create remote context")
+			}
+		}
+
+		if err := syncFrom(ctx, sourceRef, transport, id); err != nil {
+			sourceRef.Release()
+			return nil, err
+		}
+		if err := sourceRef.resetSize(-1); err != nil {
+			return nil, err
+		}
+		return sourceRef, nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	ref := sourceRef.(*cachedSourceRef)
+	if ref.src == nil { // failsafe
+		return nil, errors.Errorf("invalid empty pull")
+	}
+	wc := &wrappedContext{Source: ref.src, closer: func() error {
+		ref.Release()
+		return nil
+	}}
+	return wc, nil
+}
+
+// DiskUsage reports how much data is allocated by the cache
+func (fsc *FSCache) DiskUsage() (int64, error) {
+	return fsc.store.DiskUsage()
+}
+
+// Prune allows manually cleaning up the cache
+func (fsc *FSCache) Prune() (uint64, error) {
+	return fsc.store.Prune()
+}
+
+// Close stops the gc and closes the persistent db
+func (fsc *FSCache) Close() error {
+	return fsc.store.Close()
+}
+
+func syncFrom(ctx context.Context, cs *cachedSourceRef, transport Transport, id RemoteIdentifier) (retErr error) {
+	src := cs.src
+	if src == nil {
+		src = remotecontext.NewCachableSource(cs.Dir())
+	}
+
+	if !cs.cached {
+		if err := cs.storage.db.View(func(tx *bolt.Tx) error {
+			b := tx.Bucket([]byte(id.Key()))
+			dt := b.Get([]byte(cacheKey))
+			if dt != nil {
+				if err := src.UnmarshalBinary(dt); err != nil {
+					return err
+				}
+			} else {
+				return errors.Wrap(src.Scan(), "failed to scan cache records")
+			}
+			return nil
+		}); err != nil {
+			return err
+		}
+	}
+
+	dc := &detectChanges{f: src.HandleChange}
+
+	// todo: probably send a bucket to `Copy` and let it return source
+	// but need to make sure that tx is safe
+	if err := transport.Copy(ctx, id, cs.Dir(), dc); err != nil {
+		return errors.Wrapf(err, "failed to copy to %s", cs.Dir())
+	}
+
+	if !dc.supported {
+		if err := src.Scan(); err != nil {
+			return errors.Wrap(err, "failed to scan cache records after transfer")
+		}
+	}
+	cs.cached = true
+	cs.src = src
+	return cs.storage.db.Update(func(tx *bolt.Tx) error {
+		dt, err := src.MarshalBinary()
+		if err != nil {
+			return err
+		}
+		b := tx.Bucket([]byte(id.Key()))
+		return b.Put([]byte(cacheKey), dt)
+	})
+}
+
+type fsCacheStore struct {
+	root     string
+	mu       sync.Mutex
+	sources  map[string]*cachedSource
+	db       *bolt.DB
+	fs       Backend
+	gcTimer  *time.Timer
+	gcPolicy GCPolicy
+}
+
+// CachePolicy defines policy for keeping a resource in cache
+type CachePolicy struct {
+	Priority int
+	LastUsed time.Time
+}
+
+func defaultCachePolicy() CachePolicy {
+	return CachePolicy{Priority: 10, LastUsed: time.Now()}
+}
+
+func newFSCacheStore(opt Opt) (*fsCacheStore, error) {
+	if err := os.MkdirAll(opt.Root, 0700); err != nil {
+		return nil, err
+	}
+	p := filepath.Join(opt.Root, dbFile)
+	db, err := bolt.Open(p, 0600, nil)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to open database file %s")
+	}
+	s := &fsCacheStore{db: db, sources: make(map[string]*cachedSource), fs: opt.Backend, gcPolicy: opt.GCPolicy}
+	db.View(func(tx *bolt.Tx) error {
+		return tx.ForEach(func(name []byte, b *bolt.Bucket) error {
+			dt := b.Get([]byte(metaKey))
+			if dt == nil {
+				return nil
+			}
+			var sm sourceMeta
+			if err := json.Unmarshal(dt, &sm); err != nil {
+				return err
+			}
+			dir, err := s.fs.Get(sm.BackendID)
+			if err != nil {
+				return err // TODO: handle gracefully
+			}
+			source := &cachedSource{
+				refs:       make(map[*cachedSourceRef]struct{}),
+				id:         string(name),
+				dir:        dir,
+				sourceMeta: sm,
+				storage:    s,
+			}
+			s.sources[string(name)] = source
+			return nil
+		})
+	})
+
+	s.gcTimer = s.startPeriodicGC(5 * time.Minute)
+	return s, nil
+}
+
+func (s *fsCacheStore) startPeriodicGC(interval time.Duration) *time.Timer {
+	var t *time.Timer
+	t = time.AfterFunc(interval, func() {
+		if err := s.GC(); err != nil {
+			logrus.Errorf("build gc error: %v", err)
+		}
+		t.Reset(interval)
+	})
+	return t
+}
+
+func (s *fsCacheStore) Close() error {
+	s.gcTimer.Stop()
+	return s.db.Close()
+}
+
+func (s *fsCacheStore) New(id, sharedKey string) (*cachedSourceRef, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	var ret *cachedSource
+	if err := s.db.Update(func(tx *bolt.Tx) error {
+		b, err := tx.CreateBucket([]byte(id))
+		if err != nil {
+			return err
+		}
+		backendID := stringid.GenerateRandomID()
+		dir, err := s.fs.Get(backendID)
+		if err != nil {
+			return err
+		}
+		source := &cachedSource{
+			refs: make(map[*cachedSourceRef]struct{}),
+			id:   id,
+			dir:  dir,
+			sourceMeta: sourceMeta{
+				BackendID:   backendID,
+				SharedKey:   sharedKey,
+				CachePolicy: defaultCachePolicy(),
+			},
+			storage: s,
+		}
+		dt, err := json.Marshal(source.sourceMeta)
+		if err != nil {
+			return err
+		}
+		if err := b.Put([]byte(metaKey), dt); err != nil {
+			return err
+		}
+		s.sources[id] = source
+		ret = source
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+	return ret.getRef(), nil
+}
+
+func (s *fsCacheStore) Rebase(sharedKey, newid string) (*cachedSourceRef, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	var ret *cachedSource
+	for id, snap := range s.sources {
+		if snap.SharedKey == sharedKey && len(snap.refs) == 0 {
+			if err := s.db.Update(func(tx *bolt.Tx) error {
+				if err := tx.DeleteBucket([]byte(id)); err != nil {
+					return err
+				}
+				b, err := tx.CreateBucket([]byte(newid))
+				if err != nil {
+					return err
+				}
+				snap.id = newid
+				snap.CachePolicy = defaultCachePolicy()
+				dt, err := json.Marshal(snap.sourceMeta)
+				if err != nil {
+					return err
+				}
+				if err := b.Put([]byte(metaKey), dt); err != nil {
+					return err
+				}
+				delete(s.sources, id)
+				s.sources[newid] = snap
+				return nil
+			}); err != nil {
+				return nil, err
+			}
+			ret = snap
+			break
+		}
+	}
+	if ret == nil {
+		return nil, errors.Errorf("no candidate for rebase")
+	}
+	return ret.getRef(), nil
+}
+
+func (s *fsCacheStore) Get(id string) (*cachedSourceRef, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	src, ok := s.sources[id]
+	if !ok {
+		return nil, errors.Errorf("not found")
+	}
+	return src.getRef(), nil
+}
+
+// DiskUsage reports how much data is allocated by the cache
+func (s *fsCacheStore) DiskUsage() (int64, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	var size int64
+
+	for _, snap := range s.sources {
+		if len(snap.refs) == 0 {
+			ss, err := snap.getSize()
+			if err != nil {
+				return 0, err
+			}
+			size += ss
+		}
+	}
+	return size, nil
+}
+
+// Prune allows manually cleaning up the cache
+func (s *fsCacheStore) Prune() (uint64, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	var size uint64
+
+	for id, snap := range s.sources {
+		if len(snap.refs) == 0 {
+			ss, err := snap.getSize()
+			if err != nil {
+				return size, err
+			}
+			if err := s.delete(id); err != nil {
+				return size, errors.Wrapf(err, "failed to delete %s", id)
+			}
+			size += uint64(ss)
+		}
+	}
+	return size, nil
+}
+
+// GC runs a garbage collector on FSCache
+func (s *fsCacheStore) GC() error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	var size uint64
+
+	cutoff := time.Now().Add(-s.gcPolicy.MaxKeepDuration)
+	var blacklist []*cachedSource
+
+	for id, snap := range s.sources {
+		if len(snap.refs) == 0 {
+			if cutoff.After(snap.CachePolicy.LastUsed) {
+				if err := s.delete(id); err != nil {
+					return errors.Wrapf(err, "failed to delete %s", id)
+				}
+			} else {
+				ss, err := snap.getSize()
+				if err != nil {
+					return err
+				}
+				size += uint64(ss)
+				blacklist = append(blacklist, snap)
+			}
+		}
+	}
+
+	sort.Sort(sortableCacheSources(blacklist))
+	for _, snap := range blacklist {
+		if size <= s.gcPolicy.MaxSize {
+			break
+		}
+		ss, err := snap.getSize()
+		if err != nil {
+			return err
+		}
+		if err := s.delete(snap.id); err != nil {
+			return errors.Wrapf(err, "failed to delete %s", snap.id)
+		}
+		size -= uint64(ss)
+	}
+	return nil
+}
+
+// keep mu while calling this
+func (s *fsCacheStore) delete(id string) error {
+	src, ok := s.sources[id]
+	if !ok {
+		return nil
+	}
+	if len(src.refs) > 0 {
+		return errors.Errorf("can't delete %s because it has active references", id)
+	}
+	delete(s.sources, id)
+	if err := s.db.Update(func(tx *bolt.Tx) error {
+		return tx.DeleteBucket([]byte(id))
+	}); err != nil {
+		return err
+	}
+	if err := s.fs.Remove(src.BackendID); err != nil {
+		return err
+	}
+	return nil
+}
+
+type sourceMeta struct {
+	SharedKey   string
+	BackendID   string
+	CachePolicy CachePolicy
+	Size        int64
+}
+
+type cachedSource struct {
+	sourceMeta
+	refs    map[*cachedSourceRef]struct{}
+	id      string
+	dir     string
+	src     *remotecontext.CachableSource
+	storage *fsCacheStore
+	cached  bool // keep track if cache is up to date
+}
+
+type cachedSourceRef struct {
+	*cachedSource
+}
+
+func (cs *cachedSource) Dir() string {
+	return cs.dir
+}
+
+// hold storage lock before calling
+func (cs *cachedSource) getRef() *cachedSourceRef {
+	ref := &cachedSourceRef{cachedSource: cs}
+	cs.refs[ref] = struct{}{}
+	return ref
+}
+
+// hold storage lock before calling
+func (cs *cachedSource) getSize() (int64, error) {
+	if cs.sourceMeta.Size < 0 {
+		ss, err := directory.Size(cs.dir)
+		if err != nil {
+			return 0, err
+		}
+		if err := cs.resetSize(ss); err != nil {
+			return 0, err
+		}
+		return ss, nil
+	}
+	return cs.sourceMeta.Size, nil
+}
+
+func (cs *cachedSource) resetSize(val int64) error {
+	cs.sourceMeta.Size = val
+	return cs.saveMeta()
+}
+func (cs *cachedSource) saveMeta() error {
+	return cs.storage.db.Update(func(tx *bolt.Tx) error {
+		b := tx.Bucket([]byte(cs.id))
+		dt, err := json.Marshal(cs.sourceMeta)
+		if err != nil {
+			return err
+		}
+		return b.Put([]byte(metaKey), dt)
+	})
+}
+
+func (csr *cachedSourceRef) Release() error {
+	csr.cachedSource.storage.mu.Lock()
+	defer csr.cachedSource.storage.mu.Unlock()
+	delete(csr.cachedSource.refs, csr)
+	if len(csr.cachedSource.refs) == 0 {
+		go csr.cachedSource.storage.GC()
+	}
+	return nil
+}
+
+type detectChanges struct {
+	f         fsutil.ChangeFunc
+	supported bool
+}
+
+func (dc *detectChanges) HandleChange(kind fsutil.ChangeKind, path string, fi os.FileInfo, err error) error {
+	if dc == nil {
+		return nil
+	}
+	return dc.f(kind, path, fi, err)
+}
+
+func (dc *detectChanges) MarkSupported(v bool) {
+	if dc == nil {
+		return
+	}
+	dc.supported = v
+}
+
+type wrappedContext struct {
+	builder.Source
+	closer func() error
+}
+
+func (wc *wrappedContext) Close() error {
+	if err := wc.Source.Close(); err != nil {
+		return err
+	}
+	return wc.closer()
+}
+
+type sortableCacheSources []*cachedSource
+
+// Len is the number of elements in the collection.
+func (s sortableCacheSources) Len() int {
+	return len(s)
+}
+
+// Less reports whether the element with
+// index i should sort before the element with index j.
+func (s sortableCacheSources) Less(i, j int) bool {
+	return s[i].CachePolicy.LastUsed.Before(s[j].CachePolicy.LastUsed)
+}
+
+// Swap swaps the elements with indexes i and j.
+func (s sortableCacheSources) Swap(i, j int) {
+	s[i], s[j] = s[j], s[i]
+}
diff --git a/components/engine/builder/fscache/fscache_test.go b/components/engine/builder/fscache/fscache_test.go
new file mode 100644
index 0000000000..c7c0531f27
--- /dev/null
+++ b/components/engine/builder/fscache/fscache_test.go
@@ -0,0 +1,131 @@
+package fscache
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/docker/docker/client/session/filesync"
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/context"
+)
+
+func TestFSCache(t *testing.T) {
+	tmpDir, err := ioutil.TempDir("", "fscache")
+	assert.Nil(t, err)
+	defer os.RemoveAll(tmpDir)
+
+	backend := NewNaiveCacheBackend(filepath.Join(tmpDir, "backend"))
+
+	opt := Opt{
+		Root:     tmpDir,
+		Backend:  backend,
+		GCPolicy: GCPolicy{MaxSize: 15, MaxKeepDuration: time.Hour},
+	}
+
+	fscache, err := NewFSCache(opt)
+	assert.Nil(t, err)
+
+	defer fscache.Close()
+
+	err = fscache.RegisterTransport("test", &testTransport{})
+	assert.Nil(t, err)
+
+	src1, err := fscache.SyncFrom(context.TODO(), &testIdentifier{"foo", "data", "bar"})
+	assert.Nil(t, err)
+
+	dt, err := ioutil.ReadFile(filepath.Join(src1.Root(), "foo"))
+	assert.Nil(t, err)
+	assert.Equal(t, string(dt), "data")
+
+	// same id doesn't recalculate anything
+	src2, err := fscache.SyncFrom(context.TODO(), &testIdentifier{"foo", "data2", "bar"})
+	assert.Nil(t, err)
+	assert.Equal(t, src1.Root(), src2.Root())
+
+	dt, err = ioutil.ReadFile(filepath.Join(src1.Root(), "foo"))
+	assert.Nil(t, err)
+	assert.Equal(t, string(dt), "data")
+	assert.Nil(t, src2.Close())
+
+	src3, err := fscache.SyncFrom(context.TODO(), &testIdentifier{"foo2", "data2", "bar"})
+	assert.Nil(t, err)
+	assert.NotEqual(t, src1.Root(), src3.Root())
+
+	dt, err = ioutil.ReadFile(filepath.Join(src3.Root(), "foo2"))
+	assert.Nil(t, err)
+	assert.Equal(t, string(dt), "data2")
+
+	s, err := fscache.DiskUsage()
+	assert.Nil(t, err)
+	assert.Equal(t, s, int64(0))
+
+	assert.Nil(t, src3.Close())
+
+	s, err = fscache.DiskUsage()
+	assert.Nil(t, err)
+	assert.Equal(t, s, int64(5))
+
+	// new upload with the same shared key shoutl overwrite
+	src4, err := fscache.SyncFrom(context.TODO(), &testIdentifier{"foo3", "data3", "bar"})
+	assert.Nil(t, err)
+	assert.NotEqual(t, src1.Root(), src3.Root())
+
+	dt, err = ioutil.ReadFile(filepath.Join(src3.Root(), "foo3"))
+	assert.Nil(t, err)
+	assert.Equal(t, string(dt), "data3")
+	assert.Equal(t, src4.Root(), src3.Root())
+	assert.Nil(t, src4.Close())
+
+	s, err = fscache.DiskUsage()
+	assert.Nil(t, err)
+	assert.Equal(t, s, int64(10))
+
+	// this one goes over the GC limit
+	src5, err := fscache.SyncFrom(context.TODO(), &testIdentifier{"foo4", "datadata", "baz"})
+	assert.Nil(t, err)
+	assert.Nil(t, src5.Close())
+
+	// GC happens async
+	time.Sleep(100 * time.Millisecond)
+
+	// only last insertion after GC
+	s, err = fscache.DiskUsage()
+	assert.Nil(t, err)
+	assert.Equal(t, s, int64(8))
+
+	// prune deletes everything
+	released, err := fscache.Prune()
+	assert.Nil(t, err)
+	assert.Equal(t, released, uint64(8))
+
+	s, err = fscache.DiskUsage()
+	assert.Nil(t, err)
+	assert.Equal(t, s, int64(0))
+}
+
+type testTransport struct {
+}
+
+func (t *testTransport) Copy(ctx context.Context, id RemoteIdentifier, dest string, cs filesync.CacheUpdater) error {
+	testid := id.(*testIdentifier)
+	return ioutil.WriteFile(filepath.Join(dest, testid.filename), []byte(testid.data), 0600)
+}
+
+type testIdentifier struct {
+	filename  string
+	data      string
+	sharedKey string
+}
+
+func (t *testIdentifier) Key() string {
+	return t.filename
+}
+func (t *testIdentifier) SharedKey() string {
+	return t.sharedKey
+}
+func (t *testIdentifier) Transport() string {
+	return "test"
+}
diff --git a/components/engine/builder/fscache/naivedriver.go b/components/engine/builder/fscache/naivedriver.go
new file mode 100644
index 0000000000..f40ee570f4
--- /dev/null
+++ b/components/engine/builder/fscache/naivedriver.go
@@ -0,0 +1,28 @@
+package fscache
+
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/pkg/errors"
+)
+
+// NewNaiveCacheBackend is a basic backend implementation for fscache
+func NewNaiveCacheBackend(root string) Backend {
+	return &naiveCacheBackend{root: root}
+}
+
+type naiveCacheBackend struct {
+	root string
+}
+
+func (tcb *naiveCacheBackend) Get(id string) (string, error) {
+	d := filepath.Join(tcb.root, id)
+	if err := os.MkdirAll(d, 0700); err != nil {
+		return "", errors.Wrapf(err, "failed to create tmp dir for %s", d)
+	}
+	return d, nil
+}
+func (tcb *naiveCacheBackend) Remove(id string) error {
+	return errors.WithStack(os.RemoveAll(filepath.Join(tcb.root, id)))
+}
diff --git a/components/engine/builder/remotecontext/archive.go b/components/engine/builder/remotecontext/archive.go
new file mode 100644
index 0000000000..f48cafecd4
--- /dev/null
+++ b/components/engine/builder/remotecontext/archive.go
@@ -0,0 +1,128 @@
+package remotecontext
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/docker/docker/builder"
+	"github.com/docker/docker/pkg/archive"
+	"github.com/docker/docker/pkg/chrootarchive"
+	"github.com/docker/docker/pkg/ioutils"
+	"github.com/docker/docker/pkg/symlink"
+	"github.com/docker/docker/pkg/tarsum"
+	"github.com/pkg/errors"
+)
+
+type archiveContext struct {
+	root string
+	sums tarsum.FileInfoSums
+}
+
+func (c *archiveContext) Close() error {
+	return os.RemoveAll(c.root)
+}
+
+func convertPathError(err error, cleanpath string) error {
+	if err, ok := err.(*os.PathError); ok {
+		err.Path = cleanpath
+		return err
+	}
+	return err
+}
+
+type modifiableContext interface {
+	builder.Source
+	// Remove deletes the entry specified by `path`.
+	// It is usual for directory entries to delete all its subentries.
+	Remove(path string) error
+}
+
+// FromArchive returns a build source from a tar stream.
+//
+// It extracts the tar stream to a temporary folder that is deleted as soon as
+// the Context is closed.
+// As the extraction happens, a tarsum is calculated for every file, and the set of
+// all those sums then becomes the source of truth for all operations on this Context.
+//
+// Closing tarStream has to be done by the caller.
+func FromArchive(tarStream io.Reader) (builder.Source, error) {
+	root, err := ioutils.TempDir("", "docker-builder")
+	if err != nil {
+		return nil, err
+	}
+
+	tsc := &archiveContext{root: root}
+
+	// Make sure we clean-up upon error.  In the happy case the caller
+	// is expected to manage the clean-up
+	defer func() {
+		if err != nil {
+			tsc.Close()
+		}
+	}()
+
+	decompressedStream, err := archive.DecompressStream(tarStream)
+	if err != nil {
+		return nil, err
+	}
+
+	sum, err := tarsum.NewTarSum(decompressedStream, true, tarsum.Version1)
+	if err != nil {
+		return nil, err
+	}
+
+	err = chrootarchive.Untar(sum, root, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	tsc.sums = sum.GetSums()
+
+	return tsc, nil
+}
+
+func (c *archiveContext) Root() string {
+	return c.root
+}
+
+func (c *archiveContext) Remove(path string) error {
+	_, fullpath, err := normalize(path, c.root)
+	if err != nil {
+		return err
+	}
+	return os.RemoveAll(fullpath)
+}
+
+func (c *archiveContext) Hash(path string) (string, error) {
+	cleanpath, fullpath, err := normalize(path, c.root)
+	if err != nil {
+		return "", err
+	}
+
+	rel, err := filepath.Rel(c.root, fullpath)
+	if err != nil {
+		return "", convertPathError(err, cleanpath)
+	}
+
+	// Use the checksum of the followed path(not the possible symlink) because
+	// this is the file that is actually copied.
+	if tsInfo := c.sums.GetFile(filepath.ToSlash(rel)); tsInfo != nil {
+		return tsInfo.Sum(), nil
+	}
+	// We set sum to path by default for the case where GetFile returns nil.
+	// The usual case is if relative path is empty.
+	return path, nil // backwards compat TODO: see if really needed
+}
+
+func normalize(path, root string) (cleanPath, fullPath string, err error) {
+	cleanPath = filepath.Clean(string(os.PathSeparator) + path)[1:]
+	fullPath, err = symlink.FollowSymlinkInScope(filepath.Join(root, path), root)
+	if err != nil {
+		return "", "", errors.Wrapf(err, "forbidden path outside the build context: %s (%s)", path, cleanPath)
+	}
+	if _, err := os.Lstat(fullPath); err != nil {
+		return "", "", errors.WithStack(convertPathError(err, path))
+	}
+	return
+}
diff --git a/components/engine/builder/remotecontext/detect.go b/components/engine/builder/remotecontext/detect.go
index 448782dcca..889f0fce34 100644
--- a/components/engine/builder/remotecontext/detect.go
+++ b/components/engine/builder/remotecontext/detect.go
@@ -14,12 +14,14 @@ import (
 	"github.com/docker/docker/builder/dockerfile/parser"
 	"github.com/docker/docker/builder/dockerignore"
 	"github.com/docker/docker/pkg/fileutils"
-	"github.com/docker/docker/pkg/httputils"
 	"github.com/docker/docker/pkg/symlink"
 	"github.com/docker/docker/pkg/urlutil"
 	"github.com/pkg/errors"
 )
 
+// ClientSessionRemote is identifier for client-session context transport
+const ClientSessionRemote = "client-session"
+
 // Detect returns a context and dockerfile from remote location or local
 // archive. progressReader is only used if remoteURL is actually a URL
 // (not empty, and not a Git endpoint).
@@ -30,6 +32,12 @@ func Detect(config backend.BuildConfig) (remote builder.Source, dockerfile *pars
 	switch {
 	case remoteURL == "":
 		remote, dockerfile, err = newArchiveRemote(config.Source, dockerfilePath)
+	case remoteURL == ClientSessionRemote:
+		res, err := parser.Parse(config.Source)
+		if err != nil {
+			return nil, nil, err
+		}
+		return nil, res, nil
 	case urlutil.IsGitURL(remoteURL):
 		remote, dockerfile, err = newGitRemote(remoteURL, dockerfilePath)
 	case urlutil.IsURL(remoteURL):
@@ -42,7 +50,7 @@ func Detect(config backend.BuildConfig) (remote builder.Source, dockerfile *pars
 
 func newArchiveRemote(rc io.ReadCloser, dockerfilePath string) (builder.Source, *parser.Result, error) {
 	defer rc.Close()
-	c, err := MakeTarSumContext(rc)
+	c, err := FromArchive(rc)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -82,7 +90,7 @@ func withDockerfileFromContext(c modifiableContext, dockerfilePath string) (buil
 }
 
 func newGitRemote(gitURL string, dockerfilePath string) (builder.Source, *parser.Result, error) {
-	c, err := MakeGitContext(gitURL) // TODO: change this to NewLazyContext
+	c, err := MakeGitContext(gitURL) // TODO: change this to NewLazySource
 	if err != nil {
 		return nil, nil, err
 	}
@@ -93,7 +101,7 @@ func newURLRemote(url string, dockerfilePath string, progressReader func(in io.R
 	var dockerfile io.ReadCloser
 	dockerfileFoundErr := errors.New("found-dockerfile")
 	c, err := MakeRemoteContext(url, map[string]func(io.ReadCloser) (io.ReadCloser, error){
-		httputils.MimeTypes.TextPlain: func(rc io.ReadCloser) (io.ReadCloser, error) {
+		mimeTypes.TextPlain: func(rc io.ReadCloser) (io.ReadCloser, error) {
 			dockerfile = rc
 			return nil, dockerfileFoundErr
 		},
diff --git a/components/engine/builder/remotecontext/filehash.go b/components/engine/builder/remotecontext/filehash.go
index a9b324272b..417230297b 100644
--- a/components/engine/builder/remotecontext/filehash.go
+++ b/components/engine/builder/remotecontext/filehash.go
@@ -12,10 +12,21 @@ import (
 
 // NewFileHash returns new hash that is used for the builder cache keys
 func NewFileHash(path, name string, fi os.FileInfo) (hash.Hash, error) {
-	hdr, err := archive.FileInfoHeader(path, name, fi)
+	var link string
+	if fi.Mode()&os.ModeSymlink != 0 {
+		var err error
+		link, err = os.Readlink(path)
+		if err != nil {
+			return nil, err
+		}
+	}
+	hdr, err := archive.FileInfoHeader(name, fi, link)
 	if err != nil {
 		return nil, err
 	}
+	if err := archive.ReadSecurityXattrToTarHeader(path, hdr); err != nil {
+		return nil, err
+	}
 	tsh := &tarsumHash{hdr: hdr, Hash: sha256.New()}
 	tsh.Reset() // initialize header
 	return tsh, nil
diff --git a/components/engine/builder/remotecontext/generate.go b/components/engine/builder/remotecontext/generate.go
new file mode 100644
index 0000000000..0b52d49926
--- /dev/null
+++ b/components/engine/builder/remotecontext/generate.go
@@ -0,0 +1,3 @@
+package remotecontext
+
+//go:generate protoc --gogoslick_out=. tarsum.proto
diff --git a/components/engine/builder/remotecontext/git.go b/components/engine/builder/remotecontext/git.go
index 4204c9f7bb..158bb5ad4d 100644
--- a/components/engine/builder/remotecontext/git.go
+++ b/components/engine/builder/remotecontext/git.go
@@ -4,13 +4,13 @@ import (
 	"os"
 
 	"github.com/docker/docker/builder"
+	"github.com/docker/docker/builder/remotecontext/git"
 	"github.com/docker/docker/pkg/archive"
-	"github.com/docker/docker/pkg/gitutils"
 )
 
 // MakeGitContext returns a Context from gitURL that is cloned in a temporary directory.
 func MakeGitContext(gitURL string) (builder.Source, error) {
-	root, err := gitutils.Clone(gitURL)
+	root, err := git.Clone(gitURL)
 	if err != nil {
 		return nil, err
 	}
@@ -25,5 +25,5 @@ func MakeGitContext(gitURL string) (builder.Source, error) {
 		c.Close()
 		os.RemoveAll(root)
 	}()
-	return MakeTarSumContext(c)
+	return FromArchive(c)
 }
diff --git a/components/engine/pkg/gitutils/gitutils.go b/components/engine/builder/remotecontext/git/gitutils.go
similarity index 99%
rename from components/engine/pkg/gitutils/gitutils.go
rename to components/engine/builder/remotecontext/git/gitutils.go
index 4e09e05239..fd8250dbc3 100644
--- a/components/engine/pkg/gitutils/gitutils.go
+++ b/components/engine/builder/remotecontext/git/gitutils.go
@@ -1,4 +1,4 @@
-package gitutils
+package git
 
 import (
 	"fmt"
diff --git a/components/engine/pkg/gitutils/gitutils_test.go b/components/engine/builder/remotecontext/git/gitutils_test.go
similarity index 65%
rename from components/engine/pkg/gitutils/gitutils_test.go
rename to components/engine/builder/remotecontext/git/gitutils_test.go
index b5fbd18128..eb771f8c98 100644
--- a/components/engine/pkg/gitutils/gitutils_test.go
+++ b/components/engine/builder/remotecontext/git/gitutils_test.go
@@ -1,4 +1,4 @@
-package gitutils
+package git
 
 import (
 	"fmt"
@@ -8,10 +8,12 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
-	"reflect"
 	"runtime"
 	"strings"
 	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestCloneArgsSmartHttp(t *testing.T) {
@@ -28,9 +30,7 @@ func TestCloneArgsSmartHttp(t *testing.T) {
 
 	args := fetchArgs(serverURL, "master")
 	exp := []string{"fetch", "--recurse-submodules=yes", "--depth", "1", "origin", "master"}
-	if !reflect.DeepEqual(args, exp) {
-		t.Fatalf("Expected %v, got %v", exp, args)
-	}
+	assert.Equal(t, exp, args)
 }
 
 func TestCloneArgsDumbHttp(t *testing.T) {
@@ -46,18 +46,14 @@ func TestCloneArgsDumbHttp(t *testing.T) {
 
 	args := fetchArgs(serverURL, "master")
 	exp := []string{"fetch", "--recurse-submodules=yes", "origin", "master"}
-	if !reflect.DeepEqual(args, exp) {
-		t.Fatalf("Expected %v, got %v", exp, args)
-	}
+	assert.Equal(t, exp, args)
 }
 
 func TestCloneArgsGit(t *testing.T) {
 	u, _ := url.Parse("git://github.com/docker/docker")
 	args := fetchArgs(u, "master")
 	exp := []string{"fetch", "--recurse-submodules=yes", "--depth", "1", "origin", "master"}
-	if !reflect.DeepEqual(args, exp) {
-		t.Fatalf("Expected %v, got %v", exp, args)
-	}
+	assert.Equal(t, exp, args)
 }
 
 func gitGetConfig(name string) string {
@@ -72,9 +68,7 @@ func gitGetConfig(name string) string {
 
 func TestCheckoutGit(t *testing.T) {
 	root, err := ioutil.TempDir("", "docker-build-git-checkout")
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 	defer os.RemoveAll(root)
 
 	autocrlf := gitGetConfig("core.autocrlf")
@@ -89,30 +83,22 @@ func TestCheckoutGit(t *testing.T) {
 
 	gitDir := filepath.Join(root, "repo")
 	_, err = git("init", gitDir)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
-	if _, err = gitWithinDir(gitDir, "config", "user.email", "test@docker.com"); err != nil {
-		t.Fatal(err)
-	}
+	_, err = gitWithinDir(gitDir, "config", "user.email", "test@docker.com")
+	require.NoError(t, err)
 
-	if _, err = gitWithinDir(gitDir, "config", "user.name", "Docker test"); err != nil {
-		t.Fatal(err)
-	}
+	_, err = gitWithinDir(gitDir, "config", "user.name", "Docker test")
+	require.NoError(t, err)
 
-	if err = ioutil.WriteFile(filepath.Join(gitDir, "Dockerfile"), []byte("FROM scratch"), 0644); err != nil {
-		t.Fatal(err)
-	}
+	err = ioutil.WriteFile(filepath.Join(gitDir, "Dockerfile"), []byte("FROM scratch"), 0644)
+	require.NoError(t, err)
 
 	subDir := filepath.Join(gitDir, "subdir")
-	if err = os.Mkdir(subDir, 0755); err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, os.Mkdir(subDir, 0755))
 
-	if err = ioutil.WriteFile(filepath.Join(subDir, "Dockerfile"), []byte("FROM scratch\nEXPOSE 5000"), 0644); err != nil {
-		t.Fatal(err)
-	}
+	err = ioutil.WriteFile(filepath.Join(subDir, "Dockerfile"), []byte("FROM scratch\nEXPOSE 5000"), 0644)
+	require.NoError(t, err)
 
 	if runtime.GOOS != "windows" {
 		if err = os.Symlink("../subdir", filepath.Join(gitDir, "parentlink")); err != nil {
@@ -124,37 +110,29 @@ func TestCheckoutGit(t *testing.T) {
 		}
 	}
 
-	if _, err = gitWithinDir(gitDir, "add", "-A"); err != nil {
-		t.Fatal(err)
-	}
+	_, err = gitWithinDir(gitDir, "add", "-A")
+	require.NoError(t, err)
 
-	if _, err = gitWithinDir(gitDir, "commit", "-am", "First commit"); err != nil {
-		t.Fatal(err)
-	}
+	_, err = gitWithinDir(gitDir, "commit", "-am", "First commit")
+	require.NoError(t, err)
 
-	if _, err = gitWithinDir(gitDir, "checkout", "-b", "test"); err != nil {
-		t.Fatal(err)
-	}
+	_, err = gitWithinDir(gitDir, "checkout", "-b", "test")
+	require.NoError(t, err)
 
-	if err = ioutil.WriteFile(filepath.Join(gitDir, "Dockerfile"), []byte("FROM scratch\nEXPOSE 3000"), 0644); err != nil {
-		t.Fatal(err)
-	}
+	err = ioutil.WriteFile(filepath.Join(gitDir, "Dockerfile"), []byte("FROM scratch\nEXPOSE 3000"), 0644)
+	require.NoError(t, err)
 
-	if err = ioutil.WriteFile(filepath.Join(subDir, "Dockerfile"), []byte("FROM busybox\nEXPOSE 5000"), 0644); err != nil {
-		t.Fatal(err)
-	}
+	err = ioutil.WriteFile(filepath.Join(subDir, "Dockerfile"), []byte("FROM busybox\nEXPOSE 5000"), 0644)
+	require.NoError(t, err)
 
-	if _, err = gitWithinDir(gitDir, "add", "-A"); err != nil {
-		t.Fatal(err)
-	}
+	_, err = gitWithinDir(gitDir, "add", "-A")
+	require.NoError(t, err)
 
-	if _, err = gitWithinDir(gitDir, "commit", "-am", "Branch commit"); err != nil {
-		t.Fatal(err)
-	}
+	_, err = gitWithinDir(gitDir, "commit", "-am", "Branch commit")
+	require.NoError(t, err)
 
-	if _, err = gitWithinDir(gitDir, "checkout", "master"); err != nil {
-		t.Fatal(err)
-	}
+	_, err = gitWithinDir(gitDir, "checkout", "master")
+	require.NoError(t, err)
 
 	type singleCase struct {
 		frag string
@@ -190,21 +168,13 @@ func TestCheckoutGit(t *testing.T) {
 		ref, subdir := getRefAndSubdir(c.frag)
 		r, err := checkoutGit(gitDir, ref, subdir)
 
-		fail := err != nil
-		if fail != c.fail {
-			t.Fatalf("Expected %v failure, error was %v\n", c.fail, err)
-		}
 		if c.fail {
+			assert.Error(t, err)
 			continue
 		}
 
 		b, err := ioutil.ReadFile(filepath.Join(r, "Dockerfile"))
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		if string(b) != c.exp {
-			t.Fatalf("Expected %v, was %v\n", c.exp, string(b))
-		}
+		require.NoError(t, err)
+		assert.Equal(t, c.exp, string(b))
 	}
 }
diff --git a/components/engine/builder/remotecontext/lazycontext.go b/components/engine/builder/remotecontext/lazycontext.go
index 283d82a7b1..b29c413fac 100644
--- a/components/engine/builder/remotecontext/lazycontext.go
+++ b/components/engine/builder/remotecontext/lazycontext.go
@@ -12,30 +12,30 @@ import (
 	"github.com/pkg/errors"
 )
 
-// NewLazyContext creates a new LazyContext. LazyContext defines a hashed build
+// NewLazySource creates a new LazyContext. LazyContext defines a hashed build
 // context based on a root directory. Individual files are hashed first time
 // they are asked. It is not safe to call methods of LazyContext concurrently.
-func NewLazyContext(root string) (builder.Source, error) {
-	return &lazyContext{
+func NewLazySource(root string) (builder.Source, error) {
+	return &lazySource{
 		root: root,
 		sums: make(map[string]string),
 	}, nil
 }
 
-type lazyContext struct {
+type lazySource struct {
 	root string
 	sums map[string]string
 }
 
-func (c *lazyContext) Root() string {
+func (c *lazySource) Root() string {
 	return c.root
 }
 
-func (c *lazyContext) Close() error {
+func (c *lazySource) Close() error {
 	return nil
 }
 
-func (c *lazyContext) Hash(path string) (string, error) {
+func (c *lazySource) Hash(path string) (string, error) {
 	cleanPath, fullPath, err := normalize(path, c.root)
 	if err != nil {
 		return "", err
@@ -43,7 +43,7 @@ func (c *lazyContext) Hash(path string) (string, error) {
 
 	fi, err := os.Lstat(fullPath)
 	if err != nil {
-		return "", err
+		return "", errors.WithStack(err)
 	}
 
 	relPath, err := Rel(c.root, fullPath)
@@ -62,7 +62,7 @@ func (c *lazyContext) Hash(path string) (string, error) {
 	return sum, nil
 }
 
-func (c *lazyContext) prepareHash(relPath string, fi os.FileInfo) (string, error) {
+func (c *lazySource) prepareHash(relPath string, fi os.FileInfo) (string, error) {
 	p := filepath.Join(c.root, relPath)
 	h, err := NewFileHash(p, relPath, fi)
 	if err != nil {
diff --git a/components/engine/pkg/httputils/mimetype.go b/components/engine/builder/remotecontext/mimetype.go
similarity index 73%
rename from components/engine/pkg/httputils/mimetype.go
rename to components/engine/builder/remotecontext/mimetype.go
index abef9e9e83..083d609978 100644
--- a/components/engine/pkg/httputils/mimetype.go
+++ b/components/engine/builder/remotecontext/mimetype.go
@@ -1,29 +1,27 @@
-package httputils
+package remotecontext
 
 import (
 	"mime"
 	"net/http"
 )
 
-// MimeTypes stores the MIME content type.
-var MimeTypes = struct {
+// mimeTypes stores the MIME content type.
+var mimeTypes = struct {
 	TextPlain   string
 	OctetStream string
 }{"text/plain", "application/octet-stream"}
 
-// DetectContentType returns a best guess representation of the MIME
+// detectContentType returns a best guess representation of the MIME
 // content type for the bytes at c.  The value detected by
 // http.DetectContentType is guaranteed not be nil, defaulting to
 // application/octet-stream when a better guess cannot be made. The
 // result of this detection is then run through mime.ParseMediaType()
 // which separates the actual MIME string from any parameters.
-func DetectContentType(c []byte) (string, map[string]string, error) {
-
+func detectContentType(c []byte) (string, map[string]string, error) {
 	ct := http.DetectContentType(c)
 	contentType, args, err := mime.ParseMediaType(ct)
 	if err != nil {
 		return "", nil, err
 	}
-
 	return contentType, args, nil
 }
diff --git a/components/engine/builder/remotecontext/mimetype_test.go b/components/engine/builder/remotecontext/mimetype_test.go
new file mode 100644
index 0000000000..8c00ec2860
--- /dev/null
+++ b/components/engine/builder/remotecontext/mimetype_test.go
@@ -0,0 +1,16 @@
+package remotecontext
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDetectContentType(t *testing.T) {
+	input := []byte("That is just a plain text")
+
+	contentType, _, err := detectContentType(input)
+	require.NoError(t, err)
+	assert.Equal(t, "text/plain", contentType)
+}
diff --git a/components/engine/builder/remotecontext/remote.go b/components/engine/builder/remotecontext/remote.go
index 6be464fff1..4afd516be5 100644
--- a/components/engine/builder/remotecontext/remote.go
+++ b/components/engine/builder/remotecontext/remote.go
@@ -2,14 +2,14 @@ package remotecontext
 
 import (
 	"bytes"
-	"errors"
 	"fmt"
 	"io"
 	"io/ioutil"
+	"net/http"
 	"regexp"
 
 	"github.com/docker/docker/builder"
-	"github.com/docker/docker/pkg/httputils"
+	"github.com/pkg/errors"
 )
 
 // When downloading remote contexts, limit the amount (in bytes)
@@ -28,9 +28,9 @@ var mimeRe = regexp.MustCompile(acceptableRemoteMIME)
 //
 // If a match is found, then the body is sent to the contentType handler and a (potentially compressed) tar stream is expected
 // to be returned. If no match is found, it is assumed the body is a tar stream (compressed or not).
-// In either case, an (assumed) tar stream is passed to MakeTarSumContext whose result is returned.
+// In either case, an (assumed) tar stream is passed to FromArchive whose result is returned.
 func MakeRemoteContext(remoteURL string, contentTypeHandlers map[string]func(io.ReadCloser) (io.ReadCloser, error)) (builder.Source, error) {
-	f, err := httputils.Download(remoteURL)
+	f, err := GetWithStatusError(remoteURL)
 	if err != nil {
 		return nil, fmt.Errorf("error downloading remote context %s: %v", remoteURL, err)
 	}
@@ -63,7 +63,25 @@ func MakeRemoteContext(remoteURL string, contentTypeHandlers map[string]func(io.
 
 	// Pass through - this is a pre-packaged context, presumably
 	// with a Dockerfile with the right name inside it.
-	return MakeTarSumContext(contextReader)
+	return FromArchive(contextReader)
+}
+
+// GetWithStatusError does an http.Get() and returns an error if the
+// status code is 4xx or 5xx.
+func GetWithStatusError(url string) (resp *http.Response, err error) {
+	if resp, err = http.Get(url); err != nil {
+		return nil, err
+	}
+	if resp.StatusCode < 400 {
+		return resp, nil
+	}
+	msg := fmt.Sprintf("failed to GET %s with status %s", url, resp.Status)
+	body, err := ioutil.ReadAll(resp.Body)
+	resp.Body.Close()
+	if err != nil {
+		return nil, errors.Wrapf(err, msg+": error reading body")
+	}
+	return nil, errors.Errorf(msg+": %s", bytes.TrimSpace(body))
 }
 
 // inspectResponse looks into the http response data at r to determine whether its
@@ -94,8 +112,8 @@ func inspectResponse(ct string, r io.ReadCloser, clen int64) (string, io.ReadClo
 	// content type for files without an extension (e.g. 'Dockerfile')
 	// so if we receive this value we better check for text content
 	contentType := ct
-	if len(ct) == 0 || ct == httputils.MimeTypes.OctetStream {
-		contentType, _, err = httputils.DetectContentType(preamble)
+	if len(ct) == 0 || ct == mimeTypes.OctetStream {
+		contentType, _, err = detectContentType(preamble)
 		if err != nil {
 			return contentType, bodyReader, err
 		}
diff --git a/components/engine/builder/remotecontext/remote_test.go b/components/engine/builder/remotecontext/remote_test.go
index af9db4b927..c698726e8b 100644
--- a/components/engine/builder/remotecontext/remote_test.go
+++ b/components/engine/builder/remotecontext/remote_test.go
@@ -11,7 +11,9 @@ import (
 
 	"github.com/docker/docker/builder"
 	"github.com/docker/docker/pkg/archive"
-	"github.com/docker/docker/pkg/httputils"
+	"github.com/docker/docker/pkg/testutil"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 var binaryContext = []byte{0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00} //xz magic
@@ -188,7 +190,7 @@ func TestMakeRemoteContext(t *testing.T) {
 	mux.Handle("/", http.FileServer(http.Dir(contextDir)))
 
 	remoteContext, err := MakeRemoteContext(remoteURL, map[string]func(io.ReadCloser) (io.ReadCloser, error){
-		httputils.MimeTypes.TextPlain: func(rc io.ReadCloser) (io.ReadCloser, error) {
+		mimeTypes.TextPlain: func(rc io.ReadCloser) (io.ReadCloser, error) {
 			dockerfile, err := ioutil.ReadAll(rc)
 			if err != nil {
 				return nil, err
@@ -210,25 +212,52 @@ func TestMakeRemoteContext(t *testing.T) {
 		t.Fatal("Remote context should not be nil")
 	}
 
-	tarSumCtx, ok := remoteContext.(*tarSumContext)
-
-	if !ok {
-		t.Fatal("Cast error, remote context should be casted to tarSumContext")
+	h, err := remoteContext.Hash(builder.DefaultDockerfileName)
+	if err != nil {
+		t.Fatalf("failed to compute hash %s", err)
 	}
 
-	fileInfoSums := tarSumCtx.sums
-
-	if fileInfoSums.Len() != 1 {
-		t.Fatalf("Size of file info sums should be 1, got: %d", fileInfoSums.Len())
-	}
-
-	fileInfo := fileInfoSums.GetFile(builder.DefaultDockerfileName)
-
-	if fileInfo == nil {
-		t.Fatalf("There should be file named %s in fileInfoSums", builder.DefaultDockerfileName)
-	}
-
-	if fileInfo.Pos() != 0 {
-		t.Fatalf("File %s should have position 0, got %d", builder.DefaultDockerfileName, fileInfo.Pos())
+	if expected, actual := "7b6b6b66bee9e2102fbdc2228be6c980a2a23adf371962a37286a49f7de0f7cc", h; expected != actual {
+		t.Fatalf("There should be file named %s %s in fileInfoSums", expected, actual)
+	}
+}
+
+func TestGetWithStatusError(t *testing.T) {
+	var testcases = []struct {
+		err          error
+		statusCode   int
+		expectedErr  string
+		expectedBody string
+	}{
+		{
+			statusCode:   200,
+			expectedBody: "THE BODY",
+		},
+		{
+			statusCode:   400,
+			expectedErr:  "with status 400 Bad Request: broke",
+			expectedBody: "broke",
+		},
+	}
+	for _, testcase := range testcases {
+		ts := httptest.NewServer(
+			http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				buffer := bytes.NewBufferString(testcase.expectedBody)
+				w.WriteHeader(testcase.statusCode)
+				w.Write(buffer.Bytes())
+			}),
+		)
+		defer ts.Close()
+		response, err := GetWithStatusError(ts.URL)
+
+		if testcase.expectedErr == "" {
+			require.NoError(t, err)
+
+			body, err := testutil.ReadBody(response.Body)
+			require.NoError(t, err)
+			assert.Contains(t, string(body), testcase.expectedBody)
+		} else {
+			testutil.ErrorContains(t, err, testcase.expectedErr)
+		}
 	}
 }
diff --git a/components/engine/builder/remotecontext/tarsum.go b/components/engine/builder/remotecontext/tarsum.go
index dabf590e59..3ae9d82427 100644
--- a/components/engine/builder/remotecontext/tarsum.go
+++ b/components/engine/builder/remotecontext/tarsum.go
@@ -1,128 +1,174 @@
 package remotecontext
 
 import (
-	"io"
+	"fmt"
 	"os"
 	"path/filepath"
+	"sync"
 
-	"github.com/docker/docker/builder"
-	"github.com/docker/docker/pkg/archive"
-	"github.com/docker/docker/pkg/chrootarchive"
-	"github.com/docker/docker/pkg/ioutils"
 	"github.com/docker/docker/pkg/symlink"
-	"github.com/docker/docker/pkg/tarsum"
+	iradix "github.com/hashicorp/go-immutable-radix"
 	"github.com/pkg/errors"
+	"github.com/tonistiigi/fsutil"
 )
 
-type tarSumContext struct {
+type hashed interface {
+	Hash() string
+}
+
+// CachableSource is a source that contains cache records for its contents
+type CachableSource struct {
+	mu   sync.Mutex
 	root string
-	sums tarsum.FileInfoSums
+	tree *iradix.Tree
+	txn  *iradix.Txn
 }
 
-func (c *tarSumContext) Close() error {
-	return os.RemoveAll(c.root)
+// NewCachableSource creates new CachableSource
+func NewCachableSource(root string) *CachableSource {
+	ts := &CachableSource{
+		tree: iradix.New(),
+		root: root,
+	}
+	return ts
 }
 
-func convertPathError(err error, cleanpath string) error {
-	if err, ok := err.(*os.PathError); ok {
-		err.Path = cleanpath
+// MarshalBinary marshals current cache information to a byte array
+func (cs *CachableSource) MarshalBinary() ([]byte, error) {
+	b := TarsumBackup{Hashes: make(map[string]string)}
+	root := cs.getRoot()
+	root.Walk(func(k []byte, v interface{}) bool {
+		b.Hashes[string(k)] = v.(*fileInfo).sum
+		return false
+	})
+	return b.Marshal()
+}
+
+// UnmarshalBinary decodes cache information for presented byte array
+func (cs *CachableSource) UnmarshalBinary(data []byte) error {
+	var b TarsumBackup
+	if err := b.Unmarshal(data); err != nil {
 		return err
 	}
-	return err
-}
-
-type modifiableContext interface {
-	builder.Source
-	// Remove deletes the entry specified by `path`.
-	// It is usual for directory entries to delete all its subentries.
-	Remove(path string) error
-}
-
-// MakeTarSumContext returns a build Context from a tar stream.
-//
-// It extracts the tar stream to a temporary folder that is deleted as soon as
-// the Context is closed.
-// As the extraction happens, a tarsum is calculated for every file, and the set of
-// all those sums then becomes the source of truth for all operations on this Context.
-//
-// Closing tarStream has to be done by the caller.
-func MakeTarSumContext(tarStream io.Reader) (builder.Source, error) {
-	root, err := ioutils.TempDir("", "docker-builder")
-	if err != nil {
-		return nil, err
+	txn := iradix.New().Txn()
+	for p, v := range b.Hashes {
+		txn.Insert([]byte(p), &fileInfo{sum: v})
 	}
+	cs.mu.Lock()
+	defer cs.mu.Unlock()
+	cs.tree = txn.Commit()
+	return nil
+}
 
-	tsc := &tarSumContext{root: root}
-
-	// Make sure we clean-up upon error.  In the happy case the caller
-	// is expected to manage the clean-up
-	defer func() {
+// Scan rescans the cache information from the file system
+func (cs *CachableSource) Scan() error {
+	lc, err := NewLazySource(cs.root)
+	if err != nil {
+		return err
+	}
+	txn := iradix.New().Txn()
+	err = filepath.Walk(cs.root, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
-			tsc.Close()
+			return errors.Wrapf(err, "failed to walk %s", path)
 		}
-	}()
-
-	decompressedStream, err := archive.DecompressStream(tarStream)
-	if err != nil {
-		return nil, err
-	}
-
-	sum, err := tarsum.NewTarSum(decompressedStream, true, tarsum.Version1)
-	if err != nil {
-		return nil, err
-	}
-
-	err = chrootarchive.Untar(sum, root, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	tsc.sums = sum.GetSums()
-
-	return tsc, nil
-}
-
-func (c *tarSumContext) Root() string {
-	return c.root
-}
-
-func (c *tarSumContext) Remove(path string) error {
-	_, fullpath, err := normalize(path, c.root)
+		rel, err := Rel(cs.root, path)
+		if err != nil {
+			return err
+		}
+		h, err := lc.Hash(rel)
+		if err != nil {
+			return err
+		}
+		txn.Insert([]byte(rel), &fileInfo{sum: h})
+		return nil
+	})
 	if err != nil {
 		return err
 	}
-	return os.RemoveAll(fullpath)
+	cs.mu.Lock()
+	defer cs.mu.Unlock()
+	cs.tree = txn.Commit()
+	return nil
 }
 
-func (c *tarSumContext) Hash(path string) (string, error) {
-	cleanpath, fullpath, err := normalize(path, c.root)
-	if err != nil {
-		return "", err
+// HandleChange notifies the source about a modification operation
+func (cs *CachableSource) HandleChange(kind fsutil.ChangeKind, p string, fi os.FileInfo, err error) (retErr error) {
+	cs.mu.Lock()
+	if cs.txn == nil {
+		cs.txn = cs.tree.Txn()
+	}
+	if kind == fsutil.ChangeKindDelete {
+		cs.txn.Delete([]byte(p))
+		cs.mu.Unlock()
+		return
 	}
 
-	rel, err := filepath.Rel(c.root, fullpath)
-	if err != nil {
-		return "", convertPathError(err, cleanpath)
+	h, ok := fi.(hashed)
+	if !ok {
+		cs.mu.Unlock()
+		return errors.Errorf("invalid fileinfo: %s", p)
 	}
 
-	// Use the checksum of the followed path(not the possible symlink) because
-	// this is the file that is actually copied.
-	if tsInfo := c.sums.GetFile(filepath.ToSlash(rel)); tsInfo != nil {
-		return tsInfo.Sum(), nil
+	hfi := &fileInfo{
+		sum: h.Hash(),
 	}
-	// We set sum to path by default for the case where GetFile returns nil.
-	// The usual case is if relative path is empty.
-	return path, nil // backwards compat TODO: see if really needed
+	cs.txn.Insert([]byte(p), hfi)
+	cs.mu.Unlock()
+	return nil
 }
 
-func normalize(path, root string) (cleanPath, fullPath string, err error) {
-	cleanPath = filepath.Clean(string(os.PathSeparator) + path)[1:]
-	fullPath, err = symlink.FollowSymlinkInScope(filepath.Join(root, path), root)
-	if err != nil {
-		return "", "", errors.Wrapf(err, "forbidden path outside the build context: %s (%s)", path, cleanPath)
+func (cs *CachableSource) getRoot() *iradix.Node {
+	cs.mu.Lock()
+	if cs.txn != nil {
+		cs.tree = cs.txn.Commit()
+		cs.txn = nil
 	}
-	if _, err := os.Lstat(fullPath); err != nil {
+	t := cs.tree
+	cs.mu.Unlock()
+	return t.Root()
+}
+
+// Close closes the source
+func (cs *CachableSource) Close() error {
+	return nil
+}
+
+func (cs *CachableSource) normalize(path string) (cleanpath, fullpath string, err error) {
+	cleanpath = filepath.Clean(string(os.PathSeparator) + path)[1:]
+	fullpath, err = symlink.FollowSymlinkInScope(filepath.Join(cs.root, path), cs.root)
+	if err != nil {
+		return "", "", fmt.Errorf("Forbidden path outside the context: %s (%s)", path, fullpath)
+	}
+	_, err = os.Lstat(fullpath)
+	if err != nil {
 		return "", "", convertPathError(err, path)
 	}
 	return
 }
+
+// Hash returns a hash for a single file in the source
+func (cs *CachableSource) Hash(path string) (string, error) {
+	n := cs.getRoot()
+	sum := ""
+	// TODO: check this for symlinks
+	v, ok := n.Get([]byte(path))
+	if !ok {
+		sum = path
+	} else {
+		sum = v.(*fileInfo).sum
+	}
+	return sum, nil
+}
+
+// Root returns a root directory for the source
+func (cs *CachableSource) Root() string {
+	return cs.root
+}
+
+type fileInfo struct {
+	sum string
+}
+
+func (fi *fileInfo) Hash() string {
+	return fi.sum
+}
diff --git a/components/engine/builder/remotecontext/tarsum.pb.go b/components/engine/builder/remotecontext/tarsum.pb.go
new file mode 100644
index 0000000000..561a7f6367
--- /dev/null
+++ b/components/engine/builder/remotecontext/tarsum.pb.go
@@ -0,0 +1,525 @@
+// Code generated by protoc-gen-gogo.
+// source: tarsum.proto
+// DO NOT EDIT!
+
+/*
+Package remotecontext is a generated protocol buffer package.
+
+It is generated from these files:
+	tarsum.proto
+
+It has these top-level messages:
+	TarsumBackup
+*/
+package remotecontext
+
+import proto "github.com/gogo/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
+import strings "strings"
+import reflect "reflect"
+import github_com_gogo_protobuf_sortkeys "github.com/gogo/protobuf/sortkeys"
+
+import io "io"
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+
+type TarsumBackup struct {
+	Hashes map[string]string `protobuf:"bytes,1,rep,name=Hashes" json:"Hashes,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (m *TarsumBackup) Reset()                    { *m = TarsumBackup{} }
+func (*TarsumBackup) ProtoMessage()               {}
+func (*TarsumBackup) Descriptor() ([]byte, []int) { return fileDescriptorTarsum, []int{0} }
+
+func (m *TarsumBackup) GetHashes() map[string]string {
+	if m != nil {
+		return m.Hashes
+	}
+	return nil
+}
+
+func init() {
+	proto.RegisterType((*TarsumBackup)(nil), "remotecontext.TarsumBackup")
+}
+func (this *TarsumBackup) Equal(that interface{}) bool {
+	if that == nil {
+		if this == nil {
+			return true
+		}
+		return false
+	}
+
+	that1, ok := that.(*TarsumBackup)
+	if !ok {
+		that2, ok := that.(TarsumBackup)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		if this == nil {
+			return true
+		}
+		return false
+	} else if this == nil {
+		return false
+	}
+	if len(this.Hashes) != len(that1.Hashes) {
+		return false
+	}
+	for i := range this.Hashes {
+		if this.Hashes[i] != that1.Hashes[i] {
+			return false
+		}
+	}
+	return true
+}
+func (this *TarsumBackup) GoString() string {
+	if this == nil {
+		return "nil"
+	}
+	s := make([]string, 0, 5)
+	s = append(s, "&remotecontext.TarsumBackup{")
+	keysForHashes := make([]string, 0, len(this.Hashes))
+	for k, _ := range this.Hashes {
+		keysForHashes = append(keysForHashes, k)
+	}
+	github_com_gogo_protobuf_sortkeys.Strings(keysForHashes)
+	mapStringForHashes := "map[string]string{"
+	for _, k := range keysForHashes {
+		mapStringForHashes += fmt.Sprintf("%#v: %#v,", k, this.Hashes[k])
+	}
+	mapStringForHashes += "}"
+	if this.Hashes != nil {
+		s = append(s, "Hashes: "+mapStringForHashes+",\n")
+	}
+	s = append(s, "}")
+	return strings.Join(s, "")
+}
+func valueToGoStringTarsum(v interface{}, typ string) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
+}
+func (m *TarsumBackup) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TarsumBackup) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.Hashes) > 0 {
+		for k, _ := range m.Hashes {
+			dAtA[i] = 0xa
+			i++
+			v := m.Hashes[k]
+			mapSize := 1 + len(k) + sovTarsum(uint64(len(k))) + 1 + len(v) + sovTarsum(uint64(len(v)))
+			i = encodeVarintTarsum(dAtA, i, uint64(mapSize))
+			dAtA[i] = 0xa
+			i++
+			i = encodeVarintTarsum(dAtA, i, uint64(len(k)))
+			i += copy(dAtA[i:], k)
+			dAtA[i] = 0x12
+			i++
+			i = encodeVarintTarsum(dAtA, i, uint64(len(v)))
+			i += copy(dAtA[i:], v)
+		}
+	}
+	return i, nil
+}
+
+func encodeFixed64Tarsum(dAtA []byte, offset int, v uint64) int {
+	dAtA[offset] = uint8(v)
+	dAtA[offset+1] = uint8(v >> 8)
+	dAtA[offset+2] = uint8(v >> 16)
+	dAtA[offset+3] = uint8(v >> 24)
+	dAtA[offset+4] = uint8(v >> 32)
+	dAtA[offset+5] = uint8(v >> 40)
+	dAtA[offset+6] = uint8(v >> 48)
+	dAtA[offset+7] = uint8(v >> 56)
+	return offset + 8
+}
+func encodeFixed32Tarsum(dAtA []byte, offset int, v uint32) int {
+	dAtA[offset] = uint8(v)
+	dAtA[offset+1] = uint8(v >> 8)
+	dAtA[offset+2] = uint8(v >> 16)
+	dAtA[offset+3] = uint8(v >> 24)
+	return offset + 4
+}
+func encodeVarintTarsum(dAtA []byte, offset int, v uint64) int {
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return offset + 1
+}
+func (m *TarsumBackup) Size() (n int) {
+	var l int
+	_ = l
+	if len(m.Hashes) > 0 {
+		for k, v := range m.Hashes {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovTarsum(uint64(len(k))) + 1 + len(v) + sovTarsum(uint64(len(v)))
+			n += mapEntrySize + 1 + sovTarsum(uint64(mapEntrySize))
+		}
+	}
+	return n
+}
+
+func sovTarsum(x uint64) (n int) {
+	for {
+		n++
+		x >>= 7
+		if x == 0 {
+			break
+		}
+	}
+	return n
+}
+func sozTarsum(x uint64) (n int) {
+	return sovTarsum(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *TarsumBackup) String() string {
+	if this == nil {
+		return "nil"
+	}
+	keysForHashes := make([]string, 0, len(this.Hashes))
+	for k, _ := range this.Hashes {
+		keysForHashes = append(keysForHashes, k)
+	}
+	github_com_gogo_protobuf_sortkeys.Strings(keysForHashes)
+	mapStringForHashes := "map[string]string{"
+	for _, k := range keysForHashes {
+		mapStringForHashes += fmt.Sprintf("%v: %v,", k, this.Hashes[k])
+	}
+	mapStringForHashes += "}"
+	s := strings.Join([]string{`&TarsumBackup{`,
+		`Hashes:` + mapStringForHashes + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringTarsum(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *TarsumBackup) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTarsum
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TarsumBackup: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TarsumBackup: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Hashes", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTarsum
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTarsum
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var keykey uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTarsum
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				keykey |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			var stringLenmapkey uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTarsum
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLenmapkey |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLenmapkey := int(stringLenmapkey)
+			if intStringLenmapkey < 0 {
+				return ErrInvalidLengthTarsum
+			}
+			postStringIndexmapkey := iNdEx + intStringLenmapkey
+			if postStringIndexmapkey > l {
+				return io.ErrUnexpectedEOF
+			}
+			mapkey := string(dAtA[iNdEx:postStringIndexmapkey])
+			iNdEx = postStringIndexmapkey
+			if m.Hashes == nil {
+				m.Hashes = make(map[string]string)
+			}
+			if iNdEx < postIndex {
+				var valuekey uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowTarsum
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					valuekey |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				var stringLenmapvalue uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowTarsum
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					stringLenmapvalue |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				intStringLenmapvalue := int(stringLenmapvalue)
+				if intStringLenmapvalue < 0 {
+					return ErrInvalidLengthTarsum
+				}
+				postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+				if postStringIndexmapvalue > l {
+					return io.ErrUnexpectedEOF
+				}
+				mapvalue := string(dAtA[iNdEx:postStringIndexmapvalue])
+				iNdEx = postStringIndexmapvalue
+				m.Hashes[mapkey] = mapvalue
+			} else {
+				var mapvalue string
+				m.Hashes[mapkey] = mapvalue
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTarsum(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthTarsum
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipTarsum(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowTarsum
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowTarsum
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+			return iNdEx, nil
+		case 1:
+			iNdEx += 8
+			return iNdEx, nil
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowTarsum
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			iNdEx += length
+			if length < 0 {
+				return 0, ErrInvalidLengthTarsum
+			}
+			return iNdEx, nil
+		case 3:
+			for {
+				var innerWire uint64
+				var start int = iNdEx
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return 0, ErrIntOverflowTarsum
+					}
+					if iNdEx >= l {
+						return 0, io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					innerWire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				innerWireType := int(innerWire & 0x7)
+				if innerWireType == 4 {
+					break
+				}
+				next, err := skipTarsum(dAtA[start:])
+				if err != nil {
+					return 0, err
+				}
+				iNdEx = start + next
+			}
+			return iNdEx, nil
+		case 4:
+			return iNdEx, nil
+		case 5:
+			iNdEx += 4
+			return iNdEx, nil
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+	}
+	panic("unreachable")
+}
+
+var (
+	ErrInvalidLengthTarsum = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowTarsum   = fmt.Errorf("proto: integer overflow")
+)
+
+func init() { proto.RegisterFile("tarsum.proto", fileDescriptorTarsum) }
+
+var fileDescriptorTarsum = []byte{
+	// 196 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xe2, 0xe2, 0x29, 0x49, 0x2c, 0x2a,
+	0x2e, 0xcd, 0xd5, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0xe2, 0x2d, 0x4a, 0xcd, 0xcd, 0x2f, 0x49,
+	0x4d, 0xce, 0xcf, 0x2b, 0x49, 0xad, 0x28, 0x51, 0xea, 0x62, 0xe4, 0xe2, 0x09, 0x01, 0xcb, 0x3b,
+	0x25, 0x26, 0x67, 0x97, 0x16, 0x08, 0xd9, 0x73, 0xb1, 0x79, 0x24, 0x16, 0x67, 0xa4, 0x16, 0x4b,
+	0x30, 0x2a, 0x30, 0x6b, 0x70, 0x1b, 0xa9, 0xeb, 0xa1, 0x68, 0xd0, 0x43, 0x56, 0xac, 0x07, 0x51,
+	0xe9, 0x9a, 0x57, 0x52, 0x54, 0x19, 0x04, 0xd5, 0x26, 0x65, 0xc9, 0xc5, 0x8d, 0x24, 0x2c, 0x24,
+	0xc0, 0xc5, 0x9c, 0x9d, 0x5a, 0x29, 0xc1, 0xa8, 0xc0, 0xa8, 0xc1, 0x19, 0x04, 0x62, 0x0a, 0x89,
+	0x70, 0xb1, 0x96, 0x25, 0xe6, 0x94, 0xa6, 0x4a, 0x30, 0x81, 0xc5, 0x20, 0x1c, 0x2b, 0x26, 0x0b,
+	0x46, 0x27, 0x9d, 0x0b, 0x0f, 0xe5, 0x18, 0x6e, 0x3c, 0x94, 0x63, 0xf8, 0xf0, 0x50, 0x8e, 0xb1,
+	0xe1, 0x91, 0x1c, 0xe3, 0x8a, 0x47, 0x72, 0x8c, 0x27, 0x1e, 0xc9, 0x31, 0x5e, 0x78, 0x24, 0xc7,
+	0xf8, 0xe0, 0x91, 0x1c, 0xe3, 0x8b, 0x47, 0x72, 0x0c, 0x1f, 0x1e, 0xc9, 0x31, 0x4e, 0x78, 0x2c,
+	0xc7, 0x90, 0xc4, 0x06, 0xf6, 0x90, 0x31, 0x20, 0x00, 0x00, 0xff, 0xff, 0x89, 0x57, 0x7d, 0x3f,
+	0xe0, 0x00, 0x00, 0x00,
+}
diff --git a/components/engine/builder/remotecontext/tarsum.proto b/components/engine/builder/remotecontext/tarsum.proto
new file mode 100644
index 0000000000..cb94240ba8
--- /dev/null
+++ b/components/engine/builder/remotecontext/tarsum.proto
@@ -0,0 +1,7 @@
+syntax = "proto3";
+
+package remotecontext; // no namespace because only used internally
+
+message TarsumBackup {
+  map<string, string> Hashes = 1;
+}
\ No newline at end of file
diff --git a/components/engine/builder/remotecontext/tarsum_test.go b/components/engine/builder/remotecontext/tarsum_test.go
index 35d38cef3c..8a9d69bb73 100644
--- a/components/engine/builder/remotecontext/tarsum_test.go
+++ b/components/engine/builder/remotecontext/tarsum_test.go
@@ -9,6 +9,7 @@ import (
 	"github.com/docker/docker/builder"
 	"github.com/docker/docker/pkg/archive"
 	"github.com/docker/docker/pkg/reexec"
+	"github.com/pkg/errors"
 )
 
 const (
@@ -22,24 +23,22 @@ func init() {
 
 func TestCloseRootDirectory(t *testing.T) {
 	contextDir, err := ioutil.TempDir("", "builder-tarsum-test")
-
+	defer os.RemoveAll(contextDir)
 	if err != nil {
 		t.Fatalf("Error with creating temporary directory: %s", err)
 	}
 
-	tarsum := &tarSumContext{root: contextDir}
-
-	err = tarsum.Close()
+	src := makeTestArchiveContext(t, contextDir)
+	err = src.Close()
 
 	if err != nil {
 		t.Fatalf("Error while executing Close: %s", err)
 	}
 
-	_, err = os.Stat(contextDir)
+	_, err = os.Stat(src.Root())
 
 	if !os.IsNotExist(err) {
 		t.Fatal("Directory should not exist at this point")
-		defer os.RemoveAll(contextDir)
 	}
 }
 
@@ -49,7 +48,7 @@ func TestHashFile(t *testing.T) {
 
 	createTestTempFile(t, contextDir, filename, contents, 0755)
 
-	tarSum := makeTestTarsumContext(t, contextDir)
+	tarSum := makeTestArchiveContext(t, contextDir)
 
 	sum, err := tarSum.Hash(filename)
 
@@ -80,7 +79,7 @@ func TestHashSubdir(t *testing.T) {
 
 	testFilename := createTestTempFile(t, contextSubdir, filename, contents, 0755)
 
-	tarSum := makeTestTarsumContext(t, contextDir)
+	tarSum := makeTestArchiveContext(t, contextDir)
 
 	relativePath, err := filepath.Rel(contextDir, testFilename)
 
@@ -109,11 +108,9 @@ func TestStatNotExisting(t *testing.T) {
 	contextDir, cleanup := createTestTempDir(t, "", "builder-tarsum-test")
 	defer cleanup()
 
-	tarSum := &tarSumContext{root: contextDir}
-
-	_, err := tarSum.Hash("not-existing")
-
-	if !os.IsNotExist(err) {
+	src := makeTestArchiveContext(t, contextDir)
+	_, err := src.Hash("not-existing")
+	if !os.IsNotExist(errors.Cause(err)) {
 		t.Fatalf("This file should not exist: %s", err)
 	}
 }
@@ -130,30 +127,31 @@ func TestRemoveDirectory(t *testing.T) {
 		t.Fatalf("Error when getting relative path: %s", err)
 	}
 
-	tarSum := &tarSumContext{root: contextDir}
+	src := makeTestArchiveContext(t, contextDir)
+
+	tarSum := src.(modifiableContext)
 
 	err = tarSum.Remove(relativePath)
-
 	if err != nil {
 		t.Fatalf("Error when executing Remove: %s", err)
 	}
 
-	_, err = os.Stat(contextSubdir)
+	_, err = src.Hash(contextSubdir)
 
-	if !os.IsNotExist(err) {
+	if !os.IsNotExist(errors.Cause(err)) {
 		t.Fatal("Directory should not exist at this point")
 	}
 }
 
-func makeTestTarsumContext(t *testing.T, dir string) builder.Source {
+func makeTestArchiveContext(t *testing.T, dir string) builder.Source {
 	tarStream, err := archive.Tar(dir, archive.Uncompressed)
 	if err != nil {
 		t.Fatalf("error: %s", err)
 	}
 	defer tarStream.Close()
-	tarSum, err := MakeTarSumContext(tarStream)
+	tarSum, err := FromArchive(tarStream)
 	if err != nil {
-		t.Fatalf("Error when executing MakeTarSumContext: %s", err)
+		t.Fatalf("Error when executing FromArchive: %s", err)
 	}
 	return tarSum
 }
diff --git a/components/engine/cli/flags/configdir.go b/components/engine/cli/config/configdir.go
similarity index 68%
rename from components/engine/cli/flags/configdir.go
rename to components/engine/cli/config/configdir.go
index 5ac7b4fbb9..de22577811 100644
--- a/components/engine/cli/flags/configdir.go
+++ b/components/engine/cli/config/configdir.go
@@ -1,4 +1,4 @@
-package flags
+package config
 
 import (
 	"os"
@@ -12,9 +12,9 @@ var (
 	configFileDir = ".docker"
 )
 
-// ConfigurationDir returns the path to the configuration directory as specified by the DOCKER_CONFIG environment variable.
+// Dir returns the path to the configuration directory as specified by the DOCKER_CONFIG environment variable.
 // TODO: this was copied from cli/config/configfile and should be removed once cmd/dockerd moves
-func ConfigurationDir() string {
+func Dir() string {
 	return configDir
 }
 
diff --git a/components/engine/cli/flags/client.go b/components/engine/cli/flags/client.go
deleted file mode 100644
index 9b6940f6bd..0000000000
--- a/components/engine/cli/flags/client.go
+++ /dev/null
@@ -1,13 +0,0 @@
-package flags
-
-// ClientOptions are the options used to configure the client cli
-type ClientOptions struct {
-	Common    *CommonOptions
-	ConfigDir string
-	Version   bool
-}
-
-// NewClientOptions returns a new ClientOptions
-func NewClientOptions() *ClientOptions {
-	return &ClientOptions{Common: NewCommonOptions()}
-}
diff --git a/components/engine/cli/required.go b/components/engine/cli/required.go
index d28af86be5..d56bc213ad 100644
--- a/components/engine/cli/required.go
+++ b/components/engine/cli/required.go
@@ -25,72 +25,3 @@ func NoArgs(cmd *cobra.Command, args []string) error {
 		cmd.Short,
 	)
 }
-
-// RequiresMinArgs returns an error if there is not at least min args
-func RequiresMinArgs(min int) cobra.PositionalArgs {
-	return func(cmd *cobra.Command, args []string) error {
-		if len(args) >= min {
-			return nil
-		}
-		return errors.Errorf(
-			"\"%s\" requires at least %d argument(s).\nSee '%s --help'.\n\nUsage:  %s\n\n%s",
-			cmd.CommandPath(),
-			min,
-			cmd.CommandPath(),
-			cmd.UseLine(),
-			cmd.Short,
-		)
-	}
-}
-
-// RequiresMaxArgs returns an error if there is not at most max args
-func RequiresMaxArgs(max int) cobra.PositionalArgs {
-	return func(cmd *cobra.Command, args []string) error {
-		if len(args) <= max {
-			return nil
-		}
-		return errors.Errorf(
-			"\"%s\" requires at most %d argument(s).\nSee '%s --help'.\n\nUsage:  %s\n\n%s",
-			cmd.CommandPath(),
-			max,
-			cmd.CommandPath(),
-			cmd.UseLine(),
-			cmd.Short,
-		)
-	}
-}
-
-// RequiresRangeArgs returns an error if there is not at least min args and at most max args
-func RequiresRangeArgs(min int, max int) cobra.PositionalArgs {
-	return func(cmd *cobra.Command, args []string) error {
-		if len(args) >= min && len(args) <= max {
-			return nil
-		}
-		return errors.Errorf(
-			"\"%s\" requires at least %d and at most %d argument(s).\nSee '%s --help'.\n\nUsage:  %s\n\n%s",
-			cmd.CommandPath(),
-			min,
-			max,
-			cmd.CommandPath(),
-			cmd.UseLine(),
-			cmd.Short,
-		)
-	}
-}
-
-// ExactArgs returns an error if there is not the exact number of args
-func ExactArgs(number int) cobra.PositionalArgs {
-	return func(cmd *cobra.Command, args []string) error {
-		if len(args) == number {
-			return nil
-		}
-		return errors.Errorf(
-			"\"%s\" requires exactly %d argument(s).\nSee '%s --help'.\n\nUsage:  %s\n\n%s",
-			cmd.CommandPath(),
-			number,
-			cmd.CommandPath(),
-			cmd.UseLine(),
-			cmd.Short,
-		)
-	}
-}
diff --git a/components/engine/client/build_prune.go b/components/engine/client/build_prune.go
new file mode 100644
index 0000000000..ccab115d33
--- /dev/null
+++ b/components/engine/client/build_prune.go
@@ -0,0 +1,30 @@
+package client
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/docker/docker/api/types"
+	"golang.org/x/net/context"
+)
+
+// BuildCachePrune requests the daemon to delete unused cache data
+func (cli *Client) BuildCachePrune(ctx context.Context) (*types.BuildCachePruneReport, error) {
+	if err := cli.NewVersionError("1.31", "build prune"); err != nil {
+		return nil, err
+	}
+
+	report := types.BuildCachePruneReport{}
+
+	serverResp, err := cli.post(ctx, "/build/prune", nil, nil, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer ensureReaderClosed(serverResp)
+
+	if err := json.NewDecoder(serverResp.body).Decode(&report); err != nil {
+		return nil, fmt.Errorf("Error retrieving disk usage: %v", err)
+	}
+
+	return &report, nil
+}
diff --git a/components/engine/client/client.go b/components/engine/client/client.go
index 34897b9549..222aa50f11 100644
--- a/components/engine/client/client.go
+++ b/components/engine/client/client.go
@@ -55,8 +55,11 @@ import (
 	"strings"
 
 	"github.com/docker/docker/api"
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/versions"
 	"github.com/docker/go-connections/sockets"
 	"github.com/docker/go-connections/tlsconfig"
+	"golang.org/x/net/context"
 )
 
 // ErrRedirect is the error returned by checkRedirect when the request is non-GET.
@@ -216,9 +219,9 @@ func (cli *Client) getAPIPath(p string, query url.Values) string {
 	var apiPath string
 	if cli.version != "" {
 		v := strings.TrimPrefix(cli.version, "v")
-		apiPath = fmt.Sprintf("%s/v%s%s", cli.basePath, v, p)
+		apiPath = cli.basePath + "/v" + v + p
 	} else {
-		apiPath = fmt.Sprintf("%s%s", cli.basePath, p)
+		apiPath = cli.basePath + p
 	}
 
 	u := &url.URL{
@@ -238,13 +241,29 @@ func (cli *Client) ClientVersion() string {
 	return cli.version
 }
 
-// UpdateClientVersion updates the version string associated with this
-// instance of the Client. This operation doesn't acquire a mutex.
-func (cli *Client) UpdateClientVersion(v string) {
-	if !cli.manualOverride {
-		cli.version = v
+// NegotiateAPIVersion updates the version string associated with this
+// instance of the Client to match the latest version the server supports
+func (cli *Client) NegotiateAPIVersion(ctx context.Context) {
+	ping, _ := cli.Ping(ctx)
+	cli.NegotiateAPIVersionPing(ping)
+}
+
+// NegotiateAPIVersionPing updates the version string associated with this
+// instance of the Client to match the latest version the server supports
+func (cli *Client) NegotiateAPIVersionPing(p types.Ping) {
+	if cli.manualOverride {
+		return
 	}
 
+	// try the latest version before versioning headers existed
+	if p.APIVersion == "" {
+		p.APIVersion = "1.24"
+	}
+
+	// if server version is lower than the current cli, downgrade
+	if versions.LessThan(p.APIVersion, cli.ClientVersion()) {
+		cli.version = p.APIVersion
+	}
 }
 
 // DaemonHost returns the host associated with this instance of the Client.
diff --git a/components/engine/client/client_test.go b/components/engine/client/client_test.go
index 77214bc53c..bc911c0c4a 100644
--- a/components/engine/client/client_test.go
+++ b/components/engine/client/client_test.go
@@ -2,8 +2,6 @@ package client
 
 import (
 	"bytes"
-	"encoding/json"
-	"io/ioutil"
 	"net/http"
 	"net/url"
 	"os"
@@ -14,7 +12,6 @@ import (
 	"github.com/docker/docker/api"
 	"github.com/docker/docker/api/types"
 	"github.com/stretchr/testify/assert"
-	"golang.org/x/net/context"
 )
 
 func TestNewEnvClient(t *testing.T) {
@@ -81,57 +78,27 @@ func TestNewEnvClient(t *testing.T) {
 			expectedVersion: "1.22",
 		},
 	}
+
+	env := envToMap()
+	defer mapToEnv(env)
 	for _, c := range cases {
-		recoverEnvs := setupEnvs(t, c.envs)
+		mapToEnv(env)
+		mapToEnv(c.envs)
 		apiclient, err := NewEnvClient()
 		if c.expectedError != "" {
-			if err == nil {
-				t.Errorf("expected an error for %v", c)
-			} else if err.Error() != c.expectedError {
-				t.Errorf("expected an error %s, got %s, for %v", c.expectedError, err.Error(), c)
-			}
+			assert.Error(t, err)
+			assert.Equal(t, c.expectedError, err.Error())
 		} else {
-			if err != nil {
-				t.Error(err)
-			}
+			assert.NoError(t, err)
 			version := apiclient.ClientVersion()
-			if version != c.expectedVersion {
-				t.Errorf("expected %s, got %s, for %v", c.expectedVersion, version, c)
-			}
+			assert.Equal(t, c.expectedVersion, version)
 		}
 
 		if c.envs["DOCKER_TLS_VERIFY"] != "" {
 			// pedantic checking that this is handled correctly
 			tr := apiclient.client.Transport.(*http.Transport)
-			if tr.TLSClientConfig == nil {
-				t.Error("no TLS config found when DOCKER_TLS_VERIFY enabled")
-			}
-
-			if tr.TLSClientConfig.InsecureSkipVerify {
-				t.Error("TLS verification should be enabled")
-			}
-		}
-
-		recoverEnvs(t)
-	}
-}
-
-func setupEnvs(t *testing.T, envs map[string]string) func(*testing.T) {
-	oldEnvs := map[string]string{}
-	for key, value := range envs {
-		oldEnv := os.Getenv(key)
-		oldEnvs[key] = oldEnv
-		err := os.Setenv(key, value)
-		if err != nil {
-			t.Error(err)
-		}
-	}
-	return func(t *testing.T) {
-		for key, value := range oldEnvs {
-			err := os.Setenv(key, value)
-			if err != nil {
-				t.Error(err)
-			}
+			assert.NotNil(t, tr.TLSClientConfig)
+			assert.Equal(t, tr.TLSClientConfig.InsecureSkipVerify, false)
 		}
 	}
 }
@@ -161,14 +128,10 @@ func TestGetAPIPath(t *testing.T) {
 			t.Fatal(err)
 		}
 		g := c.getAPIPath(cs.p, cs.q)
-		if g != cs.e {
-			t.Fatalf("Expected %s, got %s", cs.e, g)
-		}
+		assert.Equal(t, g, cs.e)
 
 		err = c.Close()
-		if nil != err {
-			t.Fatalf("close client failed, error message: %s", err)
-		}
+		assert.NoError(t, err)
 	}
 }
 
@@ -189,84 +152,33 @@ func TestParseHost(t *testing.T) {
 
 	for _, cs := range cases {
 		p, a, b, e := ParseHost(cs.host)
-		if cs.err && e == nil {
-			t.Fatalf("expected error, got nil")
-		}
-		if !cs.err && e != nil {
-			t.Fatal(e)
-		}
-		if cs.proto != p {
-			t.Fatalf("expected proto %s, got %s", cs.proto, p)
-		}
-		if cs.addr != a {
-			t.Fatalf("expected addr %s, got %s", cs.addr, a)
-		}
-		if cs.base != b {
-			t.Fatalf("expected base %s, got %s", cs.base, b)
-		}
-	}
-}
-
-func TestUpdateClientVersion(t *testing.T) {
-	client := &Client{
-		client: newMockClient(func(req *http.Request) (*http.Response, error) {
-			splitQuery := strings.Split(req.URL.Path, "/")
-			queryVersion := splitQuery[1]
-			b, err := json.Marshal(types.Version{
-				APIVersion: queryVersion,
-			})
-			if err != nil {
-				return nil, err
-			}
-			return &http.Response{
-				StatusCode: http.StatusOK,
-				Body:       ioutil.NopCloser(bytes.NewReader(b)),
-			}, nil
-		}),
-	}
-
-	cases := []struct {
-		v string
-	}{
-		{"1.20"},
-		{"v1.21"},
-		{"1.22"},
-		{"v1.22"},
-	}
-
-	for _, cs := range cases {
-		client.UpdateClientVersion(cs.v)
-		r, err := client.ServerVersion(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
-		if strings.TrimPrefix(r.APIVersion, "v") != strings.TrimPrefix(cs.v, "v") {
-			t.Fatalf("Expected %s, got %s", cs.v, r.APIVersion)
+		// if we expected an error to be returned...
+		if cs.err {
+			assert.Error(t, e)
 		}
+		assert.Equal(t, cs.proto, p)
+		assert.Equal(t, cs.addr, a)
+		assert.Equal(t, cs.base, b)
 	}
 }
 
 func TestNewEnvClientSetsDefaultVersion(t *testing.T) {
-	// Unset environment variables
-	envVarKeys := []string{
-		"DOCKER_HOST",
-		"DOCKER_API_VERSION",
-		"DOCKER_TLS_VERIFY",
-		"DOCKER_CERT_PATH",
-	}
-	envVarValues := make(map[string]string)
-	for _, key := range envVarKeys {
-		envVarValues[key] = os.Getenv(key)
-		os.Setenv(key, "")
+	env := envToMap()
+	defer mapToEnv(env)
+
+	envMap := map[string]string{
+		"DOCKER_HOST":        "",
+		"DOCKER_API_VERSION": "",
+		"DOCKER_TLS_VERIFY":  "",
+		"DOCKER_CERT_PATH":   "",
 	}
+	mapToEnv(envMap)
 
 	client, err := NewEnvClient()
 	if err != nil {
 		t.Fatal(err)
 	}
-	if client.version != api.DefaultVersion {
-		t.Fatalf("Expected %s, got %s", api.DefaultVersion, client.version)
-	}
+	assert.Equal(t, client.version, api.DefaultVersion)
 
 	expected := "1.22"
 	os.Setenv("DOCKER_API_VERSION", expected)
@@ -274,14 +186,112 @@ func TestNewEnvClientSetsDefaultVersion(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if client.version != expected {
-		t.Fatalf("Expected %s, got %s", expected, client.version)
+	assert.Equal(t, expected, client.version)
+}
+
+// TestNegotiateAPIVersionEmpty asserts that client.Client can
+// negotiate a compatible APIVersion when omitted
+func TestNegotiateAPIVersionEmpty(t *testing.T) {
+	env := envToMap()
+	defer mapToEnv(env)
+
+	envMap := map[string]string{
+		"DOCKER_API_VERSION": "",
+	}
+	mapToEnv(envMap)
+
+	client, err := NewEnvClient()
+	if err != nil {
+		t.Fatal(err)
 	}
 
-	// Restore environment variables
-	for _, key := range envVarKeys {
-		os.Setenv(key, envVarValues[key])
+	ping := types.Ping{
+		APIVersion:   "",
+		OSType:       "linux",
+		Experimental: false,
 	}
+
+	// set our version to something new
+	client.version = "1.25"
+
+	// if no version from server, expect the earliest
+	// version before APIVersion was implemented
+	expected := "1.24"
+
+	// test downgrade
+	client.NegotiateAPIVersionPing(ping)
+	assert.Equal(t, expected, client.version)
+}
+
+// TestNegotiateAPIVersion asserts that client.Client can
+// negotiate a compatible APIVersion with the server
+func TestNegotiateAPIVersion(t *testing.T) {
+	client, err := NewEnvClient()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := "1.21"
+
+	ping := types.Ping{
+		APIVersion:   expected,
+		OSType:       "linux",
+		Experimental: false,
+	}
+
+	// set our version to something new
+	client.version = "1.22"
+
+	// test downgrade
+	client.NegotiateAPIVersionPing(ping)
+	assert.Equal(t, expected, client.version)
+}
+
+// TestNegotiateAPIVersionOverride asserts that we honor
+// the environment variable DOCKER_API_VERSION when negotianing versions
+func TestNegotiateAPVersionOverride(t *testing.T) {
+	env := envToMap()
+	defer mapToEnv(env)
+
+	envMap := map[string]string{
+		"DOCKER_API_VERSION": "9.99",
+	}
+	mapToEnv(envMap)
+
+	client, err := NewEnvClient()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ping := types.Ping{
+		APIVersion:   "1.24",
+		OSType:       "linux",
+		Experimental: false,
+	}
+
+	expected := envMap["DOCKER_API_VERSION"]
+
+	// test that we honored the env var
+	client.NegotiateAPIVersionPing(ping)
+	assert.Equal(t, expected, client.version)
+}
+
+// mapToEnv takes a map of environment variables and sets them
+func mapToEnv(env map[string]string) {
+	for k, v := range env {
+		os.Setenv(k, v)
+	}
+}
+
+// envToMap returns a map of environment variables
+func envToMap() map[string]string {
+	env := make(map[string]string)
+	for _, e := range os.Environ() {
+		kv := strings.SplitAfterN(e, "=", 2)
+		env[kv[0]] = kv[1]
+	}
+
+	return env
 }
 
 type roundTripFunc func(*http.Request) (*http.Response, error)
diff --git a/components/engine/client/config_create.go b/components/engine/client/config_create.go
index 7ddeaf4b43..bc4a952b2f 100644
--- a/components/engine/client/config_create.go
+++ b/components/engine/client/config_create.go
@@ -11,6 +11,9 @@ import (
 // ConfigCreate creates a new Config.
 func (cli *Client) ConfigCreate(ctx context.Context, config swarm.ConfigSpec) (types.ConfigCreateResponse, error) {
 	var response types.ConfigCreateResponse
+	if err := cli.NewVersionError("1.30", "config create"); err != nil {
+		return response, err
+	}
 	resp, err := cli.post(ctx, "/configs/create", nil, config, nil)
 	if err != nil {
 		return response, err
diff --git a/components/engine/client/config_create_test.go b/components/engine/client/config_create_test.go
index accc554133..000eaf1cba 100644
--- a/components/engine/client/config_create_test.go
+++ b/components/engine/client/config_create_test.go
@@ -11,12 +11,23 @@ import (
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
 
+func TestConfigCreateUnsupported(t *testing.T) {
+	client := &Client{
+		version: "1.29",
+		client:  &http.Client{},
+	}
+	_, err := client.ConfigCreate(context.Background(), swarm.ConfigSpec{})
+	assert.EqualError(t, err, `"config create" requires API version 1.30, but the Docker daemon API version is 1.29`)
+}
+
 func TestConfigCreateError(t *testing.T) {
 	client := &Client{
-		client: newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
+		version: "1.30",
+		client:  newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
 	}
 	_, err := client.ConfigCreate(context.Background(), swarm.ConfigSpec{})
 	if err == nil || err.Error() != "Error response from daemon: Server error" {
@@ -25,8 +36,9 @@ func TestConfigCreateError(t *testing.T) {
 }
 
 func TestConfigCreate(t *testing.T) {
-	expectedURL := "/configs/create"
+	expectedURL := "/v1.30/configs/create"
 	client := &Client{
+		version: "1.30",
 		client: newMockClient(func(req *http.Request) (*http.Response, error) {
 			if !strings.HasPrefix(req.URL.Path, expectedURL) {
 				return nil, fmt.Errorf("Expected URL '%s', got '%s'", expectedURL, req.URL)
diff --git a/components/engine/client/config_inspect.go b/components/engine/client/config_inspect.go
index 1917b181fa..ebb6d636c2 100644
--- a/components/engine/client/config_inspect.go
+++ b/components/engine/client/config_inspect.go
@@ -12,6 +12,9 @@ import (
 
 // ConfigInspectWithRaw returns the config information with raw data
 func (cli *Client) ConfigInspectWithRaw(ctx context.Context, id string) (swarm.Config, []byte, error) {
+	if err := cli.NewVersionError("1.30", "config inspect"); err != nil {
+		return swarm.Config{}, nil, err
+	}
 	resp, err := cli.get(ctx, "/configs/"+id, nil, nil)
 	if err != nil {
 		if resp.statusCode == http.StatusNotFound {
diff --git a/components/engine/client/config_inspect_test.go b/components/engine/client/config_inspect_test.go
index b9597cbc3f..010b188413 100644
--- a/components/engine/client/config_inspect_test.go
+++ b/components/engine/client/config_inspect_test.go
@@ -10,12 +10,23 @@ import (
 	"testing"
 
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
 
+func TestConfigInspectUnsupported(t *testing.T) {
+	client := &Client{
+		version: "1.29",
+		client:  &http.Client{},
+	}
+	_, _, err := client.ConfigInspectWithRaw(context.Background(), "nothing")
+	assert.EqualError(t, err, `"config inspect" requires API version 1.30, but the Docker daemon API version is 1.29`)
+}
+
 func TestConfigInspectError(t *testing.T) {
 	client := &Client{
-		client: newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
+		version: "1.30",
+		client:  newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
 	}
 
 	_, _, err := client.ConfigInspectWithRaw(context.Background(), "nothing")
@@ -26,7 +37,8 @@ func TestConfigInspectError(t *testing.T) {
 
 func TestConfigInspectConfigNotFound(t *testing.T) {
 	client := &Client{
-		client: newMockClient(errorMock(http.StatusNotFound, "Server error")),
+		version: "1.30",
+		client:  newMockClient(errorMock(http.StatusNotFound, "Server error")),
 	}
 
 	_, _, err := client.ConfigInspectWithRaw(context.Background(), "unknown")
@@ -36,8 +48,9 @@ func TestConfigInspectConfigNotFound(t *testing.T) {
 }
 
 func TestConfigInspect(t *testing.T) {
-	expectedURL := "/configs/config_id"
+	expectedURL := "/v1.30/configs/config_id"
 	client := &Client{
+		version: "1.30",
 		client: newMockClient(func(req *http.Request) (*http.Response, error) {
 			if !strings.HasPrefix(req.URL.Path, expectedURL) {
 				return nil, fmt.Errorf("Expected URL '%s', got '%s'", expectedURL, req.URL)
diff --git a/components/engine/client/config_list.go b/components/engine/client/config_list.go
index cea11708a7..8483ca14d1 100644
--- a/components/engine/client/config_list.go
+++ b/components/engine/client/config_list.go
@@ -12,6 +12,9 @@ import (
 
 // ConfigList returns the list of configs.
 func (cli *Client) ConfigList(ctx context.Context, options types.ConfigListOptions) ([]swarm.Config, error) {
+	if err := cli.NewVersionError("1.30", "config list"); err != nil {
+		return nil, err
+	}
 	query := url.Values{}
 
 	if options.Filters.Len() > 0 {
diff --git a/components/engine/client/config_list_test.go b/components/engine/client/config_list_test.go
index 101e6eafdb..4fe05469fe 100644
--- a/components/engine/client/config_list_test.go
+++ b/components/engine/client/config_list_test.go
@@ -12,12 +12,23 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
 
+func TestConfigListUnsupported(t *testing.T) {
+	client := &Client{
+		version: "1.29",
+		client:  &http.Client{},
+	}
+	_, err := client.ConfigList(context.Background(), types.ConfigListOptions{})
+	assert.EqualError(t, err, `"config list" requires API version 1.30, but the Docker daemon API version is 1.29`)
+}
+
 func TestConfigListError(t *testing.T) {
 	client := &Client{
-		client: newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
+		version: "1.30",
+		client:  newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
 	}
 
 	_, err := client.ConfigList(context.Background(), types.ConfigListOptions{})
@@ -27,7 +38,7 @@ func TestConfigListError(t *testing.T) {
 }
 
 func TestConfigList(t *testing.T) {
-	expectedURL := "/configs"
+	expectedURL := "/v1.30/configs"
 
 	filters := filters.NewArgs()
 	filters.Add("label", "label1")
@@ -54,6 +65,7 @@ func TestConfigList(t *testing.T) {
 	}
 	for _, listCase := range listCases {
 		client := &Client{
+			version: "1.30",
 			client: newMockClient(func(req *http.Request) (*http.Response, error) {
 				if !strings.HasPrefix(req.URL.Path, expectedURL) {
 					return nil, fmt.Errorf("Expected URL '%s', got '%s'", expectedURL, req.URL)
diff --git a/components/engine/client/config_remove.go b/components/engine/client/config_remove.go
index f04b8df17a..726b5c8530 100644
--- a/components/engine/client/config_remove.go
+++ b/components/engine/client/config_remove.go
@@ -4,6 +4,9 @@ import "golang.org/x/net/context"
 
 // ConfigRemove removes a Config.
 func (cli *Client) ConfigRemove(ctx context.Context, id string) error {
+	if err := cli.NewVersionError("1.30", "config remove"); err != nil {
+		return err
+	}
 	resp, err := cli.delete(ctx, "/configs/"+id, nil, nil)
 	ensureReaderClosed(resp)
 	return err
diff --git a/components/engine/client/config_remove_test.go b/components/engine/client/config_remove_test.go
index 4a9c69937f..f2a9feea74 100644
--- a/components/engine/client/config_remove_test.go
+++ b/components/engine/client/config_remove_test.go
@@ -8,12 +8,23 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
 
+func TestConfigRemoveUnsupported(t *testing.T) {
+	client := &Client{
+		version: "1.29",
+		client:  &http.Client{},
+	}
+	err := client.ConfigRemove(context.Background(), "config_id")
+	assert.EqualError(t, err, `"config remove" requires API version 1.30, but the Docker daemon API version is 1.29`)
+}
+
 func TestConfigRemoveError(t *testing.T) {
 	client := &Client{
-		client: newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
+		version: "1.30",
+		client:  newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
 	}
 
 	err := client.ConfigRemove(context.Background(), "config_id")
@@ -23,9 +34,10 @@ func TestConfigRemoveError(t *testing.T) {
 }
 
 func TestConfigRemove(t *testing.T) {
-	expectedURL := "/configs/config_id"
+	expectedURL := "/v1.30/configs/config_id"
 
 	client := &Client{
+		version: "1.30",
 		client: newMockClient(func(req *http.Request) (*http.Response, error) {
 			if !strings.HasPrefix(req.URL.Path, expectedURL) {
 				return nil, fmt.Errorf("Expected URL '%s', got '%s'", expectedURL, req.URL)
diff --git a/components/engine/client/config_update.go b/components/engine/client/config_update.go
index da171cb44c..823751bb86 100644
--- a/components/engine/client/config_update.go
+++ b/components/engine/client/config_update.go
@@ -10,6 +10,9 @@ import (
 
 // ConfigUpdate attempts to update a Config
 func (cli *Client) ConfigUpdate(ctx context.Context, id string, version swarm.Version, config swarm.ConfigSpec) error {
+	if err := cli.NewVersionError("1.30", "config update"); err != nil {
+		return err
+	}
 	query := url.Values{}
 	query.Set("version", strconv.FormatUint(version.Index, 10))
 	resp, err := cli.post(ctx, "/configs/"+id+"/update", query, config, nil)
diff --git a/components/engine/client/config_update_test.go b/components/engine/client/config_update_test.go
index 64c2f27263..799e544da7 100644
--- a/components/engine/client/config_update_test.go
+++ b/components/engine/client/config_update_test.go
@@ -8,14 +8,24 @@ import (
 	"strings"
 	"testing"
 
-	"golang.org/x/net/context"
-
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/context"
 )
 
+func TestConfigUpdateUnsupported(t *testing.T) {
+	client := &Client{
+		version: "1.29",
+		client:  &http.Client{},
+	}
+	err := client.ConfigUpdate(context.Background(), "config_id", swarm.Version{}, swarm.ConfigSpec{})
+	assert.EqualError(t, err, `"config update" requires API version 1.30, but the Docker daemon API version is 1.29`)
+}
+
 func TestConfigUpdateError(t *testing.T) {
 	client := &Client{
-		client: newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
+		version: "1.30",
+		client:  newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
 	}
 
 	err := client.ConfigUpdate(context.Background(), "config_id", swarm.Version{}, swarm.ConfigSpec{})
@@ -25,9 +35,10 @@ func TestConfigUpdateError(t *testing.T) {
 }
 
 func TestConfigUpdate(t *testing.T) {
-	expectedURL := "/configs/config_id/update"
+	expectedURL := "/v1.30/configs/config_id/update"
 
 	client := &Client{
+		version: "1.30",
 		client: newMockClient(func(req *http.Request) (*http.Response, error) {
 			if !strings.HasPrefix(req.URL.Path, expectedURL) {
 				return nil, fmt.Errorf("Expected URL '%s', got '%s'", expectedURL, req.URL)
diff --git a/components/engine/client/container_copy.go b/components/engine/client/container_copy.go
index 545aa54383..66ee5c1b3b 100644
--- a/components/engine/client/container_copy.go
+++ b/components/engine/client/container_copy.go
@@ -20,7 +20,7 @@ func (cli *Client) ContainerStatPath(ctx context.Context, containerID, path stri
 	query := url.Values{}
 	query.Set("path", filepath.ToSlash(path)) // Normalize the paths used in the API.
 
-	urlStr := fmt.Sprintf("/containers/%s/archive", containerID)
+	urlStr := "/containers/" + containerID + "/archive"
 	response, err := cli.head(ctx, urlStr, query, nil)
 	if err != nil {
 		return types.ContainerPathStat{}, err
@@ -42,7 +42,7 @@ func (cli *Client) CopyToContainer(ctx context.Context, container, path string,
 		query.Set("copyUIDGID", "true")
 	}
 
-	apiPath := fmt.Sprintf("/containers/%s/archive", container)
+	apiPath := "/containers/" + container + "/archive"
 
 	response, err := cli.putRaw(ctx, apiPath, query, content, nil)
 	if err != nil {
@@ -63,7 +63,7 @@ func (cli *Client) CopyFromContainer(ctx context.Context, container, srcPath str
 	query := make(url.Values, 1)
 	query.Set("path", filepath.ToSlash(srcPath)) // Normalize the paths used in the API.
 
-	apiPath := fmt.Sprintf("/containers/%s/archive", container)
+	apiPath := "/containers/" + container + "/archive"
 	response, err := cli.get(ctx, apiPath, query, nil)
 	if err != nil {
 		return nil, types.ContainerPathStat{}, err
diff --git a/components/engine/client/distribution_inspect.go b/components/engine/client/distribution_inspect.go
index d17ab73213..aa5bc6a6c6 100644
--- a/components/engine/client/distribution_inspect.go
+++ b/components/engine/client/distribution_inspect.go
@@ -10,6 +10,12 @@ import (
 
 // DistributionInspect returns the image digest with full Manifest
 func (cli *Client) DistributionInspect(ctx context.Context, image, encodedRegistryAuth string) (registrytypes.DistributionInspect, error) {
+	// Contact the registry to retrieve digest and platform information
+	var distributionInspect registrytypes.DistributionInspect
+
+	if err := cli.NewVersionError("1.30", "distribution inspect"); err != nil {
+		return distributionInspect, err
+	}
 	var headers map[string][]string
 
 	if encodedRegistryAuth != "" {
@@ -18,8 +24,6 @@ func (cli *Client) DistributionInspect(ctx context.Context, image, encodedRegist
 		}
 	}
 
-	// Contact the registry to retrieve digest and platform information
-	var distributionInspect registrytypes.DistributionInspect
 	resp, err := cli.get(ctx, "/distribution/"+image+"/json", url.Values{}, headers)
 	if err != nil {
 		return distributionInspect, err
diff --git a/components/engine/client/distribution_inspect_test.go b/components/engine/client/distribution_inspect_test.go
new file mode 100644
index 0000000000..eff28d7ca7
--- /dev/null
+++ b/components/engine/client/distribution_inspect_test.go
@@ -0,0 +1,18 @@
+package client
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/context"
+)
+
+func TestDistributionInspectUnsupported(t *testing.T) {
+	client := &Client{
+		version: "1.29",
+		client:  &http.Client{},
+	}
+	_, err := client.DistributionInspect(context.Background(), "foobar:1.0", "")
+	assert.EqualError(t, err, `"distribution inspect" requires API version 1.30, but the Docker daemon API version is 1.29`)
+}
diff --git a/components/engine/client/hijack.go b/components/engine/client/hijack.go
index 74c53f52b3..346c74ae82 100644
--- a/components/engine/client/hijack.go
+++ b/components/engine/client/hijack.go
@@ -1,8 +1,8 @@
 package client
 
 import (
+	"bufio"
 	"crypto/tls"
-	"errors"
 	"fmt"
 	"net"
 	"net/http"
@@ -14,6 +14,7 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/pkg/tlsconfig"
 	"github.com/docker/go-connections/sockets"
+	"github.com/pkg/errors"
 	"golang.org/x/net/context"
 )
 
@@ -46,37 +47,12 @@ func (cli *Client) postHijacked(ctx context.Context, path string, query url.Valu
 	}
 	req = cli.addHeaders(req, headers)
 
-	req.Host = cli.addr
-	req.Header.Set("Connection", "Upgrade")
-	req.Header.Set("Upgrade", "tcp")
-
-	conn, err := dial(cli.proto, cli.addr, resolveTLSConfig(cli.client.Transport))
+	conn, err := cli.setupHijackConn(req, "tcp")
 	if err != nil {
-		if strings.Contains(err.Error(), "connection refused") {
-			return types.HijackedResponse{}, fmt.Errorf("Cannot connect to the Docker daemon. Is 'docker daemon' running on this host?")
-		}
 		return types.HijackedResponse{}, err
 	}
 
-	// When we set up a TCP connection for hijack, there could be long periods
-	// of inactivity (a long running command with no output) that in certain
-	// network setups may cause ECONNTIMEOUT, leaving the client in an unknown
-	// state. Setting TCP KeepAlive on the socket connection will prohibit
-	// ECONNTIMEOUT unless the socket connection truly is broken
-	if tcpConn, ok := conn.(*net.TCPConn); ok {
-		tcpConn.SetKeepAlive(true)
-		tcpConn.SetKeepAlivePeriod(30 * time.Second)
-	}
-
-	clientconn := httputil.NewClientConn(conn, nil)
-	defer clientconn.Close()
-
-	// Server hijacks the connection, error 'connection closed' expected
-	_, err = clientconn.Do(req)
-
-	rwc, br := clientconn.Hijack()
-
-	return types.HijackedResponse{Conn: rwc, Reader: br}, err
+	return types.HijackedResponse{Conn: conn, Reader: bufio.NewReader(conn)}, err
 }
 
 func tlsDial(network, addr string, config *tls.Config) (net.Conn, error) {
@@ -175,3 +151,56 @@ func dial(proto, addr string, tlsConfig *tls.Config) (net.Conn, error) {
 	}
 	return net.Dial(proto, addr)
 }
+
+func (cli *Client) setupHijackConn(req *http.Request, proto string) (net.Conn, error) {
+	req.Host = cli.addr
+	req.Header.Set("Connection", "Upgrade")
+	req.Header.Set("Upgrade", proto)
+
+	conn, err := dial(cli.proto, cli.addr, resolveTLSConfig(cli.client.Transport))
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot connect to the Docker daemon. Is 'docker daemon' running on this host?")
+	}
+
+	// When we set up a TCP connection for hijack, there could be long periods
+	// of inactivity (a long running command with no output) that in certain
+	// network setups may cause ECONNTIMEOUT, leaving the client in an unknown
+	// state. Setting TCP KeepAlive on the socket connection will prohibit
+	// ECONNTIMEOUT unless the socket connection truly is broken
+	if tcpConn, ok := conn.(*net.TCPConn); ok {
+		tcpConn.SetKeepAlive(true)
+		tcpConn.SetKeepAlivePeriod(30 * time.Second)
+	}
+
+	clientconn := httputil.NewClientConn(conn, nil)
+	defer clientconn.Close()
+
+	// Server hijacks the connection, error 'connection closed' expected
+	resp, err := clientconn.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != http.StatusSwitchingProtocols {
+		resp.Body.Close()
+		return nil, fmt.Errorf("unable to upgrade to %s, received %d", proto, resp.StatusCode)
+	}
+
+	c, br := clientconn.Hijack()
+	if br.Buffered() > 0 {
+		// If there is buffered content, wrap the connection
+		c = &hijackedConn{c, br}
+	} else {
+		br.Reset(nil)
+	}
+
+	return c, nil
+}
+
+type hijackedConn struct {
+	net.Conn
+	r *bufio.Reader
+}
+
+func (c *hijackedConn) Read(b []byte) (int, error) {
+	return c.r.Read(b)
+}
diff --git a/components/engine/client/image_build.go b/components/engine/client/image_build.go
index bb69143e99..44a215f900 100644
--- a/components/engine/client/image_build.go
+++ b/components/engine/client/image_build.go
@@ -120,6 +120,9 @@ func (cli *Client) imageBuildOptionsToQuery(options types.ImageBuildOptions) (ur
 		return query, err
 	}
 	query.Set("cachefrom", string(cacheFromJSON))
+	if options.SessionID != "" {
+		query.Set("session", options.SessionID)
+	}
 
 	return query, nil
 }
diff --git a/components/engine/client/interface.go b/components/engine/client/interface.go
index d5f3a14ec3..acd4de1dbd 100644
--- a/components/engine/client/interface.go
+++ b/components/engine/client/interface.go
@@ -2,6 +2,7 @@ package client
 
 import (
 	"io"
+	"net"
 	"time"
 
 	"github.com/docker/docker/api/types"
@@ -33,7 +34,9 @@ type CommonAPIClient interface {
 	ClientVersion() string
 	DaemonHost() string
 	ServerVersion(ctx context.Context) (types.Version, error)
-	UpdateClientVersion(v string)
+	NegotiateAPIVersion(ctx context.Context)
+	NegotiateAPIVersionPing(types.Ping)
+	DialSession(ctx context.Context, proto string, meta map[string][]string) (net.Conn, error)
 }
 
 // ContainerAPIClient defines API client methods for the containers
@@ -79,6 +82,7 @@ type DistributionAPIClient interface {
 // ImageAPIClient defines API client methods for the images
 type ImageAPIClient interface {
 	ImageBuild(ctx context.Context, context io.Reader, options types.ImageBuildOptions) (types.ImageBuildResponse, error)
+	BuildCachePrune(ctx context.Context) (*types.BuildCachePruneReport, error)
 	ImageCreate(ctx context.Context, parentReference string, options types.ImageCreateOptions) (io.ReadCloser, error)
 	ImageHistory(ctx context.Context, image string) ([]image.HistoryResponseItem, error)
 	ImageImport(ctx context.Context, source types.ImageImportSource, ref string, options types.ImageImportOptions) (io.ReadCloser, error)
@@ -99,8 +103,8 @@ type NetworkAPIClient interface {
 	NetworkConnect(ctx context.Context, networkID, container string, config *network.EndpointSettings) error
 	NetworkCreate(ctx context.Context, name string, options types.NetworkCreate) (types.NetworkCreateResponse, error)
 	NetworkDisconnect(ctx context.Context, networkID, container string, force bool) error
-	NetworkInspect(ctx context.Context, networkID string, verbose bool) (types.NetworkResource, error)
-	NetworkInspectWithRaw(ctx context.Context, networkID string, verbose bool) (types.NetworkResource, []byte, error)
+	NetworkInspect(ctx context.Context, networkID string, options types.NetworkInspectOptions) (types.NetworkResource, error)
+	NetworkInspectWithRaw(ctx context.Context, networkID string, options types.NetworkInspectOptions) (types.NetworkResource, []byte, error)
 	NetworkList(ctx context.Context, options types.NetworkListOptions) ([]types.NetworkResource, error)
 	NetworkRemove(ctx context.Context, networkID string) error
 	NetworksPrune(ctx context.Context, pruneFilter filters.Args) (types.NetworksPruneReport, error)
diff --git a/components/engine/client/network_inspect.go b/components/engine/client/network_inspect.go
index 7242304025..848c9799fb 100644
--- a/components/engine/client/network_inspect.go
+++ b/components/engine/client/network_inspect.go
@@ -12,22 +12,25 @@ import (
 )
 
 // NetworkInspect returns the information for a specific network configured in the docker host.
-func (cli *Client) NetworkInspect(ctx context.Context, networkID string, verbose bool) (types.NetworkResource, error) {
-	networkResource, _, err := cli.NetworkInspectWithRaw(ctx, networkID, verbose)
+func (cli *Client) NetworkInspect(ctx context.Context, networkID string, options types.NetworkInspectOptions) (types.NetworkResource, error) {
+	networkResource, _, err := cli.NetworkInspectWithRaw(ctx, networkID, options)
 	return networkResource, err
 }
 
 // NetworkInspectWithRaw returns the information for a specific network configured in the docker host and its raw representation.
-func (cli *Client) NetworkInspectWithRaw(ctx context.Context, networkID string, verbose bool) (types.NetworkResource, []byte, error) {
+func (cli *Client) NetworkInspectWithRaw(ctx context.Context, networkID string, options types.NetworkInspectOptions) (types.NetworkResource, []byte, error) {
 	var (
 		networkResource types.NetworkResource
 		resp            serverResponse
 		err             error
 	)
 	query := url.Values{}
-	if verbose {
+	if options.Verbose {
 		query.Set("verbose", "true")
 	}
+	if options.Scope != "" {
+		query.Set("scope", options.Scope)
+	}
 	resp, err = cli.get(ctx, "/networks/"+networkID, query, nil)
 	if err != nil {
 		if resp.statusCode == http.StatusNotFound {
diff --git a/components/engine/client/network_inspect_test.go b/components/engine/client/network_inspect_test.go
index 1504289f5d..9bfb55d74e 100644
--- a/components/engine/client/network_inspect_test.go
+++ b/components/engine/client/network_inspect_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/network"
+	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
 
@@ -19,7 +20,7 @@ func TestNetworkInspectError(t *testing.T) {
 		client: newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
 	}
 
-	_, err := client.NetworkInspect(context.Background(), "nothing", false)
+	_, err := client.NetworkInspect(context.Background(), "nothing", types.NetworkInspectOptions{})
 	if err == nil || err.Error() != "Error response from daemon: Server error" {
 		t.Fatalf("expected a Server Error, got %v", err)
 	}
@@ -30,7 +31,7 @@ func TestNetworkInspectContainerNotFound(t *testing.T) {
 		client: newMockClient(errorMock(http.StatusNotFound, "Server error")),
 	}
 
-	_, err := client.NetworkInspect(context.Background(), "unknown", false)
+	_, err := client.NetworkInspect(context.Background(), "unknown", types.NetworkInspectOptions{})
 	if err == nil || !IsErrNetworkNotFound(err) {
 		t.Fatalf("expected a networkNotFound error, got %v", err)
 	}
@@ -51,7 +52,14 @@ func TestNetworkInspect(t *testing.T) {
 				content []byte
 				err     error
 			)
-			if strings.HasPrefix(req.URL.RawQuery, "verbose=true") {
+			if strings.Contains(req.URL.RawQuery, "scope=global") {
+				return &http.Response{
+					StatusCode: http.StatusNotFound,
+					Body:       ioutil.NopCloser(bytes.NewReader(content)),
+				}, nil
+			}
+
+			if strings.Contains(req.URL.RawQuery, "verbose=true") {
 				s := map[string]network.ServiceInfo{
 					"web": {},
 				}
@@ -74,7 +82,7 @@ func TestNetworkInspect(t *testing.T) {
 		}),
 	}
 
-	r, err := client.NetworkInspect(context.Background(), "network_id", false)
+	r, err := client.NetworkInspect(context.Background(), "network_id", types.NetworkInspectOptions{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -82,7 +90,7 @@ func TestNetworkInspect(t *testing.T) {
 		t.Fatalf("expected `mynetwork`, got %s", r.Name)
 	}
 
-	r, err = client.NetworkInspect(context.Background(), "network_id", true)
+	r, err = client.NetworkInspect(context.Background(), "network_id", types.NetworkInspectOptions{Verbose: true})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -93,4 +101,7 @@ func TestNetworkInspect(t *testing.T) {
 	if !ok {
 		t.Fatalf("expected service `web` missing in the verbose output")
 	}
+
+	_, err = client.NetworkInspect(context.Background(), "network_id", types.NetworkInspectOptions{Scope: "global"})
+	assert.EqualError(t, err, "Error: No such network: network_id")
 }
diff --git a/components/engine/client/ping.go b/components/engine/client/ping.go
index d6212ef8bb..631ed02005 100644
--- a/components/engine/client/ping.go
+++ b/components/engine/client/ping.go
@@ -1,8 +1,6 @@
 package client
 
 import (
-	"fmt"
-
 	"github.com/docker/docker/api/types"
 	"golang.org/x/net/context"
 )
@@ -10,7 +8,7 @@ import (
 // Ping pings the server and returns the value of the "Docker-Experimental", "OS-Type" & "API-Version" headers
 func (cli *Client) Ping(ctx context.Context) (types.Ping, error) {
 	var ping types.Ping
-	req, err := cli.buildRequest("GET", fmt.Sprintf("%s/_ping", cli.basePath), nil, nil)
+	req, err := cli.buildRequest("GET", cli.basePath+"/_ping", nil, nil)
 	if err != nil {
 		return ping, err
 	}
diff --git a/components/engine/client/plugin_upgrade.go b/components/engine/client/plugin_upgrade.go
index 24293c5073..049ebfa2a5 100644
--- a/components/engine/client/plugin_upgrade.go
+++ b/components/engine/client/plugin_upgrade.go
@@ -1,7 +1,6 @@
 package client
 
 import (
-	"fmt"
 	"io"
 	"net/url"
 
@@ -13,6 +12,9 @@ import (
 
 // PluginUpgrade upgrades a plugin
 func (cli *Client) PluginUpgrade(ctx context.Context, name string, options types.PluginInstallOptions) (rc io.ReadCloser, err error) {
+	if err := cli.NewVersionError("1.26", "plugin upgrade"); err != nil {
+		return nil, err
+	}
 	query := url.Values{}
 	if _, err := reference.ParseNormalizedNamed(options.RemoteRef); err != nil {
 		return nil, errors.Wrap(err, "invalid remote reference")
@@ -33,5 +35,5 @@ func (cli *Client) PluginUpgrade(ctx context.Context, name string, options types
 
 func (cli *Client) tryPluginUpgrade(ctx context.Context, query url.Values, privileges types.PluginPrivileges, name, registryAuth string) (serverResponse, error) {
 	headers := map[string][]string{"X-Registry-Auth": {registryAuth}}
-	return cli.post(ctx, fmt.Sprintf("/plugins/%s/upgrade", name), query, privileges, headers)
+	return cli.post(ctx, "/plugins/"+name+"/upgrade", query, privileges, headers)
 }
diff --git a/components/engine/client/secret_create.go b/components/engine/client/secret_create.go
index b5325a560f..4354afea60 100644
--- a/components/engine/client/secret_create.go
+++ b/components/engine/client/secret_create.go
@@ -11,6 +11,9 @@ import (
 // SecretCreate creates a new Secret.
 func (cli *Client) SecretCreate(ctx context.Context, secret swarm.SecretSpec) (types.SecretCreateResponse, error) {
 	var response types.SecretCreateResponse
+	if err := cli.NewVersionError("1.25", "secret create"); err != nil {
+		return response, err
+	}
 	resp, err := cli.post(ctx, "/secrets/create", nil, secret, nil)
 	if err != nil {
 		return response, err
diff --git a/components/engine/client/secret_create_test.go b/components/engine/client/secret_create_test.go
index cb378c77ff..ccc7349008 100644
--- a/components/engine/client/secret_create_test.go
+++ b/components/engine/client/secret_create_test.go
@@ -11,12 +11,23 @@ import (
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
 
+func TestSecretCreateUnsupported(t *testing.T) {
+	client := &Client{
+		version: "1.24",
+		client:  &http.Client{},
+	}
+	_, err := client.SecretCreate(context.Background(), swarm.SecretSpec{})
+	assert.EqualError(t, err, `"secret create" requires API version 1.25, but the Docker daemon API version is 1.24`)
+}
+
 func TestSecretCreateError(t *testing.T) {
 	client := &Client{
-		client: newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
+		version: "1.25",
+		client:  newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
 	}
 	_, err := client.SecretCreate(context.Background(), swarm.SecretSpec{})
 	if err == nil || err.Error() != "Error response from daemon: Server error" {
@@ -25,8 +36,9 @@ func TestSecretCreateError(t *testing.T) {
 }
 
 func TestSecretCreate(t *testing.T) {
-	expectedURL := "/secrets/create"
+	expectedURL := "/v1.25/secrets/create"
 	client := &Client{
+		version: "1.25",
 		client: newMockClient(func(req *http.Request) (*http.Response, error) {
 			if !strings.HasPrefix(req.URL.Path, expectedURL) {
 				return nil, fmt.Errorf("Expected URL '%s', got '%s'", expectedURL, req.URL)
diff --git a/components/engine/client/secret_inspect.go b/components/engine/client/secret_inspect.go
index f774576118..9b602972bc 100644
--- a/components/engine/client/secret_inspect.go
+++ b/components/engine/client/secret_inspect.go
@@ -12,6 +12,9 @@ import (
 
 // SecretInspectWithRaw returns the secret information with raw data
 func (cli *Client) SecretInspectWithRaw(ctx context.Context, id string) (swarm.Secret, []byte, error) {
+	if err := cli.NewVersionError("1.25", "secret inspect"); err != nil {
+		return swarm.Secret{}, nil, err
+	}
 	resp, err := cli.get(ctx, "/secrets/"+id, nil, nil)
 	if err != nil {
 		if resp.statusCode == http.StatusNotFound {
diff --git a/components/engine/client/secret_inspect_test.go b/components/engine/client/secret_inspect_test.go
index 0142a3ca9f..1581da1015 100644
--- a/components/engine/client/secret_inspect_test.go
+++ b/components/engine/client/secret_inspect_test.go
@@ -10,12 +10,23 @@ import (
 	"testing"
 
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
 
+func TestSecretInspectUnsupported(t *testing.T) {
+	client := &Client{
+		version: "1.24",
+		client:  &http.Client{},
+	}
+	_, _, err := client.SecretInspectWithRaw(context.Background(), "nothing")
+	assert.EqualError(t, err, `"secret inspect" requires API version 1.25, but the Docker daemon API version is 1.24`)
+}
+
 func TestSecretInspectError(t *testing.T) {
 	client := &Client{
-		client: newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
+		version: "1.25",
+		client:  newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
 	}
 
 	_, _, err := client.SecretInspectWithRaw(context.Background(), "nothing")
@@ -26,7 +37,8 @@ func TestSecretInspectError(t *testing.T) {
 
 func TestSecretInspectSecretNotFound(t *testing.T) {
 	client := &Client{
-		client: newMockClient(errorMock(http.StatusNotFound, "Server error")),
+		version: "1.25",
+		client:  newMockClient(errorMock(http.StatusNotFound, "Server error")),
 	}
 
 	_, _, err := client.SecretInspectWithRaw(context.Background(), "unknown")
@@ -36,8 +48,9 @@ func TestSecretInspectSecretNotFound(t *testing.T) {
 }
 
 func TestSecretInspect(t *testing.T) {
-	expectedURL := "/secrets/secret_id"
+	expectedURL := "/v1.25/secrets/secret_id"
 	client := &Client{
+		version: "1.25",
 		client: newMockClient(func(req *http.Request) (*http.Response, error) {
 			if !strings.HasPrefix(req.URL.Path, expectedURL) {
 				return nil, fmt.Errorf("Expected URL '%s', got '%s'", expectedURL, req.URL)
diff --git a/components/engine/client/secret_list.go b/components/engine/client/secret_list.go
index 7e9d5ec167..0d33ecfbc9 100644
--- a/components/engine/client/secret_list.go
+++ b/components/engine/client/secret_list.go
@@ -12,6 +12,9 @@ import (
 
 // SecretList returns the list of secrets.
 func (cli *Client) SecretList(ctx context.Context, options types.SecretListOptions) ([]swarm.Secret, error) {
+	if err := cli.NewVersionError("1.25", "secret list"); err != nil {
+		return nil, err
+	}
 	query := url.Values{}
 
 	if options.Filters.Len() > 0 {
diff --git a/components/engine/client/secret_list_test.go b/components/engine/client/secret_list_test.go
index 1ac11cddb3..67a94d3df5 100644
--- a/components/engine/client/secret_list_test.go
+++ b/components/engine/client/secret_list_test.go
@@ -12,12 +12,23 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
 
+func TestSecretListUnsupported(t *testing.T) {
+	client := &Client{
+		version: "1.24",
+		client:  &http.Client{},
+	}
+	_, err := client.SecretList(context.Background(), types.SecretListOptions{})
+	assert.EqualError(t, err, `"secret list" requires API version 1.25, but the Docker daemon API version is 1.24`)
+}
+
 func TestSecretListError(t *testing.T) {
 	client := &Client{
-		client: newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
+		version: "1.25",
+		client:  newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
 	}
 
 	_, err := client.SecretList(context.Background(), types.SecretListOptions{})
@@ -27,7 +38,7 @@ func TestSecretListError(t *testing.T) {
 }
 
 func TestSecretList(t *testing.T) {
-	expectedURL := "/secrets"
+	expectedURL := "/v1.25/secrets"
 
 	filters := filters.NewArgs()
 	filters.Add("label", "label1")
@@ -54,6 +65,7 @@ func TestSecretList(t *testing.T) {
 	}
 	for _, listCase := range listCases {
 		client := &Client{
+			version: "1.25",
 			client: newMockClient(func(req *http.Request) (*http.Response, error) {
 				if !strings.HasPrefix(req.URL.Path, expectedURL) {
 					return nil, fmt.Errorf("Expected URL '%s', got '%s'", expectedURL, req.URL)
diff --git a/components/engine/client/secret_remove.go b/components/engine/client/secret_remove.go
index 1955b988a9..c5e37af17d 100644
--- a/components/engine/client/secret_remove.go
+++ b/components/engine/client/secret_remove.go
@@ -4,6 +4,9 @@ import "golang.org/x/net/context"
 
 // SecretRemove removes a Secret.
 func (cli *Client) SecretRemove(ctx context.Context, id string) error {
+	if err := cli.NewVersionError("1.25", "secret remove"); err != nil {
+		return err
+	}
 	resp, err := cli.delete(ctx, "/secrets/"+id, nil, nil)
 	ensureReaderClosed(resp)
 	return err
diff --git a/components/engine/client/secret_remove_test.go b/components/engine/client/secret_remove_test.go
index f269f787d2..bb41edfe5d 100644
--- a/components/engine/client/secret_remove_test.go
+++ b/components/engine/client/secret_remove_test.go
@@ -8,12 +8,23 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
 
+func TestSecretRemoveUnsupported(t *testing.T) {
+	client := &Client{
+		version: "1.24",
+		client:  &http.Client{},
+	}
+	err := client.SecretRemove(context.Background(), "secret_id")
+	assert.EqualError(t, err, `"secret remove" requires API version 1.25, but the Docker daemon API version is 1.24`)
+}
+
 func TestSecretRemoveError(t *testing.T) {
 	client := &Client{
-		client: newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
+		version: "1.25",
+		client:  newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
 	}
 
 	err := client.SecretRemove(context.Background(), "secret_id")
@@ -23,9 +34,10 @@ func TestSecretRemoveError(t *testing.T) {
 }
 
 func TestSecretRemove(t *testing.T) {
-	expectedURL := "/secrets/secret_id"
+	expectedURL := "/v1.25/secrets/secret_id"
 
 	client := &Client{
+		version: "1.25",
 		client: newMockClient(func(req *http.Request) (*http.Response, error) {
 			if !strings.HasPrefix(req.URL.Path, expectedURL) {
 				return nil, fmt.Errorf("Expected URL '%s', got '%s'", expectedURL, req.URL)
diff --git a/components/engine/client/secret_update.go b/components/engine/client/secret_update.go
index 3af5287068..875a4c901e 100644
--- a/components/engine/client/secret_update.go
+++ b/components/engine/client/secret_update.go
@@ -10,6 +10,9 @@ import (
 
 // SecretUpdate attempts to update a Secret
 func (cli *Client) SecretUpdate(ctx context.Context, id string, version swarm.Version, secret swarm.SecretSpec) error {
+	if err := cli.NewVersionError("1.25", "secret update"); err != nil {
+		return err
+	}
 	query := url.Values{}
 	query.Set("version", strconv.FormatUint(version.Index, 10))
 	resp, err := cli.post(ctx, "/secrets/"+id+"/update", query, secret, nil)
diff --git a/components/engine/client/secret_update_test.go b/components/engine/client/secret_update_test.go
index c620985bd5..4a791328ed 100644
--- a/components/engine/client/secret_update_test.go
+++ b/components/engine/client/secret_update_test.go
@@ -8,14 +8,24 @@ import (
 	"strings"
 	"testing"
 
-	"golang.org/x/net/context"
-
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/context"
 )
 
+func TestSecretUpdateUnsupported(t *testing.T) {
+	client := &Client{
+		version: "1.24",
+		client:  &http.Client{},
+	}
+	err := client.SecretUpdate(context.Background(), "secret_id", swarm.Version{}, swarm.SecretSpec{})
+	assert.EqualError(t, err, `"secret update" requires API version 1.25, but the Docker daemon API version is 1.24`)
+}
+
 func TestSecretUpdateError(t *testing.T) {
 	client := &Client{
-		client: newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
+		version: "1.25",
+		client:  newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
 	}
 
 	err := client.SecretUpdate(context.Background(), "secret_id", swarm.Version{}, swarm.SecretSpec{})
@@ -25,9 +35,10 @@ func TestSecretUpdateError(t *testing.T) {
 }
 
 func TestSecretUpdate(t *testing.T) {
-	expectedURL := "/secrets/secret_id/update"
+	expectedURL := "/v1.25/secrets/secret_id/update"
 
 	client := &Client{
+		version: "1.25",
 		client: newMockClient(func(req *http.Request) (*http.Response, error) {
 			if !strings.HasPrefix(req.URL.Path, expectedURL) {
 				return nil, fmt.Errorf("Expected URL '%s', got '%s'", expectedURL, req.URL)
diff --git a/components/engine/client/service_create_test.go b/components/engine/client/service_create_test.go
index 3c5ba5a5fc..eb9e1b59df 100644
--- a/components/engine/client/service_create_test.go
+++ b/components/engine/client/service_create_test.go
@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
-	"io"
 	"io/ioutil"
 	"net/http"
 	"strings"
@@ -15,6 +14,7 @@ import (
 	"github.com/docker/docker/api/types/swarm"
 	"github.com/opencontainers/go-digest"
 	"github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
 
@@ -61,26 +61,24 @@ func TestServiceCreate(t *testing.T) {
 }
 
 func TestServiceCreateCompatiblePlatforms(t *testing.T) {
-	var (
-		platforms               []v1.Platform
-		distributionInspectBody io.ReadCloser
-		distributionInspect     registrytypes.DistributionInspect
-	)
-
 	client := &Client{
+		version: "1.30",
 		client: newMockClient(func(req *http.Request) (*http.Response, error) {
-			if strings.HasPrefix(req.URL.Path, "/services/create") {
+			if strings.HasPrefix(req.URL.Path, "/v1.30/services/create") {
+				var serviceSpec swarm.ServiceSpec
+
 				// check if the /distribution endpoint returned correct output
-				err := json.NewDecoder(distributionInspectBody).Decode(&distributionInspect)
+				err := json.NewDecoder(req.Body).Decode(&serviceSpec)
 				if err != nil {
 					return nil, err
 				}
-				if len(distributionInspect.Platforms) == 0 || distributionInspect.Platforms[0].Architecture != platforms[0].Architecture || distributionInspect.Platforms[0].OS != platforms[0].OS {
-					return nil, fmt.Errorf("received incorrect platform information from registry")
-				}
 
+				assert.Equal(t, "foobar:1.0@sha256:c0537ff6a5218ef531ece93d4984efc99bbf3f7497c0a7726c88e2bb7584dc96", serviceSpec.TaskTemplate.ContainerSpec.Image)
+				assert.Len(t, serviceSpec.TaskTemplate.Placement.Platforms, 1)
+
+				p := serviceSpec.TaskTemplate.Placement.Platforms[0]
 				b, err := json.Marshal(types.ServiceCreateResponse{
-					ID: "service_" + platforms[0].Architecture,
+					ID: "service_" + p.OS + "_" + p.Architecture,
 				})
 				if err != nil {
 					return nil, err
@@ -89,21 +87,21 @@ func TestServiceCreateCompatiblePlatforms(t *testing.T) {
 					StatusCode: http.StatusOK,
 					Body:       ioutil.NopCloser(bytes.NewReader(b)),
 				}, nil
-			} else if strings.HasPrefix(req.URL.Path, "/distribution/") {
-				platforms = []v1.Platform{
-					{
-						Architecture: "amd64",
-						OS:           "linux",
-					},
-				}
+			} else if strings.HasPrefix(req.URL.Path, "/v1.30/distribution/") {
 				b, err := json.Marshal(registrytypes.DistributionInspect{
-					Descriptor: v1.Descriptor{},
-					Platforms:  platforms,
+					Descriptor: v1.Descriptor{
+						Digest: "sha256:c0537ff6a5218ef531ece93d4984efc99bbf3f7497c0a7726c88e2bb7584dc96",
+					},
+					Platforms: []v1.Platform{
+						{
+							Architecture: "amd64",
+							OS:           "linux",
+						},
+					},
 				})
 				if err != nil {
 					return nil, err
 				}
-				distributionInspectBody = ioutil.NopCloser(bytes.NewReader(b))
 				return &http.Response{
 					StatusCode: http.StatusOK,
 					Body:       ioutil.NopCloser(bytes.NewReader(b)),
@@ -114,13 +112,11 @@ func TestServiceCreateCompatiblePlatforms(t *testing.T) {
 		}),
 	}
 
-	r, err := client.ServiceCreate(context.Background(), swarm.ServiceSpec{}, types.ServiceCreateOptions{QueryRegistry: true})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if r.ID != "service_amd64" {
-		t.Fatalf("expected `service_amd64`, got %s", r.ID)
-	}
+	spec := swarm.ServiceSpec{TaskTemplate: swarm.TaskSpec{ContainerSpec: swarm.ContainerSpec{Image: "foobar:1.0"}}}
+
+	r, err := client.ServiceCreate(context.Background(), spec, types.ServiceCreateOptions{QueryRegistry: true})
+	assert.NoError(t, err)
+	assert.Equal(t, "service_linux_amd64", r.ID)
 }
 
 func TestServiceCreateDigestPinning(t *testing.T) {
@@ -146,8 +142,9 @@ func TestServiceCreateDigestPinning(t *testing.T) {
 	}
 
 	client := &Client{
+		version: "1.30",
 		client: newMockClient(func(req *http.Request) (*http.Response, error) {
-			if strings.HasPrefix(req.URL.Path, "/services/create") {
+			if strings.HasPrefix(req.URL.Path, "/v1.30/services/create") {
 				// reset and set image received by the service create endpoint
 				serviceCreateImage = ""
 				var service swarm.ServiceSpec
@@ -166,10 +163,10 @@ func TestServiceCreateDigestPinning(t *testing.T) {
 					StatusCode: http.StatusOK,
 					Body:       ioutil.NopCloser(bytes.NewReader(b)),
 				}, nil
-			} else if strings.HasPrefix(req.URL.Path, "/distribution/cannotresolve") {
+			} else if strings.HasPrefix(req.URL.Path, "/v1.30/distribution/cannotresolve") {
 				// unresolvable image
 				return nil, fmt.Errorf("cannot resolve image")
-			} else if strings.HasPrefix(req.URL.Path, "/distribution/") {
+			} else if strings.HasPrefix(req.URL.Path, "/v1.30/distribution/") {
 				// resolvable images
 				b, err := json.Marshal(registrytypes.DistributionInspect{
 					Descriptor: v1.Descriptor{
diff --git a/components/engine/client/session.go b/components/engine/client/session.go
new file mode 100644
index 0000000000..8ee9162136
--- /dev/null
+++ b/components/engine/client/session.go
@@ -0,0 +1,19 @@
+package client
+
+import (
+	"net"
+	"net/http"
+
+	"golang.org/x/net/context"
+)
+
+// DialSession returns a connection that can be used communication with daemon
+func (cli *Client) DialSession(ctx context.Context, proto string, meta map[string][]string) (net.Conn, error) {
+	req, err := http.NewRequest("POST", "/session", nil)
+	if err != nil {
+		return nil, err
+	}
+	req = cli.addHeaders(req, meta)
+
+	return cli.setupHijackConn(req, proto)
+}
diff --git a/components/engine/client/session/filesync/diffcopy.go b/components/engine/client/session/filesync/diffcopy.go
new file mode 100644
index 0000000000..b15e4ee4bf
--- /dev/null
+++ b/components/engine/client/session/filesync/diffcopy.go
@@ -0,0 +1,30 @@
+package filesync
+
+import (
+	"time"
+
+	"google.golang.org/grpc"
+
+	"github.com/Sirupsen/logrus"
+	"github.com/tonistiigi/fsutil"
+)
+
+func sendDiffCopy(stream grpc.Stream, dir string, excludes []string, progress progressCb) error {
+	return fsutil.Send(stream.Context(), stream, dir, &fsutil.WalkOpt{
+		ExcludePatterns: excludes,
+	}, progress)
+}
+
+func recvDiffCopy(ds grpc.Stream, dest string, cu CacheUpdater) error {
+	st := time.Now()
+	defer func() {
+		logrus.Debugf("diffcopy took: %v", time.Since(st))
+	}()
+	var cf fsutil.ChangeFunc
+	if cu != nil {
+		cu.MarkSupported(true)
+		cf = cu.HandleChange
+	}
+
+	return fsutil.Receive(ds.Context(), ds, dest, cf)
+}
diff --git a/components/engine/client/session/filesync/filesync.go b/components/engine/client/session/filesync/filesync.go
new file mode 100644
index 0000000000..fa6dafb6b0
--- /dev/null
+++ b/components/engine/client/session/filesync/filesync.go
@@ -0,0 +1,173 @@
+package filesync
+
+import (
+	"os"
+	"strings"
+
+	"github.com/docker/docker/client/session"
+	"github.com/pkg/errors"
+	"github.com/tonistiigi/fsutil"
+	"golang.org/x/net/context"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
+)
+
+type fsSyncProvider struct {
+	root     string
+	excludes []string
+	p        progressCb
+	doneCh   chan error
+}
+
+// NewFSSyncProvider creates a new provider for sending files from client
+func NewFSSyncProvider(root string, excludes []string) session.Attachable {
+	p := &fsSyncProvider{
+		root:     root,
+		excludes: excludes,
+	}
+	return p
+}
+
+func (sp *fsSyncProvider) Register(server *grpc.Server) {
+	RegisterFileSyncServer(server, sp)
+}
+
+func (sp *fsSyncProvider) DiffCopy(stream FileSync_DiffCopyServer) error {
+	return sp.handle("diffcopy", stream)
+}
+func (sp *fsSyncProvider) TarStream(stream FileSync_TarStreamServer) error {
+	return sp.handle("tarstream", stream)
+}
+
+func (sp *fsSyncProvider) handle(method string, stream grpc.ServerStream) error {
+	var pr *protocol
+	for _, p := range supportedProtocols {
+		if method == p.name && isProtoSupported(p.name) {
+			pr = &p
+			break
+		}
+	}
+	if pr == nil {
+		return errors.New("failed to negotiate protocol")
+	}
+
+	opts, _ := metadata.FromContext(stream.Context()) // if no metadata continue with empty object
+
+	var excludes []string
+	if len(opts["Override-Excludes"]) == 0 || opts["Override-Excludes"][0] != "true" {
+		excludes = sp.excludes
+	}
+
+	var progress progressCb
+	if sp.p != nil {
+		progress = sp.p
+		sp.p = nil
+	}
+
+	var doneCh chan error
+	if sp.doneCh != nil {
+		doneCh = sp.doneCh
+		sp.doneCh = nil
+	}
+	err := pr.sendFn(stream, sp.root, excludes, progress)
+	if doneCh != nil {
+		if err != nil {
+			doneCh <- err
+		}
+		close(doneCh)
+	}
+	return err
+}
+
+func (sp *fsSyncProvider) SetNextProgressCallback(f func(int, bool), doneCh chan error) {
+	sp.p = f
+	sp.doneCh = doneCh
+}
+
+type progressCb func(int, bool)
+
+type protocol struct {
+	name   string
+	sendFn func(stream grpc.Stream, srcDir string, excludes []string, progress progressCb) error
+	recvFn func(stream grpc.Stream, destDir string, cu CacheUpdater) error
+}
+
+func isProtoSupported(p string) bool {
+	// TODO: this should be removed after testing if stability is confirmed
+	if override := os.Getenv("BUILD_STREAM_PROTOCOL"); override != "" {
+		return strings.EqualFold(p, override)
+	}
+	return true
+}
+
+var supportedProtocols = []protocol{
+	{
+		name:   "diffcopy",
+		sendFn: sendDiffCopy,
+		recvFn: recvDiffCopy,
+	},
+	{
+		name:   "tarstream",
+		sendFn: sendTarStream,
+		recvFn: recvTarStream,
+	},
+}
+
+// FSSendRequestOpt defines options for FSSend request
+type FSSendRequestOpt struct {
+	SrcPaths         []string
+	OverrideExcludes bool
+	DestDir          string
+	CacheUpdater     CacheUpdater
+}
+
+// CacheUpdater is an object capable of sending notifications for the cache hash changes
+type CacheUpdater interface {
+	MarkSupported(bool)
+	HandleChange(fsutil.ChangeKind, string, os.FileInfo, error) error
+}
+
+// FSSync initializes a transfer of files
+func FSSync(ctx context.Context, c session.Caller, opt FSSendRequestOpt) error {
+	var pr *protocol
+	for _, p := range supportedProtocols {
+		if isProtoSupported(p.name) && c.Supports(session.MethodURL(_FileSync_serviceDesc.ServiceName, p.name)) {
+			pr = &p
+			break
+		}
+	}
+	if pr == nil {
+		return errors.New("no fssync handlers")
+	}
+
+	opts := make(map[string][]string)
+	if opt.OverrideExcludes {
+		opts["Override-Excludes"] = []string{"true"}
+	}
+
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	client := NewFileSyncClient(c.Conn())
+
+	var stream grpc.ClientStream
+
+	ctx = metadata.NewContext(ctx, opts)
+
+	switch pr.name {
+	case "tarstream":
+		cc, err := client.TarStream(ctx)
+		if err != nil {
+			return err
+		}
+		stream = cc
+	case "diffcopy":
+		cc, err := client.DiffCopy(ctx)
+		if err != nil {
+			return err
+		}
+		stream = cc
+	}
+
+	return pr.recvFn(stream, opt.DestDir, opt.CacheUpdater)
+}
diff --git a/components/engine/client/session/filesync/filesync.pb.go b/components/engine/client/session/filesync/filesync.pb.go
new file mode 100644
index 0000000000..c6ed666383
--- /dev/null
+++ b/components/engine/client/session/filesync/filesync.pb.go
@@ -0,0 +1,575 @@
+// Code generated by protoc-gen-gogo.
+// source: filesync.proto
+// DO NOT EDIT!
+
+/*
+Package filesync is a generated protocol buffer package.
+
+It is generated from these files:
+	filesync.proto
+
+It has these top-level messages:
+	BytesMessage
+*/
+package filesync
+
+import proto "github.com/gogo/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
+import bytes "bytes"
+
+import strings "strings"
+import reflect "reflect"
+
+import (
+	context "golang.org/x/net/context"
+	grpc "google.golang.org/grpc"
+)
+
+import io "io"
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+
+// BytesMessage contains a chunk of byte data
+type BytesMessage struct {
+	Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (m *BytesMessage) Reset()                    { *m = BytesMessage{} }
+func (*BytesMessage) ProtoMessage()               {}
+func (*BytesMessage) Descriptor() ([]byte, []int) { return fileDescriptorFilesync, []int{0} }
+
+func (m *BytesMessage) GetData() []byte {
+	if m != nil {
+		return m.Data
+	}
+	return nil
+}
+
+func init() {
+	proto.RegisterType((*BytesMessage)(nil), "moby.filesync.v1.BytesMessage")
+}
+func (this *BytesMessage) Equal(that interface{}) bool {
+	if that == nil {
+		if this == nil {
+			return true
+		}
+		return false
+	}
+
+	that1, ok := that.(*BytesMessage)
+	if !ok {
+		that2, ok := that.(BytesMessage)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		if this == nil {
+			return true
+		}
+		return false
+	} else if this == nil {
+		return false
+	}
+	if !bytes.Equal(this.Data, that1.Data) {
+		return false
+	}
+	return true
+}
+func (this *BytesMessage) GoString() string {
+	if this == nil {
+		return "nil"
+	}
+	s := make([]string, 0, 5)
+	s = append(s, "&filesync.BytesMessage{")
+	s = append(s, "Data: "+fmt.Sprintf("%#v", this.Data)+",\n")
+	s = append(s, "}")
+	return strings.Join(s, "")
+}
+func valueToGoStringFilesync(v interface{}, typ string) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
+}
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ context.Context
+var _ grpc.ClientConn
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+const _ = grpc.SupportPackageIsVersion4
+
+// Client API for FileSync service
+
+type FileSyncClient interface {
+	DiffCopy(ctx context.Context, opts ...grpc.CallOption) (FileSync_DiffCopyClient, error)
+	TarStream(ctx context.Context, opts ...grpc.CallOption) (FileSync_TarStreamClient, error)
+}
+
+type fileSyncClient struct {
+	cc *grpc.ClientConn
+}
+
+func NewFileSyncClient(cc *grpc.ClientConn) FileSyncClient {
+	return &fileSyncClient{cc}
+}
+
+func (c *fileSyncClient) DiffCopy(ctx context.Context, opts ...grpc.CallOption) (FileSync_DiffCopyClient, error) {
+	stream, err := grpc.NewClientStream(ctx, &_FileSync_serviceDesc.Streams[0], c.cc, "/moby.filesync.v1.FileSync/DiffCopy", opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &fileSyncDiffCopyClient{stream}
+	return x, nil
+}
+
+type FileSync_DiffCopyClient interface {
+	Send(*BytesMessage) error
+	Recv() (*BytesMessage, error)
+	grpc.ClientStream
+}
+
+type fileSyncDiffCopyClient struct {
+	grpc.ClientStream
+}
+
+func (x *fileSyncDiffCopyClient) Send(m *BytesMessage) error {
+	return x.ClientStream.SendMsg(m)
+}
+
+func (x *fileSyncDiffCopyClient) Recv() (*BytesMessage, error) {
+	m := new(BytesMessage)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func (c *fileSyncClient) TarStream(ctx context.Context, opts ...grpc.CallOption) (FileSync_TarStreamClient, error) {
+	stream, err := grpc.NewClientStream(ctx, &_FileSync_serviceDesc.Streams[1], c.cc, "/moby.filesync.v1.FileSync/TarStream", opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &fileSyncTarStreamClient{stream}
+	return x, nil
+}
+
+type FileSync_TarStreamClient interface {
+	Send(*BytesMessage) error
+	Recv() (*BytesMessage, error)
+	grpc.ClientStream
+}
+
+type fileSyncTarStreamClient struct {
+	grpc.ClientStream
+}
+
+func (x *fileSyncTarStreamClient) Send(m *BytesMessage) error {
+	return x.ClientStream.SendMsg(m)
+}
+
+func (x *fileSyncTarStreamClient) Recv() (*BytesMessage, error) {
+	m := new(BytesMessage)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// Server API for FileSync service
+
+type FileSyncServer interface {
+	DiffCopy(FileSync_DiffCopyServer) error
+	TarStream(FileSync_TarStreamServer) error
+}
+
+func RegisterFileSyncServer(s *grpc.Server, srv FileSyncServer) {
+	s.RegisterService(&_FileSync_serviceDesc, srv)
+}
+
+func _FileSync_DiffCopy_Handler(srv interface{}, stream grpc.ServerStream) error {
+	return srv.(FileSyncServer).DiffCopy(&fileSyncDiffCopyServer{stream})
+}
+
+type FileSync_DiffCopyServer interface {
+	Send(*BytesMessage) error
+	Recv() (*BytesMessage, error)
+	grpc.ServerStream
+}
+
+type fileSyncDiffCopyServer struct {
+	grpc.ServerStream
+}
+
+func (x *fileSyncDiffCopyServer) Send(m *BytesMessage) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+func (x *fileSyncDiffCopyServer) Recv() (*BytesMessage, error) {
+	m := new(BytesMessage)
+	if err := x.ServerStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func _FileSync_TarStream_Handler(srv interface{}, stream grpc.ServerStream) error {
+	return srv.(FileSyncServer).TarStream(&fileSyncTarStreamServer{stream})
+}
+
+type FileSync_TarStreamServer interface {
+	Send(*BytesMessage) error
+	Recv() (*BytesMessage, error)
+	grpc.ServerStream
+}
+
+type fileSyncTarStreamServer struct {
+	grpc.ServerStream
+}
+
+func (x *fileSyncTarStreamServer) Send(m *BytesMessage) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+func (x *fileSyncTarStreamServer) Recv() (*BytesMessage, error) {
+	m := new(BytesMessage)
+	if err := x.ServerStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+var _FileSync_serviceDesc = grpc.ServiceDesc{
+	ServiceName: "moby.filesync.v1.FileSync",
+	HandlerType: (*FileSyncServer)(nil),
+	Methods:     []grpc.MethodDesc{},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "DiffCopy",
+			Handler:       _FileSync_DiffCopy_Handler,
+			ServerStreams: true,
+			ClientStreams: true,
+		},
+		{
+			StreamName:    "TarStream",
+			Handler:       _FileSync_TarStream_Handler,
+			ServerStreams: true,
+			ClientStreams: true,
+		},
+	},
+	Metadata: "filesync.proto",
+}
+
+func (m *BytesMessage) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *BytesMessage) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.Data) > 0 {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintFilesync(dAtA, i, uint64(len(m.Data)))
+		i += copy(dAtA[i:], m.Data)
+	}
+	return i, nil
+}
+
+func encodeFixed64Filesync(dAtA []byte, offset int, v uint64) int {
+	dAtA[offset] = uint8(v)
+	dAtA[offset+1] = uint8(v >> 8)
+	dAtA[offset+2] = uint8(v >> 16)
+	dAtA[offset+3] = uint8(v >> 24)
+	dAtA[offset+4] = uint8(v >> 32)
+	dAtA[offset+5] = uint8(v >> 40)
+	dAtA[offset+6] = uint8(v >> 48)
+	dAtA[offset+7] = uint8(v >> 56)
+	return offset + 8
+}
+func encodeFixed32Filesync(dAtA []byte, offset int, v uint32) int {
+	dAtA[offset] = uint8(v)
+	dAtA[offset+1] = uint8(v >> 8)
+	dAtA[offset+2] = uint8(v >> 16)
+	dAtA[offset+3] = uint8(v >> 24)
+	return offset + 4
+}
+func encodeVarintFilesync(dAtA []byte, offset int, v uint64) int {
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return offset + 1
+}
+func (m *BytesMessage) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.Data)
+	if l > 0 {
+		n += 1 + l + sovFilesync(uint64(l))
+	}
+	return n
+}
+
+func sovFilesync(x uint64) (n int) {
+	for {
+		n++
+		x >>= 7
+		if x == 0 {
+			break
+		}
+	}
+	return n
+}
+func sozFilesync(x uint64) (n int) {
+	return sovFilesync(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *BytesMessage) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&BytesMessage{`,
+		`Data:` + fmt.Sprintf("%v", this.Data) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringFilesync(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *BytesMessage) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowFilesync
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: BytesMessage: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: BytesMessage: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowFilesync
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthFilesync
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Data = append(m.Data[:0], dAtA[iNdEx:postIndex]...)
+			if m.Data == nil {
+				m.Data = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipFilesync(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthFilesync
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipFilesync(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowFilesync
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowFilesync
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+			return iNdEx, nil
+		case 1:
+			iNdEx += 8
+			return iNdEx, nil
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowFilesync
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			iNdEx += length
+			if length < 0 {
+				return 0, ErrInvalidLengthFilesync
+			}
+			return iNdEx, nil
+		case 3:
+			for {
+				var innerWire uint64
+				var start int = iNdEx
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return 0, ErrIntOverflowFilesync
+					}
+					if iNdEx >= l {
+						return 0, io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					innerWire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				innerWireType := int(innerWire & 0x7)
+				if innerWireType == 4 {
+					break
+				}
+				next, err := skipFilesync(dAtA[start:])
+				if err != nil {
+					return 0, err
+				}
+				iNdEx = start + next
+			}
+			return iNdEx, nil
+		case 4:
+			return iNdEx, nil
+		case 5:
+			iNdEx += 4
+			return iNdEx, nil
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+	}
+	panic("unreachable")
+}
+
+var (
+	ErrInvalidLengthFilesync = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowFilesync   = fmt.Errorf("proto: integer overflow")
+)
+
+func init() { proto.RegisterFile("filesync.proto", fileDescriptorFilesync) }
+
+var fileDescriptorFilesync = []byte{
+	// 198 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xe2, 0xe2, 0x4b, 0xcb, 0xcc, 0x49,
+	0x2d, 0xae, 0xcc, 0x4b, 0xd6, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0x12, 0xc8, 0xcd, 0x4f, 0xaa,
+	0xd4, 0x83, 0x0b, 0x96, 0x19, 0x2a, 0x29, 0x71, 0xf1, 0x38, 0x55, 0x96, 0xa4, 0x16, 0xfb, 0xa6,
+	0x16, 0x17, 0x27, 0xa6, 0xa7, 0x0a, 0x09, 0x71, 0xb1, 0xa4, 0x24, 0x96, 0x24, 0x4a, 0x30, 0x2a,
+	0x30, 0x6a, 0xf0, 0x04, 0x81, 0xd9, 0x46, 0xab, 0x19, 0xb9, 0x38, 0xdc, 0x32, 0x73, 0x52, 0x83,
+	0x2b, 0xf3, 0x92, 0x85, 0xfc, 0xb8, 0x38, 0x5c, 0x32, 0xd3, 0xd2, 0x9c, 0xf3, 0x0b, 0x2a, 0x85,
+	0xe4, 0xf4, 0xd0, 0xcd, 0xd3, 0x43, 0x36, 0x4c, 0x8a, 0x80, 0xbc, 0x06, 0xa3, 0x01, 0xa3, 0x90,
+	0x3f, 0x17, 0x67, 0x48, 0x62, 0x51, 0x70, 0x49, 0x51, 0x6a, 0x62, 0x2e, 0x35, 0x0c, 0x74, 0x32,
+	0xbb, 0xf0, 0x50, 0x8e, 0xe1, 0xc6, 0x43, 0x39, 0x86, 0x0f, 0x0f, 0xe5, 0x18, 0x1b, 0x1e, 0xc9,
+	0x31, 0xae, 0x78, 0x24, 0xc7, 0x78, 0xe2, 0x91, 0x1c, 0xe3, 0x85, 0x47, 0x72, 0x8c, 0x0f, 0x1e,
+	0xc9, 0x31, 0xbe, 0x78, 0x24, 0xc7, 0xf0, 0xe1, 0x91, 0x1c, 0xe3, 0x84, 0xc7, 0x72, 0x0c, 0x51,
+	0x1c, 0x30, 0xb3, 0x92, 0xd8, 0xc0, 0x41, 0x64, 0x0c, 0x08, 0x00, 0x00, 0xff, 0xff, 0x5f, 0x0c,
+	0x8d, 0xc5, 0x34, 0x01, 0x00, 0x00,
+}
diff --git a/components/engine/client/session/filesync/filesync.proto b/components/engine/client/session/filesync/filesync.proto
new file mode 100644
index 0000000000..2fd5b3ec8d
--- /dev/null
+++ b/components/engine/client/session/filesync/filesync.proto
@@ -0,0 +1,15 @@
+syntax = "proto3";
+
+package moby.filesync.v1;
+
+option go_package = "filesync";
+
+service FileSync{
+  rpc DiffCopy(stream BytesMessage) returns (stream BytesMessage);
+  rpc TarStream(stream BytesMessage) returns (stream BytesMessage);
+}
+
+// BytesMessage contains a chunk of byte data
+message BytesMessage{
+	bytes data = 1;
+}
\ No newline at end of file
diff --git a/components/engine/client/session/filesync/generate.go b/components/engine/client/session/filesync/generate.go
new file mode 100644
index 0000000000..261e876272
--- /dev/null
+++ b/components/engine/client/session/filesync/generate.go
@@ -0,0 +1,3 @@
+package filesync
+
+//go:generate protoc --gogoslick_out=plugins=grpc:. filesync.proto
diff --git a/components/engine/client/session/filesync/tarstream.go b/components/engine/client/session/filesync/tarstream.go
new file mode 100644
index 0000000000..ee01e30a75
--- /dev/null
+++ b/components/engine/client/session/filesync/tarstream.go
@@ -0,0 +1,83 @@
+package filesync
+
+import (
+	"io"
+
+	"github.com/Sirupsen/logrus"
+	"github.com/docker/docker/pkg/archive"
+	"github.com/docker/docker/pkg/chrootarchive"
+	"github.com/pkg/errors"
+	"google.golang.org/grpc"
+)
+
+func sendTarStream(stream grpc.Stream, dir string, excludes []string, progress progressCb) error {
+	a, err := archive.TarWithOptions(dir, &archive.TarOptions{
+		ExcludePatterns: excludes,
+	})
+	if err != nil {
+		return err
+	}
+
+	size := 0
+	buf := make([]byte, 1<<15)
+	t := new(BytesMessage)
+	for {
+		n, err := a.Read(buf)
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return err
+		}
+		t.Data = buf[:n]
+
+		if err := stream.SendMsg(t); err != nil {
+			return err
+		}
+		size += n
+		if progress != nil {
+			progress(size, false)
+		}
+	}
+	if progress != nil {
+		progress(size, true)
+	}
+	return nil
+}
+
+func recvTarStream(ds grpc.Stream, dest string, cs CacheUpdater) error {
+
+	pr, pw := io.Pipe()
+
+	go func() {
+		var (
+			err error
+			t   = new(BytesMessage)
+		)
+		for {
+			if err = ds.RecvMsg(t); err != nil {
+				if err == io.EOF {
+					err = nil
+				}
+				break
+			}
+			_, err = pw.Write(t.Data)
+			if err != nil {
+				break
+			}
+		}
+		if err = pw.CloseWithError(err); err != nil {
+			logrus.Errorf("failed to close tar transfer pipe")
+		}
+	}()
+
+	decompressedStream, err := archive.DecompressStream(pr)
+	if err != nil {
+		return errors.Wrap(err, "failed to decompress stream")
+	}
+
+	if err := chrootarchive.Untar(decompressedStream, dest, nil); err != nil {
+		return errors.Wrap(err, "failed to untar context")
+	}
+	return nil
+}
diff --git a/components/engine/client/session/grpc.go b/components/engine/client/session/grpc.go
new file mode 100644
index 0000000000..0f20b15047
--- /dev/null
+++ b/components/engine/client/session/grpc.go
@@ -0,0 +1,62 @@
+package session
+
+import (
+	"net"
+	"time"
+
+	"github.com/Sirupsen/logrus"
+	"github.com/pkg/errors"
+	"golang.org/x/net/context"
+	"golang.org/x/net/http2"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/health/grpc_health_v1"
+)
+
+func serve(ctx context.Context, grpcServer *grpc.Server, conn net.Conn) {
+	go func() {
+		<-ctx.Done()
+		conn.Close()
+	}()
+	logrus.Debugf("serving grpc connection")
+	(&http2.Server{}).ServeConn(conn, &http2.ServeConnOpts{Handler: grpcServer})
+}
+
+func grpcClientConn(ctx context.Context, conn net.Conn) (context.Context, *grpc.ClientConn, error) {
+	dialOpt := grpc.WithDialer(func(addr string, d time.Duration) (net.Conn, error) {
+		return conn, nil
+	})
+
+	cc, err := grpc.DialContext(ctx, "", dialOpt, grpc.WithInsecure())
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "failed to create grpc client")
+	}
+
+	ctx, cancel := context.WithCancel(ctx)
+	go monitorHealth(ctx, cc, cancel)
+
+	return ctx, cc, nil
+}
+
+func monitorHealth(ctx context.Context, cc *grpc.ClientConn, cancelConn func()) {
+	defer cancelConn()
+	defer cc.Close()
+
+	ticker := time.NewTicker(500 * time.Millisecond)
+	defer ticker.Stop()
+	healthClient := grpc_health_v1.NewHealthClient(cc)
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			<-ticker.C
+			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+			_, err := healthClient.Check(ctx, &grpc_health_v1.HealthCheckRequest{})
+			cancel()
+			if err != nil {
+				return
+			}
+		}
+	}
+}
diff --git a/components/engine/client/session/manager.go b/components/engine/client/session/manager.go
new file mode 100644
index 0000000000..023e850301
--- /dev/null
+++ b/components/engine/client/session/manager.go
@@ -0,0 +1,187 @@
+package session
+
+import (
+	"net/http"
+	"strings"
+	"sync"
+
+	"github.com/pkg/errors"
+	"golang.org/x/net/context"
+	"google.golang.org/grpc"
+)
+
+// Caller can invoke requests on the session
+type Caller interface {
+	Context() context.Context
+	Supports(method string) bool
+	Conn() *grpc.ClientConn
+	Name() string
+	SharedKey() string
+}
+
+type client struct {
+	Session
+	cc        *grpc.ClientConn
+	supported map[string]struct{}
+}
+
+// Manager is a controller for accessing currently active sessions
+type Manager struct {
+	sessions        map[string]*client
+	mu              sync.Mutex
+	updateCondition *sync.Cond
+}
+
+// NewManager returns a new Manager
+func NewManager() (*Manager, error) {
+	sm := &Manager{
+		sessions: make(map[string]*client),
+	}
+	sm.updateCondition = sync.NewCond(&sm.mu)
+	return sm, nil
+}
+
+// HandleHTTPRequest handles an incoming HTTP request
+func (sm *Manager) HandleHTTPRequest(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
+	hijacker, ok := w.(http.Hijacker)
+	if !ok {
+		return errors.New("handler does not support hijack")
+	}
+
+	uuid := r.Header.Get(headerSessionUUID)
+	name := r.Header.Get(headerSessionName)
+	sharedKey := r.Header.Get(headerSessionSharedKey)
+
+	proto := r.Header.Get("Upgrade")
+
+	sm.mu.Lock()
+	if _, ok := sm.sessions[uuid]; ok {
+		sm.mu.Unlock()
+		return errors.Errorf("session %s already exists", uuid)
+	}
+
+	if proto == "" {
+		sm.mu.Unlock()
+		return errors.New("no upgrade proto in request")
+	}
+
+	if proto != "h2c" {
+		sm.mu.Unlock()
+		return errors.Errorf("protocol %s not supported", proto)
+	}
+
+	conn, _, err := hijacker.Hijack()
+	if err != nil {
+		sm.mu.Unlock()
+		return errors.Wrap(err, "failed to hijack connection")
+	}
+
+	resp := &http.Response{
+		StatusCode: http.StatusSwitchingProtocols,
+		ProtoMajor: 1,
+		ProtoMinor: 1,
+		Header:     http.Header{},
+	}
+	resp.Header.Set("Connection", "Upgrade")
+	resp.Header.Set("Upgrade", proto)
+
+	// set raw mode
+	conn.Write([]byte{})
+	resp.Write(conn)
+
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	ctx, cc, err := grpcClientConn(ctx, conn)
+	if err != nil {
+		sm.mu.Unlock()
+		return err
+	}
+
+	c := &client{
+		Session: Session{
+			uuid:      uuid,
+			name:      name,
+			sharedKey: sharedKey,
+			ctx:       ctx,
+			cancelCtx: cancel,
+			done:      make(chan struct{}),
+		},
+		cc:        cc,
+		supported: make(map[string]struct{}),
+	}
+
+	for _, m := range r.Header[headerSessionMethod] {
+		c.supported[strings.ToLower(m)] = struct{}{}
+	}
+	sm.sessions[uuid] = c
+	sm.updateCondition.Broadcast()
+	sm.mu.Unlock()
+
+	defer func() {
+		sm.mu.Lock()
+		delete(sm.sessions, uuid)
+		sm.mu.Unlock()
+	}()
+
+	<-c.ctx.Done()
+	conn.Close()
+	close(c.done)
+
+	return nil
+}
+
+// Get returns a session by UUID
+func (sm *Manager) Get(ctx context.Context, uuid string) (Caller, error) {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	go func() {
+		select {
+		case <-ctx.Done():
+			sm.updateCondition.Broadcast()
+		}
+	}()
+
+	var c *client
+
+	sm.mu.Lock()
+	for {
+		select {
+		case <-ctx.Done():
+			sm.mu.Unlock()
+			return nil, errors.Wrapf(ctx.Err(), "no active session for %s", uuid)
+		default:
+		}
+		var ok bool
+		c, ok = sm.sessions[uuid]
+		if !ok || c.closed() {
+			sm.updateCondition.Wait()
+			continue
+		}
+		sm.mu.Unlock()
+		break
+	}
+
+	return c, nil
+}
+
+func (c *client) Context() context.Context {
+	return c.context()
+}
+
+func (c *client) Name() string {
+	return c.name
+}
+
+func (c *client) SharedKey() string {
+	return c.sharedKey
+}
+
+func (c *client) Supports(url string) bool {
+	_, ok := c.supported[strings.ToLower(url)]
+	return ok
+}
+func (c *client) Conn() *grpc.ClientConn {
+	return c.cc
+}
diff --git a/components/engine/client/session/session.go b/components/engine/client/session/session.go
new file mode 100644
index 0000000000..147486a75b
--- /dev/null
+++ b/components/engine/client/session/session.go
@@ -0,0 +1,117 @@
+package session
+
+import (
+	"net"
+
+	"github.com/docker/docker/pkg/stringid"
+	"github.com/pkg/errors"
+	"golang.org/x/net/context"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/health"
+	"google.golang.org/grpc/health/grpc_health_v1"
+)
+
+const (
+	headerSessionUUID      = "X-Docker-Expose-Session-Uuid"
+	headerSessionName      = "X-Docker-Expose-Session-Name"
+	headerSessionSharedKey = "X-Docker-Expose-Session-Sharedkey"
+	headerSessionMethod    = "X-Docker-Expose-Session-Grpc-Method"
+)
+
+// Dialer returns a connection that can be used by the session
+type Dialer func(ctx context.Context, proto string, meta map[string][]string) (net.Conn, error)
+
+// Attachable defines a feature that can be expsed on a session
+type Attachable interface {
+	Register(*grpc.Server)
+}
+
+// Session is a long running connection between client and a daemon
+type Session struct {
+	uuid       string
+	name       string
+	sharedKey  string
+	ctx        context.Context
+	cancelCtx  func()
+	done       chan struct{}
+	grpcServer *grpc.Server
+}
+
+// NewSession returns a new long running session
+func NewSession(name, sharedKey string) (*Session, error) {
+	uuid := stringid.GenerateRandomID()
+	s := &Session{
+		uuid:       uuid,
+		name:       name,
+		sharedKey:  sharedKey,
+		grpcServer: grpc.NewServer(),
+	}
+
+	grpc_health_v1.RegisterHealthServer(s.grpcServer, health.NewServer())
+
+	return s, nil
+}
+
+// Allow enable a given service to be reachable through the grpc session
+func (s *Session) Allow(a Attachable) {
+	a.Register(s.grpcServer)
+}
+
+// UUID returns unique identifier for the session
+func (s *Session) UUID() string {
+	return s.uuid
+}
+
+// Run activates the session
+func (s *Session) Run(ctx context.Context, dialer Dialer) error {
+	ctx, cancel := context.WithCancel(ctx)
+	s.cancelCtx = cancel
+	s.done = make(chan struct{})
+
+	defer cancel()
+	defer close(s.done)
+
+	meta := make(map[string][]string)
+	meta[headerSessionUUID] = []string{s.uuid}
+	meta[headerSessionName] = []string{s.name}
+	meta[headerSessionSharedKey] = []string{s.sharedKey}
+
+	for name, svc := range s.grpcServer.GetServiceInfo() {
+		for _, method := range svc.Methods {
+			meta[headerSessionMethod] = append(meta[headerSessionMethod], MethodURL(name, method.Name))
+		}
+	}
+	conn, err := dialer(ctx, "h2c", meta)
+	if err != nil {
+		return errors.Wrap(err, "failed to dial gRPC")
+	}
+	serve(ctx, s.grpcServer, conn)
+	return nil
+}
+
+// Close closes the session
+func (s *Session) Close() error {
+	if s.cancelCtx != nil && s.done != nil {
+		s.cancelCtx()
+		<-s.done
+	}
+	return nil
+}
+
+func (s *Session) context() context.Context {
+	return s.ctx
+}
+
+func (s *Session) closed() bool {
+	select {
+	case <-s.context().Done():
+		return true
+	default:
+		return false
+	}
+}
+
+// MethodURL returns a gRPC method URL for service and method name
+func MethodURL(s, m string) string {
+	return "/" + s + "/" + m
+}
diff --git a/components/engine/client/swarm_unlock_test.go b/components/engine/client/swarm_unlock_test.go
new file mode 100644
index 0000000000..c242d41784
--- /dev/null
+++ b/components/engine/client/swarm_unlock_test.go
@@ -0,0 +1,49 @@
+package client
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"strings"
+	"testing"
+
+	"golang.org/x/net/context"
+
+	"github.com/docker/docker/api/types/swarm"
+)
+
+func TestSwarmUnlockError(t *testing.T) {
+	client := &Client{
+		client: newMockClient(errorMock(http.StatusInternalServerError, "Server error")),
+	}
+
+	err := client.SwarmUnlock(context.Background(), swarm.UnlockRequest{"SWMKEY-1-y6guTZNTwpQeTL5RhUfOsdBdXoQjiB2GADHSRJvbXeU"})
+	if err == nil || err.Error() != "Error response from daemon: Server error" {
+		t.Fatalf("expected a Server Error, got %v", err)
+	}
+}
+
+func TestSwarmUnlock(t *testing.T) {
+	expectedURL := "/swarm/unlock"
+
+	client := &Client{
+		client: newMockClient(func(req *http.Request) (*http.Response, error) {
+			if !strings.HasPrefix(req.URL.Path, expectedURL) {
+				return nil, fmt.Errorf("Expected URL '%s', got '%s'", expectedURL, req.URL)
+			}
+			if req.Method != "POST" {
+				return nil, fmt.Errorf("expected POST method, got %s", req.Method)
+			}
+			return &http.Response{
+				StatusCode: http.StatusOK,
+				Body:       ioutil.NopCloser(bytes.NewReader([]byte(""))),
+			}, nil
+		}),
+	}
+
+	err := client.SwarmUnlock(context.Background(), swarm.UnlockRequest{"SWMKEY-1-y6guTZNTwpQeTL5RhUfOsdBdXoQjiB2GADHSRJvbXeU"})
+	if err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/components/engine/cmd/dockerd/config.go b/components/engine/cmd/dockerd/config.go
index da4071e46c..440497bfbc 100644
--- a/components/engine/cmd/dockerd/config.go
+++ b/components/engine/cmd/dockerd/config.go
@@ -1,6 +1,8 @@
 package main
 
 import (
+	"runtime"
+
 	"github.com/docker/docker/daemon/config"
 	"github.com/docker/docker/opts"
 	"github.com/spf13/pflag"
@@ -33,7 +35,12 @@ func installCommonConfigFlags(conf *config.Config, flags *pflag.FlagSet) {
 
 	flags.BoolVarP(&conf.AutoRestart, "restart", "r", true, "--restart on the daemon has been deprecated in favor of --restart policies on docker run")
 	flags.MarkDeprecated("restart", "Please use a restart policy on docker run")
-	flags.StringVarP(&conf.GraphDriver, "storage-driver", "s", "", "Storage driver to use")
+
+	// Windows doesn't support setting the storage driver - there is no choice as to which ones to use.
+	if runtime.GOOS != "windows" {
+		flags.StringVarP(&conf.GraphDriver, "storage-driver", "s", "", "Storage driver to use")
+	}
+
 	flags.IntVar(&conf.Mtu, "mtu", 0, "Set the containers network MTU")
 	flags.BoolVar(&conf.RawLogs, "raw-logs", false, "Full timestamps without ANSI coloring")
 	flags.Var(opts.NewListOptsRef(&conf.DNS, opts.ValidateIPAddress), "dns", "DNS server to use")
diff --git a/components/engine/cmd/dockerd/config_unix.go b/components/engine/cmd/dockerd/config_unix.go
index 8e741aa904..ba37121e96 100644
--- a/components/engine/cmd/dockerd/config_unix.go
+++ b/components/engine/cmd/dockerd/config_unix.go
@@ -24,7 +24,7 @@ func installConfigFlags(conf *config.Config, flags *pflag.FlagSet) {
 
 	// Then platform-specific install flags
 	flags.BoolVar(&conf.EnableSelinuxSupport, "selinux-enabled", false, "Enable selinux support")
-	flags.Var(opts.NewUlimitOpt(&conf.Ulimits), "default-ulimit", "Default ulimits for containers")
+	flags.Var(opts.NewNamedUlimitOpt("default-ulimits", &conf.Ulimits), "default-ulimit", "Default ulimits for containers")
 	flags.BoolVar(&conf.BridgeConfig.EnableIPTables, "iptables", true, "Enable addition of iptables rules")
 	flags.BoolVar(&conf.BridgeConfig.EnableIPForward, "ip-forward", true, "Enable net.ipv4.ip_forward")
 	flags.BoolVar(&conf.BridgeConfig.EnableIPMasq, "ip-masq", true, "Enable IP masquerading")
diff --git a/components/engine/cmd/dockerd/daemon.go b/components/engine/cmd/dockerd/daemon.go
index 5898df77f6..c9f7065c28 100644
--- a/components/engine/cmd/dockerd/daemon.go
+++ b/components/engine/cmd/dockerd/daemon.go
@@ -23,11 +23,14 @@ import (
 	"github.com/docker/docker/api/server/router/image"
 	"github.com/docker/docker/api/server/router/network"
 	pluginrouter "github.com/docker/docker/api/server/router/plugin"
+	sessionrouter "github.com/docker/docker/api/server/router/session"
 	swarmrouter "github.com/docker/docker/api/server/router/swarm"
 	systemrouter "github.com/docker/docker/api/server/router/system"
 	"github.com/docker/docker/api/server/router/volume"
+	"github.com/docker/docker/builder/dockerfile"
+	"github.com/docker/docker/builder/fscache"
 	"github.com/docker/docker/cli/debug"
-	cliflags "github.com/docker/docker/cli/flags"
+	"github.com/docker/docker/client/session"
 	"github.com/docker/docker/daemon"
 	"github.com/docker/docker/daemon/cluster"
 	"github.com/docker/docker/daemon/config"
@@ -41,11 +44,13 @@ import (
 	"github.com/docker/docker/pkg/pidfile"
 	"github.com/docker/docker/pkg/plugingetter"
 	"github.com/docker/docker/pkg/signal"
+	"github.com/docker/docker/pkg/system"
 	"github.com/docker/docker/plugin"
 	"github.com/docker/docker/registry"
 	"github.com/docker/docker/runconfig"
 	"github.com/docker/go-connections/tlsconfig"
 	swarmapi "github.com/docker/swarmkit/api"
+	"github.com/pkg/errors"
 	"github.com/spf13/pflag"
 )
 
@@ -65,14 +70,14 @@ func NewDaemonCli() *DaemonCli {
 	return &DaemonCli{}
 }
 
-func (cli *DaemonCli) start(opts daemonOptions) (err error) {
+func (cli *DaemonCli) start(opts *daemonOptions) (err error) {
 	stopc := make(chan bool)
 	defer close(stopc)
 
 	// warn from uuid package when running the daemon
 	uuid.Loggerf = logrus.Warnf
 
-	opts.common.SetDefaultOptions(opts.flags)
+	opts.SetDefaultOptions(opts.flags)
 
 	if cli.Config, err = loadDaemonCliConfig(opts); err != nil {
 		return err
@@ -121,6 +126,7 @@ func (cli *DaemonCli) start(opts daemonOptions) (err error) {
 		}()
 	}
 
+	// TODO: extract to newApiServerConfig()
 	serverConfig := &apiserver.Config{
 		Logging:     true,
 		SocketGroup: cli.Config.SocketGroup,
@@ -152,8 +158,9 @@ func (cli *DaemonCli) start(opts daemonOptions) (err error) {
 		cli.Config.Hosts = make([]string, 1)
 	}
 
-	api := apiserver.New(serverConfig)
-	cli.api = api
+	cli.api = apiserver.New(serverConfig)
+
+	var hosts []string
 
 	for i := 0; i < len(cli.Config.Hosts); i++ {
 		var err error
@@ -186,7 +193,8 @@ func (cli *DaemonCli) start(opts daemonOptions) (err error) {
 			}
 		}
 		logrus.Debugf("Listener created for HTTP on %s (%s)", proto, addr)
-		api.Accept(addr, ls...)
+		hosts = append(hosts, protoAddrParts[1])
+		cli.api.Accept(addr, ls...)
 	}
 
 	registryService := registry.NewService(cli.Config.ServiceOptions)
@@ -204,20 +212,27 @@ func (cli *DaemonCli) start(opts daemonOptions) (err error) {
 
 	pluginStore := plugin.NewStore()
 
-	if err := cli.initMiddlewares(api, serverConfig, pluginStore); err != nil {
+	if err := cli.initMiddlewares(cli.api, serverConfig, pluginStore); err != nil {
 		logrus.Fatalf("Error creating middlewares: %v", err)
 	}
 
+	if system.LCOWSupported() {
+		logrus.Warnln("LCOW support is enabled - this feature is incomplete")
+	}
+
 	d, err := daemon.NewDaemon(cli.Config, registryService, containerdRemote, pluginStore)
 	if err != nil {
 		return fmt.Errorf("Error starting daemon: %v", err)
 	}
 
+	d.StoreHosts(hosts)
+
 	// validate after NewDaemon has restored enabled plugins. Dont change order.
 	if err := validateAuthzPlugins(cli.Config.AuthorizationPlugins, pluginStore); err != nil {
 		return fmt.Errorf("Error validating authorization plugin: %v", err)
 	}
 
+	// TODO: move into startMetricsServer()
 	if cli.Config.MetricsAddress != "" {
 		if !d.HasExperimental() {
 			return fmt.Errorf("metrics-addr is only supported when experimental is enabled")
@@ -227,6 +242,7 @@ func (cli *DaemonCli) start(opts daemonOptions) (err error) {
 		}
 	}
 
+	// TODO: createAndStartCluster()
 	name, _ := os.Hostname()
 
 	// Use a buffered channel to pass changes from store watch API to daemon
@@ -258,15 +274,16 @@ func (cli *DaemonCli) start(opts daemonOptions) (err error) {
 
 	logrus.Info("Daemon has completed initialization")
 
-	logrus.WithFields(logrus.Fields{
-		"version":     dockerversion.Version,
-		"commit":      dockerversion.GitCommit,
-		"graphdriver": d.GraphDriverName(),
-	}).Info("Docker daemon")
-
 	cli.d = d
 
-	initRouter(api, d, c)
+	routerOptions, err := newRouterOptions(cli.Config, d)
+	if err != nil {
+		return err
+	}
+	routerOptions.api = cli.api
+	routerOptions.cluster = c
+
+	initRouter(routerOptions)
 
 	// process cluster change notifications
 	watchCtx, cancel := context.WithCancel(context.Background())
@@ -279,7 +296,7 @@ func (cli *DaemonCli) start(opts daemonOptions) (err error) {
 	// We need to start it as a goroutine and wait on it so
 	// daemon doesn't exit
 	serveAPIWait := make(chan error)
-	go api.Wait(serveAPIWait)
+	go cli.api.Wait(serveAPIWait)
 
 	// after the daemon is done setting up we can notify systemd api
 	notifySystem()
@@ -297,6 +314,54 @@ func (cli *DaemonCli) start(opts daemonOptions) (err error) {
 	return nil
 }
 
+type routerOptions struct {
+	sessionManager *session.Manager
+	buildBackend   *buildbackend.Backend
+	buildCache     *fscache.FSCache
+	daemon         *daemon.Daemon
+	api            *apiserver.Server
+	cluster        *cluster.Cluster
+}
+
+func newRouterOptions(config *config.Config, daemon *daemon.Daemon) (routerOptions, error) {
+	opts := routerOptions{}
+	sm, err := session.NewManager()
+	if err != nil {
+		return opts, errors.Wrap(err, "failed to create sessionmanager")
+	}
+
+	builderStateDir := filepath.Join(config.Root, "builder")
+
+	buildCache, err := fscache.NewFSCache(fscache.Opt{
+		Backend: fscache.NewNaiveCacheBackend(builderStateDir),
+		Root:    builderStateDir,
+		GCPolicy: fscache.GCPolicy{ // TODO: expose this in config
+			MaxSize:         1024 * 1024 * 512,  // 512MB
+			MaxKeepDuration: 7 * 24 * time.Hour, // 1 week
+		},
+	})
+	if err != nil {
+		return opts, errors.Wrap(err, "failed to create fscache")
+	}
+
+	manager, err := dockerfile.NewBuildManager(daemon, sm, buildCache, daemon.IDMappings())
+	if err != nil {
+		return opts, err
+	}
+
+	bb, err := buildbackend.NewBackend(daemon, manager, buildCache)
+	if err != nil {
+		return opts, errors.Wrap(err, "failed to create buildmanager")
+	}
+
+	return routerOptions{
+		sessionManager: sm,
+		buildBackend:   bb,
+		buildCache:     buildCache,
+		daemon:         daemon,
+	}, nil
+}
+
 func (cli *DaemonCli) reloadConfig() {
 	reload := func(config *config.Config) {
 
@@ -358,20 +423,20 @@ func shutdownDaemon(d *daemon.Daemon) {
 	}
 }
 
-func loadDaemonCliConfig(opts daemonOptions) (*config.Config, error) {
+func loadDaemonCliConfig(opts *daemonOptions) (*config.Config, error) {
 	conf := opts.daemonConfig
 	flags := opts.flags
-	conf.Debug = opts.common.Debug
-	conf.Hosts = opts.common.Hosts
-	conf.LogLevel = opts.common.LogLevel
-	conf.TLS = opts.common.TLS
-	conf.TLSVerify = opts.common.TLSVerify
+	conf.Debug = opts.Debug
+	conf.Hosts = opts.Hosts
+	conf.LogLevel = opts.LogLevel
+	conf.TLS = opts.TLS
+	conf.TLSVerify = opts.TLSVerify
 	conf.CommonTLSOptions = config.CommonTLSOptions{}
 
-	if opts.common.TLSOptions != nil {
-		conf.CommonTLSOptions.CAFile = opts.common.TLSOptions.CAFile
-		conf.CommonTLSOptions.CertFile = opts.common.TLSOptions.CertFile
-		conf.CommonTLSOptions.KeyFile = opts.common.TLSOptions.KeyFile
+	if opts.TLSOptions != nil {
+		conf.CommonTLSOptions.CAFile = opts.TLSOptions.CAFile
+		conf.CommonTLSOptions.CertFile = opts.TLSOptions.CertFile
+		conf.CommonTLSOptions.KeyFile = opts.TLSOptions.KeyFile
 	}
 
 	if conf.TrustKeyPath == "" {
@@ -402,8 +467,12 @@ func loadDaemonCliConfig(opts daemonOptions) (*config.Config, error) {
 		return nil, err
 	}
 
+	if conf.V2Only == false {
+		logrus.Warnf(`The "disable-legacy-registry" option is deprecated and wil be removed in Docker v17.12. Interacting with legacy (v1) registries will no longer be supported in Docker v17.12"`)
+	}
+
 	if flags.Changed("graph") {
-		logrus.Warnf(`the "-g / --graph" flag is deprecated. Please use "--data-root" instead`)
+		logrus.Warnf(`The "-g / --graph" flag is deprecated. Please use "--data-root" instead`)
 	}
 
 	// Labels of the docker engine used to allow multiple values associated with the same key.
@@ -425,37 +494,38 @@ func loadDaemonCliConfig(opts daemonOptions) (*config.Config, error) {
 
 	// Regardless of whether the user sets it to true or false, if they
 	// specify TLSVerify at all then we need to turn on TLS
-	if conf.IsValueSet(cliflags.FlagTLSVerify) {
+	if conf.IsValueSet(FlagTLSVerify) {
 		conf.TLS = true
 	}
 
 	// ensure that the log level is the one set after merging configurations
-	cliflags.SetLogLevel(conf.LogLevel)
+	setLogLevel(conf.LogLevel)
 
 	return conf, nil
 }
 
-func initRouter(s *apiserver.Server, d *daemon.Daemon, c *cluster.Cluster) {
+func initRouter(opts routerOptions) {
 	decoder := runconfig.ContainerDecoder{}
 
 	routers := []router.Router{
 		// we need to add the checkpoint router before the container router or the DELETE gets masked
-		checkpointrouter.NewRouter(d, decoder),
-		container.NewRouter(d, decoder),
-		image.NewRouter(d, decoder),
-		systemrouter.NewRouter(d, c),
-		volume.NewRouter(d),
-		build.NewRouter(buildbackend.NewBackend(d, d), d),
-		swarmrouter.NewRouter(c),
-		pluginrouter.NewRouter(d.PluginManager()),
-		distributionrouter.NewRouter(d),
+		checkpointrouter.NewRouter(opts.daemon, decoder),
+		container.NewRouter(opts.daemon, decoder),
+		image.NewRouter(opts.daemon, decoder),
+		systemrouter.NewRouter(opts.daemon, opts.cluster, opts.buildCache),
+		volume.NewRouter(opts.daemon),
+		build.NewRouter(opts.buildBackend, opts.daemon),
+		sessionrouter.NewRouter(opts.sessionManager),
+		swarmrouter.NewRouter(opts.cluster),
+		pluginrouter.NewRouter(opts.daemon.PluginManager()),
+		distributionrouter.NewRouter(opts.daemon),
 	}
 
-	if d.NetworkControllerEnabled() {
-		routers = append(routers, network.NewRouter(d, c))
+	if opts.daemon.NetworkControllerEnabled() {
+		routers = append(routers, network.NewRouter(opts.daemon, opts.cluster))
 	}
 
-	if d.HasExperimental() {
+	if opts.daemon.HasExperimental() {
 		for _, r := range routers {
 			for _, route := range r.Routes() {
 				if experimental, ok := route.(router.ExperimentalRoute); ok {
@@ -465,9 +535,10 @@ func initRouter(s *apiserver.Server, d *daemon.Daemon, c *cluster.Cluster) {
 		}
 	}
 
-	s.InitRouter(debug.IsEnabled(), routers...)
+	opts.api.InitRouter(debug.IsEnabled(), routers...)
 }
 
+// TODO: remove this from cli and return the authzMiddleware
 func (cli *DaemonCli) initMiddlewares(s *apiserver.Server, cfg *apiserver.Config, pluginStore *plugin.Store) error {
 	v := cfg.Version
 
diff --git a/components/engine/cmd/dockerd/daemon_test.go b/components/engine/cmd/dockerd/daemon_test.go
index c3ad617c78..7ae91fe1a7 100644
--- a/components/engine/cmd/dockerd/daemon_test.go
+++ b/components/engine/cmd/dockerd/daemon_test.go
@@ -4,7 +4,6 @@ import (
 	"testing"
 
 	"github.com/Sirupsen/logrus"
-	cliflags "github.com/docker/docker/cli/flags"
 	"github.com/docker/docker/daemon/config"
 	"github.com/docker/docker/pkg/testutil"
 	"github.com/docker/docker/pkg/testutil/tempfile"
@@ -13,13 +12,10 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func defaultOptions(configFile string) daemonOptions {
-	opts := daemonOptions{
-		daemonConfig: &config.Config{},
-		flags:        &pflag.FlagSet{},
-		common:       cliflags.NewCommonOptions(),
-	}
-	opts.common.InstallFlags(opts.flags)
+func defaultOptions(configFile string) *daemonOptions {
+	opts := newDaemonOptions(&config.Config{})
+	opts.flags = &pflag.FlagSet{}
+	opts.InstallFlags(opts.flags)
 	installConfigFlags(opts.daemonConfig, opts.flags)
 	opts.flags.StringVar(&opts.configFile, "config-file", defaultDaemonConfigFile, "")
 	opts.configFile = configFile
@@ -28,7 +24,7 @@ func defaultOptions(configFile string) daemonOptions {
 
 func TestLoadDaemonCliConfigWithoutOverriding(t *testing.T) {
 	opts := defaultOptions("")
-	opts.common.Debug = true
+	opts.Debug = true
 
 	loadedConfig, err := loadDaemonCliConfig(opts)
 	require.NoError(t, err)
@@ -40,8 +36,8 @@ func TestLoadDaemonCliConfigWithoutOverriding(t *testing.T) {
 
 func TestLoadDaemonCliConfigWithTLS(t *testing.T) {
 	opts := defaultOptions("")
-	opts.common.TLSOptions.CAFile = "/tmp/ca.pem"
-	opts.common.TLS = true
+	opts.TLSOptions.CAFile = "/tmp/ca.pem"
+	opts.TLS = true
 
 	loadedConfig, err := loadDaemonCliConfig(opts)
 	require.NoError(t, err)
@@ -70,7 +66,7 @@ func TestLoadDaemonCliConfigWithTLSVerify(t *testing.T) {
 	defer tempFile.Remove()
 
 	opts := defaultOptions(tempFile.Name())
-	opts.common.TLSOptions.CAFile = "/tmp/ca.pem"
+	opts.TLSOptions.CAFile = "/tmp/ca.pem"
 
 	loadedConfig, err := loadDaemonCliConfig(opts)
 	require.NoError(t, err)
@@ -83,7 +79,7 @@ func TestLoadDaemonCliConfigWithExplicitTLSVerifyFalse(t *testing.T) {
 	defer tempFile.Remove()
 
 	opts := defaultOptions(tempFile.Name())
-	opts.common.TLSOptions.CAFile = "/tmp/ca.pem"
+	opts.TLSOptions.CAFile = "/tmp/ca.pem"
 
 	loadedConfig, err := loadDaemonCliConfig(opts)
 	require.NoError(t, err)
@@ -96,7 +92,7 @@ func TestLoadDaemonCliConfigWithoutTLSVerify(t *testing.T) {
 	defer tempFile.Remove()
 
 	opts := defaultOptions(tempFile.Name())
-	opts.common.TLSOptions.CAFile = "/tmp/ca.pem"
+	opts.TLSOptions.CAFile = "/tmp/ca.pem"
 
 	loadedConfig, err := loadDaemonCliConfig(opts)
 	require.NoError(t, err)
diff --git a/components/engine/cmd/dockerd/daemon_unix_test.go b/components/engine/cmd/dockerd/daemon_unix_test.go
index 4aaa758d53..ebe73362f8 100644
--- a/components/engine/cmd/dockerd/daemon_unix_test.go
+++ b/components/engine/cmd/dockerd/daemon_unix_test.go
@@ -20,8 +20,8 @@ func TestLoadDaemonCliConfigWithDaemonFlags(t *testing.T) {
 	defer tempFile.Remove()
 
 	opts := defaultOptions(tempFile.Name())
-	opts.common.Debug = true
-	opts.common.LogLevel = "info"
+	opts.Debug = true
+	opts.LogLevel = "info"
 	assert.NoError(t, opts.flags.Set("selinux-enabled", "true"))
 
 	loadedConfig, err := loadDaemonCliConfig(opts)
@@ -102,7 +102,7 @@ func TestLoadDaemonConfigWithTrueDefaultValuesLeaveDefaults(t *testing.T) {
 }
 
 func TestLoadDaemonConfigWithLegacyRegistryOptions(t *testing.T) {
-	content := `{"disable-legacy-registry": true}`
+	content := `{"disable-legacy-registry": false}`
 	tempFile := tempfile.NewTempFile(t, "config", content)
 	defer tempFile.Remove()
 
@@ -110,5 +110,5 @@ func TestLoadDaemonConfigWithLegacyRegistryOptions(t *testing.T) {
 	loadedConfig, err := loadDaemonCliConfig(opts)
 	require.NoError(t, err)
 	require.NotNil(t, loadedConfig)
-	assert.True(t, loadedConfig.V2Only)
+	assert.False(t, loadedConfig.V2Only)
 }
diff --git a/components/engine/cmd/dockerd/docker.go b/components/engine/cmd/dockerd/docker.go
index c0bc965674..8a5c8f5433 100644
--- a/components/engine/cmd/dockerd/docker.go
+++ b/components/engine/cmd/dockerd/docker.go
@@ -8,28 +8,15 @@ import (
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/cli"
-	cliflags "github.com/docker/docker/cli/flags"
 	"github.com/docker/docker/daemon/config"
 	"github.com/docker/docker/dockerversion"
 	"github.com/docker/docker/pkg/reexec"
 	"github.com/docker/docker/pkg/term"
 	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
 )
 
-type daemonOptions struct {
-	version      bool
-	configFile   string
-	daemonConfig *config.Config
-	common       *cliflags.CommonOptions
-	flags        *pflag.FlagSet
-}
-
 func newDaemonCommand() *cobra.Command {
-	opts := daemonOptions{
-		daemonConfig: config.New(),
-		common:       cliflags.NewCommonOptions(),
-	}
+	opts := newDaemonOptions(config.New())
 
 	cmd := &cobra.Command{
 		Use:           "dockerd [OPTIONS]",
@@ -47,14 +34,14 @@ func newDaemonCommand() *cobra.Command {
 	flags := cmd.Flags()
 	flags.BoolVarP(&opts.version, "version", "v", false, "Print version information and quit")
 	flags.StringVar(&opts.configFile, "config-file", defaultDaemonConfigFile, "Daemon configuration file")
-	opts.common.InstallFlags(flags)
+	opts.InstallFlags(flags)
 	installConfigFlags(opts.daemonConfig, flags)
 	installServiceFlags(flags)
 
 	return cmd
 }
 
-func runDaemon(opts daemonOptions) error {
+func runDaemon(opts *daemonOptions) error {
 	if opts.version {
 		showVersion()
 		return nil
diff --git a/components/engine/cli/flags/common.go b/components/engine/cmd/dockerd/options.go
similarity index 62%
rename from components/engine/cli/flags/common.go
rename to components/engine/cmd/dockerd/options.go
index 38a793c402..629b0223e9 100644
--- a/components/engine/cli/flags/common.go
+++ b/components/engine/cmd/dockerd/options.go
@@ -1,4 +1,4 @@
-package flags
+package main
 
 import (
 	"fmt"
@@ -6,6 +6,8 @@ import (
 	"path/filepath"
 
 	"github.com/Sirupsen/logrus"
+	cliconfig "github.com/docker/docker/cli/config"
+	"github.com/docker/docker/daemon/config"
 	"github.com/docker/docker/opts"
 	"github.com/docker/go-connections/tlsconfig"
 	"github.com/spf13/pflag"
@@ -27,64 +29,69 @@ var (
 	dockerTLSVerify = os.Getenv("DOCKER_TLS_VERIFY") != ""
 )
 
-// CommonOptions are options common to both the client and the daemon.
-type CommonOptions struct {
-	Debug      bool
-	Hosts      []string
-	LogLevel   string
-	TLS        bool
-	TLSVerify  bool
-	TLSOptions *tlsconfig.Options
+type daemonOptions struct {
+	version      bool
+	configFile   string
+	daemonConfig *config.Config
+	flags        *pflag.FlagSet
+	Debug        bool
+	Hosts        []string
+	LogLevel     string
+	TLS          bool
+	TLSVerify    bool
+	TLSOptions   *tlsconfig.Options
 }
 
-// NewCommonOptions returns a new CommonOptions
-func NewCommonOptions() *CommonOptions {
-	return &CommonOptions{}
+// newDaemonOptions returns a new daemonFlags
+func newDaemonOptions(config *config.Config) *daemonOptions {
+	return &daemonOptions{
+		daemonConfig: config,
+	}
 }
 
 // InstallFlags adds flags for the common options on the FlagSet
-func (commonOpts *CommonOptions) InstallFlags(flags *pflag.FlagSet) {
+func (o *daemonOptions) InstallFlags(flags *pflag.FlagSet) {
 	if dockerCertPath == "" {
-		dockerCertPath = ConfigurationDir()
+		dockerCertPath = cliconfig.Dir()
 	}
 
-	flags.BoolVarP(&commonOpts.Debug, "debug", "D", false, "Enable debug mode")
-	flags.StringVarP(&commonOpts.LogLevel, "log-level", "l", "info", `Set the logging level ("debug"|"info"|"warn"|"error"|"fatal")`)
-	flags.BoolVar(&commonOpts.TLS, "tls", false, "Use TLS; implied by --tlsverify")
-	flags.BoolVar(&commonOpts.TLSVerify, FlagTLSVerify, dockerTLSVerify, "Use TLS and verify the remote")
+	flags.BoolVarP(&o.Debug, "debug", "D", false, "Enable debug mode")
+	flags.StringVarP(&o.LogLevel, "log-level", "l", "info", `Set the logging level ("debug"|"info"|"warn"|"error"|"fatal")`)
+	flags.BoolVar(&o.TLS, "tls", false, "Use TLS; implied by --tlsverify")
+	flags.BoolVar(&o.TLSVerify, FlagTLSVerify, dockerTLSVerify, "Use TLS and verify the remote")
 
 	// TODO use flag flags.String("identity"}, "i", "", "Path to libtrust key file")
 
-	commonOpts.TLSOptions = &tlsconfig.Options{
+	o.TLSOptions = &tlsconfig.Options{
 		CAFile:   filepath.Join(dockerCertPath, DefaultCaFile),
 		CertFile: filepath.Join(dockerCertPath, DefaultCertFile),
 		KeyFile:  filepath.Join(dockerCertPath, DefaultKeyFile),
 	}
-	tlsOptions := commonOpts.TLSOptions
+	tlsOptions := o.TLSOptions
 	flags.Var(opts.NewQuotedString(&tlsOptions.CAFile), "tlscacert", "Trust certs signed only by this CA")
 	flags.Var(opts.NewQuotedString(&tlsOptions.CertFile), "tlscert", "Path to TLS certificate file")
 	flags.Var(opts.NewQuotedString(&tlsOptions.KeyFile), "tlskey", "Path to TLS key file")
 
-	hostOpt := opts.NewNamedListOptsRef("hosts", &commonOpts.Hosts, opts.ValidateHost)
+	hostOpt := opts.NewNamedListOptsRef("hosts", &o.Hosts, opts.ValidateHost)
 	flags.VarP(hostOpt, "host", "H", "Daemon socket(s) to connect to")
 }
 
 // SetDefaultOptions sets default values for options after flag parsing is
 // complete
-func (commonOpts *CommonOptions) SetDefaultOptions(flags *pflag.FlagSet) {
+func (o *daemonOptions) SetDefaultOptions(flags *pflag.FlagSet) {
 	// Regardless of whether the user sets it to true or false, if they
 	// specify --tlsverify at all then we need to turn on TLS
 	// TLSVerify can be true even if not set due to DOCKER_TLS_VERIFY env var, so we need
 	// to check that here as well
-	if flags.Changed(FlagTLSVerify) || commonOpts.TLSVerify {
-		commonOpts.TLS = true
+	if flags.Changed(FlagTLSVerify) || o.TLSVerify {
+		o.TLS = true
 	}
 
-	if !commonOpts.TLS {
-		commonOpts.TLSOptions = nil
+	if !o.TLS {
+		o.TLSOptions = nil
 	} else {
-		tlsOptions := commonOpts.TLSOptions
-		tlsOptions.InsecureSkipVerify = !commonOpts.TLSVerify
+		tlsOptions := o.TLSOptions
+		tlsOptions.InsecureSkipVerify = !o.TLSVerify
 
 		// Reset CertFile and KeyFile to empty string if the user did not specify
 		// the respective flags and the respective default files were not found.
@@ -101,8 +108,8 @@ func (commonOpts *CommonOptions) SetDefaultOptions(flags *pflag.FlagSet) {
 	}
 }
 
-// SetLogLevel sets the logrus logging level
-func SetLogLevel(logLevel string) {
+// setLogLevel sets the logrus logging level
+func setLogLevel(logLevel string) {
 	if logLevel != "" {
 		lvl, err := logrus.ParseLevel(logLevel)
 		if err != nil {
diff --git a/components/engine/cli/flags/common_test.go b/components/engine/cmd/dockerd/options_test.go
similarity index 80%
rename from components/engine/cli/flags/common_test.go
rename to components/engine/cmd/dockerd/options_test.go
index 52aa3d8b54..c3298a0ac6 100644
--- a/components/engine/cli/flags/common_test.go
+++ b/components/engine/cmd/dockerd/options_test.go
@@ -1,16 +1,18 @@
-package flags
+package main
 
 import (
 	"path/filepath"
 	"testing"
 
+	cliconfig "github.com/docker/docker/cli/config"
+	"github.com/docker/docker/daemon/config"
 	"github.com/spf13/pflag"
 	"github.com/stretchr/testify/assert"
 )
 
 func TestCommonOptionsInstallFlags(t *testing.T) {
 	flags := pflag.NewFlagSet("testing", pflag.ContinueOnError)
-	opts := NewCommonOptions()
+	opts := newDaemonOptions(&config.Config{})
 	opts.InstallFlags(flags)
 
 	err := flags.Parse([]string{
@@ -25,12 +27,12 @@ func TestCommonOptionsInstallFlags(t *testing.T) {
 }
 
 func defaultPath(filename string) string {
-	return filepath.Join(ConfigurationDir(), filename)
+	return filepath.Join(cliconfig.Dir(), filename)
 }
 
 func TestCommonOptionsInstallFlagsWithDefaults(t *testing.T) {
 	flags := pflag.NewFlagSet("testing", pflag.ContinueOnError)
-	opts := NewCommonOptions()
+	opts := newDaemonOptions(&config.Config{})
 	opts.InstallFlags(flags)
 
 	err := flags.Parse([]string{})
diff --git a/components/engine/container/container.go b/components/engine/container/container.go
index e89340610c..fe050bcd17 100644
--- a/components/engine/container/container.go
+++ b/components/engine/container/container.go
@@ -1,20 +1,20 @@
 package container
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strconv"
 	"strings"
 	"sync"
 	"syscall"
 	"time"
 
-	"golang.org/x/net/context"
-
 	"github.com/Sirupsen/logrus"
 	containertypes "github.com/docker/docker/api/types/container"
 	mounttypes "github.com/docker/docker/api/types/mount"
@@ -33,6 +33,7 @@ import (
 	"github.com/docker/docker/pkg/ioutils"
 	"github.com/docker/docker/pkg/signal"
 	"github.com/docker/docker/pkg/symlink"
+	"github.com/docker/docker/pkg/system"
 	"github.com/docker/docker/restartmanager"
 	"github.com/docker/docker/runconfig"
 	"github.com/docker/docker/volume"
@@ -43,7 +44,7 @@ import (
 	"github.com/docker/libnetwork/options"
 	"github.com/docker/libnetwork/types"
 	agentexec "github.com/docker/swarmkit/agent/exec"
-	"github.com/opencontainers/selinux/go-selinux/label"
+	"golang.org/x/net/context"
 )
 
 const configFileName = "config.v2.json"
@@ -58,9 +59,8 @@ var (
 	errInvalidNetwork  = fmt.Errorf("invalid network settings while building port map info")
 )
 
-// CommonContainer holds the fields for a container which are
-// applicable across all platforms supported by the daemon.
-type CommonContainer struct {
+// Container holds the structure defining a container object.
+type Container struct {
 	StreamConfig *stream.Config
 	// embed for Container to support states directly.
 	*State          `json:"State"` // Needed for Engine API version <= 1.11
@@ -78,6 +78,7 @@ type CommonContainer struct {
 	LogPath         string
 	Name            string
 	Driver          string
+	Platform        string
 	// MountLabel contains the options for the 'mount' command
 	MountLabel             string
 	ProcessLabel           string
@@ -95,21 +96,31 @@ type CommonContainer struct {
 	LogCopier      *logger.Copier `json:"-"`
 	restartManager restartmanager.RestartManager
 	attachContext  *attachContext
+
+	// Fields here are specific to Unix platforms
+	AppArmorProfile string
+	HostnamePath    string
+	HostsPath       string
+	ShmPath         string
+	ResolvConfPath  string
+	SeccompProfile  string
+	NoNewPrivileges bool
+
+	// Fields here are specific to Windows
+	NetworkSharedContainerID string
 }
 
 // NewBaseContainer creates a new container with its
 // basic configuration.
 func NewBaseContainer(id, root string) *Container {
 	return &Container{
-		CommonContainer: CommonContainer{
-			ID:            id,
-			State:         NewState(),
-			ExecCommands:  exec.NewStore(),
-			Root:          root,
-			MountPoints:   make(map[string]*volume.MountPoint),
-			StreamConfig:  stream.NewConfig(),
-			attachContext: &attachContext{},
-		},
+		ID:            id,
+		State:         NewState(),
+		ExecCommands:  exec.NewStore(),
+		Root:          root,
+		MountPoints:   make(map[string]*volume.MountPoint),
+		StreamConfig:  stream.NewConfig(),
+		attachContext: &attachContext{},
 	}
 }
 
@@ -133,41 +144,58 @@ func (container *Container) FromDisk() error {
 		return err
 	}
 
-	if err := label.ReserveLabel(container.ProcessLabel); err != nil {
-		return err
+	// Ensure the platform is set if blank. Assume it is the platform of the
+	// host OS if not, to ensure containers created before multiple-platform
+	// support are migrated
+	if container.Platform == "" {
+		container.Platform = runtime.GOOS
 	}
+
 	return container.readHostConfig()
 }
 
-// ToDisk saves the container configuration on disk.
-func (container *Container) ToDisk() error {
+// toDisk saves the container configuration on disk and returns a deep copy.
+func (container *Container) toDisk() (*Container, error) {
+	var (
+		buf      bytes.Buffer
+		deepCopy Container
+	)
 	pth, err := container.ConfigPath()
 	if err != nil {
-		return err
+		return nil, err
 	}
 
-	jsonSource, err := ioutils.NewAtomicFileWriter(pth, 0644)
+	// Save container settings
+	f, err := ioutils.NewAtomicFileWriter(pth, 0644)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+
+	w := io.MultiWriter(&buf, f)
+	if err := json.NewEncoder(w).Encode(container); err != nil {
+		return nil, err
+	}
+
+	if err := json.NewDecoder(&buf).Decode(&deepCopy); err != nil {
+		return nil, err
+	}
+	deepCopy.HostConfig, err = container.WriteHostConfig()
+	if err != nil {
+		return nil, err
+	}
+
+	return &deepCopy, nil
+}
+
+// CheckpointTo makes the Container's current state visible to queries, and persists state.
+// Callers must hold a Container lock.
+func (container *Container) CheckpointTo(store ViewDB) error {
+	deepCopy, err := container.toDisk()
 	if err != nil {
 		return err
 	}
-	defer jsonSource.Close()
-
-	enc := json.NewEncoder(jsonSource)
-
-	// Save container settings
-	if err := enc.Encode(container); err != nil {
-		return err
-	}
-
-	return container.WriteHostConfig()
-}
-
-// ToDiskLocking saves the container configuration on disk in a thread safe way.
-func (container *Container) ToDiskLocking() error {
-	container.Lock()
-	err := container.ToDisk()
-	container.Unlock()
-	return err
+	return store.Save(deepCopy)
 }
 
 // readHostConfig reads the host configuration from disk for the container.
@@ -199,24 +227,38 @@ func (container *Container) readHostConfig() error {
 	return nil
 }
 
-// WriteHostConfig saves the host configuration on disk for the container.
-func (container *Container) WriteHostConfig() error {
+// WriteHostConfig saves the host configuration on disk for the container,
+// and returns a deep copy of the saved object. Callers must hold a Container lock.
+func (container *Container) WriteHostConfig() (*containertypes.HostConfig, error) {
+	var (
+		buf      bytes.Buffer
+		deepCopy containertypes.HostConfig
+	)
+
 	pth, err := container.HostConfigPath()
 	if err != nil {
-		return err
+		return nil, err
 	}
 
 	f, err := ioutils.NewAtomicFileWriter(pth, 0644)
 	if err != nil {
-		return err
+		return nil, err
 	}
 	defer f.Close()
 
-	return json.NewEncoder(f).Encode(&container.HostConfig)
+	w := io.MultiWriter(&buf, f)
+	if err := json.NewEncoder(w).Encode(&container.HostConfig); err != nil {
+		return nil, err
+	}
+
+	if err := json.NewDecoder(&buf).Decode(&deepCopy); err != nil {
+		return nil, err
+	}
+	return &deepCopy, nil
 }
 
 // SetupWorkingDirectory sets up the container's working directory as set in container.Config.WorkingDir
-func (container *Container) SetupWorkingDirectory(rootUID, rootGID int) error {
+func (container *Container) SetupWorkingDirectory(rootIDs idtools.IDPair) error {
 	if container.Config.WorkingDir == "" {
 		return nil
 	}
@@ -228,7 +270,7 @@ func (container *Container) SetupWorkingDirectory(rootUID, rootGID int) error {
 		return err
 	}
 
-	if err := idtools.MkdirAllNewAs(pth, 0755, rootUID, rootGID); err != nil {
+	if err := idtools.MkdirAllAndChownNew(pth, 0755, rootIDs); err != nil {
 		pthInfo, err2 := os.Stat(pth)
 		if err2 == nil && pthInfo != nil && !pthInfo.IsDir() {
 			return fmt.Errorf("Cannot mkdir: %s is not a directory", container.Config.WorkingDir)
@@ -986,3 +1028,31 @@ func (container *Container) ConfigsDirPath() string {
 func (container *Container) ConfigFilePath(configRef swarmtypes.ConfigReference) string {
 	return filepath.Join(container.ConfigsDirPath(), configRef.ConfigID)
 }
+
+// CreateDaemonEnvironment creates a new environment variable slice for this container.
+func (container *Container) CreateDaemonEnvironment(tty bool, linkedEnv []string) []string {
+	// Setup environment
+	// TODO @jhowardmsft LCOW Support. This will need revisiting later.
+	platform := container.Platform
+	if platform == "" {
+		platform = runtime.GOOS
+	}
+	env := []string{}
+	if runtime.GOOS != "windows" || (runtime.GOOS == "windows" && system.LCOWSupported() && platform == "linux") {
+		env = []string{
+			"PATH=" + system.DefaultPathEnv(platform),
+			"HOSTNAME=" + container.Config.Hostname,
+		}
+		if tty {
+			env = append(env, "TERM=xterm")
+		}
+		env = append(env, linkedEnv...)
+	}
+
+	// because the env on the container can override certain default values
+	// we need to replace the 'env' keys where they match and append anything
+	// else.
+	//return ReplaceOrAppendEnvValues(linkedEnv, container.Config.Env)
+	foo := ReplaceOrAppendEnvValues(env, container.Config.Env)
+	return foo
+}
diff --git a/components/engine/container/container_unit_test.go b/components/engine/container/container_unit_test.go
index 01d06e4eb8..9ba2991beb 100644
--- a/components/engine/container/container_unit_test.go
+++ b/components/engine/container/container_unit_test.go
@@ -11,9 +11,7 @@ import (
 
 func TestContainerStopSignal(t *testing.T) {
 	c := &Container{
-		CommonContainer: CommonContainer{
-			Config: &container.Config{},
-		},
+		Config: &container.Config{},
 	}
 
 	def, err := signal.ParseSignal(signal.DefaultStopSignal)
@@ -27,9 +25,7 @@ func TestContainerStopSignal(t *testing.T) {
 	}
 
 	c = &Container{
-		CommonContainer: CommonContainer{
-			Config: &container.Config{StopSignal: "SIGKILL"},
-		},
+		Config: &container.Config{StopSignal: "SIGKILL"},
 	}
 	s = c.StopSignal()
 	if s != 9 {
@@ -39,9 +35,7 @@ func TestContainerStopSignal(t *testing.T) {
 
 func TestContainerStopTimeout(t *testing.T) {
 	c := &Container{
-		CommonContainer: CommonContainer{
-			Config: &container.Config{},
-		},
+		Config: &container.Config{},
 	}
 
 	s := c.StopTimeout()
@@ -51,9 +45,7 @@ func TestContainerStopTimeout(t *testing.T) {
 
 	stopTimeout := 15
 	c = &Container{
-		CommonContainer: CommonContainer{
-			Config: &container.Config{StopTimeout: &stopTimeout},
-		},
+		Config: &container.Config{StopTimeout: &stopTimeout},
 	}
 	s = c.StopSignal()
 	if s != 15 {
diff --git a/components/engine/container/container_unix.go b/components/engine/container/container_unix.go
index b46e100bb1..0cd9312be3 100644
--- a/components/engine/container/container_unix.go
+++ b/components/engine/container/container_unix.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"github.com/Sirupsen/logrus"
+	"github.com/docker/docker/api/types"
 	containertypes "github.com/docker/docker/api/types/container"
 	mounttypes "github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/pkg/chrootarchive"
@@ -26,21 +27,6 @@ const (
 	containerSecretMountPath = "/run/secrets"
 )
 
-// Container holds the fields specific to unixen implementations.
-// See CommonContainer for standard fields common to all containers.
-type Container struct {
-	CommonContainer
-
-	// Fields below here are platform specific.
-	AppArmorProfile string
-	HostnamePath    string
-	HostsPath       string
-	ShmPath         string
-	ResolvConfPath  string
-	SeccompProfile  string
-	NoNewPrivileges bool
-}
-
 // ExitStatus provides exit reasons for a container.
 type ExitStatus struct {
 	// The exit code with which the container exited.
@@ -50,27 +36,6 @@ type ExitStatus struct {
 	OOMKilled bool
 }
 
-// CreateDaemonEnvironment returns the list of all environment variables given the list of
-// environment variables related to links.
-// Sets PATH, HOSTNAME and if container.Config.Tty is set: TERM.
-// The defaults set here do not override the values in container.Config.Env
-func (container *Container) CreateDaemonEnvironment(tty bool, linkedEnv []string) []string {
-	// Setup environment
-	env := []string{
-		"PATH=" + system.DefaultPathEnv,
-		"HOSTNAME=" + container.Config.Hostname,
-	}
-	if tty {
-		env = append(env, "TERM=xterm")
-	}
-	env = append(env, linkedEnv...)
-	// because the env on the container can override certain default values
-	// we need to replace the 'env' keys where they match and append anything
-	// else.
-	env = ReplaceOrAppendEnvValues(env, container.Config.Env)
-	return env
-}
-
 // TrySetNetworkMount attempts to set the network mounts given a provided destination and
 // the path to use for it; return true if the given destination was a network mount file
 func (container *Container) TrySetNetworkMount(destination string, path string) bool {
@@ -297,11 +262,8 @@ func (container *Container) ConfigMounts() []Mount {
 	return mounts
 }
 
-// UpdateContainer updates configuration of a container.
+// UpdateContainer updates configuration of a container. Callers must hold a Lock on the Container.
 func (container *Container) UpdateContainer(hostConfig *containertypes.HostConfig) error {
-	container.Lock()
-	defer container.Unlock()
-
 	// update resources of container
 	resources := hostConfig.Resources
 	cResources := &container.HostConfig.Resources
@@ -370,11 +332,6 @@ func (container *Container) UpdateContainer(hostConfig *containertypes.HostConfi
 		container.HostConfig.RestartPolicy = hostConfig.RestartPolicy
 	}
 
-	if err := container.ToDisk(); err != nil {
-		logrus.Errorf("Error saving updated container: %v", err)
-		return err
-	}
-
 	return nil
 }
 
@@ -425,7 +382,7 @@ func copyExistingContents(source, destination string) error {
 		}
 		if len(srcList) == 0 {
 			// If the source volume is empty, copies files from the root into the volume
-			if err := chrootarchive.CopyWithTar(source, destination); err != nil {
+			if err := chrootarchive.NewArchiver(nil).CopyWithTar(source, destination); err != nil {
 				return err
 			}
 		}
@@ -441,11 +398,26 @@ func copyOwnership(source, destination string) error {
 		return err
 	}
 
-	if err := os.Chown(destination, int(stat.UID()), int(stat.GID())); err != nil {
+	destStat, err := system.Stat(destination)
+	if err != nil {
 		return err
 	}
 
-	return os.Chmod(destination, os.FileMode(stat.Mode()))
+	// In some cases, even though UID/GID match and it would effectively be a no-op,
+	// this can return a permission denied error... for example if this is an NFS
+	// mount.
+	// Since it's not really an error that we can't chown to the same UID/GID, don't
+	// even bother trying in such cases.
+	if stat.UID() != destStat.UID() || stat.GID() != destStat.GID() {
+		if err := os.Chown(destination, int(stat.UID()), int(stat.GID())); err != nil {
+			return err
+		}
+	}
+
+	if stat.Mode() != destStat.Mode() {
+		return os.Chmod(destination, os.FileMode(stat.Mode()))
+	}
+	return nil
 }
 
 // TmpfsMounts returns the list of tmpfs mounts
@@ -483,3 +455,21 @@ func cleanResourcePath(path string) string {
 func (container *Container) EnableServiceDiscoveryOnDefaultNetwork() bool {
 	return false
 }
+
+// GetMountPoints gives a platform specific transformation to types.MountPoint. Callers must hold a Container lock.
+func (container *Container) GetMountPoints() []types.MountPoint {
+	mountPoints := make([]types.MountPoint, 0, len(container.MountPoints))
+	for _, m := range container.MountPoints {
+		mountPoints = append(mountPoints, types.MountPoint{
+			Type:        m.Type,
+			Name:        m.Name,
+			Source:      m.Path(),
+			Destination: m.Destination,
+			Driver:      m.Driver,
+			Mode:        m.Mode,
+			RW:          m.RW,
+			Propagation: m.Propagation,
+		})
+	}
+	return mountPoints
+}
diff --git a/components/engine/container/container_windows.go b/components/engine/container/container_windows.go
index bffd9520e2..0f2a45df99 100644
--- a/components/engine/container/container_windows.go
+++ b/components/engine/container/container_windows.go
@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 
+	"github.com/docker/docker/api/types"
 	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/pkg/system"
 )
@@ -17,29 +18,12 @@ const (
 	containerInternalConfigsDirPath  = `C:\ProgramData\Docker\internal\configs`
 )
 
-// Container holds fields specific to the Windows implementation. See
-// CommonContainer for standard fields common to all containers.
-type Container struct {
-	CommonContainer
-
-	// Fields below here are platform specific.
-	NetworkSharedContainerID string
-}
-
 // ExitStatus provides exit reasons for a container.
 type ExitStatus struct {
 	// The exit code with which the container exited.
 	ExitCode int
 }
 
-// CreateDaemonEnvironment creates a new environment variable slice for this container.
-func (container *Container) CreateDaemonEnvironment(_ bool, linkedEnv []string) []string {
-	// because the env on the container can override certain default values
-	// we need to replace the 'env' keys where they match and append anything
-	// else.
-	return ReplaceOrAppendEnvValues(linkedEnv, container.Config.Env)
-}
-
 // UnmountIpcMounts unmounts Ipc related mounts.
 // This is a NOOP on windows.
 func (container *Container) UnmountIpcMounts(unmount func(pth string) error) {
@@ -60,7 +44,7 @@ func (container *Container) CreateSecretSymlinks() error {
 		if err != nil {
 			return err
 		}
-		if err := system.MkdirAll(filepath.Dir(resolvedPath), 0); err != nil {
+		if err := system.MkdirAll(filepath.Dir(resolvedPath), 0, ""); err != nil {
 			return err
 		}
 		if err := os.Symlink(filepath.Join(containerInternalSecretMountPath, r.SecretID), resolvedPath); err != nil {
@@ -102,7 +86,7 @@ func (container *Container) CreateConfigSymlinks() error {
 		if err != nil {
 			return err
 		}
-		if err := system.MkdirAll(filepath.Dir(resolvedPath), 0); err != nil {
+		if err := system.MkdirAll(filepath.Dir(resolvedPath), 0, ""); err != nil {
 			return err
 		}
 		if err := os.Symlink(filepath.Join(containerInternalConfigsDirPath, configRef.ConfigID), resolvedPath); err != nil {
@@ -142,11 +126,8 @@ func (container *Container) TmpfsMounts() ([]Mount, error) {
 	return mounts, nil
 }
 
-// UpdateContainer updates configuration of a container
+// UpdateContainer updates configuration of a container. Callers must hold a Lock on the Container.
 func (container *Container) UpdateContainer(hostConfig *containertypes.HostConfig) error {
-	container.Lock()
-	defer container.Unlock()
-
 	resources := hostConfig.Resources
 	if resources.CPUShares != 0 ||
 		resources.Memory != 0 ||
@@ -211,3 +192,19 @@ func (container *Container) BuildHostnameFile() error {
 func (container *Container) EnableServiceDiscoveryOnDefaultNetwork() bool {
 	return true
 }
+
+// GetMountPoints gives a platform specific transformation to types.MountPoint. Callers must hold a Container lock.
+func (container *Container) GetMountPoints() []types.MountPoint {
+	mountPoints := make([]types.MountPoint, 0, len(container.MountPoints))
+	for _, m := range container.MountPoints {
+		mountPoints = append(mountPoints, types.MountPoint{
+			Type:        m.Type,
+			Name:        m.Name,
+			Source:      m.Path(),
+			Destination: m.Destination,
+			Driver:      m.Driver,
+			RW:          m.RW,
+		})
+	}
+	return mountPoints
+}
diff --git a/components/engine/container/health.go b/components/engine/container/health.go
index 6e3cd12f3b..31c5600d25 100644
--- a/components/engine/container/health.go
+++ b/components/engine/container/health.go
@@ -13,9 +13,8 @@ type Health struct {
 
 // String returns a human-readable description of the health-check state
 func (s *Health) String() string {
-	// This happens when the container is being shutdown and the monitor has stopped
-	// or the monitor has yet to be setup.
-	if s.stop == nil {
+	// This happens when the monitor has yet to be setup.
+	if s.Status == "" {
 		return types.Unhealthy
 	}
 
@@ -44,6 +43,8 @@ func (s *Health) CloseMonitorChannel() {
 		logrus.Debug("CloseMonitorChannel: waiting for probe to stop")
 		close(s.stop)
 		s.stop = nil
+		// unhealthy when the monitor has stopped for compatibility reasons
+		s.Status = types.Unhealthy
 		logrus.Debug("CloseMonitorChannel done")
 	}
 }
diff --git a/components/engine/container/stream/attach.go b/components/engine/container/stream/attach.go
index 5f63f88f39..3dd53d3354 100644
--- a/components/engine/container/stream/attach.go
+++ b/components/engine/container/stream/attach.go
@@ -7,6 +7,7 @@ import (
 	"golang.org/x/net/context"
 
 	"github.com/Sirupsen/logrus"
+	"github.com/docker/docker/pkg/pools"
 	"github.com/docker/docker/pkg/promise"
 	"github.com/docker/docker/pkg/term"
 )
@@ -86,7 +87,7 @@ func (c *Config) CopyStreams(ctx context.Context, cfg *AttachConfig) chan error
 		if cfg.TTY {
 			_, err = copyEscapable(cfg.CStdin, cfg.Stdin, cfg.DetachKeys)
 		} else {
-			_, err = io.Copy(cfg.CStdin, cfg.Stdin)
+			_, err = pools.Copy(cfg.CStdin, cfg.Stdin)
 		}
 		if err == io.ErrClosedPipe {
 			err = nil
@@ -116,7 +117,7 @@ func (c *Config) CopyStreams(ctx context.Context, cfg *AttachConfig) chan error
 		}
 
 		logrus.Debugf("attach: %s: begin", name)
-		_, err := io.Copy(stream, streamPipe)
+		_, err := pools.Copy(stream, streamPipe)
 		if err == io.ErrClosedPipe {
 			err = nil
 		}
@@ -174,5 +175,5 @@ func copyEscapable(dst io.Writer, src io.ReadCloser, keys []byte) (written int64
 	pr := term.NewEscapeProxy(src, keys)
 	defer src.Close()
 
-	return io.Copy(dst, pr)
+	return pools.Copy(dst, pr)
 }
diff --git a/components/engine/container/view.go b/components/engine/container/view.go
new file mode 100644
index 0000000000..13c7161852
--- /dev/null
+++ b/components/engine/container/view.go
@@ -0,0 +1,288 @@
+package container
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/Sirupsen/logrus"
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/pkg/registrar"
+	"github.com/docker/go-connections/nat"
+	"github.com/hashicorp/go-memdb"
+)
+
+const (
+	memdbTable   = "containers"
+	memdbIDIndex = "id"
+)
+
+// Snapshot is a read only view for Containers. It holds all information necessary to serve container queries in a
+// versioned ACID in-memory store.
+type Snapshot struct {
+	types.Container
+
+	// additional info queries need to filter on
+	// preserve nanosec resolution for queries
+	CreatedAt    time.Time
+	StartedAt    time.Time
+	Name         string
+	Pid          int
+	ExitCode     int
+	Running      bool
+	Paused       bool
+	Managed      bool
+	ExposedPorts nat.PortSet
+	PortBindings nat.PortSet
+	Health       string
+	HostConfig   struct {
+		Isolation string
+	}
+}
+
+// ViewDB provides an in-memory transactional (ACID) container Store
+type ViewDB interface {
+	Snapshot(nameIndex *registrar.Registrar) View
+	Save(*Container) error
+	Delete(*Container) error
+}
+
+// View can be used by readers to avoid locking
+type View interface {
+	All() ([]Snapshot, error)
+	Get(id string) (*Snapshot, error)
+}
+
+var schema = &memdb.DBSchema{
+	Tables: map[string]*memdb.TableSchema{
+		memdbTable: {
+			Name: memdbTable,
+			Indexes: map[string]*memdb.IndexSchema{
+				memdbIDIndex: {
+					Name:    memdbIDIndex,
+					Unique:  true,
+					Indexer: &containerByIDIndexer{},
+				},
+			},
+		},
+	},
+}
+
+type memDB struct {
+	store *memdb.MemDB
+}
+
+// NewViewDB provides the default implementation, with the default schema
+func NewViewDB() (ViewDB, error) {
+	store, err := memdb.NewMemDB(schema)
+	if err != nil {
+		return nil, err
+	}
+	return &memDB{store: store}, nil
+}
+
+// Snapshot provides a consistent read-only View of the database
+func (db *memDB) Snapshot(index *registrar.Registrar) View {
+	return &memdbView{
+		txn:       db.store.Txn(false),
+		nameIndex: index.GetAll(),
+	}
+}
+
+// Save atomically updates the in-memory store state for a Container.
+// Only read only (deep) copies of containers may be passed in.
+func (db *memDB) Save(c *Container) error {
+	txn := db.store.Txn(true)
+	defer txn.Commit()
+	return txn.Insert(memdbTable, c)
+}
+
+// Delete removes an item by ID
+func (db *memDB) Delete(c *Container) error {
+	txn := db.store.Txn(true)
+	defer txn.Commit()
+	return txn.Delete(memdbTable, NewBaseContainer(c.ID, c.Root))
+}
+
+type memdbView struct {
+	txn       *memdb.Txn
+	nameIndex map[string][]string
+}
+
+// All returns a all items in this snapshot. Returned objects must never be modified.
+func (v *memdbView) All() ([]Snapshot, error) {
+	var all []Snapshot
+	iter, err := v.txn.Get(memdbTable, memdbIDIndex)
+	if err != nil {
+		return nil, err
+	}
+	for {
+		item := iter.Next()
+		if item == nil {
+			break
+		}
+		snapshot := v.transform(item.(*Container))
+		all = append(all, *snapshot)
+	}
+	return all, nil
+}
+
+// Get returns an item by id. Returned objects must never be modified.
+func (v *memdbView) Get(id string) (*Snapshot, error) {
+	s, err := v.txn.First(memdbTable, memdbIDIndex, id)
+	if err != nil {
+		return nil, err
+	}
+	return v.transform(s.(*Container)), nil
+}
+
+// transform maps a (deep) copied Container object to what queries need.
+// A lock on the Container is not held because these are immutable deep copies.
+func (v *memdbView) transform(container *Container) *Snapshot {
+	snapshot := &Snapshot{
+		Container: types.Container{
+			ID:      container.ID,
+			Names:   v.nameIndex[container.ID],
+			ImageID: container.ImageID.String(),
+			Ports:   []types.Port{},
+			Mounts:  container.GetMountPoints(),
+			State:   container.State.StateString(),
+			Status:  container.State.String(),
+			Created: container.Created.Unix(),
+		},
+		CreatedAt:    container.Created,
+		StartedAt:    container.StartedAt,
+		Name:         container.Name,
+		Pid:          container.Pid,
+		Managed:      container.Managed,
+		ExposedPorts: make(nat.PortSet),
+		PortBindings: make(nat.PortSet),
+		Health:       container.HealthString(),
+		Running:      container.Running,
+		Paused:       container.Paused,
+		ExitCode:     container.ExitCode(),
+	}
+
+	if snapshot.Names == nil {
+		// Dead containers will often have no name, so make sure the response isn't null
+		snapshot.Names = []string{}
+	}
+
+	if container.HostConfig != nil {
+		snapshot.Container.HostConfig.NetworkMode = string(container.HostConfig.NetworkMode)
+		snapshot.HostConfig.Isolation = string(container.HostConfig.Isolation)
+		for binding := range container.HostConfig.PortBindings {
+			snapshot.PortBindings[binding] = struct{}{}
+		}
+	}
+
+	if container.Config != nil {
+		snapshot.Image = container.Config.Image
+		snapshot.Labels = container.Config.Labels
+		for exposed := range container.Config.ExposedPorts {
+			snapshot.ExposedPorts[exposed] = struct{}{}
+		}
+	}
+
+	if len(container.Args) > 0 {
+		args := []string{}
+		for _, arg := range container.Args {
+			if strings.Contains(arg, " ") {
+				args = append(args, fmt.Sprintf("'%s'", arg))
+			} else {
+				args = append(args, arg)
+			}
+		}
+		argsAsString := strings.Join(args, " ")
+		snapshot.Command = fmt.Sprintf("%s %s", container.Path, argsAsString)
+	} else {
+		snapshot.Command = container.Path
+	}
+
+	snapshot.Ports = []types.Port{}
+	networks := make(map[string]*network.EndpointSettings)
+	if container.NetworkSettings != nil {
+		for name, netw := range container.NetworkSettings.Networks {
+			if netw == nil || netw.EndpointSettings == nil {
+				continue
+			}
+			networks[name] = &network.EndpointSettings{
+				EndpointID:          netw.EndpointID,
+				Gateway:             netw.Gateway,
+				IPAddress:           netw.IPAddress,
+				IPPrefixLen:         netw.IPPrefixLen,
+				IPv6Gateway:         netw.IPv6Gateway,
+				GlobalIPv6Address:   netw.GlobalIPv6Address,
+				GlobalIPv6PrefixLen: netw.GlobalIPv6PrefixLen,
+				MacAddress:          netw.MacAddress,
+				NetworkID:           netw.NetworkID,
+			}
+			if netw.IPAMConfig != nil {
+				networks[name].IPAMConfig = &network.EndpointIPAMConfig{
+					IPv4Address: netw.IPAMConfig.IPv4Address,
+					IPv6Address: netw.IPAMConfig.IPv6Address,
+				}
+			}
+		}
+		for port, bindings := range container.NetworkSettings.Ports {
+			p, err := nat.ParsePort(port.Port())
+			if err != nil {
+				logrus.Warnf("invalid port map %+v", err)
+				continue
+			}
+			if len(bindings) == 0 {
+				snapshot.Ports = append(snapshot.Ports, types.Port{
+					PrivatePort: uint16(p),
+					Type:        port.Proto(),
+				})
+				continue
+			}
+			for _, binding := range bindings {
+				h, err := nat.ParsePort(binding.HostPort)
+				if err != nil {
+					logrus.Warnf("invalid host port map %+v", err)
+					continue
+				}
+				snapshot.Ports = append(snapshot.Ports, types.Port{
+					PrivatePort: uint16(p),
+					PublicPort:  uint16(h),
+					Type:        port.Proto(),
+					IP:          binding.HostIP,
+				})
+			}
+		}
+	}
+	snapshot.NetworkSettings = &types.SummaryNetworkSettings{Networks: networks}
+
+	return snapshot
+}
+
+// containerByIDIndexer is used to extract the ID field from Container types.
+// memdb.StringFieldIndex can not be used since ID is a field from an embedded struct.
+type containerByIDIndexer struct{}
+
+// FromObject implements the memdb.SingleIndexer interface for Container objects
+func (e *containerByIDIndexer) FromObject(obj interface{}) (bool, []byte, error) {
+	c, ok := obj.(*Container)
+	if !ok {
+		return false, nil, fmt.Errorf("%T is not a Container", obj)
+	}
+	// Add the null character as a terminator
+	v := c.ID + "\x00"
+	return true, []byte(v), nil
+}
+
+// FromArgs implements the memdb.Indexer interface
+func (e *containerByIDIndexer) FromArgs(args ...interface{}) ([]byte, error) {
+	if len(args) != 1 {
+		return nil, fmt.Errorf("must provide only a single argument")
+	}
+	arg, ok := args[0].(string)
+	if !ok {
+		return nil, fmt.Errorf("argument must be a string: %#v", args[0])
+	}
+	// Add the null character as a terminator
+	arg += "\x00"
+	return []byte(arg), nil
+}
diff --git a/components/engine/container/view_test.go b/components/engine/container/view_test.go
new file mode 100644
index 0000000000..9b872998bd
--- /dev/null
+++ b/components/engine/container/view_test.go
@@ -0,0 +1,106 @@
+package container
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"testing"
+
+	containertypes "github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/pkg/registrar"
+	"github.com/pborman/uuid"
+)
+
+var root string
+
+func TestMain(m *testing.M) {
+	var err error
+	root, err = ioutil.TempDir("", "docker-container-test-")
+	if err != nil {
+		panic(err)
+	}
+	defer os.RemoveAll(root)
+
+	os.Exit(m.Run())
+}
+
+func newContainer(t *testing.T) *Container {
+	var (
+		id    = uuid.New()
+		cRoot = filepath.Join(root, id)
+	)
+	if err := os.MkdirAll(cRoot, 0755); err != nil {
+		t.Fatal(err)
+	}
+	c := NewBaseContainer(id, cRoot)
+	c.HostConfig = &containertypes.HostConfig{}
+	return c
+}
+
+func TestViewSaveDelete(t *testing.T) {
+	db, err := NewViewDB()
+	if err != nil {
+		t.Fatal(err)
+	}
+	c := newContainer(t)
+	if err := c.CheckpointTo(db); err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Delete(c); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestViewAll(t *testing.T) {
+	var (
+		db, _ = NewViewDB()
+		names = registrar.NewRegistrar()
+		one   = newContainer(t)
+		two   = newContainer(t)
+	)
+	one.Pid = 10
+	if err := one.CheckpointTo(db); err != nil {
+		t.Fatal(err)
+	}
+	two.Pid = 20
+	if err := two.CheckpointTo(db); err != nil {
+		t.Fatal(err)
+	}
+
+	all, err := db.Snapshot(names).All()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if l := len(all); l != 2 {
+		t.Fatalf("expected 2 items, got %d", l)
+	}
+	byID := make(map[string]Snapshot)
+	for i := range all {
+		byID[all[i].ID] = all[i]
+	}
+	if s, ok := byID[one.ID]; !ok || s.Pid != 10 {
+		t.Fatalf("expected something different with for id=%s: %v", one.ID, s)
+	}
+	if s, ok := byID[two.ID]; !ok || s.Pid != 20 {
+		t.Fatalf("expected something different with for id=%s: %v", two.ID, s)
+	}
+}
+
+func TestViewGet(t *testing.T) {
+	var (
+		db, _ = NewViewDB()
+		names = registrar.NewRegistrar()
+		one   = newContainer(t)
+	)
+	one.ImageID = "some-image-123"
+	if err := one.CheckpointTo(db); err != nil {
+		t.Fatal(err)
+	}
+	s, err := db.Snapshot(names).Get(one.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s == nil || s.ImageID != "some-image-123" {
+		t.Fatalf("expected ImageID=some-image-123. Got: %v", s)
+	}
+}
diff --git a/components/engine/contrib/builder/deb/aarch64/debian-jessie/Dockerfile b/components/engine/contrib/builder/deb/aarch64/debian-jessie/Dockerfile
index e7f9b9e743..0e80da4aad 100644
--- a/components/engine/contrib/builder/deb/aarch64/debian-jessie/Dockerfile
+++ b/components/engine/contrib/builder/deb/aarch64/debian-jessie/Dockerfile
@@ -5,7 +5,7 @@
 FROM aarch64/debian:jessie
 
 RUN echo deb http://ftp.debian.org/debian jessie-backports main > /etc/apt/sources.list.d/backports.list
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev pkg-config vim-common libsystemd-journal-dev golang-1.6-go libseccomp-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev pkg-config vim-common libsystemd-journal-dev golang-1.6-go libseccomp-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 RUN update-alternatives --install /usr/bin/go go /usr/lib/go-1.6/bin/go 100
 
@@ -21,5 +21,5 @@ ENV PATH /usr/src/go/bin:$PATH
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 selinux seccomp
+ENV DOCKER_BUILDTAGS apparmor selinux seccomp
 ENV RUNC_BUILDTAGS apparmor selinux seccomp
diff --git a/components/engine/contrib/builder/deb/aarch64/debian-stretch/Dockerfile b/components/engine/contrib/builder/deb/aarch64/debian-stretch/Dockerfile
index f6ac277be6..caee1917b9 100644
--- a/components/engine/contrib/builder/deb/aarch64/debian-stretch/Dockerfile
+++ b/components/engine/contrib/builder/deb/aarch64/debian-stretch/Dockerfile
@@ -4,7 +4,7 @@
 
 FROM aarch64/debian:stretch
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev pkg-config vim-common libsystemd-dev golang-go libseccomp-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev pkg-config vim-common libsystemd-dev golang-go libseccomp-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 # Install Go
 # aarch64 doesn't have official go binaries, so use the version of go installed from
@@ -18,5 +18,5 @@ ENV PATH /usr/src/go/bin:$PATH
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 selinux seccomp
+ENV DOCKER_BUILDTAGS apparmor selinux seccomp
 ENV RUNC_BUILDTAGS apparmor selinux seccomp
diff --git a/components/engine/contrib/builder/deb/aarch64/generate.sh b/components/engine/contrib/builder/deb/aarch64/generate.sh
index 647bf8fc28..7c9217d042 100755
--- a/components/engine/contrib/builder/deb/aarch64/generate.sh
+++ b/components/engine/contrib/builder/deb/aarch64/generate.sh
@@ -38,7 +38,7 @@ for version in "${versions[@]}"; do
 
 	EOF
 
-	dockerBuildTags='apparmor pkcs11 selinux'
+	dockerBuildTags='apparmor selinux'
 	runcBuildTags='apparmor selinux'
 
 	# this list is sorted alphabetically; please keep it that way
@@ -55,7 +55,6 @@ for version in "${versions[@]}"; do
 		git # for "git commit" info in "docker -v"
 		libapparmor-dev # for "sys/apparmor.h"
 		libdevmapper-dev # for "libdevmapper.h"
-		libltdl-dev # for pkcs11 "ltdl.h"
 		pkg-config # for detecting things like libsystemd-journal dynamically
 		vim-common # tini dep
 	)
diff --git a/components/engine/contrib/builder/deb/aarch64/ubuntu-trusty/Dockerfile b/components/engine/contrib/builder/deb/aarch64/ubuntu-trusty/Dockerfile
index 7b8c185b84..6f4a3e9618 100644
--- a/components/engine/contrib/builder/deb/aarch64/ubuntu-trusty/Dockerfile
+++ b/components/engine/contrib/builder/deb/aarch64/ubuntu-trusty/Dockerfile
@@ -4,7 +4,7 @@
 
 FROM aarch64/ubuntu:trusty
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev pkg-config vim-common libsystemd-journal-dev golang-1.6-go --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev pkg-config vim-common libsystemd-journal-dev golang-1.6-go --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 RUN update-alternatives --install /usr/bin/go go /usr/lib/go-1.6/bin/go 100
 
@@ -20,5 +20,5 @@ ENV PATH /usr/src/go/bin:$PATH
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 selinux
+ENV DOCKER_BUILDTAGS apparmor selinux
 ENV RUNC_BUILDTAGS apparmor selinux
diff --git a/components/engine/contrib/builder/deb/aarch64/ubuntu-xenial/Dockerfile b/components/engine/contrib/builder/deb/aarch64/ubuntu-xenial/Dockerfile
index b35ade60f2..19a510b245 100644
--- a/components/engine/contrib/builder/deb/aarch64/ubuntu-xenial/Dockerfile
+++ b/components/engine/contrib/builder/deb/aarch64/ubuntu-xenial/Dockerfile
@@ -4,7 +4,7 @@
 
 FROM aarch64/ubuntu:xenial
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev pkg-config vim-common libsystemd-dev golang-go libseccomp-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev pkg-config vim-common libsystemd-dev golang-go libseccomp-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 # Install Go
 # aarch64 doesn't have official go binaries, so use the version of go installed from
@@ -18,5 +18,5 @@ ENV PATH /usr/src/go/bin:$PATH
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 selinux seccomp
+ENV DOCKER_BUILDTAGS apparmor selinux seccomp
 ENV RUNC_BUILDTAGS apparmor selinux seccomp
diff --git a/components/engine/contrib/builder/deb/amd64/debian-jessie/Dockerfile b/components/engine/contrib/builder/deb/amd64/debian-jessie/Dockerfile
index 0b41c624ad..9b6233c929 100644
--- a/components/engine/contrib/builder/deb/amd64/debian-jessie/Dockerfile
+++ b/components/engine/contrib/builder/deb/amd64/debian-jessie/Dockerfile
@@ -8,7 +8,7 @@ FROM debian:jessie
 ARG APT_MIRROR=deb.debian.org
 RUN sed -ri "s/(httpredir|deb).debian.org/$APT_MIRROR/g" /etc/apt/sources.list
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev  pkg-config vim-common libsystemd-journal-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev  pkg-config vim-common libsystemd-journal-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 RUN curl -fSL "https://golang.org/dl/go${GO_VERSION}.linux-amd64.tar.gz" | tar xzC /usr/local
@@ -16,5 +16,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 selinux
+ENV DOCKER_BUILDTAGS apparmor selinux
 ENV RUNC_BUILDTAGS apparmor selinux
diff --git a/components/engine/contrib/builder/deb/amd64/debian-stretch/Dockerfile b/components/engine/contrib/builder/deb/amd64/debian-stretch/Dockerfile
index 98ce8710cb..d95c194c34 100644
--- a/components/engine/contrib/builder/deb/amd64/debian-stretch/Dockerfile
+++ b/components/engine/contrib/builder/deb/amd64/debian-stretch/Dockerfile
@@ -8,7 +8,7 @@ FROM debian:stretch
 ARG APT_MIRROR=deb.debian.org
 RUN sed -ri "s/(httpredir|deb).debian.org/$APT_MIRROR/g" /etc/apt/sources.list
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev libseccomp-dev pkg-config vim-common libsystemd-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libseccomp-dev pkg-config vim-common libsystemd-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 RUN curl -fSL "https://golang.org/dl/go${GO_VERSION}.linux-amd64.tar.gz" | tar xzC /usr/local
@@ -16,5 +16,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS apparmor seccomp selinux
 ENV RUNC_BUILDTAGS apparmor seccomp selinux
diff --git a/components/engine/contrib/builder/deb/amd64/debian-wheezy/Dockerfile b/components/engine/contrib/builder/deb/amd64/debian-wheezy/Dockerfile
index 2d86fbb296..56763a5721 100644
--- a/components/engine/contrib/builder/deb/amd64/debian-wheezy/Dockerfile
+++ b/components/engine/contrib/builder/deb/amd64/debian-wheezy/Dockerfile
@@ -10,7 +10,7 @@ RUN sed -ri "s/(httpredir|deb).debian.org/$APT_MIRROR/g" /etc/apt/sources.list
 RUN sed -ri "s/(httpredir|deb).debian.org/$APT_MIRROR/g" /etc/apt/sources.list.d/backports.list
 
 RUN apt-get update && apt-get install -y -t wheezy-backports btrfs-tools --no-install-recommends && rm -rf /var/lib/apt/lists/*
-RUN apt-get update && apt-get install -y apparmor bash-completion  build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev  pkg-config vim-common --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion  build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev  pkg-config vim-common --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 RUN curl -fSL "https://golang.org/dl/go${GO_VERSION}.linux-amd64.tar.gz" | tar xzC /usr/local
@@ -18,5 +18,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 selinux
+ENV DOCKER_BUILDTAGS apparmor selinux
 ENV RUNC_BUILDTAGS apparmor selinux
diff --git a/components/engine/contrib/builder/deb/amd64/generate.sh b/components/engine/contrib/builder/deb/amd64/generate.sh
index 38972baadd..5708defc1a 100755
--- a/components/engine/contrib/builder/deb/amd64/generate.sh
+++ b/components/engine/contrib/builder/deb/amd64/generate.sh
@@ -57,7 +57,7 @@ for version in "${versions[@]}"; do
 		echo "" >> "$version/Dockerfile"
 	fi
 
-	extraBuildTags='pkcs11'
+	extraBuildTags=
 	runcBuildTags=
 
 	# this list is sorted alphabetically; please keep it that way
@@ -74,7 +74,6 @@ for version in "${versions[@]}"; do
 		git # for "git commit" info in "docker -v"
 		libapparmor-dev # for "sys/apparmor.h"
 		libdevmapper-dev # for "libdevmapper.h"
-		libltdl-dev # for pkcs11 "ltdl.h"
 		libseccomp-dev  # for "seccomp.h" & "libseccomp.so"
 		pkg-config # for detecting things like libsystemd-journal dynamically
 		vim-common # tini dep
diff --git a/components/engine/contrib/builder/deb/amd64/ubuntu-trusty/Dockerfile b/components/engine/contrib/builder/deb/amd64/ubuntu-trusty/Dockerfile
index 3c208c7e64..f6201164f7 100644
--- a/components/engine/contrib/builder/deb/amd64/ubuntu-trusty/Dockerfile
+++ b/components/engine/contrib/builder/deb/amd64/ubuntu-trusty/Dockerfile
@@ -4,7 +4,7 @@
 
 FROM ubuntu:trusty
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev  pkg-config vim-common libsystemd-journal-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev  pkg-config vim-common libsystemd-journal-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 RUN curl -fSL "https://golang.org/dl/go${GO_VERSION}.linux-amd64.tar.gz" | tar xzC /usr/local
@@ -12,5 +12,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 selinux
+ENV DOCKER_BUILDTAGS apparmor selinux
 ENV RUNC_BUILDTAGS apparmor selinux
diff --git a/components/engine/contrib/builder/deb/amd64/ubuntu-xenial/Dockerfile b/components/engine/contrib/builder/deb/amd64/ubuntu-xenial/Dockerfile
index 442c9de9d6..6b9370dce2 100644
--- a/components/engine/contrib/builder/deb/amd64/ubuntu-xenial/Dockerfile
+++ b/components/engine/contrib/builder/deb/amd64/ubuntu-xenial/Dockerfile
@@ -4,7 +4,7 @@
 
 FROM ubuntu:xenial
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev libseccomp-dev pkg-config vim-common libsystemd-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libseccomp-dev pkg-config vim-common libsystemd-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 RUN curl -fSL "https://golang.org/dl/go${GO_VERSION}.linux-amd64.tar.gz" | tar xzC /usr/local
@@ -12,5 +12,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS apparmor seccomp selinux
 ENV RUNC_BUILDTAGS apparmor seccomp selinux
diff --git a/components/engine/contrib/builder/deb/amd64/ubuntu-yakkety/Dockerfile b/components/engine/contrib/builder/deb/amd64/ubuntu-yakkety/Dockerfile
index 14222fa028..232c86f213 100644
--- a/components/engine/contrib/builder/deb/amd64/ubuntu-yakkety/Dockerfile
+++ b/components/engine/contrib/builder/deb/amd64/ubuntu-yakkety/Dockerfile
@@ -4,7 +4,7 @@
 
 FROM ubuntu:yakkety
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev libseccomp-dev pkg-config vim-common libsystemd-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libseccomp-dev pkg-config vim-common libsystemd-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 RUN curl -fSL "https://golang.org/dl/go${GO_VERSION}.linux-amd64.tar.gz" | tar xzC /usr/local
@@ -12,5 +12,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS apparmor seccomp selinux
 ENV RUNC_BUILDTAGS apparmor seccomp selinux
diff --git a/components/engine/contrib/builder/deb/amd64/ubuntu-zesty/Dockerfile b/components/engine/contrib/builder/deb/amd64/ubuntu-zesty/Dockerfile
index 74dbb08469..0b4e45b342 100644
--- a/components/engine/contrib/builder/deb/amd64/ubuntu-zesty/Dockerfile
+++ b/components/engine/contrib/builder/deb/amd64/ubuntu-zesty/Dockerfile
@@ -4,7 +4,7 @@
 
 FROM ubuntu:zesty
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev libseccomp-dev pkg-config vim-common libsystemd-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libseccomp-dev pkg-config vim-common libsystemd-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 RUN curl -fSL "https://golang.org/dl/go${GO_VERSION}.linux-amd64.tar.gz" | tar xzC /usr/local
@@ -12,5 +12,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS apparmor seccomp selinux
 ENV RUNC_BUILDTAGS apparmor seccomp selinux
diff --git a/components/engine/contrib/builder/deb/armhf/debian-jessie/Dockerfile b/components/engine/contrib/builder/deb/armhf/debian-jessie/Dockerfile
index 3c63f47997..9a50cd17f8 100644
--- a/components/engine/contrib/builder/deb/armhf/debian-jessie/Dockerfile
+++ b/components/engine/contrib/builder/deb/armhf/debian-jessie/Dockerfile
@@ -8,7 +8,7 @@ FROM armhf/debian:jessie
 ARG APT_MIRROR=deb.debian.org
 RUN sed -ri "s/(httpredir|deb).debian.org/$APT_MIRROR/g" /etc/apt/sources.list
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev  pkg-config vim-common libsystemd-journal-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev  pkg-config vim-common libsystemd-journal-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 RUN curl -fSL "https://golang.org/dl/go${GO_VERSION}.linux-armv6l.tar.gz" | tar xzC /usr/local
@@ -16,5 +16,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 selinux
+ENV DOCKER_BUILDTAGS apparmor selinux
 ENV RUNC_BUILDTAGS apparmor selinux
diff --git a/components/engine/contrib/builder/deb/armhf/generate.sh b/components/engine/contrib/builder/deb/armhf/generate.sh
index 9bb943ed72..285dbbf528 100755
--- a/components/engine/contrib/builder/deb/armhf/generate.sh
+++ b/components/engine/contrib/builder/deb/armhf/generate.sh
@@ -59,7 +59,7 @@ for version in "${versions[@]}"; do
 		echo "" >> "$version/Dockerfile"
 	fi
 
-	extraBuildTags='pkcs11'
+	extraBuildTags=
 	runcBuildTags=
 
 	# this list is sorted alphabetically; please keep it that way
@@ -76,7 +76,6 @@ for version in "${versions[@]}"; do
 		git # for "git commit" info in "docker -v"
 		libapparmor-dev # for "sys/apparmor.h"
 		libdevmapper-dev # for "libdevmapper.h"
-		libltdl-dev # for pkcs11 "ltdl.h"
 		libseccomp-dev  # for "seccomp.h" & "libseccomp.so"
 		pkg-config # for detecting things like libsystemd-journal dynamically
 		vim-common # tini dep
diff --git a/components/engine/contrib/builder/deb/armhf/raspbian-jessie/Dockerfile b/components/engine/contrib/builder/deb/armhf/raspbian-jessie/Dockerfile
index 926639c002..810cb2ad3d 100644
--- a/components/engine/contrib/builder/deb/armhf/raspbian-jessie/Dockerfile
+++ b/components/engine/contrib/builder/deb/armhf/raspbian-jessie/Dockerfile
@@ -8,7 +8,7 @@ FROM resin/rpi-raspbian:jessie
 ARG APT_MIRROR=deb.debian.org
 RUN sed -ri "s/(httpredir|deb).debian.org/$APT_MIRROR/g" /etc/apt/sources.list
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev  pkg-config vim-common libsystemd-journal-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev  pkg-config vim-common libsystemd-journal-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 # GOARM is the ARM architecture version which is unrelated to the above Golang version
@@ -18,5 +18,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 selinux
+ENV DOCKER_BUILDTAGS apparmor selinux
 ENV RUNC_BUILDTAGS apparmor selinux
diff --git a/components/engine/contrib/builder/deb/armhf/ubuntu-trusty/Dockerfile b/components/engine/contrib/builder/deb/armhf/ubuntu-trusty/Dockerfile
index ce80b071b0..530f9fccd4 100644
--- a/components/engine/contrib/builder/deb/armhf/ubuntu-trusty/Dockerfile
+++ b/components/engine/contrib/builder/deb/armhf/ubuntu-trusty/Dockerfile
@@ -4,7 +4,7 @@
 
 FROM armhf/ubuntu:trusty
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev  pkg-config vim-common libsystemd-journal-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev  pkg-config vim-common libsystemd-journal-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 RUN curl -fSL "https://golang.org/dl/go${GO_VERSION}.linux-armv6l.tar.gz" | tar xzC /usr/local
@@ -12,5 +12,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 selinux
+ENV DOCKER_BUILDTAGS apparmor selinux
 ENV RUNC_BUILDTAGS apparmor selinux
diff --git a/components/engine/contrib/builder/deb/armhf/ubuntu-xenial/Dockerfile b/components/engine/contrib/builder/deb/armhf/ubuntu-xenial/Dockerfile
index c25e3524ee..a7f79ee3d0 100644
--- a/components/engine/contrib/builder/deb/armhf/ubuntu-xenial/Dockerfile
+++ b/components/engine/contrib/builder/deb/armhf/ubuntu-xenial/Dockerfile
@@ -4,7 +4,7 @@
 
 FROM armhf/ubuntu:xenial
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev libseccomp-dev pkg-config vim-common libsystemd-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libseccomp-dev pkg-config vim-common libsystemd-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 RUN curl -fSL "https://golang.org/dl/go${GO_VERSION}.linux-armv6l.tar.gz" | tar xzC /usr/local
@@ -12,5 +12,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS apparmor seccomp selinux
 ENV RUNC_BUILDTAGS apparmor seccomp selinux
diff --git a/components/engine/contrib/builder/deb/armhf/ubuntu-yakkety/Dockerfile b/components/engine/contrib/builder/deb/armhf/ubuntu-yakkety/Dockerfile
index 9dc92f0b70..69f1bedb40 100644
--- a/components/engine/contrib/builder/deb/armhf/ubuntu-yakkety/Dockerfile
+++ b/components/engine/contrib/builder/deb/armhf/ubuntu-yakkety/Dockerfile
@@ -4,7 +4,7 @@
 
 FROM armhf/ubuntu:yakkety
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev libseccomp-dev pkg-config vim-common libsystemd-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libseccomp-dev pkg-config vim-common libsystemd-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 RUN curl -fSL "https://golang.org/dl/go${GO_VERSION}.linux-armv6l.tar.gz" | tar xzC /usr/local
@@ -12,5 +12,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS apparmor seccomp selinux
 ENV RUNC_BUILDTAGS apparmor seccomp selinux
diff --git a/components/engine/contrib/builder/deb/ppc64le/generate.sh b/components/engine/contrib/builder/deb/ppc64le/generate.sh
index 6f6f348b5a..bf777ab5d7 100755
--- a/components/engine/contrib/builder/deb/ppc64le/generate.sh
+++ b/components/engine/contrib/builder/deb/ppc64le/generate.sh
@@ -36,7 +36,7 @@ for version in "${versions[@]}"; do
 
 	EOF
 
-	extraBuildTags='pkcs11'
+	extraBuildTags=
 	runcBuildTags=
 
 	# this list is sorted alphabetically; please keep it that way
@@ -53,13 +53,12 @@ for version in "${versions[@]}"; do
 		git # for "git commit" info in "docker -v"
 		libapparmor-dev # for "sys/apparmor.h"
 		libdevmapper-dev # for "libdevmapper.h"
-		libltdl-dev # for pkcs11 "ltdl.h"
 		pkg-config # for detecting things like libsystemd-journal dynamically
 		vim-common # tini dep
 	)
 
 	case "$suite" in
-		trusty) 
+		trusty)
 			packages+=( libsystemd-journal-dev )
 			;;
 		*)
@@ -82,7 +81,7 @@ for version in "${versions[@]}"; do
 			runcBuildTags="apparmor seccomp selinux"
 			;;
 	esac
-	
+
 	# update and install packages
 	echo "RUN apt-get update && apt-get install -y ${packages[*]} --no-install-recommends && rm -rf /var/lib/apt/lists/*" >> "$version/Dockerfile"
 	echo >> "$version/Dockerfile"
diff --git a/components/engine/contrib/builder/deb/ppc64le/ubuntu-trusty/Dockerfile b/components/engine/contrib/builder/deb/ppc64le/ubuntu-trusty/Dockerfile
index 76bc9e51bc..0841a990f2 100644
--- a/components/engine/contrib/builder/deb/ppc64le/ubuntu-trusty/Dockerfile
+++ b/components/engine/contrib/builder/deb/ppc64le/ubuntu-trusty/Dockerfile
@@ -4,7 +4,7 @@
 
 FROM ppc64le/ubuntu:trusty
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev pkg-config vim-common libsystemd-journal-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev pkg-config vim-common libsystemd-journal-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 RUN curl -fsSL "https://golang.org/dl/go${GO_VERSION}.linux-ppc64le.tar.gz" | tar xzC /usr/local
@@ -12,5 +12,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 selinux
+ENV DOCKER_BUILDTAGS apparmor selinux
 ENV RUNC_BUILDTAGS apparmor selinux
diff --git a/components/engine/contrib/builder/deb/ppc64le/ubuntu-xenial/Dockerfile b/components/engine/contrib/builder/deb/ppc64le/ubuntu-xenial/Dockerfile
index 9db6bc0e12..f9dd2506e0 100644
--- a/components/engine/contrib/builder/deb/ppc64le/ubuntu-xenial/Dockerfile
+++ b/components/engine/contrib/builder/deb/ppc64le/ubuntu-xenial/Dockerfile
@@ -4,7 +4,7 @@
 
 FROM ppc64le/ubuntu:xenial
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev pkg-config vim-common libseccomp-dev libsystemd-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev pkg-config vim-common libseccomp-dev libsystemd-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 RUN curl -fsSL "https://golang.org/dl/go${GO_VERSION}.linux-ppc64le.tar.gz" | tar xzC /usr/local
@@ -12,5 +12,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS apparmor seccomp selinux
 ENV RUNC_BUILDTAGS apparmor seccomp selinux
diff --git a/components/engine/contrib/builder/deb/ppc64le/ubuntu-yakkety/Dockerfile b/components/engine/contrib/builder/deb/ppc64le/ubuntu-yakkety/Dockerfile
index 535f4b3427..539969df7a 100644
--- a/components/engine/contrib/builder/deb/ppc64le/ubuntu-yakkety/Dockerfile
+++ b/components/engine/contrib/builder/deb/ppc64le/ubuntu-yakkety/Dockerfile
@@ -4,7 +4,7 @@
 
 FROM ppc64le/ubuntu:yakkety
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev pkg-config vim-common libseccomp-dev libsystemd-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev pkg-config vim-common libseccomp-dev libsystemd-dev --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 RUN curl -fsSL "https://golang.org/dl/go${GO_VERSION}.linux-ppc64le.tar.gz" | tar xzC /usr/local
@@ -12,5 +12,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS apparmor seccomp selinux
 ENV RUNC_BUILDTAGS apparmor seccomp selinux
diff --git a/components/engine/contrib/builder/deb/s390x/generate.sh b/components/engine/contrib/builder/deb/s390x/generate.sh
index 5cf05f32e0..c04d24ece8 100755
--- a/components/engine/contrib/builder/deb/s390x/generate.sh
+++ b/components/engine/contrib/builder/deb/s390x/generate.sh
@@ -36,7 +36,7 @@ for version in "${versions[@]}"; do
 
 	EOF
 
-	extraBuildTags='pkcs11'
+	extraBuildTags=
 	runcBuildTags=
 
 	# this list is sorted alphabetically; please keep it that way
@@ -53,7 +53,6 @@ for version in "${versions[@]}"; do
 		git # for "git commit" info in "docker -v"
 		libapparmor-dev # for "sys/apparmor.h"
 		libdevmapper-dev # for "libdevmapper.h"
-		libltdl-dev # for pkcs11 "ltdl.h"
 		libseccomp-dev  # for "seccomp.h" & "libseccomp.so"
 		pkg-config # for detecting things like libsystemd-journal dynamically
 		libsystemd-dev
diff --git a/components/engine/contrib/builder/deb/s390x/ubuntu-xenial/Dockerfile b/components/engine/contrib/builder/deb/s390x/ubuntu-xenial/Dockerfile
index 306d3dd74e..2ed0ad3b3f 100644
--- a/components/engine/contrib/builder/deb/s390x/ubuntu-xenial/Dockerfile
+++ b/components/engine/contrib/builder/deb/s390x/ubuntu-xenial/Dockerfile
@@ -4,7 +4,7 @@
 
 FROM s390x/ubuntu:xenial
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev libseccomp-dev pkg-config libsystemd-dev vim-common --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libseccomp-dev pkg-config libsystemd-dev vim-common --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 RUN curl -fSL "https://golang.org/dl/go${GO_VERSION}.linux-s390x.tar.gz" | tar xzC /usr/local
@@ -12,5 +12,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 selinux
+ENV DOCKER_BUILDTAGS apparmor selinux
 ENV RUNC_BUILDTAGS apparmor selinux
diff --git a/components/engine/contrib/builder/deb/s390x/ubuntu-yakkety/Dockerfile b/components/engine/contrib/builder/deb/s390x/ubuntu-yakkety/Dockerfile
index d8caa0b0b8..af79ff5af1 100644
--- a/components/engine/contrib/builder/deb/s390x/ubuntu-yakkety/Dockerfile
+++ b/components/engine/contrib/builder/deb/s390x/ubuntu-yakkety/Dockerfile
@@ -4,7 +4,7 @@
 
 FROM s390x/ubuntu:yakkety
 
-RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libltdl-dev libseccomp-dev pkg-config libsystemd-dev vim-common --no-install-recommends && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y apparmor bash-completion btrfs-tools build-essential cmake curl ca-certificates debhelper dh-apparmor dh-systemd git libapparmor-dev libdevmapper-dev libseccomp-dev pkg-config libsystemd-dev vim-common --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ENV GO_VERSION 1.8.3
 RUN curl -fSL "https://golang.org/dl/go${GO_VERSION}.linux-s390x.tar.gz" | tar xzC /usr/local
@@ -12,5 +12,5 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS apparmor pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS apparmor seccomp selinux
 ENV RUNC_BUILDTAGS apparmor selinux seccomp
diff --git a/components/engine/contrib/builder/rpm/amd64/amazonlinux-latest/Dockerfile b/components/engine/contrib/builder/rpm/amd64/amazonlinux-latest/Dockerfile
index fd23603fdb..7632daf25a 100644
--- a/components/engine/contrib/builder/rpm/amd64/amazonlinux-latest/Dockerfile
+++ b/components/engine/contrib/builder/rpm/amd64/amazonlinux-latest/Dockerfile
@@ -13,6 +13,6 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS seccomp selinux
 ENV RUNC_BUILDTAGS seccomp selinux
 
diff --git a/components/engine/contrib/builder/rpm/amd64/centos-7/Dockerfile b/components/engine/contrib/builder/rpm/amd64/centos-7/Dockerfile
index c64ba0533c..82cb9153be 100644
--- a/components/engine/contrib/builder/rpm/amd64/centos-7/Dockerfile
+++ b/components/engine/contrib/builder/rpm/amd64/centos-7/Dockerfile
@@ -14,6 +14,6 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS seccomp selinux
 ENV RUNC_BUILDTAGS seccomp selinux
 
diff --git a/components/engine/contrib/builder/rpm/amd64/fedora-24/Dockerfile b/components/engine/contrib/builder/rpm/amd64/fedora-24/Dockerfile
index c1c7a45d02..cdb922c16f 100644
--- a/components/engine/contrib/builder/rpm/amd64/fedora-24/Dockerfile
+++ b/components/engine/contrib/builder/rpm/amd64/fedora-24/Dockerfile
@@ -14,6 +14,6 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS seccomp selinux
 ENV RUNC_BUILDTAGS seccomp selinux
 
diff --git a/components/engine/contrib/builder/rpm/amd64/fedora-25/Dockerfile b/components/engine/contrib/builder/rpm/amd64/fedora-25/Dockerfile
index 8c06f37346..73e9e9a730 100644
--- a/components/engine/contrib/builder/rpm/amd64/fedora-25/Dockerfile
+++ b/components/engine/contrib/builder/rpm/amd64/fedora-25/Dockerfile
@@ -14,6 +14,6 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS seccomp selinux
 ENV RUNC_BUILDTAGS seccomp selinux
 
diff --git a/components/engine/contrib/builder/rpm/amd64/generate.sh b/components/engine/contrib/builder/rpm/amd64/generate.sh
index 5239a2bf81..15add3f3c6 100755
--- a/components/engine/contrib/builder/rpm/amd64/generate.sh
+++ b/components/engine/contrib/builder/rpm/amd64/generate.sh
@@ -42,7 +42,7 @@ for version in "${versions[@]}"; do
 
 	echo >> "$version/Dockerfile"
 
-	extraBuildTags='pkcs11'
+	extraBuildTags=
 	runcBuildTags=
 
 	case "$from" in
@@ -78,7 +78,7 @@ for version in "${versions[@]}"; do
 			echo 'RUN zypper --non-interactive install ca-certificates* curl gzip rpm-build' >> "$version/Dockerfile"
 			;;
 		photon:*)
-			echo "RUN ${installer} install -y wget curl ca-certificates gzip make rpm-build sed gcc linux-api-headers glibc-devel binutils libseccomp libltdl-devel elfutils" >> "$version/Dockerfile"
+			echo "RUN ${installer} install -y wget curl ca-certificates gzip make rpm-build sed gcc linux-api-headers glibc-devel binutils libseccomp elfutils" >> "$version/Dockerfile"
 			;;
 		*)
 			echo "RUN ${installer} install -y @development-tools fedora-packager" >> "$version/Dockerfile"
@@ -91,7 +91,6 @@ for version in "${versions[@]}"; do
 		glibc-static
 		libseccomp-devel # for "seccomp.h" & "libseccomp.so"
 		libselinux-devel # for "libselinux.so"
-		libtool-ltdl-devel # for pkcs11 "ltdl.h"
 		pkgconfig # for the pkg-config command
 		selinux-policy
 		selinux-policy-devel
diff --git a/components/engine/contrib/builder/rpm/amd64/opensuse-13.2/Dockerfile b/components/engine/contrib/builder/rpm/amd64/opensuse-13.2/Dockerfile
index 5ea4623963..af97fdc1ba 100644
--- a/components/engine/contrib/builder/rpm/amd64/opensuse-13.2/Dockerfile
+++ b/components/engine/contrib/builder/rpm/amd64/opensuse-13.2/Dockerfile
@@ -13,6 +13,6 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS pkcs11 selinux
+ENV DOCKER_BUILDTAGS selinux
 ENV RUNC_BUILDTAGS selinux
 
diff --git a/components/engine/contrib/builder/rpm/amd64/oraclelinux-6/Dockerfile b/components/engine/contrib/builder/rpm/amd64/oraclelinux-6/Dockerfile
index 108c9d276a..8e15365346 100644
--- a/components/engine/contrib/builder/rpm/amd64/oraclelinux-6/Dockerfile
+++ b/components/engine/contrib/builder/rpm/amd64/oraclelinux-6/Dockerfile
@@ -16,7 +16,7 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS pkcs11 selinux
+ENV DOCKER_BUILDTAGS selinux
 ENV RUNC_BUILDTAGS selinux
 
 ENV CGO_CPPFLAGS -D__EXPORTED_HEADERS__ \
diff --git a/components/engine/contrib/builder/rpm/amd64/oraclelinux-7/Dockerfile b/components/engine/contrib/builder/rpm/amd64/oraclelinux-7/Dockerfile
index 4a57c6b5bb..7e5a83220e 100644
--- a/components/engine/contrib/builder/rpm/amd64/oraclelinux-7/Dockerfile
+++ b/components/engine/contrib/builder/rpm/amd64/oraclelinux-7/Dockerfile
@@ -13,6 +13,6 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS seccomp selinux
 ENV RUNC_BUILDTAGS seccomp selinux
 
diff --git a/components/engine/contrib/builder/rpm/amd64/photon-1.0/Dockerfile b/components/engine/contrib/builder/rpm/amd64/photon-1.0/Dockerfile
index a535820897..6b489d7a68 100644
--- a/components/engine/contrib/builder/rpm/amd64/photon-1.0/Dockerfile
+++ b/components/engine/contrib/builder/rpm/amd64/photon-1.0/Dockerfile
@@ -4,7 +4,7 @@
 
 FROM photon:1.0
 
-RUN tdnf install -y wget curl ca-certificates gzip make rpm-build sed gcc linux-api-headers glibc-devel binutils libseccomp libltdl-devel elfutils
+RUN tdnf install -y wget curl ca-certificates gzip make rpm-build sed gcc linux-api-headers glibc-devel binutils libseccomp elfutils
 RUN tdnf install -y btrfs-progs-devel device-mapper-devel glibc-static libseccomp-devel libselinux-devel libtool-ltdl-devel pkg-config selinux-policy selinux-policy-devel systemd-devel tar git cmake vim-common
 
 ENV GO_VERSION 1.8.3
@@ -13,6 +13,6 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS seccomp selinux
 ENV RUNC_BUILDTAGS seccomp selinux
 
diff --git a/components/engine/contrib/builder/rpm/armhf/centos-7/Dockerfile b/components/engine/contrib/builder/rpm/armhf/centos-7/Dockerfile
index ece0ad5b2a..f482fa7ac1 100644
--- a/components/engine/contrib/builder/rpm/armhf/centos-7/Dockerfile
+++ b/components/engine/contrib/builder/rpm/armhf/centos-7/Dockerfile
@@ -15,6 +15,6 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS seccomp selinux
 ENV RUNC_BUILDTAGS seccomp selinux
 
diff --git a/components/engine/contrib/builder/rpm/armhf/generate.sh b/components/engine/contrib/builder/rpm/armhf/generate.sh
index f7c742ebdd..b07231eb97 100755
--- a/components/engine/contrib/builder/rpm/armhf/generate.sh
+++ b/components/engine/contrib/builder/rpm/armhf/generate.sh
@@ -52,7 +52,7 @@ for version in "${versions[@]}"; do
 
 	echo >> "$version/Dockerfile"
 
-	extraBuildTags='pkcs11'
+	extraBuildTags=
 	runcBuildTags=
 
 	case "$from" in
@@ -85,7 +85,6 @@ for version in "${versions[@]}"; do
 		glibc-static
 		libseccomp-devel # for "seccomp.h" & "libseccomp.so"
 		libselinux-devel # for "libselinux.so"
-		libtool-ltdl-devel # for pkcs11 "ltdl.h"
 		pkgconfig # for the pkg-config command
 		selinux-policy
 		selinux-policy-devel
diff --git a/components/engine/contrib/builder/rpm/ppc64le/centos-7/Dockerfile b/components/engine/contrib/builder/rpm/ppc64le/centos-7/Dockerfile
index 8299031346..95da278566 100644
--- a/components/engine/contrib/builder/rpm/ppc64le/centos-7/Dockerfile
+++ b/components/engine/contrib/builder/rpm/ppc64le/centos-7/Dockerfile
@@ -14,6 +14,6 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS seccomp selinux
 ENV RUNC_BUILDTAGS seccomp selinux
 
diff --git a/components/engine/contrib/builder/rpm/ppc64le/fedora-24/Dockerfile b/components/engine/contrib/builder/rpm/ppc64le/fedora-24/Dockerfile
index 3bb6c0547a..70a9f5daf2 100644
--- a/components/engine/contrib/builder/rpm/ppc64le/fedora-24/Dockerfile
+++ b/components/engine/contrib/builder/rpm/ppc64le/fedora-24/Dockerfile
@@ -14,6 +14,6 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS seccomp selinux
 ENV RUNC_BUILDTAGS seccomp selinux
 
diff --git a/components/engine/contrib/builder/rpm/ppc64le/generate.sh b/components/engine/contrib/builder/rpm/ppc64le/generate.sh
index cb0c81b964..c89f5a3416 100755
--- a/components/engine/contrib/builder/rpm/ppc64le/generate.sh
+++ b/components/engine/contrib/builder/rpm/ppc64le/generate.sh
@@ -39,7 +39,7 @@ for version in "${versions[@]}"; do
 
 	echo >> "$version/Dockerfile"
 
-	extraBuildTags='pkcs11'
+	extraBuildTags=
 	runcBuildTags=
 
 	case "$from" in
@@ -76,7 +76,6 @@ for version in "${versions[@]}"; do
 		glibc-static
 		libseccomp-devel # for "seccomp.h" & "libseccomp.so"
 		libselinux-devel # for "libselinux.so"
-		libtool-ltdl-devel # for pkcs11 "ltdl.h"
 		pkgconfig # for the pkg-config command
 		selinux-policy
 		selinux-policy-devel
diff --git a/components/engine/contrib/builder/rpm/ppc64le/opensuse-42.1/Dockerfile b/components/engine/contrib/builder/rpm/ppc64le/opensuse-42.1/Dockerfile
index 83e5f62b46..d11caa4cb5 100644
--- a/components/engine/contrib/builder/rpm/ppc64le/opensuse-42.1/Dockerfile
+++ b/components/engine/contrib/builder/rpm/ppc64le/opensuse-42.1/Dockerfile
@@ -15,6 +15,6 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS pkcs11 selinux
+ENV DOCKER_BUILDTAGS selinux
 ENV RUNC_BUILDTAGS selinux
 
diff --git a/components/engine/contrib/builder/rpm/s390x/clefos-base-s390x-7/Dockerfile b/components/engine/contrib/builder/rpm/s390x/clefos-base-s390x-7/Dockerfile
index 9435bf1329..1310b21545 100644
--- a/components/engine/contrib/builder/rpm/s390x/clefos-base-s390x-7/Dockerfile
+++ b/components/engine/contrib/builder/rpm/s390x/clefos-base-s390x-7/Dockerfile
@@ -14,6 +14,6 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS pkcs11 seccomp selinux
+ENV DOCKER_BUILDTAGS seccomp selinux
 ENV RUNC_BUILDTAGS seccomp selinux
 RUN ln -s /usr/bin/gcc /usr/bin/s390x-linux-gnu-gcc
diff --git a/components/engine/contrib/builder/rpm/s390x/generate.sh b/components/engine/contrib/builder/rpm/s390x/generate.sh
index 7e9a9cf6a3..81246c5dd4 100755
--- a/components/engine/contrib/builder/rpm/s390x/generate.sh
+++ b/components/engine/contrib/builder/rpm/s390x/generate.sh
@@ -50,7 +50,7 @@ for version in "${versions[@]}"; do
 
 	echo >> "$version/Dockerfile"
 
-	extraBuildTags='pkcs11'
+	extraBuildTags=''
 	runcBuildTags=
 
 	case "$from" in
@@ -75,7 +75,6 @@ for version in "${versions[@]}"; do
 		glibc-static
 		libseccomp-devel # for "seccomp.h" & "libseccomp.so"
 		libselinux-devel # for "libselinux.so"
-		libtool-ltdl-devel # for pkcs11 "ltdl.h"
 		pkgconfig # for the pkg-config command
 		selinux-policy
 		selinux-policy-devel
diff --git a/components/engine/contrib/builder/rpm/s390x/opensuse-tumbleweed-1/Dockerfile b/components/engine/contrib/builder/rpm/s390x/opensuse-tumbleweed-1/Dockerfile
index a36bb74f08..05cad426e1 100644
--- a/components/engine/contrib/builder/rpm/s390x/opensuse-tumbleweed-1/Dockerfile
+++ b/components/engine/contrib/builder/rpm/s390x/opensuse-tumbleweed-1/Dockerfile
@@ -15,6 +15,6 @@ ENV PATH $PATH:/usr/local/go/bin
 
 ENV AUTO_GOPATH 1
 
-ENV DOCKER_BUILDTAGS pkcs11 selinux
+ENV DOCKER_BUILDTAGS selinux
 ENV RUNC_BUILDTAGS selinux
 RUN ln -s /usr/bin/gcc /usr/bin/s390x-linux-gnu-gcc
diff --git a/components/engine/contrib/completion/REVIEWERS b/components/engine/contrib/completion/REVIEWERS
deleted file mode 100644
index 03ee2dde3d..0000000000
--- a/components/engine/contrib/completion/REVIEWERS
+++ /dev/null
@@ -1,2 +0,0 @@
-Tianon Gravi <admwiggin@gmail.com> (@tianon)
-Jessie Frazelle <jess@docker.com> (@jfrazelle)
diff --git a/components/engine/contrib/completion/bash/docker b/components/engine/contrib/completion/bash/docker
deleted file mode 100644
index 79209c2941..0000000000
--- a/components/engine/contrib/completion/bash/docker
+++ /dev/null
@@ -1,4629 +0,0 @@
-#!/usr/bin/env bash
-#
-# bash completion file for core docker commands
-#
-# This script provides completion of:
-#  - commands and their options
-#  - container ids and names
-#  - image repos and tags
-#  - filepaths
-#
-# To enable the completions either:
-#  - place this file in /etc/bash_completion.d
-#  or
-#  - copy this file to e.g. ~/.docker-completion.sh and add the line
-#    below to your .bashrc after bash completion features are loaded
-#    . ~/.docker-completion.sh
-#
-# Configuration:
-#
-# For several commands, the amount of completions can be configured by
-# setting environment variables.
-#
-# DOCKER_COMPLETION_SHOW_CONTAINER_IDS
-# DOCKER_COMPLETION_SHOW_NETWORK_IDS
-# DOCKER_COMPLETION_SHOW_NODE_IDS
-# DOCKER_COMPLETION_SHOW_PLUGIN_IDS
-# DOCKER_COMPLETION_SHOW_SECRET_IDS
-# DOCKER_COMPLETION_SHOW_SERVICE_IDS
-#   "no"  - Show names only (default)
-#   "yes" - Show names and ids
-#
-# You can tailor completion for the "events", "history", "inspect", "run",
-# "rmi" and "save" commands by settings the following environment
-# variables:
-#
-# DOCKER_COMPLETION_SHOW_IMAGE_IDS
-#   "none" - Show names only (default)
-#   "non-intermediate" - Show names and ids, but omit intermediate image IDs
-#   "all" - Show names and ids, including intermediate image IDs
-#
-# DOCKER_COMPLETION_SHOW_TAGS
-#   "yes" - include tags in completion options (default)
-#   "no"  - don't include tags in completion options
-
-#
-# Note:
-# Currently, the completions will not work if the docker daemon is not
-# bound to the default communication port/socket
-# If the docker daemon is using a unix socket for communication your user
-# must have access to the socket for the completions to function correctly
-#
-# Note for developers:
-# Please arrange options sorted alphabetically by long name with the short
-# options immediately following their corresponding long form.
-# This order should be applied to lists, alternatives and code blocks.
-
-__docker_previous_extglob_setting=$(shopt -p extglob)
-shopt -s extglob
-
-__docker_q() {
-	docker ${host:+-H "$host"} ${config:+--config "$config"} 2>/dev/null "$@"
-}
-
-# __docker_containers returns a list of containers. Additional options to
-# `docker ps` may be specified in order to filter the list, e.g.
-# `__docker_containers --filter status=running`
-# By default, only names are returned.
-# Set DOCKER_COMPLETION_SHOW_CONTAINER_IDS=yes to also complete IDs.
-# An optional first option `--id|--name` may be used to limit the
-# output to the IDs or names of matching items. This setting takes
-# precedence over the environment setting.
-__docker_containers() {
-	local format
-	if [ "$1" = "--id" ] ; then
-		format='{{.ID}}'
-		shift
-	elif [ "$1" = "--name" ] ; then
-		format='{{.Names}}'
-		shift
-	elif [ "${DOCKER_COMPLETION_SHOW_CONTAINER_IDS}" = yes ] ; then
-		format='{{.ID}} {{.Names}}'
-	else
-		format='{{.Names}}'
-	fi
-	__docker_q ps --format "$format" "$@"
-}
-
-# __docker_complete_containers applies completion of containers based on the current
-# value of `$cur` or the value of the optional first option `--cur`, if given.
-# Additional filters may be appended, see `__docker_containers`.
-__docker_complete_containers() {
-	local current="$cur"
-	if [ "$1" = "--cur" ] ; then
-		current="$2"
-		shift 2
-	fi
-	COMPREPLY=( $(compgen -W "$(__docker_containers "$@")" -- "$current") )
-}
-
-__docker_complete_containers_all() {
-	__docker_complete_containers "$@" --all
-}
-
-__docker_complete_containers_removable() {
-	__docker_complete_containers "$@" --filter status=created --filter status=exited
-}
-
-__docker_complete_containers_running() {
-	__docker_complete_containers "$@" --filter status=running
-}
-
-__docker_complete_containers_stopped() {
-	__docker_complete_containers "$@" --filter status=exited
-}
-
-__docker_complete_containers_unpauseable() {
-	__docker_complete_containers "$@" --filter status=paused
-}
-
-__docker_complete_container_names() {
-	local containers=( $(__docker_q ps -aq --no-trunc) )
-	local names=( $(__docker_q inspect --format '{{.Name}}' "${containers[@]}") )
-	names=( "${names[@]#/}" ) # trim off the leading "/" from the container names
-	COMPREPLY=( $(compgen -W "${names[*]}" -- "$cur") )
-}
-
-__docker_complete_container_ids() {
-	local containers=( $(__docker_q ps -aq) )
-	COMPREPLY=( $(compgen -W "${containers[*]}" -- "$cur") )
-}
-
-__docker_images() {
-	local images_args=""
-
-	case "$DOCKER_COMPLETION_SHOW_IMAGE_IDS" in
-		all)
-			images_args="--no-trunc -a"
-			;;
-		non-intermediate)
-			images_args="--no-trunc"
-			;;
-	esac
-
-	local repo_print_command
-	if [ "${DOCKER_COMPLETION_SHOW_TAGS:-yes}" = "yes" ]; then
-		repo_print_command='print $1; print $1":"$2'
-	else
-		repo_print_command='print $1'
-	fi
-
-	local awk_script
-	case "$DOCKER_COMPLETION_SHOW_IMAGE_IDS" in
-		all|non-intermediate)
-			awk_script='NR>1 { print $3; if ($1 != "<none>") { '"$repo_print_command"' } }'
-			;;
-		none|*)
-			awk_script='NR>1 && $1 != "<none>" { '"$repo_print_command"' }'
-			;;
-	esac
-
-	__docker_q images $images_args | awk "$awk_script" | grep -v '<none>$'
-}
-
-__docker_complete_images() {
-	COMPREPLY=( $(compgen -W "$(__docker_images)" -- "$cur") )
-	__ltrim_colon_completions "$cur"
-}
-
-__docker_complete_image_repos() {
-	local repos="$(__docker_q images | awk 'NR>1 && $1 != "<none>" { print $1 }')"
-	COMPREPLY=( $(compgen -W "$repos" -- "$cur") )
-}
-
-__docker_complete_image_repos_and_tags() {
-	local reposAndTags="$(__docker_q images | awk 'NR>1 && $1 != "<none>" { print $1; print $1":"$2 }')"
-	COMPREPLY=( $(compgen -W "$reposAndTags" -- "$cur") )
-	__ltrim_colon_completions "$cur"
-}
-
-# __docker_networks returns a list of all networks. Additional options to
-# `docker network ls` may be specified in order to filter the list, e.g.
-# `__docker_networks --filter type=custom`
-# By default, only names are returned.
-# Set DOCKER_COMPLETION_SHOW_NETWORK_IDS=yes to also complete IDs.
-# An optional first option `--id|--name` may be used to limit the
-# output to the IDs or names of matching items. This setting takes
-# precedence over the environment setting.
-__docker_networks() {
-	local format
-	if [ "$1" = "--id" ] ; then
-		format='{{.ID}}'
-		shift
-	elif [ "$1" = "--name" ] ; then
-		format='{{.Name}}'
-		shift
-	elif [ "${DOCKER_COMPLETION_SHOW_NETWORK_IDS}" = yes ] ; then
-		format='{{.ID}} {{.Name}}'
-	else
-		format='{{.Name}}'
-	fi
-	__docker_q network ls --format "$format" "$@"
-}
-
-# __docker_complete_networks applies completion of networks based on the current
-# value of `$cur` or the value of the optional first option `--cur`, if given.
-# Additional filters may be appended, see `__docker_networks`.
-__docker_complete_networks() {
-	local current="$cur"
-	if [ "$1" = "--cur" ] ; then
-		current="$2"
-		shift 2
-	fi
-	COMPREPLY=( $(compgen -W "$(__docker_networks "$@")" -- "$current") )
-}
-
-__docker_complete_containers_in_network() {
-	local containers=$(__docker_q network inspect -f '{{range $i, $c := .Containers}}{{$i}} {{$c.Name}} {{end}}' "$1")
-	COMPREPLY=( $(compgen -W "$containers" -- "$cur") )
-}
-
-# __docker_volumes returns a list of all volumes. Additional options to
-# `docker volume ls` may be specified in order to filter the list, e.g.
-# `__docker_volumes --filter dangling=true`
-# Because volumes do not have IDs, this function does not distinguish between
-# IDs and names.
-__docker_volumes() {
-	__docker_q volume ls -q "$@"
-}
-
-# __docker_complete_volumes applies completion of volumes based on the current
-# value of `$cur` or the value of the optional first option `--cur`, if given.
-# Additional filters may be appended, see `__docker_volumes`.
-__docker_complete_volumes() {
-	local current="$cur"
-	if [ "$1" = "--cur" ] ; then
-		current="$2"
-		shift 2
-	fi
-	COMPREPLY=( $(compgen -W "$(__docker_volumes "$@")" -- "$current") )
-}
-
-# __docker_plugins_bundled returns a list of all plugins of a given type.
-# The type has to be specified with the mandatory option `--type`.
-# Valid types are: Network, Volume, Authorization.
-# Completions may be added or removed with `--add` and `--remove`
-# This function only deals with plugins that come bundled with Docker.
-# For plugins managed by `docker plugin`, see `__docker_plugins_installed`.
-__docker_plugins_bundled() {
-	local type add=() remove=()
-	while true ; do
-		case "$1" in
-			--type)
-				type="$2"
-				shift 2
-				;;
-			--add)
-				add+=("$2")
-				shift 2
-				;;
-			--remove)
-				remove+=("$2")
-				shift 2
-				;;
-			*)
-				break
-				;;
-		esac
-	done
-
-	local plugins=($(__docker_q info --format "{{range \$i, \$p := .Plugins.$type}}{{.}} {{end}}"))
-	for del in "${remove[@]}" ; do
-		plugins=(${plugins[@]/$del/})
-	done
-	echo "${plugins[@]} ${add[@]}"
-}
-
-# __docker_complete_plugins_bundled applies completion of plugins based on the current
-# value of `$cur` or the value of the optional first option `--cur`, if given.
-# The plugin type has to be specified with the next option `--type`.
-# This function only deals with plugins that come bundled with Docker.
-# For completion of plugins managed by `docker plugin`, see
-# `__docker_complete_plugins_installed`.
-__docker_complete_plugins_bundled() {
-	local current="$cur"
-	if [ "$1" = "--cur" ] ; then
-		current="$2"
-		shift 2
-	fi
-	COMPREPLY=( $(compgen -W "$(__docker_plugins_bundled "$@")" -- "$current") )
-}
-
-# __docker_plugins_installed returns a list of all plugins that were installed with
-# the Docker plugin API.
-# By default, only names are returned.
-# Set DOCKER_COMPLETION_SHOW_PLUGIN_IDS=yes to also complete IDs.
-# Additional options to `docker plugin ls` may be specified in order to filter the list,
-# e.g. `__docker_plugins_installed --filter enabled=true`
-# For built-in pugins, see `__docker_plugins_bundled`.
-__docker_plugins_installed() {
-	local format
-	if [ "$DOCKER_COMPLETION_SHOW_PLUGIN_IDS" = yes ] ; then
-		format='{{.ID}} {{.Name}}'
-	else
-		format='{{.Name}}'
-	fi
-	__docker_q plugin ls --format "$format" "$@"
-}
-
-# __docker_complete_plugins_installed applies completion of plugins that were installed
-# with the Docker plugin API, based on the current value of `$cur` or the value of
-# the optional first option `--cur`, if given.
-# Additional filters may be appended, see `__docker_plugins_installed`.
-# For completion of built-in pugins, see `__docker_complete_plugins_bundled`.
-__docker_complete_plugins_installed() {
-	local current="$cur"
-	if [ "$1" = "--cur" ] ; then
-		current="$2"
-		shift 2
-	fi
-	COMPREPLY=( $(compgen -W "$(__docker_plugins_installed "$@")" -- "$current") )
-}
-
-__docker_runtimes() {
-	__docker_q info | sed -n 's/^Runtimes: \(.*\)/\1/p'
-}
-
-__docker_complete_runtimes() {
-	COMPREPLY=( $(compgen -W "$(__docker_runtimes)" -- "$cur") )
-}
-
-# __docker_secrets returns a list of secrets. Additional options to
-# `docker secret ls` may be specified in order to filter the list, e.g.
-# `__docker_secrets --filter label=stage=production`
-# By default, only names are returned.
-# Set DOCKER_COMPLETION_SHOW_SECRET_IDS=yes to also complete IDs.
-# An optional first option `--id|--name` may be used to limit the
-# output to the IDs or names of matching items. This setting takes
-# precedence over the environment setting.
-__docker_secrets() {
-	local format
-	if [ "$1" = "--id" ] ; then
-		format='{{.ID}}'
-		shift
-	elif [ "$1" = "--name" ] ; then
-		format='{{.Name}}'
-		shift
-	elif [ "$DOCKER_COMPLETION_SHOW_SECRET_IDS" = yes ] ; then
-		format='{{.ID}} {{.Name}}'
-	else
-		format='{{.Name}}'
-	fi
-
-	__docker_q secret ls --format "$format" "$@"
-}
-
-# __docker_complete_secrets applies completion of secrets based on the current value
-# of `$cur` or the value of the optional first option `--cur`, if given.
-__docker_complete_secrets() {
-	local current="$cur"
-	if [ "$1" = "--cur" ] ; then
-		current="$2"
-		shift 2
-	fi
-	COMPREPLY=( $(compgen -W "$(__docker_secrets "$@")" -- "$current") )
-}
-
-# __docker_stacks returns a list of all stacks.
-__docker_stacks() {
-	__docker_q stack ls | awk 'NR>1 {print $1}'
-}
-
-# __docker_complete_stacks applies completion of stacks based on the current value
-# of `$cur` or the value of the optional first option `--cur`, if given.
-__docker_complete_stacks() {
-	local current="$cur"
-	if [ "$1" = "--cur" ] ; then
-		current="$2"
-		shift 2
-	fi
-	COMPREPLY=( $(compgen -W "$(__docker_stacks "$@")" -- "$current") )
-}
-
-# __docker_nodes returns a list of all nodes. Additional options to
-# `docker node ls` may be specified in order to filter the list, e.g.
-# `__docker_nodes --filter role=manager`
-# By default, only node names are returned.
-# Set DOCKER_COMPLETION_SHOW_NODE_IDS=yes to also complete node IDs.
-# An optional first option `--id|--name` may be used to limit the
-# output to the IDs or names of matching items. This setting takes
-# precedence over the environment setting.
-# Completions may be added with `--add`, e.g. `--add self`.
-__docker_nodes() {
-	local add=()
-	local fields='$2'  # default: node name only
-	[ "${DOCKER_COMPLETION_SHOW_NODE_IDS}" = yes ] && fields='$1,$2' # ID and name
-
-	while true ; do
-		case "$1" in
-			--id)
-				fields='$1' # IDs only
-				shift
-				;;
-			--name)
-				fields='$2' # names only
-				shift
-				;;
-			--add)
-				add+=("$2")
-				shift 2
-				;;
-			*)
-				break
-				;;
-		esac
-	done
-
-	echo $(__docker_q node ls "$@" | tr -d '*' | awk "NR>1 {print $fields}") "${add[@]}"
-}
-
-# __docker_complete_nodes applies completion of nodes based on the current
-# value of `$cur` or the value of the optional first option `--cur`, if given.
-# Additional filters may be appended, see `__docker_nodes`.
-__docker_complete_nodes() {
-	local current="$cur"
-	if [ "$1" = "--cur" ] ; then
-		current="$2"
-		shift 2
-	fi
-	COMPREPLY=( $(compgen -W "$(__docker_nodes "$@")" -- "$current") )
-}
-
-# __docker_services returns a list of all services. Additional options to
-# `docker service ls` may be specified in order to filter the list, e.g.
-# `__docker_services --filter name=xxx`
-# By default, only node names are returned.
-# Set DOCKER_COMPLETION_SHOW_SERVICE_IDS=yes to also complete IDs.
-# An optional first option `--id|--name` may be used to limit the
-# output to the IDs or names of matching items. This setting takes
-# precedence over the environment setting.
-__docker_services() {
-	local fields='$2'  # default: service name only
-	[ "${DOCKER_COMPLETION_SHOW_SERVICE_IDS}" = yes ] && fields='$1,$2' # ID & name
-
-	if [ "$1" = "--id" ] ; then
-		fields='$1' # IDs only
-		shift
-	elif [ "$1" = "--name" ] ; then
-		fields='$2' # names only
-		shift
-	fi
-        __docker_q service ls "$@" | awk "NR>1 {print $fields}"
-}
-
-# __docker_complete_services applies completion of services based on the current
-# value of `$cur` or the value of the optional first option `--cur`, if given.
-# Additional filters may be appended, see `__docker_services`.
-__docker_complete_services() {
-	local current="$cur"
-	if [ "$1" = "--cur" ] ; then
-		current="$2"
-		shift 2
-	fi
-	COMPREPLY=( $(compgen -W "$(__docker_services "$@")" -- "$current") )
-}
-
-# __docker_tasks returns a list of all task IDs.
-__docker_tasks() {
-	__docker_q service ps --format '{{.ID}}' ""
-}
-
-# __docker_complete_services_and_tasks applies completion of services and task IDs.
-__docker_complete_services_and_tasks() {
-	COMPREPLY=( $(compgen -W "$(__docker_services "$@") $(__docker_tasks)" -- "$cur") )
-}
-
-# __docker_append_to_completions appends the word passed as an argument to every
-# word in `$COMPREPLY`.
-# Normally you do this with `compgen -S` while generating the completions.
-# This function allows you to append a suffix later. It allows you to use
-# the __docker_complete_XXX functions in cases where you need a suffix.
-__docker_append_to_completions() {
-	COMPREPLY=( ${COMPREPLY[@]/%/"$1"} )
-}
-
-# __docker_daemon_is_experimental tests whether the currently configured Docker
-# daemon runs in experimental mode. If so, the function exits with 0 (true).
-# Otherwise, or if the result cannot be determined, the exit value is 1 (false).
-__docker_daemon_is_experimental() {
-	[ "$(__docker_q version -f '{{.Server.Experimental}}')" = "true" ]
-}
-
-# __docker_daemon_os_is tests whether the currently configured Docker daemon runs
-# on the operating system passed in as the first argument.
-# It does so by querying the daemon for its OS. The result is cached for the duration
-# of one invocation of bash completion so that this function can be used to test for
-# several different operating systems without additional costs.
-# Known operating systems: linux, windows.
-__docker_daemon_os_is() {
-	local expected_os="$1"
-	local actual_os=${daemon_os=$(__docker_q version -f '{{.Server.Os}}')}
-	[ "$actual_os" = "$expected_os" ]
-}
-
-# __docker_pos_first_nonflag finds the position of the first word that is neither
-# option nor an option's argument. If there are options that require arguments,
-# you should pass a glob describing those options, e.g. "--option1|-o|--option2"
-# Use this function to restrict completions to exact positions after the argument list.
-__docker_pos_first_nonflag() {
-	local argument_flags=$1
-
-	local counter=$((${subcommand_pos:-${command_pos}} + 1))
-	while [ $counter -le $cword ]; do
-		if [ -n "$argument_flags" ] && eval "case '${words[$counter]}' in $argument_flags) true ;; *) false ;; esac"; then
-			(( counter++ ))
-			# eat "=" in case of --option=arg syntax
-			[ "${words[$counter]}" = "=" ] && (( counter++ ))
-		else
-			case "${words[$counter]}" in
-				-*)
-					;;
-				*)
-					break
-					;;
-			esac
-		fi
-
-		# Bash splits words at "=", retaining "=" as a word, examples:
-		# "--debug=false" => 3 words, "--log-opt syslog-facility=daemon" => 4 words
-		while [ "${words[$counter + 1]}" = "=" ] ; do
-			counter=$(( counter + 2))
-		done
-
-		(( counter++ ))
-	done
-
-	echo $counter
-}
-
-# __docker_map_key_of_current_option returns `key` if we are currently completing the
-# value of a map option (`key=value`) which matches the extglob given as an argument.
-# This function is needed for key-specific completions.
-__docker_map_key_of_current_option() {
-	local glob="$1"
-
-	local key glob_pos
-	if [ "$cur" = "=" ] ; then        # key= case
-		key="$prev"
-		glob_pos=$((cword - 2))
-	elif [[ $cur == *=* ]] ; then     # key=value case (OSX)
-		key=${cur%=*}
-		glob_pos=$((cword - 1))
-	elif [ "$prev" = "=" ] ; then
-		key=${words[$cword - 2]}  # key=value case
-		glob_pos=$((cword - 3))
-	else
-		return
-	fi
-
-	[ "${words[$glob_pos]}" = "=" ] && ((glob_pos--))  # --option=key=value syntax
-
-	[[ ${words[$glob_pos]} == @($glob) ]] && echo "$key"
-}
-
-# __docker_value_of_option returns the value of the first option matching `option_glob`.
-# Valid values for `option_glob` are option names like `--log-level` and globs like
-# `--log-level|-l`
-# Only positions between the command and the current word are considered.
-__docker_value_of_option() {
-	local option_extglob=$(__docker_to_extglob "$1")
-
-	local counter=$((command_pos + 1))
-	while [ $counter -lt $cword ]; do
-		case ${words[$counter]} in
-			$option_extglob )
-				echo ${words[$counter + 1]}
-				break
-				;;
-		esac
-		(( counter++ ))
-	done
-}
-
-# __docker_to_alternatives transforms a multiline list of strings into a single line
-# string with the words separated by `|`.
-# This is used to prepare arguments to __docker_pos_first_nonflag().
-__docker_to_alternatives() {
-	local parts=( $1 )
-	local IFS='|'
-	echo "${parts[*]}"
-}
-
-# __docker_to_extglob transforms a multiline list of options into an extglob pattern
-# suitable for use in case statements.
-__docker_to_extglob() {
-	local extglob=$( __docker_to_alternatives "$1" )
-	echo "@($extglob)"
-}
-
-# __docker_subcommands processes subcommands
-# Locates the first occurrence of any of the subcommands contained in the
-# first argument. In case of a match, calls the corresponding completion
-# function and returns 0.
-# If no match is found, 1 is returned. The calling function can then
-# continue processing its completion.
-#
-# TODO if the preceding command has options that accept arguments and an
-# argument is equal ot one of the subcommands, this is falsely detected as
-# a match.
-__docker_subcommands() {
-	local subcommands="$1"
-
-	local counter=$(($command_pos + 1))
-	while [ $counter -lt $cword ]; do
-		case "${words[$counter]}" in
-			$(__docker_to_extglob "$subcommands") )
-				subcommand_pos=$counter
-				local subcommand=${words[$counter]}
-				local completions_func=_docker_${command}_${subcommand//-/_}
-				declare -F $completions_func >/dev/null && $completions_func
-				return 0
-				;;
-		esac
-		(( counter++ ))
-	done
-	return 1
-}
-
-# __docker_nospace suppresses trailing whitespace
-__docker_nospace() {
-	# compopt is not available in ancient bash versions
-	type compopt &>/dev/null && compopt -o nospace
-}
-
-__docker_complete_resolved_hostname() {
-	command -v host >/dev/null 2>&1 || return
-	COMPREPLY=( $(host 2>/dev/null "${cur%:}" | awk '/has address/ {print $4}') )
-}
-
-__docker_local_interfaces() {
-	command -v ip >/dev/null 2>&1 || return
-	ip addr show scope global 2>/dev/null | sed -n 's| \+inet \([0-9.]\+\).* \([^ ]\+\)|\1 \2|p'
-}
-
-__docker_complete_local_interfaces() {
-	local additional_interface
-	if [ "$1" = "--add" ] ; then
-		additional_interface="$2"
-	fi
-
-	COMPREPLY=( $( compgen -W "$(__docker_local_interfaces) $additional_interface" -- "$cur" ) )
-}
-
-# __docker_complete_capabilities_addable completes Linux capabilities which are
-# not granted by default and may be added.
-# see https://docs.docker.com/engine/reference/run/#/runtime-privilege-and-linux-capabilities
-__docker_complete_capabilities_addable() {
-	COMPREPLY=( $( compgen -W "
-		ALL
-		AUDIT_CONTROL
-		BLOCK_SUSPEND
-		DAC_READ_SEARCH
-		IPC_LOCK
-		IPC_OWNER
-		LEASE
-		LINUX_IMMUTABLE
-		MAC_ADMIN
-		MAC_OVERRIDE
-		NET_ADMIN
-		NET_BROADCAST
-		SYS_ADMIN
-		SYS_BOOT
-		SYSLOG
-		SYS_MODULE
-		SYS_NICE
-		SYS_PACCT
-		SYS_PTRACE
-		SYS_RAWIO
-		SYS_RESOURCE
-		SYS_TIME
-		SYS_TTY_CONFIG
-		WAKE_ALARM
-	" -- "$cur" ) )
-}
-
-# __docker_complete_capabilities_droppable completes Linux capability options which are
-# allowed by default and can be dropped.
-# see https://docs.docker.com/engine/reference/run/#/runtime-privilege-and-linux-capabilities
-__docker_complete_capabilities_droppable() {
-	COMPREPLY=( $( compgen -W "
-		ALL
-		AUDIT_WRITE
-		CHOWN
-		DAC_OVERRIDE
-		FOWNER
-		FSETID
-		KILL
-		MKNOD
-		NET_BIND_SERVICE
-		NET_RAW
-		SETFCAP
-		SETGID
-		SETPCAP
-		SETUID
-		SYS_CHROOT
-	" -- "$cur" ) )
-}
-
-__docker_complete_detach_keys() {
-	case "$prev" in
-		--detach-keys)
-			case "$cur" in
-				*,)
-					COMPREPLY=( $( compgen -W "${cur}ctrl-" -- "$cur" ) )
-					;;
-				*)
-					COMPREPLY=( $( compgen -W "ctrl-" -- "$cur" ) )
-					;;
-			esac
-
-			__docker_nospace
-			return
-			;;
-	esac
-	return 1
-}
-
-__docker_complete_isolation() {
-	COMPREPLY=( $( compgen -W "default hyperv process" -- "$cur" ) )
-}
-
-__docker_complete_log_drivers() {
-	COMPREPLY=( $( compgen -W "
-		awslogs
-		etwlogs
-		fluentd
-		gcplogs
-		gelf
-		journald
-		json-file
-		logentries
-		none
-		splunk
-		syslog
-	" -- "$cur" ) )
-}
-
-__docker_complete_log_options() {
-	# see repository docker/docker.github.io/engine/admin/logging/
-
-	# really global options, defined in https://github.com/moby/moby/blob/master/daemon/logger/factory.go
-	local common_options1="max-buffer-size mode"
-	# common options defined in https://github.com/moby/moby/blob/master/daemon/logger/loginfo.go
-	# but not implemented in all log drivers
-	local common_options2="env env-regex labels"
-
-	# awslogs does not implement the $common_options2.
-	local awslogs_options="$common_options1 awslogs-create-group awslogs-group awslogs-region awslogs-stream tag"
-
-	local fluentd_options="$common_options1 $common_options2 fluentd-address fluentd-async-connect fluentd-buffer-limit fluentd-retry-wait fluentd-max-retries tag"
-	local gcplogs_options="$common_options1 $common_options2 gcp-log-cmd gcp-meta-id gcp-meta-name gcp-meta-zone gcp-project"
-	local gelf_options="$common_options1 $common_options2 gelf-address gelf-compression-level gelf-compression-type tag"
-	local journald_options="$common_options1 $common_options2 tag"
-	local json_file_options="$common_options1 $common_options2 max-file max-size"
-	local logentries_options="$common_options1 $common_options2 logentries-token tag"
-	local splunk_options="$common_options1 $common_options2 splunk-caname splunk-capath splunk-format splunk-gzip splunk-gzip-level splunk-index splunk-insecureskipverify splunk-source splunk-sourcetype splunk-token splunk-url splunk-verify-connection tag"
-	local syslog_options="$common_options1 $common_options2 syslog-address syslog-facility syslog-format syslog-tls-ca-cert syslog-tls-cert syslog-tls-key syslog-tls-skip-verify tag"
-
-	local all_options="$fluentd_options $gcplogs_options $gelf_options $journald_options $logentries_options $json_file_options $syslog_options $splunk_options"
-
-	case $(__docker_value_of_option --log-driver) in
-		'')
-			COMPREPLY=( $( compgen -W "$all_options" -S = -- "$cur" ) )
-			;;
-		awslogs)
-			COMPREPLY=( $( compgen -W "$awslogs_options" -S = -- "$cur" ) )
-			;;
-		fluentd)
-			COMPREPLY=( $( compgen -W "$fluentd_options" -S = -- "$cur" ) )
-			;;
-		gcplogs)
-			COMPREPLY=( $( compgen -W "$gcplogs_options" -S = -- "$cur" ) )
-			;;
-		gelf)
-			COMPREPLY=( $( compgen -W "$gelf_options" -S = -- "$cur" ) )
-			;;
-		journald)
-			COMPREPLY=( $( compgen -W "$journald_options" -S = -- "$cur" ) )
-			;;
-		json-file)
-			COMPREPLY=( $( compgen -W "$json_file_options" -S = -- "$cur" ) )
-			;;
-		logentries)
-			COMPREPLY=( $( compgen -W "$logentries_options" -S = -- "$cur" ) )
-			;;
-		syslog)
-			COMPREPLY=( $( compgen -W "$syslog_options" -S = -- "$cur" ) )
-			;;
-		splunk)
-			COMPREPLY=( $( compgen -W "$splunk_options" -S = -- "$cur" ) )
-			;;
-		*)
-			return
-			;;
-	esac
-
-	__docker_nospace
-}
-
-__docker_complete_log_driver_options() {
-	local key=$(__docker_map_key_of_current_option '--log-opt')
-	case "$key" in
-		awslogs-create-group)
-			COMPREPLY=( $( compgen -W "false true" -- "${cur##*=}" ) )
-			return
-			;;
-		fluentd-async-connect)
-			COMPREPLY=( $( compgen -W "false true" -- "${cur##*=}" ) )
-			return
-			;;
-		gelf-address)
-			COMPREPLY=( $( compgen -W "udp" -S "://" -- "${cur##*=}" ) )
-			__docker_nospace
-			return
-			;;
-		gelf-compression-level)
-			COMPREPLY=( $( compgen -W "1 2 3 4 5 6 7 8 9" -- "${cur##*=}" ) )
-			return
-			;;
-		gelf-compression-type)
-			COMPREPLY=( $( compgen -W "gzip none zlib" -- "${cur##*=}" ) )
-			return
-			;;
-		mode)
-			COMPREPLY=( $( compgen -W "blocking non-blocking" -- "${cur##*=}" ) )
-			return
-			;;
-		syslog-address)
-			COMPREPLY=( $( compgen -W "tcp:// tcp+tls:// udp:// unix://" -- "${cur##*=}" ) )
-			__docker_nospace
-			__ltrim_colon_completions "${cur}"
-			return
-			;;
-		syslog-facility)
-			COMPREPLY=( $( compgen -W "
-				auth
-				authpriv
-				cron
-				daemon
-				ftp
-				kern
-				local0
-				local1
-				local2
-				local3
-				local4
-				local5
-				local6
-				local7
-				lpr
-				mail
-				news
-				syslog
-				user
-				uucp
-			" -- "${cur##*=}" ) )
-			return
-			;;
-		syslog-format)
-			COMPREPLY=( $( compgen -W "rfc3164 rfc5424 rfc5424micro" -- "${cur##*=}" ) )
-			return
-			;;
-		syslog-tls-ca-cert|syslog-tls-cert|syslog-tls-key)
-			_filedir
-			return
-			;;
-		syslog-tls-skip-verify)
-			COMPREPLY=( $( compgen -W "true" -- "${cur##*=}" ) )
-			return
-			;;
-		splunk-url)
-			COMPREPLY=( $( compgen -W "http:// https://" -- "${cur##*=}" ) )
-			__docker_nospace
-			__ltrim_colon_completions "${cur}"
-			return
-			;;
-		splunk-gzip|splunk-insecureskipverify|splunk-verify-connection)
-			COMPREPLY=( $( compgen -W "false true" -- "${cur##*=}" ) )
-			return
-			;;
-		splunk-format)
-			COMPREPLY=( $( compgen -W "inline json raw" -- "${cur##*=}" ) )
-			return
-			;;
-	esac
-	return 1
-}
-
-__docker_complete_log_levels() {
-	COMPREPLY=( $( compgen -W "debug info warn error fatal" -- "$cur" ) )
-}
-
-__docker_complete_restart() {
-	case "$prev" in
-		--restart)
-			case "$cur" in
-				on-failure:*)
-					;;
-				*)
-					COMPREPLY=( $( compgen -W "always no on-failure on-failure: unless-stopped" -- "$cur") )
-					;;
-			esac
-			return
-			;;
-	esac
-	return 1
-}
-
-# __docker_complete_signals returns a subset of the available signals that is most likely
-# relevant in the context of docker containers
-__docker_complete_signals() {
-	local signals=(
-		SIGCONT
-		SIGHUP
-		SIGINT
-		SIGKILL
-		SIGQUIT
-		SIGSTOP
-		SIGTERM
-		SIGUSR1
-		SIGUSR2
-	)
-	COMPREPLY=( $( compgen -W "${signals[*]} ${signals[*]#SIG}" -- "$( echo $cur | tr '[:lower:]' '[:upper:]')" ) )
-}
-
-__docker_complete_user_group() {
-	if [[ $cur == *:* ]] ; then
-		COMPREPLY=( $(compgen -g -- "${cur#*:}") )
-	else
-		COMPREPLY=( $(compgen -u -S : -- "$cur") )
-		__docker_nospace
-	fi
-}
-
-_docker_docker() {
-	# global options that may appear after the docker command
-	local boolean_options="
-		$global_boolean_options
-		--help
-		--version -v
-	"
-
-	case "$prev" in
-		--config)
-			_filedir -d
-			return
-			;;
-		--log-level|-l)
-			__docker_complete_log_levels
-			return
-			;;
-		$(__docker_to_extglob "$global_options_with_args") )
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $global_options_with_args" -- "$cur" ) )
-			;;
-		*)
-			local counter=$( __docker_pos_first_nonflag "$(__docker_to_extglob "$global_options_with_args")" )
-			if [ $cword -eq $counter ]; then
-				__docker_daemon_is_experimental && commands+=(${experimental_commands[*]})
-				COMPREPLY=( $( compgen -W "${commands[*]} help" -- "$cur" ) )
-			fi
-			;;
-	esac
-}
-
-_docker_attach() {
-	_docker_container_attach
-}
-
-_docker_build() {
-	_docker_image_build
-}
-
-
-_docker_checkpoint() {
-	local subcommands="
-		create
-		ls
-		rm
-	"
-	local aliases="
-		list
-		remove
-	"
-	__docker_subcommands "$subcommands $aliases" && return
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			COMPREPLY=( $( compgen -W "$subcommands" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_checkpoint_create() {
-	case "$prev" in
-		--checkpoint-dir)
-			_filedir -d
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--checkpoint-dir --help --leave-running" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag '--checkpoint-dir')
-			if [ $cword -eq $counter ]; then
-				__docker_complete_containers_running
-			fi
-			;;
-	esac
-}
-
-_docker_checkpoint_ls() {
-	case "$prev" in
-		--checkpoint-dir)
-			_filedir -d
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--checkpoint-dir --help" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag '--checkpoint-dir')
-			if [ $cword -eq $counter ]; then
-				__docker_complete_containers_all
-			fi
-			;;
-	esac
-}
-
-_docker_checkpoint_rm() {
-	case "$prev" in
-		--checkpoint-dir)
-			_filedir -d
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--checkpoint-dir --help" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag '--checkpoint-dir')
-			if [ $cword -eq $counter ]; then
-				__docker_complete_containers_all
-			elif [ $cword -eq $(($counter + 1)) ]; then
-				COMPREPLY=( $( compgen -W "$(__docker_q checkpoint ls "$prev" | sed 1d)" -- "$cur" ) )
-			fi
-			;;
-	esac
-}
-
-
-_docker_container() {
-	local subcommands="
-		attach
-		commit
-		cp
-		create
-		diff
-		exec
-		export
-		inspect
-		kill
-		logs
-		ls
-		pause
-		port
-		prune
-		rename
-		restart
-		rm
-		run
-		start
-		stats
-		stop
-		top
-		unpause
-		update
-		wait
-	"
-	local aliases="
-		list
-		ps
-	"
-	__docker_subcommands "$subcommands $aliases" && return
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			COMPREPLY=( $( compgen -W "$subcommands" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_container_attach() {
-	__docker_complete_detach_keys && return
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--detach-keys --help --no-stdin --sig-proxy=false" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag '--detach-keys')
-			if [ $cword -eq $counter ]; then
-				__docker_complete_containers_running
-			fi
-			;;
-	esac
-}
-
-_docker_container_commit() {
-	case "$prev" in
-		--author|-a|--change|-c|--message|-m)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--author -a --change -c --help --message -m --pause=false -p=false" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag '--author|-a|--change|-c|--message|-m')
-
-			if [ $cword -eq $counter ]; then
-				__docker_complete_containers_all
-				return
-			fi
-			(( counter++ ))
-
-			if [ $cword -eq $counter ]; then
-				__docker_complete_image_repos_and_tags
-				return
-			fi
-			;;
-	esac
-}
-
-_docker_container_cp() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--follow-link -L --help" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-			if [ $cword -eq $counter ]; then
-				case "$cur" in
-					*:)
-						return
-						;;
-					*)
-						# combined container and filename completion
-						_filedir
-						local files=( ${COMPREPLY[@]} )
-
-						__docker_complete_containers_all
-						COMPREPLY=( $( compgen -W "${COMPREPLY[*]}" -S ':' ) )
-						local containers=( ${COMPREPLY[@]} )
-
-						COMPREPLY=( $( compgen -W "${files[*]} ${containers[*]}" -- "$cur" ) )
-						if [[ "$COMPREPLY" == *: ]]; then
-							__docker_nospace
-						fi
-						return
-						;;
-				esac
-			fi
-			(( counter++ ))
-
-			if [ $cword -eq $counter ]; then
-				if [ -e "$prev" ]; then
-					__docker_complete_containers_all
-					COMPREPLY=( $( compgen -W "${COMPREPLY[*]}" -S ':' ) )
-					__docker_nospace
-				else
-					_filedir
-				fi
-				return
-			fi
-			;;
-	esac
-}
-
-_docker_container_create() {
-	_docker_container_run_and_create
-}
-
-_docker_container_diff() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-			if [ $cword -eq $counter ]; then
-				__docker_complete_containers_all
-			fi
-			;;
-	esac
-}
-
-_docker_container_exec() {
-	__docker_complete_detach_keys && return
-
-	case "$prev" in
-		--env|-e)
-			# we do not append a "=" here because "-e VARNAME" is legal systax, too
-			COMPREPLY=( $( compgen -e -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--user|-u)
-			__docker_complete_user_group
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--detach -d --detach-keys --env -e --help --interactive -i --privileged -t --tty -u --user" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_containers_running
-			;;
-	esac
-}
-
-_docker_container_export() {
-	case "$prev" in
-		--output|-o)
-			_filedir
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help --output -o" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-			if [ $cword -eq $counter ]; then
-				__docker_complete_containers_all
-			fi
-			;;
-	esac
-}
-
-_docker_container_inspect() {
-	_docker_inspect --type container
-}
-
-_docker_container_kill() {
-	case "$prev" in
-		--signal|-s)
-			__docker_complete_signals
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help --signal -s" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_containers_running
-			;;
-	esac
-}
-
-_docker_container_logs() {
-	case "$prev" in
-		--since|--tail)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--details --follow -f --help --since --tail --timestamps -t" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag '--since|--tail')
-			if [ $cword -eq $counter ]; then
-				__docker_complete_containers_all
-			fi
-			;;
-	esac
-}
-
-_docker_container_list() {
-	_docker_container_ls
-}
-
-_docker_container_ls() {
-	local key=$(__docker_map_key_of_current_option '--filter|-f')
-	case "$key" in
-		ancestor)
-			cur="${cur##*=}"
-			__docker_complete_images
-			return
-			;;
-		before)
-			__docker_complete_containers_all --cur "${cur##*=}"
-			return
-			;;
-		expose|publish)
-			return
-			;;
-		id)
-			__docker_complete_containers_all --cur "${cur##*=}" --id
-			return
-			;;
-		health)
-			COMPREPLY=( $( compgen -W "healthy starting none unhealthy" -- "${cur##*=}" ) )
-			return
-			;;
-		is-task)
-			COMPREPLY=( $( compgen -W "true false" -- "${cur##*=}" ) )
-			return
-			;;
-		name)
-			__docker_complete_containers_all --cur "${cur##*=}" --name
-			return
-			;;
-		network)
-			__docker_complete_networks --cur "${cur##*=}"
-			return
-			;;
-		since)
-			__docker_complete_containers_all --cur "${cur##*=}"
-			return
-			;;
-		status)
-			COMPREPLY=( $( compgen -W "created dead exited paused restarting running removing" -- "${cur##*=}" ) )
-			return
-			;;
-		volume)
-			__docker_complete_volumes --cur "${cur##*=}"
-			return
-			;;
-	esac
-
-	case "$prev" in
-		--filter|-f)
-			COMPREPLY=( $( compgen -S = -W "ancestor before exited expose health id is-task label name network publish since status volume" -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--format|--last|-n)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--all -a --filter -f --format --help --last -n --latest -l --no-trunc --quiet -q --size -s" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_container_pause() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_containers_running
-			;;
-	esac
-}
-
-_docker_container_port() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-			if [ $cword -eq $counter ]; then
-				__docker_complete_containers_all
-			fi
-			;;
-	esac
-}
-
-_docker_container_prune() {
-	case "$prev" in
-		--filter)
-			COMPREPLY=( $( compgen -W "until" -S = -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--force -f --filter --help" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_container_ps() {
-	_docker_container_ls
-}
-
-_docker_container_rename() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-			if [ $cword -eq $counter ]; then
-				__docker_complete_containers_all
-			fi
-			;;
-	esac
-}
-
-_docker_container_restart() {
-	case "$prev" in
-		--time|-t)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help --time -t" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_containers_all
-			;;
-	esac
-}
-
-_docker_container_rm() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--force -f --help --link -l --volumes -v" -- "$cur" ) )
-			;;
-		*)
-			for arg in "${COMP_WORDS[@]}"; do
-				case "$arg" in
-					--force|-f)
-						__docker_complete_containers_all
-						return
-						;;
-				esac
-			done
-			__docker_complete_containers_removable
-			;;
-	esac
-}
-
-_docker_container_run() {
-	_docker_container_run_and_create
-}
-
-# _docker_container_run_and_create is the combined completion for `_docker_container_run`
-# and `_docker_container_create`
-_docker_container_run_and_create() {
-	local options_with_args="
-		--add-host
-		--attach -a
-		--blkio-weight
-		--blkio-weight-device
-		--cap-add
-		--cap-drop
-		--cgroup-parent
-		--cidfile
-		--cpu-period
-		--cpu-quota
-		--cpu-rt-period
-		--cpu-rt-runtime
-		--cpuset-cpus
-		--cpus
-		--cpuset-mems
-		--cpu-shares -c
-		--device
-		--device-cgroup-rule
-		--device-read-bps
-		--device-read-iops
-		--device-write-bps
-		--device-write-iops
-		--dns
-		--dns-option
-		--dns-search
-		--entrypoint
-		--env -e
-		--env-file
-		--expose
-		--group-add
-		--health-cmd
-		--health-interval
-		--health-retries
-		--health-start-period
-		--health-timeout
-		--hostname -h
-		--ip
-		--ip6
-		--ipc
-		--kernel-memory
-		--label-file
-		--label -l
-		--link
-		--link-local-ip
-		--log-driver
-		--log-opt
-		--mac-address
-		--memory -m
-		--memory-swap
-		--memory-swappiness
-		--memory-reservation
-		--mount
-		--name
-		--network
-		--network-alias
-		--oom-score-adj
-		--pid
-		--pids-limit
-		--publish -p
-		--restart
-		--runtime
-		--security-opt
-		--shm-size
-		--stop-signal
-		--stop-timeout
-		--storage-opt
-		--tmpfs
-		--sysctl
-		--ulimit
-		--user -u
-		--userns
-		--uts
-		--volume-driver
-		--volumes-from
-		--volume -v
-		--workdir -w
-	"
-	__docker_daemon_os_is windows && options_with_args+="
-		--cpu-count
-		--cpu-percent
-		--io-maxbandwidth
-		--io-maxiops
-		--isolation
-	"
-
-	local boolean_options="
-		--disable-content-trust=false
-		--help
-		--init
-		--interactive -i
-		--no-healthcheck
-		--oom-kill-disable
-		--privileged
-		--publish-all -P
-		--read-only
-		--tty -t
-	"
-
-	if [ "$command" = "run" -o "$subcommand" = "run" ] ; then
-		options_with_args="$options_with_args
-			--detach-keys
-		"
-		boolean_options="$boolean_options
-			--detach -d
-			--rm
-			--sig-proxy=false
-		"
-		__docker_complete_detach_keys && return
-	fi
-
-	local all_options="$options_with_args $boolean_options"
-
-
-	__docker_complete_log_driver_options && return
-	__docker_complete_restart && return
-
-	local key=$(__docker_map_key_of_current_option '--security-opt')
-	case "$key" in
-		label)
-			[[ $cur == *: ]] && return
-			COMPREPLY=( $( compgen -W "user: role: type: level: disable" -- "${cur##*=}") )
-			if [ "${COMPREPLY[*]}" != "disable" ] ; then
-				__docker_nospace
-			fi
-			return
-			;;
-		seccomp)
-			local cur=${cur##*=}
-			_filedir
-			COMPREPLY+=( $( compgen -W "unconfined" -- "$cur" ) )
-			return
-			;;
-	esac
-
-	case "$prev" in
-		--add-host)
-			case "$cur" in
-				*:)
-					__docker_complete_resolved_hostname
-					return
-					;;
-			esac
-			;;
-		--attach|-a)
-			COMPREPLY=( $( compgen -W 'stdin stdout stderr' -- "$cur" ) )
-			return
-			;;
-		--cap-add)
-			__docker_complete_capabilities_addable
-			return
-			;;
-		--cap-drop)
-			__docker_complete_capabilities_droppable
-			return
-			;;
-		--cidfile|--env-file|--label-file)
-			_filedir
-			return
-			;;
-		--device|--tmpfs|--volume|-v)
-			case "$cur" in
-				*:*)
-					# TODO somehow do _filedir for stuff inside the image, if it's already specified (which is also somewhat difficult to determine)
-					;;
-				'')
-					COMPREPLY=( $( compgen -W '/' -- "$cur" ) )
-					__docker_nospace
-					;;
-				/*)
-					_filedir
-					__docker_nospace
-					;;
-			esac
-			return
-			;;
-		--env|-e)
-			# we do not append a "=" here because "-e VARNAME" is legal systax, too
-			COMPREPLY=( $( compgen -e -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--ipc)
-			case "$cur" in
-				*:*)
-					cur="${cur#*:}"
-					__docker_complete_containers_running
-					;;
-				*)
-					COMPREPLY=( $( compgen -W 'host container:' -- "$cur" ) )
-					if [ "$COMPREPLY" = "container:" ]; then
-						__docker_nospace
-					fi
-					;;
-			esac
-			return
-			;;
-		--isolation)
-			if __docker_daemon_os_is windows ; then
-				__docker_complete_isolation
-				return
-			fi
-			;;
-		--link)
-			case "$cur" in
-				*:*)
-					;;
-				*)
-					__docker_complete_containers_running
-					COMPREPLY=( $( compgen -W "${COMPREPLY[*]}" -S ':' ) )
-					__docker_nospace
-					;;
-			esac
-			return
-			;;
-		--log-driver)
-			__docker_complete_log_drivers
-			return
-			;;
-		--log-opt)
-			__docker_complete_log_options
-			return
-			;;
-		--network)
-			case "$cur" in
-				container:*)
-					__docker_complete_containers_all --cur "${cur#*:}"
-					;;
-				*)
-					COMPREPLY=( $( compgen -W "$(__docker_plugins_bundled --type Network) $(__docker_networks) container:" -- "$cur") )
-					if [ "${COMPREPLY[*]}" = "container:" ] ; then
-						__docker_nospace
-					fi
-					;;
-			esac
-			return
-			;;
-		--pid)
-			case "$cur" in
-				*:*)
-					__docker_complete_containers_running --cur "${cur#*:}"
-					;;
-				*)
-					COMPREPLY=( $( compgen -W 'host container:' -- "$cur" ) )
-					if [ "$COMPREPLY" = "container:" ]; then
-						__docker_nospace
-					fi
-					;;
-			esac
-			return
-			;;
-		--runtime)
-			__docker_complete_runtimes
-			return
-			;;
-		--security-opt)
-			COMPREPLY=( $( compgen -W "apparmor= label= no-new-privileges seccomp=" -- "$cur") )
-			if [ "${COMPREPLY[*]}" != "no-new-privileges" ] ; then
-				__docker_nospace
-			fi
-			return
-			;;
-		--stop-signal)
-			__docker_complete_signals
-			return
-			;;
-		--storage-opt)
-			COMPREPLY=( $( compgen -W "size" -S = -- "$cur") )
-			__docker_nospace
-			return
-			;;
-		--user|-u)
-			__docker_complete_user_group
-			return
-			;;
-		--userns)
-			COMPREPLY=( $( compgen -W "host" -- "$cur" ) )
-			return
-			;;
-		--volume-driver)
-			__docker_complete_plugins_bundled --type Volume
-			return
-			;;
-		--volumes-from)
-			__docker_complete_containers_all
-			return
-			;;
-		$(__docker_to_extglob "$options_with_args") )
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "$all_options" -- "$cur" ) )
-			;;
-		*)
-			local counter=$( __docker_pos_first_nonflag $( __docker_to_alternatives "$options_with_args" ) )
-			if [ $cword -eq $counter ]; then
-				__docker_complete_images
-			fi
-			;;
-	esac
-}
-
-_docker_container_start() {
-	__docker_complete_detach_keys && return
-
-	case "$prev" in
-		--checkpoint)
-			if [ __docker_daemon_is_experimental ] ; then
-				return
-			fi
-			;;
-		--checkpoint-dir)
-			if [ __docker_daemon_is_experimental ] ; then
-				_filedir -d
-				return
-			fi
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			local options="--attach -a --detach-keys --help --interactive -i"
-			__docker_daemon_is_experimental && options+=" --checkpoint --checkpoint-dir"
-			COMPREPLY=( $( compgen -W "$options" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_containers_stopped
-			;;
-	esac
-}
-
-_docker_container_stats() {
-	case "$prev" in
-		--format)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--all -a --format --help --no-stream" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_containers_running
-			;;
-	esac
-}
-
-_docker_container_stop() {
-	case "$prev" in
-		--time|-t)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help --time -t" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_containers_running
-			;;
-	esac
-}
-
-_docker_container_top() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-			if [ $cword -eq $counter ]; then
-				__docker_complete_containers_running
-			fi
-			;;
-	esac
-}
-
-_docker_container_unpause() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-			if [ $cword -eq $counter ]; then
-				__docker_complete_containers_unpauseable
-			fi
-			;;
-	esac
-}
-
-_docker_container_update() {
-	local options_with_args="
-		--blkio-weight
-		--cpu-period
-		--cpu-quota
-		--cpu-rt-period
-		--cpu-rt-runtime
-		--cpus
-		--cpuset-cpus
-		--cpuset-mems
-		--cpu-shares -c
-		--kernel-memory
-		--memory -m
-		--memory-reservation
-		--memory-swap
-		--restart
-	"
-
-	local boolean_options="
-		--help
-	"
-
-	local all_options="$options_with_args $boolean_options"
-
-	__docker_complete_restart && return
-
-	case "$prev" in
-		$(__docker_to_extglob "$options_with_args") )
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "$all_options" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_containers_all
-			;;
-	esac
-}
-
-_docker_container_wait() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_containers_all
-			;;
-	esac
-}
-
-
-_docker_commit() {
-	_docker_container_commit
-}
-
-_docker_cp() {
-	_docker_container_cp
-}
-
-_docker_create() {
-	_docker_container_create
-}
-
-_docker_daemon() {
-	local boolean_options="
-		$global_boolean_options
-		--disable-legacy-registry
-		--experimental
-		--help
-		--icc=false
-		--init
-		--ip-forward=false
-		--ip-masq=false
-		--iptables=false
-		--ipv6
-		--live-restore
-		--raw-logs
-		--selinux-enabled
-		--userland-proxy=false
-	"
-	local options_with_args="
-		$global_options_with_args
-		--add-runtime
-		--allow-nondistributable-artifacts
-		--api-cors-header
-		--authorization-plugin
-		--bip
-		--bridge -b
-		--cgroup-parent
-		--cluster-advertise
-		--cluster-store
-		--cluster-store-opt
-		--config-file
-		--containerd
-		--data-root
-		--default-gateway
-		--default-gateway-v6
-		--default-shm-size
-		--default-ulimit
-		--dns
-		--dns-search
-		--dns-opt
-		--exec-opt
-		--exec-root
-		--fixed-cidr
-		--fixed-cidr-v6
-		--group -G
-		--init-path
-		--insecure-registry
-		--ip
-		--label
-		--log-driver
-		--log-opt
-		--max-concurrent-downloads
-		--max-concurrent-uploads
-		--mtu
-		--oom-score-adjust
-		--pidfile -p
-		--registry-mirror
-		--seccomp-profile
-		--shutdown-timeout
-		--storage-driver -s
-		--storage-opt
-		--userland-proxy-path
-		--userns-remap
-	"
-
-	__docker_complete_log_driver_options && return
-
- 	key=$(__docker_map_key_of_current_option '--cluster-store-opt')
- 	case "$key" in
- 		kv.*file)
-			cur=${cur##*=}
- 			_filedir
- 			return
- 			;;
- 	esac
-
- 	local key=$(__docker_map_key_of_current_option '--storage-opt')
- 	case "$key" in
- 		dm.blkdiscard|dm.override_udev_sync_check|dm.use_deferred_removal|dm.use_deferred_deletion)
- 			COMPREPLY=( $( compgen -W "false true" -- "${cur##*=}" ) )
- 			return
- 			;;
-		dm.directlvm_device|dm.thinpooldev)
-			cur=${cur##*=}
-			_filedir
-			return
-			;;
-		dm.fs)
-			COMPREPLY=( $( compgen -W "ext4 xfs" -- "${cur##*=}" ) )
-			return
-			;;
- 	esac
-
-	case "$prev" in
-		--authorization-plugin)
-			__docker_complete_plugins_bundled --type Authorization
-			return
-			;;
-		--cluster-store)
-			COMPREPLY=( $( compgen -W "consul etcd zk" -S "://" -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--cluster-store-opt)
-			COMPREPLY=( $( compgen -W "discovery.heartbeat discovery.ttl kv.cacertfile kv.certfile kv.keyfile kv.path" -S = -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--config-file|--containerd|--init-path|--pidfile|-p|--tlscacert|--tlscert|--tlskey|--userland-proxy-path)
-			_filedir
-			return
-			;;
-		--exec-root|--data-root)
-			_filedir -d
-			return
-			;;
-		--log-driver)
-			__docker_complete_log_drivers
-			return
-			;;
-		--storage-driver|-s)
-			COMPREPLY=( $( compgen -W "aufs btrfs devicemapper overlay  overlay2 vfs zfs" -- "$(echo $cur | tr '[:upper:]' '[:lower:]')" ) )
-			return
-			;;
-		--storage-opt)
-			local btrfs_options="btrfs.min_space"
-			local devicemapper_options="
-				dm.basesize
-				dm.blkdiscard
-				dm.blocksize
-				dm.directlvm_device
-				dm.fs
-				dm.loopdatasize
-				dm.loopmetadatasize
-				dm.min_free_space
-				dm.mkfsarg
-				dm.mountopt
-				dm.override_udev_sync_check
-				dm.thinpooldev
-				dm.thinp_autoextend_percent
-				dm.thinp_autoextend_threshold
-				dm.thinp_metapercent
-				dm.thinp_percent
-				dm.use_deferred_deletion
-				dm.use_deferred_removal
-			"
-			local zfs_options="zfs.fsname"
-
-			case $(__docker_value_of_option '--storage-driver|-s') in
-				'')
-					COMPREPLY=( $( compgen -W "$btrfs_options $devicemapper_options $zfs_options" -S = -- "$cur" ) )
-					;;
-				btrfs)
-					COMPREPLY=( $( compgen -W "$btrfs_options" -S = -- "$cur" ) )
-					;;
-				devicemapper)
-					COMPREPLY=( $( compgen -W "$devicemapper_options" -S = -- "$cur" ) )
-					;;
-				zfs)
-					COMPREPLY=( $( compgen -W "$zfs_options" -S = -- "$cur" ) )
-					;;
-				*)
-					return
-					;;
-			esac
-			__docker_nospace
-			return
-			;;
-		--log-level|-l)
-			__docker_complete_log_levels
-			return
-			;;
-		--log-opt)
-			__docker_complete_log_options
-			return
-			;;
-		--seccomp-profile)
-			_filedir json
-			return
-			;;
-		--userns-remap)
-			__docker_complete_user_group
-			return
-			;;
-		$(__docker_to_extglob "$options_with_args") )
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_deploy() {
-	__docker_daemon_is_experimental && _docker_stack_deploy
-}
-
-_docker_diff() {
-	_docker_container_diff
-}
-
-_docker_events() {
-	_docker_system_events
-}
-
-_docker_exec() {
-	_docker_container_exec
-}
-
-_docker_export() {
-	_docker_container_export
-}
-
-_docker_help() {
-	local counter=$(__docker_pos_first_nonflag)
-	if [ $cword -eq $counter ]; then
-		COMPREPLY=( $( compgen -W "${commands[*]}" -- "$cur" ) )
-	fi
-}
-
-_docker_history() {
-	_docker_image_history
-}
-
-
-_docker_image() {
-	local subcommands="
-		build
-		history
-		import
-		inspect
-		load
-		ls
-		prune
-		pull
-		push
-		rm
-		save
-		tag
-	"
-	local aliases="
-		images
-		list
-		remove
-		rmi
-	"
-	__docker_subcommands "$subcommands $aliases" && return
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			COMPREPLY=( $( compgen -W "$subcommands" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_image_build() {
-	local options_with_args="
-		--add-host
-		--build-arg
-		--cache-from
-		--cgroup-parent
-		--cpuset-cpus
-		--cpuset-mems
-		--cpu-shares -c
-		--cpu-period
-		--cpu-quota
-		--file -f
-		--label
-		--memory -m
-		--memory-swap
-		--network
-		--shm-size
-		--tag -t
-		--ulimit
-	"
-	__docker_daemon_os_is windows && options_with_args+="
-		--isolation
-	"
-
-	local boolean_options="
-		--compress
-		--disable-content-trust=false
-		--force-rm
-		--help
-		--no-cache
-		--pull
-		--quiet -q
-		--rm
-	"
-	__docker_daemon_is_experimental && boolean_options+="--squash"
-
-	local all_options="$options_with_args $boolean_options"
-
-	case "$prev" in
-		--add-host)
-			case "$cur" in
-				*:)
-					__docker_complete_resolved_hostname
-					return
-					;;
-			esac
-			;;
-		--build-arg)
-			COMPREPLY=( $( compgen -e -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--cache-from)
-			__docker_complete_image_repos_and_tags
-			return
-			;;
-		--file|-f)
-			_filedir
-			return
-			;;
-		--isolation)
-			if __docker_daemon_os_is windows ; then
-				__docker_complete_isolation
-				return
-			fi
-			;;
-		--network)
-			case "$cur" in
-				container:*)
-					__docker_complete_containers_all --cur "${cur#*:}"
-					;;
-				*)
-					COMPREPLY=( $( compgen -W "$(__docker_plugins_bundled --type Network) $(__docker_networks) container:" -- "$cur") )
-					if [ "${COMPREPLY[*]}" = "container:" ] ; then
-						__docker_nospace
-					fi
-					;;
-			esac
-			return
-			;;
-		--tag|-t)
-			__docker_complete_image_repos_and_tags
-			return
-			;;
-		$(__docker_to_extglob "$options_with_args") )
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "$all_options" -- "$cur" ) )
-			;;
-		*)
-			local counter=$( __docker_pos_first_nonflag $( __docker_to_alternatives "$options_with_args" ) )
-			if [ $cword -eq $counter ]; then
-				_filedir -d
-			fi
-			;;
-	esac
-}
-
-_docker_image_history() {
-	case "$prev" in
-		--format)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--format --help --human=false -H=false --no-trunc --quiet -q" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-			if [ $cword -eq $counter ]; then
-				__docker_complete_images
-			fi
-			;;
-	esac
-}
-
-_docker_image_images() {
-	_docker_image_ls
-}
-
-_docker_image_import() {
-	case "$prev" in
-		--change|-c|--message|-m)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--change -c --help --message -m" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag '--change|-c|--message|-m')
-			if [ $cword -eq $counter ]; then
-				return
-			fi
-			(( counter++ ))
-
-			if [ $cword -eq $counter ]; then
-				__docker_complete_image_repos_and_tags
-				return
-			fi
-			;;
-	esac
-}
-
-_docker_image_inspect() {
-	_docker_inspect --type image
-}
-
-_docker_image_load() {
-	case "$prev" in
-		--input|-i)
-			_filedir
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help --input -i --quiet -q" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_image_list() {
-	_docker_image_ls
-}
-
-_docker_image_ls() {
-	local key=$(__docker_map_key_of_current_option '--filter|-f')
-	case "$key" in
-		before|since|reference)
-			cur="${cur##*=}"
-			__docker_complete_images
-			return
-			;;
-		dangling)
-			COMPREPLY=( $( compgen -W "false true" -- "${cur##*=}" ) )
-			return
-			;;
-		label)
-			return
-			;;
-	esac
-
-	case "$prev" in
-		--filter|-f)
-			COMPREPLY=( $( compgen -S = -W "before dangling label reference since" -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-                --format)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--all -a --digests --filter -f --format --help --no-trunc --quiet -q" -- "$cur" ) )
-			;;
-		=)
-			return
-			;;
-		*)
-			__docker_complete_image_repos
-			;;
-	esac
-}
-
-_docker_image_prune() {
-	case "$prev" in
-		--filter)
-			COMPREPLY=( $( compgen -W "until" -S = -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--all -a --force -f --filter --help" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_image_pull() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--all-tags -a --disable-content-trust=false --help" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-			if [ $cword -eq $counter ]; then
-				for arg in "${COMP_WORDS[@]}"; do
-					case "$arg" in
-						--all-tags|-a)
-							__docker_complete_image_repos
-							return
-							;;
-					esac
-				done
-				__docker_complete_image_repos_and_tags
-			fi
-			;;
-	esac
-}
-
-_docker_image_push() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--disable-content-trust=false --help" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-			if [ $cword -eq $counter ]; then
-				__docker_complete_image_repos_and_tags
-			fi
-			;;
-	esac
-}
-
-_docker_image_remove() {
-	_docker_image_rm
-}
-
-_docker_image_rm() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--force -f --help --no-prune" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_images
-			;;
-	esac
-}
-
-_docker_image_rmi() {
-	_docker_image_rm
-}
-
-_docker_image_save() {
-	case "$prev" in
-		--output|-o)
-			_filedir
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help --output -o" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_images
-			;;
-	esac
-}
-
-_docker_image_tag() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-
-			if [ $cword -eq $counter ]; then
-				__docker_complete_image_repos_and_tags
-				return
-			fi
-			(( counter++ ))
-
-			if [ $cword -eq $counter ]; then
-				__docker_complete_image_repos_and_tags
-				return
-			fi
-			;;
-	esac
-}
-
-
-_docker_images() {
-	_docker_image_ls
-}
-
-_docker_import() {
-	_docker_image_import
-}
-
-_docker_info() {
-	_docker_system_info
-}
-
-_docker_inspect() {
-	local preselected_type
-	local type
-
-	if [ "$1" = "--type" ] ; then
-		preselected_type=yes
-		type="$2"
-	else
-		type=$(__docker_value_of_option --type)
-	fi
-
-	case "$prev" in
-		--format|-f)
-			return
-			;;
-		--type)
-			if [ -z "$preselected_type" ] ; then
-				COMPREPLY=( $( compgen -W "container image network node plugin secret service volume" -- "$cur" ) )
-				return
-			fi
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			local options="--format -f --help --size -s"
-			if [ -z "$preselected_type" ] ; then
-				options+=" --type"
-			fi
-			COMPREPLY=( $( compgen -W "$options" -- "$cur" ) )
-			;;
-		*)
-			case "$type" in
-				'')
-					COMPREPLY=( $( compgen -W "
-						$(__docker_containers --all)
-						$(__docker_images)
-						$(__docker_networks)
-						$(__docker_nodes)
-						$(__docker_plugins_installed)
-						$(__docker_secrets)
-						$(__docker_services)
-						$(__docker_volumes)
-					" -- "$cur" ) )
-					;;
-				container)
-					__docker_complete_containers_all
-					;;
-				image)
-					__docker_complete_images
-					;;
-				network)
-					__docker_complete_networks
-					;;
-				node)
-					__docker_complete_nodes
-					;;
-				plugin)
-					__docker_complete_plugins_installed
-					;;
-				secret)
-					__docker_complete_secrets
-					;;
-				service)
-					__docker_complete_services
-					;;
-				volume)
-					__docker_complete_volumes
-					;;
-			esac
-	esac
-}
-
-_docker_kill() {
-	_docker_container_kill
-}
-
-_docker_load() {
-	_docker_image_load
-}
-
-_docker_login() {
-	case "$prev" in
-		--password|-p|--username|-u)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help --password -p --username -u" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_logout() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_logs() {
-	_docker_container_logs
-}
-
-_docker_network_connect() {
-	local options_with_args="
-		--alias
-		--ip
-		--ip6
-		--link
-		--link-local-ip
-	"
-
-	local boolean_options="
-		--help
-	"
-
-	case "$prev" in
-		--link)
-			case "$cur" in
-				*:*)
-					;;
-				*)
-					__docker_complete_containers_running
-					COMPREPLY=( $( compgen -W "${COMPREPLY[*]}" -S ':' ) )
-					__docker_nospace
-					;;
-			esac
-			return
-			;;
-		$(__docker_to_extglob "$options_with_args") )
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
-			;;
-		*)
-			local counter=$( __docker_pos_first_nonflag $( __docker_to_alternatives "$options_with_args" ) )
-			if [ $cword -eq $counter ]; then
-				__docker_complete_networks
-			elif [ $cword -eq $(($counter + 1)) ]; then
-				__docker_complete_containers_all
-			fi
-			;;
-	esac
-}
-
-_docker_network_create() {
-	case "$prev" in
-		--aux-address|--gateway|--internal|--ip-range|--ipam-opt|--ipv6|--opt|-o|--subnet)
-			return
-			;;
-		--ipam-driver)
-			COMPREPLY=( $( compgen -W "default" -- "$cur" ) )
-			return
-			;;
-		--driver|-d)
-			# remove drivers that allow one instance only, add drivers missing in `docker info`
-			__docker_complete_plugins_bundled --type Network --remove host --remove null --add macvlan
-			return
-			;;
-		--label)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--attachable --aux-address --driver -d --gateway --help --internal --ip-range --ipam-driver --ipam-opt --ipv6 --label --opt -o --subnet" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_network_disconnect() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-			if [ $cword -eq $counter ]; then
-				__docker_complete_networks
-			elif [ $cword -eq $(($counter + 1)) ]; then
-				__docker_complete_containers_in_network "$prev"
-			fi
-			;;
-	esac
-}
-
-_docker_network_inspect() {
-	case "$prev" in
-		--format|-f)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--format -f --help --verbose" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_networks
-	esac
-}
-
-_docker_network_ls() {
-	local key=$(__docker_map_key_of_current_option '--filter|-f')
-	case "$key" in
-		driver)
-			__docker_complete_plugins_bundled --cur "${cur##*=}" --type Network --add macvlan
-			return
-			;;
-		id)
-			__docker_complete_networks --cur "${cur##*=}" --id
-			return
-			;;
-		name)
-			__docker_complete_networks --cur "${cur##*=}" --name
-			return
-			;;
-		scope)
-			COMPREPLY=( $( compgen -W "global local swarm" -- "${cur##*=}" ) )
-			return
-			;;
-		type)
-			COMPREPLY=( $( compgen -W "builtin custom" -- "${cur##*=}" ) )
-			return
-			;;
-	esac
-
-	case "$prev" in
-		--filter|-f)
-			COMPREPLY=( $( compgen -S = -W "driver id label name scope type" -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--format)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--filter -f --format --help --no-trunc --quiet -q" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_network_prune() {
-	case "$prev" in
-		--filter)
-			COMPREPLY=( $( compgen -W "until" -S = -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--force -f --filter --help" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_network_rm() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_networks --filter type=custom
-	esac
-}
-
-_docker_network() {
-	local subcommands="
-		connect
-		create
-		disconnect
-		inspect
-		ls
-		prune
-		rm
-	"
-	local aliases="
-		list
-		remove
-	"
-	__docker_subcommands "$subcommands $aliases" && return
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			COMPREPLY=( $( compgen -W "$subcommands" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_service() {
-	local subcommands="
-		create
-		inspect
-		logs
-		ls
-		rm
-		scale
-		ps
-		update
-	"
-
-	local aliases="
-		list
-		remove
-	"
-	__docker_subcommands "$subcommands $aliases" && return
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			COMPREPLY=( $( compgen -W "$subcommands" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_service_create() {
-	_docker_service_update_and_create
-}
-
-_docker_service_inspect() {
-	case "$prev" in
-		--format|-f)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--format -f --help --pretty" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_services
-	esac
-}
-
-_docker_service_logs() {
-	case "$prev" in
-		--since|--tail)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--follow -f --help --no-resolve --no-task-ids --no-trunc --since --tail --timestamps -t" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag '--since|--tail')
-			if [ $cword -eq $counter ]; then
-				__docker_complete_services_and_tasks
-			fi
-			;;
-	esac
-}
-
-_docker_service_list() {
-	_docker_service_ls
-}
-
-_docker_service_ls() {
-	local key=$(__docker_map_key_of_current_option '--filter|-f')
-	case "$key" in
-		id)
-			__docker_complete_services --cur "${cur##*=}" --id
-			return
-			;;
-		mode)
-			COMPREPLY=( $( compgen -W "global replicated" -- "${cur##*=}" ) )
-			return
-			;;
-		name)
-			__docker_complete_services --cur "${cur##*=}" --name
-			return
-			;;
-	esac
-
-	case "$prev" in
-		--filter|-f)
-			COMPREPLY=( $( compgen -W "id label mode name" -S = -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--format)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--filter -f --format --help --quiet -q" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_service_remove() {
-	_docker_service_rm
-}
-
-_docker_service_rm() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_services
-	esac
-}
-
-_docker_service_scale() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_services
-			__docker_append_to_completions "="
-			__docker_nospace
-			;;
-	esac
-}
-
-_docker_service_ps() {
-	local key=$(__docker_map_key_of_current_option '--filter|-f')
-	case "$key" in
-		desired-state)
-			COMPREPLY=( $( compgen -W "accepted running shutdown" -- "${cur##*=}" ) )
-			return
-			;;
-		name)
-			__docker_complete_services --cur "${cur##*=}" --name
-			return
-			;;
-		node)
-			__docker_complete_nodes --cur "${cur##*=}" --add self
-			return
-			;;
-	esac
-
-	case "$prev" in
-		--filter|-f)
-			COMPREPLY=( $( compgen -W "desired-state id name node" -S = -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--format)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--filter -f --format --help --no-resolve --no-trunc --quiet -q" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag '--filter|-f')
-			if [ $cword -eq $counter ]; then
-				__docker_complete_services
-			fi
-			;;
-	esac
-}
-
-_docker_service_update() {
-	_docker_service_update_and_create
-}
-
-# _docker_service_update_and_create is the combined completion for `docker service create`
-# and `docker service update`
-_docker_service_update_and_create() {
-	local options_with_args="
-		--endpoint-mode
-		--env -e
-		--force
-		--health-cmd
-		--health-interval
-		--health-retries
-		--health-start-period
-		--health-timeout
-		--hostname
-		--label -l
-		--limit-cpu
-		--limit-memory
-		--log-driver
-		--log-opt
-		--mount
-		--network
-		--replicas
-		--reserve-cpu
-		--reserve-memory
-		--restart-condition
-		--restart-delay
-		--restart-max-attempts
-		--restart-window
-		--rollback-delay
-		--rollback-failure-action
-		--rollback-max-failure-ratio
-		--rollback-monitor
-		--rollback-parallelism
-		--stop-grace-period
-		--stop-signal
-		--update-delay
-		--update-failure-action
-		--update-max-failure-ratio
-		--update-monitor
-		--update-parallelism
-		--user -u
-		--workdir -w
-	"
-
-	local boolean_options="
-		--help
-		--no-healthcheck
-		--read-only
-		--tty -t
-		--with-registry-auth
-	"
-
-	__docker_complete_log_driver_options && return
-
-	if [ "$subcommand" = "create" ] ; then
-		options_with_args="$options_with_args
-			--constraint
-			--container-label
-			--dns
-			--dns-option
-			--dns-search
-			--env-file
-			--group
-			--host
-			--mode
-			--name
-			--placement-pref
-			--publish -p
-			--secret
-		"
-
-		case "$prev" in
-			--env-file)
-				_filedir
-				return
-				;;
-			--group)
-				COMPREPLY=( $(compgen -g -- "$cur") )
-				return
-				;;
-			--host)
-				case "$cur" in
-					*:)
-						__docker_complete_resolved_hostname
-						return
-						;;
-				esac
-				;;
-			--mode)
-				COMPREPLY=( $( compgen -W "global replicated" -- "$cur" ) )
-				return
-				;;
-			--placement-pref)
-				COMPREPLY=( $( compgen -W "spread" -S = -- "$cur" ) )
-				__docker_nospace
-				return
-				;;
-			--secret)
-				__docker_complete_secrets
-				return
-				;;
-		esac
-	fi
-	if [ "$subcommand" = "update" ] ; then
-		options_with_args="$options_with_args
-			--arg
-			--constraint-add
-			--constraint-rm
-			--container-label-add
-			--container-label-rm
-			--dns-add
-			--dns-option-add
-			--dns-option-rm
-			--dns-rm
-			--dns-search-add
-			--dns-search-rm
-			--group-add
-			--group-rm
-			--host-add
-			--host-rm
-			--image
-			--placement-pref-add
-			--placement-pref-rm
-			--publish-add
-			--publish-rm
-			--rollback
-			--secret-add
-			--secret-rm
-		"
-
-		case "$prev" in
-			--group-add|--group-rm)
-				COMPREPLY=( $(compgen -g -- "$cur") )
-				return
-				;;
-			--host-add|--host-rm)
-				case "$cur" in
-					*:)
-						__docker_complete_resolved_hostname
-						return
-						;;
-				esac
-				;;
-			--image)
-				__docker_complete_image_repos_and_tags
-				return
-				;;
-			--placement-pref-add|--placement-pref-rm)
-				COMPREPLY=( $( compgen -W "spread" -S = -- "$cur" ) )
-				__docker_nospace
-				return
-				;;
-			--secret-add|--secret-rm)
-				__docker_complete_secrets
-				return
-				;;
-		esac
-	fi
-
-	local strategy=$(__docker_map_key_of_current_option '--placement-pref|--placement-pref-add|--placement-pref-rm')
-	case "$strategy" in
-		spread)
-			COMPREPLY=( $( compgen -W "engine.labels node.labels" -S . -- "${cur##*=}" ) )
-			__docker_nospace
-			return
-			;;
-	esac
-
-	case "$prev" in
-		--endpoint-mode)
-			COMPREPLY=( $( compgen -W "dnsrr vip" -- "$cur" ) )
-			return
-			;;
-		--env|-e)
-			# we do not append a "=" here because "-e VARNAME" is legal systax, too
-			COMPREPLY=( $( compgen -e -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--log-driver)
-			__docker_complete_log_drivers
-			return
-			;;
-		--log-opt)
-			__docker_complete_log_options
-			return
-			;;
-		--network)
-			__docker_complete_networks
-			return
-			;;
-		--restart-condition)
-			COMPREPLY=( $( compgen -W "any none on-failure" -- "$cur" ) )
-			return
-			;;
-		--rollback-failure-action)
-			COMPREPLY=( $( compgen -W "continue pause" -- "$cur" ) )
-			return
-			;;
-		--stop-signal)
-			__docker_complete_signals
-			return
-			;;
-		--update-failure-action)
-			COMPREPLY=( $( compgen -W "continue pause rollback" -- "$cur" ) )
-			return
-			;;
-		--user|-u)
-			__docker_complete_user_group
-			return
-			;;
-		$(__docker_to_extglob "$options_with_args") )
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
-			;;
-		*)
-			local counter=$( __docker_pos_first_nonflag $( __docker_to_alternatives "$options_with_args" ) )
-			if [ "$subcommand" = "update" ] ; then
-				if [ $cword -eq $counter ]; then
-					__docker_complete_services
-				fi
-			else
-				if [ $cword -eq $counter ]; then
-					__docker_complete_images
-				fi
-			fi
-			;;
-	esac
-}
-
-_docker_swarm() {
-	local subcommands="
-		init
-		join
-		join-token
-		leave
-		unlock
-		unlock-key
-		update
-	"
-	__docker_subcommands "$subcommands" && return
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			COMPREPLY=( $( compgen -W "$subcommands" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_swarm_init() {
-	case "$prev" in
-		--advertise-addr)
-			if [[ $cur == *: ]] ; then
-				COMPREPLY=( $( compgen -W "2377" -- "${cur##*:}" ) )
-			else
-				__docker_complete_local_interfaces
-				__docker_nospace
-			fi
-			return
-			;;
-		--availability)
-			COMPREPLY=( $( compgen -W "active drain pause" -- "$cur" ) )
-			return
-			;;
-		--cert-expiry|--dispatcher-heartbeat|--external-ca|--max-snapshots|--snapshot-interval|--task-history-limit)
-			return
-			;;
-		--listen-addr)
-			if [[ $cur == *: ]] ; then
-				COMPREPLY=( $( compgen -W "2377" -- "${cur##*:}" ) )
-			else
-				__docker_complete_local_interfaces --add 0.0.0.0
-				__docker_nospace
-			fi
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--advertise-addr --data-path-addr --autolock --availability --cert-expiry --dispatcher-heartbeat --external-ca --force-new-cluster --help --listen-addr --max-snapshots --snapshot-interval --task-history-limit" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_swarm_join() {
-	case "$prev" in
-		--advertise-addr)
-			if [[ $cur == *: ]] ; then
-				COMPREPLY=( $( compgen -W "2377" -- "${cur##*:}" ) )
-			else
-				__docker_complete_local_interfaces
-				__docker_nospace
-			fi
-			return
-			;;
-		--listen-addr)
-			if [[ $cur == *: ]] ; then
-				COMPREPLY=( $( compgen -W "2377" -- "${cur##*:}" ) )
-			else
-				__docker_complete_local_interfaces --add 0.0.0.0
-				__docker_nospace
-			fi
-			return
-			;;
-		--availability)
-			COMPREPLY=( $( compgen -W "active drain pause" -- "$cur" ) )
-			return
-			;;
-		--token)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--advertise-addr --data-path-addr --availability --help --listen-addr --token" -- "$cur" ) )
-			;;
-		*:)
-			COMPREPLY=( $( compgen -W "2377" -- "${cur##*:}" ) )
-			;;
-	esac
-}
-
-_docker_swarm_join_token() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help --quiet -q --rotate" -- "$cur" ) )
-			;;
-		*)
-			local counter=$( __docker_pos_first_nonflag )
-			if [ $cword -eq $counter ]; then
-				COMPREPLY=( $( compgen -W "manager worker" -- "$cur" ) )
-			fi
-			;;
-	esac
-}
-
-_docker_swarm_leave() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--force -f --help" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_swarm_unlock() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_swarm_unlock_key() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help --quiet -q --rotate" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_swarm_update() {
-	case "$prev" in
-		--cert-expiry|--dispatcher-heartbeat|--external-ca|--max-snapshots|--snapshot-interval|--task-history-limit)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--autolock --cert-expiry --dispatcher-heartbeat --external-ca --help --max-snapshots --snapshot-interval --task-history-limit" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_node() {
-	local subcommands="
-		demote
-		inspect
-		ls
-		promote
-		rm
-		ps
-		update
-	"
-	local aliases="
-		list
-		remove
-	"
-	__docker_subcommands "$subcommands $aliases" && return
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			COMPREPLY=( $( compgen -W "$subcommands" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_node_demote() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_nodes --filter role=manager
-	esac
-}
-
-_docker_node_inspect() {
-	case "$prev" in
-		--format|-f)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--format -f --help --pretty" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_nodes --add self
-	esac
-}
-
-_docker_node_list() {
-	_docker_node_ls
-}
-
-_docker_node_ls() {
-	local key=$(__docker_map_key_of_current_option '--filter|-f')
-	case "$key" in
-		id)
-			__docker_complete_nodes --cur "${cur##*=}" --id
-			return
-			;;
-		membership)
-			COMPREPLY=( $( compgen -W "accepted pending" -- "${cur##*=}" ) )
-			return
-			;;
-		name)
-			__docker_complete_nodes --cur "${cur##*=}" --name
-			return
-			;;
-		role)
-			COMPREPLY=( $( compgen -W "manager worker" -- "${cur##*=}" ) )
-			return
-			;;
-	esac
-
-	case "$prev" in
-		--filter|-f)
-			COMPREPLY=( $( compgen -W "id label membership name role" -S = -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--format)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--filter -f --format --help --quiet -q" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_node_promote() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_nodes --filter role=worker
-	esac
-}
-
-_docker_node_remove() {
-	_docker_node_rm
-}
-
-_docker_node_rm() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--force -f --help" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_nodes
-	esac
-}
-
-_docker_node_ps() {
-	local key=$(__docker_map_key_of_current_option '--filter|-f')
-	case "$key" in
-		desired-state)
-			COMPREPLY=( $( compgen -W "accepted running shutdown" -- "${cur##*=}" ) )
-			return
-			;;
-		name)
-			__docker_complete_services --cur "${cur##*=}" --name
-			return
-			;;
-	esac
-
-	case "$prev" in
-		--filter|-f)
-			COMPREPLY=( $( compgen -W "desired-state id label name" -S = -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--format)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--filter -f --format --help --no-resolve --no-trunc --quiet -q" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_nodes --add self
-			;;
-	esac
-}
-
-_docker_node_update() {
-	case "$prev" in
-		--availability)
-			COMPREPLY=( $( compgen -W "active drain pause" -- "$cur" ) )
-			return
-			;;
-		--role)
-			COMPREPLY=( $( compgen -W "manager worker" -- "$cur" ) )
-			return
-			;;
-		--label-add|--label-rm)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--availability --help --label-add --label-rm --role" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag '--availability|--label-add|--label-rm|--role')
-			if [ $cword -eq $counter ]; then
-				__docker_complete_nodes
-			fi
-			;;
-	esac
-}
-
-_docker_pause() {
-	_docker_container_pause
-}
-
-_docker_plugin() {
-	local subcommands="
-		create
-		disable
-		enable
-		inspect
-		install
-		ls
-		push
-		rm
-		set
-		upgrade
-	"
-	local aliases="
-		list
-		remove
-	"
-	__docker_subcommands "$subcommands $aliases" && return
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			COMPREPLY=( $( compgen -W "$subcommands" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_plugin_create() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--compress --help" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-			if [ $cword -eq $counter ]; then
-				# reponame
-				return
-			elif [ $cword -eq  $((counter + 1)) ]; then
-				_filedir -d
-			fi
-			;;
-	esac
-}
-
-_docker_plugin_disable() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--force -f --help" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-			if [ $cword -eq $counter ]; then
-				__docker_complete_plugins_installed --filter enabled=true
-			fi
-			;;
-	esac
-}
-
-_docker_plugin_enable() {
-	case "$prev" in
-		--timeout)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help --timeout" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag '--timeout')
-			if [ $cword -eq $counter ]; then
-				__docker_complete_plugins_installed --filter enabled=false
-			fi
-			;;
-	esac
-}
-
-_docker_plugin_inspect() {
-	case "$prev" in
-		--format|f)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--format -f --help" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_plugins_installed
-			;;
-	esac
-}
-
-_docker_plugin_install() {
-	case "$prev" in
-		--alias)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--alias --disable --disable-content-trust=false --grant-all-permissions --help" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_plugin_list() {
-	_docker_plugin_ls
-}
-
-_docker_plugin_ls() {
-	local key=$(__docker_map_key_of_current_option '--filter|-f')
-	case "$key" in
-		capability)
-			COMPREPLY=( $( compgen -W "authz ipamdriver networkdriver volumedriver" -- "${cur##*=}" ) )
-			return
-			;;
-		enabled)
-			COMPREPLY=( $( compgen -W "false true" -- "${cur##*=}" ) )
-			return
-			;;
-	esac
-
-	case "$prev" in
-		--filter|-f)
-			COMPREPLY=( $( compgen -S = -W "capability enabled" -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--format)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--filter -f --format --help --no-trunc --quiet -q" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_plugin_push() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-			if [ $cword -eq $counter ]; then
-				__docker_complete_plugins_installed
-			fi
-			;;
-	esac
-}
-
-_docker_plugin_remove() {
-	_docker_plugin_rm
-}
-
-_docker_plugin_rm() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--force -f --help" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_plugins_installed
-			;;
-	esac
-}
-
-_docker_plugin_set() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-			if [ $cword -eq $counter ]; then
-				__docker_complete_plugins_installed
-			fi
-			;;
-	esac
-}
-
-_docker_plugin_upgrade() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--disable-content-trust --grant-all-permissions --help --skip-remote-check" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag)
-			if [ $cword -eq $counter ]; then
-				__docker_complete_plugins_installed
-				__ltrim_colon_completions "$cur"
-			elif [ $cword -eq  $((counter + 1)) ]; then
-				local plugin_images="$(__docker_plugins_installed)"
-				COMPREPLY=( $(compgen -S : -W "${plugin_images%:*}" -- "$cur") )
-				__docker_nospace
-			fi
-			;;
-	esac
-}
-
-
-_docker_port() {
-	_docker_container_port
-}
-
-_docker_ps() {
-	_docker_container_ls
-}
-
-_docker_pull() {
-	_docker_image_pull
-}
-
-_docker_push() {
-	_docker_image_push
-}
-
-_docker_rename() {
-	_docker_container_rename
-}
-
-_docker_restart() {
-	_docker_container_restart
-}
-
-_docker_rm() {
-	_docker_container_rm
-}
-
-_docker_rmi() {
-	_docker_image_rm
-}
-
-_docker_run() {
-	_docker_container_run
-}
-
-_docker_save() {
-	_docker_image_save
-}
-
-
-_docker_secret() {
-	local subcommands="
-		create
-		inspect
-		ls
-		rm
-	"
-	local aliases="
-		list
-		remove
-	"
-	__docker_subcommands "$subcommands $aliases" && return
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			COMPREPLY=( $( compgen -W "$subcommands" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_secret_create() {
-	case "$prev" in
-		--label|-l)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help --label -l" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_secret_inspect() {
-	case "$prev" in
-		--format|-f)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--format -f --help" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_secrets
-			;;
-	esac
-}
-
-_docker_secret_list() {
-	_docker_secret_ls
-}
-
-_docker_secret_ls() {
-	local key=$(__docker_map_key_of_current_option '--filter|-f')
-	case "$key" in
-		id)
-			__docker_complete_secrets --cur "${cur##*=}" --id
-			return
-			;;
-		name)
-			__docker_complete_secrets --cur "${cur##*=}" --name
-			return
-			;;
-	esac
-
-	case "$prev" in
-		--filter|-f)
-			COMPREPLY=( $( compgen -S = -W "id label name" -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--format)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--format --filter -f --help --quiet -q" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_secret_remove() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_secrets
-			;;
-	esac
-}
-
-_docker_secret_rm() {
-	_docker_secret_remove
-}
-
-
-
-_docker_search() {
-	local key=$(__docker_map_key_of_current_option '--filter|-f')
-	case "$key" in
-		is-automated)
-			COMPREPLY=( $( compgen -W "false true" -- "${cur##*=}" ) )
-			return
-			;;
-		is-official)
-			COMPREPLY=( $( compgen -W "false true" -- "${cur##*=}" ) )
-			return
-			;;
-	esac
-
-	case "$prev" in
-		--filter|-f)
-			COMPREPLY=( $( compgen -S = -W "is-automated is-official stars" -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--limit)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--filter --help --limit --no-trunc" -- "$cur" ) )
-			;;
-	esac
-}
-
-
-_docker_stack() {
-	local subcommands="
-		deploy
-		ls
-		ps
-		rm
-		services
-	"
-	local aliases="
-		down
-		list
-		remove
-		up
-	"
-	__docker_subcommands "$subcommands $aliases" && return
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			COMPREPLY=( $( compgen -W "$subcommands" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_stack_deploy() {
-	case "$prev" in
-		--bundle-file)
-			if __docker_daemon_is_experimental ; then
-				_filedir dab
-				return
-			fi
-			;;
-		--compose-file|-c)
-			_filedir yml
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			local options="--compose-file -c --help --prune --with-registry-auth"
-			__docker_daemon_is_experimental && options+=" --bundle-file"
-			COMPREPLY=( $( compgen -W "$options" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_stack_down() {
-	_docker_stack_rm
-}
-
-_docker_stack_list() {
-	_docker_stack_ls
-}
-
-_docker_stack_ls() {
-	case "$prev" in
-		--format)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--format --help" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_stack_ps() {
-	local key=$(__docker_map_key_of_current_option '--filter|-f')
-	case "$key" in
-		desired-state)
-			COMPREPLY=( $( compgen -W "accepted running shutdown" -- "${cur##*=}" ) )
-			return
-			;;
-		id)
-			__docker_complete_stacks --cur "${cur##*=}" --id
-			return
-			;;
-		name)
-			__docker_complete_stacks --cur "${cur##*=}" --name
-			return
-			;;
-	esac
-
-	case "$prev" in
-		--filter|-f)
-			COMPREPLY=( $( compgen -S = -W "id name desired-state" -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--format)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--all -a --filter -f --format --help --no-resolve --no-trunc --quiet -q" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag '--filter|-f')
-			if [ $cword -eq $counter ]; then
-				__docker_complete_stacks
-			fi
-			;;
-	esac
-}
-
-_docker_stack_remove() {
-	_docker_stack_rm
-}
-
-_docker_stack_rm() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_stacks
-	esac
-}
-
-_docker_stack_services() {
-	local key=$(__docker_map_key_of_current_option '--filter|-f')
-	case "$key" in
-		id)
-			__docker_complete_services --cur "${cur##*=}" --id
-			return
-			;;
-		label)
-			return
-			;;
-		name)
-			__docker_complete_services --cur "${cur##*=}" --name
-			return
-			;;
-	esac
-
-	case "$prev" in
-		--filter|-f)
-			COMPREPLY=( $( compgen -S = -W "id label name" -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--format)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--filter -f --format --help --quiet -q" -- "$cur" ) )
-			;;
-		*)
-			local counter=$(__docker_pos_first_nonflag '--filter|-f|--format')
-			if [ $cword -eq $counter ]; then
-				__docker_complete_stacks
-			fi
-			;;
-	esac
-}
-
-_docker_stack_up() {
-	_docker_stack_deploy
-}
-
-
-_docker_start() {
-	_docker_container_start
-}
-
-_docker_stats() {
-	_docker_container_stats
-}
-
-_docker_stop() {
-	_docker_container_stop
-}
-
-
-_docker_system() {
-	local subcommands="
-		df
-		events
-		info
-		prune
-	"
-	__docker_subcommands "$subcommands $aliases" && return
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			COMPREPLY=( $( compgen -W "$subcommands" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_system_df() {
-	case "$prev" in
-		--format)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--format --help --verbose -v" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_system_events() {
-	local key=$(__docker_map_key_of_current_option '-f|--filter')
-	case "$key" in
-		container)
-			__docker_complete_containers_all --cur "${cur##*=}"
-			return
-			;;
-		daemon)
-			local name=$(__docker_q info | sed -n 's/^\(ID\|Name\): //p')
-			COMPREPLY=( $( compgen -W "$name" -- "${cur##*=}" ) )
-			return
-			;;
-		event)
-			COMPREPLY=( $( compgen -W "
-				attach
-				commit
-				connect
-				copy
-				create
-				delete
-				destroy
-				detach
-				die
-				disconnect
-				exec_create
-				exec_detach
-				exec_start
-				export
-				health_status
-				import
-				kill
-				load
-				mount
-				oom
-				pause
-				pull
-				push
-				reload
-				rename
-				resize
-				restart
-				save
-				start
-				stop
-				tag
-				top
-				unmount
-				unpause
-				untag
-				update
-			" -- "${cur##*=}" ) )
-			return
-			;;
-		image)
-			cur="${cur##*=}"
-			__docker_complete_images
-			return
-			;;
-		network)
-			__docker_complete_networks --cur "${cur##*=}"
-			return
-			;;
-		type)
-			COMPREPLY=( $( compgen -W "container daemon image network volume" -- "${cur##*=}" ) )
-			return
-			;;
-		volume)
-			__docker_complete_volumes --cur "${cur##*=}"
-			return
-			;;
-	esac
-
-	case "$prev" in
-		--filter|-f)
-			COMPREPLY=( $( compgen -S = -W "container daemon event image label network type volume" -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--since|--until)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--filter -f --help --since --until --format" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_system_info() {
-	case "$prev" in
-		--format|-f)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--format -f --help" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_system_prune() {
-	case "$prev" in
-		--filter)
-			COMPREPLY=( $( compgen -W "until" -S = -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--all -a --force -f --filter --help" -- "$cur" ) )
-			;;
-	esac
-}
-
-
-_docker_tag() {
-	_docker_image_tag
-}
-
-_docker_unpause() {
-	_docker_container_unpause
-}
-
-_docker_update() {
-	_docker_container_update
-}
-
-_docker_top() {
-	_docker_container_top
-}
-
-_docker_version() {
-	case "$prev" in
-		--format|-f)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--format -f --help" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_volume_create() {
-	case "$prev" in
-		--driver|-d)
-			__docker_complete_plugins_bundled --type Volume
-			return
-			;;
-		--label|--opt|-o)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--driver -d --help --label --opt -o" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_volume_inspect() {
-	case "$prev" in
-		--format|-f)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--format -f --help" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_volumes
-			;;
-	esac
-}
-
-_docker_volume_list() {
-	_docker_volume_ls
-}
-
-_docker_volume_ls() {
-	local key=$(__docker_map_key_of_current_option '--filter|-f')
-	case "$key" in
-		dangling)
-			COMPREPLY=( $( compgen -W "true false" -- "${cur##*=}" ) )
-			return
-			;;
-		driver)
-			__docker_complete_plugins_bundled --cur "${cur##*=}" --type Volume
-			return
-			;;
-		name)
-			__docker_complete_volumes --cur "${cur##*=}"
-			return
-			;;
-	esac
-
-	case "$prev" in
-		--filter|-f)
-			COMPREPLY=( $( compgen -S = -W "dangling driver label name" -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--format)
-			return
-			;;
-	esac
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--filter -f --format --help --quiet -q" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_volume_prune() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--force -f --help" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_volume_remove() {
-	_docker_volume_rm
-}
-
-_docker_volume_rm() {
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--force -f --help" -- "$cur" ) )
-			;;
-		*)
-			__docker_complete_volumes
-			;;
-	esac
-}
-
-_docker_volume() {
-	local subcommands="
-		create
-		inspect
-		ls
-		prune
-		rm
-	"
-	local aliases="
-		list
-		remove
-	"
-	__docker_subcommands "$subcommands $aliases" && return
-
-	case "$cur" in
-		-*)
-			COMPREPLY=( $( compgen -W "--help" -- "$cur" ) )
-			;;
-		*)
-			COMPREPLY=( $( compgen -W "$subcommands" -- "$cur" ) )
-			;;
-	esac
-}
-
-_docker_wait() {
-	_docker_container_wait
-}
-
-_docker() {
-	local previous_extglob_setting=$(shopt -p extglob)
-	shopt -s extglob
-
-	local management_commands=(
-		container
-		image
-		network
-		node
-		plugin
-		secret
-		service
-		stack
-		system
-		volume
-	)
-
-	local top_level_commands=(
-		build
-		login
-		logout
-		run
-		search
-		version
-	)
-
-	local legacy_commands=(
-		attach
-		commit
-		cp
-		create
-		diff
-		events
-		exec
-		export
-		history
-		images
-		import
-		info
-		inspect
-		kill
-		load
-		logs
-		pause
-		port
-		ps
-		pull
-		push
-		rename
-		restart
-		rm
-		rmi
-		save
-		start
-		stats
-		stop
-		swarm
-		tag
-		top
-		unpause
-		update
-		wait
-	)
-
-	local experimental_commands=(
-		checkpoint
-		deploy
-	)
-
-	local commands=(${management_commands[*]} ${top_level_commands[*]})
-	[ -z "$DOCKER_HIDE_LEGACY_COMMANDS" ] && commands+=(${legacy_commands[*]})
-
-	# These options are valid as global options for all client commands
-	# and valid as command options for `docker daemon`
-	local global_boolean_options="
-		--debug -D
-		--tls
-		--tlsverify
-	"
-	local global_options_with_args="
-		--config
-		--host -H
-		--log-level -l
-		--tlscacert
-		--tlscert
-		--tlskey
-	"
-
-	local host config daemon_os
-
-	COMPREPLY=()
-	local cur prev words cword
-	_get_comp_words_by_ref -n : cur prev words cword
-
-	local command='docker' command_pos=0 subcommand_pos
-	local counter=1
-	while [ $counter -lt $cword ]; do
-		case "${words[$counter]}" in
-			# save host so that completion can use custom daemon
-			--host|-H)
-				(( counter++ ))
-				host="${words[$counter]}"
-				;;
-			# save config so that completion can use custom configuration directories
-			--config)
-				(( counter++ ))
-				config="${words[$counter]}"
-				;;
-			$(__docker_to_extglob "$global_options_with_args") )
-				(( counter++ ))
-				;;
-			-*)
-				;;
-			=)
-				(( counter++ ))
-				;;
-			*)
-				command="${words[$counter]}"
-				command_pos=$counter
-				break
-				;;
-		esac
-		(( counter++ ))
-	done
-
-	local binary="${words[0]}"
-	if [[ $binary == ?(*/)dockerd ]] ; then
-		# for the dockerd binary, we reuse completion of `docker daemon`.
-		# dockerd does not have subcommands and global options.
-		command=daemon
-		command_pos=0
-	fi
-
-	local completions_func=_docker_${command//-/_}
-	declare -F $completions_func >/dev/null && $completions_func
-
-	eval "$previous_extglob_setting"
-	return 0
-}
-
-eval "$__docker_previous_extglob_setting"
-unset __docker_previous_extglob_setting
-
-complete -F _docker docker docker.exe dockerd dockerd.exe
diff --git a/components/engine/contrib/completion/fish/docker.fish b/components/engine/contrib/completion/fish/docker.fish
deleted file mode 100644
index 38957b8b77..0000000000
--- a/components/engine/contrib/completion/fish/docker.fish
+++ /dev/null
@@ -1,409 +0,0 @@
-# docker.fish - docker completions for fish shell
-#
-# This file is generated by gen_docker_fish_completions.py from:
-# https://github.com/barnybug/docker-fish-completion
-#
-# To install the completions:
-# mkdir -p ~/.config/fish/completions
-# cp docker.fish ~/.config/fish/completions
-#
-# Completion supported:
-# - parameters
-# - commands
-# - containers
-# - images
-# - repositories
-
-function __fish_docker_no_subcommand --description 'Test if docker has yet to be given the subcommand'
-    for i in (commandline -opc)
-        if contains -- $i attach build commit cp create diff events exec export history images import info inspect kill load login logout logs pause port ps pull push rename restart rm rmi run save search start stop tag top unpause version wait stats
-            return 1
-        end
-    end
-    return 0
-end
-
-function __fish_print_docker_containers --description 'Print a list of docker containers' -a select
-    switch $select
-        case running
-            docker ps -a --no-trunc --filter status=running --format "{{.ID}}\n{{.Names}}" | tr ',' '\n'
-        case stopped
-            docker ps -a --no-trunc --filter status=exited --format "{{.ID}}\n{{.Names}}" | tr ',' '\n'
-        case all
-            docker ps -a --no-trunc --format "{{.ID}}\n{{.Names}}" | tr ',' '\n'
-    end
-end
-
-function __fish_print_docker_images --description 'Print a list of docker images'
-    docker images --format "{{.Repository}}:{{.Tag}}" | command grep -v '<none>'
-end
-
-function __fish_print_docker_repositories --description 'Print a list of docker repositories'
-    docker images --format "{{.Repository}}" | command grep -v '<none>' | command sort | command uniq
-end
-
-# common options
-complete -c docker -f -n '__fish_docker_no_subcommand' -l api-cors-header -d "Set CORS headers in the Engine API. Default is cors disabled"
-complete -c docker -f -n '__fish_docker_no_subcommand' -s b -l bridge -d 'Attach containers to a pre-existing network bridge'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l bip -d "Use this CIDR notation address for the network bridge's IP, not compatible with -b"
-complete -c docker -f -n '__fish_docker_no_subcommand' -s D -l debug -d 'Enable debug mode'
-complete -c docker -f -n '__fish_docker_no_subcommand' -s d -l daemon -d 'Enable daemon mode'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l dns -d 'Force Docker to use specific DNS servers'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l dns-opt -d 'Force Docker to use specific DNS options'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l dns-search -d 'Force Docker to use specific DNS search domains'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l exec-opt -d 'Set runtime execution options'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l fixed-cidr -d 'IPv4 subnet for fixed IPs (e.g. 10.20.0.0/16)'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l fixed-cidr-v6 -d 'IPv6 subnet for fixed IPs (e.g.: 2001:a02b/48)'
-complete -c docker -f -n '__fish_docker_no_subcommand' -s G -l group -d 'Group to assign the unix socket specified by -H when running in daemon mode'
-complete -c docker -f -n '__fish_docker_no_subcommand' -s g -l graph -d 'Path to use as the root of the Docker runtime'
-complete -c docker -f -n '__fish_docker_no_subcommand' -s H -l host -d 'The socket(s) to bind to in daemon mode or connect to in client mode, specified using one or more tcp://host:port, unix:///path/to/socket, fd://* or fd://socketfd.'
-complete -c docker -f -n '__fish_docker_no_subcommand' -s h -l help -d 'Print usage'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l icc -d 'Allow unrestricted inter-container and Docker daemon host communication'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l insecure-registry -d 'Enable insecure communication with specified registries (no certificate verification for HTTPS and enable HTTP fallback) (e.g., localhost:5000 or 10.20.0.0/16)'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l ip -d 'Default IP address to use when binding container ports'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l ip-forward -d 'Enable net.ipv4.ip_forward and IPv6 forwarding if --fixed-cidr-v6 is defined. IPv6 forwarding may interfere with your existing IPv6 configuration when using Router Advertisement.'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l ip-masq -d "Enable IP masquerading for bridge's IP range"
-complete -c docker -f -n '__fish_docker_no_subcommand' -l iptables -d "Enable Docker's addition of iptables rules"
-complete -c docker -f -n '__fish_docker_no_subcommand' -l ipv6 -d 'Enable IPv6 networking'
-complete -c docker -f -n '__fish_docker_no_subcommand' -s l -l log-level -d 'Set the logging level ("debug", "info", "warn", "error", "fatal")'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l label -d 'Set key=value labels to the daemon (displayed in `docker info`)'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l mtu -d 'Set the containers network MTU'
-complete -c docker -f -n '__fish_docker_no_subcommand' -s p -l pidfile -d 'Path to use for daemon PID file'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l registry-mirror -d 'Specify a preferred Docker registry mirror'
-complete -c docker -f -n '__fish_docker_no_subcommand' -s s -l storage-driver -d 'Force the Docker runtime to use a specific storage driver'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l selinux-enabled -d 'Enable selinux support. SELinux does not presently support the BTRFS storage driver'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l storage-opt -d 'Set storage driver options'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l tls -d 'Use TLS; implied by --tlsverify'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l tlscacert -d 'Trust only remotes providing a certificate signed by the CA given here'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l tlscert -d 'Path to TLS certificate file'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l tlskey -d 'Path to TLS key file'
-complete -c docker -f -n '__fish_docker_no_subcommand' -l tlsverify -d 'Use TLS and verify the remote (daemon: verify client, client: verify daemon)'
-complete -c docker -f -n '__fish_docker_no_subcommand' -s v -l version -d 'Print version information and quit'
-
-# subcommands
-# attach
-complete -c docker -f -n '__fish_docker_no_subcommand' -a attach -d 'Attach to a running container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from attach' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from attach' -l no-stdin -d 'Do not attach STDIN'
-complete -c docker -A -f -n '__fish_seen_subcommand_from attach' -l sig-proxy -d 'Proxy all received signals to the process (non-TTY mode only). SIGCHLD, SIGKILL, and SIGSTOP are not proxied.'
-complete -c docker -A -f -n '__fish_seen_subcommand_from attach' -a '(__fish_print_docker_containers running)' -d "Container"
-
-# build
-complete -c docker -f -n '__fish_docker_no_subcommand' -a build -d 'Build an image from a Dockerfile'
-complete -c docker -A -f -n '__fish_seen_subcommand_from build' -s f -l file -d "Name of the Dockerfile(Default is 'Dockerfile' at context root)"
-complete -c docker -A -f -n '__fish_seen_subcommand_from build' -l force-rm -d 'Always remove intermediate containers, even after unsuccessful builds'
-complete -c docker -A -f -n '__fish_seen_subcommand_from build' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from build' -l no-cache -d 'Do not use cache when building the image'
-complete -c docker -A -f -n '__fish_seen_subcommand_from build' -l pull -d 'Always attempt to pull a newer version of the image'
-complete -c docker -A -f -n '__fish_seen_subcommand_from build' -s q -l quiet -d 'Suppress the build output and print image ID on success'
-complete -c docker -A -f -n '__fish_seen_subcommand_from build' -l rm -d 'Remove intermediate containers after a successful build'
-complete -c docker -A -f -n '__fish_seen_subcommand_from build' -s t -l tag -d 'Repository name (and optionally a tag) to be applied to the resulting image in case of success'
-
-# commit
-complete -c docker -f -n '__fish_docker_no_subcommand' -a commit -d "Create a new image from a container's changes"
-complete -c docker -A -f -n '__fish_seen_subcommand_from commit' -s a -l author -d 'Author (e.g., "John Hannibal Smith <hannibal@a-team.com>")'
-complete -c docker -A -f -n '__fish_seen_subcommand_from commit' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from commit' -s m -l message -d 'Commit message'
-complete -c docker -A -f -n '__fish_seen_subcommand_from commit' -s p -l pause -d 'Pause container during commit'
-complete -c docker -A -f -n '__fish_seen_subcommand_from commit' -a '(__fish_print_docker_containers all)' -d "Container"
-
-# cp
-complete -c docker -f -n '__fish_docker_no_subcommand' -a cp -d "Copy files/folders between a container and the local filesystem"
-complete -c docker -A -f -n '__fish_seen_subcommand_from cp' -l help -d 'Print usage'
-
-# create
-complete -c docker -f -n '__fish_docker_no_subcommand' -a create -d 'Create a new container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -s a -l attach -d 'Attach to STDIN, STDOUT or STDERR.'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l add-host -d 'Add a custom host-to-IP mapping (host:ip)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l cpu-shares -d 'CPU shares (relative weight)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l cap-add -d 'Add Linux capabilities'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l cap-drop -d 'Drop Linux capabilities'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l cidfile -d 'Write the container ID to the file'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l cpuset -d 'CPUs in which to allow execution (0-3, 0,1)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l device -d 'Add a host device to the container (e.g. --device=/dev/sdc:/dev/xvdc:rwm)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l device-cgroup-rule -d 'Add a rule to the cgroup allowed devices list (e.g. --device-cgroup-rule="c 13:37 rwm")'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l dns -d 'Set custom DNS servers'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l dns-opt -d "Set custom DNS options (Use --dns-opt='' if you don't wish to set options)"
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l dns-search -d "Set custom DNS search domains (Use --dns-search=. if you don't wish to set the search domain)"
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -s e -l env -d 'Set environment variables'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l entrypoint -d 'Overwrite the default ENTRYPOINT of the image'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l env-file -d 'Read in a line delimited file of environment variables'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l expose -d 'Expose a port or a range of ports (e.g. --expose=3300-3310) from the container without publishing it to your host'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l group-add -d 'Add additional groups to run as'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -s h -l hostname -d 'Container host name'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -s i -l interactive -d 'Keep STDIN open even if not attached'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l ipc -d 'Default is to create a private IPC namespace (POSIX SysV IPC) for the container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l link -d 'Add link to another container in the form of <name|id>:alias'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -s m -l memory -d 'Memory limit (format: <number>[<unit>], where unit = b, k, m or g)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l mac-address -d 'Container MAC address (e.g., 92:d0:c6:0a:29:33)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l memory-swap -d "Total memory usage (memory + swap), set '-1' to disable swap (format: <number>[<unit>], where unit = b, k, m or g)"
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l mount -d 'Attach a filesystem mount to the container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l name -d 'Assign a name to the container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l net -d 'Set the Network mode for the container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -s P -l publish-all -d 'Publish all exposed ports to random ports on the host interfaces'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -s p -l publish -d "Publish a container's port to the host"
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l pid -d 'Default is to create a private PID namespace for the container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l privileged -d 'Give extended privileges to this container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l read-only -d "Mount the container's root filesystem as read only"
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l restart -d 'Restart policy to apply when a container exits (no, on-failure[:max-retry], always)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l security-opt -d 'Security Options'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -s t -l tty -d 'Allocate a pseudo-TTY'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -s u -l user -d 'Username or UID'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -s v -l volume -d 'Bind mount a volume (e.g., from the host: -v /host:/container, from Docker: -v /container)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l volumes-from -d 'Mount volumes from the specified container(s)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -s w -l workdir -d 'Working directory inside the container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -a '(__fish_print_docker_images)' -d "Image"
-
-# diff
-complete -c docker -f -n '__fish_docker_no_subcommand' -a diff -d "Inspect changes on a container's filesystem"
-complete -c docker -A -f -n '__fish_seen_subcommand_from diff' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from diff' -a '(__fish_print_docker_containers all)' -d "Container"
-
-# events
-complete -c docker -f -n '__fish_docker_no_subcommand' -a events -d 'Get real time events from the server'
-complete -c docker -A -f -n '__fish_seen_subcommand_from events' -s f -l filter -d "Provide filter values (i.e., 'event=stop')"
-complete -c docker -A -f -n '__fish_seen_subcommand_from events' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from events' -l since -d 'Show all events created since timestamp'
-complete -c docker -A -f -n '__fish_seen_subcommand_from events' -l until -d 'Stream events until this timestamp'
-complete -c docker -A -f -n '__fish_seen_subcommand_from events' -l format -d 'Format the output using the given go template'
-
-# exec
-complete -c docker -f -n '__fish_docker_no_subcommand' -a exec -d 'Run a command in a running container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from exec' -s d -l detach -d 'Detached mode: run command in the background'
-complete -c docker -A -f -n '__fish_seen_subcommand_from exec' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from exec' -s i -l interactive -d 'Keep STDIN open even if not attached'
-complete -c docker -A -f -n '__fish_seen_subcommand_from exec' -s t -l tty -d 'Allocate a pseudo-TTY'
-complete -c docker -A -f -n '__fish_seen_subcommand_from exec' -a '(__fish_print_docker_containers running)' -d "Container"
-
-# export
-complete -c docker -f -n '__fish_docker_no_subcommand' -a export -d 'Stream the contents of a container as a tar archive'
-complete -c docker -A -f -n '__fish_seen_subcommand_from export' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from export' -a '(__fish_print_docker_containers all)' -d "Container"
-
-# history
-complete -c docker -f -n '__fish_docker_no_subcommand' -a history -d 'Show the history of an image'
-complete -c docker -A -f -n '__fish_seen_subcommand_from history' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from history' -l no-trunc -d "Don't truncate output"
-complete -c docker -A -f -n '__fish_seen_subcommand_from history' -s q -l quiet -d 'Only show numeric IDs'
-complete -c docker -A -f -n '__fish_seen_subcommand_from history' -a '(__fish_print_docker_images)' -d "Image"
-
-# images
-complete -c docker -f -n '__fish_docker_no_subcommand' -a images -d 'List images'
-complete -c docker -A -f -n '__fish_seen_subcommand_from images' -s a -l all -d 'Show all images (by default filter out the intermediate image layers)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from images' -s f -l filter -d "Provide filter values (i.e., 'dangling=true')"
-complete -c docker -A -f -n '__fish_seen_subcommand_from images' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from images' -l no-trunc -d "Don't truncate output"
-complete -c docker -A -f -n '__fish_seen_subcommand_from images' -s q -l quiet -d 'Only show numeric IDs'
-complete -c docker -A -f -n '__fish_seen_subcommand_from images' -a '(__fish_print_docker_repositories)' -d "Repository"
-
-# import
-complete -c docker -f -n '__fish_docker_no_subcommand' -a import -d 'Create a new filesystem image from the contents of a tarball'
-complete -c docker -A -f -n '__fish_seen_subcommand_from import' -l help -d 'Print usage'
-
-# info
-complete -c docker -f -n '__fish_docker_no_subcommand' -a info -d 'Display system-wide information'
-complete -c docker -A -f -n '__fish_seen_subcommand_from info' -s f -l format  -d 'Format the output using the given go template'
-complete -c docker -A -f -n '__fish_seen_subcommand_from info' -l help -d 'Print usage'
-
-# inspect
-complete -c docker -f -n '__fish_docker_no_subcommand' -a inspect -d 'Return low-level information on a container or image'
-complete -c docker -A -f -n '__fish_seen_subcommand_from inspect' -s f -l format -d 'Format the output using the given go template.'
-complete -c docker -A -f -n '__fish_seen_subcommand_from inspect' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from inspect' -s s -l size -d 'Display total file sizes if the type is container.'
-complete -c docker -A -f -n '__fish_seen_subcommand_from inspect' -a '(__fish_print_docker_images)' -d "Image"
-complete -c docker -A -f -n '__fish_seen_subcommand_from inspect' -a '(__fish_print_docker_containers all)' -d "Container"
-
-# kill
-complete -c docker -f -n '__fish_docker_no_subcommand' -a kill -d 'Kill a running container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from kill' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from kill' -s s -l signal -d 'Signal to send to the container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from kill' -a '(__fish_print_docker_containers running)' -d "Container"
-
-# load
-complete -c docker -f -n '__fish_docker_no_subcommand' -a load -d 'Load an image from a tar archive'
-complete -c docker -A -f -n '__fish_seen_subcommand_from load' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from load' -s i -l input -d 'Read from a tar archive file, instead of STDIN'
-
-# login
-complete -c docker -f -n '__fish_docker_no_subcommand' -a login -d 'Log in to a Docker registry server'
-complete -c docker -A -f -n '__fish_seen_subcommand_from login' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from login' -s p -l password -d 'Password'
-complete -c docker -A -f -n '__fish_seen_subcommand_from login' -s u -l username -d 'Username'
-
-# logout
-complete -c docker -f -n '__fish_docker_no_subcommand' -a logout -d 'Log out from a Docker registry server'
-
-# logs
-complete -c docker -f -n '__fish_docker_no_subcommand' -a logs -d 'Fetch the logs of a container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from logs' -s f -l follow -d 'Follow log output'
-complete -c docker -A -f -n '__fish_seen_subcommand_from logs' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from logs' -s t -l timestamps -d 'Show timestamps'
-complete -c docker -A -f -n '__fish_seen_subcommand_from logs' -l since -d 'Show logs since timestamp'
-complete -c docker -A -f -n '__fish_seen_subcommand_from logs' -l tail -d 'Output the specified number of lines at the end of logs (defaults to all logs)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from logs' -a '(__fish_print_docker_containers running)' -d "Container"
-
-# port
-complete -c docker -f -n '__fish_docker_no_subcommand' -a port -d 'Lookup the public-facing port that is NAT-ed to PRIVATE_PORT'
-complete -c docker -A -f -n '__fish_seen_subcommand_from port' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from port' -a '(__fish_print_docker_containers running)' -d "Container"
-
-# pause
-complete -c docker -f -n '__fish_docker_no_subcommand' -a pause -d 'Pause all processes within a container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from pause' -a '(__fish_print_docker_containers running)' -d "Container"
-
-# ps
-complete -c docker -f -n '__fish_docker_no_subcommand' -a ps -d 'List containers'
-complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -s a -l all -d 'Show all containers. Only running containers are shown by default.'
-complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -l before -d 'Show only container created before Id or Name, include non-running ones.'
-complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -s f -l filter -d 'Provide filter values. Valid filters:'
-complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -s l -l latest -d 'Show only the latest created container, include non-running ones.'
-complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -s n -d 'Show n last created containers, include non-running ones.'
-complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -l no-trunc -d "Don't truncate output"
-complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -s q -l quiet -d 'Only display numeric IDs'
-complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -s s -l size -d 'Display total file sizes'
-complete -c docker -A -f -n '__fish_seen_subcommand_from ps' -l since -d 'Show only containers created since Id or Name, include non-running ones.'
-
-# pull
-complete -c docker -f -n '__fish_docker_no_subcommand' -a pull -d 'Pull an image or a repository from a Docker registry server'
-complete -c docker -A -f -n '__fish_seen_subcommand_from pull' -s a -l all-tags -d 'Download all tagged images in the repository'
-complete -c docker -A -f -n '__fish_seen_subcommand_from pull' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from pull' -a '(__fish_print_docker_images)' -d "Image"
-complete -c docker -A -f -n '__fish_seen_subcommand_from pull' -a '(__fish_print_docker_repositories)' -d "Repository"
-
-# push
-complete -c docker -f -n '__fish_docker_no_subcommand' -a push -d 'Push an image or a repository to a Docker registry server'
-complete -c docker -A -f -n '__fish_seen_subcommand_from push' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from push' -a '(__fish_print_docker_images)' -d "Image"
-complete -c docker -A -f -n '__fish_seen_subcommand_from push' -a '(__fish_print_docker_repositories)' -d "Repository"
-
-# rename
-complete -c docker -f -n '__fish_docker_no_subcommand' -a rename -d 'Rename an existing container'
-
-# restart
-complete -c docker -f -n '__fish_docker_no_subcommand' -a restart -d 'Restart a container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from restart' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from restart' -s t -l time -d 'Number of seconds to try to stop for before killing the container. Once killed it will then be restarted. Default is 10 seconds.'
-complete -c docker -A -f -n '__fish_seen_subcommand_from restart' -a '(__fish_print_docker_containers running)' -d "Container"
-
-# rm
-complete -c docker -f -n '__fish_docker_no_subcommand' -a rm -d 'Remove one or more containers'
-complete -c docker -A -f -n '__fish_seen_subcommand_from rm' -s f -l force -d 'Force the removal of a running container (uses SIGKILL)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from rm' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from rm' -s l -l link -d 'Remove the specified link and not the underlying container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from rm' -s v -l volumes -d 'Remove the volumes associated with the container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from rm' -a '(__fish_print_docker_containers stopped)' -d "Container"
-complete -c docker -A -f -n '__fish_seen_subcommand_from rm' -s f -l force -a '(__fish_print_docker_containers all)' -d "Container"
-
-# rmi
-complete -c docker -f -n '__fish_docker_no_subcommand' -a rmi -d 'Remove one or more images'
-complete -c docker -A -f -n '__fish_seen_subcommand_from rmi' -s f -l force -d 'Force removal of the image'
-complete -c docker -A -f -n '__fish_seen_subcommand_from rmi' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from rmi' -l no-prune -d 'Do not delete untagged parents'
-complete -c docker -A -f -n '__fish_seen_subcommand_from rmi' -a '(__fish_print_docker_images)' -d "Image"
-
-# run
-complete -c docker -f -n '__fish_docker_no_subcommand' -a run -d 'Run a command in a new container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s a -l attach -d 'Attach to STDIN, STDOUT or STDERR.'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l add-host -d 'Add a custom host-to-IP mapping (host:ip)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s c -l cpu-shares -d 'CPU shares (relative weight)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l cap-add -d 'Add Linux capabilities'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l cap-drop -d 'Drop Linux capabilities'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l cidfile -d 'Write the container ID to the file'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l cpuset -d 'CPUs in which to allow execution (0-3, 0,1)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s d -l detach -d 'Detached mode: run the container in the background and print the new container ID'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l device -d 'Add a host device to the container (e.g. --device=/dev/sdc:/dev/xvdc:rwm)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l device-cgroup-rule -d 'Add a rule to the cgroup allowed devices list (e.g. --device-cgroup-rule="c 13:37 rwm")'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l dns -d 'Set custom DNS servers'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l dns-opt -d "Set custom DNS options (Use --dns-opt='' if you don't wish to set options)"
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l dns-search -d "Set custom DNS search domains (Use --dns-search=. if you don't wish to set the search domain)"
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s e -l env -d 'Set environment variables'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l entrypoint -d 'Overwrite the default ENTRYPOINT of the image'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l env-file -d 'Read in a line delimited file of environment variables'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l expose -d 'Expose a port or a range of ports (e.g. --expose=3300-3310) from the container without publishing it to your host'
-complete -c docker -A -f -n '__fish_seen_subcommand_from create' -l group-add -d 'Add additional groups to run as'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s h -l hostname -d 'Container host name'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s i -l interactive -d 'Keep STDIN open even if not attached'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l ipc -d 'Default is to create a private IPC namespace (POSIX SysV IPC) for the container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l link -d 'Add link to another container in the form of <name|id>:alias'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s m -l memory -d 'Memory limit (format: <number>[<unit>], where unit = b, k, m or g)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l mac-address -d 'Container MAC address (e.g., 92:d0:c6:0a:29:33)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l memory-swap -d "Total memory usage (memory + swap), set '-1' to disable swap (format: <number>[<unit>], where unit = b, k, m or g)"
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l mount -d 'Attach a filesystem mount to the container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l name -d 'Assign a name to the container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l net -d 'Set the Network mode for the container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s P -l publish-all -d 'Publish all exposed ports to random ports on the host interfaces'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s p -l publish -d "Publish a container's port to the host"
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l pid -d 'Default is to create a private PID namespace for the container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l privileged -d 'Give extended privileges to this container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l read-only -d "Mount the container's root filesystem as read only"
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l restart -d 'Restart policy to apply when a container exits (no, on-failure[:max-retry], always)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l rm -d 'Automatically remove the container when it exits (incompatible with -d)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l security-opt -d 'Security Options'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l sig-proxy -d 'Proxy received signals to the process (non-TTY mode only). SIGCHLD, SIGSTOP, and SIGKILL are not proxied.'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l stop-signal -d 'Signal to kill a container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s t -l tty -d 'Allocate a pseudo-TTY'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s u -l user -d 'Username or UID'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l tmpfs -d 'Mount tmpfs on a directory'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s v -l volume -d 'Bind mount a volume (e.g., from the host: -v /host:/container, from Docker: -v /container)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -l volumes-from -d 'Mount volumes from the specified container(s)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -s w -l workdir -d 'Working directory inside the container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from run' -a '(__fish_print_docker_images)' -d "Image"
-
-# save
-complete -c docker -f -n '__fish_docker_no_subcommand' -a save -d 'Save an image to a tar archive'
-complete -c docker -A -f -n '__fish_seen_subcommand_from save' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from save' -s o -l output -d 'Write to an file, instead of STDOUT'
-complete -c docker -A -f -n '__fish_seen_subcommand_from save' -a '(__fish_print_docker_images)' -d "Image"
-
-# search
-complete -c docker -f -n '__fish_docker_no_subcommand' -a search -d 'Search for an image on the registry (defaults to the Docker Hub)'
-complete -c docker -A -f -n '__fish_seen_subcommand_from search' -l automated -d 'Only show automated builds'
-complete -c docker -A -f -n '__fish_seen_subcommand_from search' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from search' -l no-trunc -d "Don't truncate output"
-complete -c docker -A -f -n '__fish_seen_subcommand_from search' -s s -l stars -d 'Only displays with at least x stars'
-
-# start
-complete -c docker -f -n '__fish_docker_no_subcommand' -a start -d 'Start a container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from start' -s a -l attach -d "Attach container's STDOUT and STDERR and forward all signals to the process"
-complete -c docker -A -f -n '__fish_seen_subcommand_from start' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from start' -s i -l interactive -d "Attach container's STDIN"
-complete -c docker -A -f -n '__fish_seen_subcommand_from start' -a '(__fish_print_docker_containers stopped)' -d "Container"
-
-# stats
-complete -c docker -f -n '__fish_docker_no_subcommand' -a stats -d "Display a live stream of one or more containers' resource usage statistics"
-complete -c docker -A -f -n '__fish_seen_subcommand_from stats' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from stats' -l no-stream -d 'Disable streaming stats and only pull the first result'
-complete -c docker -A -f -n '__fish_seen_subcommand_from stats' -a '(__fish_print_docker_containers running)' -d "Container"
-
-# stop
-complete -c docker -f -n '__fish_docker_no_subcommand' -a stop -d 'Stop a container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from stop' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from stop' -s t -l time -d 'Number of seconds to wait for the container to stop before killing it. Default is 10 seconds.'
-complete -c docker -A -f -n '__fish_seen_subcommand_from stop' -a '(__fish_print_docker_containers running)' -d "Container"
-
-# tag
-complete -c docker -f -n '__fish_docker_no_subcommand' -a tag -d 'Tag an image into a repository'
-complete -c docker -A -f -n '__fish_seen_subcommand_from tag' -s f -l force -d 'Force'
-complete -c docker -A -f -n '__fish_seen_subcommand_from tag' -l help -d 'Print usage'
-
-# top
-complete -c docker -f -n '__fish_docker_no_subcommand' -a top -d 'Lookup the running processes of a container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from top' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from top' -a '(__fish_print_docker_containers running)' -d "Container"
-
-# unpause
-complete -c docker -f -n '__fish_docker_no_subcommand' -a unpause -d 'Unpause a paused container'
-complete -c docker -A -f -n '__fish_seen_subcommand_from unpause' -a '(__fish_print_docker_containers running)' -d "Container"
-
-# version
-complete -c docker -f -n '__fish_docker_no_subcommand' -a version -d 'Show the Docker version information'
-complete -c docker -A -f -n '__fish_seen_subcommand_from version' -s f -l format  -d 'Format the output using the given go template'
-complete -c docker -A -f -n '__fish_seen_subcommand_from version' -l help -d 'Print usage'
-
-# wait
-complete -c docker -f -n '__fish_docker_no_subcommand' -a wait -d 'Block until a container stops, then print its exit code'
-complete -c docker -A -f -n '__fish_seen_subcommand_from wait' -l help -d 'Print usage'
-complete -c docker -A -f -n '__fish_seen_subcommand_from wait' -a '(__fish_print_docker_containers running)' -d "Container"
diff --git a/components/engine/contrib/completion/powershell/readme.txt b/components/engine/contrib/completion/powershell/readme.txt
deleted file mode 100644
index 18e1b53c13..0000000000
--- a/components/engine/contrib/completion/powershell/readme.txt
+++ /dev/null
@@ -1 +0,0 @@
-See https://github.com/samneirinck/posh-docker
\ No newline at end of file
diff --git a/components/engine/contrib/completion/zsh/REVIEWERS b/components/engine/contrib/completion/zsh/REVIEWERS
deleted file mode 100644
index 03ee2dde3d..0000000000
--- a/components/engine/contrib/completion/zsh/REVIEWERS
+++ /dev/null
@@ -1,2 +0,0 @@
-Tianon Gravi <admwiggin@gmail.com> (@tianon)
-Jessie Frazelle <jess@docker.com> (@jfrazelle)
diff --git a/components/engine/contrib/completion/zsh/_docker b/components/engine/contrib/completion/zsh/_docker
deleted file mode 100644
index 0860907839..0000000000
--- a/components/engine/contrib/completion/zsh/_docker
+++ /dev/null
@@ -1,3014 +0,0 @@
-#compdef docker dockerd
-#
-# zsh completion for docker (http://docker.com)
-#
-# version:  0.3.0
-# github:   https://github.com/felixr/docker-zsh-completion
-#
-# contributors:
-#   - Felix Riedel
-#   - Steve Durrheimer
-#   - Vincent Bernat
-#
-# license:
-#
-# Copyright (c) 2013, Felix Riedel
-# All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are met:
-#     * Redistributions of source code must retain the above copyright
-#       notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above copyright
-#       notice, this list of conditions and the following disclaimer in the
-#       documentation and/or other materials provided with the distribution.
-#     * Neither the name of the <organization> nor the
-#       names of its contributors may be used to endorse or promote products
-#       derived from this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-# DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
-# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-#
-
-# Short-option stacking can be enabled with:
-#  zstyle ':completion:*:*:docker:*' option-stacking yes
-#  zstyle ':completion:*:*:docker-*:*' option-stacking yes
-__docker_arguments() {
-    if zstyle -t ":completion:${curcontext}:" option-stacking; then
-        print -- -s
-    fi
-}
-
-__docker_get_containers() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    local kind type line s
-    declare -a running stopped lines args names
-
-    kind=$1; shift
-    type=$1; shift
-    [[ $kind = (stopped|all) ]] && args=($args -a)
-
-    lines=(${(f)${:-"$(_call_program commands docker $docker_options ps --format 'table' --no-trunc $args)"$'\n'}})
-
-    # Parse header line to find columns
-    local i=1 j=1 k header=${lines[1]}
-    declare -A begin end
-    while (( j < ${#header} - 1 )); do
-        i=$(( j + ${${header[$j,-1]}[(i)[^ ]]} - 1 ))
-        j=$(( i + ${${header[$i,-1]}[(i)  ]} - 1 ))
-        k=$(( j + ${${header[$j,-1]}[(i)[^ ]]} - 2 ))
-        begin[${header[$i,$((j-1))]}]=$i
-        end[${header[$i,$((j-1))]}]=$k
-    done
-    end[${header[$i,$((j-1))]}]=-1 # Last column, should go to the end of the line
-    lines=(${lines[2,-1]})
-
-    # Container ID
-    if [[ $type = (ids|all) ]]; then
-        for line in $lines; do
-            s="${${line[${begin[CONTAINER ID]},${end[CONTAINER ID]}]%% ##}[0,12]}"
-            s="$s:${(l:15:: :::)${${line[${begin[CREATED]},${end[CREATED]}]/ ago/}%% ##}}"
-            s="$s, ${${${line[${begin[IMAGE]},${end[IMAGE]}]}/:/\\:}%% ##}"
-            if [[ ${line[${begin[STATUS]},${end[STATUS]}]} = (Exit*|Created*) ]]; then
-                stopped=($stopped $s)
-            else
-                running=($running $s)
-            fi
-        done
-    fi
-
-    # Names: we only display the one without slash. All other names
-    # are generated and may clutter the completion. However, with
-    # Swarm, all names may be prefixed by the swarm node name.
-    if [[ $type = (names|all) ]]; then
-        for line in $lines; do
-            names=(${(ps:,:)${${line[${begin[NAMES]},${end[NAMES]}]}%% *}})
-            # First step: find a common prefix and strip it (swarm node case)
-            (( ${#${(u)names%%/*}} == 1 )) && names=${names#${names[1]%%/*}/}
-            # Second step: only keep the first name without a /
-            s=${${names:#*/*}[1]}
-            # If no name, well give up.
-            (( $#s != 0 )) || continue
-            s="$s:${(l:15:: :::)${${line[${begin[CREATED]},${end[CREATED]}]/ ago/}%% ##}}"
-            s="$s, ${${${line[${begin[IMAGE]},${end[IMAGE]}]}/:/\\:}%% ##}"
-            if [[ ${line[${begin[STATUS]},${end[STATUS]}]} = (Exit*|Created*) ]]; then
-                stopped=($stopped $s)
-            else
-                running=($running $s)
-            fi
-        done
-    fi
-
-    [[ $kind = (running|all) ]] && _describe -t containers-running "running containers" running "$@" && ret=0
-    [[ $kind = (stopped|all) ]] && _describe -t containers-stopped "stopped containers" stopped "$@" && ret=0
-    return ret
-}
-
-__docker_complete_stopped_containers() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_get_containers stopped all "$@"
-}
-
-__docker_complete_running_containers() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_get_containers running all "$@"
-}
-
-__docker_complete_containers() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_get_containers all all "$@"
-}
-
-__docker_complete_containers_ids() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_get_containers all ids "$@"
-}
-
-__docker_complete_containers_names() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_get_containers all names "$@"
-}
-
-__docker_complete_info_plugins() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    emulate -L zsh
-    setopt extendedglob
-    local -a plugins
-    plugins=(${(ps: :)${(M)${(f)${${"$(_call_program commands docker $docker_options info)"##*$'\n'Plugins:}%%$'\n'^ *}}:# $1: *}## $1: })
-    _describe -t plugins "$1 plugins" plugins && ret=0
-    return ret
-}
-
-__docker_complete_images() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    declare -a images
-    images=(${${${(f)${:-"$(_call_program commands docker $docker_options images)"$'\n'}}[2,-1]}/(#b)([^ ]##) ##([^ ]##) ##([^ ]##)*/${match[3]}:${(r:15:: :::)match[2]} in ${match[1]}})
-    _describe -t docker-images "images" images && ret=0
-    __docker_complete_repositories_with_tags && ret=0
-    return ret
-}
-
-__docker_complete_repositories() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    declare -a repos
-    repos=(${${${(f)${:-"$(_call_program commands docker $docker_options images)"$'\n'}}%% *}[2,-1]})
-    repos=(${repos#<none>})
-    _describe -t docker-repos "repositories" repos && ret=0
-    return ret
-}
-
-__docker_complete_repositories_with_tags() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    declare -a repos onlyrepos matched
-    declare m
-    repos=(${${${${(f)${:-"$(_call_program commands docker $docker_options images)"$'\n'}}[2,-1]}/ ##/:::}%% *})
-    repos=(${${repos%:::<none>}#<none>})
-    # Check if we have a prefix-match for the current prefix.
-    onlyrepos=(${repos%::*})
-    for m in $onlyrepos; do
-        [[ ${PREFIX##${~~m}} != ${PREFIX} ]] && {
-            # Yes, complete with tags
-            repos=(${${repos/:::/:}/:/\\:})
-            _describe -t docker-repos-with-tags "repositories with tags" repos && ret=0
-            return ret
-        }
-    done
-    # No, only complete repositories
-    onlyrepos=(${${repos%:::*}/:/\\:})
-    _describe -t docker-repos "repositories" onlyrepos -qS : && ret=0
-
-    return ret
-}
-
-__docker_search() {
-    [[ $PREFIX = -* ]] && return 1
-    local cache_policy
-    zstyle -s ":completion:${curcontext}:" cache-policy cache_policy
-    if [[ -z "$cache_policy" ]]; then
-        zstyle ":completion:${curcontext}:" cache-policy __docker_caching_policy
-    fi
-
-    local searchterm cachename
-    searchterm="${words[$CURRENT]%/}"
-    cachename=_docker-search-$searchterm
-
-    local expl
-    local -a result
-    if ( [[ ${(P)+cachename} -eq 0 ]] || _cache_invalid ${cachename#_} ) \
-        && ! _retrieve_cache ${cachename#_}; then
-        _message "Searching for ${searchterm}..."
-        result=(${${${(f)${:-"$(_call_program commands docker $docker_options search $searchterm)"$'\n'}}%% *}[2,-1]})
-        _store_cache ${cachename#_} result
-    fi
-    _wanted dockersearch expl 'available images' compadd -a result
-}
-
-__docker_get_log_options() {
-    [[ $PREFIX = -* ]] && return 1
-
-    integer ret=1
-    local log_driver=${opt_args[--log-driver]:-"all"}
-    local -a common_options awslogs_options fluentd_options gelf_options journald_options json_file_options logentries_options syslog_options splunk_options
-
-    common_options=("max-buffer-size" "mode")
-    awslogs_options=($common_options "awslogs-region" "awslogs-group" "awslogs-stream" "awslogs-create-group")
-    fluentd_options=($common_options "env" "fluentd-address" "fluentd-async-connect" "fluentd-buffer-limit" "fluentd-retry-wait" "fluentd-max-retries" "labels" "tag")
-    gcplogs_options=($common_options "env" "gcp-log-cmd" "gcp-project" "labels")
-    gelf_options=($common_options "env" "gelf-address" "gelf-compression-level" "gelf-compression-type" "labels" "tag")
-    journald_options=($common_options "env" "labels" "tag")
-    json_file_options=($common_options "env" "labels" "max-file" "max-size")
-    logentries_options=($common_options "logentries-token")
-    syslog_options=($common_options "env" "labels" "syslog-address" "syslog-facility" "syslog-format" "syslog-tls-ca-cert" "syslog-tls-cert" "syslog-tls-key" "syslog-tls-skip-verify" "tag")
-    splunk_options=($common_options "env" "labels" "splunk-caname" "splunk-capath" "splunk-format" "splunk-gzip" "splunk-gzip-level" "splunk-index" "splunk-insecureskipverify" "splunk-source" "splunk-sourcetype" "splunk-token" "splunk-url" "splunk-verify-connection" "tag")
-
-    [[ $log_driver = (awslogs|all) ]] && _describe -t awslogs-options "awslogs options" awslogs_options "$@" && ret=0
-    [[ $log_driver = (fluentd|all) ]] && _describe -t fluentd-options "fluentd options" fluentd_options "$@" && ret=0
-    [[ $log_driver = (gcplogs|all) ]] && _describe -t gcplogs-options "gcplogs options" gcplogs_options "$@" && ret=0
-    [[ $log_driver = (gelf|all) ]] && _describe -t gelf-options "gelf options" gelf_options "$@" && ret=0
-    [[ $log_driver = (journald|all) ]] && _describe -t journald-options "journald options" journald_options "$@" && ret=0
-    [[ $log_driver = (json-file|all) ]] && _describe -t json-file-options "json-file options" json_file_options "$@" && ret=0
-    [[ $log_driver = (logentries|all) ]] && _describe -t logentries-options "logentries options" logentries_options "$@" && ret=0
-    [[ $log_driver = (syslog|all) ]] && _describe -t syslog-options "syslog options" syslog_options "$@" && ret=0
-    [[ $log_driver = (splunk|all) ]] && _describe -t splunk-options "splunk options" splunk_options "$@" && ret=0
-
-    return ret
-}
-
-__docker_complete_log_drivers() {
-    [[ $PREFIX = -*  ]] && return 1
-    integer ret=1
-    drivers=(awslogs etwlogs fluentd gcplogs gelf journald json-file none splunk syslog)
-    _describe -t log-drivers "log drivers" drivers && ret=0
-    return ret
-}
-
-__docker_complete_log_options() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-
-    if compset -P '*='; then
-        case "${${words[-1]%=*}#*=}" in
-            (syslog-format)
-                local opts=('rfc3164' 'rfc5424' 'rfc5424micro')
-                _describe -t syslog-format-opts "syslog format options" opts && ret=0
-                ;;
-            (mode)
-                local opts=('blocking' 'non-blocking')
-                _describe -t mode-opts "mode options" opts && ret=0
-                ;;
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        __docker_get_log_options -qS "=" && ret=0
-    fi
-
-    return ret
-}
-
-__docker_complete_detach_keys() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-
-    compset -P "*,"
-    keys=(${:-{a-z}})
-    ctrl_keys=(${:-ctrl-{{a-z},{@,'[','\\','^',']',_}}})
-    _describe -t detach_keys "[a-z]" keys -qS "," && ret=0
-    _describe -t detach_keys-ctrl "'ctrl-' + 'a-z @ [ \\\\ ] ^ _'" ctrl_keys -qS "," && ret=0
-}
-
-__docker_complete_pid() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    local -a opts vopts
-
-    opts=('host')
-    vopts=('container')
-
-    if compset -P '*:'; then
-        case "${${words[-1]%:*}#*=}" in
-            (container)
-                __docker_complete_running_containers && ret=0
-                ;;
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        _describe -t pid-value-opts "PID Options with value" vopts -qS ":" && ret=0
-        _describe -t pid-opts "PID Options" opts && ret=0
-    fi
-
-    return ret
-}
-
-__docker_complete_runtimes() {
-    [[ $PREFIX = -*  ]] && return 1
-    integer ret=1
-
-    emulate -L zsh
-    setopt extendedglob
-    local -a runtimes_opts
-    runtimes_opts=(${(ps: :)${(f)${${"$(_call_program commands docker $docker_options info)"##*$'\n'Runtimes: }%%$'\n'^ *}}})
-    _describe -t runtimes-opts "runtimes options" runtimes_opts && ret=0
-}
-
-__docker_complete_ps_filters() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-
-    if compset -P '*='; then
-        case "${${words[-1]%=*}#*=}" in
-            (ancestor)
-                __docker_complete_images && ret=0
-                ;;
-            (before|since)
-                __docker_complete_containers && ret=0
-                ;;
-            (health)
-                health_opts=('healthy' 'none' 'starting' 'unhealthy')
-                _describe -t health-filter-opts "health filter options" health_opts && ret=0
-                ;;
-            (id)
-                __docker_complete_containers_ids && ret=0
-                ;;
-            (is-task)
-                _describe -t boolean-filter-opts "filter options" boolean_opts && ret=0
-                ;;
-            (name)
-                __docker_complete_containers_names && ret=0
-                ;;
-            (network)
-                __docker_complete_networks && ret=0
-                ;;
-            (status)
-                status_opts=('created' 'dead' 'exited' 'paused' 'restarting' 'running' 'removing')
-                _describe -t status-filter-opts "status filter options" status_opts && ret=0
-                ;;
-            (volume)
-                __docker_complete_volumes && ret=0
-                ;;
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        opts=('ancestor' 'before' 'exited' 'expose' 'health' 'id' 'label' 'name' 'network' 'publish' 'since' 'status' 'volume')
-        _describe -t filter-opts "Filter Options" opts -qS "=" && ret=0
-    fi
-
-    return ret
-}
-
-__docker_complete_search_filters() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    declare -a boolean_opts opts
-
-    boolean_opts=('true' 'false')
-    opts=('is-automated' 'is-official' 'stars')
-
-    if compset -P '*='; then
-        case "${${words[-1]%=*}#*=}" in
-            (is-automated|is-official)
-                _describe -t boolean-filter-opts "filter options" boolean_opts && ret=0
-                ;;
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        _describe -t filter-opts "filter options" opts -qS "=" && ret=0
-    fi
-
-    return ret
-}
-
-__docker_complete_images_filters() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    declare -a boolean_opts opts
-
-    boolean_opts=('true' 'false')
-    opts=('before' 'dangling' 'label' 'reference' 'since')
-
-    if compset -P '*='; then
-        case "${${words[-1]%=*}#*=}" in
-            (before|reference|since)
-                __docker_complete_images && ret=0
-                ;;
-            (dangling)
-                _describe -t boolean-filter-opts "filter options" boolean_opts && ret=0
-                ;;
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        _describe -t filter-opts "Filter Options" opts -qS "=" && ret=0
-    fi
-
-    return ret
-}
-
-__docker_complete_events_filter() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    declare -a opts
-
-    opts=('container' 'daemon' 'event' 'image' 'label' 'network' 'type' 'volume')
-
-    if compset -P '*='; then
-        case "${${words[-1]%=*}#*=}" in
-            (container)
-                __docker_complete_containers && ret=0
-                ;;
-            (daemon)
-                emulate -L zsh
-                setopt extendedglob
-                local -a daemon_opts
-                daemon_opts=(
-                    ${(f)${${"$(_call_program commands docker $docker_options info)"##*$'\n'Name: }%%$'\n'^ *}}
-                    ${${(f)${${"$(_call_program commands docker $docker_options info)"##*$'\n'ID: }%%$'\n'^ *}}//:/\\:}
-                )
-                _describe -t daemon-filter-opts "daemon filter options" daemon_opts && ret=0
-                ;;
-            (event)
-                local -a event_opts
-                event_opts=('attach' 'commit' 'connect' 'copy' 'create' 'delete' 'destroy' 'detach' 'die' 'disconnect' 'exec_create' 'exec_detach'
-                'exec_start' 'export' 'health_status' 'import' 'kill' 'load'  'mount' 'oom' 'pause' 'pull' 'push' 'reload' 'rename' 'resize' 'restart' 'save' 'start'
-                'stop' 'tag' 'top' 'unmount' 'unpause' 'untag' 'update')
-                _describe -t event-filter-opts "event filter options" event_opts && ret=0
-                ;;
-            (image)
-                __docker_complete_images && ret=0
-                ;;
-            (network)
-                __docker_complete_networks && ret=0
-                ;;
-            (type)
-                local -a type_opts
-                type_opts=('container' 'daemon' 'image' 'network' 'volume')
-                _describe -t type-filter-opts "type filter options" type_opts && ret=0
-                ;;
-            (volume)
-                __docker_complete_volumes && ret=0
-                ;;
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        _describe -t filter-opts "filter options" opts -qS "=" && ret=0
-    fi
-
-    return ret
-}
-
-__docker_complete_prune_filters() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    declare -a opts
-
-    opts=('until')
-
-    if compset -P '*='; then
-        case "${${words[-1]%=*}#*=}" in
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        _describe -t filter-opts "filter options" opts -qS "=" && ret=0
-    fi
-
-    return ret
-}
-
-# BO checkpoint
-
-__docker_checkpoint_commands() {
-    local -a _docker_checkpoint_subcommands
-    _docker_checkpoint_subcommands=(
-        "create:Create a checkpoint from a running container"
-        "ls:List checkpoints for a container"
-        "rm:Remove a checkpoint"
-    )
-    _describe -t docker-checkpoint-commands "docker checkpoint command" _docker_checkpoint_subcommands
-}
-
-__docker_checkpoint_subcommand() {
-    local -a _command_args opts_help
-    local expl help="--help"
-    integer ret=1
-
-    opts_help=("(: -)--help[Print usage]")
-
-    case "$words[1]" in
-        (create)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)--checkpoint-dir=[Use a custom checkpoint storage directory]:dir:_directories" \
-                "($help)--leave-running[Leave the container running after checkpoint]" \
-                "($help -)1:container:__docker_complete_running_containers" \
-                "($help -)2:checkpoint: " && ret=0
-            ;;
-        (ls|list)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)--checkpoint-dir=[Use a custom checkpoint storage directory]:dir:_directories" \
-                "($help -)1:container:__docker_complete_containers" && ret=0
-            ;;
-        (rm|remove)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)--checkpoint-dir=[Use a custom checkpoint storage directory]:dir:_directories" \
-                "($help -)1:container:__docker_complete_containers" \
-                "($help -)2:checkpoint: " && ret=0
-            ;;
-        (help)
-            _arguments $(__docker_arguments) ":subcommand:__docker_checkpoint_commands" && ret=0
-            ;;
-    esac
-
-    return ret
-}
-
-# EO checkpoint
-
-# BO container
-
-__docker_container_commands() {
-    local -a _docker_container_subcommands
-    _docker_container_subcommands=(
-        "attach:Attach to a running container"
-        "commit:Create a new image from a container's changes"
-        "cp:Copy files/folders between a container and the local filesystem"
-        "create:Create a new container"
-        "diff:Inspect changes on a container's filesystem"
-        "exec:Run a command in a running container"
-        "export:Export a container's filesystem as a tar archive"
-        "inspect:Display detailed information on one or more containers"
-        "kill:Kill one or more running containers"
-        "logs:Fetch the logs of a container"
-        "ls:List containers"
-        "pause:Pause all processes within one or more containers"
-        "port:List port mappings or a specific mapping for the container"
-        "prune:Remove all stopped containers"
-        "rename:Rename a container"
-        "restart:Restart one or more containers"
-        "rm:Remove one or more containers"
-        "run:Run a command in a new container"
-        "start:Start one or more stopped containers"
-        "stats:Display a live stream of container(s) resource usage statistics"
-        "stop:Stop one or more running containers"
-        "top:Display the running processes of a container"
-        "unpause:Unpause all processes within one or more containers"
-        "update:Update configuration of one or more containers"
-        "wait:Block until one or more containers stop, then print their exit codes"
-    )
-    _describe -t docker-container-commands "docker container command" _docker_container_subcommands
-}
-
-__docker_container_subcommand() {
-    local -a _command_args opts_help opts_attach_exec_run_start opts_create_run opts_create_run_update
-    local expl help="--help"
-    integer ret=1
-
-    opts_attach_exec_run_start=(
-        "($help)--detach-keys=[Escape key sequence used to detach a container]:sequence:__docker_complete_detach_keys"
-    )
-    opts_create_run=(
-        "($help -a --attach)"{-a=,--attach=}"[Attach to stdin, stdout or stderr]:device:(STDIN STDOUT STDERR)"
-        "($help)*--add-host=[Add a custom host-to-IP mapping]:host\:ip mapping: "
-        "($help)*--blkio-weight-device=[Block IO (relative device weight)]:device:Block IO weight: "
-        "($help)*--cap-add=[Add Linux capabilities]:capability: "
-        "($help)*--cap-drop=[Drop Linux capabilities]:capability: "
-        "($help)--cgroup-parent=[Parent cgroup for the container]:cgroup: "
-        "($help)--cidfile=[Write the container ID to the file]:CID file:_files"
-        "($help)--cpus=[Number of CPUs (default 0.000)]:cpus: "
-        "($help)*--device=[Add a host device to the container]:device:_files"
-        "($help)*--device-cgroup-rule=[Add a rule to the cgroup allowed devices list]:device:cgroup: "
-        "($help)*--device-read-bps=[Limit the read rate (bytes per second) from a device]:device:IO rate: "
-        "($help)*--device-read-iops=[Limit the read rate (IO per second) from a device]:device:IO rate: "
-        "($help)*--device-write-bps=[Limit the write rate (bytes per second) to a device]:device:IO rate: "
-        "($help)*--device-write-iops=[Limit the write rate (IO per second) to a device]:device:IO rate: "
-        "($help)--disable-content-trust[Skip image verification]"
-        "($help)*--dns=[Custom DNS servers]:DNS server: "
-        "($help)*--dns-option=[Custom DNS options]:DNS option: "
-        "($help)*--dns-search=[Custom DNS search domains]:DNS domains: "
-        "($help)*"{-e=,--env=}"[Environment variables]:environment variable: "
-        "($help)--entrypoint=[Overwrite the default entrypoint of the image]:entry point: "
-        "($help)*--env-file=[Read environment variables from a file]:environment file:_files"
-        "($help)*--expose=[Expose a port from the container without publishing it]: "
-        "($help)*--group=[Set one or more supplementary user groups for the container]:group:_groups"
-        "($help -h --hostname)"{-h=,--hostname=}"[Container host name]:hostname:_hosts"
-        "($help -i --interactive)"{-i,--interactive}"[Keep stdin open even if not attached]"
-        "($help)--init[Run an init inside the container that forwards signals and reaps processes]"
-        "($help)--ip=[IPv4 address]:IPv4: "
-        "($help)--ip6=[IPv6 address]:IPv6: "
-        "($help)--ipc=[IPC namespace to use]:IPC namespace: "
-        "($help)--isolation=[Container isolation technology]:isolation:(default hyperv process)"
-        "($help)*--link=[Add link to another container]:link:->link"
-        "($help)*--link-local-ip=[Container IPv4/IPv6 link-local addresses]:IPv4/IPv6: "
-        "($help)*"{-l=,--label=}"[Container metadata]:label: "
-        "($help)--log-driver=[Default driver for container logs]:logging driver:__docker_complete_log_drivers"
-        "($help)*--log-opt=[Log driver specific options]:log driver options:__docker_complete_log_options"
-        "($help)--mac-address=[Container MAC address]:MAC address: "
-        "($help)*--mount=[Attach a filesystem mount to the container]:mount: "
-        "($help)--name=[Container name]:name: "
-        "($help)--network=[Connect a container to a network]:network mode:(bridge none container host)"
-        "($help)*--network-alias=[Add network-scoped alias for the container]:alias: "
-        "($help)--oom-kill-disable[Disable OOM Killer]"
-        "($help)--oom-score-adj[Tune the host's OOM preferences for containers (accepts -1000 to 1000)]"
-        "($help)--pids-limit[Tune container pids limit (set -1 for unlimited)]"
-        "($help -P --publish-all)"{-P,--publish-all}"[Publish all exposed ports]"
-        "($help)*"{-p=,--publish=}"[Expose a container's port to the host]:port:_ports"
-        "($help)--pid=[PID namespace to use]:PID namespace:__docker_complete_pid"
-        "($help)--privileged[Give extended privileges to this container]"
-        "($help)--read-only[Mount the container's root filesystem as read only]"
-        "($help)*--security-opt=[Security options]:security option: "
-        "($help)*--shm-size=[Size of '/dev/shm' (format is '<number><unit>')]:shm size: "
-        "($help)--stop-signal=[Signal to kill a container]:signal:_signals"
-        "($help)--stop-timeout=[Timeout (in seconds) to stop a container]:time: "
-        "($help)*--sysctl=-[sysctl options]:sysctl: "
-        "($help -t --tty)"{-t,--tty}"[Allocate a pseudo-tty]"
-        "($help -u --user)"{-u=,--user=}"[Username or UID]:user:_users"
-        "($help)*--ulimit=[ulimit options]:ulimit: "
-        "($help)--userns=[Container user namespace]:user namespace:(host)"
-        "($help)--tmpfs[mount tmpfs]"
-        "($help)*-v[Bind mount a volume]:volume: "
-        "($help)--volume-driver=[Optional volume driver for the container]:volume driver:(local)"
-        "($help)*--volumes-from=[Mount volumes from the specified container]:volume: "
-        "($help -w --workdir)"{-w=,--workdir=}"[Working directory inside the container]:directory:_directories"
-    )
-    opts_create_run_update=(
-        "($help)--blkio-weight=[Block IO (relative weight), between 10 and 1000]:Block IO weight:(10 100 500 1000)"
-        "($help -c --cpu-shares)"{-c=,--cpu-shares=}"[CPU shares (relative weight)]:CPU shares:(0 10 100 200 500 800 1000)"
-        "($help)--cpu-period=[Limit the CPU CFS (Completely Fair Scheduler) period]:CPU period: "
-        "($help)--cpu-quota=[Limit the CPU CFS (Completely Fair Scheduler) quota]:CPU quota: "
-        "($help)--cpu-rt-period=[Limit the CPU real-time period]:CPU real-time period in microseconds: "
-        "($help)--cpu-rt-runtime=[Limit the CPU real-time runtime]:CPU real-time runtime in microseconds: "
-        "($help)--cpuset-cpus=[CPUs in which to allow execution]:CPUs: "
-        "($help)--cpuset-mems=[MEMs in which to allow execution]:MEMs: "
-        "($help)--kernel-memory=[Kernel memory limit in bytes]:Memory limit: "
-        "($help -m --memory)"{-m=,--memory=}"[Memory limit]:Memory limit: "
-        "($help)--memory-reservation=[Memory soft limit]:Memory limit: "
-        "($help)--memory-swap=[Total memory limit with swap]:Memory limit: "
-        "($help)--restart=[Restart policy]:restart policy:(no on-failure always unless-stopped)"
-    )
-    opts_help=("(: -)--help[Print usage]")
-
-    case "$words[1]" in
-        (attach)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                $opts_attach_exec_run_start \
-                "($help)--no-stdin[Do not attach stdin]" \
-                "($help)--sig-proxy[Proxy all received signals to the process (non-TTY mode only)]" \
-                "($help -):containers:__docker_complete_running_containers" && ret=0
-            ;;
-        (commit)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -a --author)"{-a=,--author=}"[Author]:author: " \
-                "($help)*"{-c=,--change=}"[Apply Dockerfile instruction to the created image]:Dockerfile:_files" \
-                "($help -m --message)"{-m=,--message=}"[Commit message]:message: " \
-                "($help -p --pause)"{-p,--pause}"[Pause container during commit]" \
-                "($help -):container:__docker_complete_containers" \
-                "($help -): :__docker_complete_repositories_with_tags" && ret=0
-            ;;
-        (cp)
-            local state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -L --follow-link)"{-L,--follow-link}"[Always follow symbol link]" \
-                "($help -)1:container:->container" \
-                "($help -)2:hostpath:_files" && ret=0
-            case $state in
-                (container)
-                    if compset -P "*:"; then
-                        _files && ret=0
-                    else
-                        __docker_complete_containers -qS ":" && ret=0
-                    fi
-                    ;;
-            esac
-            ;;
-        (create)
-            local state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                $opts_create_run \
-                $opts_create_run_update \
-                "($help -): :__docker_complete_images" \
-                "($help -):command: _command_names -e" \
-                "($help -)*::arguments: _normal" && ret=0
-            case $state in
-                (link)
-                    if compset -P "*:"; then
-                        _wanted alias expl "Alias" compadd -E "" && ret=0
-                    else
-                        __docker_complete_running_containers -qS ":" && ret=0
-                    fi
-                    ;;
-            esac
-            ;;
-        (diff)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -)*:containers:__docker_complete_containers" && ret=0
-            ;;
-        (exec)
-            local state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                $opts_attach_exec_run_start \
-                "($help -d --detach)"{-d,--detach}"[Detached mode: leave the container running in the background]" \
-                "($help)*"{-e=,--env=}"[Set environment variables]:environment variable: " \
-                "($help -i --interactive)"{-i,--interactive}"[Keep stdin open even if not attached]" \
-                "($help)--privileged[Give extended Linux capabilities to the command]" \
-                "($help -t --tty)"{-t,--tty}"[Allocate a pseudo-tty]" \
-                "($help -u --user)"{-u=,--user=}"[Username or UID]:user:_users" \
-                "($help -):containers:__docker_complete_running_containers" \
-                "($help -)*::command:->anycommand" && ret=0
-            case $state in
-                (anycommand)
-                    shift 1 words
-                    (( CURRENT-- ))
-                    _normal && ret=0
-                    ;;
-            esac
-            ;;
-        (export)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -o --output)"{-o=,--output=}"[Write to a file, instead of stdout]:output file:_files" \
-                "($help -)*:containers:__docker_complete_containers" && ret=0
-            ;;
-        (inspect)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --format)"{-f=,--format=}"[Format the output using the given go template]:template: " \
-                "($help -s --size)"{-s,--size}"[Display total file sizes]" \
-                "($help -)*:containers:__docker_complete_containers" && ret=0
-            ;;
-        (kill)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -s --signal)"{-s=,--signal=}"[Signal to send]:signal:_signals" \
-                "($help -)*:containers:__docker_complete_running_containers" && ret=0
-            ;;
-        (logs)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)--details[Show extra details provided to logs]" \
-                "($help -f --follow)"{-f,--follow}"[Follow log output]" \
-                "($help -s --since)"{-s=,--since=}"[Show logs since this timestamp]:timestamp: " \
-                "($help -t --timestamps)"{-t,--timestamps}"[Show timestamps]" \
-                "($help)--tail=[Output the last K lines]:lines:(1 10 20 50 all)" \
-                "($help -)*:containers:__docker_complete_containers" && ret=0
-            ;;
-        (ls|list)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -a --all)"{-a,--all}"[Show all containers]" \
-                "($help)--before=[Show only container created before...]:containers:__docker_complete_containers" \
-                "($help)*"{-f=,--filter=}"[Filter values]:filter:__docker_complete_ps_filters" \
-                "($help)--format=[Pretty-print containers using a Go template]:template: " \
-                "($help -l --latest)"{-l,--latest}"[Show only the latest created container]" \
-                "($help -n --last)"{-n=,--last=}"[Show n last created containers (includes all states)]:n:(1 5 10 25 50)" \
-                "($help)--no-trunc[Do not truncate output]" \
-                "($help -q --quiet)"{-q,--quiet}"[Only show numeric IDs]" \
-                "($help -s --size)"{-s,--size}"[Display total file sizes]" \
-                "($help)--since=[Show only containers created since...]:containers:__docker_complete_containers" && ret=0
-            ;;
-        (pause|unpause)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -)*:containers:__docker_complete_running_containers" && ret=0
-            ;;
-        (port)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -)1:containers:__docker_complete_running_containers" \
-                "($help -)2:port:_ports" && ret=0
-            ;;
-        (prune)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)*--filter=[Filter values]:filter:__docker_complete_prune_filters" \
-                "($help -f --force)"{-f,--force}"[Do not prompt for confirmation]" && ret=0
-            ;;
-        (rename)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -):old name:__docker_complete_containers" \
-                "($help -):new name: " && ret=0
-            ;;
-        (restart)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -t --time)"{-t=,--time=}"[Number of seconds to try to stop for before killing the container]:seconds to before killing:(1 5 10 30 60)" \
-                "($help -)*:containers:__docker_complete_containers_ids" && ret=0
-            ;;
-        (rm)
-            local state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --force)"{-f,--force}"[Force removal]" \
-                "($help -l --link)"{-l,--link}"[Remove the specified link and not the underlying container]" \
-                "($help -v --volumes)"{-v,--volumes}"[Remove the volumes associated to the container]" \
-                "($help -)*:containers:->values" && ret=0
-            case $state in
-                (values)
-                    if [[ ${words[(r)-f]} == -f || ${words[(r)--force]} == --force ]]; then
-                        __docker_complete_containers && ret=0
-                    else
-                        __docker_complete_stopped_containers && ret=0
-                    fi
-                    ;;
-            esac
-            ;;
-        (run)
-            local state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                $opts_create_run \
-                $opts_create_run_update \
-                $opts_attach_exec_run_start \
-                "($help -d --detach)"{-d,--detach}"[Detached mode: leave the container running in the background]" \
-                "($help)--health-cmd=[Command to run to check health]:command: " \
-                "($help)--health-interval=[Time between running the check]:time: " \
-                "($help)--health-retries=[Consecutive failures needed to report unhealthy]:retries:(1 2 3 4 5)" \
-                "($help)--health-timeout=[Maximum time to allow one check to run]:time: " \
-                "($help)--no-healthcheck[Disable any container-specified HEALTHCHECK]" \
-                "($help)--rm[Remove intermediate containers when it exits]" \
-                "($help)--runtime=[Name of the runtime to be used for that container]:runtime:__docker_complete_runtimes" \
-                "($help)--sig-proxy[Proxy all received signals to the process (non-TTY mode only)]" \
-                "($help)--storage-opt=[Storage driver options for the container]:storage options:->storage-opt" \
-                "($help -): :__docker_complete_images" \
-                "($help -):command: _command_names -e" \
-                "($help -)*::arguments: _normal" && ret=0
-            case $state in
-                (link)
-                    if compset -P "*:"; then
-                        _wanted alias expl "Alias" compadd -E "" && ret=0
-                    else
-                        __docker_complete_running_containers -qS ":" && ret=0
-                    fi
-                    ;;
-                (storage-opt)
-                    if compset -P "*="; then
-                        _message "value" && ret=0
-                    else
-                        opts=('size')
-                        _describe -t filter-opts "storage options" opts -qS "=" && ret=0
-                    fi
-                    ;;
-            esac
-            ;;
-        (start)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                $opts_attach_exec_run_start \
-                "($help -a --attach)"{-a,--attach}"[Attach container's stdout/stderr and forward all signals]" \
-                "($help -i --interactive)"{-i,--interactive}"[Attach container's stding]" \
-                "($help -)*:containers:__docker_complete_stopped_containers" && ret=0
-            ;;
-        (stats)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -a --all)"{-a,--all}"[Show all containers (default shows just running)]" \
-                "($help)--format=[Pretty-print images using a Go template]:template: " \
-                "($help)--no-stream[Disable streaming stats and only pull the first result]" \
-                "($help -)*:containers:__docker_complete_running_containers" && ret=0
-            ;;
-        (stop)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -t --time)"{-t=,--time=}"[Number of seconds to try to stop for before killing the container]:seconds to before killing:(1 5 10 30 60)" \
-                "($help -)*:containers:__docker_complete_running_containers" && ret=0
-            ;;
-        (top)
-            local state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -)1:containers:__docker_complete_running_containers" \
-                "($help -)*:: :->ps-arguments" && ret=0
-            case $state in
-                (ps-arguments)
-                    _ps && ret=0
-                    ;;
-            esac
-            ;;
-        (update)
-            local state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                opts_create_run_update \
-                "($help -)*: :->values" && ret=0
-            case $state in
-                (values)
-                    if [[ ${words[(r)--kernel-memory*]} = (--kernel-memory*) ]]; then
-                        __docker_complete_stopped_containers && ret=0
-                    else
-                        __docker_complete_containers && ret=0
-                    fi
-                    ;;
-            esac
-            ;;
-        (wait)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -)*:containers:__docker_complete_running_containers" && ret=0
-            ;;
-        (help)
-            _arguments $(__docker_arguments) ":subcommand:__docker_container_commands" && ret=0
-            ;;
-    esac
-
-    return ret
-}
-
-# EO container
-
-# BO image
-
-__docker_image_commands() {
-    local -a _docker_image_subcommands
-    _docker_image_subcommands=(
-        "build:Build an image from a Dockerfile"
-        "history:Show the history of an image"
-        "import:Import the contents from a tarball to create a filesystem image"
-        "inspect:Display detailed information on one or more images"
-        "load:Load an image from a tar archive or STDIN"
-        "ls:List images"
-        "prune:Remove unused images"
-        "pull:Pull an image or a repository from a registry"
-        "push:Push an image or a repository to a registry"
-        "rm:Remove one or more images"
-        "save:Save one or more images to a tar archive (streamed to STDOUT by default)"
-        "tag:Tag an image into a repository"
-    )
-    _describe -t docker-image-commands "docker image command" _docker_image_subcommands
-}
-
-__docker_image_subcommand() {
-    local -a _command_args opts_help
-    local expl help="--help"
-    integer ret=1
-
-    opts_help=("(: -)--help[Print usage]")
-
-    case "$words[1]" in
-        (build)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)*--add-host=[Add a custom host-to-IP mapping]:host\:ip mapping: " \
-                "($help)*--build-arg=[Build-time variables]:<varname>=<value>: " \
-                "($help)*--cache-from=[Images to consider as cache sources]: :__docker_complete_repositories_with_tags" \
-                "($help -c --cpu-shares)"{-c=,--cpu-shares=}"[CPU shares (relative weight)]:CPU shares:(0 10 100 200 500 800 1000)" \
-                "($help)--cgroup-parent=[Parent cgroup for the container]:cgroup: " \
-                "($help)--compress[Compress the build context using gzip]" \
-                "($help)--cpu-period=[Limit the CPU CFS (Completely Fair Scheduler) period]:CPU period: " \
-                "($help)--cpu-quota=[Limit the CPU CFS (Completely Fair Scheduler) quota]:CPU quota: " \
-                "($help)--cpu-rt-period=[Limit the CPU real-time period]:CPU real-time period in microseconds: " \
-                "($help)--cpu-rt-runtime=[Limit the CPU real-time runtime]:CPU real-time runtime in microseconds: " \
-                "($help)--cpuset-cpus=[CPUs in which to allow execution]:CPUs: " \
-                "($help)--cpuset-mems=[MEMs in which to allow execution]:MEMs: " \
-                "($help)--disable-content-trust[Skip image verification]" \
-                "($help -f --file)"{-f=,--file=}"[Name of the Dockerfile]:Dockerfile:_files" \
-                "($help)--force-rm[Always remove intermediate containers]" \
-                "($help)--isolation=[Container isolation technology]:isolation:(default hyperv process)" \
-                "($help)*--label=[Set metadata for an image]:label=value: " \
-                "($help -m --memory)"{-m=,--memory=}"[Memory limit]:Memory limit: " \
-                "($help)--memory-swap=[Total memory limit with swap]:Memory limit: " \
-                "($help)--network=[Connect a container to a network]:network mode:(bridge none container host)" \
-                "($help)--no-cache[Do not use cache when building the image]" \
-                "($help)--pull[Attempt to pull a newer version of the image]" \
-                "($help -q --quiet)"{-q,--quiet}"[Suppress verbose build output]" \
-                "($help)--rm[Remove intermediate containers after a successful build]" \
-                "($help)*--shm-size=[Size of '/dev/shm' (format is '<number><unit>')]:shm size: " \
-                "($help)--squash[Squash newly built layers into a single new layer]" \
-                "($help -t --tag)*"{-t=,--tag=}"[Repository, name and tag for the image]: :__docker_complete_repositories_with_tags" \
-                "($help)*--ulimit=[ulimit options]:ulimit: " \
-                "($help)--userns=[Container user namespace]:user namespace:(host)" \
-                "($help -):path or URL:_directories" && ret=0
-            ;;
-        (history)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -H --human)"{-H,--human}"[Print sizes and dates in human readable format]" \
-                "($help)--no-trunc[Do not truncate output]" \
-                "($help -q --quiet)"{-q,--quiet}"[Only show numeric IDs]" \
-                "($help -)*: :__docker_complete_images" && ret=0
-            ;;
-        (import)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)*"{-c=,--change=}"[Apply Dockerfile instruction to the created image]:Dockerfile:_files" \
-                "($help -m --message)"{-m=,--message=}"[Commit message for imported image]:message: " \
-                "($help -):URL:(- http:// file://)" \
-                "($help -): :__docker_complete_repositories_with_tags" && ret=0
-            ;;
-        (inspect)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --format)"{-f=,--format=}"[Format the output using the given go template]:template: " \
-                "($help -)*:images:__docker_complete_images" && ret=0
-            ;;
-        (load)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -i --input)"{-i=,--input=}"[Read from tar archive file]:archive file:_files -g \"*.((tar|TAR)(.gz|.GZ|.Z|.bz2|.lzma|.xz|)|(tbz|tgz|txz))(-.)\"" \
-                "($help -q --quiet)"{-q,--quiet}"[Suppress the load output]" && ret=0
-            ;;
-        (ls|list)
-            local state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -a --all)"{-a,--all}"[Show all images]" \
-                "($help)--digests[Show digests]" \
-                "($help)*"{-f=,--filter=}"[Filter values]:filter:__docker_complete_images_filters" \
-                "($help)--format=[Pretty-print images using a Go template]:template: " \
-                "($help)--no-trunc[Do not truncate output]" \
-                "($help -q --quiet)"{-q,--quiet}"[Only show numeric IDs]" \
-                "($help -): :__docker_complete_repositories" && ret=0
-            ;;
-        (prune)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -a --all)"{-a,--all}"[Remove all unused images, not just dangling ones]" \
-                "($help)*--filter=[Filter values]:filter:__docker_complete_prune_filters" \
-                "($help -f --force)"{-f,--force}"[Do not prompt for confirmation]" && ret=0
-            ;;
-        (pull)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -a --all-tags)"{-a,--all-tags}"[Download all tagged images]" \
-                "($help)--disable-content-trust[Skip image verification]" \
-                "($help -):name:__docker_search" && ret=0
-            ;;
-        (push)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)--disable-content-trust[Skip image signing]" \
-                "($help -): :__docker_complete_images" && ret=0
-            ;;
-        (rm)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --force)"{-f,--force}"[Force removal]" \
-                "($help)--no-prune[Do not delete untagged parents]" \
-                "($help -)*: :__docker_complete_images" && ret=0
-            ;;
-        (save)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -o --output)"{-o=,--output=}"[Write to file]:file:_files" \
-                "($help -)*: :__docker_complete_images" && ret=0
-            ;;
-        (tag)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -):source:__docker_complete_images"\
-                "($help -):destination:__docker_complete_repositories_with_tags" && ret=0
-            ;;
-        (help)
-            _arguments $(__docker_arguments) ":subcommand:__docker_container_commands" && ret=0
-            ;;
-    esac
-
-    return ret
-}
-
-# EO image
-
-# BO network
-
-__docker_network_complete_ls_filters() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-
-    if compset -P '*='; then
-        case "${${words[-1]%=*}#*=}" in
-            (driver)
-                __docker_complete_info_plugins Network && ret=0
-                ;;
-            (id)
-                __docker_complete_networks_ids && ret=0
-                ;;
-            (name)
-                __docker_complete_networks_names && ret=0
-                ;;
-            (scope)
-                opts=('global' 'local' 'swarm')
-                _describe -t scope-filter-opts "Scope filter options" opts && ret=0
-                ;;
-            (type)
-                opts=('builtin' 'custom')
-                _describe -t type-filter-opts "Type filter options" opts && ret=0
-                ;;
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        opts=('driver' 'id' 'label' 'name' 'scope' 'type')
-        _describe -t filter-opts "Filter Options" opts -qS "=" && ret=0
-    fi
-
-    return ret
-}
-
-__docker_get_networks() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    local line s
-    declare -a lines networks
-
-    type=$1; shift
-
-    lines=(${(f)${:-"$(_call_program commands docker $docker_options network ls)"$'\n'}})
-
-    # Parse header line to find columns
-    local i=1 j=1 k header=${lines[1]}
-    declare -A begin end
-    while (( j < ${#header} - 1 )); do
-        i=$(( j + ${${header[$j,-1]}[(i)[^ ]]} - 1 ))
-        j=$(( i + ${${header[$i,-1]}[(i)  ]} - 1 ))
-        k=$(( j + ${${header[$j,-1]}[(i)[^ ]]} - 2 ))
-        begin[${header[$i,$((j-1))]}]=$i
-        end[${header[$i,$((j-1))]}]=$k
-    done
-    end[${header[$i,$((j-1))]}]=-1
-    lines=(${lines[2,-1]})
-
-    # Network ID
-    if [[ $type = (ids|all) ]]; then
-        for line in $lines; do
-            s="${line[${begin[NETWORK ID]},${end[NETWORK ID]}]%% ##}"
-            s="$s:${(l:7:: :::)${${line[${begin[DRIVER]},${end[DRIVER]}]}%% ##}}"
-            s="$s, ${${line[${begin[SCOPE]},${end[SCOPE]}]}%% ##}"
-            networks=($networks $s)
-        done
-    fi
-
-    # Names
-    if [[ $type = (names|all) ]]; then
-        for line in $lines; do
-            s="${line[${begin[NAME]},${end[NAME]}]%% ##}"
-            s="$s:${(l:7:: :::)${${line[${begin[DRIVER]},${end[DRIVER]}]}%% ##}}"
-            s="$s, ${${line[${begin[SCOPE]},${end[SCOPE]}]}%% ##}"
-            networks=($networks $s)
-        done
-    fi
-
-    _describe -t networks-list "networks" networks "$@" && ret=0
-    return ret
-}
-
-__docker_complete_networks() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_get_networks all "$@"
-}
-
-__docker_complete_networks_ids() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_get_networks ids "$@"
-}
-
-__docker_complete_networks_names() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_get_networks names "$@"
-}
-
-__docker_network_commands() {
-    local -a _docker_network_subcommands
-    _docker_network_subcommands=(
-        "connect:Connect a container to a network"
-        "create:Creates a new network with a name specified by the user"
-        "disconnect:Disconnects a container from a network"
-        "inspect:Displays detailed information on a network"
-        "ls:Lists all the networks created by the user"
-        "prune:Remove all unused networks"
-        "rm:Deletes one or more networks"
-    )
-    _describe -t docker-network-commands "docker network command" _docker_network_subcommands
-}
-
-__docker_network_subcommand() {
-    local -a _command_args opts_help
-    local expl help="--help"
-    integer ret=1
-
-    opts_help=("(: -)--help[Print usage]")
-
-    case "$words[1]" in
-        (connect)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)*--alias=[Add network-scoped alias for the container]:alias: " \
-                "($help)--ip=[IPv4 address]:IPv4: " \
-                "($help)--ip6=[IPv6 address]:IPv6: " \
-                "($help)*--link=[Add a link to another container]:link:->link" \
-                "($help)*--link-local-ip=[Add a link-local address for the container]:IPv4/IPv6: " \
-                "($help -)1:network:__docker_complete_networks" \
-                "($help -)2:containers:__docker_complete_containers" && ret=0
-
-            case $state in
-                (link)
-                    if compset -P "*:"; then
-                        _wanted alias expl "Alias" compadd -E "" && ret=0
-                    else
-                        __docker_complete_running_containers -qS ":" && ret=0
-                    fi
-                    ;;
-            esac
-            ;;
-        (create)
-            _arguments $(__docker_arguments) -A '-*' \
-                $opts_help \
-                "($help)--attachable[Enable manual container attachment]" \
-                "($help)*--aux-address[Auxiliary IPv4 or IPv6 addresses used by network driver]:key=IP: " \
-                "($help -d --driver)"{-d=,--driver=}"[Driver to manage the Network]:driver:(null host bridge overlay)" \
-                "($help)*--gateway=[IPv4 or IPv6 Gateway for the master subnet]:IP: " \
-                "($help)--internal[Restricts external access to the network]" \
-                "($help)*--ip-range=[Allocate container ip from a sub-range]:IP/mask: " \
-                "($help)--ipam-driver=[IP Address Management Driver]:driver:(default)" \
-                "($help)*--ipam-opt=[Custom IPAM plugin options]:opt=value: " \
-                "($help)--ipv6[Enable IPv6 networking]" \
-                "($help)*--label=[Set metadata on a network]:label=value: " \
-                "($help)*"{-o=,--opt=}"[Driver specific options]:opt=value: " \
-                "($help)*--subnet=[Subnet in CIDR format that represents a network segment]:IP/mask: " \
-                "($help -)1:Network Name: " && ret=0
-            ;;
-        (disconnect)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -)1:network:__docker_complete_networks" \
-                "($help -)2:containers:__docker_complete_containers" && ret=0
-            ;;
-        (inspect)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --format)"{-f=,--format=}"[Format the output using the given go template]:template: " \
-                "($help)--verbose[Show detailed information]" \
-                "($help -)*:network:__docker_complete_networks" && ret=0
-            ;;
-        (ls)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)--no-trunc[Do not truncate the output]" \
-                "($help)*"{-f=,--filter=}"[Provide filter values]:filter:__docker_network_complete_ls_filters" \
-                "($help)--format=[Pretty-print networks using a Go template]:template: " \
-                "($help -q --quiet)"{-q,--quiet}"[Only display numeric IDs]" && ret=0
-            ;;
-        (prune)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)*--filter=[Filter values]:filter:__docker_complete_prune_filters" \
-                "($help -f --force)"{-f,--force}"[Do not prompt for confirmation]" && ret=0
-            ;;
-        (rm)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -)*:network:__docker_complete_networks" && ret=0
-            ;;
-        (help)
-            _arguments $(__docker_arguments) ":subcommand:__docker_network_commands" && ret=0
-            ;;
-    esac
-
-    return ret
-}
-
-# EO network
-
-# BO node
-
-__docker_node_complete_ls_filters() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-
-    if compset -P '*='; then
-        case "${${words[-1]%=*}#*=}" in
-            (id)
-                __docker_complete_nodes_ids && ret=0
-                ;;
-            (membership)
-                membership_opts=('accepted' 'pending' 'rejected')
-                _describe -t membership-opts "membership options" membership_opts && ret=0
-                ;;
-            (name)
-                __docker_complete_nodes_names && ret=0
-                ;;
-            (role)
-                role_opts=('manager' 'worker')
-                _describe -t role-opts "role options" role_opts && ret=0
-                ;;
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        opts=('id' 'label' 'membership' 'name' 'role')
-        _describe -t filter-opts "filter options" opts -qS "=" && ret=0
-    fi
-
-    return ret
-}
-
-__docker_node_complete_ps_filters() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-
-    if compset -P '*='; then
-        case "${${words[-1]%=*}#*=}" in
-            (desired-state)
-                state_opts=('accepted' 'running' 'shutdown')
-                _describe -t state-opts "desired state options" state_opts && ret=0
-                ;;
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        opts=('desired-state' 'id' 'label' 'name')
-        _describe -t filter-opts "filter options" opts -qS "=" && ret=0
-    fi
-
-    return ret
-}
-
-__docker_nodes() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    local line s
-    declare -a lines nodes args
-
-    type=$1; shift
-    filter=$1; shift
-    [[ $filter != "none" ]] && args=("-f $filter")
-
-    lines=(${(f)${:-"$(_call_program commands docker $docker_options node ls $args)"$'\n'}})
-    # Parse header line to find columns
-    local i=1 j=1 k header=${lines[1]}
-    declare -A begin end
-    while (( j < ${#header} - 1 )); do
-        i=$(( j + ${${header[$j,-1]}[(i)[^ ]]} - 1 ))
-        j=$(( i + ${${header[$i,-1]}[(i)  ]} - 1 ))
-        k=$(( j + ${${header[$j,-1]}[(i)[^ ]]} - 2 ))
-        begin[${header[$i,$((j-1))]}]=$i
-        end[${header[$i,$((j-1))]}]=$k
-    done
-    end[${header[$i,$((j-1))]}]=-1
-    lines=(${lines[2,-1]})
-
-    # Node ID
-    if [[ $type = (ids|all) ]]; then
-        for line in $lines; do
-            s="${line[${begin[ID]},${end[ID]}]%% ##}"
-            nodes=($nodes $s)
-        done
-    fi
-
-    # Names
-    if [[ $type = (names|all) ]]; then
-        for line in $lines; do
-            s="${line[${begin[NAME]},${end[NAME]}]%% ##}"
-            nodes=($nodes $s)
-        done
-    fi
-
-    _describe -t nodes-list "nodes" nodes "$@" && ret=0
-    return ret
-}
-
-__docker_complete_nodes() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_nodes all none "$@"
-}
-
-__docker_complete_nodes_ids() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_nodes ids none "$@"
-}
-
-__docker_complete_nodes_names() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_nodes names none "$@"
-}
-
-__docker_complete_pending_nodes() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_nodes all "membership=pending" "$@"
-}
-
-__docker_complete_manager_nodes() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_nodes all "role=manager" "$@"
-}
-
-__docker_complete_worker_nodes() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_nodes all "role=worker" "$@"
-}
-
-__docker_node_commands() {
-    local -a _docker_node_subcommands
-    _docker_node_subcommands=(
-        "demote:Demote a node as manager in the swarm"
-        "inspect:Display detailed information on one or more nodes"
-        "ls:List nodes in the swarm"
-        "promote:Promote a node as manager in the swarm"
-        "rm:Remove one or more nodes from the swarm"
-        "ps:List tasks running on one or more nodes, defaults to current node"
-        "update:Update a node"
-    )
-    _describe -t docker-node-commands "docker node command" _docker_node_subcommands
-}
-
-__docker_node_subcommand() {
-    local -a _command_args opts_help
-    local expl help="--help"
-    integer ret=1
-
-    opts_help=("(: -)--help[Print usage]")
-
-    case "$words[1]" in
-        (rm|remove)
-             _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --force)"{-f,--force}"[Force remove a node from the swarm]" \
-                "($help -)*:node:__docker_complete_pending_nodes" && ret=0
-            ;;
-        (demote)
-             _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -)*:node:__docker_complete_manager_nodes" && ret=0
-            ;;
-        (inspect)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --format)"{-f=,--format=}"[Format the output using the given go template]:template: " \
-                "($help)--pretty[Print the information in a human friendly format]" \
-                "($help -)*:node:__docker_complete_nodes" && ret=0
-            ;;
-        (ls|list)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)*"{-f=,--filter=}"[Provide filter values]:filter:__docker_node_complete_ls_filters" \
-                "($help -q --quiet)"{-q,--quiet}"[Only display IDs]" && ret=0
-            ;;
-        (promote)
-             _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -)*:node:__docker_complete_worker_nodes" && ret=0
-            ;;
-        (ps)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -a --all)"{-a,--all}"[Display all instances]" \
-                "($help)*"{-f=,--filter=}"[Provide filter values]:filter:__docker_node_complete_ps_filters" \
-                "($help)--format=[Format the output using the given go template]:template: " \
-                "($help)--no-resolve[Do not map IDs to Names]" \
-                "($help)--no-trunc[Do not truncate output]" \
-                "($help -q --quiet)"{-q,--quiet}"[Only display IDs]" \
-                "($help -)*:node:__docker_complete_nodes" && ret=0
-            ;;
-        (update)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)--availability=[Availability of the node]:availability:(active pause drain)" \
-                "($help)*--label-add=[Add or update a node label]:key=value: " \
-                "($help)*--label-rm=[Remove a node label if exists]:label: " \
-                "($help)--role=[Role of the node]:role:(manager worker)" \
-                "($help -)1:node:__docker_complete_nodes" && ret=0
-            ;;
-        (help)
-            _arguments $(__docker_arguments) ":subcommand:__docker_node_commands" && ret=0
-            ;;
-    esac
-
-    return ret
-}
-
-# EO node
-
-# BO plugin
-
-__docker_plugin_complete_ls_filters() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-
-    if compset -P '*='; then
-        case "${${words[-1]%=*}#*=}" in
-            (capability)
-                opts=('authz' 'ipamdriver' 'networkdriver' 'volumedriver')
-                _describe -t capability-opts "capability options" opts && ret=0
-                ;;
-            (enabled)
-                opts=('false' 'true')
-                _describe -t enabled-opts "enabled options" opts && ret=0
-                ;;
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        opts=('capability' 'enabled')
-        _describe -t filter-opts "filter options" opts -qS "=" && ret=0
-    fi
-
-    return ret
-}
-
-__docker_plugins() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    local line s
-    declare -a lines plugins args
-
-    filter=$1; shift
-    [[ $filter != "none" ]] && args=("-f $filter")
-
-    lines=(${(f)${:-"$(_call_program commands docker $docker_options plugin ls $args)"$'\n'}})
-
-    # Parse header line to find columns
-    local i=1 j=1 k header=${lines[1]}
-    declare -A begin end
-    while (( j < ${#header} - 1 )); do
-        i=$(( j + ${${header[$j,-1]}[(i)[^ ]]} - 1 ))
-        j=$(( i + ${${header[$i,-1]}[(i)  ]} - 1 ))
-        k=$(( j + ${${header[$j,-1]}[(i)[^ ]]} - 2 ))
-        begin[${header[$i,$((j-1))]}]=$i
-        end[${header[$i,$((j-1))]}]=$k
-    done
-    end[${header[$i,$((j-1))]}]=-1
-    lines=(${lines[2,-1]})
-
-    # Name
-    for line in $lines; do
-        s="${line[${begin[NAME]},${end[NAME]}]%% ##}"
-        s="$s:${(l:7:: :::)${${line[${begin[TAG]},${end[TAG]}]}%% ##}}"
-        plugins=($plugins $s)
-    done
-
-    _describe -t plugins-list "plugins" plugins "$@" && ret=0
-    return ret
-}
-
-__docker_complete_plugins() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_plugins none "$@"
-}
-
-__docker_complete_enabled_plugins() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_plugins enabled=true "$@"
-}
-
-__docker_complete_disabled_plugins() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_plugins enabled=false "$@"
-}
-
-__docker_plugin_commands() {
-    local -a _docker_plugin_subcommands
-    _docker_plugin_subcommands=(
-        "disable:Disable a plugin"
-        "enable:Enable a plugin"
-        "inspect:Return low-level information about a plugin"
-        "install:Install a plugin"
-        "ls:List plugins"
-        "push:Push a plugin"
-        "rm:Remove a plugin"
-        "set:Change settings for a plugin"
-        "upgrade:Upgrade an existing plugin"
-    )
-    _describe -t docker-plugin-commands "docker plugin command" _docker_plugin_subcommands
-}
-
-__docker_plugin_subcommand() {
-    local -a _command_args opts_help
-    local expl help="--help"
-    integer ret=1
-
-    opts_help=("(: -)--help[Print usage]")
-
-    case "$words[1]" in
-        (disable)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --force)"{-f,--force}"[Force the disable of an active plugin]" \
-                "($help -)1:plugin:__docker_complete_enabled_plugins" && ret=0
-            ;;
-        (enable)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)--timeout=[HTTP client timeout (in seconds)]:timeout: " \
-                "($help -)1:plugin:__docker_complete_disabled_plugins" && ret=0
-            ;;
-        (inspect)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --format)"{-f=,--format=}"[Format the output using the given Go template]:template: " \
-                "($help -)*:plugin:__docker_complete_plugins" && ret=0
-            ;;
-        (install)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)--alias=[Local name for plugin]:alias: " \
-                "($help)--disable[Do not enable the plugin on install]" \
-                "($help)--disable-content-trust[Skip image verification (default true)]" \
-                "($help)--grant-all-permissions[Grant all permissions necessary to run the plugin]" \
-                "($help -)1:plugin:__docker_complete_plugins" \
-                "($help -)*:key=value: " && ret=0
-            ;;
-        (ls|list)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)*"{-f=,--filter=}"[Filter output based on conditions provided]:filter:__docker_plugin_complete_ls_filters" \
-                "($help --format)--format=[Format the output using the given Go template]:template: " \
-                "($help)--no-trunc[Don't truncate output]" \
-                "($help -q --quiet)"{-q,--quiet}"[Only display IDs]" && ret=0
-            ;;
-        (push)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)--disable-content-trust[Skip image verification (default true)]" \
-                "($help -)1:plugin:__docker_complete_plugins" && ret=0
-            ;;
-        (rm|remove)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --force)"{-f,--force}"[Force the removal of an active plugin]" \
-                "($help -)*:plugin:__docker_complete_plugins" && ret=0
-            ;;
-        (set)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -)1:plugin:__docker_complete_plugins" \
-                "($help -)*:key=value: " && ret=0
-            ;;
-        (upgrade)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)--disable-content-trust[Skip image verification (default true)]" \
-                "($help)--grant-all-permissions[Grant all permissions necessary to run the plugin]" \
-                "($help)--skip-remote-check[Do not check if specified remote plugin matches existing plugin image]" \
-                "($help -)1:plugin:__docker_complete_plugins" \
-                "($help -):remote: " && ret=0
-            ;;
-        (help)
-            _arguments $(__docker_arguments) ":subcommand:__docker_plugin_commands" && ret=0
-            ;;
-    esac
-
-    return ret
-}
-
-# EO plugin
-
-# BO secret
-
-__docker_secrets() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    local line s
-    declare -a lines secrets
-
-    type=$1; shift
-
-    lines=(${(f)${:-"$(_call_program commands docker $docker_options secret ls)"$'\n'}})
-
-    # Parse header line to find columns
-    local i=1 j=1 k header=${lines[1]}
-    declare -A begin end
-    while (( j < ${#header} - 1 )); do
-        i=$(( j + ${${header[$j,-1]}[(i)[^ ]]} - 1 ))
-        j=$(( i + ${${header[$i,-1]}[(i)  ]} - 1 ))
-        k=$(( j + ${${header[$j,-1]}[(i)[^ ]]} - 2 ))
-        begin[${header[$i,$((j-1))]}]=$i
-        end[${header[$i,$((j-1))]}]=$k
-    done
-    end[${header[$i,$((j-1))]}]=-1
-    lines=(${lines[2,-1]})
-
-    # ID
-    if [[ $type = (ids|all) ]]; then
-        for line in $lines; do
-            s="${line[${begin[ID]},${end[ID]}]%% ##}"
-            secrets=($secrets $s)
-        done
-    fi
-
-    # Names
-    if [[ $type = (names|all) ]]; then
-        for line in $lines; do
-            s="${line[${begin[NAME]},${end[NAME]}]%% ##}"
-            secrets=($secrets $s)
-        done
-    fi
-
-    _describe -t secrets-list "secrets" secrets "$@" && ret=0
-    return ret
-}
-
-__docker_complete_secrets() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_secrets all "$@"
-}
-
-__docker_secret_commands() {
-    local -a _docker_secret_subcommands
-    _docker_secret_subcommands=(
-        "create:Create a secret using stdin as content"
-        "inspect:Display detailed information on one or more secrets"
-        "ls:List secrets"
-        "rm:Remove one or more secrets"
-    )
-    _describe -t docker-secret-commands "docker secret command" _docker_secret_subcommands
-}
-
-__docker_secret_subcommand() {
-    local -a _command_args opts_help
-    local expl help="--help"
-    integer ret=1
-
-    opts_help=("(: -)--help[Print usage]")
-
-    case "$words[1]" in
-        (create)
-            _arguments $(__docker_arguments) -A '-*' \
-                $opts_help \
-                "($help)*"{-l=,--label=}"[Secret labels]:label: " \
-                "($help -):secret: " && ret=0
-            ;;
-        (inspect)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --format)"{-f=,--format=}"[Format the output using the given Go template]:template: " \
-                "($help -)*:secret:__docker_complete_secrets" && ret=0
-            ;;
-        (ls|list)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)--format=[Format the output using the given go template]:template: " \
-                "($help -q --quiet)"{-q,--quiet}"[Only display IDs]" && ret=0
-            ;;
-        (rm|remove)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -)*:secret:__docker_complete_secrets" && ret=0
-            ;;
-        (help)
-            _arguments $(__docker_arguments) ":subcommand:__docker_secret_commands" && ret=0
-            ;;
-    esac
-
-    return ret
-}
-
-# EO secret
-
-# BO service
-
-__docker_service_complete_ls_filters() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-
-    if compset -P '*='; then
-        case "${${words[-1]%=*}#*=}" in
-            (id)
-                __docker_complete_services_ids && ret=0
-                ;;
-            (mode)
-                opts=('global' 'replicated')
-                _describe -t mode-opts "mode options" opts && ret=0
-                ;;
-            (name)
-                __docker_complete_services_names && ret=0
-                ;;
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        opts=('id' 'label' 'mode' 'name')
-        _describe -t filter-opts "filter options" opts -qS "=" && ret=0
-    fi
-
-    return ret
-}
-
-__docker_service_complete_ps_filters() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-
-    if compset -P '*='; then
-        case "${${words[-1]%=*}#*=}" in
-            (desired-state)
-                state_opts=('accepted' 'running' 'shutdown')
-                _describe -t state-opts "desired state options" state_opts && ret=0
-                ;;
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        opts=('desired-state' 'id' 'label' 'name')
-        _describe -t filter-opts "filter options" opts -qS "=" && ret=0
-    fi
-
-    return ret
-}
-
-__docker_service_complete_placement_pref() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-
-    if compset -P '*='; then
-        case "${${words[-1]%=*}#*=}" in
-            (spread)
-                opts=('engine.labels' 'node.labels')
-                _describe -t spread-opts "spread options" opts -qS "." && ret=0
-                ;;
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        opts=('spread')
-        _describe -t pref-opts "placement pref options" opts -qS "=" && ret=0
-    fi
-
-    return ret
-}
-
-__docker_services() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    local line s
-    declare -a lines services
-
-    type=$1; shift
-
-    lines=(${(f)${:-"$(_call_program commands docker $docker_options service ls)"$'\n'}})
-
-    # Parse header line to find columns
-    local i=1 j=1 k header=${lines[1]}
-    declare -A begin end
-    while (( j < ${#header} - 1 )); do
-        i=$(( j + ${${header[$j,-1]}[(i)[^ ]]} - 1 ))
-        j=$(( i + ${${header[$i,-1]}[(i)  ]} - 1 ))
-        k=$(( j + ${${header[$j,-1]}[(i)[^ ]]} - 2 ))
-        begin[${header[$i,$((j-1))]}]=$i
-        end[${header[$i,$((j-1))]}]=$k
-    done
-    end[${header[$i,$((j-1))]}]=-1
-    lines=(${lines[2,-1]})
-
-    # Service ID
-    if [[ $type = (ids|all) ]]; then
-        for line in $lines; do
-            s="${line[${begin[ID]},${end[ID]}]%% ##}"
-            s="$s:${(l:7:: :::)${${line[${begin[IMAGE]},${end[IMAGE]}]}%% ##}}"
-            services=($services $s)
-        done
-    fi
-
-    # Names
-    if [[ $type = (names|all) ]]; then
-        for line in $lines; do
-            s="${line[${begin[NAME]},${end[NAME]}]%% ##}"
-            s="$s:${(l:7:: :::)${${line[${begin[IMAGE]},${end[IMAGE]}]}%% ##}}"
-            services=($services $s)
-        done
-    fi
-
-    _describe -t services-list "services" services "$@" && ret=0
-    return ret
-}
-
-__docker_complete_services() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_services all "$@"
-}
-
-__docker_complete_services_ids() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_services ids "$@"
-}
-
-__docker_complete_services_names() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_services names "$@"
-}
-
-__docker_service_commands() {
-    local -a _docker_service_subcommands
-    _docker_service_subcommands=(
-        "create:Create a new service"
-        "inspect:Display detailed information on one or more services"
-        "logs:Fetch the logs of a service or task"
-        "ls:List services"
-        "rm:Remove one or more services"
-        "scale:Scale one or multiple replicated services"
-        "ps:List the tasks of a service"
-        "update:Update a service"
-    )
-    _describe -t docker-service-commands "docker service command" _docker_service_subcommands
-}
-
-__docker_service_subcommand() {
-    local -a _command_args opts_help opts_create_update
-    local expl help="--help"
-    integer ret=1
-
-    opts_help=("(: -)--help[Print usage]")
-    opts_create_update=(
-        "($help)*--constraint=[Placement constraints]:constraint: "
-        "($help)--endpoint-mode=[Placement constraints]:mode:(dnsrr vip)"
-        "($help)*"{-e=,--env=}"[Set environment variables]:env: "
-        "($help)--health-cmd=[Command to run to check health]:command: "
-        "($help)--health-interval=[Time between running the check]:time: "
-        "($help)--health-retries=[Consecutive failures needed to report unhealthy]:retries:(1 2 3 4 5)"
-        "($help)--health-timeout=[Maximum time to allow one check to run]:time: "
-        "($help)--hostname=[Service container hostname]:hostname: " \
-        "($help)*--label=[Service labels]:label: "
-        "($help)--limit-cpu=[Limit CPUs]:value: "
-        "($help)--limit-memory=[Limit Memory]:value: "
-        "($help)--log-driver=[Logging driver for service]:logging driver:__docker_complete_log_drivers"
-        "($help)*--log-opt=[Logging driver options]:log driver options:__docker_complete_log_options"
-        "($help)*--mount=[Attach a filesystem mount to the service]:mount: "
-        "($help)*--network=[Network attachments]:network: "
-        "($help)--no-healthcheck[Disable any container-specified HEALTHCHECK]"
-        "($help)*"{-p=,--publish=}"[Publish a port as a node port]:port: "
-        "($help)--read-only[Mount the container's root filesystem as read only]"
-        "($help)--replicas=[Number of tasks]:replicas: "
-        "($help)--reserve-cpu=[Reserve CPUs]:value: "
-        "($help)--reserve-memory=[Reserve Memory]:value: "
-        "($help)--restart-condition=[Restart when condition is met]:mode:(any none on-failure)"
-        "($help)--restart-delay=[Delay between restart attempts]:delay: "
-        "($help)--restart-max-attempts=[Maximum number of restarts before giving up]:max-attempts: "
-        "($help)--restart-window=[Window used to evaluate the restart policy]:duration: "
-        "($help)--rollback-delay=[Delay between task rollbacks]:duration: "
-        "($help)--rollback-failure-action=[Action on rollback failure]:action:(continue pause)"
-        "($help)--rollback-max-failure-ratio=[Failure rate to tolerate during a rollback]:failure rate: "
-        "($help)--rollback-monitor=[Duration after each task rollback to monitor for failure]:duration: "
-        "($help)--rollback-parallelism=[Maximum number of tasks rolled back simultaneously]:number: "
-        "($help)*--secret=[Specify secrets to expose to the service]:secret:__docker_complete_secrets"
-        "($help)--stop-grace-period=[Time to wait before force killing a container]:grace period: "
-        "($help)--stop-signal=[Signal to stop the container]:signal:_signals"
-        "($help -t --tty)"{-t,--tty}"[Allocate a pseudo-TTY]"
-        "($help)--update-delay=[Delay between updates]:delay: "
-        "($help)--update-failure-action=[Action on update failure]:mode:(continue pause rollback)"
-        "($help)--update-max-failure-ratio=[Failure rate to tolerate during an update]:fraction: "
-        "($help)--update-monitor=[Duration after each task update to monitor for failure]:window: "
-        "($help)--update-parallelism=[Maximum number of tasks updated simultaneously]:number: "
-        "($help -u --user)"{-u=,--user=}"[Username or UID]:user:_users"
-        "($help)--with-registry-auth[Send registry authentication details to swarm agents]"
-        "($help -w --workdir)"{-w=,--workdir=}"[Working directory inside the container]:directory:_directories"
-    )
-
-    case "$words[1]" in
-        (create)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                $opts_create_update \
-                "($help)*--container-label=[Container labels]:label: " \
-                "($help)*--dns=[Set custom DNS servers]:DNS: " \
-                "($help)*--dns-option=[Set DNS options]:DNS option: " \
-                "($help)*--dns-search=[Set custom DNS search domains]:DNS search: " \
-                "($help)*--env-file=[Read environment variables from a file]:environment file:_files" \
-                "($help)--mode=[Service Mode]:mode:(global replicated)" \
-                "($help)--name=[Service name]:name: " \
-                "($help)*--placement-pref=[Add a placement preference]:pref:__docker_service_complete_placement_pref" \
-                "($help)*--publish=[Publish a port]:port: " \
-                "($help -): :__docker_complete_images" \
-                "($help -):command: _command_names -e" \
-                "($help -)*::arguments: _normal" && ret=0
-            ;;
-        (inspect)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --format)"{-f=,--format=}"[Format the output using the given go template]:template: " \
-                "($help)--pretty[Print the information in a human friendly format]" \
-                "($help -)*:service:__docker_complete_services" && ret=0
-            ;;
-        (logs)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --follow)"{-f,--follow}"[Follow log output]" \
-                "($help)--no-resolve[Do not map IDs to Names]" \
-                "($help)--no-task-ids[Do not include task IDs]" \
-                "($help)--no-trunc[Do not truncate output]" \
-                "($help)--since=[Show logs since timestamp]:timestamp: " \
-                "($help)--tail=[Number of lines to show from the end of the logs]:lines:(1 10 20 50 all)" \
-                "($help -t --timestamps)"{-t,--timestamps}"[Show timestamps]" \
-                "($help -)1:service:__docker_complete_services" && ret=0
-            ;;
-        (ls|list)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)*"{-f=,--filter=}"[Filter output based on conditions provided]:filter:__docker_service_complete_ls_filters" \
-                "($help)--format=[Pretty-print services using a Go template]:template: " \
-                "($help -q --quiet)"{-q,--quiet}"[Only display IDs]" && ret=0
-            ;;
-        (rm|remove)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -)*:service:__docker_complete_services" && ret=0
-            ;;
-        (scale)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -)*:service:->values" && ret=0
-            case $state in
-                (values)
-                    if compset -P '*='; then
-                        _message 'replicas' && ret=0
-                    else
-                        __docker_complete_services -qS "="
-                    fi
-                    ;;
-            esac
-            ;;
-        (ps)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)*"{-f=,--filter=}"[Provide filter values]:filter:__docker_service_complete_ps_filters" \
-                "($help)--format=[Format the output using the given go template]:template: " \
-                "($help)--no-resolve[Do not map IDs to Names]" \
-                "($help)--no-trunc[Do not truncate output]" \
-                "($help -q --quiet)"{-q,--quiet}"[Only display task IDs]" \
-                "($help -)*:service:__docker_complete_services" && ret=0
-            ;;
-        (update)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                $opts_create_update \
-                "($help)--arg=[Service command args]:arguments: _normal" \
-                "($help)*--container-label-add=[Add or update container labels]:label: " \
-                "($help)*--container-label-rm=[Remove a container label by its key]:label: " \
-                "($help)*--dns-add=[Add or update custom DNS servers]:DNS: " \
-                "($help)*--dns-rm=[Remove custom DNS servers]:DNS: " \
-                "($help)*--dns-option-add=[Add or update DNS options]:DNS option: " \
-                "($help)*--dns-option-rm=[Remove DNS options]:DNS option: " \
-                "($help)*--dns-search-add=[Add or update custom DNS search domains]:DNS search: " \
-                "($help)*--dns-search-rm=[Remove DNS search domains]:DNS search: " \
-                "($help)--force[Force update]" \
-                "($help)*--group-add=[Add additional supplementary user groups to the container]:group:_groups" \
-                "($help)*--group-rm=[Remove previously added supplementary user groups from the container]:group:_groups" \
-                "($help)--image=[Service image tag]:image:__docker_complete_repositories" \
-                "($help)*--placement-pref-add=[Add a placement preference]:pref:__docker_service_complete_placement_pref" \
-                "($help)*--placement-pref-rm=[Remove a placement preference]:pref:__docker_service_complete_placement_pref" \
-                "($help)*--publish-add=[Add or update a port]:port: " \
-                "($help)*--publish-rm=[Remove a port(target-port mandatory)]:port: " \
-                "($help)--rollback[Rollback to previous specification]" \
-                "($help -)1:service:__docker_complete_services" && ret=0
-            ;;
-        (help)
-            _arguments $(__docker_arguments) ":subcommand:__docker_service_commands" && ret=0
-            ;;
-    esac
-
-    return ret
-}
-
-# EO service
-
-# BO stack
-
-__docker_stack_complete_ps_filters() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-
-    if compset -P '*='; then
-        case "${${words[-1]%=*}#*=}" in
-            (desired-state)
-                state_opts=('accepted' 'running' 'shutdown')
-                _describe -t state-opts "desired state options" state_opts && ret=0
-                ;;
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        opts=('desired-state' 'id' 'name')
-        _describe -t filter-opts "filter options" opts -qS "=" && ret=0
-    fi
-
-    return ret
-}
-
-__docker_stack_complete_services_filters() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-
-    if compset -P '*='; then
-        case "${${words[-1]%=*}#*=}" in
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        opts=('id' 'label' 'name')
-        _describe -t filter-opts "filter options" opts -qS "=" && ret=0
-    fi
-
-    return ret
-}
-
-__docker_stacks() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    local line s
-    declare -a lines stacks
-
-    lines=(${(f)${:-"$(_call_program commands docker $docker_options stack ls)"$'\n'}})
-
-    # Parse header line to find columns
-    local i=1 j=1 k header=${lines[1]}
-    declare -A begin end
-    while (( j < ${#header} - 1 )); do
-        i=$(( j + ${${header[$j,-1]}[(i)[^ ]]} - 1 ))
-        j=$(( i + ${${header[$i,-1]}[(i)  ]} - 1 ))
-        k=$(( j + ${${header[$j,-1]}[(i)[^ ]]} - 2 ))
-        begin[${header[$i,$((j-1))]}]=$i
-        end[${header[$i,$((j-1))]}]=$k
-    done
-    end[${header[$i,$((j-1))]}]=-1
-    lines=(${lines[2,-1]})
-
-    # Service ID
-    for line in $lines; do
-        s="${line[${begin[ID]},${end[ID]}]%% ##}"
-        stacks=($stacks $s)
-    done
-
-    _describe -t stacks-list "stacks" stacks "$@" && ret=0
-    return ret
-}
-
-__docker_complete_stacks() {
-    [[ $PREFIX = -* ]] && return 1
-    __docker_stacks "$@"
-}
-
-__docker_stack_commands() {
-    local -a _docker_stack_subcommands
-    _docker_stack_subcommands=(
-        "deploy:Deploy a new stack or update an existing stack"
-        "ls:List stacks"
-        "ps:List the tasks in the stack"
-        "rm:Remove the stack"
-        "services:List the services in the stack"
-    )
-    _describe -t docker-stack-commands "docker stack command" _docker_stack_subcommands
-}
-
-__docker_stack_subcommand() {
-    local -a _command_args opts_help
-    local expl help="--help"
-    integer ret=1
-
-    opts_help=("(: -)--help[Print usage]")
-
-    case "$words[1]" in
-        (deploy|up)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)--bundle-file=[Path to a Distributed Application Bundle file]:dab:_files -g \"*.dab\"" \
-                "($help -c --compose-file)"{-c=,--compose-file=}"[Path to a Compose file]:compose file:_files -g \"*.(yml|yaml)\"" \
-                "($help)--with-registry-auth[Send registry authentication details to Swarm agents]" \
-                "($help -):stack:__docker_complete_stacks" && ret=0
-            ;;
-        (ls|list)
-            _arguments $(__docker_arguments) \
-                $opts_help && ret=0
-            ;;
-        (ps)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -a --all)"{-a,--all}"[Display all tasks]" \
-                "($help)*"{-f=,--filter=}"[Filter output based on conditions provided]:filter:__docker_stack_complete_ps_filters" \
-                "($help)--format=[Format the output using the given go template]:template: " \
-                "($help)--no-resolve[Do not map IDs to Names]" \
-                "($help)--no-trunc[Do not truncate output]" \
-                "($help -q --quiet)"{-q,--quiet}"[Only display task IDs]" \
-                "($help -):stack:__docker_complete_stacks" && ret=0
-            ;;
-        (rm|remove|down)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -):stack:__docker_complete_stacks" && ret=0
-            ;;
-        (services)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)*"{-f=,--filter=}"[Filter output based on conditions provided]:filter:__docker_stack_complete_services_filters" \
-                "($help)--format=[Pretty-print services using a Go template]:template: " \
-                "($help -q --quiet)"{-q,--quiet}"[Only display IDs]" \
-                "($help -):stack:__docker_complete_stacks" && ret=0
-            ;;
-        (help)
-            _arguments $(__docker_arguments) ":subcommand:__docker_stack_commands" && ret=0
-            ;;
-    esac
-
-    return ret
-}
-
-# EO stack
-
-# BO swarm
-
-__docker_swarm_commands() {
-    local -a _docker_swarm_subcommands
-    _docker_swarm_subcommands=(
-        "init:Initialize a swarm"
-        "join:Join a swarm as a node and/or manager"
-        "join-token:Manage join tokens"
-        "leave:Leave a swarm"
-        "unlock:Unlock swarm"
-        "unlock-key:Manage the unlock key"
-        "update:Update the swarm"
-    )
-    _describe -t docker-swarm-commands "docker swarm command" _docker_swarm_subcommands
-}
-
-__docker_swarm_subcommand() {
-    local -a _command_args opts_help
-    local expl help="--help"
-    integer ret=1
-
-    opts_help=("(: -)--help[Print usage]")
-
-    case "$words[1]" in
-        (init)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)--advertise-addr=[Advertised address]:ip\:port: " \
-                "($help)--data-path-addr=[Data path IP or interface]:ip " \
-                "($help)--autolock[Enable manager autolocking]" \
-                "($help)--availability=[Availability of the node]:availability:(active drain pause)" \
-                "($help)--cert-expiry=[Validity period for node certificates]:duration: " \
-                "($help)--dispatcher-heartbeat=[Dispatcher heartbeat period]:duration: " \
-                "($help)*--external-ca=[Specifications of one or more certificate signing endpoints]:endpoint: " \
-                "($help)--force-new-cluster[Force create a new cluster from current state]" \
-                "($help)--listen-addr=[Listen address]:ip\:port: " \
-                "($help)--max-snapshots[Number of additional Raft snapshots to retain]" \
-                "($help)--snapshot-interval[Number of log entries between Raft snapshots]" \
-                "($help)--task-history-limit=[Task history retention limit]:limit: " && ret=0
-            ;;
-        (join)
-            _arguments $(__docker_arguments) -A '-*' \
-                $opts_help \
-                "($help)--advertise-addr=[Advertised address]:ip\:port: " \
-                "($help)--data-path-addr=[Data path IP or interface]:ip " \
-                "($help)--availability=[Availability of the node]:availability:(active drain pause)" \
-                "($help)--listen-addr=[Listen address]:ip\:port: " \
-                "($help)--token=[Token for entry into the swarm]:secret: " \
-                "($help -):host\:port: " && ret=0
-            ;;
-        (join-token)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -q --quiet)"{-q,--quiet}"[Only display token]" \
-                "($help)--rotate[Rotate join token]" \
-                "($help -):role:(manager worker)" && ret=0
-            ;;
-        (leave)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --force)"{-f,--force}"[Force this node to leave the swarm, ignoring warnings]" && ret=0
-            ;;
-        (unlock)
-            _arguments $(__docker_arguments) \
-                $opts_help && ret=0
-            ;;
-        (unlock-key)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -q --quiet)"{-q,--quiet}"[Only display token]" \
-                "($help)--rotate[Rotate unlock token]" && ret=0
-            ;;
-        (update)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)--autolock[Enable manager autolocking]" \
-                "($help)--cert-expiry=[Validity period for node certificates]:duration: " \
-                "($help)--dispatcher-heartbeat=[Dispatcher heartbeat period]:duration: " \
-                "($help)*--external-ca=[Specifications of one or more certificate signing endpoints]:endpoint: " \
-                "($help)--max-snapshots[Number of additional Raft snapshots to retain]" \
-                "($help)--snapshot-interval[Number of log entries between Raft snapshots]" \
-                "($help)--task-history-limit=[Task history retention limit]:limit: " && ret=0
-            ;;
-        (help)
-            _arguments $(__docker_arguments) ":subcommand:__docker_network_commands" && ret=0
-            ;;
-    esac
-
-    return ret
-}
-
-# EO swarm
-
-# BO system
-
-__docker_system_commands() {
-    local -a _docker_system_subcommands
-    _docker_system_subcommands=(
-        "df:Show docker filesystem usage"
-        "events:Get real time events from the server"
-        "info:Display system-wide information"
-        "prune:Remove unused data"
-    )
-    _describe -t docker-system-commands "docker system command" _docker_system_subcommands
-}
-
-__docker_system_subcommand() {
-    local -a _command_args opts_help
-    local expl help="--help"
-    integer ret=1
-
-    opts_help=("(: -)--help[Print usage]")
-
-    case "$words[1]" in
-        (df)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -v --verbose)"{-v,--verbose}"[Show detailed information on space usage]" && ret=0
-            ;;
-        (events)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)*"{-f=,--filter=}"[Filter values]:filter:__docker_complete_events_filter" \
-                "($help)--since=[Events created since this timestamp]:timestamp: " \
-                "($help)--until=[Events created until this timestamp]:timestamp: " \
-                "($help)--format=[Format the output using the given go template]:template: " && ret=0
-            ;;
-        (info)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --format)"{-f=,--format=}"[Format the output using the given go template]:template: " && ret=0
-            ;;
-        (prune)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -a --all)"{-a,--all}"[Remove all unused data, not just dangling ones]" \
-                "($help)*--filter=[Filter values]:filter:__docker_complete_prune_filters" \
-                "($help -f --force)"{-f,--force}"[Do not prompt for confirmation]" && ret=0
-            ;;
-        (help)
-            _arguments $(__docker_arguments) ":subcommand:__docker_volume_commands" && ret=0
-            ;;
-    esac
-
-    return ret
-}
-
-# EO system
-
-# BO volume
-
-__docker_volume_complete_ls_filters() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-
-    if compset -P '*='; then
-        case "${${words[-1]%=*}#*=}" in
-            (dangling)
-                dangling_opts=('true' 'false')
-                _describe -t dangling-filter-opts "Dangling Filter Options" dangling_opts && ret=0
-                ;;
-            (driver)
-                __docker_complete_info_plugins Volume && ret=0
-                ;;
-            (name)
-                __docker_complete_volumes && ret=0
-                ;;
-            *)
-                _message 'value' && ret=0
-                ;;
-        esac
-    else
-        opts=('dangling' 'driver' 'label' 'name')
-        _describe -t filter-opts "Filter Options" opts -qS "=" && ret=0
-    fi
-
-    return ret
-}
-
-__docker_complete_volumes() {
-    [[ $PREFIX = -* ]] && return 1
-    integer ret=1
-    declare -a lines volumes
-
-    lines=(${(f)${:-"$(_call_program commands docker $docker_options volume ls)"$'\n'}})
-
-    # Parse header line to find columns
-    local i=1 j=1 k header=${lines[1]}
-    declare -A begin end
-    while (( j < ${#header} - 1 )); do
-        i=$(( j + ${${header[$j,-1]}[(i)[^ ]]} - 1 ))
-        j=$(( i + ${${header[$i,-1]}[(i)  ]} - 1 ))
-        k=$(( j + ${${header[$j,-1]}[(i)[^ ]]} - 2 ))
-        begin[${header[$i,$((j-1))]}]=$i
-        end[${header[$i,$((j-1))]}]=$k
-    done
-    end[${header[$i,$((j-1))]}]=-1
-    lines=(${lines[2,-1]})
-
-    # Names
-    local line s
-    for line in $lines; do
-        s="${line[${begin[VOLUME NAME]},${end[VOLUME NAME]}]%% ##}"
-        s="$s:${(l:7:: :::)${${line[${begin[DRIVER]},${end[DRIVER]}]}%% ##}}"
-        volumes=($volumes $s)
-    done
-
-    _describe -t volumes-list "volumes" volumes && ret=0
-    return ret
-}
-
-__docker_volume_commands() {
-    local -a _docker_volume_subcommands
-    _docker_volume_subcommands=(
-        "create:Create a volume"
-        "inspect:Display detailed information on one or more volumes"
-        "ls:List volumes"
-        "prune:Remove all unused volumes"
-        "rm:Remove one or more volumes"
-    )
-    _describe -t docker-volume-commands "docker volume command" _docker_volume_subcommands
-}
-
-__docker_volume_subcommand() {
-    local -a _command_args opts_help
-    local expl help="--help"
-    integer ret=1
-
-    opts_help=("(: -)--help[Print usage]")
-
-    case "$words[1]" in
-        (create)
-            _arguments $(__docker_arguments) -A '-*' \
-                $opts_help \
-                "($help -d --driver)"{-d=,--driver=}"[Volume driver name]:Driver name:(local)" \
-                "($help)*--label=[Set metadata for a volume]:label=value: " \
-                "($help)*"{-o=,--opt=}"[Driver specific options]:Driver option: " \
-                "($help -)1:Volume name: " && ret=0
-            ;;
-        (inspect)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --format)"{-f=,--format=}"[Format the output using the given go template]:template: " \
-                "($help -)1:volume:__docker_complete_volumes" && ret=0
-            ;;
-        (ls)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)*"{-f=,--filter=}"[Provide filter values]:filter:__docker_volume_complete_ls_filters" \
-                "($help)--format=[Pretty-print volumes using a Go template]:template: " \
-                "($help -q --quiet)"{-q,--quiet}"[Only display volume names]" && ret=0
-            ;;
-        (prune)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --force)"{-f,--force}"[Do not prompt for confirmation]" && ret=0
-            ;;
-        (rm)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --force)"{-f,--force}"[Force the removal of one or more volumes]" \
-                "($help -):volume:__docker_complete_volumes" && ret=0
-            ;;
-        (help)
-            _arguments $(__docker_arguments) ":subcommand:__docker_volume_commands" && ret=0
-            ;;
-    esac
-
-    return ret
-}
-
-# EO volume
-
-__docker_caching_policy() {
-  oldp=( "$1"(Nmh+1) )     # 1 hour
-  (( $#oldp ))
-}
-
-__docker_commands() {
-    local cache_policy
-    integer force_invalidation=0
-
-    zstyle -s ":completion:${curcontext}:" cache-policy cache_policy
-    if [[ -z "$cache_policy" ]]; then
-        zstyle ":completion:${curcontext}:" cache-policy __docker_caching_policy
-    fi
-
-    if ( (( ! ${+_docker_hide_legacy_commands} )) || _cache_invalid docker_hide_legacy_commands ) \
-       && ! _retrieve_cache docker_hide_legacy_commands;
-    then
-        _docker_hide_legacy_commands="${DOCKER_HIDE_LEGACY_COMMANDS}"
-        _store_cache docker_hide_legacy_commands _docker_hide_legacy_commands
-    fi
-
-    if [[ "${_docker_hide_legacy_commands}" != "${DOCKER_HIDE_LEGACY_COMMANDS}" ]]; then
-        force_invalidation=1
-        _docker_hide_legacy_commands="${DOCKER_HIDE_LEGACY_COMMANDS}"
-        _store_cache docker_hide_legacy_commands _docker_hide_legacy_commands
-    fi
-
-    if ( [[ ${+_docker_subcommands} -eq 0 ]] || _cache_invalid docker_subcommands ) \
-        && ! _retrieve_cache docker_subcommands || [[ ${force_invalidation} -eq 1 ]];
-    then
-        local -a lines
-        lines=(${(f)"$(_call_program commands docker 2>&1)"})
-        _docker_subcommands=(${${${(M)${lines[$((${lines[(i)*Commands:]} + 1)),-1]}:# *}## #}/ ##/:})
-        _docker_subcommands=($_docker_subcommands 'daemon:Enable daemon mode' 'help:Show help for a command')
-        (( $#_docker_subcommands > 2 )) && _store_cache docker_subcommands _docker_subcommands
-    fi
-    _describe -t docker-commands "docker command" _docker_subcommands
-}
-
-__docker_subcommand() {
-    local -a _command_args opts_help
-    local expl help="--help"
-    integer ret=1
-
-    opts_help=("(: -)--help[Print usage]")
-
-    case "$words[1]" in
-        (attach|commit|cp|create|diff|exec|export|kill|logs|pause|unpause|port|rename|restart|rm|run|start|stats|stop|top|update|wait)
-            __docker_container_subcommand && ret=0
-            ;;
-        (build|history|import|load|pull|push|save|tag)
-            __docker_image_subcommand && ret=0
-            ;;
-        (checkpoint)
-            local curcontext="$curcontext" state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -): :->command" \
-                "($help -)*:: :->option-or-argument" && ret=0
-
-            case $state in
-                (command)
-                    __docker_checkpoint_commands && ret=0
-                    ;;
-                (option-or-argument)
-                    curcontext=${curcontext%:*:*}:docker-${words[-1]}:
-                    __docker_checkpoint_subcommand && ret=0
-                    ;;
-            esac
-            ;;
-        (container)
-            local curcontext="$curcontext" state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -): :->command" \
-                "($help -)*:: :->option-or-argument" && ret=0
-
-            case $state in
-                (command)
-                    __docker_container_commands && ret=0
-                    ;;
-                (option-or-argument)
-                    curcontext=${curcontext%:*:*}:docker-${words[-1]}:
-                    __docker_container_subcommand && ret=0
-                    ;;
-            esac
-            ;;
-        (daemon)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help)*--add-runtime=[Register an additional OCI compatible runtime]:runtime:__docker_complete_runtimes" \
-                "($help)*--allow-nondistributable-artifacts=[Push nondistributable artifacts to specified registries]:registry: " \
-                "($help)--api-cors-header=[CORS headers in the Engine API]:CORS headers: " \
-                "($help)*--authorization-plugin=[Authorization plugins to load]" \
-                "($help -b --bridge)"{-b=,--bridge=}"[Attach containers to a network bridge]:bridge:_net_interfaces" \
-                "($help)--bip=[Network bridge IP]:IP address: " \
-                "($help)--cgroup-parent=[Parent cgroup for all containers]:cgroup: " \
-                "($help)--cluster-advertise=[Address or interface name to advertise]:Instance to advertise (host\:port): " \
-                "($help)--cluster-store=[URL of the distributed storage backend]:Cluster Store:->cluster-store" \
-                "($help)*--cluster-store-opt=[Cluster store options]:Cluster options:->cluster-store-options" \
-                "($help)--config-file=[Path to daemon configuration file]:Config File:_files" \
-                "($help)--containerd=[Path to containerd socket]:socket:_files -g \"*.sock\"" \
-                "($help)--data-root=[Root directory of persisted Docker data]:path:_directories" \
-                "($help -D --debug)"{-D,--debug}"[Enable debug mode]" \
-                "($help)--default-gateway[Container default gateway IPv4 address]:IPv4 address: " \
-                "($help)--default-gateway-v6[Container default gateway IPv6 address]:IPv6 address: " \
-                "($help)--default-shm-size=[Default shm size for containers]:size:" \
-                "($help)*--default-ulimit=[Default ulimits for containers]:ulimit: " \
-                "($help)--disable-legacy-registry[Disable contacting legacy registries]" \
-                "($help)*--dns=[DNS server to use]:DNS: " \
-                "($help)*--dns-opt=[DNS options to use]:DNS option: " \
-                "($help)*--dns-search=[DNS search domains to use]:DNS search: " \
-                "($help)*--exec-opt=[Runtime execution options]:runtime execution options: " \
-                "($help)--exec-root=[Root directory for execution state files]:path:_directories" \
-                "($help)--experimental[Enable experimental features]" \
-                "($help)--fixed-cidr=[IPv4 subnet for fixed IPs]:IPv4 subnet: " \
-                "($help)--fixed-cidr-v6=[IPv6 subnet for fixed IPs]:IPv6 subnet: " \
-                "($help -G --group)"{-G=,--group=}"[Group for the unix socket]:group:_groups" \
-                "($help -H --host)"{-H=,--host=}"[tcp://host:port to bind/connect to]:host: " \
-                "($help)--icc[Enable inter-container communication]" \
-                "($help)--init[Run an init inside containers to forward signals and reap processes]" \
-                "($help)--init-path=[Path to the docker-init binary]:docker-init binary:_files" \
-                "($help)*--insecure-registry=[Enable insecure registry communication]:registry: " \
-                "($help)--ip=[Default IP when binding container ports]" \
-                "($help)--ip-forward[Enable net.ipv4.ip_forward]" \
-                "($help)--ip-masq[Enable IP masquerading]" \
-                "($help)--iptables[Enable addition of iptables rules]" \
-                "($help)--ipv6[Enable IPv6 networking]" \
-                "($help -l --log-level)"{-l=,--log-level=}"[Logging level]:level:(debug info warn error fatal)" \
-                "($help)*--label=[Key=value labels]:label: " \
-                "($help)--live-restore[Enable live restore of docker when containers are still running]" \
-                "($help)--log-driver=[Default driver for container logs]:logging driver:__docker_complete_log_drivers" \
-                "($help)*--log-opt=[Default log driver options for containers]:log driver options:__docker_complete_log_options" \
-                "($help)--max-concurrent-downloads[Set the max concurrent downloads for each pull]" \
-                "($help)--max-concurrent-uploads[Set the max concurrent uploads for each push]" \
-                "($help)--mtu=[Network MTU]:mtu:(0 576 1420 1500 9000)" \
-                "($help)--oom-score-adjust=[Set the oom_score_adj for the daemon]:oom-score:(-500)" \
-                "($help -p --pidfile)"{-p=,--pidfile=}"[Path to use for daemon PID file]:PID file:_files" \
-                "($help)--raw-logs[Full timestamps without ANSI coloring]" \
-                "($help)*--registry-mirror=[Preferred Docker registry mirror]:registry mirror: " \
-                "($help)--seccomp-profile=[Path to seccomp profile]:path:_files -g \"*.json\"" \
-                "($help -s --storage-driver)"{-s=,--storage-driver=}"[Storage driver to use]:driver:(aufs btrfs devicemapper overlay overlay2 vfs zfs)" \
-                "($help)--selinux-enabled[Enable selinux support]" \
-                "($help)--shutdown-timeout=[Set the shutdown timeout value in seconds]:time: " \
-                "($help)*--storage-opt=[Storage driver options]:storage driver options: " \
-                "($help)--tls[Use TLS]" \
-                "($help)--tlscacert=[Trust certs signed only by this CA]:PEM file:_files -g \"*.(pem|crt)\"" \
-                "($help)--tlscert=[Path to TLS certificate file]:PEM file:_files -g \"*.(pem|crt)\"" \
-                "($help)--tlskey=[Path to TLS key file]:Key file:_files -g \"*.(pem|key)\"" \
-                "($help)--tlsverify[Use TLS and verify the remote]" \
-                "($help)--userns-remap=[User/Group setting for user namespaces]:user\:group:->users-groups" \
-                "($help)--userland-proxy[Use userland proxy for loopback traffic]" \
-                "($help)--userland-proxy-path=[Path to the userland proxy binary]:binary:_files" && ret=0
-
-            case $state in
-                (cluster-store)
-                    if compset -P '*://'; then
-                        _message 'host:port' && ret=0
-                    else
-                        store=('consul' 'etcd' 'zk')
-                        _describe -t cluster-store "Cluster Store" store -qS "://" && ret=0
-                    fi
-                    ;;
-                (cluster-store-options)
-                    if compset -P '*='; then
-                        _files && ret=0
-                    else
-                        opts=('discovery.heartbeat' 'discovery.ttl' 'kv.cacertfile' 'kv.certfile' 'kv.keyfile' 'kv.path')
-                        _describe -t cluster-store-opts "Cluster Store Options" opts -qS "=" && ret=0
-                    fi
-                    ;;
-                (users-groups)
-                    if compset -P '*:'; then
-                        _groups && ret=0
-                    else
-                        _describe -t userns-default "default Docker user management" '(default)' && ret=0
-                        _users && ret=0
-                    fi
-                    ;;
-            esac
-            ;;
-        (events|info)
-            __docker_system_subcommand && ret=0
-            ;;
-        (image)
-            local curcontext="$curcontext" state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -): :->command" \
-                "($help -)*:: :->option-or-argument" && ret=0
-
-            case $state in
-                (command)
-                    __docker_image_commands && ret=0
-                    ;;
-                (option-or-argument)
-                    curcontext=${curcontext%:*:*}:docker-${words[-1]}:
-                    __docker_image_subcommand && ret=0
-                    ;;
-            esac
-            ;;
-        (images)
-            words[1]='ls'
-            __docker_image_subcommand && ret=0
-            ;;
-        (inspect)
-            local state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --format)"{-f=,--format=}"[Format the output using the given go template]:template: " \
-                "($help -s --size)"{-s,--size}"[Display total file sizes if the type is container]" \
-                "($help)--type=[Return JSON for specified type]:type:(container image network node plugin service volume)" \
-                "($help -)*: :->values" && ret=0
-
-            case $state in
-                (values)
-                    if [[ ${words[(r)--type=container]} == --type=container ]]; then
-                        __docker_complete_containers && ret=0
-                    elif [[ ${words[(r)--type=image]} == --type=image ]]; then
-                        __docker_complete_images && ret=0
-                    elif [[ ${words[(r)--type=network]} == --type=network ]]; then
-                        __docker_complete_networks && ret=0
-                    elif [[ ${words[(r)--type=node]} == --type=node ]]; then
-                        __docker_complete_nodes && ret=0
-                    elif [[ ${words[(r)--type=plugin]} == --type=plugin ]]; then
-                        __docker_complete_plugins && ret=0
-                    elif [[ ${words[(r)--type=service]} == --type=secrets ]]; then
-                        __docker_complete_secrets && ret=0
-                    elif [[ ${words[(r)--type=service]} == --type=service ]]; then
-                        __docker_complete_services && ret=0
-                    elif [[ ${words[(r)--type=volume]} == --type=volume ]]; then
-                        __docker_complete_volumes && ret=0
-                    else
-                        __docker_complete_containers
-                        __docker_complete_images
-                        __docker_complete_networks
-                        __docker_complete_nodes
-                        __docker_complete_plugins
-                        __docker_complete_secrets
-                        __docker_complete_services
-                        __docker_complete_volumes && ret=0
-                    fi
-                    ;;
-            esac
-            ;;
-        (login)
-            _arguments $(__docker_arguments) -A '-*' \
-                $opts_help \
-                "($help -p --password)"{-p=,--password=}"[Password]:password: " \
-                "($help -u --user)"{-u=,--user=}"[Username]:username: " \
-                "($help -)1:server: " && ret=0
-            ;;
-        (logout)
-            _arguments $(__docker_arguments) -A '-*' \
-                $opts_help \
-                "($help -)1:server: " && ret=0
-            ;;
-        (network)
-            local curcontext="$curcontext" state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -): :->command" \
-                "($help -)*:: :->option-or-argument" && ret=0
-
-            case $state in
-                (command)
-                    __docker_network_commands && ret=0
-                    ;;
-                (option-or-argument)
-                    curcontext=${curcontext%:*:*}:docker-${words[-1]}:
-                    __docker_network_subcommand && ret=0
-                    ;;
-            esac
-            ;;
-        (node)
-            local curcontext="$curcontext" state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -): :->command" \
-                "($help -)*:: :->option-or-argument" && ret=0
-
-            case $state in
-                (command)
-                    __docker_node_commands && ret=0
-                    ;;
-                (option-or-argument)
-                    curcontext=${curcontext%:*:*}:docker-${words[-1]}:
-                    __docker_node_subcommand && ret=0
-                    ;;
-            esac
-            ;;
-        (plugin)
-            local curcontext="$curcontext" state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -): :->command" \
-                "($help -)*:: :->option-or-argument" && ret=0
-
-            case $state in
-                (command)
-                    __docker_plugin_commands && ret=0
-                    ;;
-                (option-or-argument)
-                    curcontext=${curcontext%:*:*}:docker-${words[-1]}:
-                    __docker_plugin_subcommand && ret=0
-                    ;;
-            esac
-            ;;
-        (ps)
-            words[1]='ls'
-            __docker_container_subcommand && ret=0
-            ;;
-        (rmi)
-            words[1]='rm'
-            __docker_image_subcommand && ret=0
-            ;;
-        (search)
-            _arguments $(__docker_arguments) -A '-*' \
-                $opts_help \
-                "($help)*"{-f=,--filter=}"[Filter values]:filter:__docker_complete_search_filters" \
-                "($help)--limit=[Maximum returned search results]:limit:(1 5 10 25 50)" \
-                "($help)--no-trunc[Do not truncate output]" \
-                "($help -):term: " && ret=0
-            ;;
-        (secret)
-            local curcontext="$curcontext" state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -): :->command" \
-                "($help -)*:: :->option-or-argument" && ret=0
-
-            case $state in
-                (command)
-                    __docker_secret_commands && ret=0
-                    ;;
-                (option-or-argument)
-                    curcontext=${curcontext%:*:*}:docker-${words[-1]}:
-                    __docker_secret_subcommand && ret=0
-                    ;;
-            esac
-            ;;
-        (service)
-            local curcontext="$curcontext" state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -): :->command" \
-                "($help -)*:: :->option-or-argument" && ret=0
-
-            case $state in
-                (command)
-                    __docker_service_commands && ret=0
-                    ;;
-                (option-or-argument)
-                    curcontext=${curcontext%:*:*}:docker-${words[-1]}:
-                    __docker_service_subcommand && ret=0
-                    ;;
-            esac
-            ;;
-        (stack)
-            local curcontext="$curcontext" state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -): :->command" \
-                "($help -)*:: :->option-or-argument" && ret=0
-
-            case $state in
-                (command)
-                    __docker_stack_commands && ret=0
-                    ;;
-                (option-or-argument)
-                    curcontext=${curcontext%:*:*}:docker-${words[-1]}:
-                    __docker_stack_subcommand && ret=0
-                    ;;
-            esac
-            ;;
-        (swarm)
-            local curcontext="$curcontext" state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -): :->command" \
-                "($help -)*:: :->option-or-argument" && ret=0
-
-            case $state in
-                (command)
-                    __docker_swarm_commands && ret=0
-                    ;;
-                (option-or-argument)
-                    curcontext=${curcontext%:*:*}:docker-${words[-1]}:
-                    __docker_swarm_subcommand && ret=0
-                    ;;
-            esac
-            ;;
-        (system)
-            local curcontext="$curcontext" state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -): :->command" \
-                "($help -)*:: :->option-or-argument" && ret=0
-
-            case $state in
-                (command)
-                    __docker_system_commands && ret=0
-                    ;;
-                (option-or-argument)
-                    curcontext=${curcontext%:*:*}:docker-${words[-1]}:
-                    __docker_system_subcommand && ret=0
-                    ;;
-            esac
-            ;;
-        (version)
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -f --format)"{-f=,--format=}"[Format the output using the given go template]:template: " && ret=0
-            ;;
-        (volume)
-            local curcontext="$curcontext" state
-            _arguments $(__docker_arguments) \
-                $opts_help \
-                "($help -): :->command" \
-                "($help -)*:: :->option-or-argument" && ret=0
-
-            case $state in
-                (command)
-                    __docker_volume_commands && ret=0
-                    ;;
-                (option-or-argument)
-                    curcontext=${curcontext%:*:*}:docker-${words[-1]}:
-                    __docker_volume_subcommand && ret=0
-                    ;;
-            esac
-            ;;
-        (help)
-            _arguments $(__docker_arguments) ":subcommand:__docker_commands" && ret=0
-            ;;
-    esac
-
-    return ret
-}
-
-_docker() {
-    # Support for subservices, which allows for `compdef _docker docker-shell=_docker_containers`.
-    # Based on /usr/share/zsh/functions/Completion/Unix/_git without support for `ret`.
-    if [[ $service != docker ]]; then
-        _call_function - _$service
-        return
-    fi
-
-    local curcontext="$curcontext" state line help="-h --help"
-    integer ret=1
-    typeset -A opt_args
-
-    _arguments $(__docker_arguments) -C \
-        "(: -)"{-h,--help}"[Print usage]" \
-        "($help)--config[Location of client config files]:path:_directories" \
-        "($help -D --debug)"{-D,--debug}"[Enable debug mode]" \
-        "($help -H --host)"{-H=,--host=}"[tcp://host:port to bind/connect to]:host: " \
-        "($help -l --log-level)"{-l=,--log-level=}"[Logging level]:level:(debug info warn error fatal)" \
-        "($help)--tls[Use TLS]" \
-        "($help)--tlscacert=[Trust certs signed only by this CA]:PEM file:_files -g "*.(pem|crt)"" \
-        "($help)--tlscert=[Path to TLS certificate file]:PEM file:_files -g "*.(pem|crt)"" \
-        "($help)--tlskey=[Path to TLS key file]:Key file:_files -g "*.(pem|key)"" \
-        "($help)--tlsverify[Use TLS and verify the remote]" \
-        "($help)--userland-proxy[Use userland proxy for loopback traffic]" \
-        "($help -v --version)"{-v,--version}"[Print version information and quit]" \
-        "($help -): :->command" \
-        "($help -)*:: :->option-or-argument" && ret=0
-
-    local host=${opt_args[-H]}${opt_args[--host]}
-    local config=${opt_args[--config]}
-    local docker_options="${host:+--host $host} ${config:+--config $config}"
-
-    case $state in
-        (command)
-            __docker_commands && ret=0
-            ;;
-        (option-or-argument)
-            curcontext=${curcontext%:*:*}:docker-$words[1]:
-            __docker_subcommand && ret=0
-            ;;
-    esac
-
-    return ret
-}
-
-_dockerd() {
-    integer ret=1
-    words[1]='daemon'
-    __docker_subcommand && ret=0
-    return ret
-}
-
-_docker "$@"
-
-# Local Variables:
-# mode: Shell-Script
-# sh-indentation: 4
-# indent-tabs-mode: nil
-# sh-basic-offset: 4
-# End:
-# vim: ft=zsh sw=4 ts=4 et
diff --git a/components/engine/contrib/mkimage-alpine.sh b/components/engine/contrib/mkimage-alpine.sh
index 47cd35ce62..a271effaa6 100755
--- a/components/engine/contrib/mkimage-alpine.sh
+++ b/components/engine/contrib/mkimage-alpine.sh
@@ -8,7 +8,7 @@ set -e
 }
 
 usage() {
-	printf >&2 '%s: [-r release] [-m mirror] [-s]  [-c additional repository]\n' "$0"
+	printf >&2 '%s: [-r release] [-m mirror] [-s] [-c additional repository] [-a arch]\n' "$0"
 	exit 1
 }
 
@@ -52,7 +52,7 @@ save() {
 	tar --numeric-owner -C $ROOTFS -c . | xz > rootfs.tar.xz
 }
 
-while getopts "hr:m:s" opt; do
+while getopts "hr:m:sc:a:" opt; do
 	case $opt in
 		r)
 			REL=$OPTARG
@@ -64,7 +64,10 @@ while getopts "hr:m:s" opt; do
 			SAVE=1
 			;;
 		c)
-			ADDITIONALREPO=community
+			ADDITIONALREPO=$OPTARG
+			;;
+		a)
+			ARCH=$OPTARG
 			;;
 		*)
 			usage
@@ -76,7 +79,7 @@ REL=${REL:-edge}
 MIRROR=${MIRROR:-http://nl.alpinelinux.org/alpine}
 SAVE=${SAVE:-0}
 MAINREPO=$MIRROR/$REL/main
-ADDITIONALREPO=$MIRROR/$REL/community
+ADDITIONALREPO=$MIRROR/$REL/${ADDITIONALREPO:-community}
 ARCH=${ARCH:-$(uname -m)}
 
 tmp
diff --git a/components/engine/contrib/mkimage-busybox.sh b/components/engine/contrib/mkimage-busybox.sh
deleted file mode 100755
index b11a6bb265..0000000000
--- a/components/engine/contrib/mkimage-busybox.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/usr/bin/env bash
-# Generate a very minimal filesystem based on busybox-static,
-# and load it into the local docker under the name "busybox".
-
-echo >&2
-echo >&2 'warning: this script is deprecated - see mkimage.sh and mkimage/busybox-static'
-echo >&2
-
-BUSYBOX=$(which busybox)
-[ "$BUSYBOX" ] || {
-    echo "Sorry, I could not locate busybox."
-    echo "Try 'apt-get install busybox-static'?"
-    exit 1
-}
-
-set -e
-ROOTFS=${TMPDIR:-/var/tmp}/rootfs-busybox-$$-$RANDOM
-mkdir $ROOTFS
-cd $ROOTFS
-
-mkdir bin etc dev dev/pts lib proc sys tmp
-touch etc/resolv.conf
-cp /etc/nsswitch.conf etc/nsswitch.conf
-echo root:x:0:0:root:/:/bin/sh > etc/passwd
-echo root:x:0: > etc/group
-ln -s lib lib64
-ln -s bin sbin
-cp $BUSYBOX bin
-for X in $(busybox --list)
-do
-    ln -s busybox bin/$X
-done
-rm bin/init
-ln bin/busybox bin/init
-cp /lib/x86_64-linux-gnu/lib{pthread,c,dl,nsl,nss_*}.so.* lib
-cp /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 lib
-for X in console null ptmx random stdin stdout stderr tty urandom zero
-do
-    cp -a /dev/$X dev
-done
-
-tar --numeric-owner -cf- . | docker import - busybox
-docker run -i -u root busybox /bin/echo Success.
diff --git a/components/engine/contrib/mkimage-debootstrap.sh b/components/engine/contrib/mkimage-debootstrap.sh
deleted file mode 100755
index 412a5ce0a7..0000000000
--- a/components/engine/contrib/mkimage-debootstrap.sh
+++ /dev/null
@@ -1,297 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-echo >&2
-echo >&2 'warning: this script is deprecated - see mkimage.sh and mkimage/debootstrap'
-echo >&2
-
-variant='minbase'
-include='iproute,iputils-ping'
-arch='amd64' # intentionally undocumented for now
-skipDetection=
-strictDebootstrap=
-justTar=
-
-usage() {
-	echo >&2
-
-	echo >&2 "usage: $0 [options] repo suite [mirror]"
-
-	echo >&2
-	echo >&2 'options: (not recommended)'
-	echo >&2 "  -p set an http_proxy for debootstrap"
-	echo >&2 "  -v $variant # change default debootstrap variant"
-	echo >&2 "  -i $include # change default package includes"
-	echo >&2 "  -d # strict debootstrap (do not apply any docker-specific tweaks)"
-	echo >&2 "  -s # skip version detection and tagging (ie, precise also tagged as 12.04)"
-	echo >&2 "     # note that this will also skip adding universe and/or security/updates to sources.list"
-	echo >&2 "  -t # just create a tarball, especially for dockerbrew (uses repo as tarball name)"
-
-	echo >&2
-	echo >&2 "   ie: $0 username/debian squeeze"
-	echo >&2 "       $0 username/debian squeeze http://ftp.uk.debian.org/debian/"
-
-	echo >&2
-	echo >&2 "   ie: $0 username/ubuntu precise"
-	echo >&2 "       $0 username/ubuntu precise http://mirrors.melbourne.co.uk/ubuntu/"
-
-	echo >&2
-	echo >&2 "   ie: $0 -t precise.tar.bz2 precise"
-	echo >&2 "       $0 -t wheezy.tgz wheezy"
-	echo >&2 "       $0 -t wheezy-uk.tar.xz wheezy http://ftp.uk.debian.org/debian/"
-
-	echo >&2
-}
-
-# these should match the names found at http://www.debian.org/releases/
-debianStable=wheezy
-debianUnstable=sid
-# this should match the name found at http://releases.ubuntu.com/
-ubuntuLatestLTS=trusty
-# this should match the name found at http://releases.tanglu.org/
-tangluLatest=aequorea
-
-while getopts v:i:a:p:dst name; do
-	case "$name" in
-		p)
-			http_proxy="$OPTARG"
-			;;
-		v)
-			variant="$OPTARG"
-			;;
-		i)
-			include="$OPTARG"
-			;;
-		a)
-			arch="$OPTARG"
-			;;
-		d)
-			strictDebootstrap=1
-			;;
-		s)
-			skipDetection=1
-			;;
-		t)
-			justTar=1
-			;;
-		?)
-			usage
-			exit 0
-			;;
-	esac
-done
-shift $(($OPTIND - 1))
-
-repo="$1"
-suite="$2"
-mirror="${3:-}" # stick to the default debootstrap mirror if one is not provided
-
-if [ ! "$repo" ] || [ ! "$suite" ]; then
-	usage
-	exit 1
-fi
-
-# some rudimentary detection for whether we need to "sudo" our docker calls
-docker=''
-if docker version > /dev/null 2>&1; then
-	docker='docker'
-elif sudo docker version > /dev/null 2>&1; then
-	docker='sudo docker'
-elif command -v docker > /dev/null 2>&1; then
-	docker='docker'
-else
-	echo >&2 "warning: either docker isn't installed, or your current user cannot run it;"
-	echo >&2 "         this script is not likely to work as expected"
-	sleep 3
-	docker='docker' # give us a command-not-found later
-fi
-
-# make sure we have an absolute path to our final tarball so we can still reference it properly after we change directory
-if [ "$justTar" ]; then
-	if [ ! -d "$(dirname "$repo")" ]; then
-		echo >&2 "error: $(dirname "$repo") does not exist"
-		exit 1
-	fi
-	repo="$(cd "$(dirname "$repo")" && pwd -P)/$(basename "$repo")"
-fi
-
-# will be filled in later, if [ -z "$skipDetection" ]
-lsbDist=''
-
-target="${TMPDIR:-/var/tmp}/docker-rootfs-debootstrap-$suite-$$-$RANDOM"
-
-cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
-returnTo="$(pwd -P)"
-
-if [ "$suite" = 'lucid' ]; then
-	# lucid fails and doesn't include gpgv in minbase; "apt-get update" fails
-	include+=',gpgv'
-fi
-
-set -x
-
-# bootstrap
-mkdir -p "$target"
-sudo http_proxy=$http_proxy debootstrap --verbose --variant="$variant" --include="$include" --arch="$arch" "$suite" "$target" "$mirror"
-
-cd "$target"
-
-if [ -z "$strictDebootstrap" ]; then
-	# prevent init scripts from running during install/update
-	#  policy-rc.d (for most scripts)
-	echo $'#!/bin/sh\nexit 101' | sudo tee usr/sbin/policy-rc.d > /dev/null
-	sudo chmod +x usr/sbin/policy-rc.d
-	#  initctl (for some pesky upstart scripts)
-	sudo chroot . dpkg-divert --local --rename --add /sbin/initctl
-	sudo ln -sf /bin/true sbin/initctl
-	# see https://github.com/docker/docker/issues/446#issuecomment-16953173
-
-	# shrink the image, since apt makes us fat (wheezy: ~157.5MB vs ~120MB)
-	sudo chroot . apt-get clean
-
-	if strings usr/bin/dpkg | grep -q unsafe-io; then
-		# while we're at it, apt is unnecessarily slow inside containers
-		#  this forces dpkg not to call sync() after package extraction and speeds up install
-		#    the benefit is huge on spinning disks, and the penalty is nonexistent on SSD or decent server virtualization
-		echo 'force-unsafe-io' | sudo tee etc/dpkg/dpkg.cfg.d/02apt-speedup > /dev/null
-		# we have this wrapped up in an "if" because the "force-unsafe-io"
-		# option was added in dpkg 1.15.8.6
-		# (see http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584254#82),
-		# and ubuntu lucid/10.04 only has 1.15.5.6
-	fi
-
-	# we want to effectively run "apt-get clean" after every install to keep images small (see output of "apt-get clean -s" for context)
-	{
-		aptGetClean='"rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true";'
-		echo "DPkg::Post-Invoke { ${aptGetClean} };"
-		echo "APT::Update::Post-Invoke { ${aptGetClean} };"
-		echo 'Dir::Cache::pkgcache ""; Dir::Cache::srcpkgcache "";'
-	} | sudo tee etc/apt/apt.conf.d/no-cache > /dev/null
-
-	# and remove the translations, too
-	echo 'Acquire::Languages "none";' | sudo tee etc/apt/apt.conf.d/no-languages > /dev/null
-
-	# helpful undo lines for each the above tweaks (for lack of a better home to keep track of them):
-	#  rm /usr/sbin/policy-rc.d
-	#  rm /sbin/initctl; dpkg-divert --rename --remove /sbin/initctl
-	#  rm /etc/dpkg/dpkg.cfg.d/02apt-speedup
-	#  rm /etc/apt/apt.conf.d/no-cache
-	#  rm /etc/apt/apt.conf.d/no-languages
-
-	if [ -z "$skipDetection" ]; then
-		# see also rudimentary platform detection in hack/install.sh
-		lsbDist=''
-		if [ -r etc/lsb-release ]; then
-			lsbDist="$(. etc/lsb-release && echo "$DISTRIB_ID")"
-		fi
-		if [ -z "$lsbDist" ] && [ -r etc/debian_version ]; then
-			lsbDist='Debian'
-		fi
-
-		case "$lsbDist" in
-			Debian)
-				# add the updates and security repositories
-				if [ "$suite" != "$debianUnstable" -a "$suite" != 'unstable' ]; then
-					# ${suite}-updates only applies to non-unstable
-					sudo sed -i "p; s/ $suite main$/ ${suite}-updates main/" etc/apt/sources.list
-
-					# same for security updates
-					echo "deb http://security.debian.org/ $suite/updates main" | sudo tee -a etc/apt/sources.list > /dev/null
-				fi
-				;;
-			Ubuntu)
-				# add the universe, updates, and security repositories
-				sudo sed -i "
-					s/ $suite main$/ $suite main universe/; p;
-					s/ $suite main/ ${suite}-updates main/; p;
-					s/ $suite-updates main/ ${suite}-security main/
-				" etc/apt/sources.list
-				;;
-			Tanglu)
-				# add the updates repository
-				if [ "$suite" = "$tangluLatest" ]; then
-					# ${suite}-updates only applies to stable Tanglu versions
-					sudo sed -i "p; s/ $suite main$/ ${suite}-updates main/" etc/apt/sources.list
-				fi
-				;;
-			SteamOS)
-				# add contrib and non-free
-				sudo sed -i "s/ $suite main$/ $suite main contrib non-free/" etc/apt/sources.list
-				;;
-		esac
-	fi
-
-	# make sure our packages lists are as up to date as we can get them
-	sudo chroot . apt-get update
-	sudo chroot . apt-get dist-upgrade -y
-fi
-
-if [ "$justTar" ]; then
-	# create the tarball file so it has the right permissions (ie, not root)
-	touch "$repo"
-
-	# fill the tarball
-	sudo tar --numeric-owner -caf "$repo" .
-else
-	# create the image (and tag $repo:$suite)
-	sudo tar --numeric-owner -c . | $docker import - $repo:$suite
-
-	# test the image
-	$docker run -i -t $repo:$suite echo success
-
-	if [ -z "$skipDetection" ]; then
-		case "$lsbDist" in
-			Debian)
-				if [ "$suite" = "$debianStable" -o "$suite" = 'stable' ] && [ -r etc/debian_version ]; then
-					# tag latest
-					$docker tag $repo:$suite $repo:latest
-
-					if [ -r etc/debian_version ]; then
-						# tag the specific debian release version (which is only reasonable to tag on debian stable)
-						ver=$(cat etc/debian_version)
-						$docker tag $repo:$suite $repo:$ver
-					fi
-				fi
-				;;
-			Ubuntu)
-				if [ "$suite" = "$ubuntuLatestLTS" ]; then
-					# tag latest
-					$docker tag $repo:$suite $repo:latest
-				fi
-				if [ -r etc/lsb-release ]; then
-					lsbRelease="$(. etc/lsb-release && echo "$DISTRIB_RELEASE")"
-					if [ "$lsbRelease" ]; then
-						# tag specific Ubuntu version number, if available (12.04, etc.)
-						$docker tag $repo:$suite $repo:$lsbRelease
-					fi
-				fi
-				;;
-			Tanglu)
-				if [ "$suite" = "$tangluLatest" ]; then
-					# tag latest
-					$docker tag $repo:$suite $repo:latest
-				fi
-				if [ -r etc/lsb-release ]; then
-					lsbRelease="$(. etc/lsb-release && echo "$DISTRIB_RELEASE")"
-					if [ "$lsbRelease" ]; then
-						# tag specific Tanglu version number, if available (1.0, 2.0, etc.)
-						$docker tag $repo:$suite $repo:$lsbRelease
-					fi
-				fi
-				;;
-			SteamOS)
-				if [ -r etc/lsb-release ]; then
-					lsbRelease="$(. etc/lsb-release && echo "$DISTRIB_RELEASE")"
-					if [ "$lsbRelease" ]; then
-						# tag specific SteamOS version number, if available (1.0, 2.0, etc.)
-						$docker tag $repo:$suite $repo:$lsbRelease
-					fi
-				fi
-				;;
-		esac
-	fi
-fi
-
-# cleanup
-cd "$returnTo"
-sudo rm -rf "$target"
diff --git a/components/engine/contrib/mkimage-rinse.sh b/components/engine/contrib/mkimage-rinse.sh
deleted file mode 100755
index 7e0935062f..0000000000
--- a/components/engine/contrib/mkimage-rinse.sh
+++ /dev/null
@@ -1,123 +0,0 @@
-#!/usr/bin/env bash
-#
-# Create a base CentOS Docker image.
-
-# This script is useful on systems with rinse available (e.g.,
-# building a CentOS image on Debian).  See contrib/mkimage-yum.sh for
-# a way to build CentOS images on systems with yum installed.
-
-set -e
-
-echo >&2
-echo >&2 'warning: this script is deprecated - see mkimage.sh and mkimage/rinse'
-echo >&2
-
-repo="$1"
-distro="$2"
-mirror="$3"
-
-if [ ! "$repo" ] || [ ! "$distro" ]; then
-	self="$(basename $0)"
-	echo >&2 "usage: $self repo distro [mirror]"
-	echo >&2
-	echo >&2 "   ie: $self username/centos centos-5"
-	echo >&2 "       $self username/centos centos-6"
-	echo >&2
-	echo >&2 "   ie: $self username/slc slc-5"
-	echo >&2 "       $self username/slc slc-6"
-	echo >&2
-	echo >&2 "   ie: $self username/centos centos-5 http://vault.centos.org/5.8/os/x86_64/CentOS/"
-	echo >&2 "       $self username/centos centos-6 http://vault.centos.org/6.3/os/x86_64/Packages/"
-	echo >&2
-	echo >&2 'See /etc/rinse for supported values of "distro" and for examples of'
-	echo >&2 '  expected values of "mirror".'
-	echo >&2
-	echo >&2 'This script is tested to work with the original upstream version of rinse,'
-	echo >&2 '  found at http://www.steve.org.uk/Software/rinse/ and also in Debian at'
-	echo >&2 '  http://packages.debian.org/wheezy/rinse -- as always, YMMV.'
-	echo >&2
-	exit 1
-fi
-
-target="${TMPDIR:-/var/tmp}/docker-rootfs-rinse-$distro-$$-$RANDOM"
-
-cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
-returnTo="$(pwd -P)"
-
-rinseArgs=( --arch amd64 --distribution "$distro" --directory "$target" )
-if [ "$mirror" ]; then
-	rinseArgs+=( --mirror "$mirror" )
-fi
-
-set -x
-
-mkdir -p "$target"
-
-sudo rinse "${rinseArgs[@]}"
-
-cd "$target"
-
-# rinse fails a little at setting up /dev, so we'll just wipe it out and create our own
-sudo rm -rf dev
-sudo mkdir -m 755 dev
-(
-	cd dev
-	sudo ln -sf /proc/self/fd ./
-	sudo mkdir -m 755 pts
-	sudo mkdir -m 1777 shm
-	sudo mknod -m 600 console c 5 1
-	sudo mknod -m 600 initctl p
-	sudo mknod -m 666 full c 1 7
-	sudo mknod -m 666 null c 1 3
-	sudo mknod -m 666 ptmx c 5 2
-	sudo mknod -m 666 random c 1 8
-	sudo mknod -m 666 tty c 5 0
-	sudo mknod -m 666 tty0 c 4 0
-	sudo mknod -m 666 urandom c 1 9
-	sudo mknod -m 666 zero c 1 5
-)
-
-# effectively: febootstrap-minimize --keep-zoneinfo --keep-rpmdb --keep-services "$target"
-#  locales
-sudo rm -rf usr/{{lib,share}/locale,{lib,lib64}/gconv,bin/localedef,sbin/build-locale-archive}
-#  docs and man pages
-sudo rm -rf usr/share/{man,doc,info,gnome/help}
-#  cracklib
-sudo rm -rf usr/share/cracklib
-#  i18n
-sudo rm -rf usr/share/i18n
-#  yum cache
-sudo rm -rf var/cache/yum
-sudo mkdir -p --mode=0755 var/cache/yum
-#  sln
-sudo rm -rf sbin/sln
-#  ldconfig
-#sudo rm -rf sbin/ldconfig
-sudo rm -rf etc/ld.so.cache var/cache/ldconfig
-sudo mkdir -p --mode=0755 var/cache/ldconfig
-
-# allow networking init scripts inside the container to work without extra steps
-echo 'NETWORKING=yes' | sudo tee etc/sysconfig/network > /dev/null
-
-# to restore locales later:
-#  yum reinstall glibc-common
-
-version=
-if [ -r etc/redhat-release ]; then
-	version="$(sed -E 's/^[^0-9.]*([0-9.]+).*$/\1/' etc/redhat-release)"
-elif [ -r etc/SuSE-release ]; then
-	version="$(awk '/^VERSION/ { print $3 }' etc/SuSE-release)"
-fi
-
-if [ -z "$version" ]; then
-	echo >&2 "warning: cannot autodetect OS version, using $distro as tag"
-	sleep 20
-	version="$distro"
-fi
-
-sudo tar --numeric-owner -c . | docker import - $repo:$version
-
-docker run -i -t $repo:$version echo success
-
-cd "$returnTo"
-sudo rm -rf "$target"
diff --git a/components/engine/daemon/archive.go b/components/engine/daemon/archive.go
index dbef0b4d48..bd00daca53 100644
--- a/components/engine/daemon/archive.go
+++ b/components/engine/daemon/archive.go
@@ -10,9 +10,7 @@ import (
 	"github.com/docker/docker/container"
 	"github.com/docker/docker/pkg/archive"
 	"github.com/docker/docker/pkg/chrootarchive"
-	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/ioutils"
-	"github.com/docker/docker/pkg/symlink"
 	"github.com/docker/docker/pkg/system"
 	"github.com/pkg/errors"
 )
@@ -362,109 +360,3 @@ func (daemon *Daemon) containerCopy(container *container.Container, resource str
 	daemon.LogContainerEvent(container, "copy")
 	return reader, nil
 }
-
-// CopyOnBuild copies/extracts a source FileInfo to a destination path inside a container
-// specified by a container object.
-// TODO: make sure callers don't unnecessarily convert destPath with filepath.FromSlash (Copy does it already).
-// CopyOnBuild should take in abstract paths (with slashes) and the implementation should convert it to OS-specific paths.
-func (daemon *Daemon) CopyOnBuild(cID, destPath, srcRoot, srcPath string, decompress bool) error {
-	fullSrcPath, err := symlink.FollowSymlinkInScope(filepath.Join(srcRoot, srcPath), srcRoot)
-	if err != nil {
-		return err
-	}
-
-	destExists := true
-	destDir := false
-	rootUID, rootGID := daemon.GetRemappedUIDGID()
-
-	// Work in daemon-local OS specific file paths
-	destPath = filepath.FromSlash(destPath)
-
-	c, err := daemon.GetContainer(cID)
-	if err != nil {
-		return err
-	}
-	err = daemon.Mount(c)
-	if err != nil {
-		return err
-	}
-	defer daemon.Unmount(c)
-
-	dest, err := c.GetResourcePath(destPath)
-	if err != nil {
-		return err
-	}
-
-	// Preserve the trailing slash
-	// TODO: why are we appending another path separator if there was already one?
-	if strings.HasSuffix(destPath, string(os.PathSeparator)) || destPath == "." {
-		destDir = true
-		dest += string(os.PathSeparator)
-	}
-
-	destPath = dest
-
-	destStat, err := os.Stat(destPath)
-	if err != nil {
-		if !os.IsNotExist(err) {
-			//logrus.Errorf("Error performing os.Stat on %s. %s", destPath, err)
-			return err
-		}
-		destExists = false
-	}
-
-	uidMaps, gidMaps := daemon.GetUIDGIDMaps()
-	archiver := &archive.Archiver{
-		Untar:   chrootarchive.Untar,
-		UIDMaps: uidMaps,
-		GIDMaps: gidMaps,
-	}
-
-	src, err := os.Stat(fullSrcPath)
-	if err != nil {
-		return err
-	}
-
-	if src.IsDir() {
-		// copy as directory
-		if err := archiver.CopyWithTar(fullSrcPath, destPath); err != nil {
-			return err
-		}
-		return fixPermissions(fullSrcPath, destPath, rootUID, rootGID, destExists)
-	}
-	if decompress && archive.IsArchivePath(fullSrcPath) {
-		// Only try to untar if it is a file and that we've been told to decompress (when ADD-ing a remote file)
-
-		// First try to unpack the source as an archive
-		// to support the untar feature we need to clean up the path a little bit
-		// because tar is very forgiving.  First we need to strip off the archive's
-		// filename from the path but this is only added if it does not end in slash
-		tarDest := destPath
-		if strings.HasSuffix(tarDest, string(os.PathSeparator)) {
-			tarDest = filepath.Dir(destPath)
-		}
-
-		// try to successfully untar the orig
-		err := archiver.UntarPath(fullSrcPath, tarDest)
-		/*
-			if err != nil {
-				logrus.Errorf("Couldn't untar to %s: %v", tarDest, err)
-			}
-		*/
-		return err
-	}
-
-	// only needed for fixPermissions, but might as well put it before CopyFileWithTar
-	if destDir || (destExists && destStat.IsDir()) {
-		destPath = filepath.Join(destPath, filepath.Base(srcPath))
-	}
-
-	if err := idtools.MkdirAllNewAs(filepath.Dir(destPath), 0755, rootUID, rootGID); err != nil {
-		return err
-	}
-	if err := archiver.CopyFileWithTar(fullSrcPath, destPath); err != nil {
-		return err
-	}
-
-	return fixPermissions(fullSrcPath, destPath, rootUID, rootGID, destExists)
-}
diff --git a/components/engine/daemon/archive_tarcopyoptions.go b/components/engine/daemon/archive_tarcopyoptions.go
index cbd1fc2cee..fe7722fdb4 100644
--- a/components/engine/daemon/archive_tarcopyoptions.go
+++ b/components/engine/daemon/archive_tarcopyoptions.go
@@ -7,10 +7,9 @@ import (
 // defaultTarCopyOptions is the setting that is used when unpacking an archive
 // for a copy API event.
 func (daemon *Daemon) defaultTarCopyOptions(noOverwriteDirNonDir bool) *archive.TarOptions {
-	uidMaps, gidMaps := daemon.GetUIDGIDMaps()
 	return &archive.TarOptions{
 		NoOverwriteDirNonDir: noOverwriteDirNonDir,
-		UIDMaps:              uidMaps,
-		GIDMaps:              gidMaps,
+		UIDMaps:              daemon.idMappings.UIDs(),
+		GIDMaps:              daemon.idMappings.GIDs(),
 	}
 }
diff --git a/components/engine/daemon/archive_tarcopyoptions_unix.go b/components/engine/daemon/archive_tarcopyoptions_unix.go
index 7b68bc463d..83e6fd9e17 100644
--- a/components/engine/daemon/archive_tarcopyoptions_unix.go
+++ b/components/engine/daemon/archive_tarcopyoptions_unix.go
@@ -20,9 +20,6 @@ func (daemon *Daemon) tarCopyOptions(container *container.Container, noOverwrite
 
 	return &archive.TarOptions{
 		NoOverwriteDirNonDir: noOverwriteDirNonDir,
-		ChownOpts: &archive.TarChownOptions{
-			UID: user.Uid,
-			GID: user.Gid,
-		},
+		ChownOpts:            &idtools.IDPair{UID: user.Uid, GID: user.Gid},
 	}, nil
 }
diff --git a/components/engine/daemon/archive_unix.go b/components/engine/daemon/archive_unix.go
index 8806e2e198..d5dfad78cb 100644
--- a/components/engine/daemon/archive_unix.go
+++ b/components/engine/daemon/archive_unix.go
@@ -3,9 +3,6 @@
 package daemon
 
 import (
-	"os"
-	"path/filepath"
-
 	"github.com/docker/docker/container"
 )
 
@@ -25,38 +22,6 @@ func checkIfPathIsInAVolume(container *container.Container, absPath string) (boo
 	return toVolume, nil
 }
 
-func fixPermissions(source, destination string, uid, gid int, destExisted bool) error {
-	// If the destination didn't already exist, or the destination isn't a
-	// directory, then we should Lchown the destination. Otherwise, we shouldn't
-	// Lchown the destination.
-	destStat, err := os.Stat(destination)
-	if err != nil {
-		// This should *never* be reached, because the destination must've already
-		// been created while untar-ing the context.
-		return err
-	}
-	doChownDestination := !destExisted || !destStat.IsDir()
-
-	// We Walk on the source rather than on the destination because we don't
-	// want to change permissions on things we haven't created or modified.
-	return filepath.Walk(source, func(fullpath string, info os.FileInfo, err error) error {
-		// Do not alter the walk root iff. it existed before, as it doesn't fall under
-		// the domain of "things we should chown".
-		if !doChownDestination && (source == fullpath) {
-			return nil
-		}
-
-		// Path is prefixed by source: substitute with destination instead.
-		cleaned, err := filepath.Rel(source, fullpath)
-		if err != nil {
-			return err
-		}
-
-		fullpath = filepath.Join(destination, cleaned)
-		return os.Lchown(fullpath, uid, gid)
-	})
-}
-
 // isOnlineFSOperationPermitted returns an error if an online filesystem operation
 // is not permitted.
 func (daemon *Daemon) isOnlineFSOperationPermitted(container *container.Container) error {
diff --git a/components/engine/daemon/archive_windows.go b/components/engine/daemon/archive_windows.go
index 1c5a894f7c..ab105607d5 100644
--- a/components/engine/daemon/archive_windows.go
+++ b/components/engine/daemon/archive_windows.go
@@ -17,11 +17,6 @@ func checkIfPathIsInAVolume(container *container.Container, absPath string) (boo
 	return false, nil
 }
 
-func fixPermissions(source, destination string, uid, gid int, destExisted bool) error {
-	// chown is not supported on Windows
-	return nil
-}
-
 // isOnlineFSOperationPermitted returns an error if an online filesystem operation
 // is not permitted (such as stat or for copying). Running Hyper-V containers
 // cannot have their file-system interrogated from the host as the filter is
diff --git a/components/engine/daemon/build.go b/components/engine/daemon/build.go
index 1bf05ded2c..9b518d64f3 100644
--- a/components/engine/daemon/build.go
+++ b/components/engine/daemon/build.go
@@ -1,6 +1,9 @@
 package daemon
 
 import (
+	"io"
+	"runtime"
+
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/distribution/reference"
 	"github.com/docker/docker/api/types"
@@ -8,26 +11,29 @@ import (
 	"github.com/docker/docker/builder"
 	"github.com/docker/docker/image"
 	"github.com/docker/docker/layer"
+	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/stringid"
 	"github.com/docker/docker/registry"
 	"github.com/pkg/errors"
 	"golang.org/x/net/context"
-	"io"
 )
 
 type releaseableLayer struct {
+	released   bool
 	layerStore layer.Store
 	roLayer    layer.Layer
 	rwLayer    layer.RWLayer
 }
 
 func (rl *releaseableLayer) Mount() (string, error) {
-	if rl.roLayer == nil {
-		return "", errors.New("can not mount an image with no root FS")
-	}
 	var err error
+	var chainID layer.ChainID
+	if rl.roLayer != nil {
+		chainID = rl.roLayer.ChainID()
+	}
+
 	mountID := stringid.GenerateRandomID()
-	rl.rwLayer, err = rl.layerStore.CreateRWLayer(mountID, rl.roLayer.ChainID(), nil)
+	rl.rwLayer, err = rl.layerStore.CreateRWLayer(mountID, chainID, nil)
 	if err != nil {
 		return "", errors.Wrap(err, "failed to create rwlayer")
 	}
@@ -35,7 +41,41 @@ func (rl *releaseableLayer) Mount() (string, error) {
 	return rl.rwLayer.Mount("")
 }
 
+func (rl *releaseableLayer) Commit(platform string) (builder.ReleaseableLayer, error) {
+	var chainID layer.ChainID
+	if rl.roLayer != nil {
+		chainID = rl.roLayer.ChainID()
+	}
+
+	stream, err := rl.rwLayer.TarStream()
+	if err != nil {
+		return nil, err
+	}
+
+	newLayer, err := rl.layerStore.Register(stream, chainID, layer.Platform(platform))
+	if err != nil {
+		return nil, err
+	}
+
+	if layer.IsEmpty(newLayer.DiffID()) {
+		_, err := rl.layerStore.Release(newLayer)
+		return &releaseableLayer{layerStore: rl.layerStore}, err
+	}
+	return &releaseableLayer{layerStore: rl.layerStore, roLayer: newLayer}, nil
+}
+
+func (rl *releaseableLayer) DiffID() layer.DiffID {
+	if rl.roLayer == nil {
+		return layer.DigestSHA256EmptyTar
+	}
+	return rl.roLayer.DiffID()
+}
+
 func (rl *releaseableLayer) Release() error {
+	if rl.released {
+		return nil
+	}
+	rl.released = true
 	rl.releaseRWLayer()
 	return rl.releaseROLayer()
 }
@@ -62,8 +102,8 @@ func (rl *releaseableLayer) releaseROLayer() error {
 }
 
 func newReleasableLayerForImage(img *image.Image, layerStore layer.Store) (builder.ReleaseableLayer, error) {
-	if img.RootFS.ChainID() == "" {
-		return nil, nil
+	if img == nil || img.RootFS.ChainID() == "" {
+		return &releaseableLayer{layerStore: layerStore}, nil
 	}
 	// Hold a reference to the image layer so that it can't be removed before
 	// it is released
@@ -75,7 +115,7 @@ func newReleasableLayerForImage(img *image.Image, layerStore layer.Store) (build
 }
 
 // TODO: could this use the regular daemon PullImage ?
-func (daemon *Daemon) pullForBuilder(ctx context.Context, name string, authConfigs map[string]types.AuthConfig, output io.Writer) (*image.Image, error) {
+func (daemon *Daemon) pullForBuilder(ctx context.Context, name string, authConfigs map[string]types.AuthConfig, output io.Writer, platform string) (*image.Image, error) {
 	ref, err := reference.ParseNormalizedNamed(name)
 	if err != nil {
 		return nil, err
@@ -94,7 +134,7 @@ func (daemon *Daemon) pullForBuilder(ctx context.Context, name string, authConfi
 		pullRegistryAuth = &resolvedConfig
 	}
 
-	if err := daemon.pullImageWithReference(ctx, ref, nil, pullRegistryAuth, output); err != nil {
+	if err := daemon.pullImageWithReference(ctx, ref, platform, nil, pullRegistryAuth, output); err != nil {
 		return nil, err
 	}
 	return daemon.GetImage(name)
@@ -104,19 +144,53 @@ func (daemon *Daemon) pullForBuilder(ctx context.Context, name string, authConfi
 // Every call to GetImageAndReleasableLayer MUST call releasableLayer.Release() to prevent
 // leaking of layers.
 func (daemon *Daemon) GetImageAndReleasableLayer(ctx context.Context, refOrID string, opts backend.GetImageAndLayerOptions) (builder.Image, builder.ReleaseableLayer, error) {
-	if !opts.ForcePull {
-		image, _ := daemon.GetImage(refOrID)
+	if refOrID == "" {
+		layer, err := newReleasableLayerForImage(nil, daemon.stores[opts.Platform].layerStore)
+		return nil, layer, err
+	}
+
+	if opts.PullOption != backend.PullOptionForcePull {
+		image, err := daemon.GetImage(refOrID)
+		if err != nil && opts.PullOption == backend.PullOptionNoPull {
+			return nil, nil, err
+		}
 		// TODO: shouldn't we error out if error is different from "not found" ?
 		if image != nil {
-			layer, err := newReleasableLayerForImage(image, daemon.layerStore)
+			layer, err := newReleasableLayerForImage(image, daemon.stores[opts.Platform].layerStore)
 			return image, layer, err
 		}
 	}
 
-	image, err := daemon.pullForBuilder(ctx, refOrID, opts.AuthConfig, opts.Output)
+	image, err := daemon.pullForBuilder(ctx, refOrID, opts.AuthConfig, opts.Output, opts.Platform)
 	if err != nil {
 		return nil, nil, err
 	}
-	layer, err := newReleasableLayerForImage(image, daemon.layerStore)
+	layer, err := newReleasableLayerForImage(image, daemon.stores[opts.Platform].layerStore)
 	return image, layer, err
 }
+
+// CreateImage creates a new image by adding a config and ID to the image store.
+// This is similar to LoadImage() except that it receives JSON encoded bytes of
+// an image instead of a tar archive.
+func (daemon *Daemon) CreateImage(config []byte, parent string, platform string) (builder.Image, error) {
+	if platform == "" {
+		platform = runtime.GOOS
+	}
+	id, err := daemon.stores[platform].imageStore.Create(config)
+	if err != nil {
+		return nil, errors.Wrapf(err, "failed to create image")
+	}
+
+	if parent != "" {
+		if err := daemon.stores[platform].imageStore.SetParent(id, image.ID(parent)); err != nil {
+			return nil, errors.Wrapf(err, "failed to set parent %s", parent)
+		}
+	}
+
+	return daemon.stores[platform].imageStore.Get(id)
+}
+
+// IDMappings returns uid/gid mappings for the builder
+func (daemon *Daemon) IDMappings() *idtools.IDMappings {
+	return daemon.idMappings
+}
diff --git a/components/engine/daemon/cache.go b/components/engine/daemon/cache.go
index 8e3d207758..219b0b38da 100644
--- a/components/engine/daemon/cache.go
+++ b/components/engine/daemon/cache.go
@@ -7,12 +7,12 @@ import (
 )
 
 // MakeImageCache creates a stateful image cache.
-func (daemon *Daemon) MakeImageCache(sourceRefs []string) builder.ImageCache {
+func (daemon *Daemon) MakeImageCache(sourceRefs []string, platform string) builder.ImageCache {
 	if len(sourceRefs) == 0 {
-		return cache.NewLocal(daemon.imageStore)
+		return cache.NewLocal(daemon.stores[platform].imageStore)
 	}
 
-	cache := cache.New(daemon.imageStore)
+	cache := cache.New(daemon.stores[platform].imageStore)
 
 	for _, ref := range sourceRefs {
 		img, err := daemon.GetImage(ref)
diff --git a/components/engine/daemon/cluster/convert/swarm.go b/components/engine/daemon/cluster/convert/swarm.go
index 0d5c8738c9..2ea89b968e 100644
--- a/components/engine/daemon/cluster/convert/swarm.go
+++ b/components/engine/daemon/cluster/convert/swarm.go
@@ -31,9 +31,10 @@ func SwarmFromGRPC(c swarmapi.Cluster) types.Swarm {
 					AutoLockManagers: c.Spec.EncryptionConfig.AutoLockManagers,
 				},
 				CAConfig: types.CAConfig{
-					// do not include the signing CA key (it should already be redacted via the swarm APIs)
-					SigningCACert: string(c.Spec.CAConfig.SigningCACert),
-					ForceRotate:   c.Spec.CAConfig.ForceRotate,
+					// do not include the signing CA cert or key (it should already be redacted via the swarm APIs) -
+					// the key because it's secret, and the cert because otherwise doing a get + update on the spec
+					// can cause issues because the key would be missing and the cert wouldn't
+					ForceRotate: c.Spec.CAConfig.ForceRotate,
 				},
 			},
 			TLSInfo: types.TLSInfo{
diff --git a/components/engine/daemon/cluster/executor/backend.go b/components/engine/daemon/cluster/executor/backend.go
index 2578a93c5a..fbe9006561 100644
--- a/components/engine/daemon/cluster/executor/backend.go
+++ b/components/engine/daemon/cluster/executor/backend.go
@@ -30,7 +30,7 @@ type Backend interface {
 	FindNetwork(idName string) (libnetwork.Network, error)
 	SetupIngress(clustertypes.NetworkCreateRequest, string) (<-chan struct{}, error)
 	ReleaseIngress() (<-chan struct{}, error)
-	PullImage(ctx context.Context, image, tag string, metaHeaders map[string][]string, authConfig *types.AuthConfig, outStream io.Writer) error
+	PullImage(ctx context.Context, image, tag, platform string, metaHeaders map[string][]string, authConfig *types.AuthConfig, outStream io.Writer) error
 	CreateManagedContainer(config types.ContainerCreateConfig) (container.ContainerCreateCreatedBody, error)
 	ContainerStart(name string, hostConfig *container.HostConfig, checkpoint string, checkpointDir string) error
 	ContainerStop(name string, seconds *int) error
diff --git a/components/engine/daemon/cluster/executor/container/adapter.go b/components/engine/daemon/cluster/executor/container/adapter.go
index 67d42c706e..75a085ef1d 100644
--- a/components/engine/daemon/cluster/executor/container/adapter.go
+++ b/components/engine/daemon/cluster/executor/container/adapter.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"runtime"
 	"strings"
 	"syscall"
 	"time"
@@ -20,6 +21,7 @@ import (
 	containerpkg "github.com/docker/docker/container"
 	"github.com/docker/docker/daemon/cluster/convert"
 	executorpkg "github.com/docker/docker/daemon/cluster/executor"
+	"github.com/docker/docker/pkg/system"
 	"github.com/docker/libnetwork"
 	"github.com/docker/swarmkit/agent/exec"
 	"github.com/docker/swarmkit/api"
@@ -88,7 +90,13 @@ func (c *containerAdapter) pullImage(ctx context.Context) error {
 	pr, pw := io.Pipe()
 	metaHeaders := map[string][]string{}
 	go func() {
-		err := c.backend.PullImage(ctx, c.container.image(), "", metaHeaders, authConfig, pw)
+		// TODO @jhowardmsft LCOW Support: This will need revisiting as
+		// the stack is built up to include LCOW support for swarm.
+		platform := runtime.GOOS
+		if platform == "windows" && system.LCOWSupported() {
+			platform = "linux"
+		}
+		err := c.backend.PullImage(ctx, c.container.image(), "", platform, metaHeaders, authConfig, pw)
 		pw.CloseWithError(err)
 	}()
 
diff --git a/components/engine/daemon/cluster/executor/container/container.go b/components/engine/daemon/cluster/executor/container/container.go
index 31a9c91e05..501da3286c 100644
--- a/components/engine/daemon/cluster/executor/container/container.go
+++ b/components/engine/daemon/cluster/executor/container/container.go
@@ -495,7 +495,6 @@ func getEndpointConfig(na *api.NetworkAttachment, b executorpkg.Backend) *networ
 			IPv4Address: ipv4,
 			IPv6Address: ipv6,
 		},
-		Aliases:    na.Aliases,
 		DriverOpts: na.DriverAttachmentOpts,
 	}
 	if v, ok := na.Network.Spec.Annotations.Labels["com.docker.swarm.predefined"]; ok && v == "true" {
diff --git a/components/engine/daemon/cluster/executor/container/health_test.go b/components/engine/daemon/cluster/executor/container/health_test.go
index 4abf0999b4..b6f188557f 100644
--- a/components/engine/daemon/cluster/executor/container/health_test.go
+++ b/components/engine/daemon/cluster/executor/container/health_test.go
@@ -38,14 +38,12 @@ func TestHealthStates(t *testing.T) {
 	}
 
 	c := &container.Container{
-		CommonContainer: container.CommonContainer{
-			ID:   "id",
-			Name: "name",
-			Config: &containertypes.Config{
-				Image: "image_name",
-				Labels: map[string]string{
-					"com.docker.swarm.task.id": "id",
-				},
+		ID:   "id",
+		Name: "name",
+		Config: &containertypes.Config{
+			Image: "image_name",
+			Labels: map[string]string{
+				"com.docker.swarm.task.id": "id",
 			},
 		},
 	}
diff --git a/components/engine/daemon/cluster/noderunner.go b/components/engine/daemon/cluster/noderunner.go
index 2ec13b4639..c0c7529ed9 100644
--- a/components/engine/daemon/cluster/noderunner.go
+++ b/components/engine/daemon/cluster/noderunner.go
@@ -50,6 +50,9 @@ type nodeStartConfig struct {
 	AdvertiseAddr string
 	// DataPathAddr is the address that has to be used for the data path
 	DataPathAddr string
+	// JoinInProgress is set to true if a join operation has started, but
+	// not completed yet.
+	JoinInProgress bool
 
 	joinAddr        string
 	forceNewCluster bool
@@ -98,6 +101,13 @@ func (n *nodeRunner) start(conf nodeStartConfig) error {
 		control = filepath.Join(n.cluster.runtimeRoot, controlSocket)
 	}
 
+	joinAddr := conf.joinAddr
+	if joinAddr == "" && conf.JoinInProgress {
+		// We must have been restarted while trying to join a cluster.
+		// Continue trying to join instead of forming our own cluster.
+		joinAddr = conf.RemoteAddr
+	}
+
 	// Hostname is not set here. Instead, it is obtained from
 	// the node description that is reported periodically
 	swarmnodeConfig := swarmnode.Config{
@@ -105,7 +115,7 @@ func (n *nodeRunner) start(conf nodeStartConfig) error {
 		ListenControlAPI:   control,
 		ListenRemoteAPI:    conf.ListenAddr,
 		AdvertiseRemoteAPI: conf.AdvertiseAddr,
-		JoinAddr:           conf.joinAddr,
+		JoinAddr:           joinAddr,
 		StateDir:           n.cluster.root,
 		JoinToken:          conf.joinToken,
 		Executor:           container.NewExecutor(n.cluster.config.Backend),
@@ -133,6 +143,9 @@ func (n *nodeRunner) start(conf nodeStartConfig) error {
 	n.done = make(chan struct{})
 	n.ready = make(chan struct{})
 	n.swarmNode = node
+	if conf.joinAddr != "" {
+		conf.JoinInProgress = true
+	}
 	n.config = conf
 	savePersistentState(n.cluster.root, conf)
 
@@ -216,6 +229,10 @@ func (n *nodeRunner) handleReadyEvent(ctx context.Context, node *swarmnode.Node,
 	case <-node.Ready():
 		n.mu.Lock()
 		n.err = nil
+		if n.config.JoinInProgress {
+			n.config.JoinInProgress = false
+			savePersistentState(n.cluster.root, n.config)
+		}
 		n.mu.Unlock()
 		close(ready)
 	case <-ctx.Done():
@@ -306,7 +323,6 @@ func (n *nodeRunner) enableReconnectWatcher() {
 	delayCtx, cancel := context.WithTimeout(context.Background(), n.reconnectDelay)
 	n.cancelReconnect = cancel
 
-	config := n.config
 	go func() {
 		<-delayCtx.Done()
 		if delayCtx.Err() != context.DeadlineExceeded {
@@ -317,15 +333,8 @@ func (n *nodeRunner) enableReconnectWatcher() {
 		if n.stopping {
 			return
 		}
-		remotes := n.cluster.getRemoteAddressList()
-		if len(remotes) > 0 {
-			config.RemoteAddr = remotes[0]
-		} else {
-			config.RemoteAddr = ""
-		}
 
-		config.joinAddr = config.RemoteAddr
-		if err := n.start(config); err != nil {
+		if err := n.start(n.config); err != nil {
 			n.err = err
 		}
 	}()
diff --git a/components/engine/daemon/commit.go b/components/engine/daemon/commit.go
index e64c7d3333..084f488583 100644
--- a/components/engine/daemon/commit.go
+++ b/components/engine/daemon/commit.go
@@ -12,7 +12,6 @@ import (
 	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/builder/dockerfile"
 	"github.com/docker/docker/container"
-	"github.com/docker/docker/dockerversion"
 	"github.com/docker/docker/image"
 	"github.com/docker/docker/layer"
 	"github.com/docker/docker/pkg/ioutils"
@@ -129,11 +128,6 @@ func (daemon *Daemon) Commit(name string, c *backend.ContainerCommitConfig) (str
 		return "", err
 	}
 
-	containerConfig := c.ContainerConfig
-	if containerConfig == nil {
-		containerConfig = container.Config
-	}
-
 	// It is not possible to commit a running container on Windows and on Solaris.
 	if (runtime.GOOS == "windows" || runtime.GOOS == "solaris") && container.IsRunning() {
 		return "", errors.Errorf("%+v does not support commit of a running container", runtime.GOOS)
@@ -165,71 +159,47 @@ func (daemon *Daemon) Commit(name string, c *backend.ContainerCommitConfig) (str
 		}
 	}()
 
-	var history []image.History
-	rootFS := image.NewRootFS()
-	osVersion := ""
-	var osFeatures []string
-
-	if container.ImageID != "" {
-		img, err := daemon.imageStore.Get(container.ImageID)
+	var parent *image.Image
+	if container.ImageID == "" {
+		parent = new(image.Image)
+		parent.RootFS = image.NewRootFS()
+	} else {
+		parent, err = daemon.stores[container.Platform].imageStore.Get(container.ImageID)
 		if err != nil {
 			return "", err
 		}
-		history = img.History
-		rootFS = img.RootFS
-		osVersion = img.OSVersion
-		osFeatures = img.OSFeatures
 	}
 
-	l, err := daemon.layerStore.Register(rwTar, rootFS.ChainID())
+	l, err := daemon.stores[container.Platform].layerStore.Register(rwTar, parent.RootFS.ChainID(), layer.Platform(container.Platform))
 	if err != nil {
 		return "", err
 	}
-	defer layer.ReleaseAndLog(daemon.layerStore, l)
+	defer layer.ReleaseAndLog(daemon.stores[container.Platform].layerStore, l)
 
-	h := image.History{
-		Author:     c.Author,
-		Created:    time.Now().UTC(),
-		CreatedBy:  strings.Join(containerConfig.Cmd, " "),
-		Comment:    c.Comment,
-		EmptyLayer: true,
+	containerConfig := c.ContainerConfig
+	if containerConfig == nil {
+		containerConfig = container.Config
 	}
-
-	if diffID := l.DiffID(); layer.DigestSHA256EmptyTar != diffID {
-		h.EmptyLayer = false
-		rootFS.Append(diffID)
+	cc := image.ChildConfig{
+		ContainerID:     container.ID,
+		Author:          c.Author,
+		Comment:         c.Comment,
+		ContainerConfig: containerConfig,
+		Config:          newConfig,
+		DiffID:          l.DiffID(),
 	}
-
-	history = append(history, h)
-
-	config, err := json.Marshal(&image.Image{
-		V1Image: image.V1Image{
-			DockerVersion:   dockerversion.Version,
-			Config:          newConfig,
-			Architecture:    runtime.GOARCH,
-			OS:              runtime.GOOS,
-			Container:       container.ID,
-			ContainerConfig: *containerConfig,
-			Author:          c.Author,
-			Created:         h.Created,
-		},
-		RootFS:     rootFS,
-		History:    history,
-		OSFeatures: osFeatures,
-		OSVersion:  osVersion,
-	})
-
+	config, err := json.Marshal(image.NewChildImage(parent, cc, container.Platform))
 	if err != nil {
 		return "", err
 	}
 
-	id, err := daemon.imageStore.Create(config)
+	id, err := daemon.stores[container.Platform].imageStore.Create(config)
 	if err != nil {
 		return "", err
 	}
 
 	if container.ImageID != "" {
-		if err := daemon.imageStore.SetParent(id, container.ImageID); err != nil {
+		if err := daemon.stores[container.Platform].imageStore.SetParent(id, container.ImageID); err != nil {
 			return "", err
 		}
 	}
@@ -248,7 +218,7 @@ func (daemon *Daemon) Commit(name string, c *backend.ContainerCommitConfig) (str
 				return "", err
 			}
 		}
-		if err := daemon.TagImageWithReference(id, newTag); err != nil {
+		if err := daemon.TagImageWithReference(id, container.Platform, newTag); err != nil {
 			return "", err
 		}
 		imageRef = reference.FamiliarString(newTag)
diff --git a/components/engine/daemon/config/config_common_unix.go b/components/engine/daemon/config/config_common_unix.go
index 2e818cb344..d11cceba20 100644
--- a/components/engine/daemon/config/config_common_unix.go
+++ b/components/engine/daemon/config/config_common_unix.go
@@ -59,7 +59,7 @@ func (conf *Config) GetExecRoot() string {
 	return conf.ExecRoot
 }
 
-// GetInitPath returns the configure docker-init path
+// GetInitPath returns the configured docker-init path
 func (conf *Config) GetInitPath() string {
 	conf.Lock()
 	defer conf.Unlock()
diff --git a/components/engine/daemon/config/config_unix_test.go b/components/engine/daemon/config/config_unix_test.go
index 3e7d1be94a..9e52cb70fe 100644
--- a/components/engine/daemon/config/config_unix_test.go
+++ b/components/engine/daemon/config/config_unix_test.go
@@ -3,21 +3,18 @@
 package config
 
 import (
-	"io/ioutil"
-	"runtime"
-
 	"testing"
+
+	"github.com/docker/docker/opts"
+	"github.com/docker/docker/pkg/testutil/tempfile"
+	"github.com/docker/go-units"
+	"github.com/spf13/pflag"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
-func TestDaemonConfigurationMerge(t *testing.T) {
-	f, err := ioutil.TempFile("", "docker-config-")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	configFile := f.Name()
-
-	f.Write([]byte(`
+func TestGetConflictFreeConfiguration(t *testing.T) {
+	configFileData := string([]byte(`
 		{
 			"debug": true,
 			"default-ulimits": {
@@ -32,7 +29,49 @@ func TestDaemonConfigurationMerge(t *testing.T) {
 			}
 		}`))
 
-	f.Close()
+	file := tempfile.NewTempFile(t, "docker-config", configFileData)
+	defer file.Remove()
+
+	flags := pflag.NewFlagSet("test", pflag.ContinueOnError)
+	var debug bool
+	flags.BoolVarP(&debug, "debug", "D", false, "")
+	flags.Var(opts.NewNamedUlimitOpt("default-ulimits", nil), "default-ulimit", "")
+	flags.Var(opts.NewNamedMapOpts("log-opts", nil, nil), "log-opt", "")
+
+	cc, err := getConflictFreeConfiguration(file.Name(), flags)
+	require.NoError(t, err)
+
+	assert.True(t, cc.Debug)
+
+	expectedUlimits := map[string]*units.Ulimit{
+		"nofile": {
+			Name: "nofile",
+			Hard: 2048,
+			Soft: 1024,
+		},
+	}
+
+	assert.Equal(t, expectedUlimits, cc.Ulimits)
+}
+
+func TestDaemonConfigurationMerge(t *testing.T) {
+	configFileData := string([]byte(`
+		{
+			"debug": true,
+			"default-ulimits": {
+				"nofile": {
+					"Name": "nofile",
+					"Hard": 2048,
+					"Soft": 1024
+				}
+			},
+			"log-opts": {
+				"tag": "test_tag"
+			}
+		}`))
+
+	file := tempfile.NewTempFile(t, "docker-config", configFileData)
+	defer file.Remove()
 
 	c := &Config{
 		CommonConfig: CommonConfig{
@@ -44,66 +83,55 @@ func TestDaemonConfigurationMerge(t *testing.T) {
 		},
 	}
 
-	cc, err := MergeDaemonConfigurations(c, nil, configFile)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !cc.Debug {
-		t.Fatalf("expected %v, got %v\n", true, cc.Debug)
-	}
-	if !cc.AutoRestart {
-		t.Fatalf("expected %v, got %v\n", true, cc.AutoRestart)
-	}
-	if cc.LogConfig.Type != "syslog" {
-		t.Fatalf("expected syslog config, got %q\n", cc.LogConfig)
+	flags := pflag.NewFlagSet("test", pflag.ContinueOnError)
+
+	var debug bool
+	flags.BoolVarP(&debug, "debug", "D", false, "")
+	flags.Var(opts.NewNamedUlimitOpt("default-ulimits", nil), "default-ulimit", "")
+	flags.Var(opts.NewNamedMapOpts("log-opts", nil, nil), "log-opt", "")
+
+	cc, err := MergeDaemonConfigurations(c, flags, file.Name())
+	require.NoError(t, err)
+
+	assert.True(t, cc.Debug)
+	assert.True(t, cc.AutoRestart)
+
+	expectedLogConfig := LogConfig{
+		Type:   "syslog",
+		Config: map[string]string{"tag": "test_tag"},
 	}
 
-	if configValue, OK := cc.LogConfig.Config["tag"]; !OK {
-		t.Fatal("expected syslog config attributes, got nil\n")
-	} else {
-		if configValue != "test_tag" {
-			t.Fatalf("expected syslog config attributes 'tag=test_tag', got 'tag=%s'\n", configValue)
-		}
+	assert.Equal(t, expectedLogConfig, cc.LogConfig)
+
+	expectedUlimits := map[string]*units.Ulimit{
+		"nofile": {
+			Name: "nofile",
+			Hard: 2048,
+			Soft: 1024,
+		},
 	}
 
-	if cc.Ulimits == nil {
-		t.Fatal("expected default ulimit config, got nil\n")
-	} else {
-		if _, OK := cc.Ulimits["nofile"]; OK {
-			if cc.Ulimits["nofile"].Name != "nofile" ||
-				cc.Ulimits["nofile"].Hard != 2048 ||
-				cc.Ulimits["nofile"].Soft != 1024 {
-				t.Fatalf("expected default ulimit name, hard and soft are nofile, 2048, 1024, got %s, %d, %d\n", cc.Ulimits["nofile"].Name, cc.Ulimits["nofile"].Hard, cc.Ulimits["nofile"].Soft)
-			}
-		} else {
-			t.Fatal("expected default ulimit name nofile, got nil\n")
-		}
-	}
+	assert.Equal(t, expectedUlimits, cc.Ulimits)
 }
 
 func TestDaemonConfigurationMergeShmSize(t *testing.T) {
-	if runtime.GOOS == "solaris" {
-		t.Skip("ShmSize not supported on Solaris\n")
-	}
-	f, err := ioutil.TempFile("", "docker-config-")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	configFile := f.Name()
-
-	f.Write([]byte(`
+	data := string([]byte(`
 		{
 			"default-shm-size": "1g"
 		}`))
 
-	f.Close()
+	file := tempfile.NewTempFile(t, "docker-config", data)
+	defer file.Remove()
 
 	c := &Config{}
-	cc, err := MergeDaemonConfigurations(c, nil, configFile)
-	if err != nil {
-		t.Fatal(err)
-	}
+
+	flags := pflag.NewFlagSet("test", pflag.ContinueOnError)
+	shmSize := opts.MemBytes(DefaultShmSize)
+	flags.Var(&shmSize, "default-shm-size", "")
+
+	cc, err := MergeDaemonConfigurations(c, flags, file.Name())
+	require.NoError(t, err)
+
 	expectedValue := 1 * 1024 * 1024 * 1024
 	if cc.ShmSize.Value() != int64(expectedValue) {
 		t.Fatalf("expected default shm size %d, got %d", expectedValue, cc.ShmSize.Value())
diff --git a/components/engine/daemon/config/config_windows_test.go b/components/engine/daemon/config/config_windows_test.go
index 1c435c630a..92ee8e4acd 100644
--- a/components/engine/daemon/config/config_windows_test.go
+++ b/components/engine/daemon/config/config_windows_test.go
@@ -5,6 +5,11 @@ package config
 import (
 	"io/ioutil"
 	"testing"
+
+	"github.com/docker/docker/opts"
+	"github.com/spf13/pflag"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestDaemonConfigurationMerge(t *testing.T) {
@@ -35,25 +40,21 @@ func TestDaemonConfigurationMerge(t *testing.T) {
 		},
 	}
 
-	cc, err := MergeDaemonConfigurations(c, nil, configFile)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !cc.Debug {
-		t.Fatalf("expected %v, got %v\n", true, cc.Debug)
-	}
-	if !cc.AutoRestart {
-		t.Fatalf("expected %v, got %v\n", true, cc.AutoRestart)
-	}
-	if cc.LogConfig.Type != "syslog" {
-		t.Fatalf("expected syslog config, got %q\n", cc.LogConfig)
+	flags := pflag.NewFlagSet("test", pflag.ContinueOnError)
+	var debug bool
+	flags.BoolVarP(&debug, "debug", "D", false, "")
+	flags.Var(opts.NewNamedMapOpts("log-opts", nil, nil), "log-opt", "")
+
+	cc, err := MergeDaemonConfigurations(c, flags, configFile)
+	require.NoError(t, err)
+
+	assert.True(t, cc.Debug)
+	assert.True(t, cc.AutoRestart)
+
+	expectedLogConfig := LogConfig{
+		Type:   "syslog",
+		Config: map[string]string{"tag": "test_tag"},
 	}
 
-	if configValue, OK := cc.LogConfig.Config["tag"]; !OK {
-		t.Fatal("expected syslog config attributes, got nil\n")
-	} else {
-		if configValue != "test_tag" {
-			t.Fatalf("expected syslog config attributes 'tag=test_tag', got 'tag=%s'\n", configValue)
-		}
-	}
+	assert.Equal(t, expectedLogConfig, cc.LogConfig)
 }
diff --git a/components/engine/daemon/container.go b/components/engine/daemon/container.go
index 6a660ba4f3..149df0dec6 100644
--- a/components/engine/daemon/container.go
+++ b/components/engine/daemon/container.go
@@ -18,6 +18,7 @@ import (
 	"github.com/docker/docker/pkg/truncindex"
 	"github.com/docker/docker/runconfig"
 	"github.com/docker/go-connections/nat"
+	"github.com/opencontainers/selinux/go-selinux/label"
 )
 
 // GetContainer looks for a container using the provided information, which could be
@@ -90,6 +91,9 @@ func (daemon *Daemon) load(id string) (*container.Container, error) {
 	if err := container.FromDisk(); err != nil {
 		return nil, err
 	}
+	if err := label.ReserveLabel(container.ProcessLabel); err != nil {
+		return nil, err
+	}
 
 	if container.ID != id {
 		return container, fmt.Errorf("Container %s is stored at %s", container.ID, id)
@@ -99,7 +103,7 @@ func (daemon *Daemon) load(id string) (*container.Container, error) {
 }
 
 // Register makes a container object usable by the daemon as <container.ID>
-func (daemon *Daemon) Register(c *container.Container) {
+func (daemon *Daemon) Register(c *container.Container) error {
 	// Attach to stdout and stderr
 	if c.Config.OpenStdin {
 		c.StreamConfig.NewInputPipes()
@@ -107,11 +111,17 @@ func (daemon *Daemon) Register(c *container.Container) {
 		c.StreamConfig.NewNopInputPipe()
 	}
 
+	// once in the memory store it is visible to other goroutines
+	// grab a Lock until it has been checkpointed to avoid races
+	c.Lock()
+	defer c.Unlock()
+
 	daemon.containers.Add(c.ID, c)
 	daemon.idIndex.Add(c.ID)
+	return c.CheckpointTo(daemon.containersReplica)
 }
 
-func (daemon *Daemon) newContainer(name string, config *containertypes.Config, hostConfig *containertypes.HostConfig, imgID image.ID, managed bool) (*container.Container, error) {
+func (daemon *Daemon) newContainer(name string, platform string, config *containertypes.Config, hostConfig *containertypes.HostConfig, imgID image.ID, managed bool) (*container.Container, error) {
 	var (
 		id             string
 		err            error
@@ -144,8 +154,8 @@ func (daemon *Daemon) newContainer(name string, config *containertypes.Config, h
 	base.ImageID = imgID
 	base.NetworkSettings = &network.Settings{IsAnonymousEndpoint: noExplicitName}
 	base.Name = name
-	base.Driver = daemon.GraphDriverName()
-
+	base.Driver = daemon.GraphDriverName(platform)
+	base.Platform = platform
 	return base, err
 }
 
@@ -212,7 +222,7 @@ func (daemon *Daemon) setHostConfig(container *container.Container, hostConfig *
 
 	runconfig.SetDefaultNetModeIfBlank(hostConfig)
 	container.HostConfig = hostConfig
-	return container.ToDisk()
+	return container.CheckpointTo(daemon.containersReplica)
 }
 
 // verifyContainerSettings performs validation of the hostconfig and config
@@ -301,7 +311,7 @@ func (daemon *Daemon) verifyContainerSettings(hostConfig *containertypes.HostCon
 			return nil, fmt.Errorf("maximum retry count cannot be negative")
 		}
 	case "":
-	// do nothing
+		// do nothing
 	default:
 		return nil, fmt.Errorf("invalid restart policy '%s'", p.Name)
 	}
diff --git a/components/engine/daemon/container_operations.go b/components/engine/daemon/container_operations.go
index 82ca4701af..00ed2f4787 100644
--- a/components/engine/daemon/container_operations.go
+++ b/components/engine/daemon/container_operations.go
@@ -44,6 +44,7 @@ func (daemon *Daemon) getDNSSearchSettings(container *container.Container) []str
 
 	return nil
 }
+
 func (daemon *Daemon) buildSandboxOptions(container *container.Container) ([]libnetwork.SandboxOption, error) {
 	var (
 		sboxOptions []libnetwork.SandboxOption
@@ -568,7 +569,7 @@ func (daemon *Daemon) allocateNetwork(container *container.Container) error {
 
 	}
 
-	if err := container.WriteHostConfig(); err != nil {
+	if _, err := container.WriteHostConfig(); err != nil {
 		return err
 	}
 	networkActions.WithValues("allocate").UpdateSince(start)
@@ -980,6 +981,9 @@ func (daemon *Daemon) ConnectToNetwork(container *container.Container, idOrName
 	if endpointConfig == nil {
 		endpointConfig = &networktypes.EndpointSettings{}
 	}
+	container.Lock()
+	defer container.Unlock()
+
 	if !container.Running {
 		if container.RemovalInProgress || container.Dead {
 			return errRemovalContainer(container.ID)
@@ -1002,15 +1006,16 @@ func (daemon *Daemon) ConnectToNetwork(container *container.Container, idOrName
 			return err
 		}
 	}
-	if err := container.ToDiskLocking(); err != nil {
-		return fmt.Errorf("Error saving container to disk: %v", err)
-	}
-	return nil
+
+	return container.CheckpointTo(daemon.containersReplica)
 }
 
 // DisconnectFromNetwork disconnects container from network n.
 func (daemon *Daemon) DisconnectFromNetwork(container *container.Container, networkName string, force bool) error {
 	n, err := daemon.FindNetwork(networkName)
+	container.Lock()
+	defer container.Unlock()
+
 	if !container.Running || (err != nil && force) {
 		if container.RemovalInProgress || container.Dead {
 			return errRemovalContainer(container.ID)
@@ -1038,16 +1043,16 @@ func (daemon *Daemon) DisconnectFromNetwork(container *container.Container, netw
 		return err
 	}
 
-	if err := container.ToDiskLocking(); err != nil {
-		return fmt.Errorf("Error saving container to disk: %v", err)
+	if err := container.CheckpointTo(daemon.containersReplica); err != nil {
+		return err
 	}
 
 	if n != nil {
-		attributes := map[string]string{
+		daemon.LogNetworkEventWithAttributes(n, "disconnect", map[string]string{
 			"container": container.ID,
-		}
-		daemon.LogNetworkEventWithAttributes(n, "disconnect", attributes)
+		})
 	}
+
 	return nil
 }
 
diff --git a/components/engine/daemon/container_operations_unix.go b/components/engine/daemon/container_operations_unix.go
index 6889c10956..277c83e083 100644
--- a/components/engine/daemon/container_operations_unix.go
+++ b/components/engine/daemon/container_operations_unix.go
@@ -109,14 +109,14 @@ func (daemon *Daemon) setupIpcDirs(c *container.Container) error {
 		}
 		c.ShmPath = "/dev/shm"
 	} else {
-		rootUID, rootGID := daemon.GetRemappedUIDGID()
+		rootIDs := daemon.idMappings.RootPair()
 		if !c.HasMountFor("/dev/shm") {
 			shmPath, err := c.ShmResourcePath()
 			if err != nil {
 				return err
 			}
 
-			if err := idtools.MkdirAllAs(shmPath, 0700, rootUID, rootGID); err != nil {
+			if err := idtools.MkdirAllAndChown(shmPath, 0700, rootIDs); err != nil {
 				return err
 			}
 
@@ -128,7 +128,7 @@ func (daemon *Daemon) setupIpcDirs(c *container.Container) error {
 			if err := syscall.Mount("shm", shmPath, "tmpfs", uintptr(syscall.MS_NOEXEC|syscall.MS_NOSUID|syscall.MS_NODEV), label.FormatMountLabel(shmproperty, c.GetMountLabel())); err != nil {
 				return fmt.Errorf("mounting shm tmpfs: %s", err)
 			}
-			if err := os.Chown(shmPath, rootUID, rootGID); err != nil {
+			if err := os.Chown(shmPath, rootIDs.UID, rootIDs.GID); err != nil {
 				return err
 			}
 		}
@@ -147,9 +147,9 @@ func (daemon *Daemon) setupSecretDir(c *container.Container) (setupErr error) {
 	logrus.Debugf("secrets: setting up secret dir: %s", localMountPath)
 
 	// retrieve possible remapped range start for root UID, GID
-	rootUID, rootGID := daemon.GetRemappedUIDGID()
+	rootIDs := daemon.idMappings.RootPair()
 	// create tmpfs
-	if err := idtools.MkdirAllAs(localMountPath, 0700, rootUID, rootGID); err != nil {
+	if err := idtools.MkdirAllAndChown(localMountPath, 0700, rootIDs); err != nil {
 		return errors.Wrap(err, "error creating secret local mount path")
 	}
 
@@ -164,7 +164,7 @@ func (daemon *Daemon) setupSecretDir(c *container.Container) (setupErr error) {
 		}
 	}()
 
-	tmpfsOwnership := fmt.Sprintf("uid=%d,gid=%d", rootUID, rootGID)
+	tmpfsOwnership := fmt.Sprintf("uid=%d,gid=%d", rootIDs.UID, rootIDs.GID)
 	if err := mount.Mount("tmpfs", localMountPath, "tmpfs", "nodev,nosuid,noexec,"+tmpfsOwnership); err != nil {
 		return errors.Wrap(err, "unable to setup secret mount")
 	}
@@ -183,7 +183,7 @@ func (daemon *Daemon) setupSecretDir(c *container.Container) (setupErr error) {
 		// secrets are created in the SecretMountPath on the host, at a
 		// single level
 		fPath := c.SecretFilePath(*s)
-		if err := idtools.MkdirAllAs(filepath.Dir(fPath), 0700, rootUID, rootGID); err != nil {
+		if err := idtools.MkdirAllAndChown(filepath.Dir(fPath), 0700, rootIDs); err != nil {
 			return errors.Wrap(err, "error creating secret mount path")
 		}
 
@@ -191,9 +191,9 @@ func (daemon *Daemon) setupSecretDir(c *container.Container) (setupErr error) {
 			"name": s.File.Name,
 			"path": fPath,
 		}).Debug("injecting secret")
-		secret := c.DependencyStore.Secrets().Get(s.SecretID)
-		if secret == nil {
-			return fmt.Errorf("unable to get secret from secret store")
+		secret, err := c.DependencyStore.Secrets().Get(s.SecretID)
+		if err != nil {
+			return errors.Wrap(err, "unable to get secret from secret store")
 		}
 		if err := ioutil.WriteFile(fPath, secret.Spec.Data, s.File.Mode); err != nil {
 			return errors.Wrap(err, "error injecting secret")
@@ -208,7 +208,7 @@ func (daemon *Daemon) setupSecretDir(c *container.Container) (setupErr error) {
 			return err
 		}
 
-		if err := os.Chown(fPath, rootUID+uid, rootGID+gid); err != nil {
+		if err := os.Chown(fPath, rootIDs.UID+uid, rootIDs.GID+gid); err != nil {
 			return errors.Wrap(err, "error setting ownership for secret")
 		}
 	}
@@ -232,9 +232,9 @@ func (daemon *Daemon) setupConfigDir(c *container.Container) (setupErr error) {
 	logrus.Debugf("configs: setting up config dir: %s", localPath)
 
 	// retrieve possible remapped range start for root UID, GID
-	rootUID, rootGID := daemon.GetRemappedUIDGID()
+	rootIDs := daemon.idMappings.RootPair()
 	// create tmpfs
-	if err := idtools.MkdirAllAs(localPath, 0700, rootUID, rootGID); err != nil {
+	if err := idtools.MkdirAllAndChown(localPath, 0700, rootIDs); err != nil {
 		return errors.Wrap(err, "error creating config dir")
 	}
 
@@ -261,14 +261,14 @@ func (daemon *Daemon) setupConfigDir(c *container.Container) (setupErr error) {
 
 		log := logrus.WithFields(logrus.Fields{"name": configRef.File.Name, "path": fPath})
 
-		if err := idtools.MkdirAllAs(filepath.Dir(fPath), 0700, rootUID, rootGID); err != nil {
+		if err := idtools.MkdirAllAndChown(filepath.Dir(fPath), 0700, rootIDs); err != nil {
 			return errors.Wrap(err, "error creating config path")
 		}
 
 		log.Debug("injecting config")
-		config := c.DependencyStore.Configs().Get(configRef.ConfigID)
-		if config == nil {
-			return fmt.Errorf("unable to get config from config store")
+		config, err := c.DependencyStore.Configs().Get(configRef.ConfigID)
+		if err != nil {
+			return errors.Wrap(err, "unable to get config from config store")
 		}
 		if err := ioutil.WriteFile(fPath, config.Spec.Data, configRef.File.Mode); err != nil {
 			return errors.Wrap(err, "error injecting config")
@@ -283,7 +283,7 @@ func (daemon *Daemon) setupConfigDir(c *container.Container) (setupErr error) {
 			return err
 		}
 
-		if err := os.Chown(fPath, rootUID+uid, rootGID+gid); err != nil {
+		if err := os.Chown(fPath, rootIDs.UID+uid, rootIDs.GID+gid); err != nil {
 			return errors.Wrap(err, "error setting ownership for config")
 		}
 	}
diff --git a/components/engine/daemon/container_operations_windows.go b/components/engine/daemon/container_operations_windows.go
index 058089e7ca..1c20ebd672 100644
--- a/components/engine/daemon/container_operations_windows.go
+++ b/components/engine/daemon/container_operations_windows.go
@@ -25,7 +25,7 @@ func (daemon *Daemon) setupConfigDir(c *container.Container) (setupErr error) {
 	logrus.Debugf("configs: setting up config dir: %s", localPath)
 
 	// create local config root
-	if err := system.MkdirAllWithACL(localPath, 0); err != nil {
+	if err := system.MkdirAllWithACL(localPath, 0, system.SddlAdministratorsLocalSystem); err != nil {
 		return errors.Wrap(err, "error creating config dir")
 	}
 
@@ -53,9 +53,9 @@ func (daemon *Daemon) setupConfigDir(c *container.Container) (setupErr error) {
 		log := logrus.WithFields(logrus.Fields{"name": configRef.File.Name, "path": fPath})
 
 		log.Debug("injecting config")
-		config := c.DependencyStore.Configs().Get(configRef.ConfigID)
-		if config == nil {
-			return fmt.Errorf("unable to get config from config store")
+		config, err := c.DependencyStore.Configs().Get(configRef.ConfigID)
+		if err != nil {
+			return errors.Wrap(err, "unable to get config from config store")
 		}
 		if err := ioutil.WriteFile(fPath, config.Spec.Data, configRef.File.Mode); err != nil {
 			return errors.Wrap(err, "error injecting config")
@@ -98,7 +98,7 @@ func (daemon *Daemon) setupSecretDir(c *container.Container) (setupErr error) {
 	logrus.Debugf("secrets: setting up secret dir: %s", localMountPath)
 
 	// create local secret root
-	if err := system.MkdirAllWithACL(localMountPath, 0); err != nil {
+	if err := system.MkdirAllWithACL(localMountPath, 0, system.SddlAdministratorsLocalSystem); err != nil {
 		return errors.Wrap(err, "error creating secret local directory")
 	}
 
@@ -128,9 +128,9 @@ func (daemon *Daemon) setupSecretDir(c *container.Container) (setupErr error) {
 			"name": s.File.Name,
 			"path": fPath,
 		}).Debug("injecting secret")
-		secret := c.DependencyStore.Secrets().Get(s.SecretID)
-		if secret == nil {
-			return fmt.Errorf("unable to get secret from secret store")
+		secret, err := c.DependencyStore.Secrets().Get(s.SecretID)
+		if err != nil {
+			return errors.Wrap(err, "unable to get secret from secret store")
 		}
 		if err := ioutil.WriteFile(fPath, secret.Spec.Data, s.File.Mode); err != nil {
 			return errors.Wrap(err, "error injecting secret")
diff --git a/components/engine/daemon/create.go b/components/engine/daemon/create.go
index de129ca60d..d47de31fa8 100644
--- a/components/engine/daemon/create.go
+++ b/components/engine/daemon/create.go
@@ -19,6 +19,7 @@ import (
 	"github.com/docker/docker/layer"
 	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/stringid"
+	"github.com/docker/docker/pkg/system"
 	"github.com/docker/docker/runconfig"
 	"github.com/opencontainers/selinux/go-selinux/label"
 )
@@ -75,6 +76,16 @@ func (daemon *Daemon) create(params types.ContainerCreateConfig, managed bool) (
 		err       error
 	)
 
+	// TODO: @jhowardmsft LCOW support - at a later point, can remove the hard-coding
+	// to force the platform to be linux.
+	// Default the platform if not supplied
+	if params.Platform == "" {
+		params.Platform = runtime.GOOS
+	}
+	if params.Platform == "windows" && system.LCOWSupported() {
+		params.Platform = "linux"
+	}
+
 	if params.Config.Image != "" {
 		img, err = daemon.GetImage(params.Config.Image)
 		if err != nil {
@@ -82,9 +93,23 @@ func (daemon *Daemon) create(params types.ContainerCreateConfig, managed bool) (
 		}
 
 		if runtime.GOOS == "solaris" && img.OS != "solaris " {
-			return nil, errors.New("Platform on which parent image was created is not Solaris")
+			return nil, errors.New("platform on which parent image was created is not Solaris")
 		}
 		imgID = img.ID()
+
+		if runtime.GOOS == "windows" && img.OS == "linux" && !system.LCOWSupported() {
+			return nil, errors.New("platform on which parent image was created is not Windows")
+		}
+	}
+
+	// Make sure the platform requested matches the image
+	if img != nil {
+		if params.Platform != img.Platform() {
+			// Ignore this in LCOW mode. @jhowardmsft TODO - This will need revisiting later.
+			if !(runtime.GOOS == "windows" && system.LCOWSupported()) {
+				return nil, fmt.Errorf("cannot create a %s container from a %s image", params.Platform, img.Platform())
+			}
+		}
 	}
 
 	if err := daemon.mergeAndVerifyConfig(params.Config, img); err != nil {
@@ -95,7 +120,7 @@ func (daemon *Daemon) create(params types.ContainerCreateConfig, managed bool) (
 		return nil, err
 	}
 
-	if container, err = daemon.newContainer(params.Name, params.Config, params.HostConfig, imgID, managed); err != nil {
+	if container, err = daemon.newContainer(params.Name, params.Platform, params.Config, params.HostConfig, imgID, managed); err != nil {
 		return nil, err
 	}
 	defer func() {
@@ -117,14 +142,11 @@ func (daemon *Daemon) create(params types.ContainerCreateConfig, managed bool) (
 		return nil, err
 	}
 
-	rootUID, rootGID, err := idtools.GetRootUIDGID(daemon.uidMaps, daemon.gidMaps)
-	if err != nil {
+	rootIDs := daemon.idMappings.RootPair()
+	if err := idtools.MkdirAndChown(container.Root, 0700, rootIDs); err != nil {
 		return nil, err
 	}
-	if err := idtools.MkdirAs(container.Root, 0700, rootUID, rootGID); err != nil {
-		return nil, err
-	}
-	if err := idtools.MkdirAs(container.CheckpointDir(), 0700, rootUID, rootGID); err != nil {
+	if err := idtools.MkdirAndChown(container.CheckpointDir(), 0700, rootIDs); err != nil {
 		return nil, err
 	}
 
@@ -145,12 +167,9 @@ func (daemon *Daemon) create(params types.ContainerCreateConfig, managed bool) (
 	runconfig.SetDefaultNetModeIfBlank(container.HostConfig)
 
 	daemon.updateContainerNetworkSettings(container, endpointsConfigs)
-
-	if err := container.ToDisk(); err != nil {
-		logrus.Errorf("Error saving new container to disk: %v", err)
+	if err := daemon.Register(container); err != nil {
 		return nil, err
 	}
-	daemon.Register(container)
 	stateCtr.set(container.ID, "stopped")
 	daemon.LogContainerEvent(container, "create")
 	return container, nil
@@ -218,7 +237,7 @@ func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig)
 func (daemon *Daemon) setRWLayer(container *container.Container) error {
 	var layerID layer.ChainID
 	if container.ImageID != "" {
-		img, err := daemon.imageStore.Get(container.ImageID)
+		img, err := daemon.stores[container.Platform].imageStore.Get(container.ImageID)
 		if err != nil {
 			return err
 		}
@@ -231,7 +250,7 @@ func (daemon *Daemon) setRWLayer(container *container.Container) error {
 		StorageOpt: container.HostConfig.StorageOpt,
 	}
 
-	rwLayer, err := daemon.layerStore.CreateRWLayer(container.ID, layerID, rwLayerOpts)
+	rwLayer, err := daemon.stores[container.Platform].layerStore.CreateRWLayer(container.ID, layerID, rwLayerOpts)
 	if err != nil {
 		return err
 	}
diff --git a/components/engine/daemon/create_unix.go b/components/engine/daemon/create_unix.go
index 7b067bdc22..2501a3374a 100644
--- a/components/engine/daemon/create_unix.go
+++ b/components/engine/daemon/create_unix.go
@@ -22,8 +22,8 @@ func (daemon *Daemon) createContainerPlatformSpecificSettings(container *contain
 	}
 	defer daemon.Unmount(container)
 
-	rootUID, rootGID := daemon.GetRemappedUIDGID()
-	if err := container.SetupWorkingDirectory(rootUID, rootGID); err != nil {
+	rootIDs := daemon.idMappings.RootPair()
+	if err := container.SetupWorkingDirectory(rootIDs); err != nil {
 		return err
 	}
 
diff --git a/components/engine/daemon/daemon.go b/components/engine/daemon/daemon.go
index 3d45c71bf8..ac03b75c2c 100644
--- a/components/engine/daemon/daemon.go
+++ b/components/engine/daemon/daemon.go
@@ -40,7 +40,6 @@ import (
 	"github.com/docker/docker/layer"
 	"github.com/docker/docker/libcontainerd"
 	"github.com/docker/docker/migrate/v1"
-	"github.com/docker/docker/pkg/fileutils"
 	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/plugingetter"
 	"github.com/docker/docker/pkg/registrar"
@@ -70,44 +69,50 @@ var (
 	errSystemNotSupported = errors.New("The Docker daemon is not supported on this platform.")
 )
 
+type daemonStore struct {
+	graphDriver               string
+	imageRoot                 string
+	imageStore                image.Store
+	layerStore                layer.Store
+	distributionMetadataStore dmetadata.Store
+	referenceStore            refstore.Store
+}
+
 // Daemon holds information about the Docker daemon.
 type Daemon struct {
-	ID                        string
-	repository                string
-	containers                container.Store
-	execCommands              *exec.Store
-	referenceStore            refstore.Store
-	downloadManager           *xfer.LayerDownloadManager
-	uploadManager             *xfer.LayerUploadManager
-	distributionMetadataStore dmetadata.Store
-	trustKey                  libtrust.PrivateKey
-	idIndex                   *truncindex.TruncIndex
-	configStore               *config.Config
-	statsCollector            *stats.Collector
-	defaultLogConfig          containertypes.LogConfig
-	RegistryService           registry.Service
-	EventsService             *events.Events
-	netController             libnetwork.NetworkController
-	volumes                   *store.VolumeStore
-	discoveryWatcher          discovery.Reloader
-	root                      string
-	seccompEnabled            bool
-	apparmorEnabled           bool
-	shutdown                  bool
-	uidMaps                   []idtools.IDMap
-	gidMaps                   []idtools.IDMap
-	layerStore                layer.Store
-	imageStore                image.Store
-	PluginStore               *plugin.Store // todo: remove
-	pluginManager             *plugin.Manager
-	nameIndex                 *registrar.Registrar
-	linkIndex                 *linkIndex
-	containerd                libcontainerd.Client
-	containerdRemote          libcontainerd.Remote
-	defaultIsolation          containertypes.Isolation // Default isolation mode on Windows
-	clusterProvider           cluster.Provider
-	cluster                   Cluster
-	metricsPluginListener     net.Listener
+	ID                    string
+	repository            string
+	containers            container.Store
+	containersReplica     container.ViewDB
+	execCommands          *exec.Store
+	downloadManager       *xfer.LayerDownloadManager
+	uploadManager         *xfer.LayerUploadManager
+	trustKey              libtrust.PrivateKey
+	idIndex               *truncindex.TruncIndex
+	configStore           *config.Config
+	statsCollector        *stats.Collector
+	defaultLogConfig      containertypes.LogConfig
+	RegistryService       registry.Service
+	EventsService         *events.Events
+	netController         libnetwork.NetworkController
+	volumes               *store.VolumeStore
+	discoveryWatcher      discovery.Reloader
+	root                  string
+	seccompEnabled        bool
+	apparmorEnabled       bool
+	shutdown              bool
+	idMappings            *idtools.IDMappings
+	stores                map[string]daemonStore // By container target platform
+	PluginStore           *plugin.Store          // todo: remove
+	pluginManager         *plugin.Manager
+	nameIndex             *registrar.Registrar
+	linkIndex             *linkIndex
+	containerd            libcontainerd.Client
+	containerdRemote      libcontainerd.Remote
+	defaultIsolation      containertypes.Isolation // Default isolation mode on Windows
+	clusterProvider       cluster.Provider
+	cluster               Cluster
+	metricsPluginListener net.Listener
 
 	machineMemory uint64
 
@@ -116,6 +121,18 @@ type Daemon struct {
 
 	diskUsageRunning int32
 	pruneRunning     int32
+	hosts            map[string]bool // hosts stores the addresses the daemon is listening on
+	startupDone      chan struct{}
+}
+
+// StoreHosts stores the addresses the daemon is listening on
+func (daemon *Daemon) StoreHosts(hosts []string) {
+	if daemon.hosts == nil {
+		daemon.hosts = make(map[string]bool)
+	}
+	for _, h := range hosts {
+		daemon.hosts[h] = true
+	}
 }
 
 // HasExperimental returns whether the experimental features of the daemon are enabled or not
@@ -127,10 +144,7 @@ func (daemon *Daemon) HasExperimental() bool {
 }
 
 func (daemon *Daemon) restore() error {
-	var (
-		currentDriver = daemon.GraphDriverName()
-		containers    = make(map[string]*container.Container)
-	)
+	containers := make(map[string]*container.Container)
 
 	logrus.Info("Loading containers: start.")
 
@@ -148,8 +162,9 @@ func (daemon *Daemon) restore() error {
 		}
 
 		// Ignore the container if it does not support the current driver being used by the graph
-		if (container.Driver == "" && currentDriver == "aufs") || container.Driver == currentDriver {
-			rwlayer, err := daemon.layerStore.GetRWLayer(container.ID)
+		currentDriverForContainerPlatform := daemon.stores[container.Platform].graphDriver
+		if (container.Driver == "" && currentDriverForContainerPlatform == "aufs") || container.Driver == currentDriverForContainerPlatform {
+			rwlayer, err := daemon.stores[container.Platform].layerStore.GetRWLayer(container.ID)
 			if err != nil {
 				logrus.Errorf("Failed to load container mount %v: %v", id, err)
 				continue
@@ -168,17 +183,20 @@ func (daemon *Daemon) restore() error {
 	activeSandboxes := make(map[string]interface{})
 	for id, c := range containers {
 		if err := daemon.registerName(c); err != nil {
-			logrus.Errorf("Failed to register container %s: %s", c.ID, err)
+			logrus.Errorf("Failed to register container name %s: %s", c.ID, err)
 			delete(containers, id)
 			continue
 		}
-		daemon.Register(c)
-
 		// verify that all volumes valid and have been migrated from the pre-1.7 layout
 		if err := daemon.verifyVolumesInfo(c); err != nil {
 			// don't skip the container due to error
 			logrus.Errorf("Failed to verify volumes for container '%s': %v", c.ID, err)
 		}
+		if err := daemon.Register(c); err != nil {
+			logrus.Errorf("Failed to register container %s: %s", c.ID, err)
+			delete(containers, id)
+			continue
+		}
 
 		// The LogConfig.Type is empty if the container was created before docker 1.12 with default log driver.
 		// We should rewrite it to use the daemon defaults.
@@ -198,7 +216,7 @@ func (daemon *Daemon) restore() error {
 		go func(c *container.Container) {
 			defer wg.Done()
 			daemon.backportMountSpec(c)
-			if err := c.ToDiskLocking(); err != nil {
+			if err := daemon.checkpointAndSave(c); err != nil {
 				logrus.WithError(err).WithField("container", c.ID).Error("error saving backported mountspec to disk")
 			}
 
@@ -257,6 +275,7 @@ func (daemon *Daemon) restore() error {
 				}
 			}
 
+			c.Lock()
 			if c.RemovalInProgress {
 				// We probably crashed in the middle of a removal, reset
 				// the flag.
@@ -267,10 +286,13 @@ func (daemon *Daemon) restore() error {
 				// be removed. So we put the container in the "dead"
 				// state and leave further processing up to them.
 				logrus.Debugf("Resetting RemovalInProgress flag from %v", c.ID)
-				c.ResetRemovalInProgress()
-				c.SetDead()
-				c.ToDisk()
+				c.RemovalInProgress = false
+				c.Dead = true
+				if err := c.CheckpointTo(daemon.containersReplica); err != nil {
+					logrus.Errorf("Failed to update container %s state: %v", c.ID, err)
+				}
 			}
+			c.Unlock()
 		}(c)
 	}
 	wg.Wait()
@@ -513,31 +535,30 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe
 		return nil, err
 	}
 
-	uidMaps, gidMaps, err := setupRemappedRoot(config)
+	idMappings, err := setupRemappedRoot(config)
 	if err != nil {
 		return nil, err
 	}
-	rootUID, rootGID, err := idtools.GetRootUIDGID(uidMaps, gidMaps)
-	if err != nil {
-		return nil, err
-	}
-
+	rootIDs := idMappings.RootPair()
 	if err := setupDaemonProcess(config); err != nil {
 		return nil, err
 	}
 
 	// set up the tmpDir to use a canonical path
-	tmp, err := prepareTempDir(config.Root, rootUID, rootGID)
+	tmp, err := prepareTempDir(config.Root, rootIDs)
 	if err != nil {
 		return nil, fmt.Errorf("Unable to get the TempDir under %s: %s", config.Root, err)
 	}
-	realTmp, err := fileutils.ReadSymlinkedDirectory(tmp)
+	realTmp, err := getRealPath(tmp)
 	if err != nil {
 		return nil, fmt.Errorf("Unable to get the full path to the TempDir (%s): %s", tmp, err)
 	}
 	os.Setenv("TMPDIR", realTmp)
 
-	d := &Daemon{configStore: config}
+	d := &Daemon{
+		configStore: config,
+		startupDone: make(chan struct{}),
+	}
 	// Ensure the daemon is properly shutdown if there is a failure during
 	// initialization
 	defer func() {
@@ -576,19 +597,34 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe
 	}
 
 	daemonRepo := filepath.Join(config.Root, "containers")
-	if err := idtools.MkdirAllAs(daemonRepo, 0700, rootUID, rootGID); err != nil && !os.IsExist(err) {
+	if err := idtools.MkdirAllAndChown(daemonRepo, 0700, rootIDs); err != nil && !os.IsExist(err) {
 		return nil, err
 	}
 
 	if runtime.GOOS == "windows" {
-		if err := system.MkdirAll(filepath.Join(config.Root, "credentialspecs"), 0); err != nil && !os.IsExist(err) {
+		if err := system.MkdirAll(filepath.Join(config.Root, "credentialspecs"), 0, ""); err != nil && !os.IsExist(err) {
 			return nil, err
 		}
 	}
 
-	driverName := os.Getenv("DOCKER_DRIVER")
-	if driverName == "" {
-		driverName = config.GraphDriver
+	// On Windows we don't support the environment variable, or a user supplied graphdriver
+	// as Windows has no choice in terms of which graphdrivers to use. It's a case of
+	// running Windows containers on Windows - windowsfilter, running Linux containers on Windows,
+	// lcow. Unix platforms however run a single graphdriver for all containers, and it can
+	// be set through an environment variable, a daemon start parameter, or chosen through
+	// initialization of the layerstore through driver priority order for example.
+	d.stores = make(map[string]daemonStore)
+	if runtime.GOOS == "windows" {
+		d.stores["windows"] = daemonStore{graphDriver: "windowsfilter"}
+		if system.LCOWSupported() {
+			d.stores["linux"] = daemonStore{graphDriver: "lcow"}
+		}
+	} else {
+		driverName := os.Getenv("DOCKER_DRIVER")
+		if driverName == "" {
+			driverName = config.GraphDriver
+		}
+		d.stores[runtime.GOOS] = daemonStore{graphDriver: driverName} // May still be empty. Layerstore init determines instead.
 	}
 
 	d.RegistryService = registryService
@@ -616,45 +652,60 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe
 		return nil, errors.Wrap(err, "couldn't create plugin manager")
 	}
 
-	d.layerStore, err = layer.NewStoreFromOptions(layer.StoreOptions{
-		StorePath:                 config.Root,
-		MetadataStorePathTemplate: filepath.Join(config.Root, "image", "%s", "layerdb"),
-		GraphDriver:               driverName,
-		GraphDriverOptions:        config.GraphOptions,
-		UIDMaps:                   uidMaps,
-		GIDMaps:                   gidMaps,
-		PluginGetter:              d.PluginStore,
-		ExperimentalEnabled:       config.Experimental,
-	})
-	if err != nil {
-		return nil, err
+	var graphDrivers []string
+	for platform, ds := range d.stores {
+		ls, err := layer.NewStoreFromOptions(layer.StoreOptions{
+			StorePath:                 config.Root,
+			MetadataStorePathTemplate: filepath.Join(config.Root, "image", "%s", "layerdb"),
+			GraphDriver:               ds.graphDriver,
+			GraphDriverOptions:        config.GraphOptions,
+			IDMappings:                idMappings,
+			PluginGetter:              d.PluginStore,
+			ExperimentalEnabled:       config.Experimental,
+			Platform:                  platform,
+		})
+		if err != nil {
+			return nil, err
+		}
+		ds.graphDriver = ls.DriverName() // As layerstore may set the driver
+		ds.layerStore = ls
+		d.stores[platform] = ds
+		graphDrivers = append(graphDrivers, ls.DriverName())
 	}
 
-	graphDriver := d.layerStore.DriverName()
-	imageRoot := filepath.Join(config.Root, "image", graphDriver)
-
 	// Configure and validate the kernels security support
-	if err := configureKernelSecuritySupport(config, graphDriver); err != nil {
+	if err := configureKernelSecuritySupport(config, graphDrivers); err != nil {
 		return nil, err
 	}
 
 	logrus.Debugf("Max Concurrent Downloads: %d", *config.MaxConcurrentDownloads)
-	d.downloadManager = xfer.NewLayerDownloadManager(d.layerStore, *config.MaxConcurrentDownloads)
+	lsMap := make(map[string]layer.Store)
+	for platform, ds := range d.stores {
+		lsMap[platform] = ds.layerStore
+	}
+	d.downloadManager = xfer.NewLayerDownloadManager(lsMap, *config.MaxConcurrentDownloads)
 	logrus.Debugf("Max Concurrent Uploads: %d", *config.MaxConcurrentUploads)
 	d.uploadManager = xfer.NewLayerUploadManager(*config.MaxConcurrentUploads)
 
-	ifs, err := image.NewFSStoreBackend(filepath.Join(imageRoot, "imagedb"))
-	if err != nil {
-		return nil, err
-	}
+	for platform, ds := range d.stores {
+		imageRoot := filepath.Join(config.Root, "image", ds.graphDriver)
+		ifs, err := image.NewFSStoreBackend(filepath.Join(imageRoot, "imagedb"))
+		if err != nil {
+			return nil, err
+		}
 
-	d.imageStore, err = image.NewImageStore(ifs, d.layerStore)
-	if err != nil {
-		return nil, err
+		var is image.Store
+		is, err = image.NewImageStore(ifs, platform, ds.layerStore)
+		if err != nil {
+			return nil, err
+		}
+		ds.imageRoot = imageRoot
+		ds.imageStore = is
+		d.stores[platform] = ds
 	}
 
 	// Configure the volumes driver
-	volStore, err := d.configureVolumes(rootUID, rootGID)
+	volStore, err := d.configureVolumes(rootIDs)
 	if err != nil {
 		return nil, err
 	}
@@ -666,27 +717,35 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe
 
 	trustDir := filepath.Join(config.Root, "trust")
 
-	if err := system.MkdirAll(trustDir, 0700); err != nil {
-		return nil, err
-	}
-
-	distributionMetadataStore, err := dmetadata.NewFSMetadataStore(filepath.Join(imageRoot, "distribution"))
-	if err != nil {
+	if err := system.MkdirAll(trustDir, 0700, ""); err != nil {
 		return nil, err
 	}
 
 	eventsService := events.New()
 
-	referenceStore, err := refstore.NewReferenceStore(filepath.Join(imageRoot, "repositories.json"))
-	if err != nil {
-		return nil, fmt.Errorf("Couldn't create Tag store repositories: %s", err)
-	}
+	for platform, ds := range d.stores {
+		dms, err := dmetadata.NewFSMetadataStore(filepath.Join(ds.imageRoot, "distribution"), platform)
+		if err != nil {
+			return nil, err
+		}
 
-	migrationStart := time.Now()
-	if err := v1.Migrate(config.Root, graphDriver, d.layerStore, d.imageStore, referenceStore, distributionMetadataStore); err != nil {
-		logrus.Errorf("Graph migration failed: %q. Your old graph data was found to be too inconsistent for upgrading to content-addressable storage. Some of the old data was probably not upgraded. We recommend starting over with a clean storage directory if possible.", err)
+		rs, err := refstore.NewReferenceStore(filepath.Join(ds.imageRoot, "repositories.json"), platform)
+		if err != nil {
+			return nil, fmt.Errorf("Couldn't create Tag store repositories: %s", err)
+		}
+		ds.distributionMetadataStore = dms
+		ds.referenceStore = rs
+		d.stores[platform] = ds
+
+		// No content-addressability migration on Windows as it never supported pre-CA
+		if runtime.GOOS != "windows" {
+			migrationStart := time.Now()
+			if err := v1.Migrate(config.Root, ds.graphDriver, ds.layerStore, ds.imageStore, rs, dms); err != nil {
+				logrus.Errorf("Graph migration failed: %q. Your old graph data was found to be too inconsistent for upgrading to content-addressable storage. Some of the old data was probably not upgraded. We recommend starting over with a clean storage directory if possible.", err)
+			}
+			logrus.Infof("Graph migration to content-addressability took %.2f seconds", time.Since(migrationStart).Seconds())
+		}
 	}
-	logrus.Infof("Graph migration to content-addressability took %.2f seconds", time.Since(migrationStart).Seconds())
 
 	// Discovery is only enabled when the daemon is launched with an address to advertise.  When
 	// initialized, the daemon is registered and we can store the discovery backend as it's read-only
@@ -704,9 +763,10 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe
 	d.ID = trustKey.PublicKey().KeyID()
 	d.repository = daemonRepo
 	d.containers = container.NewMemoryStore()
+	if d.containersReplica, err = container.NewViewDB(); err != nil {
+		return nil, err
+	}
 	d.execCommands = exec.NewStore()
-	d.referenceStore = referenceStore
-	d.distributionMetadataStore = distributionMetadataStore
 	d.trustKey = trustKey
 	d.idIndex = truncindex.NewTruncIndex([]string{})
 	d.statsCollector = d.newStatsCollector(1 * time.Second)
@@ -717,8 +777,7 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe
 	d.EventsService = eventsService
 	d.volumes = volStore
 	d.root = config.Root
-	d.uidMaps = uidMaps
-	d.gidMaps = gidMaps
+	d.idMappings = idMappings
 	d.seccompEnabled = sysInfo.Seccomp
 	d.apparmorEnabled = sysInfo.AppArmor
 
@@ -736,6 +795,7 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe
 	if err := d.restore(); err != nil {
 		return nil, err
 	}
+	close(d.startupDone)
 
 	// FIXME: this method never returns an error
 	info, _ := d.SystemInfo()
@@ -753,9 +813,29 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe
 	engineCpus.Set(float64(info.NCPU))
 	engineMemory.Set(float64(info.MemTotal))
 
+	gd := ""
+	for platform, ds := range d.stores {
+		if len(gd) > 0 {
+			gd += ", "
+		}
+		gd += ds.graphDriver
+		if len(d.stores) > 1 {
+			gd = fmt.Sprintf("%s (%s)", gd, platform)
+		}
+	}
+	logrus.WithFields(logrus.Fields{
+		"version":        dockerversion.Version,
+		"commit":         dockerversion.GitCommit,
+		"graphdriver(s)": gd,
+	}).Info("Docker daemon")
+
 	return d, nil
 }
 
+func (daemon *Daemon) waitForStartupDone() {
+	<-daemon.startupDone
+}
+
 func (daemon *Daemon) shutdownContainer(c *container.Container) error {
 	stopTimeout := c.StopTimeout()
 	// TODO(windows): Handle docker restart with paused containers
@@ -855,7 +935,7 @@ func (daemon *Daemon) Shutdown() error {
 				logrus.Errorf("Stop container error: %v", err)
 				return
 			}
-			if mountid, err := daemon.layerStore.GetMountID(c.ID); err == nil {
+			if mountid, err := daemon.stores[c.Platform].layerStore.GetMountID(c.ID); err == nil {
 				daemon.cleanupMountsByID(mountid)
 			}
 			logrus.Debugf("container stopped %s", c.ID)
@@ -868,9 +948,11 @@ func (daemon *Daemon) Shutdown() error {
 		}
 	}
 
-	if daemon.layerStore != nil {
-		if err := daemon.layerStore.Cleanup(); err != nil {
-			logrus.Errorf("Error during layer Store.Cleanup(): %v", err)
+	for platform, ds := range daemon.stores {
+		if ds.layerStore != nil {
+			if err := ds.layerStore.Cleanup(); err != nil {
+				logrus.Errorf("Error during layer Store.Cleanup(): %v %s", err, platform)
+			}
 		}
 	}
 
@@ -913,7 +995,7 @@ func (daemon *Daemon) Mount(container *container.Container) error {
 		if container.BaseFS != "" && runtime.GOOS != "windows" {
 			daemon.Unmount(container)
 			return fmt.Errorf("Error: driver %s is returning inconsistent paths for container %s ('%s' then '%s')",
-				daemon.GraphDriverName(), container.ID, container.BaseFS, dir)
+				daemon.GraphDriverName(container.Platform), container.ID, container.BaseFS, dir)
 		}
 	}
 	container.BaseFS = dir // TODO: combine these fields
@@ -955,29 +1037,14 @@ func (daemon *Daemon) Subnets() ([]net.IPNet, []net.IPNet) {
 }
 
 // GraphDriverName returns the name of the graph driver used by the layer.Store
-func (daemon *Daemon) GraphDriverName() string {
-	return daemon.layerStore.DriverName()
-}
-
-// GetUIDGIDMaps returns the current daemon's user namespace settings
-// for the full uid and gid maps which will be applied to containers
-// started in this instance.
-func (daemon *Daemon) GetUIDGIDMaps() ([]idtools.IDMap, []idtools.IDMap) {
-	return daemon.uidMaps, daemon.gidMaps
-}
-
-// GetRemappedUIDGID returns the current daemon's uid and gid values
-// if user namespaces are in use for this daemon instance.  If not
-// this function will return "real" root values of 0, 0.
-func (daemon *Daemon) GetRemappedUIDGID() (int, int) {
-	uid, gid, _ := idtools.GetRootUIDGID(daemon.uidMaps, daemon.gidMaps)
-	return uid, gid
+func (daemon *Daemon) GraphDriverName(platform string) string {
+	return daemon.stores[platform].layerStore.DriverName()
 }
 
 // prepareTempDir prepares and returns the default directory to use
 // for temporary files.
 // If it doesn't exist, it is created. If it exists, its content is removed.
-func prepareTempDir(rootDir string, rootUID, rootGID int) (string, error) {
+func prepareTempDir(rootDir string, rootIDs idtools.IDPair) (string, error) {
 	var tmpDir string
 	if tmpDir = os.Getenv("DOCKER_TMPDIR"); tmpDir == "" {
 		tmpDir = filepath.Join(rootDir, "tmp")
@@ -997,12 +1064,12 @@ func prepareTempDir(rootDir string, rootUID, rootGID int) (string, error) {
 	}
 	// We don't remove the content of tmpdir if it's not the default,
 	// it may hold things that do not belong to us.
-	return tmpDir, idtools.MkdirAllAs(tmpDir, 0700, rootUID, rootGID)
+	return tmpDir, idtools.MkdirAllAndChown(tmpDir, 0700, rootIDs)
 }
 
 func (daemon *Daemon) setupInitLayer(initPath string) error {
-	rootUID, rootGID := daemon.GetRemappedUIDGID()
-	return initlayer.Setup(initPath, rootUID, rootGID)
+	rootIDs := daemon.idMappings.RootPair()
+	return initlayer.Setup(initPath, rootIDs)
 }
 
 func setDefaultMtu(conf *config.Config) {
@@ -1013,8 +1080,8 @@ func setDefaultMtu(conf *config.Config) {
 	conf.Mtu = config.DefaultNetworkMtu
 }
 
-func (daemon *Daemon) configureVolumes(rootUID, rootGID int) (*store.VolumeStore, error) {
-	volumesDriver, err := local.New(daemon.configStore.Root, rootUID, rootGID)
+func (daemon *Daemon) configureVolumes(rootIDs idtools.IDPair) (*store.VolumeStore, error) {
+	volumesDriver, err := local.New(daemon.configStore.Root, rootIDs)
 	if err != nil {
 		return nil, err
 	}
@@ -1154,24 +1221,25 @@ func CreateDaemonRoot(config *config.Config) error {
 	if _, err := os.Stat(config.Root); err != nil && os.IsNotExist(err) {
 		realRoot = config.Root
 	} else {
-		realRoot, err = fileutils.ReadSymlinkedDirectory(config.Root)
+		realRoot, err = getRealPath(config.Root)
 		if err != nil {
 			return fmt.Errorf("Unable to get the full path to root (%s): %s", config.Root, err)
 		}
 	}
 
-	uidMaps, gidMaps, err := setupRemappedRoot(config)
-	if err != nil {
-		return err
-	}
-	rootUID, rootGID, err := idtools.GetRootUIDGID(uidMaps, gidMaps)
+	idMappings, err := setupRemappedRoot(config)
 	if err != nil {
 		return err
 	}
+	return setupDaemonRoot(config, realRoot, idMappings.RootPair())
+}
 
-	if err := setupDaemonRoot(config, realRoot, rootUID, rootGID); err != nil {
-		return err
+// checkpointAndSave grabs a container lock to safely call container.CheckpointTo
+func (daemon *Daemon) checkpointAndSave(container *container.Container) error {
+	container.Lock()
+	defer container.Unlock()
+	if err := container.CheckpointTo(daemon.containersReplica); err != nil {
+		return fmt.Errorf("Error saving container state: %v", err)
 	}
-
 	return nil
 }
diff --git a/components/engine/daemon/daemon_linux.go b/components/engine/daemon/daemon_linux.go
index 5faf533fde..000a048699 100644
--- a/components/engine/daemon/daemon_linux.go
+++ b/components/engine/daemon/daemon_linux.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"github.com/Sirupsen/logrus"
+	"github.com/docker/docker/pkg/fileutils"
 	"github.com/docker/docker/pkg/mount"
 )
 
@@ -86,3 +87,7 @@ func getCleanPatterns(id string) (regexps []*regexp.Regexp) {
 	}
 	return
 }
+
+func getRealPath(path string) (string, error) {
+	return fileutils.ReadSymlinkedDirectory(path)
+}
diff --git a/components/engine/daemon/daemon_solaris.go b/components/engine/daemon/daemon_solaris.go
index aacb416a88..7f2004e65a 100644
--- a/components/engine/daemon/daemon_solaris.go
+++ b/components/engine/daemon/daemon_solaris.go
@@ -13,6 +13,7 @@ import (
 	"github.com/docker/docker/container"
 	"github.com/docker/docker/image"
 	"github.com/docker/docker/layer"
+	"github.com/docker/docker/pkg/fileutils"
 	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/parsers/kernel"
 	"github.com/docker/docker/pkg/sysinfo"
@@ -352,7 +353,7 @@ func configureMaxThreads(config *Config) error {
 }
 
 // configureKernelSecuritySupport configures and validate security support for the kernel
-func configureKernelSecuritySupport(config *Config, driverName string) error {
+func configureKernelSecuritySupport(config *config.Config, driverNames []string) error {
 	return nil
 }
 
@@ -525,3 +526,7 @@ func setupDaemonProcess(config *Config) error {
 func (daemon *Daemon) setupSeccompProfile() error {
 	return nil
 }
+
+func getRealPath(path string) (string, error) {
+	return fileutils.ReadSymlinkedDirectory(path)
+}
diff --git a/components/engine/daemon/daemon_test.go b/components/engine/daemon/daemon_test.go
index eaa3be44d8..6f07d0d1ee 100644
--- a/components/engine/daemon/daemon_test.go
+++ b/components/engine/daemon/daemon_test.go
@@ -11,6 +11,7 @@ import (
 	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/container"
 	_ "github.com/docker/docker/pkg/discovery/memory"
+	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/registrar"
 	"github.com/docker/docker/pkg/truncindex"
 	"github.com/docker/docker/volume"
@@ -26,38 +27,28 @@ import (
 
 func TestGetContainer(t *testing.T) {
 	c1 := &container.Container{
-		CommonContainer: container.CommonContainer{
-			ID:   "5a4ff6a163ad4533d22d69a2b8960bf7fafdcba06e72d2febdba229008b0bf57",
-			Name: "tender_bardeen",
-		},
+		ID:   "5a4ff6a163ad4533d22d69a2b8960bf7fafdcba06e72d2febdba229008b0bf57",
+		Name: "tender_bardeen",
 	}
 
 	c2 := &container.Container{
-		CommonContainer: container.CommonContainer{
-			ID:   "3cdbd1aa394fd68559fd1441d6eff2ab7c1e6363582c82febfaa8045df3bd8de",
-			Name: "drunk_hawking",
-		},
+		ID:   "3cdbd1aa394fd68559fd1441d6eff2ab7c1e6363582c82febfaa8045df3bd8de",
+		Name: "drunk_hawking",
 	}
 
 	c3 := &container.Container{
-		CommonContainer: container.CommonContainer{
-			ID:   "3cdbd1aa394fd68559fd1441d6eff2abfafdcba06e72d2febdba229008b0bf57",
-			Name: "3cdbd1aa",
-		},
+		ID:   "3cdbd1aa394fd68559fd1441d6eff2abfafdcba06e72d2febdba229008b0bf57",
+		Name: "3cdbd1aa",
 	}
 
 	c4 := &container.Container{
-		CommonContainer: container.CommonContainer{
-			ID:   "75fb0b800922abdbef2d27e60abcdfaf7fb0698b2a96d22d3354da361a6ff4a5",
-			Name: "5a4ff6a163ad4533d22d69a2b8960bf7fafdcba06e72d2febdba229008b0bf57",
-		},
+		ID:   "75fb0b800922abdbef2d27e60abcdfaf7fb0698b2a96d22d3354da361a6ff4a5",
+		Name: "5a4ff6a163ad4533d22d69a2b8960bf7fafdcba06e72d2febdba229008b0bf57",
 	}
 
 	c5 := &container.Container{
-		CommonContainer: container.CommonContainer{
-			ID:   "d22d69a2b8960bf7fafdcba06e72d2febdba960bf7fafdcba06e72d2f9008b060b",
-			Name: "d22d69a2b896",
-		},
+		ID:   "d22d69a2b8960bf7fafdcba06e72d2febdba960bf7fafdcba06e72d2f9008b060b",
+		Name: "d22d69a2b896",
 	}
 
 	store := container.NewMemoryStore()
@@ -127,7 +118,7 @@ func initDaemonWithVolumeStore(tmp string) (*Daemon, error) {
 		return nil, err
 	}
 
-	volumesDriver, err := local.New(tmp, 0, 0)
+	volumesDriver, err := local.New(tmp, idtools.IDPair{UID: 0, GID: 0})
 	if err != nil {
 		return nil, err
 	}
@@ -183,7 +174,7 @@ func TestContainerInitDNS(t *testing.T) {
 "UpdateDns":false,"Volumes":{},"VolumesRW":{},"AppliedVolumesFrom":null}`
 
 	// Container struct only used to retrieve path to config file
-	container := &container.Container{CommonContainer: container.CommonContainer{Root: containerPath}}
+	container := &container.Container{Root: containerPath}
 	configPath, err := container.ConfigPath()
 	if err != nil {
 		t.Fatal(err)
diff --git a/components/engine/daemon/daemon_unix.go b/components/engine/daemon/daemon_unix.go
index 031cdc4a8b..0778dde4f7 100644
--- a/components/engine/daemon/daemon_unix.go
+++ b/components/engine/daemon/daemon_unix.go
@@ -702,14 +702,22 @@ func overlaySupportsSelinux() (bool, error) {
 }
 
 // configureKernelSecuritySupport configures and validates security support for the kernel
-func configureKernelSecuritySupport(config *config.Config, driverName string) error {
+func configureKernelSecuritySupport(config *config.Config, driverNames []string) error {
 	if config.EnableSelinuxSupport {
 		if !selinuxEnabled() {
 			logrus.Warn("Docker could not enable SELinux on the host system")
 			return nil
 		}
 
-		if driverName == "overlay" || driverName == "overlay2" {
+		overlayFound := false
+		for _, d := range driverNames {
+			if d == "overlay" || d == "overlay2" {
+				overlayFound = true
+				break
+			}
+		}
+
+		if overlayFound {
 			// If driver is overlay or overlay2, make sure kernel
 			// supports selinux with overlay.
 			supported, err := overlaySupportsSelinux()
@@ -718,7 +726,7 @@ func configureKernelSecuritySupport(config *config.Config, driverName string) er
 			}
 
 			if !supported {
-				logrus.Warnf("SELinux is not supported with the %s graph driver on this kernel", driverName)
+				logrus.Warnf("SELinux is not supported with the %v graph driver on this kernel", driverNames)
 			}
 		}
 	} else {
@@ -1026,40 +1034,38 @@ func parseRemappedRoot(usergrp string) (string, string, error) {
 	return username, groupname, nil
 }
 
-func setupRemappedRoot(config *config.Config) ([]idtools.IDMap, []idtools.IDMap, error) {
+func setupRemappedRoot(config *config.Config) (*idtools.IDMappings, error) {
 	if runtime.GOOS != "linux" && config.RemappedRoot != "" {
-		return nil, nil, fmt.Errorf("User namespaces are only supported on Linux")
+		return nil, fmt.Errorf("User namespaces are only supported on Linux")
 	}
 
 	// if the daemon was started with remapped root option, parse
 	// the config option to the int uid,gid values
-	var (
-		uidMaps, gidMaps []idtools.IDMap
-	)
 	if config.RemappedRoot != "" {
 		username, groupname, err := parseRemappedRoot(config.RemappedRoot)
 		if err != nil {
-			return nil, nil, err
+			return nil, err
 		}
 		if username == "root" {
 			// Cannot setup user namespaces with a 1-to-1 mapping; "--root=0:0" is a no-op
 			// effectively
 			logrus.Warn("User namespaces: root cannot be remapped with itself; user namespaces are OFF")
-			return uidMaps, gidMaps, nil
+			return &idtools.IDMappings{}, nil
 		}
 		logrus.Infof("User namespaces: ID ranges will be mapped to subuid/subgid ranges of: %s:%s", username, groupname)
 		// update remapped root setting now that we have resolved them to actual names
 		config.RemappedRoot = fmt.Sprintf("%s:%s", username, groupname)
 
-		uidMaps, gidMaps, err = idtools.CreateIDMappings(username, groupname)
+		mappings, err := idtools.NewIDMappings(username, groupname)
 		if err != nil {
-			return nil, nil, fmt.Errorf("Can't create ID mappings: %v", err)
+			return nil, errors.Wrapf(err, "Can't create ID mappings: %v")
 		}
+		return mappings, nil
 	}
-	return uidMaps, gidMaps, nil
+	return &idtools.IDMappings{}, nil
 }
 
-func setupDaemonRoot(config *config.Config, rootDir string, rootUID, rootGID int) error {
+func setupDaemonRoot(config *config.Config, rootDir string, rootIDs idtools.IDPair) error {
 	config.Root = rootDir
 	// the docker root metadata directory needs to have execute permissions for all users (g+x,o+x)
 	// so that syscalls executing as non-root, operating on subdirectories of the graph root
@@ -1084,10 +1090,10 @@ func setupDaemonRoot(config *config.Config, rootDir string, rootUID, rootGID int
 	// a new subdirectory with ownership set to the remapped uid/gid (so as to allow
 	// `chdir()` to work for containers namespaced to that uid/gid)
 	if config.RemappedRoot != "" {
-		config.Root = filepath.Join(rootDir, fmt.Sprintf("%d.%d", rootUID, rootGID))
+		config.Root = filepath.Join(rootDir, fmt.Sprintf("%d.%d", rootIDs.UID, rootIDs.GID))
 		logrus.Debugf("Creating user namespaced daemon root: %s", config.Root)
 		// Create the root directory if it doesn't exist
-		if err := idtools.MkdirAllAs(config.Root, 0700, rootUID, rootGID); err != nil {
+		if err := idtools.MkdirAllAndChown(config.Root, 0700, rootIDs); err != nil {
 			return fmt.Errorf("Cannot create daemon root: %s: %v", config.Root, err)
 		}
 		// we also need to verify that any pre-existing directories in the path to
@@ -1100,7 +1106,7 @@ func setupDaemonRoot(config *config.Config, rootDir string, rootUID, rootGID int
 			if dirPath == "/" {
 				break
 			}
-			if !idtools.CanAccess(dirPath, rootUID, rootGID) {
+			if !idtools.CanAccess(dirPath, rootIDs) {
 				return fmt.Errorf("A subdirectory in your graphroot path (%s) restricts access to the remapped root uid/gid; please fix by allowing 'o+x' permissions on existing directories.", config.Root)
 			}
 		}
@@ -1140,7 +1146,8 @@ func (daemon *Daemon) registerLinks(container *container.Container, hostConfig *
 
 	// After we load all the links into the daemon
 	// set them to nil on the hostconfig
-	return container.WriteHostConfig()
+	_, err := container.WriteHostConfig()
+	return err
 }
 
 // conditionalMountOnStart is a platform specific helper function during the
diff --git a/components/engine/daemon/daemon_unix_test.go b/components/engine/daemon/daemon_unix_test.go
index e8afe629e0..c3aa443e45 100644
--- a/components/engine/daemon/daemon_unix_test.go
+++ b/components/engine/daemon/daemon_unix_test.go
@@ -11,6 +11,7 @@ import (
 	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/container"
 	"github.com/docker/docker/daemon/config"
+	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/volume"
 	"github.com/docker/docker/volume/drivers"
 	"github.com/docker/docker/volume/local"
@@ -277,13 +278,17 @@ func TestMigratePre17Volumes(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	drv, err := local.New(volumeRoot, 0, 0)
+	drv, err := local.New(volumeRoot, idtools.IDPair{UID: 0, GID: 0})
 	if err != nil {
 		t.Fatal(err)
 	}
 	volumedrivers.Register(drv, volume.DefaultDriverName)
 
-	daemon := &Daemon{root: rootDir, repository: containerRoot, volumes: volStore}
+	daemon := &Daemon{
+		root:       rootDir,
+		repository: containerRoot,
+		volumes:    volStore,
+	}
 	err = ioutil.WriteFile(filepath.Join(containerRoot, cid, "config.v2.json"), config, 600)
 	if err != nil {
 		t.Fatal(err)
diff --git a/components/engine/daemon/daemon_windows.go b/components/engine/daemon/daemon_windows.go
index efe1b1f6a0..c77f32a5ef 100644
--- a/components/engine/daemon/daemon_windows.go
+++ b/components/engine/daemon/daemon_windows.go
@@ -14,6 +14,7 @@ import (
 	"github.com/docker/docker/container"
 	"github.com/docker/docker/daemon/config"
 	"github.com/docker/docker/image"
+	"github.com/docker/docker/pkg/fileutils"
 	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/parsers"
 	"github.com/docker/docker/pkg/platform"
@@ -217,7 +218,7 @@ func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *containertypes.
 	warnings := []string{}
 
 	hyperv := daemon.runAsHyperVContainer(hostConfig)
-	if !hyperv && system.IsWindowsClient() {
+	if !hyperv && system.IsWindowsClient() && !system.IsIoTCore() {
 		// @engine maintainers. This block should not be removed. It partially enforces licensing
 		// restrictions on Windows. Ping @jhowardmsft if there are concerns or PRs to change this.
 		return warnings, fmt.Errorf("Windows client operating systems only support Hyper-V containers")
@@ -259,7 +260,7 @@ func checkSystem() error {
 }
 
 // configureKernelSecuritySupport configures and validate security support for the kernel
-func configureKernelSecuritySupport(config *config.Config, driverName string) error {
+func configureKernelSecuritySupport(config *config.Config, driverNames []string) error {
 	return nil
 }
 
@@ -327,6 +328,9 @@ func (daemon *Daemon) initNetworkController(config *config.Config, activeSandbox
 	// discover and add HNS networks to windows
 	// network that exist are removed and added again
 	for _, v := range hnsresponse {
+		if strings.ToLower(v.Type) == "private" {
+			continue // workaround for HNS reporting unsupported networks
+		}
 		var n libnetwork.Network
 		s := func(current libnetwork.Network) bool {
 			options := current.Info().DriverOptions()
@@ -454,14 +458,14 @@ func (daemon *Daemon) cleanupMounts() error {
 	return nil
 }
 
-func setupRemappedRoot(config *config.Config) ([]idtools.IDMap, []idtools.IDMap, error) {
-	return nil, nil, nil
+func setupRemappedRoot(config *config.Config) (*idtools.IDMappings, error) {
+	return &idtools.IDMappings{}, nil
 }
 
-func setupDaemonRoot(config *config.Config, rootDir string, rootUID, rootGID int) error {
+func setupDaemonRoot(config *config.Config, rootDir string, rootIDs idtools.IDPair) error {
 	config.Root = rootDir
 	// Create the root directory if it doesn't exists
-	if err := system.MkdirAllWithACL(config.Root, 0); err != nil && !os.IsExist(err) {
+	if err := system.MkdirAllWithACL(config.Root, 0, system.SddlAdministratorsLocalSystem); err != nil && !os.IsExist(err) {
 		return err
 	}
 	return nil
@@ -482,6 +486,11 @@ func (daemon *Daemon) runAsHyperVContainer(hostConfig *containertypes.HostConfig
 // conditionalMountOnStart is a platform specific helper function during the
 // container start to call mount.
 func (daemon *Daemon) conditionalMountOnStart(container *container.Container) error {
+	// Bail out now for Linux containers
+	if system.LCOWSupported() && container.Platform != "windows" {
+		return nil
+	}
+
 	// We do not mount if a Hyper-V container
 	if !daemon.runAsHyperVContainer(container.HostConfig) {
 		return daemon.Mount(container)
@@ -492,6 +501,11 @@ func (daemon *Daemon) conditionalMountOnStart(container *container.Container) er
 // conditionalUnmountOnCleanup is a platform specific helper function called
 // during the cleanup of a container to unmount.
 func (daemon *Daemon) conditionalUnmountOnCleanup(container *container.Container) error {
+	// Bail out now for Linux containers
+	if system.LCOWSupported() && container.Platform != "windows" {
+		return nil
+	}
+
 	// We do not unmount if a Hyper-V container
 	if !daemon.runAsHyperVContainer(container.HostConfig) {
 		return daemon.Unmount(container)
@@ -566,8 +580,9 @@ func (daemon *Daemon) stats(c *container.Container) (*types.StatsJSON, error) {
 // daemon to run in. This is only applicable on Windows
 func (daemon *Daemon) setDefaultIsolation() error {
 	daemon.defaultIsolation = containertypes.Isolation("process")
-	// On client SKUs, default to Hyper-V
-	if system.IsWindowsClient() {
+	// On client SKUs, default to Hyper-V. Note that IoT reports as a client SKU
+	// but it should not be treated as such.
+	if system.IsWindowsClient() && !system.IsIoTCore() {
 		daemon.defaultIsolation = containertypes.Isolation("hyperv")
 	}
 	for _, option := range daemon.configStore.ExecOptions {
@@ -586,7 +601,7 @@ func (daemon *Daemon) setDefaultIsolation() error {
 				daemon.defaultIsolation = containertypes.Isolation("hyperv")
 			}
 			if containertypes.Isolation(val).IsProcess() {
-				if system.IsWindowsClient() {
+				if system.IsWindowsClient() && !system.IsIoTCore() {
 					// @engine maintainers. This block should not be removed. It partially enforces licensing
 					// restrictions on Windows. Ping @jhowardmsft if there are concerns or PRs to change this.
 					return fmt.Errorf("Windows client operating systems only support Hyper-V containers")
@@ -627,3 +642,13 @@ func (daemon *Daemon) verifyVolumesInfo(container *container.Container) error {
 func (daemon *Daemon) setupSeccompProfile() error {
 	return nil
 }
+
+func getRealPath(path string) (string, error) {
+	if system.IsIoTCore() {
+		// Due to https://github.com/golang/go/issues/20506, path expansion
+		// does not work correctly on the default IoT Core configuration.
+		// TODO @darrenstahlmsft remove this once golang/go/20506 is fixed
+		return path, nil
+	}
+	return fileutils.ReadSymlinkedDirectory(path)
+}
diff --git a/components/engine/daemon/debugtrap.go b/components/engine/daemon/debugtrap.go
deleted file mode 100644
index 209048b589..0000000000
--- a/components/engine/daemon/debugtrap.go
+++ /dev/null
@@ -1,62 +0,0 @@
-package daemon
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"github.com/davecgh/go-spew/spew"
-	"github.com/pkg/errors"
-)
-
-const dataStructuresLogNameTemplate = "daemon-data-%s.log"
-
-// dumpDaemon appends the daemon datastructures into file in dir and returns full path
-// to that file.
-func (d *Daemon) dumpDaemon(dir string) (string, error) {
-	// Ensure we recover from a panic as we are doing this without any locking
-	defer func() {
-		recover()
-	}()
-
-	path := filepath.Join(dir, fmt.Sprintf(dataStructuresLogNameTemplate, strings.Replace(time.Now().Format(time.RFC3339), ":", "", -1)))
-	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, 0666)
-	if err != nil {
-		return "", errors.Wrap(err, "failed to open file to write the daemon datastructure dump")
-	}
-	defer f.Close()
-
-	dump := struct {
-		containers      interface{}
-		names           interface{}
-		links           interface{}
-		execs           interface{}
-		volumes         interface{}
-		images          interface{}
-		layers          interface{}
-		imageReferences interface{}
-		downloads       interface{}
-		uploads         interface{}
-		registry        interface{}
-		plugins         interface{}
-	}{
-		containers:      d.containers,
-		execs:           d.execCommands,
-		volumes:         d.volumes,
-		images:          d.imageStore,
-		layers:          d.layerStore,
-		imageReferences: d.referenceStore,
-		downloads:       d.downloadManager,
-		uploads:         d.uploadManager,
-		registry:        d.RegistryService,
-		plugins:         d.PluginStore,
-		names:           d.nameIndex,
-		links:           d.linkIndex,
-	}
-
-	spew.Fdump(f, dump) // Does not return an error
-	f.Sync()
-	return path, nil
-}
diff --git a/components/engine/daemon/debugtrap_unix.go b/components/engine/daemon/debugtrap_unix.go
index d650eb7f8c..8605d1d2b5 100644
--- a/components/engine/daemon/debugtrap_unix.go
+++ b/components/engine/daemon/debugtrap_unix.go
@@ -22,12 +22,6 @@ func (d *Daemon) setupDumpStackTrap(root string) {
 			} else {
 				logrus.Infof("goroutine stacks written to %s", path)
 			}
-			path, err = d.dumpDaemon(root)
-			if err != nil {
-				logrus.WithError(err).Error("failed to write daemon datastructure dump")
-			} else {
-				logrus.Infof("daemon datastructure dump written to %s", path)
-			}
 		}
 	}()
 }
diff --git a/components/engine/daemon/debugtrap_windows.go b/components/engine/daemon/debugtrap_windows.go
index fb20c9d2c5..d01f7f332d 100644
--- a/components/engine/daemon/debugtrap_windows.go
+++ b/components/engine/daemon/debugtrap_windows.go
@@ -41,12 +41,6 @@ func (d *Daemon) setupDumpStackTrap(root string) {
 			} else {
 				logrus.Infof("goroutine stacks written to %s", path)
 			}
-			path, err = d.dumpDaemon(root)
-			if err != nil {
-				logrus.WithError(err).Error("failed to write daemon datastructure dump")
-			} else {
-				logrus.Infof("daemon datastructure dump written to %s", path)
-			}
 		}
 	}()
 }
diff --git a/components/engine/daemon/delete.go b/components/engine/daemon/delete.go
index af709445ce..2d3cd0f90f 100644
--- a/components/engine/daemon/delete.go
+++ b/components/engine/daemon/delete.go
@@ -103,22 +103,24 @@ func (daemon *Daemon) cleanupContainer(container *container.Container, forceRemo
 	}
 
 	// Mark container dead. We don't want anybody to be restarting it.
-	container.SetDead()
+	container.Lock()
+	container.Dead = true
 
 	// Save container state to disk. So that if error happens before
 	// container meta file got removed from disk, then a restart of
 	// docker should not make a dead container alive.
-	if err := container.ToDiskLocking(); err != nil && !os.IsNotExist(err) {
+	if err := container.CheckpointTo(daemon.containersReplica); err != nil && !os.IsNotExist(err) {
 		logrus.Errorf("Error saving dying container to disk: %v", err)
 	}
+	container.Unlock()
 
 	// When container creation fails and `RWLayer` has not been created yet, we
 	// do not call `ReleaseRWLayer`
 	if container.RWLayer != nil {
-		metadata, err := daemon.layerStore.ReleaseRWLayer(container.RWLayer)
+		metadata, err := daemon.stores[container.Platform].layerStore.ReleaseRWLayer(container.RWLayer)
 		layer.LogReleaseMetadata(metadata)
 		if err != nil && err != layer.ErrMountDoesNotExist {
-			return errors.Wrapf(err, "driver %q failed to remove root filesystem for %s", daemon.GraphDriverName(), container.ID)
+			return errors.Wrapf(err, "driver %q failed to remove root filesystem for %s", daemon.GraphDriverName(container.Platform), container.ID)
 		}
 	}
 
@@ -131,6 +133,7 @@ func (daemon *Daemon) cleanupContainer(container *container.Container, forceRemo
 	selinuxFreeLxcContexts(container.ProcessLabel)
 	daemon.idIndex.Delete(container.ID)
 	daemon.containers.Delete(container.ID)
+	daemon.containersReplica.Delete(container)
 	if e := daemon.removeMountPoints(container, removeVolume); e != nil {
 		logrus.Error(e)
 	}
diff --git a/components/engine/daemon/delete_test.go b/components/engine/daemon/delete_test.go
index 4664cd9869..f1a979003c 100644
--- a/components/engine/daemon/delete_test.go
+++ b/components/engine/daemon/delete_test.go
@@ -26,11 +26,9 @@ func newDaemonWithTmpRoot(t *testing.T) (*Daemon, func()) {
 
 func newContainerWithState(state *container.State) *container.Container {
 	return &container.Container{
-		CommonContainer: container.CommonContainer{
-			ID:     "test",
-			State:  state,
-			Config: &containertypes.Config{},
-		},
+		ID:     "test",
+		State:  state,
+		Config: &containertypes.Config{},
 	}
 
 }
diff --git a/components/engine/daemon/disk_usage.go b/components/engine/daemon/disk_usage.go
index 83de00ab2e..c64a243304 100644
--- a/components/engine/daemon/disk_usage.go
+++ b/components/engine/daemon/disk_usage.go
@@ -15,12 +15,12 @@ import (
 	"github.com/opencontainers/go-digest"
 )
 
-func (daemon *Daemon) getLayerRefs() map[layer.ChainID]int {
-	tmpImages := daemon.imageStore.Map()
+func (daemon *Daemon) getLayerRefs(platform string) map[layer.ChainID]int {
+	tmpImages := daemon.stores[platform].imageStore.Map()
 	layerRefs := map[layer.ChainID]int{}
 	for id, img := range tmpImages {
 		dgst := digest.Digest(id)
-		if len(daemon.referenceStore.References(dgst)) == 0 && len(daemon.imageStore.Children(id)) != 0 {
+		if len(daemon.stores[platform].referenceStore.References(dgst)) == 0 && len(daemon.stores[platform].imageStore.Children(id)) != 0 {
 			continue
 		}
 
@@ -53,6 +53,7 @@ func (daemon *Daemon) SystemDiskUsage(ctx context.Context) (*types.DiskUsage, er
 	}
 
 	// Get all top images with extra attributes
+	// TODO @jhowardmsft LCOW. This may need revisiting
 	allImages, err := daemon.Images(filters.NewArgs(), false, true)
 	if err != nil {
 		return nil, fmt.Errorf("failed to retrieve image list: %v", err)
@@ -65,6 +66,13 @@ func (daemon *Daemon) SystemDiskUsage(ctx context.Context) (*types.DiskUsage, er
 		case <-ctx.Done():
 			return ctx.Err()
 		default:
+			if d, ok := v.(volume.DetailedVolume); ok {
+				// skip local volumes with mount options since these could have external
+				// mounted filesystems that will be slow to enumerate.
+				if len(d.Options()) > 0 {
+					return nil
+				}
+			}
 			name := v.Name()
 			refs := daemon.volumes.Refs(v)
 
@@ -87,23 +95,26 @@ func (daemon *Daemon) SystemDiskUsage(ctx context.Context) (*types.DiskUsage, er
 	}
 
 	// Get total layers size on disk
-	layerRefs := daemon.getLayerRefs()
-	allLayers := daemon.layerStore.Map()
 	var allLayersSize int64
-	for _, l := range allLayers {
-		select {
-		case <-ctx.Done():
-			return nil, ctx.Err()
-		default:
-			size, err := l.DiffSize()
-			if err == nil {
-				if _, ok := layerRefs[l.ChainID()]; ok {
-					allLayersSize += size
+	for platform := range daemon.stores {
+		layerRefs := daemon.getLayerRefs(platform)
+		allLayers := daemon.stores[platform].layerStore.Map()
+		var allLayersSize int64
+		for _, l := range allLayers {
+			select {
+			case <-ctx.Done():
+				return nil, ctx.Err()
+			default:
+				size, err := l.DiffSize()
+				if err == nil {
+					if _, ok := layerRefs[l.ChainID()]; ok {
+						allLayersSize += size
+					} else {
+						logrus.Warnf("found leaked image layer %v platform %s", l.ChainID(), platform)
+					}
 				} else {
-					logrus.Warnf("found leaked image layer %v", l.ChainID())
+					logrus.Warnf("failed to get diff size for layer %v %s", l.ChainID(), platform)
 				}
-			} else {
-				logrus.Warnf("failed to get diff size for layer %v", l.ChainID())
 			}
 		}
 	}
diff --git a/components/engine/daemon/events_test.go b/components/engine/daemon/events_test.go
index aa78664b23..7048de2926 100644
--- a/components/engine/daemon/events_test.go
+++ b/components/engine/daemon/events_test.go
@@ -16,15 +16,13 @@ func TestLogContainerEventCopyLabels(t *testing.T) {
 	defer e.Evict(l)
 
 	container := &container.Container{
-		CommonContainer: container.CommonContainer{
-			ID:   "container_id",
-			Name: "container_name",
-			Config: &containertypes.Config{
-				Image: "image_name",
-				Labels: map[string]string{
-					"node": "1",
-					"os":   "alpine",
-				},
+		ID:   "container_id",
+		Name: "container_name",
+		Config: &containertypes.Config{
+			Image: "image_name",
+			Labels: map[string]string{
+				"node": "1",
+				"os":   "alpine",
 			},
 		},
 	}
@@ -49,14 +47,12 @@ func TestLogContainerEventWithAttributes(t *testing.T) {
 	defer e.Evict(l)
 
 	container := &container.Container{
-		CommonContainer: container.CommonContainer{
-			ID:   "container_id",
-			Name: "container_name",
-			Config: &containertypes.Config{
-				Labels: map[string]string{
-					"node": "1",
-					"os":   "alpine",
-				},
+		ID:   "container_id",
+		Name: "container_name",
+		Config: &containertypes.Config{
+			Labels: map[string]string{
+				"node": "1",
+				"os":   "alpine",
 			},
 		},
 	}
diff --git a/components/engine/daemon/export.go b/components/engine/daemon/export.go
index 5ef6dbb0e5..402e67583d 100644
--- a/components/engine/daemon/export.go
+++ b/components/engine/daemon/export.go
@@ -40,11 +40,10 @@ func (daemon *Daemon) containerExport(container *container.Container) (io.ReadCl
 		return nil, err
 	}
 
-	uidMaps, gidMaps := daemon.GetUIDGIDMaps()
 	archive, err := archive.TarWithOptions(container.BaseFS, &archive.TarOptions{
 		Compression: archive.Uncompressed,
-		UIDMaps:     uidMaps,
-		GIDMaps:     gidMaps,
+		UIDMaps:     daemon.idMappings.UIDs(),
+		GIDMaps:     daemon.idMappings.GIDs(),
 	})
 	if err != nil {
 		daemon.Unmount(container)
diff --git a/components/engine/daemon/getsize_unix.go b/components/engine/daemon/getsize_unix.go
index bd088fd41c..434fa4388a 100644
--- a/components/engine/daemon/getsize_unix.go
+++ b/components/engine/daemon/getsize_unix.go
@@ -3,6 +3,8 @@
 package daemon
 
 import (
+	"runtime"
+
 	"github.com/Sirupsen/logrus"
 )
 
@@ -13,17 +15,17 @@ func (daemon *Daemon) getSize(containerID string) (int64, int64) {
 		err                error
 	)
 
-	rwlayer, err := daemon.layerStore.GetRWLayer(containerID)
+	rwlayer, err := daemon.stores[runtime.GOOS].layerStore.GetRWLayer(containerID)
 	if err != nil {
 		logrus.Errorf("Failed to compute size of container rootfs %v: %v", containerID, err)
 		return sizeRw, sizeRootfs
 	}
-	defer daemon.layerStore.ReleaseRWLayer(rwlayer)
+	defer daemon.stores[runtime.GOOS].layerStore.ReleaseRWLayer(rwlayer)
 
 	sizeRw, err = rwlayer.Size()
 	if err != nil {
 		logrus.Errorf("Driver %s couldn't return diff size of container %s: %s",
-			daemon.GraphDriverName(), containerID, err)
+			daemon.GraphDriverName(runtime.GOOS), containerID, err)
 		// FIXME: GetSize should return an error. Not changing it now in case
 		// there is a side-effect.
 		sizeRw = -1
diff --git a/components/engine/daemon/graphdriver/aufs/aufs.go b/components/engine/daemon/graphdriver/aufs/aufs.go
index 85cd5d1d26..b245143e1e 100644
--- a/components/engine/daemon/graphdriver/aufs/aufs.go
+++ b/components/engine/daemon/graphdriver/aufs/aufs.go
@@ -573,7 +573,7 @@ func (a *Driver) aufsMount(ro []string, rw, target, mountLabel string) (err erro
 
 	offset := 54
 	if useDirperm() {
-		offset += len("dirperm1")
+		offset += len(",dirperm1")
 	}
 	b := make([]byte, syscall.Getpagesize()-len(mountLabel)-offset) // room for xino & mountLabel
 	bp := copy(b, fmt.Sprintf("br:%s=rw", rw))
diff --git a/components/engine/daemon/graphdriver/btrfs/btrfs.go b/components/engine/daemon/graphdriver/btrfs/btrfs.go
index 2ff41a0b8b..3eb4ce8ed1 100644
--- a/components/engine/daemon/graphdriver/btrfs/btrfs.go
+++ b/components/engine/daemon/graphdriver/btrfs/btrfs.go
@@ -16,13 +16,18 @@ import "C"
 
 import (
 	"fmt"
+	"io/ioutil"
+	"math"
 	"os"
 	"path"
 	"path/filepath"
+	"strconv"
 	"strings"
+	"sync"
 	"syscall"
 	"unsafe"
 
+	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/daemon/graphdriver"
 	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/mount"
@@ -119,6 +124,7 @@ type Driver struct {
 	gidMaps      []idtools.IDMap
 	options      btrfsOptions
 	quotaEnabled bool
+	once         sync.Once
 }
 
 // String prints the name of the driver (btrfs).
@@ -237,7 +243,7 @@ func isSubvolume(p string) (bool, error) {
 	return bufStat.Ino == C.BTRFS_FIRST_FREE_OBJECTID, nil
 }
 
-func subvolDelete(dirpath, name string) error {
+func subvolDelete(dirpath, name string, quotaEnabled bool) error {
 	dir, err := openDir(dirpath)
 	if err != nil {
 		return err
@@ -265,7 +271,7 @@ func subvolDelete(dirpath, name string) error {
 				return fmt.Errorf("Failed to test if %s is a btrfs subvolume: %v", p, err)
 			}
 			if sv {
-				if err := subvolDelete(path.Dir(p), f.Name()); err != nil {
+				if err := subvolDelete(path.Dir(p), f.Name(), quotaEnabled); err != nil {
 					return fmt.Errorf("Failed to destroy btrfs child subvolume (%s) of parent (%s): %v", p, dirpath, err)
 				}
 			}
@@ -276,6 +282,21 @@ func subvolDelete(dirpath, name string) error {
 		return fmt.Errorf("Recursively walking subvolumes for %s failed: %v", dirpath, err)
 	}
 
+	if quotaEnabled {
+		if qgroupid, err := subvolLookupQgroup(fullPath); err == nil {
+			var args C.struct_btrfs_ioctl_qgroup_create_args
+			args.qgroupid = C.__u64(qgroupid)
+
+			_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_QGROUP_CREATE,
+				uintptr(unsafe.Pointer(&args)))
+			if errno != 0 {
+				logrus.Errorf("Failed to delete btrfs qgroup %v for %s: %v", qgroupid, fullPath, errno.Error())
+			}
+		} else {
+			logrus.Errorf("Failed to lookup btrfs qgroup for %s: %v", fullPath, err.Error())
+		}
+	}
+
 	// all subvolumes have been removed
 	// now remove the one originally passed in
 	for i, c := range []byte(name) {
@@ -289,15 +310,25 @@ func subvolDelete(dirpath, name string) error {
 	return nil
 }
 
+func (d *Driver) updateQuotaStatus() {
+	d.once.Do(func() {
+		if !d.quotaEnabled {
+			// In case quotaEnabled is not set, check qgroup and update quotaEnabled as needed
+			if err := subvolQgroupStatus(d.home); err != nil {
+				// quota is still not enabled
+				return
+			}
+			d.quotaEnabled = true
+		}
+	})
+}
+
 func (d *Driver) subvolEnableQuota() error {
+	d.updateQuotaStatus()
+
 	if d.quotaEnabled {
 		return nil
 	}
-	// In case quotaEnabled is not set, check qgroup and update quotaEnabled as needed
-	if _, err := subvolLookupQgroup(d.home); err == nil {
-		d.quotaEnabled = true
-		return nil
-	}
 
 	dir, err := openDir(d.home)
 	if err != nil {
@@ -319,13 +350,10 @@ func (d *Driver) subvolEnableQuota() error {
 }
 
 func (d *Driver) subvolDisableQuota() error {
+	d.updateQuotaStatus()
+
 	if !d.quotaEnabled {
-		// In case quotaEnabled is not set, check qgroup and update quotaEnabled as needed
-		if _, err := subvolLookupQgroup(d.home); err != nil {
-			// quota is still not enabled
-			return nil
-		}
-		d.quotaEnabled = true
+		return nil
 	}
 
 	dir, err := openDir(d.home)
@@ -348,13 +376,10 @@ func (d *Driver) subvolDisableQuota() error {
 }
 
 func (d *Driver) subvolRescanQuota() error {
+	d.updateQuotaStatus()
+
 	if !d.quotaEnabled {
-		// In case quotaEnabled is not set, check qgroup and update quotaEnabled as needed
-		if _, err := subvolLookupQgroup(d.home); err != nil {
-			// quota is still not enabled
-			return nil
-		}
-		d.quotaEnabled = true
+		return nil
 	}
 
 	dir, err := openDir(d.home)
@@ -392,6 +417,38 @@ func subvolLimitQgroup(path string, size uint64) error {
 	return nil
 }
 
+// subvolQgroupStatus performs a BTRFS_IOC_TREE_SEARCH on the root path
+// with search key of BTRFS_QGROUP_STATUS_KEY.
+// In case qgroup is enabled, the retuned key type will match BTRFS_QGROUP_STATUS_KEY.
+// For more details please see https://github.com/kdave/btrfs-progs/blob/v4.9/qgroup.c#L1035
+func subvolQgroupStatus(path string) error {
+	dir, err := openDir(path)
+	if err != nil {
+		return err
+	}
+	defer closeDir(dir)
+
+	var args C.struct_btrfs_ioctl_search_args
+	args.key.tree_id = C.BTRFS_QUOTA_TREE_OBJECTID
+	args.key.min_type = C.BTRFS_QGROUP_STATUS_KEY
+	args.key.max_type = C.BTRFS_QGROUP_STATUS_KEY
+	args.key.max_objectid = C.__u64(math.MaxUint64)
+	args.key.max_offset = C.__u64(math.MaxUint64)
+	args.key.max_transid = C.__u64(math.MaxUint64)
+	args.key.nr_items = 4096
+
+	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_TREE_SEARCH,
+		uintptr(unsafe.Pointer(&args)))
+	if errno != 0 {
+		return fmt.Errorf("Failed to search qgroup for %s: %v", path, errno.Error())
+	}
+	sh := (*C.struct_btrfs_ioctl_search_header)(unsafe.Pointer(&args.buf))
+	if sh._type != C.BTRFS_QGROUP_STATUS_KEY {
+		return fmt.Errorf("Invalid qgroup search header type for %s: %v", path, sh._type)
+	}
+	return nil
+}
+
 func subvolLookupQgroup(path string) (uint64, error) {
 	dir, err := openDir(path)
 	if err != nil {
@@ -422,6 +479,14 @@ func (d *Driver) subvolumesDirID(id string) string {
 	return path.Join(d.subvolumesDir(), id)
 }
 
+func (d *Driver) quotasDir() string {
+	return path.Join(d.home, "quotas")
+}
+
+func (d *Driver) quotasDirID(id string) string {
+	return path.Join(d.quotasDir(), id)
+}
+
 // CreateReadWrite creates a layer that is writable for use as a container
 // file system.
 func (d *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts) error {
@@ -430,6 +495,7 @@ func (d *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts
 
 // Create the filesystem with given id.
 func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) error {
+	quotas := path.Join(d.home, "quotas")
 	subvolumes := path.Join(d.home, "subvolumes")
 	rootUID, rootGID, err := idtools.GetRootUIDGID(d.uidMaps, d.gidMaps)
 	if err != nil {
@@ -466,9 +532,16 @@ func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) error {
 		if err := d.parseStorageOpt(storageOpt, driver); err != nil {
 			return err
 		}
+
 		if err := d.setStorageSize(path.Join(subvolumes, id), driver); err != nil {
 			return err
 		}
+		if err := idtools.MkdirAllAs(quotas, 0700, rootUID, rootGID); err != nil {
+			return err
+		}
+		if err := ioutil.WriteFile(path.Join(quotas, id), []byte(fmt.Sprint(driver.options.size)), 0644); err != nil {
+			return err
+		}
 	}
 
 	// if we have a remapped root (user namespaces enabled), change the created snapshot
@@ -533,7 +606,19 @@ func (d *Driver) Remove(id string) error {
 	if _, err := os.Stat(dir); err != nil {
 		return err
 	}
-	if err := subvolDelete(d.subvolumesDir(), id); err != nil {
+	quotasDir := d.quotasDirID(id)
+	if _, err := os.Stat(quotasDir); err == nil {
+		if err := os.Remove(quotasDir); err != nil {
+			return err
+		}
+	} else if !os.IsNotExist(err) {
+		return err
+	}
+
+	// Call updateQuotaStatus() to invoke status update
+	d.updateQuotaStatus()
+
+	if err := subvolDelete(d.subvolumesDir(), id, d.quotaEnabled); err != nil {
 		return err
 	}
 	if err := system.EnsureRemoveAll(dir); err != nil {
@@ -557,6 +642,17 @@ func (d *Driver) Get(id, mountLabel string) (string, error) {
 		return "", fmt.Errorf("%s: not a directory", dir)
 	}
 
+	if quota, err := ioutil.ReadFile(d.quotasDirID(id)); err == nil {
+		if size, err := strconv.ParseUint(string(quota), 10, 64); err == nil && size >= d.options.minSpace {
+			if err := d.subvolEnableQuota(); err != nil {
+				return "", err
+			}
+			if err := subvolLimitQgroup(dir, size); err != nil {
+				return "", err
+			}
+		}
+	}
+
 	return dir, nil
 }
 
diff --git a/components/engine/daemon/graphdriver/devmapper/deviceset.go b/components/engine/daemon/graphdriver/devmapper/deviceset.go
index 876c14ea38..49ea386f4a 100644
--- a/components/engine/daemon/graphdriver/devmapper/deviceset.go
+++ b/components/engine/daemon/graphdriver/devmapper/deviceset.go
@@ -1689,7 +1689,7 @@ func (devices *DeviceSet) enableDeferredRemovalDeletion() error {
 	return nil
 }
 
-func (devices *DeviceSet) initDevmapper(doInit bool) error {
+func (devices *DeviceSet) initDevmapper(doInit bool) (retErr error) {
 	// give ourselves to libdm as a log handler
 	devicemapper.LogInit(devices)
 
@@ -1871,6 +1871,14 @@ func (devices *DeviceSet) initDevmapper(doInit bool) error {
 		if err := devicemapper.CreatePool(devices.getPoolName(), dataFile, metadataFile, devices.thinpBlockSize); err != nil {
 			return err
 		}
+		defer func() {
+			if retErr != nil {
+				err = devices.deactivatePool()
+				if err != nil {
+					logrus.Warnf("devmapper: Failed to deactivatePool: %v", err)
+				}
+			}
+		}()
 	}
 
 	// Pool already exists and caller did not pass us a pool. That means
diff --git a/components/engine/daemon/graphdriver/devmapper/devmapper_test.go b/components/engine/daemon/graphdriver/devmapper/devmapper_test.go
index c5be97ae3f..7501397fdc 100644
--- a/components/engine/daemon/graphdriver/devmapper/devmapper_test.go
+++ b/components/engine/daemon/graphdriver/devmapper/devmapper_test.go
@@ -4,6 +4,8 @@ package devmapper
 
 import (
 	"fmt"
+	"os"
+	"syscall"
 	"testing"
 	"time"
 
@@ -17,11 +19,51 @@ func init() {
 	defaultMetaDataLoopbackSize = 200 * 1024 * 1024
 	defaultBaseFsSize = 300 * 1024 * 1024
 	defaultUdevSyncOverride = true
-	if err := graphtest.InitLoopbacks(); err != nil {
+	if err := initLoopbacks(); err != nil {
 		panic(err)
 	}
 }
 
+// initLoopbacks ensures that the loopback devices are properly created within
+// the system running the device mapper tests.
+func initLoopbacks() error {
+	statT, err := getBaseLoopStats()
+	if err != nil {
+		return err
+	}
+	// create at least 8 loopback files, ya, that is a good number
+	for i := 0; i < 8; i++ {
+		loopPath := fmt.Sprintf("/dev/loop%d", i)
+		// only create new loopback files if they don't exist
+		if _, err := os.Stat(loopPath); err != nil {
+			if mkerr := syscall.Mknod(loopPath,
+				uint32(statT.Mode|syscall.S_IFBLK), int((7<<8)|(i&0xff)|((i&0xfff00)<<12))); mkerr != nil {
+				return mkerr
+			}
+			os.Chown(loopPath, int(statT.Uid), int(statT.Gid))
+		}
+	}
+	return nil
+}
+
+// getBaseLoopStats inspects /dev/loop0 to collect uid,gid, and mode for the
+// loop0 device on the system.  If it does not exist we assume 0,0,0660 for the
+// stat data
+func getBaseLoopStats() (*syscall.Stat_t, error) {
+	loop0, err := os.Stat("/dev/loop0")
+	if err != nil {
+		if os.IsNotExist(err) {
+			return &syscall.Stat_t{
+				Uid:  0,
+				Gid:  0,
+				Mode: 0660,
+			}, nil
+		}
+		return nil, err
+	}
+	return loop0.Sys().(*syscall.Stat_t), nil
+}
+
 // This avoids creating a new driver for each test if all tests are run
 // Make sure to put new tests between TestDevmapperSetup and TestDevmapperTeardown
 func TestDevmapperSetup(t *testing.T) {
diff --git a/components/engine/daemon/graphdriver/graphtest/graphtest_unix.go b/components/engine/daemon/graphdriver/graphtest/graphtest_unix.go
index 6e952de78b..6852ca9f4c 100644
--- a/components/engine/daemon/graphdriver/graphtest/graphtest_unix.go
+++ b/components/engine/daemon/graphdriver/graphtest/graphtest_unix.go
@@ -16,6 +16,8 @@ import (
 	"github.com/docker/docker/daemon/graphdriver"
 	"github.com/docker/docker/pkg/stringid"
 	"github.com/docker/go-units"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 var (
@@ -33,14 +35,9 @@ type Driver struct {
 
 func newDriver(t testing.TB, name string, options []string) *Driver {
 	root, err := ioutil.TempDir("", "docker-graphtest-")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if err := os.MkdirAll(root, 0755); err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
+	require.NoError(t, os.MkdirAll(root, 0755))
 	d, err := graphdriver.GetDriver(name, nil, graphdriver.Options{DriverOptions: options, Root: root})
 	if err != nil {
 		t.Logf("graphdriver: %v\n", err)
@@ -86,14 +83,11 @@ func DriverTestCreateEmpty(t testing.TB, drivername string, driverOptions ...str
 	driver := GetDriver(t, drivername, driverOptions...)
 	defer PutDriver(t)
 
-	if err := driver.Create("empty", "", nil); err != nil {
-		t.Fatal(err)
-	}
+	err := driver.Create("empty", "", nil)
+	require.NoError(t, err)
 
 	defer func() {
-		if err := driver.Remove("empty"); err != nil {
-			t.Fatal(err)
-		}
+		require.NoError(t, driver.Remove("empty"))
 	}()
 
 	if !driver.Exists("empty") {
@@ -101,21 +95,14 @@ func DriverTestCreateEmpty(t testing.TB, drivername string, driverOptions ...str
 	}
 
 	dir, err := driver.Get("empty", "")
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	verifyFile(t, dir, 0755|os.ModeDir, 0, 0)
 
 	// Verify that the directory is empty
 	fis, err := readDir(dir)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if len(fis) != 0 {
-		t.Fatal("New directory not empty")
-	}
+	require.NoError(t, err)
+	assert.Len(t, fis, 0)
 
 	driver.Put("empty")
 }
@@ -127,9 +114,7 @@ func DriverTestCreateBase(t testing.TB, drivername string, driverOptions ...stri
 
 	createBase(t, driver, "Base")
 	defer func() {
-		if err := driver.Remove("Base"); err != nil {
-			t.Fatal(err)
-		}
+		require.NoError(t, driver.Remove("Base"))
 	}()
 	verifyBase(t, driver, "Base")
 }
@@ -140,21 +125,14 @@ func DriverTestCreateSnap(t testing.TB, drivername string, driverOptions ...stri
 	defer PutDriver(t)
 
 	createBase(t, driver, "Base")
-
 	defer func() {
-		if err := driver.Remove("Base"); err != nil {
-			t.Fatal(err)
-		}
+		require.NoError(t, driver.Remove("Base"))
 	}()
 
-	if err := driver.Create("Snap", "Base", nil); err != nil {
-		t.Fatal(err)
-	}
-
+	err := driver.Create("Snap", "Base", nil)
+	require.NoError(t, err)
 	defer func() {
-		if err := driver.Remove("Snap"); err != nil {
-			t.Fatal(err)
-		}
+		require.NoError(t, driver.Remove("Snap"))
 	}()
 
 	verifyBase(t, driver, "Snap")
diff --git a/components/engine/daemon/graphdriver/graphtest/testutil_unix.go b/components/engine/daemon/graphdriver/graphtest/testutil_unix.go
index 49b0c2cc35..63a934176e 100644
--- a/components/engine/daemon/graphdriver/graphtest/testutil_unix.go
+++ b/components/engine/daemon/graphdriver/graphtest/testutil_unix.go
@@ -3,7 +3,6 @@
 package graphtest
 
 import (
-	"fmt"
 	"io/ioutil"
 	"os"
 	"path"
@@ -11,81 +10,24 @@ import (
 	"testing"
 
 	"github.com/docker/docker/daemon/graphdriver"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
-// InitLoopbacks ensures that the loopback devices are properly created within
-// the system running the device mapper tests.
-func InitLoopbacks() error {
-	statT, err := getBaseLoopStats()
-	if err != nil {
-		return err
-	}
-	// create at least 8 loopback files, ya, that is a good number
-	for i := 0; i < 8; i++ {
-		loopPath := fmt.Sprintf("/dev/loop%d", i)
-		// only create new loopback files if they don't exist
-		if _, err := os.Stat(loopPath); err != nil {
-			if mkerr := syscall.Mknod(loopPath,
-				uint32(statT.Mode|syscall.S_IFBLK), int((7<<8)|(i&0xff)|((i&0xfff00)<<12))); mkerr != nil {
-				return mkerr
-			}
-			os.Chown(loopPath, int(statT.Uid), int(statT.Gid))
-		}
-	}
-	return nil
-}
-
-// getBaseLoopStats inspects /dev/loop0 to collect uid,gid, and mode for the
-// loop0 device on the system.  If it does not exist we assume 0,0,0660 for the
-// stat data
-func getBaseLoopStats() (*syscall.Stat_t, error) {
-	loop0, err := os.Stat("/dev/loop0")
-	if err != nil {
-		if os.IsNotExist(err) {
-			return &syscall.Stat_t{
-				Uid:  0,
-				Gid:  0,
-				Mode: 0660,
-			}, nil
-		}
-		return nil, err
-	}
-	return loop0.Sys().(*syscall.Stat_t), nil
-}
-
 func verifyFile(t testing.TB, path string, mode os.FileMode, uid, gid uint32) {
 	fi, err := os.Stat(path)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
-	if fi.Mode()&os.ModeType != mode&os.ModeType {
-		t.Fatalf("Expected %s type 0x%x, got 0x%x", path, mode&os.ModeType, fi.Mode()&os.ModeType)
-	}
-
-	if fi.Mode()&os.ModePerm != mode&os.ModePerm {
-		t.Fatalf("Expected %s mode %o, got %o", path, mode&os.ModePerm, fi.Mode()&os.ModePerm)
-	}
-
-	if fi.Mode()&os.ModeSticky != mode&os.ModeSticky {
-		t.Fatalf("Expected %s sticky 0x%x, got 0x%x", path, mode&os.ModeSticky, fi.Mode()&os.ModeSticky)
-	}
-
-	if fi.Mode()&os.ModeSetuid != mode&os.ModeSetuid {
-		t.Fatalf("Expected %s setuid 0x%x, got 0x%x", path, mode&os.ModeSetuid, fi.Mode()&os.ModeSetuid)
-	}
-
-	if fi.Mode()&os.ModeSetgid != mode&os.ModeSetgid {
-		t.Fatalf("Expected %s setgid 0x%x, got 0x%x", path, mode&os.ModeSetgid, fi.Mode()&os.ModeSetgid)
-	}
+	actual := fi.Mode()
+	assert.Equal(t, mode&os.ModeType, actual&os.ModeType, path)
+	assert.Equal(t, mode&os.ModePerm, actual&os.ModePerm, path)
+	assert.Equal(t, mode&os.ModeSticky, actual&os.ModeSticky, path)
+	assert.Equal(t, mode&os.ModeSetuid, actual&os.ModeSetuid, path)
+	assert.Equal(t, mode&os.ModeSetgid, actual&os.ModeSetgid, path)
 
 	if stat, ok := fi.Sys().(*syscall.Stat_t); ok {
-		if stat.Uid != uid {
-			t.Fatalf("%s no owned by uid %d", path, uid)
-		}
-		if stat.Gid != gid {
-			t.Fatalf("%s not owned by gid %d", path, gid)
-		}
+		assert.Equal(t, uid, stat.Uid, path)
+		assert.Equal(t, gid, stat.Gid, path)
 	}
 }
 
@@ -94,35 +36,25 @@ func createBase(t testing.TB, driver graphdriver.Driver, name string) {
 	oldmask := syscall.Umask(0)
 	defer syscall.Umask(oldmask)
 
-	if err := driver.CreateReadWrite(name, "", nil); err != nil {
-		t.Fatal(err)
-	}
+	err := driver.CreateReadWrite(name, "", nil)
+	require.NoError(t, err)
 
 	dir, err := driver.Get(name, "")
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 	defer driver.Put(name)
 
 	subdir := path.Join(dir, "a subdir")
-	if err := os.Mkdir(subdir, 0705|os.ModeSticky); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Chown(subdir, 1, 2); err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, os.Mkdir(subdir, 0705|os.ModeSticky))
+	require.NoError(t, os.Chown(subdir, 1, 2))
 
 	file := path.Join(dir, "a file")
-	if err := ioutil.WriteFile(file, []byte("Some data"), 0222|os.ModeSetuid); err != nil {
-		t.Fatal(err)
-	}
+	err = ioutil.WriteFile(file, []byte("Some data"), 0222|os.ModeSetuid)
+	require.NoError(t, err)
 }
 
 func verifyBase(t testing.TB, driver graphdriver.Driver, name string) {
 	dir, err := driver.Get(name, "")
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 	defer driver.Put(name)
 
 	subdir := path.Join(dir, "a subdir")
@@ -131,13 +63,7 @@ func verifyBase(t testing.TB, driver graphdriver.Driver, name string) {
 	file := path.Join(dir, "a file")
 	verifyFile(t, file, 0222|os.ModeSetuid, 0, 0)
 
-	fis, err := readDir(dir)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if len(fis) != 2 {
-		t.Fatal("Unexpected files in base image")
-	}
-
+	files, err := readDir(dir)
+	require.NoError(t, err)
+	assert.Len(t, files, 2)
 }
diff --git a/components/engine/daemon/graphdriver/lcow/lcow.go b/components/engine/daemon/graphdriver/lcow/lcow.go
new file mode 100644
index 0000000000..6bf491574a
--- /dev/null
+++ b/components/engine/daemon/graphdriver/lcow/lcow.go
@@ -0,0 +1,497 @@
+// +build windows
+
+package lcow
+
+// Maintainer: @jhowardmsft
+// Graph-driver for Linux Containers On Windows (LCOW)
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/Sirupsen/logrus"
+	"github.com/docker/docker/daemon/graphdriver"
+	"github.com/docker/docker/pkg/archive"
+	"github.com/docker/docker/pkg/idtools"
+	"github.com/docker/docker/pkg/system"
+	"github.com/jhowardmsft/opengcs/gogcs/client"
+)
+
+// init registers the LCOW driver to the register.
+func init() {
+	graphdriver.Register("lcow", InitLCOW)
+}
+
+const (
+	// sandboxFilename is the name of the file containing a layers sandbox (read-write layer)
+	sandboxFilename = "sandbox.vhdx"
+)
+
+// cacheType is our internal structure representing an item in our local cache
+// of things that have been mounted.
+type cacheType struct {
+	uvmPath   string // Path in utility VM
+	hostPath  string // Path on host
+	refCount  int    // How many times its been mounted
+	isSandbox bool   // True if a sandbox
+}
+
+// Driver represents an LCOW graph driver.
+type Driver struct {
+	// homeDir is the hostpath where we're storing everything
+	homeDir string
+	// cachedSandboxFile is the location of the local default-sized cached sandbox
+	cachedSandboxFile string
+	// options are the graphdriver options we are initialised with
+	options []string
+	// JJH LIFETIME TODO - Remove this and move up to daemon. For now, a global service utility-VM
+	config client.Config
+
+	// it is safe for windows to use a cache here because it does not support
+	// restoring containers when the daemon dies.
+
+	// cacheMu is the mutex protection add/update/deletes to our cache
+	cacheMu sync.Mutex
+	// cache is the cache of all the IDs we've mounted/unmounted.
+	cache map[string]cacheType
+}
+
+// InitLCOW returns a new LCOW storage driver.
+func InitLCOW(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (graphdriver.Driver, error) {
+	title := "lcowdriver: init:"
+	logrus.Debugf("%s %s", title, home)
+
+	d := &Driver{
+		homeDir:           home,
+		options:           options,
+		cachedSandboxFile: filepath.Join(home, "cache", sandboxFilename),
+		cache:             make(map[string]cacheType),
+	}
+
+	if err := idtools.MkdirAllAs(home, 0700, 0, 0); err != nil {
+		return nil, fmt.Errorf("%s failed to create '%s': %v", title, home, err)
+	}
+
+	// Cache directory for blank sandbox so don't have to pull it from the service VM each time
+	if err := idtools.MkdirAllAs(filepath.Dir(d.cachedSandboxFile), 0700, 0, 0); err != nil {
+		return nil, fmt.Errorf("%s failed to create '%s': %v", title, home, err)
+	}
+
+	return d, nil
+}
+
+// startUvm starts the service utility VM if it isn't running.
+// TODO @jhowardmsft. This will change before RS3 ships as we move to a model of one
+// service VM globally to a service VM per container (or offline operation). However,
+// for the initial bring-up of LCOW, this is acceptable.
+func (d *Driver) startUvm(context string) error {
+	// Nothing to do if it's already running
+	if d.config.Uvm != nil {
+		return nil
+	}
+
+	// So we need to start it. Generate a default configuration
+	if err := d.config.GenerateDefault(d.options); err != nil {
+		return fmt.Errorf("failed to generate default gogcs configuration (%s): %s", context, err)
+	}
+
+	d.config.Name = "LinuxServiceVM" // TODO @jhowardmsft - This requires an in-flight platform change. Can't hard code it to this longer term
+	if err := d.config.Create(); err != nil {
+		return fmt.Errorf("failed to start utility VM (%s): %s", context, err)
+	}
+	return nil
+}
+
+// terminateUvm terminates the service utility VM if its running.
+func (d *Driver) terminateUvm(context string) error {
+	// Nothing to do if it's not running
+	if d.config.Uvm == nil {
+		return nil
+	}
+
+	// FIXME: @jhowardmsft
+	// This isn't thread-safe yet, but will change anyway with the lifetime
+	// changes and multiple instances. Defering that work for now.
+	uvm := d.config.Uvm
+	d.config.Uvm = nil
+
+	if err := uvm.Terminate(); err != nil {
+		return fmt.Errorf("failed to terminate utility VM (%s): %s", context, err)
+	}
+
+	if err := uvm.WaitTimeout(time.Duration(d.config.UvmTimeoutSeconds) * time.Second); err != nil {
+		return fmt.Errorf("failed waiting for utility VM to terminate (%s): %s", context, err)
+	}
+
+	return nil
+}
+
+// String returns the string representation of a driver. This should match
+// the name the graph driver has been registered with.
+func (d *Driver) String() string {
+	return "lcow"
+}
+
+// Status returns the status of the driver.
+func (d *Driver) Status() [][2]string {
+	return [][2]string{
+		{"LCOW", ""},
+	}
+}
+
+// Exists returns true if the given id is registered with this driver.
+func (d *Driver) Exists(id string) bool {
+	_, err := os.Lstat(d.dir(id))
+	logrus.Debugf("lcowdriver: exists: id %s %t", id, err == nil)
+	return err == nil
+}
+
+// CreateReadWrite creates a layer that is writable for use as a container
+// file system. That equates to creating a sandbox VHDx.
+func (d *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts) error {
+	logrus.Debugf("lcowdriver: createreadwrite: id %s", id)
+
+	if err := d.startUvm("createreadwrite"); err != nil {
+		return err
+	}
+
+	if err := d.Create(id, parent, opts); err != nil {
+		return err
+	}
+
+	return d.config.CreateSandbox(filepath.Join(d.dir(id), sandboxFilename), client.DefaultSandboxSizeMB, d.cachedSandboxFile)
+}
+
+// Create creates a new read-only layer with the given id.
+func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) error {
+	logrus.Debugf("lcowdriver: create: id %s parent: %s", id, parent)
+
+	parentChain, err := d.getLayerChain(parent)
+	if err != nil {
+		return err
+	}
+
+	var layerChain []string
+	if parent != "" {
+		if !d.Exists(parent) {
+			return fmt.Errorf("lcowdriver: cannot create read-only layer with missing parent %s", parent)
+		}
+		layerChain = []string{d.dir(parent)}
+	}
+	layerChain = append(layerChain, parentChain...)
+
+	// Make sure layers are created with the correct ACL so that VMs can access them.
+	layerPath := d.dir(id)
+	logrus.Debugf("lcowdriver: create: id %s: creating layerPath %s", id, layerPath)
+	// Make sure the layers are created with the correct ACL so that VMs can access them.
+	if err := system.MkdirAllWithACL(layerPath, 755, system.SddlNtvmAdministratorsLocalSystem); err != nil {
+		return err
+	}
+
+	if err := d.setLayerChain(id, layerChain); err != nil {
+		if err2 := os.RemoveAll(layerPath); err2 != nil {
+			logrus.Warnf("Failed to remove layer %s: %s", layerPath, err2)
+		}
+		return err
+	}
+	logrus.Debugf("lcowdriver: createreadwrite: id %s: success", id)
+
+	return nil
+}
+
+// Remove unmounts and removes the dir information.
+func (d *Driver) Remove(id string) error {
+	logrus.Debugf("lcowdriver: remove: id %s", id)
+	tmpID := fmt.Sprintf("%s-removing", id)
+	tmpLayerPath := d.dir(tmpID)
+	layerPath := d.dir(id)
+
+	logrus.Debugf("lcowdriver: remove: id %s: layerPath %s", id, layerPath)
+	if err := os.Rename(layerPath, tmpLayerPath); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+
+	if err := os.RemoveAll(tmpLayerPath); err != nil {
+		return err
+	}
+
+	logrus.Debugf("lcowdriver: remove: id %s: layerPath %s succeeded", id, layerPath)
+	return nil
+}
+
+// Get returns the rootfs path for the id. It is reference counted and
+// effectively can be thought of as a "mount the layer into the utility
+// vm if it isn't already"
+func (d *Driver) Get(id, mountLabel string) (string, error) {
+	dir, _, _, err := d.getEx(id)
+	return dir, err
+}
+
+// getEx is Get, but also returns the cache-entry and the size of the VHD
+func (d *Driver) getEx(id string) (string, cacheType, int64, error) {
+	title := "lcowdriver: getEx"
+	logrus.Debugf("%s %s", title, id)
+
+	if err := d.startUvm(fmt.Sprintf("getex %s", id)); err != nil {
+		logrus.Debugf("%s failed to start utility vm: %s", title, err)
+		return "", cacheType{}, 0, err
+	}
+
+	// Work out what we are working on
+	vhdFilename, vhdSize, isSandbox, err := client.LayerVhdDetails(d.dir(id))
+	if err != nil {
+		logrus.Debugf("%s failed to get LayerVhdDetails from %s: %s", title, d.dir(id), err)
+		return "", cacheType{}, 0, fmt.Errorf("%s failed to open layer or sandbox VHD to open in %s: %s", title, d.dir(id), err)
+	}
+	logrus.Debugf("%s %s, size %d, isSandbox %t", title, vhdFilename, vhdSize, isSandbox)
+
+	hotAddRequired := false
+	d.cacheMu.Lock()
+	var cacheEntry cacheType
+	if _, ok := d.cache[id]; !ok {
+		// The item is not currently in the cache.
+		//
+		// Sandboxes need hot-adding in the case that there is a single global utility VM
+		// This will change for multiple instances with the lifetime changes.
+		if isSandbox {
+			hotAddRequired = true
+		}
+		d.cache[id] = cacheType{
+			uvmPath:   fmt.Sprintf("/mnt/%s", id),
+			refCount:  1,
+			isSandbox: isSandbox,
+			hostPath:  vhdFilename,
+		}
+	} else {
+		// Increment the reference counter in the cache.
+		cacheEntry = d.cache[id]
+		cacheEntry.refCount++
+		d.cache[id] = cacheEntry
+	}
+
+	cacheEntry = d.cache[id]
+	logrus.Debugf("%s %s: isSandbox %t, refCount %d", title, id, cacheEntry.isSandbox, cacheEntry.refCount)
+	d.cacheMu.Unlock()
+
+	if hotAddRequired {
+		logrus.Debugf("%s %s: Hot-Adding %s", title, id, vhdFilename)
+		if err := d.config.HotAddVhd(vhdFilename, cacheEntry.uvmPath); err != nil {
+			return "", cacheType{}, 0, fmt.Errorf("%s hot add %s failed: %s", title, vhdFilename, err)
+		}
+	}
+
+	logrus.Debugf("%s %s success. %s: %+v: size %d", title, id, d.dir(id), cacheEntry, vhdSize)
+	return d.dir(id), cacheEntry, vhdSize, nil
+}
+
+// Put does the reverse of get. If there are no more references to
+// the layer, it unmounts it from the utility VM.
+func (d *Driver) Put(id string) error {
+	title := "lcowdriver: put"
+	logrus.Debugf("%s %s", title, id)
+
+	if err := d.startUvm(fmt.Sprintf("put %s", id)); err != nil {
+		return err
+	}
+
+	d.cacheMu.Lock()
+	// Bad-news if unmounting something that isn't in the cache.
+	entry, ok := d.cache[id]
+	if !ok {
+		d.cacheMu.Unlock()
+		return fmt.Errorf("%s possible ref-count error, or invalid id was passed to the graphdriver. Cannot handle id %s as it's not in the cache", title, id)
+	}
+
+	// Are we just decrementing the reference count
+	if entry.refCount > 1 {
+		entry.refCount--
+		d.cache[id] = entry
+		logrus.Debugf("%s %s: refCount decremented to %d", title, id, entry.refCount)
+		d.cacheMu.Unlock()
+		return nil
+	}
+
+	// No more references, so tear it down if previously hot-added
+	if entry.isSandbox {
+		logrus.Debugf("%s %s: Hot-Removing %s", title, id, entry.hostPath)
+		if err := d.config.HotRemoveVhd(entry.hostPath); err != nil {
+			d.cacheMu.Unlock()
+			return fmt.Errorf("%s failed to hot-remove %s from service utility VM: %s", title, entry.hostPath, err)
+		}
+	}
+
+	// @jhowardmsft TEMPORARY FIX WHILE WAITING FOR HOT-REMOVE TO BE FIXED IN PLATFORM
+	//d.terminateUvm(fmt.Sprintf("put %s", id))
+
+	// Remove from the cache map.
+	delete(d.cache, id)
+	d.cacheMu.Unlock()
+
+	logrus.Debugf("%s %s: refCount 0. %s (%s) completed successfully", title, id, entry.hostPath, entry.uvmPath)
+	return nil
+}
+
+// Cleanup ensures the information the driver stores is properly removed.
+// We use this opportunity to cleanup any -removing folders which may be
+// still left if the daemon was killed while it was removing a layer.
+func (d *Driver) Cleanup() error {
+	title := "lcowdriver: cleanup"
+	logrus.Debugf(title)
+
+	d.cacheMu.Lock()
+	for k, v := range d.cache {
+		logrus.Debugf("%s cache entry: %s: %+v", title, k, v)
+		if v.refCount > 0 {
+			logrus.Warnf("%s leaked %s: %+v", title, k, v)
+		}
+	}
+	d.cacheMu.Unlock()
+
+	items, err := ioutil.ReadDir(d.homeDir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+
+	// Note we don't return an error below - it's possible the files
+	// are locked. However, next time around after the daemon exits,
+	// we likely will be able to to cleanup successfully. Instead we log
+	// warnings if there are errors.
+	for _, item := range items {
+		if item.IsDir() && strings.HasSuffix(item.Name(), "-removing") {
+			if err := os.RemoveAll(filepath.Join(d.homeDir, item.Name())); err != nil {
+				logrus.Warnf("%s failed to cleanup %s: %s", title, item.Name(), err)
+			} else {
+				logrus.Infof("%s cleaned up %s", title, item.Name())
+			}
+		}
+	}
+	return nil
+}
+
+// Diff takes a layer (and it's parent layer which may be null, but
+// is ignored by this implementation below) and returns a reader for
+// a tarstream representing the layers contents. The id could be
+// a read-only "layer.vhd" or a read-write "sandbox.vhdx". The semantics
+// of this function dictate that the layer is already mounted.
+func (d *Driver) Diff(id, parent string) (io.ReadCloser, error) {
+	title := "lcowdriver: diff:"
+	logrus.Debugf("%s id %s", title, id)
+
+	if err := d.startUvm(fmt.Sprintf("diff %s", id)); err != nil {
+		return nil, err
+	}
+
+	d.cacheMu.Lock()
+	if _, ok := d.cache[id]; !ok {
+		d.cacheMu.Unlock()
+		return nil, fmt.Errorf("%s fail as %s is not in the cache", title, id)
+	}
+	cacheEntry := d.cache[id]
+	d.cacheMu.Unlock()
+
+	// Stat to get size
+	fileInfo, err := os.Stat(cacheEntry.hostPath)
+	if err != nil {
+		return nil, fmt.Errorf("%s failed to stat %s: %s", title, cacheEntry.hostPath, err)
+	}
+
+	// Then obtain the tar stream for it
+	logrus.Debugf("%s %s, size %d, isSandbox %t", title, cacheEntry.hostPath, fileInfo.Size(), cacheEntry.isSandbox)
+	tarReadCloser, err := d.config.VhdToTar(cacheEntry.hostPath, cacheEntry.uvmPath, cacheEntry.isSandbox, fileInfo.Size())
+	if err != nil {
+		return nil, fmt.Errorf("%s failed to export layer to tar stream for id: %s, parent: %s : %s", title, id, parent, err)
+	}
+	logrus.Debugf("%s id %s parent %s completed successfully", title, id, parent)
+	return tarReadCloser, nil
+}
+
+// ApplyDiff extracts the changeset from the given diff into the
+// layer with the specified id and parent, returning the size of the
+// new layer in bytes. The layer should not be mounted when calling
+// this function. Another way of describing this is that ApplyDiff writes
+// to a new layer (a VHD in LCOW) the contents of a tarstream it's given.
+func (d *Driver) ApplyDiff(id, parent string, diff io.Reader) (int64, error) {
+	logrus.Debugf("lcowdriver: applydiff: id %s", id)
+
+	if err := d.startUvm(fmt.Sprintf("applydiff %s", id)); err != nil {
+		return 0, err
+	}
+
+	return d.config.TarToVhd(filepath.Join(d.homeDir, id, "layer.vhd"), diff)
+}
+
+// Changes produces a list of changes between the specified layer
+// and its parent layer. If parent is "", then all changes will be ADD changes.
+// The layer should not be mounted when calling this function.
+func (d *Driver) Changes(id, parent string) ([]archive.Change, error) {
+	logrus.Debugf("lcowdriver: changes: id %s parent %s", id, parent)
+	// TODO @gupta-ak. Needs implementation with assistance from service VM
+	return nil, nil
+}
+
+// DiffSize calculates the changes between the specified layer
+// and its parent and returns the size in bytes of the changes
+// relative to its base filesystem directory.
+func (d *Driver) DiffSize(id, parent string) (size int64, err error) {
+	logrus.Debugf("lcowdriver: diffsize: id %s", id)
+	// TODO @gupta-ak. Needs implementation with assistance from service VM
+	return 0, nil
+}
+
+// GetMetadata returns custom driver information.
+func (d *Driver) GetMetadata(id string) (map[string]string, error) {
+	logrus.Debugf("lcowdriver: getmetadata: id %s", id)
+	m := make(map[string]string)
+	m["dir"] = d.dir(id)
+	return m, nil
+}
+
+// dir returns the absolute path to the layer.
+func (d *Driver) dir(id string) string {
+	return filepath.Join(d.homeDir, filepath.Base(id))
+}
+
+// getLayerChain returns the layer chain information.
+func (d *Driver) getLayerChain(id string) ([]string, error) {
+	jPath := filepath.Join(d.dir(id), "layerchain.json")
+	logrus.Debugf("lcowdriver: getlayerchain: id %s json %s", id, jPath)
+	content, err := ioutil.ReadFile(jPath)
+	if os.IsNotExist(err) {
+		return nil, nil
+	} else if err != nil {
+		return nil, fmt.Errorf("lcowdriver: getlayerchain: %s unable to read layerchain file %s: %s", id, jPath, err)
+	}
+
+	var layerChain []string
+	err = json.Unmarshal(content, &layerChain)
+	if err != nil {
+		return nil, fmt.Errorf("lcowdriver: getlayerchain: %s failed to unmarshall layerchain file %s: %s", id, jPath, err)
+	}
+	return layerChain, nil
+}
+
+// setLayerChain stores the layer chain information on disk.
+func (d *Driver) setLayerChain(id string, chain []string) error {
+	content, err := json.Marshal(&chain)
+	if err != nil {
+		return fmt.Errorf("lcowdriver: setlayerchain: %s failed to marshall layerchain json: %s", id, err)
+	}
+
+	jPath := filepath.Join(d.dir(id), "layerchain.json")
+	logrus.Debugf("lcowdriver: setlayerchain: id %s json %s", id, jPath)
+	err = ioutil.WriteFile(jPath, content, 0600)
+	if err != nil {
+		return fmt.Errorf("lcowdriver: setlayerchain: %s failed to write layerchain file: %s", id, err)
+	}
+	return nil
+}
diff --git a/components/engine/daemon/graphdriver/overlay/overlay.go b/components/engine/daemon/graphdriver/overlay/overlay.go
index 88d6602e07..7f849c96ff 100644
--- a/components/engine/daemon/graphdriver/overlay/overlay.go
+++ b/components/engine/daemon/graphdriver/overlay/overlay.go
@@ -404,7 +404,7 @@ func (d *Driver) Put(id string) error {
 	if count := d.ctr.Decrement(mountpoint); count > 0 {
 		return nil
 	}
-	if err := syscall.Unmount(mountpoint, 0); err != nil {
+	if err := syscall.Unmount(mountpoint, syscall.MNT_DETACH); err != nil {
 		logrus.Debugf("Failed to unmount %s overlay: %v", id, err)
 	}
 	return nil
diff --git a/components/engine/daemon/graphdriver/overlay2/overlay.go b/components/engine/daemon/graphdriver/overlay2/overlay.go
index e327ec508a..ccb2c3669d 100644
--- a/components/engine/daemon/graphdriver/overlay2/overlay.go
+++ b/components/engine/daemon/graphdriver/overlay2/overlay.go
@@ -587,7 +587,7 @@ func (d *Driver) Put(id string) error {
 	if count := d.ctr.Decrement(mountpoint); count > 0 {
 		return nil
 	}
-	if err := syscall.Unmount(mountpoint, 0); err != nil {
+	if err := syscall.Unmount(mountpoint, syscall.MNT_DETACH); err != nil {
 		logrus.Debugf("Failed to unmount %s overlay: %s - %v", id, mountpoint, err)
 	}
 	return nil
diff --git a/components/engine/daemon/graphdriver/register/register_windows.go b/components/engine/daemon/graphdriver/register/register_windows.go
index efaa5005ed..5bb1fd62a8 100644
--- a/components/engine/daemon/graphdriver/register/register_windows.go
+++ b/components/engine/daemon/graphdriver/register/register_windows.go
@@ -1,6 +1,7 @@
 package register
 
 import (
-	// register the windows graph driver
+	// register the windows graph drivers
+	_ "github.com/docker/docker/daemon/graphdriver/lcow"
 	_ "github.com/docker/docker/daemon/graphdriver/windows"
 )
diff --git a/components/engine/daemon/graphdriver/vfs/driver.go b/components/engine/daemon/graphdriver/vfs/driver.go
index 846215e810..15a4de3606 100644
--- a/components/engine/daemon/graphdriver/vfs/driver.go
+++ b/components/engine/daemon/graphdriver/vfs/driver.go
@@ -9,13 +9,12 @@ import (
 	"github.com/docker/docker/pkg/chrootarchive"
 	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/system"
-
 	"github.com/opencontainers/selinux/go-selinux/label"
 )
 
 var (
 	// CopyWithTar defines the copy method to use.
-	CopyWithTar = chrootarchive.CopyWithTar
+	CopyWithTar = chrootarchive.NewArchiver(nil).CopyWithTar
 )
 
 func init() {
@@ -26,15 +25,11 @@ func init() {
 // This sets the home directory for the driver and returns NaiveDiffDriver.
 func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (graphdriver.Driver, error) {
 	d := &Driver{
-		home:    home,
-		uidMaps: uidMaps,
-		gidMaps: gidMaps,
+		home:       home,
+		idMappings: idtools.NewIDMappingsFromMaps(uidMaps, gidMaps),
 	}
-	rootUID, rootGID, err := idtools.GetRootUIDGID(uidMaps, gidMaps)
-	if err != nil {
-		return nil, err
-	}
-	if err := idtools.MkdirAllAs(home, 0700, rootUID, rootGID); err != nil {
+	rootIDs := d.idMappings.RootPair()
+	if err := idtools.MkdirAllAndChown(home, 0700, rootIDs); err != nil {
 		return nil, err
 	}
 	return graphdriver.NewNaiveDiffDriver(d, uidMaps, gidMaps), nil
@@ -45,9 +40,8 @@ func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap
 // In order to support layering, files are copied from the parent layer into the new layer. There is no copy-on-write support.
 // Driver must be wrapped in NaiveDiffDriver to be used as a graphdriver.Driver
 type Driver struct {
-	home    string
-	uidMaps []idtools.IDMap
-	gidMaps []idtools.IDMap
+	home       string
+	idMappings *idtools.IDMappings
 }
 
 func (d *Driver) String() string {
@@ -82,14 +76,11 @@ func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) error {
 	}
 
 	dir := d.dir(id)
-	rootUID, rootGID, err := idtools.GetRootUIDGID(d.uidMaps, d.gidMaps)
-	if err != nil {
+	rootIDs := d.idMappings.RootPair()
+	if err := idtools.MkdirAllAndChown(filepath.Dir(dir), 0700, rootIDs); err != nil {
 		return err
 	}
-	if err := idtools.MkdirAllAs(filepath.Dir(dir), 0700, rootUID, rootGID); err != nil {
-		return err
-	}
-	if err := idtools.MkdirAs(dir, 0755, rootUID, rootGID); err != nil {
+	if err := idtools.MkdirAndChown(dir, 0755, rootIDs); err != nil {
 		return err
 	}
 	labelOpts := []string{"level:s0"}
@@ -103,10 +94,7 @@ func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) error {
 	if err != nil {
 		return fmt.Errorf("%s: %s", parent, err)
 	}
-	if err := CopyWithTar(parentDir, dir); err != nil {
-		return err
-	}
-	return nil
+	return CopyWithTar(parentDir, dir)
 }
 
 func (d *Driver) dir(id string) string {
diff --git a/components/engine/daemon/graphdriver/windows/windows.go b/components/engine/daemon/graphdriver/windows/windows.go
index 441621f6eb..a722078e35 100644
--- a/components/engine/daemon/graphdriver/windows/windows.go
+++ b/components/engine/daemon/graphdriver/windows/windows.go
@@ -94,6 +94,10 @@ func InitFilter(home string, options []string, uidMaps, gidMaps []idtools.IDMap)
 		return nil, fmt.Errorf("%s is on an ReFS volume - ReFS volumes are not supported", home)
 	}
 
+	if err := idtools.MkdirAllAs(home, 0700, 0, 0); err != nil {
+		return nil, fmt.Errorf("windowsfilter failed to create '%s': %v", home, err)
+	}
+
 	d := &Driver{
 		info: hcsshim.DriverInfo{
 			HomeDir: home,
@@ -149,8 +153,19 @@ func (d *Driver) Status() [][2]string {
 	}
 }
 
+// panicIfUsedByLcow does exactly what it says.
+// TODO @jhowardmsft - this is an temporary measure for the bring-up of
+// Linux containers on Windows. It is a failsafe to ensure that the right
+// graphdriver is used.
+func panicIfUsedByLcow() {
+	if system.LCOWSupported() {
+		panic("inconsistency - windowsfilter graphdriver should not be used when in LCOW mode")
+	}
+}
+
 // Exists returns true if the given id is registered with this driver.
 func (d *Driver) Exists(id string) bool {
+	panicIfUsedByLcow()
 	rID, err := d.resolveID(id)
 	if err != nil {
 		return false
@@ -165,6 +180,7 @@ func (d *Driver) Exists(id string) bool {
 // CreateReadWrite creates a layer that is writable for use as a container
 // file system.
 func (d *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts) error {
+	panicIfUsedByLcow()
 	if opts != nil {
 		return d.create(id, parent, opts.MountLabel, false, opts.StorageOpt)
 	}
@@ -173,6 +189,7 @@ func (d *Driver) CreateReadWrite(id, parent string, opts *graphdriver.CreateOpts
 
 // Create creates a new read-only layer with the given id.
 func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) error {
+	panicIfUsedByLcow()
 	if opts != nil {
 		return d.create(id, parent, opts.MountLabel, true, opts.StorageOpt)
 	}
@@ -256,6 +273,7 @@ func (d *Driver) dir(id string) string {
 
 // Remove unmounts and removes the dir information.
 func (d *Driver) Remove(id string) error {
+	panicIfUsedByLcow()
 	rID, err := d.resolveID(id)
 	if err != nil {
 		return err
@@ -337,6 +355,7 @@ func (d *Driver) Remove(id string) error {
 
 // Get returns the rootfs path for the id. This will mount the dir at its given path.
 func (d *Driver) Get(id, mountLabel string) (string, error) {
+	panicIfUsedByLcow()
 	logrus.Debugf("WindowsGraphDriver Get() id %s mountLabel %s", id, mountLabel)
 	var dir string
 
@@ -395,6 +414,7 @@ func (d *Driver) Get(id, mountLabel string) (string, error) {
 
 // Put adds a new layer to the driver.
 func (d *Driver) Put(id string) error {
+	panicIfUsedByLcow()
 	logrus.Debugf("WindowsGraphDriver Put() id %s", id)
 
 	rID, err := d.resolveID(id)
@@ -424,7 +444,6 @@ func (d *Driver) Put(id string) error {
 // We use this opportunity to cleanup any -removing folders which may be
 // still left if the daemon was killed while it was removing a layer.
 func (d *Driver) Cleanup() error {
-
 	items, err := ioutil.ReadDir(d.info.HomeDir)
 	if err != nil {
 		if os.IsNotExist(err) {
@@ -454,6 +473,7 @@ func (d *Driver) Cleanup() error {
 // layer and its parent layer which may be "".
 // The layer should be mounted when calling this function
 func (d *Driver) Diff(id, parent string) (_ io.ReadCloser, err error) {
+	panicIfUsedByLcow()
 	rID, err := d.resolveID(id)
 	if err != nil {
 		return
@@ -490,6 +510,7 @@ func (d *Driver) Diff(id, parent string) (_ io.ReadCloser, err error) {
 // and its parent layer. If parent is "", then all changes will be ADD changes.
 // The layer should not be mounted when calling this function.
 func (d *Driver) Changes(id, parent string) ([]archive.Change, error) {
+	panicIfUsedByLcow()
 	rID, err := d.resolveID(id)
 	if err != nil {
 		return nil, err
@@ -545,6 +566,7 @@ func (d *Driver) Changes(id, parent string) ([]archive.Change, error) {
 // new layer in bytes.
 // The layer should not be mounted when calling this function
 func (d *Driver) ApplyDiff(id, parent string, diff io.Reader) (int64, error) {
+	panicIfUsedByLcow()
 	var layerChain []string
 	if parent != "" {
 		rPId, err := d.resolveID(parent)
@@ -579,6 +601,7 @@ func (d *Driver) ApplyDiff(id, parent string, diff io.Reader) (int64, error) {
 // and its parent and returns the size in bytes of the changes
 // relative to its base filesystem directory.
 func (d *Driver) DiffSize(id, parent string) (size int64, err error) {
+	panicIfUsedByLcow()
 	rPId, err := d.resolveID(parent)
 	if err != nil {
 		return
@@ -600,6 +623,7 @@ func (d *Driver) DiffSize(id, parent string) (size int64, err error) {
 
 // GetMetadata returns custom driver information.
 func (d *Driver) GetMetadata(id string) (map[string]string, error) {
+	panicIfUsedByLcow()
 	m := make(map[string]string)
 	m["dir"] = d.dir(id)
 	return m, nil
@@ -902,6 +926,7 @@ func (fg *fileGetCloserWithBackupPrivileges) Close() error {
 // DiffGetter returns a FileGetCloser that can read files from the directory that
 // contains files for the layer differences. Used for direct access for tar-split.
 func (d *Driver) DiffGetter(id string) (graphdriver.FileGetCloser, error) {
+	panicIfUsedByLcow()
 	id, err := d.resolveID(id)
 	if err != nil {
 		return nil, err
diff --git a/components/engine/daemon/health.go b/components/engine/daemon/health.go
index 48cf4c4255..00528db2ae 100644
--- a/components/engine/daemon/health.go
+++ b/components/engine/daemon/health.go
@@ -167,6 +167,13 @@ func handleProbeResult(d *Daemon, c *container.Container, result *types.Healthch
 		// Else we're starting or healthy. Stay in that state.
 	}
 
+	// replicate Health status changes
+	if err := c.CheckpointTo(d.containersReplica); err != nil {
+		// queries will be inconsistent until the next probe runs or other state mutations
+		// checkpoint the container
+		logrus.Errorf("Error replicating health state for container %s: %v", c.ID, err)
+	}
+
 	if oldStatus != h.Status {
 		d.LogContainerEvent(c, "health_status: "+h.Status)
 	}
diff --git a/components/engine/daemon/health_test.go b/components/engine/daemon/health_test.go
index fbbdf06c52..4fd89140d3 100644
--- a/components/engine/daemon/health_test.go
+++ b/components/engine/daemon/health_test.go
@@ -19,19 +19,23 @@ func reset(c *container.Container) {
 
 func TestNoneHealthcheck(t *testing.T) {
 	c := &container.Container{
-		CommonContainer: container.CommonContainer{
-			ID:   "container_id",
-			Name: "container_name",
-			Config: &containertypes.Config{
-				Image: "image_name",
-				Healthcheck: &containertypes.HealthConfig{
-					Test: []string{"NONE"},
-				},
+		ID:   "container_id",
+		Name: "container_name",
+		Config: &containertypes.Config{
+			Image: "image_name",
+			Healthcheck: &containertypes.HealthConfig{
+				Test: []string{"NONE"},
 			},
-			State: &container.State{},
 		},
+		State: &container.State{},
+	}
+	store, err := container.NewViewDB()
+	if err != nil {
+		t.Fatal(err)
+	}
+	daemon := &Daemon{
+		containersReplica: store,
 	}
-	daemon := &Daemon{}
 
 	daemon.initHealthMonitor(c)
 	if c.State.Health != nil {
@@ -58,16 +62,21 @@ func TestHealthStates(t *testing.T) {
 	}
 
 	c := &container.Container{
-		CommonContainer: container.CommonContainer{
-			ID:   "container_id",
-			Name: "container_name",
-			Config: &containertypes.Config{
-				Image: "image_name",
-			},
+		ID:   "container_id",
+		Name: "container_name",
+		Config: &containertypes.Config{
+			Image: "image_name",
 		},
 	}
+
+	store, err := container.NewViewDB()
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	daemon := &Daemon{
-		EventsService: e,
+		EventsService:     e,
+		containersReplica: store,
 	}
 
 	c.Config.Healthcheck = &containertypes.HealthConfig{
diff --git a/components/engine/daemon/image.go b/components/engine/daemon/image.go
index d10457118f..a51049dbb5 100644
--- a/components/engine/daemon/image.go
+++ b/components/engine/daemon/image.go
@@ -21,37 +21,43 @@ func (e ErrImageDoesNotExist) Error() string {
 	return fmt.Sprintf("No such image: %s", reference.FamiliarString(ref))
 }
 
-// GetImageID returns an image ID corresponding to the image referred to by
+// GetImageIDAndPlatform returns an image ID and platform corresponding to the image referred to by
 // refOrID.
-func (daemon *Daemon) GetImageID(refOrID string) (image.ID, error) {
+func (daemon *Daemon) GetImageIDAndPlatform(refOrID string) (image.ID, string, error) {
 	ref, err := reference.ParseAnyReference(refOrID)
 	if err != nil {
-		return "", err
+		return "", "", err
 	}
 	namedRef, ok := ref.(reference.Named)
 	if !ok {
 		digested, ok := ref.(reference.Digested)
 		if !ok {
-			return "", ErrImageDoesNotExist{ref}
+			return "", "", ErrImageDoesNotExist{ref}
 		}
 		id := image.IDFromDigest(digested.Digest())
-		if _, err := daemon.imageStore.Get(id); err != nil {
-			return "", ErrImageDoesNotExist{ref}
+		for platform := range daemon.stores {
+			if _, err = daemon.stores[platform].imageStore.Get(id); err == nil {
+				return id, platform, nil
+			}
 		}
-		return id, nil
+		return "", "", ErrImageDoesNotExist{ref}
 	}
 
-	if id, err := daemon.referenceStore.Get(namedRef); err == nil {
-		return image.IDFromDigest(id), nil
+	for platform := range daemon.stores {
+		if id, err := daemon.stores[platform].referenceStore.Get(namedRef); err == nil {
+			return image.IDFromDigest(id), platform, nil
+		}
 	}
 
 	// deprecated: repo:shortid https://github.com/docker/docker/pull/799
 	if tagged, ok := namedRef.(reference.Tagged); ok {
 		if tag := tagged.Tag(); stringid.IsShortID(stringid.TruncateID(tag)) {
-			if id, err := daemon.imageStore.Search(tag); err == nil {
-				for _, storeRef := range daemon.referenceStore.References(id.Digest()) {
-					if storeRef.Name() == namedRef.Name() {
-						return id, nil
+			for platform := range daemon.stores {
+				if id, err := daemon.stores[platform].imageStore.Search(tag); err == nil {
+					for _, storeRef := range daemon.stores[platform].referenceStore.References(id.Digest()) {
+						if storeRef.Name() == namedRef.Name() {
+							return id, platform, nil
+						}
 					}
 				}
 			}
@@ -59,18 +65,20 @@ func (daemon *Daemon) GetImageID(refOrID string) (image.ID, error) {
 	}
 
 	// Search based on ID
-	if id, err := daemon.imageStore.Search(refOrID); err == nil {
-		return id, nil
+	for platform := range daemon.stores {
+		if id, err := daemon.stores[platform].imageStore.Search(refOrID); err == nil {
+			return id, platform, nil
+		}
 	}
 
-	return "", ErrImageDoesNotExist{ref}
+	return "", "", ErrImageDoesNotExist{ref}
 }
 
 // GetImage returns an image corresponding to the image referred to by refOrID.
 func (daemon *Daemon) GetImage(refOrID string) (*image.Image, error) {
-	imgID, err := daemon.GetImageID(refOrID)
+	imgID, platform, err := daemon.GetImageIDAndPlatform(refOrID)
 	if err != nil {
 		return nil, err
 	}
-	return daemon.imageStore.Get(imgID)
+	return daemon.stores[platform].imageStore.Get(imgID)
 }
diff --git a/components/engine/daemon/image_delete.go b/components/engine/daemon/image_delete.go
index b7dbd249eb..4e228594bc 100644
--- a/components/engine/daemon/image_delete.go
+++ b/components/engine/daemon/image_delete.go
@@ -65,12 +65,12 @@ func (daemon *Daemon) ImageDelete(imageRef string, force, prune bool) ([]types.I
 	start := time.Now()
 	records := []types.ImageDeleteResponseItem{}
 
-	imgID, err := daemon.GetImageID(imageRef)
+	imgID, platform, err := daemon.GetImageIDAndPlatform(imageRef)
 	if err != nil {
 		return nil, daemon.imageNotExistToErrcode(err)
 	}
 
-	repoRefs := daemon.referenceStore.References(imgID.Digest())
+	repoRefs := daemon.stores[platform].referenceStore.References(imgID.Digest())
 
 	var removedRepositoryRef bool
 	if !isImageIDPrefix(imgID.String(), imageRef) {
@@ -94,7 +94,7 @@ func (daemon *Daemon) ImageDelete(imageRef string, force, prune bool) ([]types.I
 			return nil, err
 		}
 
-		parsedRef, err = daemon.removeImageRef(parsedRef)
+		parsedRef, err = daemon.removeImageRef(platform, parsedRef)
 		if err != nil {
 			return nil, err
 		}
@@ -104,7 +104,7 @@ func (daemon *Daemon) ImageDelete(imageRef string, force, prune bool) ([]types.I
 		daemon.LogImageEvent(imgID.String(), imgID.String(), "untag")
 		records = append(records, untaggedRecord)
 
-		repoRefs = daemon.referenceStore.References(imgID.Digest())
+		repoRefs = daemon.stores[platform].referenceStore.References(imgID.Digest())
 
 		// If a tag reference was removed and the only remaining
 		// references to the same repository are digest references,
@@ -122,7 +122,7 @@ func (daemon *Daemon) ImageDelete(imageRef string, force, prune bool) ([]types.I
 				remainingRefs := []reference.Named{}
 				for _, repoRef := range repoRefs {
 					if _, repoRefIsCanonical := repoRef.(reference.Canonical); repoRefIsCanonical && parsedRef.Name() == repoRef.Name() {
-						if _, err := daemon.removeImageRef(repoRef); err != nil {
+						if _, err := daemon.removeImageRef(platform, repoRef); err != nil {
 							return records, err
 						}
 
@@ -152,12 +152,12 @@ func (daemon *Daemon) ImageDelete(imageRef string, force, prune bool) ([]types.I
 			if !force {
 				c |= conflictSoft &^ conflictActiveReference
 			}
-			if conflict := daemon.checkImageDeleteConflict(imgID, c); conflict != nil {
+			if conflict := daemon.checkImageDeleteConflict(imgID, platform, c); conflict != nil {
 				return nil, conflict
 			}
 
 			for _, repoRef := range repoRefs {
-				parsedRef, err := daemon.removeImageRef(repoRef)
+				parsedRef, err := daemon.removeImageRef(platform, repoRef)
 				if err != nil {
 					return nil, err
 				}
@@ -170,7 +170,7 @@ func (daemon *Daemon) ImageDelete(imageRef string, force, prune bool) ([]types.I
 		}
 	}
 
-	if err := daemon.imageDeleteHelper(imgID, &records, force, prune, removedRepositoryRef); err != nil {
+	if err := daemon.imageDeleteHelper(imgID, platform, &records, force, prune, removedRepositoryRef); err != nil {
 		return nil, err
 	}
 
@@ -231,13 +231,13 @@ func (daemon *Daemon) getContainerUsingImage(imageID image.ID) *container.Contai
 // repositoryRef must not be an image ID but a repository name followed by an
 // optional tag or digest reference. If tag or digest is omitted, the default
 // tag is used. Returns the resolved image reference and an error.
-func (daemon *Daemon) removeImageRef(ref reference.Named) (reference.Named, error) {
+func (daemon *Daemon) removeImageRef(platform string, ref reference.Named) (reference.Named, error) {
 	ref = reference.TagNameOnly(ref)
 
 	// Ignore the boolean value returned, as far as we're concerned, this
 	// is an idempotent operation and it's okay if the reference didn't
 	// exist in the first place.
-	_, err := daemon.referenceStore.Delete(ref)
+	_, err := daemon.stores[platform].referenceStore.Delete(ref)
 
 	return ref, err
 }
@@ -247,11 +247,11 @@ func (daemon *Daemon) removeImageRef(ref reference.Named) (reference.Named, erro
 // on the first encountered error. Removed references are logged to this
 // daemon's event service. An "Untagged" types.ImageDeleteResponseItem is added to the
 // given list of records.
-func (daemon *Daemon) removeAllReferencesToImageID(imgID image.ID, records *[]types.ImageDeleteResponseItem) error {
-	imageRefs := daemon.referenceStore.References(imgID.Digest())
+func (daemon *Daemon) removeAllReferencesToImageID(imgID image.ID, platform string, records *[]types.ImageDeleteResponseItem) error {
+	imageRefs := daemon.stores[platform].referenceStore.References(imgID.Digest())
 
 	for _, imageRef := range imageRefs {
-		parsedRef, err := daemon.removeImageRef(imageRef)
+		parsedRef, err := daemon.removeImageRef(platform, imageRef)
 		if err != nil {
 			return err
 		}
@@ -296,15 +296,15 @@ func (idc *imageDeleteConflict) Error() string {
 // conflict is encountered, it will be returned immediately without deleting
 // the image. If quiet is true, any encountered conflicts will be ignored and
 // the function will return nil immediately without deleting the image.
-func (daemon *Daemon) imageDeleteHelper(imgID image.ID, records *[]types.ImageDeleteResponseItem, force, prune, quiet bool) error {
+func (daemon *Daemon) imageDeleteHelper(imgID image.ID, platform string, records *[]types.ImageDeleteResponseItem, force, prune, quiet bool) error {
 	// First, determine if this image has any conflicts. Ignore soft conflicts
 	// if force is true.
 	c := conflictHard
 	if !force {
 		c |= conflictSoft
 	}
-	if conflict := daemon.checkImageDeleteConflict(imgID, c); conflict != nil {
-		if quiet && (!daemon.imageIsDangling(imgID) || conflict.used) {
+	if conflict := daemon.checkImageDeleteConflict(imgID, platform, c); conflict != nil {
+		if quiet && (!daemon.imageIsDangling(imgID, platform) || conflict.used) {
 			// Ignore conflicts UNLESS the image is "dangling" or not being used in
 			// which case we want the user to know.
 			return nil
@@ -315,18 +315,18 @@ func (daemon *Daemon) imageDeleteHelper(imgID image.ID, records *[]types.ImageDe
 		return conflict
 	}
 
-	parent, err := daemon.imageStore.GetParent(imgID)
+	parent, err := daemon.stores[platform].imageStore.GetParent(imgID)
 	if err != nil {
 		// There may be no parent
 		parent = ""
 	}
 
 	// Delete all repository tag/digest references to this image.
-	if err := daemon.removeAllReferencesToImageID(imgID, records); err != nil {
+	if err := daemon.removeAllReferencesToImageID(imgID, platform, records); err != nil {
 		return err
 	}
 
-	removedLayers, err := daemon.imageStore.Delete(imgID)
+	removedLayers, err := daemon.stores[platform].imageStore.Delete(imgID)
 	if err != nil {
 		return err
 	}
@@ -346,7 +346,7 @@ func (daemon *Daemon) imageDeleteHelper(imgID image.ID, records *[]types.ImageDe
 	// either running or stopped).
 	// Do not force prunings, but do so quietly (stopping on any encountered
 	// conflicts).
-	return daemon.imageDeleteHelper(parent, records, false, true, true)
+	return daemon.imageDeleteHelper(parent, platform, records, false, true, true)
 }
 
 // checkImageDeleteConflict determines whether there are any conflicts
@@ -355,9 +355,9 @@ func (daemon *Daemon) imageDeleteHelper(imgID image.ID, records *[]types.ImageDe
 // using the image. A soft conflict is any tags/digest referencing the given
 // image or any stopped container using the image. If ignoreSoftConflicts is
 // true, this function will not check for soft conflict conditions.
-func (daemon *Daemon) checkImageDeleteConflict(imgID image.ID, mask conflictType) *imageDeleteConflict {
+func (daemon *Daemon) checkImageDeleteConflict(imgID image.ID, platform string, mask conflictType) *imageDeleteConflict {
 	// Check if the image has any descendant images.
-	if mask&conflictDependentChild != 0 && len(daemon.imageStore.Children(imgID)) > 0 {
+	if mask&conflictDependentChild != 0 && len(daemon.stores[platform].imageStore.Children(imgID)) > 0 {
 		return &imageDeleteConflict{
 			hard:    true,
 			imgID:   imgID,
@@ -381,7 +381,7 @@ func (daemon *Daemon) checkImageDeleteConflict(imgID image.ID, mask conflictType
 	}
 
 	// Check if any repository tags/digest reference this image.
-	if mask&conflictActiveReference != 0 && len(daemon.referenceStore.References(imgID.Digest())) > 0 {
+	if mask&conflictActiveReference != 0 && len(daemon.stores[platform].referenceStore.References(imgID.Digest())) > 0 {
 		return &imageDeleteConflict{
 			imgID:   imgID,
 			message: "image is referenced in multiple repositories",
@@ -408,6 +408,6 @@ func (daemon *Daemon) checkImageDeleteConflict(imgID image.ID, mask conflictType
 // imageIsDangling returns whether the given image is "dangling" which means
 // that there are no repository references to the given image and it has no
 // child images.
-func (daemon *Daemon) imageIsDangling(imgID image.ID) bool {
-	return !(len(daemon.referenceStore.References(imgID.Digest())) > 0 || len(daemon.imageStore.Children(imgID)) > 0)
+func (daemon *Daemon) imageIsDangling(imgID image.ID, platform string) bool {
+	return !(len(daemon.stores[platform].referenceStore.References(imgID.Digest())) > 0 || len(daemon.stores[platform].imageStore.Children(imgID)) > 0)
 }
diff --git a/components/engine/daemon/image_exporter.go b/components/engine/daemon/image_exporter.go
index 95d1d3dcdb..edac775d43 100644
--- a/components/engine/daemon/image_exporter.go
+++ b/components/engine/daemon/image_exporter.go
@@ -2,8 +2,10 @@ package daemon
 
 import (
 	"io"
+	"runtime"
 
 	"github.com/docker/docker/image/tarexport"
+	"github.com/docker/docker/pkg/system"
 )
 
 // ExportImage exports a list of images to the given output stream. The
@@ -12,7 +14,12 @@ import (
 // the same tag are exported. names is the set of tags to export, and
 // outStream is the writer which the images are written to.
 func (daemon *Daemon) ExportImage(names []string, outStream io.Writer) error {
-	imageExporter := tarexport.NewTarExporter(daemon.imageStore, daemon.layerStore, daemon.referenceStore, daemon)
+	// TODO @jhowardmsft LCOW. This will need revisiting later.
+	platform := runtime.GOOS
+	if platform == "windows" && system.LCOWSupported() {
+		platform = "linux"
+	}
+	imageExporter := tarexport.NewTarExporter(daemon.stores[platform].imageStore, daemon.stores[platform].layerStore, daemon.stores[platform].referenceStore, daemon)
 	return imageExporter.Save(names, outStream)
 }
 
@@ -20,6 +27,11 @@ func (daemon *Daemon) ExportImage(names []string, outStream io.Writer) error {
 // complement of ImageExport.  The input stream is an uncompressed tar
 // ball containing images and metadata.
 func (daemon *Daemon) LoadImage(inTar io.ReadCloser, outStream io.Writer, quiet bool) error {
-	imageExporter := tarexport.NewTarExporter(daemon.imageStore, daemon.layerStore, daemon.referenceStore, daemon)
+	// TODO @jhowardmsft LCOW. This will need revisiting later.
+	platform := runtime.GOOS
+	if platform == "windows" && system.LCOWSupported() {
+		platform = "linux"
+	}
+	imageExporter := tarexport.NewTarExporter(daemon.stores[platform].imageStore, daemon.stores[platform].layerStore, daemon.stores[platform].referenceStore, daemon)
 	return imageExporter.Load(inTar, outStream, quiet)
 }
diff --git a/components/engine/daemon/image_history.go b/components/engine/daemon/image_history.go
index b763c86c03..c9e81554e9 100644
--- a/components/engine/daemon/image_history.go
+++ b/components/engine/daemon/image_history.go
@@ -2,6 +2,7 @@ package daemon
 
 import (
 	"fmt"
+	"runtime"
 	"time"
 
 	"github.com/docker/distribution/reference"
@@ -18,6 +19,12 @@ func (daemon *Daemon) ImageHistory(name string) ([]*image.HistoryResponseItem, e
 		return nil, err
 	}
 
+	// If the image OS isn't set, assume it's the host OS
+	platform := img.OS
+	if platform == "" {
+		platform = runtime.GOOS
+	}
+
 	history := []*image.HistoryResponseItem{}
 
 	layerCounter := 0
@@ -33,12 +40,12 @@ func (daemon *Daemon) ImageHistory(name string) ([]*image.HistoryResponseItem, e
 			}
 
 			rootFS.Append(img.RootFS.DiffIDs[layerCounter])
-			l, err := daemon.layerStore.Get(rootFS.ChainID())
+			l, err := daemon.stores[platform].layerStore.Get(rootFS.ChainID())
 			if err != nil {
 				return nil, err
 			}
 			layerSize, err = l.DiffSize()
-			layer.ReleaseAndLog(daemon.layerStore, l)
+			layer.ReleaseAndLog(daemon.stores[platform].layerStore, l)
 			if err != nil {
 				return nil, err
 			}
@@ -62,7 +69,7 @@ func (daemon *Daemon) ImageHistory(name string) ([]*image.HistoryResponseItem, e
 		h.ID = id.String()
 
 		var tags []string
-		for _, r := range daemon.referenceStore.References(id.Digest()) {
+		for _, r := range daemon.stores[platform].referenceStore.References(id.Digest()) {
 			if _, ok := r.(reference.NamedTagged); ok {
 				tags = append(tags, reference.FamiliarString(r))
 			}
diff --git a/components/engine/daemon/image_inspect.go b/components/engine/daemon/image_inspect.go
index 267a41946a..672a4cc012 100644
--- a/components/engine/daemon/image_inspect.go
+++ b/components/engine/daemon/image_inspect.go
@@ -1,6 +1,7 @@
 package daemon
 
 import (
+	"runtime"
 	"time"
 
 	"github.com/docker/distribution/reference"
@@ -17,7 +18,13 @@ func (daemon *Daemon) LookupImage(name string) (*types.ImageInspect, error) {
 		return nil, errors.Wrapf(err, "no such image: %s", name)
 	}
 
-	refs := daemon.referenceStore.References(img.ID().Digest())
+	// If the image OS isn't set, assume it's the host OS
+	platform := img.OS
+	if platform == "" {
+		platform = runtime.GOOS
+	}
+
+	refs := daemon.stores[platform].referenceStore.References(img.ID().Digest())
 	repoTags := []string{}
 	repoDigests := []string{}
 	for _, ref := range refs {
@@ -33,11 +40,11 @@ func (daemon *Daemon) LookupImage(name string) (*types.ImageInspect, error) {
 	var layerMetadata map[string]string
 	layerID := img.RootFS.ChainID()
 	if layerID != "" {
-		l, err := daemon.layerStore.Get(layerID)
+		l, err := daemon.stores[platform].layerStore.Get(layerID)
 		if err != nil {
 			return nil, err
 		}
-		defer layer.ReleaseAndLog(daemon.layerStore, l)
+		defer layer.ReleaseAndLog(daemon.stores[platform].layerStore, l)
 		size, err = l.Size()
 		if err != nil {
 			return nil, err
@@ -67,15 +74,14 @@ func (daemon *Daemon) LookupImage(name string) (*types.ImageInspect, error) {
 		Author:          img.Author,
 		Config:          img.Config,
 		Architecture:    img.Architecture,
-		Os:              img.OS,
+		Os:              platform,
 		OsVersion:       img.OSVersion,
 		Size:            size,
 		VirtualSize:     size, // TODO: field unused, deprecate
 		RootFS:          rootFSToAPIType(img.RootFS),
 	}
 
-	imageInspect.GraphDriver.Name = daemon.GraphDriverName()
-
+	imageInspect.GraphDriver.Name = daemon.GraphDriverName(platform)
 	imageInspect.GraphDriver.Data = layerMetadata
 
 	return imageInspect, nil
diff --git a/components/engine/daemon/image_pull.go b/components/engine/daemon/image_pull.go
index 304fd9f024..abc81ec67c 100644
--- a/components/engine/daemon/image_pull.go
+++ b/components/engine/daemon/image_pull.go
@@ -2,6 +2,7 @@ package daemon
 
 import (
 	"io"
+	"runtime"
 	"strings"
 
 	dist "github.com/docker/distribution"
@@ -17,7 +18,7 @@ import (
 
 // PullImage initiates a pull operation. image is the repository name to pull, and
 // tag may be either empty, or indicate a specific tag to pull.
-func (daemon *Daemon) PullImage(ctx context.Context, image, tag string, metaHeaders map[string][]string, authConfig *types.AuthConfig, outStream io.Writer) error {
+func (daemon *Daemon) PullImage(ctx context.Context, image, tag, platform string, metaHeaders map[string][]string, authConfig *types.AuthConfig, outStream io.Writer) error {
 	// Special case: "pull -a" may send an image name with a
 	// trailing :. This is ugly, but let's not break API
 	// compatibility.
@@ -42,10 +43,10 @@ func (daemon *Daemon) PullImage(ctx context.Context, image, tag string, metaHead
 		}
 	}
 
-	return daemon.pullImageWithReference(ctx, ref, metaHeaders, authConfig, outStream)
+	return daemon.pullImageWithReference(ctx, ref, platform, metaHeaders, authConfig, outStream)
 }
 
-func (daemon *Daemon) pullImageWithReference(ctx context.Context, ref reference.Named, metaHeaders map[string][]string, authConfig *types.AuthConfig, outStream io.Writer) error {
+func (daemon *Daemon) pullImageWithReference(ctx context.Context, ref reference.Named, platform string, metaHeaders map[string][]string, authConfig *types.AuthConfig, outStream io.Writer) error {
 	// Include a buffer so that slow client connections don't affect
 	// transfer performance.
 	progressChan := make(chan progress.Progress, 100)
@@ -59,6 +60,11 @@ func (daemon *Daemon) pullImageWithReference(ctx context.Context, ref reference.
 		close(writesDone)
 	}()
 
+	// Default to the host OS platform in case it hasn't been populated with an explicit value.
+	if platform == "" {
+		platform = runtime.GOOS
+	}
+
 	imagePullConfig := &distribution.ImagePullConfig{
 		Config: distribution.Config{
 			MetaHeaders:      metaHeaders,
@@ -66,12 +72,13 @@ func (daemon *Daemon) pullImageWithReference(ctx context.Context, ref reference.
 			ProgressOutput:   progress.ChanOutput(progressChan),
 			RegistryService:  daemon.RegistryService,
 			ImageEventLogger: daemon.LogImageEvent,
-			MetadataStore:    daemon.distributionMetadataStore,
-			ImageStore:       distribution.NewImageConfigStoreFromStore(daemon.imageStore),
-			ReferenceStore:   daemon.referenceStore,
+			MetadataStore:    daemon.stores[platform].distributionMetadataStore,
+			ImageStore:       distribution.NewImageConfigStoreFromStore(daemon.stores[platform].imageStore),
+			ReferenceStore:   daemon.stores[platform].referenceStore,
 		},
 		DownloadManager: daemon.downloadManager,
 		Schema2Types:    distribution.ImageTypes,
+		Platform:        platform,
 	}
 
 	err := distribution.Pull(ctx, ref, imagePullConfig)
diff --git a/components/engine/daemon/image_push.go b/components/engine/daemon/image_push.go
index 0f060d117f..b1d15454fb 100644
--- a/components/engine/daemon/image_push.go
+++ b/components/engine/daemon/image_push.go
@@ -2,6 +2,7 @@ package daemon
 
 import (
 	"io"
+	"runtime"
 
 	"github.com/docker/distribution/manifest/schema2"
 	"github.com/docker/distribution/reference"
@@ -9,6 +10,7 @@ import (
 	"github.com/docker/docker/distribution"
 	progressutils "github.com/docker/docker/distribution/utils"
 	"github.com/docker/docker/pkg/progress"
+	"github.com/docker/docker/pkg/system"
 	"golang.org/x/net/context"
 )
 
@@ -39,6 +41,12 @@ func (daemon *Daemon) PushImage(ctx context.Context, image, tag string, metaHead
 		close(writesDone)
 	}()
 
+	// TODO @jhowardmsft LCOW Support. This will require revisiting. For now, hard-code.
+	platform := runtime.GOOS
+	if platform == "windows" && system.LCOWSupported() {
+		platform = "linux"
+	}
+
 	imagePushConfig := &distribution.ImagePushConfig{
 		Config: distribution.Config{
 			MetaHeaders:      metaHeaders,
@@ -46,12 +54,12 @@ func (daemon *Daemon) PushImage(ctx context.Context, image, tag string, metaHead
 			ProgressOutput:   progress.ChanOutput(progressChan),
 			RegistryService:  daemon.RegistryService,
 			ImageEventLogger: daemon.LogImageEvent,
-			MetadataStore:    daemon.distributionMetadataStore,
-			ImageStore:       distribution.NewImageConfigStoreFromStore(daemon.imageStore),
-			ReferenceStore:   daemon.referenceStore,
+			MetadataStore:    daemon.stores[platform].distributionMetadataStore,
+			ImageStore:       distribution.NewImageConfigStoreFromStore(daemon.stores[platform].imageStore),
+			ReferenceStore:   daemon.stores[platform].referenceStore,
 		},
 		ConfigMediaType: schema2.MediaTypeImageConfig,
-		LayerStore:      distribution.NewLayerProviderFromStore(daemon.layerStore),
+		LayerStore:      distribution.NewLayerProviderFromStore(daemon.stores[platform].layerStore),
 		TrustKey:        daemon.trustKey,
 		UploadManager:   daemon.uploadManager,
 	}
diff --git a/components/engine/daemon/image_tag.go b/components/engine/daemon/image_tag.go
index 10a584b361..199ca9ad84 100644
--- a/components/engine/daemon/image_tag.go
+++ b/components/engine/daemon/image_tag.go
@@ -8,7 +8,7 @@ import (
 // TagImage creates the tag specified by newTag, pointing to the image named
 // imageName (alternatively, imageName can also be an image ID).
 func (daemon *Daemon) TagImage(imageName, repository, tag string) error {
-	imageID, err := daemon.GetImageID(imageName)
+	imageID, platform, err := daemon.GetImageIDAndPlatform(imageName)
 	if err != nil {
 		return err
 	}
@@ -23,12 +23,12 @@ func (daemon *Daemon) TagImage(imageName, repository, tag string) error {
 		}
 	}
 
-	return daemon.TagImageWithReference(imageID, newTag)
+	return daemon.TagImageWithReference(imageID, platform, newTag)
 }
 
 // TagImageWithReference adds the given reference to the image ID provided.
-func (daemon *Daemon) TagImageWithReference(imageID image.ID, newTag reference.Named) error {
-	if err := daemon.referenceStore.AddTag(newTag, imageID.Digest(), true); err != nil {
+func (daemon *Daemon) TagImageWithReference(imageID image.ID, platform string, newTag reference.Named) error {
+	if err := daemon.stores[platform].referenceStore.AddTag(newTag, imageID.Digest(), true); err != nil {
 		return err
 	}
 
diff --git a/components/engine/daemon/images.go b/components/engine/daemon/images.go
index b014fd4887..6e29cae4d0 100644
--- a/components/engine/daemon/images.go
+++ b/components/engine/daemon/images.go
@@ -3,6 +3,7 @@ package daemon
 import (
 	"encoding/json"
 	"fmt"
+	"runtime"
 	"sort"
 	"time"
 
@@ -14,6 +15,7 @@ import (
 	"github.com/docker/docker/container"
 	"github.com/docker/docker/image"
 	"github.com/docker/docker/layer"
+	"github.com/docker/docker/pkg/system"
 )
 
 var acceptedImageFilterTags = map[string]bool{
@@ -34,7 +36,12 @@ func (r byCreated) Less(i, j int) bool { return r[i].Created < r[j].Created }
 
 // Map returns a map of all images in the ImageStore
 func (daemon *Daemon) Map() map[image.ID]*image.Image {
-	return daemon.imageStore.Map()
+	// TODO @jhowardmsft LCOW. This will need  work to enumerate the stores for all platforms.
+	platform := runtime.GOOS
+	if platform == "windows" && system.LCOWSupported() {
+		platform = "linux"
+	}
+	return daemon.stores[platform].imageStore.Map()
 }
 
 // Images returns a filtered list of images. filterArgs is a JSON-encoded set
@@ -43,6 +50,13 @@ func (daemon *Daemon) Map() map[image.ID]*image.Image {
 // named all controls whether all images in the graph are filtered, or just
 // the heads.
 func (daemon *Daemon) Images(imageFilters filters.Args, all bool, withExtraAttrs bool) ([]*types.ImageSummary, error) {
+
+	// TODO @jhowardmsft LCOW. This will need  work to enumerate the stores for all platforms.
+	platform := runtime.GOOS
+	if platform == "windows" && system.LCOWSupported() {
+		platform = "linux"
+	}
+
 	var (
 		allImages    map[image.ID]*image.Image
 		err          error
@@ -61,9 +75,9 @@ func (daemon *Daemon) Images(imageFilters filters.Args, all bool, withExtraAttrs
 		}
 	}
 	if danglingOnly {
-		allImages = daemon.imageStore.Heads()
+		allImages = daemon.stores[platform].imageStore.Heads()
 	} else {
-		allImages = daemon.imageStore.Map()
+		allImages = daemon.stores[platform].imageStore.Map()
 	}
 
 	var beforeFilter, sinceFilter *image.Image
@@ -116,7 +130,7 @@ func (daemon *Daemon) Images(imageFilters filters.Args, all bool, withExtraAttrs
 		layerID := img.RootFS.ChainID()
 		var size int64
 		if layerID != "" {
-			l, err := daemon.layerStore.Get(layerID)
+			l, err := daemon.stores[platform].layerStore.Get(layerID)
 			if err != nil {
 				// The layer may have been deleted between the call to `Map()` or
 				// `Heads()` and the call to `Get()`, so we just ignore this error
@@ -127,7 +141,7 @@ func (daemon *Daemon) Images(imageFilters filters.Args, all bool, withExtraAttrs
 			}
 
 			size, err = l.Size()
-			layer.ReleaseAndLog(daemon.layerStore, l)
+			layer.ReleaseAndLog(daemon.stores[platform].layerStore, l)
 			if err != nil {
 				return nil, err
 			}
@@ -135,7 +149,7 @@ func (daemon *Daemon) Images(imageFilters filters.Args, all bool, withExtraAttrs
 
 		newImage := newImage(img, size)
 
-		for _, ref := range daemon.referenceStore.References(id.Digest()) {
+		for _, ref := range daemon.stores[platform].referenceStore.References(id.Digest()) {
 			if imageFilters.Include("reference") {
 				var found bool
 				var matchErr error
@@ -157,7 +171,7 @@ func (daemon *Daemon) Images(imageFilters filters.Args, all bool, withExtraAttrs
 			}
 		}
 		if newImage.RepoDigests == nil && newImage.RepoTags == nil {
-			if all || len(daemon.imageStore.Children(id)) == 0 {
+			if all || len(daemon.stores[platform].imageStore.Children(id)) == 0 {
 
 				if imageFilters.Include("dangling") && !danglingOnly {
 					//dangling=false case, so dangling image is not needed
@@ -179,7 +193,7 @@ func (daemon *Daemon) Images(imageFilters filters.Args, all bool, withExtraAttrs
 			// lazily init variables
 			if imagesMap == nil {
 				allContainers = daemon.List()
-				allLayers = daemon.layerStore.Map()
+				allLayers = daemon.stores[platform].layerStore.Map()
 				imagesMap = make(map[*image.Image]*types.ImageSummary)
 				layerRefs = make(map[layer.ChainID]int)
 			}
@@ -242,7 +256,16 @@ func (daemon *Daemon) Images(imageFilters filters.Args, all bool, withExtraAttrs
 // The existing image(s) is not destroyed.
 // If no parent is specified, a new image with the diff of all the specified image's layers merged into a new layer that has no parents.
 func (daemon *Daemon) SquashImage(id, parent string) (string, error) {
-	img, err := daemon.imageStore.Get(image.ID(id))
+
+	var (
+		img *image.Image
+		err error
+	)
+	for _, ds := range daemon.stores {
+		if img, err = ds.imageStore.Get(image.ID(id)); err == nil {
+			break
+		}
+	}
 	if err != nil {
 		return "", err
 	}
@@ -250,7 +273,7 @@ func (daemon *Daemon) SquashImage(id, parent string) (string, error) {
 	var parentImg *image.Image
 	var parentChainID layer.ChainID
 	if len(parent) != 0 {
-		parentImg, err = daemon.imageStore.Get(image.ID(parent))
+		parentImg, err = daemon.stores[img.Platform()].imageStore.Get(image.ID(parent))
 		if err != nil {
 			return "", errors.Wrap(err, "error getting specified parent layer")
 		}
@@ -260,11 +283,11 @@ func (daemon *Daemon) SquashImage(id, parent string) (string, error) {
 		parentImg = &image.Image{RootFS: rootFS}
 	}
 
-	l, err := daemon.layerStore.Get(img.RootFS.ChainID())
+	l, err := daemon.stores[img.Platform()].layerStore.Get(img.RootFS.ChainID())
 	if err != nil {
 		return "", errors.Wrap(err, "error getting image layer")
 	}
-	defer daemon.layerStore.Release(l)
+	defer daemon.stores[img.Platform()].layerStore.Release(l)
 
 	ts, err := l.TarStreamFrom(parentChainID)
 	if err != nil {
@@ -272,11 +295,11 @@ func (daemon *Daemon) SquashImage(id, parent string) (string, error) {
 	}
 	defer ts.Close()
 
-	newL, err := daemon.layerStore.Register(ts, parentChainID)
+	newL, err := daemon.stores[img.Platform()].layerStore.Register(ts, parentChainID, layer.Platform(img.Platform()))
 	if err != nil {
 		return "", errors.Wrap(err, "error registering layer")
 	}
-	defer daemon.layerStore.Release(newL)
+	defer daemon.stores[img.Platform()].layerStore.Release(newL)
 
 	var newImage image.Image
 	newImage = *img
@@ -313,7 +336,7 @@ func (daemon *Daemon) SquashImage(id, parent string) (string, error) {
 		return "", errors.Wrap(err, "error marshalling image config")
 	}
 
-	newImgID, err := daemon.imageStore.Create(b)
+	newImgID, err := daemon.stores[img.Platform()].imageStore.Create(b)
 	if err != nil {
 		return "", errors.Wrap(err, "error creating new image after squash")
 	}
diff --git a/components/engine/daemon/import.go b/components/engine/daemon/import.go
index 17b9d870a3..0409cd6bd6 100644
--- a/components/engine/daemon/import.go
+++ b/components/engine/daemon/import.go
@@ -12,11 +12,11 @@ import (
 	"github.com/docker/distribution/reference"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/builder/dockerfile"
+	"github.com/docker/docker/builder/remotecontext"
 	"github.com/docker/docker/dockerversion"
 	"github.com/docker/docker/image"
 	"github.com/docker/docker/layer"
 	"github.com/docker/docker/pkg/archive"
-	"github.com/docker/docker/pkg/httputils"
 	"github.com/docker/docker/pkg/progress"
 	"github.com/docker/docker/pkg/streamformatter"
 	"github.com/pkg/errors"
@@ -26,13 +26,18 @@ import (
 // inConfig (if src is "-"), or from a URI specified in src. Progress output is
 // written to outStream. Repository and tag names can optionally be given in
 // the repo and tag arguments, respectively.
-func (daemon *Daemon) ImportImage(src string, repository, tag string, msg string, inConfig io.ReadCloser, outStream io.Writer, changes []string) error {
+func (daemon *Daemon) ImportImage(src string, repository, platform string, tag string, msg string, inConfig io.ReadCloser, outStream io.Writer, changes []string) error {
 	var (
 		rc     io.ReadCloser
 		resp   *http.Response
 		newRef reference.Named
 	)
 
+	// Default the platform if not supplied.
+	if platform == "" {
+		platform = runtime.GOOS
+	}
+
 	if repository != "" {
 		var err error
 		newRef, err = reference.ParseNormalizedNamed(repository)
@@ -67,7 +72,7 @@ func (daemon *Daemon) ImportImage(src string, repository, tag string, msg string
 			return err
 		}
 
-		resp, err = httputils.Download(u.String())
+		resp, err = remotecontext.GetWithStatusError(u.String())
 		if err != nil {
 			return err
 		}
@@ -85,12 +90,11 @@ func (daemon *Daemon) ImportImage(src string, repository, tag string, msg string
 	if err != nil {
 		return err
 	}
-	// TODO: support windows baselayer?
-	l, err := daemon.layerStore.Register(inflatedLayerData, "")
+	l, err := daemon.stores[platform].layerStore.Register(inflatedLayerData, "", layer.Platform(platform))
 	if err != nil {
 		return err
 	}
-	defer layer.ReleaseAndLog(daemon.layerStore, l)
+	defer layer.ReleaseAndLog(daemon.stores[platform].layerStore, l)
 
 	created := time.Now().UTC()
 	imgConfig, err := json.Marshal(&image.Image{
@@ -98,7 +102,7 @@ func (daemon *Daemon) ImportImage(src string, repository, tag string, msg string
 			DockerVersion: dockerversion.Version,
 			Config:        config,
 			Architecture:  runtime.GOARCH,
-			OS:            runtime.GOOS,
+			OS:            platform,
 			Created:       created,
 			Comment:       msg,
 		},
@@ -115,14 +119,14 @@ func (daemon *Daemon) ImportImage(src string, repository, tag string, msg string
 		return err
 	}
 
-	id, err := daemon.imageStore.Create(imgConfig)
+	id, err := daemon.stores[platform].imageStore.Create(imgConfig)
 	if err != nil {
 		return err
 	}
 
 	// FIXME: connect with commit code and call refstore directly
 	if newRef != nil {
-		if err := daemon.TagImageWithReference(id, newRef); err != nil {
+		if err := daemon.TagImageWithReference(id, platform, newRef); err != nil {
 			return err
 		}
 	}
diff --git a/components/engine/daemon/info.go b/components/engine/daemon/info.go
index 2be4b395fa..a11775c2e9 100644
--- a/components/engine/daemon/info.go
+++ b/components/engine/daemon/info.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 	"runtime"
+	"strings"
 	"time"
 
 	"github.com/Sirupsen/logrus"
@@ -72,20 +73,37 @@ func (daemon *Daemon) SystemInfo() (*types.Info, error) {
 	if selinuxEnabled() {
 		securityOptions = append(securityOptions, "name=selinux")
 	}
-	uid, gid := daemon.GetRemappedUIDGID()
-	if uid != 0 || gid != 0 {
+	rootIDs := daemon.idMappings.RootPair()
+	if rootIDs.UID != 0 || rootIDs.GID != 0 {
 		securityOptions = append(securityOptions, "name=userns")
 	}
 
+	imageCount := 0
+	drivers := ""
+	for p, ds := range daemon.stores {
+		imageCount += len(ds.imageStore.Map())
+		drivers += daemon.GraphDriverName(p)
+		if len(daemon.stores) > 1 {
+			drivers += fmt.Sprintf(" (%s) ", p)
+		}
+	}
+
+	// TODO @jhowardmsft LCOW support. For now, hard-code the platform shown for the driver status
+	p := runtime.GOOS
+	if p == "windows" && system.LCOWSupported() {
+		p = "linux"
+	}
+
+	drivers = strings.TrimSpace(drivers)
 	v := &types.Info{
 		ID:                 daemon.ID,
 		Containers:         int(cRunning + cPaused + cStopped),
 		ContainersRunning:  int(cRunning),
 		ContainersPaused:   int(cPaused),
 		ContainersStopped:  int(cStopped),
-		Images:             len(daemon.imageStore.Map()),
-		Driver:             daemon.GraphDriverName(),
-		DriverStatus:       daemon.layerStore.DriverStatus(),
+		Images:             imageCount,
+		Driver:             drivers,
+		DriverStatus:       daemon.stores[p].layerStore.DriverStatus(),
 		Plugins:            daemon.showPluginsInfo(),
 		IPv4Forwarding:     !sysInfo.IPv4ForwardingDisabled,
 		BridgeNfIptables:   !sysInfo.BridgeNFCallIPTablesDisabled,
diff --git a/components/engine/daemon/info_unix.go b/components/engine/daemon/info_unix.go
index 5c387541b3..e816f8dff1 100644
--- a/components/engine/daemon/info_unix.go
+++ b/components/engine/daemon/info_unix.go
@@ -9,7 +9,6 @@ import (
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/api/types"
-	daemonconfig "github.com/docker/docker/daemon/config"
 	"github.com/docker/docker/dockerversion"
 	"github.com/docker/docker/pkg/sysinfo"
 	"github.com/pkg/errors"
@@ -38,7 +37,8 @@ func (daemon *Daemon) FillPlatformInfo(v *types.Info, sysInfo *sysinfo.SysInfo)
 	}
 
 	v.RuncCommit.Expected = dockerversion.RuncCommitID
-	if rv, err := exec.Command(DefaultRuntimeBinary, "--version").Output(); err == nil {
+	defaultRuntimeBinary := daemon.configStore.GetRuntime(daemon.configStore.GetDefaultRuntimeName()).Path
+	if rv, err := exec.Command(defaultRuntimeBinary, "--version").Output(); err == nil {
 		parts := strings.Split(strings.TrimSpace(string(rv)), "\n")
 		if len(parts) == 3 {
 			parts = strings.Split(parts[1], ": ")
@@ -48,23 +48,24 @@ func (daemon *Daemon) FillPlatformInfo(v *types.Info, sysInfo *sysinfo.SysInfo)
 		}
 
 		if v.RuncCommit.ID == "" {
-			logrus.Warnf("failed to retrieve %s version: unknown output format: %s", DefaultRuntimeBinary, string(rv))
+			logrus.Warnf("failed to retrieve %s version: unknown output format: %s", defaultRuntimeBinary, string(rv))
 			v.RuncCommit.ID = "N/A"
 		}
 	} else {
-		logrus.Warnf("failed to retrieve %s version: %v", DefaultRuntimeBinary, err)
+		logrus.Warnf("failed to retrieve %s version: %v", defaultRuntimeBinary, err)
 		v.RuncCommit.ID = "N/A"
 	}
 
-	if rv, err := exec.Command(daemonconfig.DefaultInitBinary, "--version").Output(); err == nil {
+	defaultInitBinary := daemon.configStore.GetInitPath()
+	if rv, err := exec.Command(defaultInitBinary, "--version").Output(); err == nil {
 		ver, err := parseInitVersion(string(rv))
 
 		if err != nil {
-			logrus.Warnf("failed to retrieve %s version: %s", daemonconfig.DefaultInitBinary, err)
+			logrus.Warnf("failed to retrieve %s version: %s", defaultInitBinary, err)
 		}
 		v.InitCommit = ver
 	} else {
-		logrus.Warnf("failed to retrieve %s version: %s", daemonconfig.DefaultInitBinary, err)
+		logrus.Warnf("failed to retrieve %s version: %s", defaultInitBinary, err)
 		v.InitCommit.ID = "N/A"
 	}
 }
diff --git a/components/engine/daemon/initlayer/setup_unix.go b/components/engine/daemon/initlayer/setup_unix.go
index e83c2751ed..cdd8973481 100644
--- a/components/engine/daemon/initlayer/setup_unix.go
+++ b/components/engine/daemon/initlayer/setup_unix.go
@@ -16,7 +16,7 @@ import (
 //
 // This extra layer is used by all containers as the top-most ro layer. It protects
 // the container from unwanted side-effects on the rw layer.
-func Setup(initLayer string, rootUID, rootGID int) error {
+func Setup(initLayer string, rootIDs idtools.IDPair) error {
 	for pth, typ := range map[string]string{
 		"/dev/pts":         "dir",
 		"/dev/shm":         "dir",
@@ -38,12 +38,12 @@ func Setup(initLayer string, rootUID, rootGID int) error {
 
 		if _, err := os.Stat(filepath.Join(initLayer, pth)); err != nil {
 			if os.IsNotExist(err) {
-				if err := idtools.MkdirAllNewAs(filepath.Join(initLayer, filepath.Dir(pth)), 0755, rootUID, rootGID); err != nil {
+				if err := idtools.MkdirAllAndChownNew(filepath.Join(initLayer, filepath.Dir(pth)), 0755, rootIDs); err != nil {
 					return err
 				}
 				switch typ {
 				case "dir":
-					if err := idtools.MkdirAllNewAs(filepath.Join(initLayer, pth), 0755, rootUID, rootGID); err != nil {
+					if err := idtools.MkdirAllAndChownNew(filepath.Join(initLayer, pth), 0755, rootIDs); err != nil {
 						return err
 					}
 				case "file":
@@ -51,7 +51,7 @@ func Setup(initLayer string, rootUID, rootGID int) error {
 					if err != nil {
 						return err
 					}
-					f.Chown(rootUID, rootGID)
+					f.Chown(rootIDs.UID, rootIDs.GID)
 					f.Close()
 				default:
 					if err := os.Symlink(typ, filepath.Join(initLayer, pth)); err != nil {
diff --git a/components/engine/daemon/initlayer/setup_windows.go b/components/engine/daemon/initlayer/setup_windows.go
index 48a9d71aa5..2b22f58b5e 100644
--- a/components/engine/daemon/initlayer/setup_windows.go
+++ b/components/engine/daemon/initlayer/setup_windows.go
@@ -2,12 +2,16 @@
 
 package initlayer
 
+import (
+	"github.com/docker/docker/pkg/idtools"
+)
+
 // Setup populates a directory with mountpoints suitable
 // for bind-mounting dockerinit into the container. The mountpoint is simply an
 // empty file at /.dockerinit
 //
 // This extra layer is used by all containers as the top-most ro layer. It protects
 // the container from unwanted side-effects on the rw layer.
-func Setup(initLayer string, rootUID, rootGID int) error {
+func Setup(initLayer string, rootIDs idtools.IDPair) error {
 	return nil
 }
diff --git a/components/engine/daemon/inspect.go b/components/engine/daemon/inspect.go
index 4eb1d091d3..47c1ba4184 100644
--- a/components/engine/daemon/inspect.go
+++ b/components/engine/daemon/inspect.go
@@ -51,7 +51,7 @@ func (daemon *Daemon) ContainerInspectCurrent(name string, size bool) (*types.Co
 		}
 	}
 
-	mountPoints := addMountPoints(container)
+	mountPoints := container.GetMountPoints()
 	networkSettings := &types.NetworkSettings{
 		NetworkSettingsBase: types.NetworkSettingsBase{
 			Bridge:                 container.NetworkSettings.Bridge,
@@ -104,7 +104,7 @@ func (daemon *Daemon) containerInspect120(name string) (*v1p20.ContainerJSON, er
 		return nil, err
 	}
 
-	mountPoints := addMountPoints(container)
+	mountPoints := container.GetMountPoints()
 	config := &v1p20.ContainerConfig{
 		Config:          container.Config,
 		MacAddress:      container.Config.MacAddress,
@@ -170,6 +170,7 @@ func (daemon *Daemon) getInspectData(container *container.Container) (*types.Con
 		Name:         container.Name,
 		RestartCount: container.RestartCount,
 		Driver:       container.Driver,
+		Platform:     container.Platform,
 		MountLabel:   container.MountLabel,
 		ProcessLabel: container.ProcessLabel,
 		ExecIDs:      container.GetExecIDs(),
diff --git a/components/engine/daemon/inspect_solaris.go b/components/engine/daemon/inspect_solaris.go
index 0e3dcc1119..0b275c1418 100644
--- a/components/engine/daemon/inspect_solaris.go
+++ b/components/engine/daemon/inspect_solaris.go
@@ -18,20 +18,6 @@ func (daemon *Daemon) containerInspectPre120(name string) (*v1p19.ContainerJSON,
 	return &v1p19.ContainerJSON{}, nil
 }
 
-func addMountPoints(container *container.Container) []types.MountPoint {
-	mountPoints := make([]types.MountPoint, 0, len(container.MountPoints))
-	for _, m := range container.MountPoints {
-		mountPoints = append(mountPoints, types.MountPoint{
-			Name:        m.Name,
-			Source:      m.Path(),
-			Destination: m.Destination,
-			Driver:      m.Driver,
-			RW:          m.RW,
-		})
-	}
-	return mountPoints
-}
-
 func inspectExecProcessConfig(e *exec.Config) *backend.ExecProcessConfig {
 	return &backend.ExecProcessConfig{
 		Tty:        e.Tty,
diff --git a/components/engine/daemon/inspect_unix.go b/components/engine/daemon/inspect_unix.go
index 8342f7cf98..bd28481e6a 100644
--- a/components/engine/daemon/inspect_unix.go
+++ b/components/engine/daemon/inspect_unix.go
@@ -64,23 +64,6 @@ func (daemon *Daemon) containerInspectPre120(name string) (*v1p19.ContainerJSON,
 	}, nil
 }
 
-func addMountPoints(container *container.Container) []types.MountPoint {
-	mountPoints := make([]types.MountPoint, 0, len(container.MountPoints))
-	for _, m := range container.MountPoints {
-		mountPoints = append(mountPoints, types.MountPoint{
-			Type:        m.Type,
-			Name:        m.Name,
-			Source:      m.Path(),
-			Destination: m.Destination,
-			Driver:      m.Driver,
-			Mode:        m.Mode,
-			RW:          m.RW,
-			Propagation: m.Propagation,
-		})
-	}
-	return mountPoints
-}
-
 func inspectExecProcessConfig(e *exec.Config) *backend.ExecProcessConfig {
 	return &backend.ExecProcessConfig{
 		Tty:        e.Tty,
diff --git a/components/engine/daemon/inspect_windows.go b/components/engine/daemon/inspect_windows.go
index b331c83ca3..5b12902dbc 100644
--- a/components/engine/daemon/inspect_windows.go
+++ b/components/engine/daemon/inspect_windows.go
@@ -12,21 +12,6 @@ func setPlatformSpecificContainerFields(container *container.Container, contJSON
 	return contJSONBase
 }
 
-func addMountPoints(container *container.Container) []types.MountPoint {
-	mountPoints := make([]types.MountPoint, 0, len(container.MountPoints))
-	for _, m := range container.MountPoints {
-		mountPoints = append(mountPoints, types.MountPoint{
-			Type:        m.Type,
-			Name:        m.Name,
-			Source:      m.Path(),
-			Destination: m.Destination,
-			Driver:      m.Driver,
-			RW:          m.RW,
-		})
-	}
-	return mountPoints
-}
-
 // containerInspectPre120 get containers for pre 1.20 APIs.
 func (daemon *Daemon) containerInspectPre120(name string) (*types.ContainerJSON, error) {
 	return daemon.ContainerInspectCurrent(name, false)
diff --git a/components/engine/daemon/kill.go b/components/engine/daemon/kill.go
index 72e716d098..a2220715a3 100644
--- a/components/engine/daemon/kill.go
+++ b/components/engine/daemon/kill.go
@@ -69,7 +69,7 @@ func (daemon *Daemon) killWithSignal(container *containerpkg.Container, sig int)
 		return errNotRunning{container.ID}
 	}
 
-	if container.Config.StopSignal != "" {
+	if container.Config.StopSignal != "" && syscall.Signal(sig) != syscall.SIGKILL {
 		containerStopSignal, err := signal.ParseSignal(container.Config.StopSignal)
 		if err != nil {
 			return err
diff --git a/components/engine/daemon/list.go b/components/engine/daemon/list.go
index 4d831460f2..870a7bda2d 100644
--- a/components/engine/daemon/list.go
+++ b/components/engine/daemon/list.go
@@ -10,7 +10,6 @@ import (
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
-	networktypes "github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/container"
 	"github.com/docker/docker/image"
 	"github.com/docker/docker/volume"
@@ -47,7 +46,7 @@ type iterationAction int
 
 // containerReducer represents a reducer for a container.
 // Returns the object to serialize by the api.
-type containerReducer func(*container.Container, *listContext) (*types.Container, error)
+type containerReducer func(*container.Snapshot, *listContext) (*types.Container, error)
 
 const (
 	// includeContainer is the action to include a container in the reducer.
@@ -83,9 +82,9 @@ type listContext struct {
 	exitAllowed []int
 
 	// beforeFilter is a filter to ignore containers that appear before the one given
-	beforeFilter *container.Container
+	beforeFilter *container.Snapshot
 	// sinceFilter is a filter to stop the filtering when the iterator arrive to the given container
-	sinceFilter *container.Container
+	sinceFilter *container.Snapshot
 
 	// taskFilter tells if we should filter based on wether a container is part of a task
 	taskFilter bool
@@ -101,21 +100,21 @@ type listContext struct {
 	*types.ContainerListOptions
 }
 
-// byContainerCreated is a temporary type used to sort a list of containers by creation time.
-type byContainerCreated []*container.Container
+// byCreatedDescending is a temporary type used to sort a list of containers by creation time.
+type byCreatedDescending []container.Snapshot
 
-func (r byContainerCreated) Len() int      { return len(r) }
-func (r byContainerCreated) Swap(i, j int) { r[i], r[j] = r[j], r[i] }
-func (r byContainerCreated) Less(i, j int) bool {
-	return r[i].Created.UnixNano() < r[j].Created.UnixNano()
+func (r byCreatedDescending) Len() int      { return len(r) }
+func (r byCreatedDescending) Swap(i, j int) { r[i], r[j] = r[j], r[i] }
+func (r byCreatedDescending) Less(i, j int) bool {
+	return r[j].CreatedAt.UnixNano() < r[i].CreatedAt.UnixNano()
 }
 
 // Containers returns the list of containers to show given the user's filtering.
 func (daemon *Daemon) Containers(config *types.ContainerListOptions) ([]*types.Container, error) {
-	return daemon.reduceContainers(config, daemon.transformContainer)
+	return daemon.reduceContainers(config, daemon.refreshImage)
 }
 
-func (daemon *Daemon) filterByNameIDMatches(ctx *listContext) []*container.Container {
+func (daemon *Daemon) filterByNameIDMatches(view container.View, ctx *listContext) ([]container.Snapshot, error) {
 	idSearch := false
 	names := ctx.filters.Get("name")
 	ids := ctx.filters.Get("id")
@@ -123,7 +122,9 @@ func (daemon *Daemon) filterByNameIDMatches(ctx *listContext) []*container.Conta
 		// if name or ID filters are not in use, return to
 		// standard behavior of walking the entire container
 		// list from the daemon's in-memory store
-		return daemon.List()
+		all, err := view.All()
+		sort.Sort(byCreatedDescending(all))
+		return all, err
 	}
 
 	// idSearch will determine if we limit name matching to the IDs
@@ -158,38 +159,46 @@ func (daemon *Daemon) filterByNameIDMatches(ctx *listContext) []*container.Conta
 		}
 	}
 
-	cntrs := make([]*container.Container, 0, len(matches))
+	cntrs := make([]container.Snapshot, 0, len(matches))
 	for id := range matches {
-		if c := daemon.containers.Get(id); c != nil {
-			cntrs = append(cntrs, c)
+		c, err := view.Get(id)
+		if err != nil {
+			return nil, err
+		}
+		if c != nil {
+			cntrs = append(cntrs, *c)
 		}
 	}
 
 	// Restore sort-order after filtering
 	// Created gives us nanosec resolution for sorting
-	sort.Sort(sort.Reverse(byContainerCreated(cntrs)))
+	sort.Sort(byCreatedDescending(cntrs))
 
-	return cntrs
+	return cntrs, nil
 }
 
 // reduceContainers parses the user's filtering options and generates the list of containers to return based on a reducer.
 func (daemon *Daemon) reduceContainers(config *types.ContainerListOptions, reducer containerReducer) ([]*types.Container, error) {
 	var (
+		view       = daemon.containersReplica.Snapshot(daemon.nameIndex)
 		containers = []*types.Container{}
 	)
 
-	ctx, err := daemon.foldFilter(config)
+	ctx, err := daemon.foldFilter(view, config)
 	if err != nil {
 		return nil, err
 	}
 
 	// fastpath to only look at a subset of containers if specific name
 	// or ID matches were provided by the user--otherwise we potentially
-	// end up locking and querying many more containers than intended
-	containerList := daemon.filterByNameIDMatches(ctx)
+	// end up querying many more containers than intended
+	containerList, err := daemon.filterByNameIDMatches(view, ctx)
+	if err != nil {
+		return nil, err
+	}
 
-	for _, container := range containerList {
-		t, err := daemon.reducePsContainer(container, ctx, reducer)
+	for i := range containerList {
+		t, err := daemon.reducePsContainer(&containerList[i], ctx, reducer)
 		if err != nil {
 			if err != errStopIteration {
 				return nil, err
@@ -206,23 +215,17 @@ func (daemon *Daemon) reduceContainers(config *types.ContainerListOptions, reduc
 }
 
 // reducePsContainer is the basic representation for a container as expected by the ps command.
-func (daemon *Daemon) reducePsContainer(container *container.Container, ctx *listContext, reducer containerReducer) (*types.Container, error) {
-	container.Lock()
-
+func (daemon *Daemon) reducePsContainer(container *container.Snapshot, ctx *listContext, reducer containerReducer) (*types.Container, error) {
 	// filter containers to return
-	action := includeContainerInList(container, ctx)
-	switch action {
+	switch includeContainerInList(container, ctx) {
 	case excludeContainer:
-		container.Unlock()
 		return nil, nil
 	case stopIteration:
-		container.Unlock()
 		return nil, errStopIteration
 	}
 
 	// transform internal container struct into api structs
 	newC, err := reducer(container, ctx)
-	container.Unlock()
 	if err != nil {
 		return nil, err
 	}
@@ -237,7 +240,7 @@ func (daemon *Daemon) reducePsContainer(container *container.Container, ctx *lis
 }
 
 // foldFilter generates the container filter based on the user's filtering options.
-func (daemon *Daemon) foldFilter(config *types.ContainerListOptions) (*listContext, error) {
+func (daemon *Daemon) foldFilter(view container.View, config *types.ContainerListOptions) (*listContext, error) {
 	psFilters := config.Filters
 
 	if err := psFilters.Validate(acceptedPsFilterTags); err != nil {
@@ -294,10 +297,10 @@ func (daemon *Daemon) foldFilter(config *types.ContainerListOptions) (*listConte
 		return nil, err
 	}
 
-	var beforeContFilter, sinceContFilter *container.Container
+	var beforeContFilter, sinceContFilter *container.Snapshot
 
 	err = psFilters.WalkValues("before", func(value string) error {
-		beforeContFilter, err = daemon.GetContainer(value)
+		beforeContFilter, err = view.Get(value)
 		return err
 	})
 	if err != nil {
@@ -305,7 +308,7 @@ func (daemon *Daemon) foldFilter(config *types.ContainerListOptions) (*listConte
 	}
 
 	err = psFilters.WalkValues("since", func(value string) error {
-		sinceContFilter, err = daemon.GetContainer(value)
+		sinceContFilter, err = view.Get(value)
 		return err
 	})
 	if err != nil {
@@ -317,7 +320,7 @@ func (daemon *Daemon) foldFilter(config *types.ContainerListOptions) (*listConte
 	if psFilters.Include("ancestor") {
 		ancestorFilter = true
 		psFilters.WalkValues("ancestor", func(ancestor string) error {
-			id, err := daemon.GetImageID(ancestor)
+			id, platform, err := daemon.GetImageIDAndPlatform(ancestor)
 			if err != nil {
 				logrus.Warnf("Error while looking up for image %v", ancestor)
 				return nil
@@ -327,7 +330,7 @@ func (daemon *Daemon) foldFilter(config *types.ContainerListOptions) (*listConte
 				return nil
 			}
 			// Then walk down the graph and put the imageIds in imagesFilter
-			populateImageFilterByParents(imagesFilter, id, daemon.imageStore.Children)
+			populateImageFilterByParents(imagesFilter, id, daemon.stores[platform].imageStore.Children)
 			return nil
 		})
 	}
@@ -383,7 +386,7 @@ func portOp(key string, filter map[nat.Port]bool) func(value string) error {
 
 // includeContainerInList decides whether a container should be included in the output or not based in the filter.
 // It also decides if the iteration should be stopped or not.
-func includeContainerInList(container *container.Container, ctx *listContext) iterationAction {
+func includeContainerInList(container *container.Snapshot, ctx *listContext) iterationAction {
 	// Do not include container if it's in the list before the filter container.
 	// Set the filter container to nil to include the rest of containers after this one.
 	if ctx.beforeFilter != nil {
@@ -422,7 +425,7 @@ func includeContainerInList(container *container.Container, ctx *listContext) it
 	}
 
 	// Do not include container if any of the labels don't match
-	if !ctx.filters.MatchKVList("label", container.Config.Labels) {
+	if !ctx.filters.MatchKVList("label", container.Labels) {
 		return excludeContainer
 	}
 
@@ -440,7 +443,7 @@ func includeContainerInList(container *container.Container, ctx *listContext) it
 	if len(ctx.exitAllowed) > 0 {
 		shouldSkip := true
 		for _, code := range ctx.exitAllowed {
-			if code == container.ExitCode() && !container.Running && !container.StartedAt.IsZero() {
+			if code == container.ExitCode && !container.Running && !container.StartedAt.IsZero() {
 				shouldSkip = false
 				break
 			}
@@ -451,28 +454,34 @@ func includeContainerInList(container *container.Container, ctx *listContext) it
 	}
 
 	// Do not include container if its status doesn't match the filter
-	if !ctx.filters.Match("status", container.State.StateString()) {
+	if !ctx.filters.Match("status", container.State) {
 		return excludeContainer
 	}
 
 	// Do not include container if its health doesn't match the filter
-	if !ctx.filters.ExactMatch("health", container.State.HealthString()) {
+	if !ctx.filters.ExactMatch("health", container.Health) {
 		return excludeContainer
 	}
 
 	if ctx.filters.Include("volume") {
-		volumesByName := make(map[string]*volume.MountPoint)
-		for _, m := range container.MountPoints {
+		volumesByName := make(map[string]types.MountPoint)
+		for _, m := range container.Mounts {
 			if m.Name != "" {
 				volumesByName[m.Name] = m
 			} else {
 				volumesByName[m.Source] = m
 			}
 		}
+		volumesByDestination := make(map[string]types.MountPoint)
+		for _, m := range container.Mounts {
+			if m.Destination != "" {
+				volumesByDestination[m.Destination] = m
+			}
+		}
 
 		volumeExist := fmt.Errorf("volume mounted in container")
 		err := ctx.filters.WalkValues("volume", func(value string) error {
-			if _, exist := container.MountPoints[value]; exist {
+			if _, exist := volumesByDestination[value]; exist {
 				return volumeExist
 			}
 			if _, exist := volumesByName[value]; exist {
@@ -489,19 +498,25 @@ func includeContainerInList(container *container.Container, ctx *listContext) it
 		if len(ctx.images) == 0 {
 			return excludeContainer
 		}
-		if !ctx.images[container.ImageID] {
+		if !ctx.images[image.ID(container.ImageID)] {
 			return excludeContainer
 		}
 	}
 
-	networkExist := fmt.Errorf("container part of network")
+	var (
+		networkExist = errors.New("container part of network")
+		noNetworks   = errors.New("container is not part of any networks")
+	)
 	if ctx.filters.Include("network") {
 		err := ctx.filters.WalkValues("network", func(value string) error {
+			if container.NetworkSettings == nil {
+				return noNetworks
+			}
 			if _, ok := container.NetworkSettings.Networks[value]; ok {
 				return networkExist
 			}
 			for _, nw := range container.NetworkSettings.Networks {
-				if nw.EndpointSettings == nil {
+				if nw == nil {
 					continue
 				}
 				if strings.HasPrefix(nw.NetworkID, value) {
@@ -518,7 +533,7 @@ func includeContainerInList(container *container.Container, ctx *listContext) it
 	if len(ctx.publish) > 0 {
 		shouldSkip := true
 		for port := range ctx.publish {
-			if _, ok := container.HostConfig.PortBindings[port]; ok {
+			if _, ok := container.PortBindings[port]; ok {
 				shouldSkip = false
 				break
 			}
@@ -531,7 +546,7 @@ func includeContainerInList(container *container.Container, ctx *listContext) it
 	if len(ctx.expose) > 0 {
 		shouldSkip := true
 		for port := range ctx.expose {
-			if _, ok := container.Config.ExposedPorts[port]; ok {
+			if _, ok := container.ExposedPorts[port]; ok {
 				shouldSkip = false
 				break
 			}
@@ -544,106 +559,22 @@ func includeContainerInList(container *container.Container, ctx *listContext) it
 	return includeContainer
 }
 
-// transformContainer generates the container type expected by the docker ps command.
-func (daemon *Daemon) transformContainer(container *container.Container, ctx *listContext) (*types.Container, error) {
-	newC := &types.Container{
-		ID:      container.ID,
-		Names:   ctx.names[container.ID],
-		ImageID: container.ImageID.String(),
-	}
-	if newC.Names == nil {
-		// Dead containers will often have no name, so make sure the response isn't null
-		newC.Names = []string{}
-	}
-
-	image := container.Config.Image // if possible keep the original ref
-	if image != container.ImageID.String() {
-		id, err := daemon.GetImageID(image)
+// refreshImage checks if the Image ref still points to the correct ID, and updates the ref to the actual ID when it doesn't
+func (daemon *Daemon) refreshImage(s *container.Snapshot, ctx *listContext) (*types.Container, error) {
+	c := s.Container
+	image := s.Image // keep the original ref if still valid (hasn't changed)
+	if image != s.ImageID {
+		id, _, err := daemon.GetImageIDAndPlatform(image)
 		if _, isDNE := err.(ErrImageDoesNotExist); err != nil && !isDNE {
 			return nil, err
 		}
-		if err != nil || id != container.ImageID {
-			image = container.ImageID.String()
+		if err != nil || id.String() != s.ImageID {
+			// ref changed, we need to use original ID
+			image = s.ImageID
 		}
 	}
-	newC.Image = image
-
-	if len(container.Args) > 0 {
-		args := []string{}
-		for _, arg := range container.Args {
-			if strings.Contains(arg, " ") {
-				args = append(args, fmt.Sprintf("'%s'", arg))
-			} else {
-				args = append(args, arg)
-			}
-		}
-		argsAsString := strings.Join(args, " ")
-
-		newC.Command = fmt.Sprintf("%s %s", container.Path, argsAsString)
-	} else {
-		newC.Command = container.Path
-	}
-	newC.Created = container.Created.Unix()
-	newC.State = container.State.StateString()
-	newC.Status = container.State.String()
-	newC.HostConfig.NetworkMode = string(container.HostConfig.NetworkMode)
-	// copy networks to avoid races
-	networks := make(map[string]*networktypes.EndpointSettings)
-	for name, network := range container.NetworkSettings.Networks {
-		if network == nil || network.EndpointSettings == nil {
-			continue
-		}
-		networks[name] = &networktypes.EndpointSettings{
-			EndpointID:          network.EndpointID,
-			Gateway:             network.Gateway,
-			IPAddress:           network.IPAddress,
-			IPPrefixLen:         network.IPPrefixLen,
-			IPv6Gateway:         network.IPv6Gateway,
-			GlobalIPv6Address:   network.GlobalIPv6Address,
-			GlobalIPv6PrefixLen: network.GlobalIPv6PrefixLen,
-			MacAddress:          network.MacAddress,
-			NetworkID:           network.NetworkID,
-		}
-		if network.IPAMConfig != nil {
-			networks[name].IPAMConfig = &networktypes.EndpointIPAMConfig{
-				IPv4Address: network.IPAMConfig.IPv4Address,
-				IPv6Address: network.IPAMConfig.IPv6Address,
-			}
-		}
-	}
-	newC.NetworkSettings = &types.SummaryNetworkSettings{Networks: networks}
-
-	newC.Ports = []types.Port{}
-	for port, bindings := range container.NetworkSettings.Ports {
-		p, err := nat.ParsePort(port.Port())
-		if err != nil {
-			return nil, err
-		}
-		if len(bindings) == 0 {
-			newC.Ports = append(newC.Ports, types.Port{
-				PrivatePort: uint16(p),
-				Type:        port.Proto(),
-			})
-			continue
-		}
-		for _, binding := range bindings {
-			h, err := nat.ParsePort(binding.HostPort)
-			if err != nil {
-				return nil, err
-			}
-			newC.Ports = append(newC.Ports, types.Port{
-				PrivatePort: uint16(p),
-				PublicPort:  uint16(h),
-				Type:        port.Proto(),
-				IP:          binding.HostIP,
-			})
-		}
-	}
-
-	newC.Labels = container.Config.Labels
-	newC.Mounts = addMountPoints(container)
-
-	return newC, nil
+	c.Image = image
+	return &c, nil
 }
 
 // Volumes lists known volumes, using the filter to restrict the range
diff --git a/components/engine/daemon/list_unix.go b/components/engine/daemon/list_unix.go
index 91c9caccf4..ebaae4560c 100644
--- a/components/engine/daemon/list_unix.go
+++ b/components/engine/daemon/list_unix.go
@@ -6,6 +6,6 @@ import "github.com/docker/docker/container"
 
 // excludeByIsolation is a platform specific helper function to support PS
 // filtering by Isolation. This is a Windows-only concept, so is a no-op on Unix.
-func excludeByIsolation(container *container.Container, ctx *listContext) iterationAction {
+func excludeByIsolation(container *container.Snapshot, ctx *listContext) iterationAction {
 	return includeContainer
 }
diff --git a/components/engine/daemon/list_windows.go b/components/engine/daemon/list_windows.go
index 7fbcd3af26..ab563c535f 100644
--- a/components/engine/daemon/list_windows.go
+++ b/components/engine/daemon/list_windows.go
@@ -8,7 +8,7 @@ import (
 
 // excludeByIsolation is a platform specific helper function to support PS
 // filtering by Isolation. This is a Windows-only concept, so is a no-op on Unix.
-func excludeByIsolation(container *container.Container, ctx *listContext) iterationAction {
+func excludeByIsolation(container *container.Snapshot, ctx *listContext) iterationAction {
 	i := strings.ToLower(string(container.HostConfig.Isolation))
 	if i == "" {
 		i = "default"
diff --git a/components/engine/daemon/logger/adapter.go b/components/engine/daemon/logger/adapter.go
index e6d7598b44..a187b30fdd 100644
--- a/components/engine/daemon/logger/adapter.go
+++ b/components/engine/daemon/logger/adapter.go
@@ -3,6 +3,7 @@ package logger
 import (
 	"io"
 	"os"
+	"strings"
 	"sync"
 	"time"
 
@@ -18,6 +19,7 @@ type pluginAdapter struct {
 	driverName   string
 	id           string
 	plugin       logPlugin
+	basePath     string
 	fifoPath     string
 	capabilities Capability
 	logInfo      Info
@@ -56,7 +58,7 @@ func (a *pluginAdapter) Close() error {
 	a.mu.Lock()
 	defer a.mu.Unlock()
 
-	if err := a.plugin.StopLogging(a.fifoPath); err != nil {
+	if err := a.plugin.StopLogging(strings.TrimPrefix(a.fifoPath, a.basePath)); err != nil {
 		return err
 	}
 
diff --git a/components/engine/daemon/logger/adapter_test.go b/components/engine/daemon/logger/adapter_test.go
index 707550e7e3..b8c069ffbe 100644
--- a/components/engine/daemon/logger/adapter_test.go
+++ b/components/engine/daemon/logger/adapter_test.go
@@ -1,17 +1,16 @@
 package logger
 
 import (
-	"bytes"
 	"encoding/binary"
 	"io"
 	"io/ioutil"
 	"os"
-	"runtime"
 	"testing"
 	"time"
 
 	"github.com/docker/docker/api/types/plugins/logdriver"
 	protoio "github.com/gogo/protobuf/io"
+	"github.com/stretchr/testify/assert"
 )
 
 // mockLoggingPlugin implements the loggingPlugin interface for testing purposes
@@ -89,9 +88,8 @@ func (l *mockLoggingPlugin) ReadLogs(info Info, config ReadConfig) (io.ReadClose
 func newMockPluginAdapter(t *testing.T) Logger {
 	r, w := io.Pipe()
 	f, err := ioutil.TempFile("", "mock-plugin-adapter")
-	if err != nil {
-		t.Fatal(err)
-	}
+	assert.NoError(t, err)
+
 	enc := logdriver.NewLogEntryEncoder(w)
 	a := &pluginAdapterWithRead{
 		&pluginAdapter{
@@ -118,15 +116,11 @@ func TestAdapterReadLogs(t *testing.T) {
 	}
 	for _, msg := range testMsg {
 		m := msg.copy()
-		if err := l.Log(m); err != nil {
-			t.Fatal(err)
-		}
+		assert.NoError(t, l.Log(m))
 	}
 
 	lr, ok := l.(LogReader)
-	if !ok {
-		t.Fatal("expected log reader")
-	}
+	assert.NotNil(t, ok)
 
 	lw := lr.ReadLogs(ReadConfig{})
 
@@ -134,16 +128,14 @@ func TestAdapterReadLogs(t *testing.T) {
 		select {
 		case msg := <-lw.Msg:
 			testMessageEqual(t, &x, msg)
-		case <-time.After(10 * time.Millisecond):
+		case <-time.After(10 * time.Second):
 			t.Fatal("timeout reading logs")
 		}
 	}
 
 	select {
 	case _, ok := <-lw.Msg:
-		if ok {
-			t.Fatal("expected message channel to be closed")
-		}
+		assert.False(t, ok, "expected message channel to be closed")
 	case <-time.After(10 * time.Second):
 		t.Fatal("timeout waiting for message channel to close")
 
@@ -161,16 +153,11 @@ func TestAdapterReadLogs(t *testing.T) {
 	}
 
 	x := Message{Line: []byte("Too infinity and beyond!"), Timestamp: time.Now()}
-
-	if err := l.Log(x.copy()); err != nil {
-		t.Fatal(err)
-	}
+	assert.NoError(t, l.Log(x.copy()))
 
 	select {
 	case msg, ok := <-lw.Msg:
-		if !ok {
-			t.Fatal("message channel unexpectedly closed")
-		}
+		assert.NotNil(t, ok, "message channel unexpectedly closed")
 		testMessageEqual(t, &x, msg)
 	case <-time.After(10 * time.Second):
 		t.Fatal("timeout reading logs")
@@ -179,30 +166,15 @@ func TestAdapterReadLogs(t *testing.T) {
 	l.Close()
 	select {
 	case msg, ok := <-lw.Msg:
-		if ok {
-			t.Fatal("expected message channel to be closed")
-		}
-		if msg != nil {
-			t.Fatal("expected nil message")
-		}
+		assert.False(t, ok, "expected message channel to be closed")
+		assert.Nil(t, msg)
 	case <-time.After(10 * time.Second):
 		t.Fatal("timeout waiting for logger to close")
 	}
 }
 
 func testMessageEqual(t *testing.T, a, b *Message) {
-	_, _, n, _ := runtime.Caller(1)
-	errFmt := "line %d: expected same messages:\nwant: %+v\nhave: %+v"
-
-	if !bytes.Equal(a.Line, b.Line) {
-		t.Fatalf(errFmt, n, *a, *b)
-	}
-
-	if a.Timestamp.UnixNano() != b.Timestamp.UnixNano() {
-		t.Fatalf(errFmt, n, *a, *b)
-	}
-
-	if a.Source != b.Source {
-		t.Fatalf(errFmt, n, *a, *b)
-	}
+	assert.Equal(t, a.Line, b.Line)
+	assert.Equal(t, a.Timestamp.UnixNano(), b.Timestamp.UnixNano())
+	assert.Equal(t, a.Source, b.Source)
 }
diff --git a/components/engine/pkg/ioutils/multireader.go b/components/engine/daemon/logger/jsonfilelog/multireader/multireader.go
similarity index 99%
rename from components/engine/pkg/ioutils/multireader.go
rename to components/engine/daemon/logger/jsonfilelog/multireader/multireader.go
index edb043ddc3..06a7307ce4 100644
--- a/components/engine/pkg/ioutils/multireader.go
+++ b/components/engine/daemon/logger/jsonfilelog/multireader/multireader.go
@@ -1,4 +1,4 @@
-package ioutils
+package multireader
 
 import (
 	"bytes"
diff --git a/components/engine/pkg/ioutils/multireader_test.go b/components/engine/daemon/logger/jsonfilelog/multireader/multireader_test.go
similarity index 99%
rename from components/engine/pkg/ioutils/multireader_test.go
rename to components/engine/daemon/logger/jsonfilelog/multireader/multireader_test.go
index 0604739897..bd59b78ca7 100644
--- a/components/engine/pkg/ioutils/multireader_test.go
+++ b/components/engine/daemon/logger/jsonfilelog/multireader/multireader_test.go
@@ -1,4 +1,4 @@
-package ioutils
+package multireader
 
 import (
 	"bytes"
diff --git a/components/engine/daemon/logger/jsonfilelog/read.go b/components/engine/daemon/logger/jsonfilelog/read.go
index 9f282eafbb..312aa551d0 100644
--- a/components/engine/daemon/logger/jsonfilelog/read.go
+++ b/components/engine/daemon/logger/jsonfilelog/read.go
@@ -14,8 +14,8 @@ import (
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/daemon/logger"
+	"github.com/docker/docker/daemon/logger/jsonfilelog/multireader"
 	"github.com/docker/docker/pkg/filenotify"
-	"github.com/docker/docker/pkg/ioutils"
 	"github.com/docker/docker/pkg/jsonlog"
 	"github.com/docker/docker/pkg/tailfile"
 )
@@ -77,7 +77,7 @@ func (l *JSONFileLogger) readLogs(logWatcher *logger.LogWatcher, config logger.R
 	defer latestFile.Close()
 
 	if config.Tail != 0 {
-		tailer := ioutils.MultiReadSeeker(append(files, latestFile)...)
+		tailer := multireader.MultiReadSeeker(append(files, latestFile)...)
 		tailFile(tailer, logWatcher, config.Tail, config.Since)
 	}
 
diff --git a/components/engine/daemon/logger/plugin.go b/components/engine/daemon/logger/plugin.go
index de618c5aea..bdccea5b21 100644
--- a/components/engine/daemon/logger/plugin.go
+++ b/components/engine/daemon/logger/plugin.go
@@ -59,6 +59,7 @@ func makePluginCreator(name string, l *logPluginProxy, basePath string) Creator
 			driverName: name,
 			id:         id,
 			plugin:     l,
+			basePath:   basePath,
 			fifoPath:   filepath.Join(root, id),
 			logInfo:    logCtx,
 		}
diff --git a/components/engine/daemon/monitor.go b/components/engine/daemon/monitor.go
index 6861a5c3c8..5156d9a8e1 100644
--- a/components/engine/daemon/monitor.go
+++ b/components/engine/daemon/monitor.go
@@ -39,6 +39,9 @@ func (daemon *Daemon) StateChanged(id string, e libcontainerd.StateInfo) error {
 			return errors.New("Received StateOOM from libcontainerd on Windows. This should never happen.")
 		}
 		daemon.updateHealthMonitor(c)
+		if err := c.CheckpointTo(daemon.containersReplica); err != nil {
+			return err
+		}
 		daemon.LogContainerEvent(c, "oom")
 	case libcontainerd.StateExit:
 
@@ -46,7 +49,8 @@ func (daemon *Daemon) StateChanged(id string, e libcontainerd.StateInfo) error {
 		c.StreamConfig.Wait()
 		c.Reset(false)
 
-		restart, wait, err := c.RestartManager().ShouldRestart(e.ExitCode, c.HasBeenManuallyStopped, time.Since(c.StartedAt))
+		// If daemon is being shutdown, don't let the container restart
+		restart, wait, err := c.RestartManager().ShouldRestart(e.ExitCode, daemon.IsShuttingDown() || c.HasBeenManuallyStopped, time.Since(c.StartedAt))
 		if err == nil && restart {
 			c.RestartCount++
 			c.SetRestarting(platformConstructExitStatus(e))
@@ -68,6 +72,10 @@ func (daemon *Daemon) StateChanged(id string, e libcontainerd.StateInfo) error {
 			go func() {
 				err := <-wait
 				if err == nil {
+					// daemon.netController is initialized when daemon is restoring containers.
+					// But containerStart will use daemon.netController segment.
+					// So to avoid panic at startup process, here must wait util daemon restore done.
+					daemon.waitForStartupDone()
 					if err = daemon.containerStart(c, "", "", false); err != nil {
 						logrus.Debugf("failed to restart container: %+v", err)
 					}
@@ -85,7 +93,7 @@ func (daemon *Daemon) StateChanged(id string, e libcontainerd.StateInfo) error {
 		daemon.setStateCounter(c)
 
 		defer c.Unlock()
-		if err := c.ToDisk(); err != nil {
+		if err := c.CheckpointTo(daemon.containersReplica); err != nil {
 			return err
 		}
 		return daemon.postRunProcessing(c, e)
@@ -114,30 +122,30 @@ func (daemon *Daemon) StateChanged(id string, e libcontainerd.StateInfo) error {
 		c.HasBeenStartedBefore = true
 		daemon.setStateCounter(c)
 
-		if err := c.ToDisk(); err != nil {
+		daemon.initHealthMonitor(c)
+		if err := c.CheckpointTo(daemon.containersReplica); err != nil {
 			c.Reset(false)
 			return err
 		}
-		daemon.initHealthMonitor(c)
 
 		daemon.LogContainerEvent(c, "start")
 	case libcontainerd.StatePause:
 		// Container is already locked in this case
 		c.Paused = true
 		daemon.setStateCounter(c)
-		if err := c.ToDisk(); err != nil {
+		daemon.updateHealthMonitor(c)
+		if err := c.CheckpointTo(daemon.containersReplica); err != nil {
 			return err
 		}
-		daemon.updateHealthMonitor(c)
 		daemon.LogContainerEvent(c, "pause")
 	case libcontainerd.StateResume:
 		// Container is already locked in this case
 		c.Paused = false
 		daemon.setStateCounter(c)
-		if err := c.ToDisk(); err != nil {
+		daemon.updateHealthMonitor(c)
+		if err := c.CheckpointTo(daemon.containersReplica); err != nil {
 			return err
 		}
-		daemon.updateHealthMonitor(c)
 		daemon.LogContainerEvent(c, "unpause")
 	}
 	return nil
diff --git a/components/engine/daemon/names.go b/components/engine/daemon/names.go
index 5ce16624ad..ec6ac2924f 100644
--- a/components/engine/daemon/names.go
+++ b/components/engine/daemon/names.go
@@ -30,10 +30,6 @@ func (daemon *Daemon) registerName(container *container.Container) error {
 			return err
 		}
 		container.Name = name
-
-		if err := container.ToDiskLocking(); err != nil {
-			logrus.Errorf("Error saving container name to disk: %v", err)
-		}
 	}
 	return daemon.nameIndex.Reserve(container.Name, container.ID)
 }
diff --git a/components/engine/daemon/oci_linux.go b/components/engine/daemon/oci_linux.go
index 55a6cd8ae0..6d74301a05 100644
--- a/components/engine/daemon/oci_linux.go
+++ b/components/engine/daemon/oci_linux.go
@@ -271,13 +271,13 @@ func setNamespaces(daemon *Daemon, s *specs.Spec, c *container.Container) error
 	userNS := false
 	// user
 	if c.HostConfig.UsernsMode.IsPrivate() {
-		uidMap, gidMap := daemon.GetUIDGIDMaps()
+		uidMap := daemon.idMappings.UIDs()
 		if uidMap != nil {
 			userNS = true
 			ns := specs.LinuxNamespace{Type: "user"}
 			setNamespace(s, ns)
 			s.Linux.UIDMappings = specMapping(uidMap)
-			s.Linux.GIDMappings = specMapping(gidMap)
+			s.Linux.GIDMappings = specMapping(daemon.idMappings.GIDs())
 		}
 	}
 	// network
@@ -591,7 +591,7 @@ func setMounts(daemon *Daemon, s *specs.Spec, c *container.Container, mounts []c
 
 	// TODO: until a kernel/mount solution exists for handling remount in a user namespace,
 	// we must clear the readonly flag for the cgroups mount (@mrunalp concurs)
-	if uidMap, _ := daemon.GetUIDGIDMaps(); uidMap != nil || c.HostConfig.Privileged {
+	if uidMap := daemon.idMappings.UIDs(); uidMap != nil || c.HostConfig.Privileged {
 		for i, m := range s.Mounts {
 			if m.Type == "cgroup" {
 				clearReadOnly(&s.Mounts[i])
@@ -611,8 +611,7 @@ func (daemon *Daemon) populateCommonSpec(s *specs.Spec, c *container.Container)
 		Path:     c.BaseFS,
 		Readonly: c.HostConfig.ReadonlyRootfs,
 	}
-	rootUID, rootGID := daemon.GetRemappedUIDGID()
-	if err := c.SetupWorkingDirectory(rootUID, rootGID); err != nil {
+	if err := c.SetupWorkingDirectory(daemon.idMappings.RootPair()); err != nil {
 		return err
 	}
 	cwd := c.Config.WorkingDir
diff --git a/components/engine/daemon/oci_solaris.go b/components/engine/daemon/oci_solaris.go
index 0c757f9196..610efe10a1 100644
--- a/components/engine/daemon/oci_solaris.go
+++ b/components/engine/daemon/oci_solaris.go
@@ -130,8 +130,7 @@ func (daemon *Daemon) populateCommonSpec(s *specs.Spec, c *container.Container)
 		Path:     filepath.Dir(c.BaseFS),
 		Readonly: c.HostConfig.ReadonlyRootfs,
 	}
-	rootUID, rootGID := daemon.GetRemappedUIDGID()
-	if err := c.SetupWorkingDirectory(rootUID, rootGID); err != nil {
+	if err := c.SetupWorkingDirectory(daemon.idMappings.RootPair()); err != nil {
 		return err
 	}
 	cwd := c.Config.WorkingDir
diff --git a/components/engine/daemon/oci_windows.go b/components/engine/daemon/oci_windows.go
index d180518faa..67e3473537 100644
--- a/components/engine/daemon/oci_windows.go
+++ b/components/engine/daemon/oci_windows.go
@@ -7,11 +7,17 @@ import (
 	"github.com/docker/docker/container"
 	"github.com/docker/docker/oci"
 	"github.com/docker/docker/pkg/sysinfo"
+	"github.com/docker/docker/pkg/system"
 	"github.com/opencontainers/runtime-spec/specs-go"
 )
 
 func (daemon *Daemon) createSpec(c *container.Container) (*specs.Spec, error) {
-	s := oci.DefaultSpec()
+	img, err := daemon.GetImage(string(c.ImageID))
+	if err != nil {
+		return nil, err
+	}
+
+	s := oci.DefaultOSSpec(img.OS)
 
 	linkedEnv, err := daemon.setupLinkedContainers(c)
 	if err != nil {
@@ -95,7 +101,30 @@ func (daemon *Daemon) createSpec(c *container.Container) (*specs.Spec, error) {
 	if !c.Config.ArgsEscaped {
 		s.Process.Args = escapeArgs(s.Process.Args)
 	}
+
 	s.Process.Cwd = c.Config.WorkingDir
+	s.Process.Env = c.CreateDaemonEnvironment(c.Config.Tty, linkedEnv)
+	if c.Config.Tty {
+		s.Process.Terminal = c.Config.Tty
+		s.Process.ConsoleSize.Height = c.HostConfig.ConsoleSize[0]
+		s.Process.ConsoleSize.Width = c.HostConfig.ConsoleSize[1]
+	}
+	s.Process.User.Username = c.Config.User
+
+	if img.OS == "windows" {
+		daemon.createSpecWindowsFields(c, &s, isHyperV)
+	} else {
+		// TODO @jhowardmsft LCOW Support. Modify this check when running in dual-mode
+		if system.LCOWSupported() && img.OS == "linux" {
+			daemon.createSpecLinuxFields(c, &s)
+		}
+	}
+
+	return (*specs.Spec)(&s), nil
+}
+
+// Sets the Windows-specific fields of the OCI spec
+func (daemon *Daemon) createSpecWindowsFields(c *container.Container, s *specs.Spec, isHyperV bool) {
 	if len(s.Process.Cwd) == 0 {
 		// We default to C:\ to workaround the oddity of the case that the
 		// default directory for cmd running as LocalSystem (or
@@ -106,17 +135,11 @@ func (daemon *Daemon) createSpec(c *container.Container) (*specs.Spec, error) {
 		// as c:\. Hence, setting it to default of c:\ makes for consistency.
 		s.Process.Cwd = `C:\`
 	}
-	s.Process.Env = c.CreateDaemonEnvironment(c.Config.Tty, linkedEnv)
-	s.Process.ConsoleSize.Height = c.HostConfig.ConsoleSize[0]
-	s.Process.ConsoleSize.Width = c.HostConfig.ConsoleSize[1]
-	s.Process.Terminal = c.Config.Tty
-	s.Process.User.Username = c.Config.User
 
-	// In spec.Root. This is not set for Hyper-V containers
-	if !isHyperV {
-		s.Root.Path = c.BaseFS
-	}
 	s.Root.Readonly = false // Windows does not support a read-only root filesystem
+	if !isHyperV {
+		s.Root.Path = c.BaseFS // This is not set for Hyper-V containers
+	}
 
 	// In s.Windows.Resources
 	cpuShares := uint16(c.HostConfig.CPUShares)
@@ -157,7 +180,17 @@ func (daemon *Daemon) createSpec(c *container.Container) (*specs.Spec, error) {
 			Iops: &c.HostConfig.IOMaximumIOps,
 		},
 	}
-	return (*specs.Spec)(&s), nil
+}
+
+// Sets the Linux-specific fields of the OCI spec
+// TODO: @jhowardmsft LCOW Support. We need to do a lot more pulling in what can
+// be pulled in from oci_linux.go.
+func (daemon *Daemon) createSpecLinuxFields(c *container.Container, s *specs.Spec) {
+	if len(s.Process.Cwd) == 0 {
+		s.Process.Cwd = `/`
+	}
+	s.Root.Path = "rootfs"
+	s.Root.Readonly = c.HostConfig.ReadonlyRootfs
 }
 
 func escapeArgs(args []string) []string {
diff --git a/components/engine/daemon/prune.go b/components/engine/daemon/prune.go
index 602de618c9..561ac1e01e 100644
--- a/components/engine/daemon/prune.go
+++ b/components/engine/daemon/prune.go
@@ -3,6 +3,7 @@ package daemon
 import (
 	"fmt"
 	"regexp"
+	"runtime"
 	"sync/atomic"
 	"time"
 
@@ -14,6 +15,7 @@ import (
 	"github.com/docker/docker/image"
 	"github.com/docker/docker/layer"
 	"github.com/docker/docker/pkg/directory"
+	"github.com/docker/docker/pkg/system"
 	"github.com/docker/docker/runconfig"
 	"github.com/docker/docker/volume"
 	"github.com/docker/libnetwork"
@@ -157,6 +159,12 @@ func (daemon *Daemon) VolumesPrune(ctx context.Context, pruneFilters filters.Arg
 
 // ImagesPrune removes unused images
 func (daemon *Daemon) ImagesPrune(ctx context.Context, pruneFilters filters.Args) (*types.ImagesPruneReport, error) {
+	// TODO @jhowardmsft LCOW Support: This will need revisiting later.
+	platform := runtime.GOOS
+	if platform == "windows" && system.LCOWSupported() {
+		platform = "linux"
+	}
+
 	if !atomic.CompareAndSwapInt32(&daemon.pruneRunning, 0, 1) {
 		return nil, errPruneRunning
 	}
@@ -186,9 +194,9 @@ func (daemon *Daemon) ImagesPrune(ctx context.Context, pruneFilters filters.Args
 
 	var allImages map[image.ID]*image.Image
 	if danglingOnly {
-		allImages = daemon.imageStore.Heads()
+		allImages = daemon.stores[platform].imageStore.Heads()
 	} else {
-		allImages = daemon.imageStore.Map()
+		allImages = daemon.stores[platform].imageStore.Map()
 	}
 	allContainers := daemon.List()
 	imageRefs := map[string]bool{}
@@ -202,7 +210,7 @@ func (daemon *Daemon) ImagesPrune(ctx context.Context, pruneFilters filters.Args
 	}
 
 	// Filter intermediary images and get their unique size
-	allLayers := daemon.layerStore.Map()
+	allLayers := daemon.stores[platform].layerStore.Map()
 	topImages := map[image.ID]*image.Image{}
 	for id, img := range allImages {
 		select {
@@ -210,7 +218,7 @@ func (daemon *Daemon) ImagesPrune(ctx context.Context, pruneFilters filters.Args
 			return nil, ctx.Err()
 		default:
 			dgst := digest.Digest(id)
-			if len(daemon.referenceStore.References(dgst)) == 0 && len(daemon.imageStore.Children(id)) != 0 {
+			if len(daemon.stores[platform].referenceStore.References(dgst)) == 0 && len(daemon.stores[platform].imageStore.Children(id)) != 0 {
 				continue
 			}
 			if !until.IsZero() && img.Created.After(until) {
@@ -241,7 +249,7 @@ deleteImagesLoop:
 		}
 
 		deletedImages := []types.ImageDeleteResponseItem{}
-		refs := daemon.referenceStore.References(dgst)
+		refs := daemon.stores[platform].referenceStore.References(dgst)
 		if len(refs) > 0 {
 			shouldDelete := !danglingOnly
 			if !shouldDelete {
diff --git a/components/engine/daemon/rename.go b/components/engine/daemon/rename.go
index 2770ead80c..ad21593c19 100644
--- a/components/engine/daemon/rename.go
+++ b/components/engine/daemon/rename.go
@@ -82,7 +82,7 @@ func (daemon *Daemon) ContainerRename(oldName, newName string) error {
 		daemon.nameIndex.Release(oldName + k)
 	}
 	daemon.releaseName(oldName)
-	if err = container.ToDisk(); err != nil {
+	if err = container.CheckpointTo(daemon.containersReplica); err != nil {
 		return err
 	}
 
@@ -99,7 +99,7 @@ func (daemon *Daemon) ContainerRename(oldName, newName string) error {
 		if err != nil {
 			container.Name = oldName
 			container.NetworkSettings.IsAnonymousEndpoint = oldIsAnonymousEndpoint
-			if e := container.ToDisk(); e != nil {
+			if e := container.CheckpointTo(daemon.containersReplica); e != nil {
 				logrus.Errorf("%s: Failed in writing to Disk on rename failure: %v", container.ID, e)
 			}
 		}
diff --git a/components/engine/daemon/restart.go b/components/engine/daemon/restart.go
index 79292f3752..9f2ef569af 100644
--- a/components/engine/daemon/restart.go
+++ b/components/engine/daemon/restart.go
@@ -52,7 +52,7 @@ func (daemon *Daemon) containerRestart(container *container.Container, seconds i
 		container.HostConfig.AutoRemove = autoRemove
 		// containerStop will write HostConfig to disk, we shall restore AutoRemove
 		// in disk too
-		if toDiskErr := container.ToDiskLocking(); toDiskErr != nil {
+		if toDiskErr := daemon.checkpointAndSave(container); toDiskErr != nil {
 			logrus.Errorf("Write container to disk error: %v", toDiskErr)
 		}
 
diff --git a/components/engine/daemon/start.go b/components/engine/daemon/start.go
index eddb5d3d50..8d938519c4 100644
--- a/components/engine/daemon/start.go
+++ b/components/engine/daemon/start.go
@@ -58,7 +58,7 @@ func (daemon *Daemon) ContainerStart(name string, hostConfig *containertypes.Hos
 				// if user has change the network mode on starting, clean up the
 				// old networks. It is a deprecated feature and has been removed in Docker 1.12
 				container.NetworkSettings.Networks = nil
-				if err := container.ToDisk(); err != nil {
+				if err := container.CheckpointTo(daemon.containersReplica); err != nil {
 					return err
 				}
 			}
@@ -86,11 +86,6 @@ func (daemon *Daemon) ContainerStart(name string, hostConfig *containertypes.Hos
 	return daemon.containerStart(container, checkpoint, checkpointDir, true)
 }
 
-// Start starts a container
-func (daemon *Daemon) Start(container *container.Container) error {
-	return daemon.containerStart(container, "", "", true)
-}
-
 // containerStart prepares the container to run by setting up everything the
 // container needs, such as storage and networking, as well as links
 // between containers. The container is left waiting for a signal to
@@ -117,8 +112,9 @@ func (daemon *Daemon) containerStart(container *container.Container, checkpoint
 			if container.ExitCode() == 0 {
 				container.SetExitCode(128)
 			}
-			container.ToDisk()
-
+			if err := container.CheckpointTo(daemon.containersReplica); err != nil {
+				logrus.Errorf("%s: failed saving state on start failure: %v", container.ID, err)
+			}
 			container.Reset(false)
 
 			daemon.Cleanup(container)
@@ -207,7 +203,7 @@ func (daemon *Daemon) Cleanup(container *container.Container) {
 	if err := daemon.conditionalUnmountOnCleanup(container); err != nil {
 		// FIXME: remove once reference counting for graphdrivers has been refactored
 		// Ensure that all the mounts are gone
-		if mountid, err := daemon.layerStore.GetMountID(container.ID); err == nil {
+		if mountid, err := daemon.stores[container.Platform].layerStore.GetMountID(container.ID); err == nil {
 			daemon.cleanupMountsByID(mountid)
 		}
 	}
diff --git a/components/engine/daemon/start_unix.go b/components/engine/daemon/start_unix.go
index 103cc73b86..12ecdab2db 100644
--- a/components/engine/daemon/start_unix.go
+++ b/components/engine/daemon/start_unix.go
@@ -9,13 +9,14 @@ import (
 	"github.com/docker/docker/libcontainerd"
 )
 
+// getLibcontainerdCreateOptions callers must hold a lock on the container
 func (daemon *Daemon) getLibcontainerdCreateOptions(container *container.Container) ([]libcontainerd.CreateOption, error) {
 	createOptions := []libcontainerd.CreateOption{}
 
 	// Ensure a runtime has been assigned to this container
 	if container.HostConfig.Runtime == "" {
 		container.HostConfig.Runtime = daemon.configStore.GetDefaultRuntimeName()
-		container.ToDisk()
+		container.CheckpointTo(daemon.containersReplica)
 	}
 
 	rt := daemon.configStore.GetRuntime(container.HostConfig.Runtime)
diff --git a/components/engine/daemon/start_windows.go b/components/engine/daemon/start_windows.go
index 2578c5f330..da70a16112 100644
--- a/components/engine/daemon/start_windows.go
+++ b/components/engine/daemon/start_windows.go
@@ -41,7 +41,7 @@ func (daemon *Daemon) getLibcontainerdCreateOptions(container *container.Contain
 	layerOpts.LayerFolderPath = m["dir"]
 
 	// Generate the layer paths of the layer options
-	img, err := daemon.imageStore.Get(container.ImageID)
+	img, err := daemon.stores[container.Platform].imageStore.Get(container.ImageID)
 	if err != nil {
 		return nil, fmt.Errorf("failed to graph.Get on ImageID %s - %s", container.ImageID, err)
 	}
@@ -49,9 +49,9 @@ func (daemon *Daemon) getLibcontainerdCreateOptions(container *container.Contain
 	max := len(img.RootFS.DiffIDs)
 	for i := 1; i <= max; i++ {
 		img.RootFS.DiffIDs = img.RootFS.DiffIDs[:i]
-		layerPath, err := layer.GetLayerPath(daemon.layerStore, img.RootFS.ChainID())
+		layerPath, err := layer.GetLayerPath(daemon.stores[container.Platform].layerStore, img.RootFS.ChainID())
 		if err != nil {
-			return nil, fmt.Errorf("failed to get layer path from graphdriver %s for ImageID %s - %s", daemon.layerStore, img.RootFS.ChainID(), err)
+			return nil, fmt.Errorf("failed to get layer path from graphdriver %s for ImageID %s - %s", daemon.stores[container.Platform].layerStore, img.RootFS.ChainID(), err)
 		}
 		// Reverse order, expecting parent most first
 		layerOpts.LayerPaths = append([]string{layerPath}, layerOpts.LayerPaths...)
diff --git a/components/engine/daemon/stats/collector_unix.go b/components/engine/daemon/stats/collector_unix.go
index 5ad9658690..cd522e07ce 100644
--- a/components/engine/daemon/stats/collector_unix.go
+++ b/components/engine/daemon/stats/collector_unix.go
@@ -72,7 +72,11 @@ func (s *Collector) getSystemCPUUsage() (uint64, error) {
 
 func (s *Collector) getNumberOnlineCPUs() (uint32, error) {
 	i, err := C.sysconf(C._SC_NPROCESSORS_ONLN)
-	if err != nil {
+	// According to POSIX - errno is undefined after successful
+	// sysconf, and can be non-zero in several cases, so look for
+	// error in returned value not in errno.
+	// (https://sourceware.org/bugzilla/show_bug.cgi?id=21536)
+	if i == -1 {
 		return 0, err
 	}
 	return uint32(i), nil
diff --git a/components/engine/daemon/update.go b/components/engine/daemon/update.go
index 76e4a3f93f..a65cbd51b1 100644
--- a/components/engine/daemon/update.go
+++ b/components/engine/daemon/update.go
@@ -38,7 +38,7 @@ func (daemon *Daemon) update(name string, hostConfig *container.HostConfig) erro
 		if restoreConfig {
 			container.Lock()
 			container.HostConfig = &backupHostConfig
-			container.ToDisk()
+			container.CheckpointTo(daemon.containersReplica)
 			container.Unlock()
 		}
 	}()
@@ -47,10 +47,18 @@ func (daemon *Daemon) update(name string, hostConfig *container.HostConfig) erro
 		return errCannotUpdate(container.ID, fmt.Errorf("Container is marked for removal and cannot be \"update\"."))
 	}
 
+	container.Lock()
 	if err := container.UpdateContainer(hostConfig); err != nil {
 		restoreConfig = true
+		container.Unlock()
 		return errCannotUpdate(container.ID, err)
 	}
+	if err := container.CheckpointTo(daemon.containersReplica); err != nil {
+		restoreConfig = true
+		container.Unlock()
+		return errCannotUpdate(container.ID, err)
+	}
+	container.Unlock()
 
 	// if Restart Policy changed, we need to update container monitor
 	if hostConfig.RestartPolicy.Name != "" {
diff --git a/components/engine/daemon/volumes_unix.go b/components/engine/daemon/volumes_unix.go
index 29dffa9ea0..0a4cbf8493 100644
--- a/components/engine/daemon/volumes_unix.go
+++ b/components/engine/daemon/volumes_unix.go
@@ -6,6 +6,7 @@ package daemon
 
 import (
 	"encoding/json"
+	"fmt"
 	"os"
 	"path/filepath"
 	"sort"
@@ -42,8 +43,18 @@ func (daemon *Daemon) setupMounts(c *container.Container) ([]container.Mount, er
 		if err := daemon.lazyInitializeVolume(c.ID, m); err != nil {
 			return nil, err
 		}
-		rootUID, rootGID := daemon.GetRemappedUIDGID()
-		path, err := m.Setup(c.MountLabel, rootUID, rootGID)
+		// If the daemon is being shutdown, we should not let a container start if it is trying to
+		// mount the socket the daemon is listening on. During daemon shutdown, the socket
+		// (/var/run/docker.sock by default) doesn't exist anymore causing the call to m.Setup to
+		// create at directory instead. This in turn will prevent the daemon to restart.
+		checkfunc := func(m *volume.MountPoint) error {
+			if _, exist := daemon.hosts[m.Source]; exist && daemon.IsShuttingDown() {
+				return fmt.Errorf("Could not mount %q to container while the daemon is shutting down", m.Source)
+			}
+			return nil
+		}
+
+		path, err := m.Setup(c.MountLabel, daemon.idMappings.RootPair(), checkfunc)
 		if err != nil {
 			return nil, err
 		}
@@ -73,9 +84,9 @@ func (daemon *Daemon) setupMounts(c *container.Container) ([]container.Mount, er
 	// if we are going to mount any of the network files from container
 	// metadata, the ownership must be set properly for potential container
 	// remapped root (user namespaces)
-	rootUID, rootGID := daemon.GetRemappedUIDGID()
+	rootIDs := daemon.idMappings.RootPair()
 	for _, mount := range netMounts {
-		if err := os.Chown(mount.Source, rootUID, rootGID); err != nil {
+		if err := os.Chown(mount.Source, rootIDs.UID, rootIDs.GID); err != nil {
 			return nil, err
 		}
 	}
@@ -126,6 +137,9 @@ func migrateVolume(id, vfs string) error {
 // verifyVolumesInfo ports volumes configured for the containers pre docker 1.7.
 // It reads the container configuration and creates valid mount points for the old volumes.
 func (daemon *Daemon) verifyVolumesInfo(container *container.Container) error {
+	container.Lock()
+	defer container.Unlock()
+
 	// Inspect old structures only when we're upgrading from old versions
 	// to versions >= 1.7 and the MountPoints has not been populated with volumes data.
 	type volumes struct {
@@ -166,7 +180,6 @@ func (daemon *Daemon) verifyVolumesInfo(container *container.Container) error {
 				container.MountPoints[destination] = &m
 			}
 		}
-		return container.ToDisk()
 	}
 	return nil
 }
diff --git a/components/engine/daemon/volumes_unix_test.go b/components/engine/daemon/volumes_unix_test.go
index 4be7719fe7..dcd6977eaa 100644
--- a/components/engine/daemon/volumes_unix_test.go
+++ b/components/engine/daemon/volumes_unix_test.go
@@ -18,70 +18,67 @@ func TestBackportMountSpec(t *testing.T) {
 	d := Daemon{containers: container.NewMemoryStore()}
 
 	c := &container.Container{
-		CommonContainer: container.CommonContainer{
-			State: &container.State{},
-			MountPoints: map[string]*volume.MountPoint{
-				"/apple":      {Destination: "/apple", Source: "/var/lib/docker/volumes/12345678", Name: "12345678", RW: true, CopyData: true}, // anonymous volume
-				"/banana":     {Destination: "/banana", Source: "/var/lib/docker/volumes/data", Name: "data", RW: true, CopyData: true},        // named volume
-				"/cherry":     {Destination: "/cherry", Source: "/var/lib/docker/volumes/data", Name: "data", CopyData: true},                  // RO named volume
-				"/dates":      {Destination: "/dates", Source: "/var/lib/docker/volumes/data", Name: "data"},                                   // named volume nocopy
-				"/elderberry": {Destination: "/elderberry", Source: "/var/lib/docker/volumes/data", Name: "data"},                              // masks anon vol
-				"/fig":        {Destination: "/fig", Source: "/data", RW: true},                                                                // RW bind
-				"/guava":      {Destination: "/guava", Source: "/data", RW: false, Propagation: "shared"},                                      // RO bind + propagation
-				"/kumquat":    {Destination: "/kumquat", Name: "data", RW: false, CopyData: true},                                              // volumes-from
+		State: &container.State{},
+		MountPoints: map[string]*volume.MountPoint{
+			"/apple":      {Destination: "/apple", Source: "/var/lib/docker/volumes/12345678", Name: "12345678", RW: true, CopyData: true}, // anonymous volume
+			"/banana":     {Destination: "/banana", Source: "/var/lib/docker/volumes/data", Name: "data", RW: true, CopyData: true},        // named volume
+			"/cherry":     {Destination: "/cherry", Source: "/var/lib/docker/volumes/data", Name: "data", CopyData: true},                  // RO named volume
+			"/dates":      {Destination: "/dates", Source: "/var/lib/docker/volumes/data", Name: "data"},                                   // named volume nocopy
+			"/elderberry": {Destination: "/elderberry", Source: "/var/lib/docker/volumes/data", Name: "data"},                              // masks anon vol
+			"/fig":        {Destination: "/fig", Source: "/data", RW: true},                                                                // RW bind
+			"/guava":      {Destination: "/guava", Source: "/data", RW: false, Propagation: "shared"},                                      // RO bind + propagation
+			"/kumquat":    {Destination: "/kumquat", Name: "data", RW: false, CopyData: true},                                              // volumes-from
 
-				// partially configured mountpoint due to #32613
-				// specifically, `mp.Spec.Source` is not set
-				"/honeydew": {
-					Type:        mounttypes.TypeVolume,
-					Destination: "/honeydew",
-					Name:        "data",
-					Source:      "/var/lib/docker/volumes/data",
-					Spec:        mounttypes.Mount{Type: mounttypes.TypeVolume, Target: "/honeydew", VolumeOptions: &mounttypes.VolumeOptions{NoCopy: true}},
-				},
+			// partially configured mountpoint due to #32613
+			// specifically, `mp.Spec.Source` is not set
+			"/honeydew": {
+				Type:        mounttypes.TypeVolume,
+				Destination: "/honeydew",
+				Name:        "data",
+				Source:      "/var/lib/docker/volumes/data",
+				Spec:        mounttypes.Mount{Type: mounttypes.TypeVolume, Target: "/honeydew", VolumeOptions: &mounttypes.VolumeOptions{NoCopy: true}},
+			},
 
-				// from hostconfig.Mounts
-				"/jambolan": {
-					Type:        mounttypes.TypeVolume,
-					Destination: "/jambolan",
-					Source:      "/var/lib/docker/volumes/data",
-					RW:          true,
-					Name:        "data",
-					Spec:        mounttypes.Mount{Type: mounttypes.TypeVolume, Target: "/jambolan", Source: "data"},
-				},
+			// from hostconfig.Mounts
+			"/jambolan": {
+				Type:        mounttypes.TypeVolume,
+				Destination: "/jambolan",
+				Source:      "/var/lib/docker/volumes/data",
+				RW:          true,
+				Name:        "data",
+				Spec:        mounttypes.Mount{Type: mounttypes.TypeVolume, Target: "/jambolan", Source: "data"},
 			},
-			HostConfig: &containertypes.HostConfig{
-				Binds: []string{
-					"data:/banana",
-					"data:/cherry:ro",
-					"data:/dates:ro,nocopy",
-					"data:/elderberry:ro,nocopy",
-					"/data:/fig",
-					"/data:/guava:ro,shared",
-					"data:/honeydew:nocopy",
-				},
-				VolumesFrom: []string{"1:ro"},
-				Mounts: []mounttypes.Mount{
-					{Type: mounttypes.TypeVolume, Target: "/jambolan"},
-				},
+		},
+		HostConfig: &containertypes.HostConfig{
+			Binds: []string{
+				"data:/banana",
+				"data:/cherry:ro",
+				"data:/dates:ro,nocopy",
+				"data:/elderberry:ro,nocopy",
+				"/data:/fig",
+				"/data:/guava:ro,shared",
+				"data:/honeydew:nocopy",
 			},
-			Config: &containertypes.Config{Volumes: map[string]struct{}{
-				"/apple":      {},
-				"/elderberry": {},
-			}},
-		}}
+			VolumesFrom: []string{"1:ro"},
+			Mounts: []mounttypes.Mount{
+				{Type: mounttypes.TypeVolume, Target: "/jambolan"},
+			},
+		},
+		Config: &containertypes.Config{Volumes: map[string]struct{}{
+			"/apple":      {},
+			"/elderberry": {},
+		}},
+	}
 
 	d.containers.Add("1", &container.Container{
-		CommonContainer: container.CommonContainer{
-			State: &container.State{},
-			ID:    "1",
-			MountPoints: map[string]*volume.MountPoint{
-				"/kumquat": {Destination: "/kumquat", Name: "data", RW: false, CopyData: true},
-			},
-			HostConfig: &containertypes.HostConfig{
-				Binds: []string{
-					"data:/kumquat:ro",
-				},
+		State: &container.State{},
+		ID:    "1",
+		MountPoints: map[string]*volume.MountPoint{
+			"/kumquat": {Destination: "/kumquat", Name: "data", RW: false, CopyData: true},
+		},
+		HostConfig: &containertypes.HostConfig{
+			Binds: []string{
+				"data:/kumquat:ro",
 			},
 		},
 	})
diff --git a/components/engine/daemon/volumes_windows.go b/components/engine/daemon/volumes_windows.go
index b43de47b65..62c9e23ac0 100644
--- a/components/engine/daemon/volumes_windows.go
+++ b/components/engine/daemon/volumes_windows.go
@@ -6,6 +6,7 @@ import (
 	"sort"
 
 	"github.com/docker/docker/container"
+	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/volume"
 )
 
@@ -24,7 +25,7 @@ func (daemon *Daemon) setupMounts(c *container.Container) ([]container.Mount, er
 		if err := daemon.lazyInitializeVolume(c.ID, mount); err != nil {
 			return nil, err
 		}
-		s, err := mount.Setup(c.MountLabel, 0, 0)
+		s, err := mount.Setup(c.MountLabel, idtools.IDPair{0, 0}, nil)
 		if err != nil {
 			return nil, err
 		}
diff --git a/components/engine/daemon/workdir.go b/components/engine/daemon/workdir.go
index 99a2a8ea57..6360f24138 100644
--- a/components/engine/daemon/workdir.go
+++ b/components/engine/daemon/workdir.go
@@ -16,6 +16,5 @@ func (daemon *Daemon) ContainerCreateWorkdir(cID string) error {
 		return err
 	}
 	defer daemon.Unmount(container)
-	rootUID, rootGID := daemon.GetRemappedUIDGID()
-	return container.SetupWorkingDirectory(rootUID, rootGID)
+	return container.SetupWorkingDirectory(daemon.idMappings.RootPair())
 }
diff --git a/components/engine/distribution/config.go b/components/engine/distribution/config.go
index f24678d0e2..1c10533f69 100644
--- a/components/engine/distribution/config.go
+++ b/components/engine/distribution/config.go
@@ -14,6 +14,7 @@ import (
 	"github.com/docker/docker/image"
 	"github.com/docker/docker/layer"
 	"github.com/docker/docker/pkg/progress"
+	"github.com/docker/docker/pkg/system"
 	refstore "github.com/docker/docker/reference"
 	"github.com/docker/docker/registry"
 	"github.com/docker/libtrust"
@@ -58,6 +59,9 @@ type ImagePullConfig struct {
 	// Schema2Types is the valid schema2 configuration types allowed
 	// by the pull operation.
 	Schema2Types []string
+	// Platform is the requested platform of the image being pulled to ensure it can be validated
+	// when the host platform supports multiple image operating systems.
+	Platform string
 }
 
 // ImagePushConfig stores push configuration.
@@ -82,7 +86,7 @@ type ImagePushConfig struct {
 type ImageConfigStore interface {
 	Put([]byte) (digest.Digest, error)
 	Get(digest.Digest) ([]byte, error)
-	RootFSFromConfig([]byte) (*image.RootFS, error)
+	RootFSAndPlatformFromConfig([]byte) (*image.RootFS, layer.Platform, error)
 }
 
 // PushLayerProvider provides layers to be pushed by ChainID.
@@ -108,7 +112,7 @@ type RootFSDownloadManager interface {
 	// returns the final rootfs.
 	// Given progress output to track download progress
 	// Returns function to release download resources
-	Download(ctx context.Context, initialRootFS image.RootFS, layers []xfer.DownloadDescriptor, progressOutput progress.Output) (image.RootFS, func(), error)
+	Download(ctx context.Context, initialRootFS image.RootFS, platform layer.Platform, layers []xfer.DownloadDescriptor, progressOutput progress.Output) (image.RootFS, func(), error)
 }
 
 type imageConfigStore struct {
@@ -136,21 +140,25 @@ func (s *imageConfigStore) Get(d digest.Digest) ([]byte, error) {
 	return img.RawJSON(), nil
 }
 
-func (s *imageConfigStore) RootFSFromConfig(c []byte) (*image.RootFS, error) {
+func (s *imageConfigStore) RootFSAndPlatformFromConfig(c []byte) (*image.RootFS, layer.Platform, error) {
 	var unmarshalledConfig image.Image
 	if err := json.Unmarshal(c, &unmarshalledConfig); err != nil {
-		return nil, err
+		return nil, "", err
 	}
 
 	// fail immediately on Windows when downloading a non-Windows image
-	// and vice versa
-	if runtime.GOOS == "windows" && unmarshalledConfig.OS == "linux" {
-		return nil, fmt.Errorf("image operating system %q cannot be used on this platform", unmarshalledConfig.OS)
+	// and vice versa. Exception on Windows if Linux Containers are enabled.
+	if runtime.GOOS == "windows" && unmarshalledConfig.OS == "linux" && !system.LCOWSupported() {
+		return nil, "", fmt.Errorf("image operating system %q cannot be used on this platform", unmarshalledConfig.OS)
 	} else if runtime.GOOS != "windows" && unmarshalledConfig.OS == "windows" {
-		return nil, fmt.Errorf("image operating system %q cannot be used on this platform", unmarshalledConfig.OS)
+		return nil, "", fmt.Errorf("image operating system %q cannot be used on this platform", unmarshalledConfig.OS)
 	}
 
-	return unmarshalledConfig.RootFS, nil
+	platform := ""
+	if runtime.GOOS == "windows" {
+		platform = unmarshalledConfig.OS
+	}
+	return unmarshalledConfig.RootFS, layer.Platform(platform), nil
 }
 
 type storeLayerProvider struct {
diff --git a/components/engine/distribution/errors.go b/components/engine/distribution/errors.go
index adf272a5cf..7f97c1d5eb 100644
--- a/components/engine/distribution/errors.go
+++ b/components/engine/distribution/errors.go
@@ -78,7 +78,7 @@ func TranslatePullError(err error, ref reference.Named) error {
 		switch v.Code {
 		case errcode.ErrorCodeDenied:
 			// ErrorCodeDenied is used when access to the repository was denied
-			newErr = errors.Errorf("repository %s not found: does not exist or no pull access", reference.FamiliarName(ref))
+			newErr = errors.Errorf("pull access denied for %s, repository does not exist or may require 'docker login'", reference.FamiliarName(ref))
 		case v2.ErrorCodeManifestUnknown:
 			newErr = errors.Errorf("manifest for %s not found", reference.FamiliarString(ref))
 		case v2.ErrorCodeNameUnknown:
diff --git a/components/engine/distribution/metadata/metadata.go b/components/engine/distribution/metadata/metadata.go
index 05ba4f817d..3dae79555d 100644
--- a/components/engine/distribution/metadata/metadata.go
+++ b/components/engine/distribution/metadata/metadata.go
@@ -26,15 +26,17 @@ type Store interface {
 type FSMetadataStore struct {
 	sync.RWMutex
 	basePath string
+	platform string
 }
 
 // NewFSMetadataStore creates a new filesystem-based metadata store.
-func NewFSMetadataStore(basePath string) (*FSMetadataStore, error) {
+func NewFSMetadataStore(basePath, platform string) (*FSMetadataStore, error) {
 	if err := os.MkdirAll(basePath, 0700); err != nil {
 		return nil, err
 	}
 	return &FSMetadataStore{
 		basePath: basePath,
+		platform: platform,
 	}, nil
 }
 
diff --git a/components/engine/distribution/metadata/v1_id_service_test.go b/components/engine/distribution/metadata/v1_id_service_test.go
index 556886581e..385901ec46 100644
--- a/components/engine/distribution/metadata/v1_id_service_test.go
+++ b/components/engine/distribution/metadata/v1_id_service_test.go
@@ -3,6 +3,7 @@ package metadata
 import (
 	"io/ioutil"
 	"os"
+	"runtime"
 	"testing"
 
 	"github.com/docker/docker/layer"
@@ -15,7 +16,7 @@ func TestV1IDService(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpDir)
 
-	metadataStore, err := NewFSMetadataStore(tmpDir)
+	metadataStore, err := NewFSMetadataStore(tmpDir, runtime.GOOS)
 	if err != nil {
 		t.Fatalf("could not create metadata store: %v", err)
 	}
diff --git a/components/engine/distribution/metadata/v2_metadata_service_test.go b/components/engine/distribution/metadata/v2_metadata_service_test.go
index 8e3e4614c0..b5d59b2297 100644
--- a/components/engine/distribution/metadata/v2_metadata_service_test.go
+++ b/components/engine/distribution/metadata/v2_metadata_service_test.go
@@ -6,6 +6,7 @@ import (
 	"math/rand"
 	"os"
 	"reflect"
+	"runtime"
 	"testing"
 
 	"github.com/docker/docker/layer"
@@ -19,7 +20,7 @@ func TestV2MetadataService(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpDir)
 
-	metadataStore, err := NewFSMetadataStore(tmpDir)
+	metadataStore, err := NewFSMetadataStore(tmpDir, runtime.GOOS)
 	if err != nil {
 		t.Fatalf("could not create metadata store: %v", err)
 	}
diff --git a/components/engine/distribution/pull_v1.go b/components/engine/distribution/pull_v1.go
index d873d338cd..7151a7584d 100644
--- a/components/engine/distribution/pull_v1.go
+++ b/components/engine/distribution/pull_v1.go
@@ -232,7 +232,7 @@ func (p *v1Puller) pullImage(ctx context.Context, v1ID, endpoint string, localNa
 	}
 
 	rootFS := image.NewRootFS()
-	resultRootFS, release, err := p.config.DownloadManager.Download(ctx, *rootFS, descriptors, p.config.ProgressOutput)
+	resultRootFS, release, err := p.config.DownloadManager.Download(ctx, *rootFS, "", descriptors, p.config.ProgressOutput)
 	if err != nil {
 		return err
 	}
diff --git a/components/engine/distribution/pull_v2.go b/components/engine/distribution/pull_v2.go
index 08df6b768f..0f3f31cf52 100644
--- a/components/engine/distribution/pull_v2.go
+++ b/components/engine/distribution/pull_v2.go
@@ -27,6 +27,7 @@ import (
 	"github.com/docker/docker/pkg/ioutils"
 	"github.com/docker/docker/pkg/progress"
 	"github.com/docker/docker/pkg/stringid"
+	"github.com/docker/docker/pkg/system"
 	refstore "github.com/docker/docker/reference"
 	"github.com/docker/docker/registry"
 	"github.com/opencontainers/go-digest"
@@ -486,7 +487,26 @@ func (p *v2Puller) pullSchema1(ctx context.Context, ref reference.Named, unverif
 		descriptors = append(descriptors, layerDescriptor)
 	}
 
-	resultRootFS, release, err := p.config.DownloadManager.Download(ctx, *rootFS, descriptors, p.config.ProgressOutput)
+	// The v1 manifest itself doesn't directly contain a platform. However,
+	// the history does, but unfortunately that's a string, so search through
+	// all the history until hopefully we find one which indicates the os.
+	platform := runtime.GOOS
+	if runtime.GOOS == "windows" && system.LCOWSupported() {
+		type config struct {
+			Os string `json:"os,omitempty"`
+		}
+		for _, v := range verifiedManifest.History {
+			var c config
+			if err := json.Unmarshal([]byte(v.V1Compatibility), &c); err == nil {
+				if c.Os != "" {
+					platform = c.Os
+					break
+				}
+			}
+		}
+	}
+
+	resultRootFS, release, err := p.config.DownloadManager.Download(ctx, *rootFS, layer.Platform(platform), descriptors, p.config.ProgressOutput)
 	if err != nil {
 		return "", "", err
 	}
@@ -556,10 +576,11 @@ func (p *v2Puller) pullSchema2(ctx context.Context, ref reference.Named, mfst *s
 	}()
 
 	var (
-		configJSON       []byte        // raw serialized image config
-		downloadedRootFS *image.RootFS // rootFS from registered layers
-		configRootFS     *image.RootFS // rootFS from configuration
-		release          func()        // release resources from rootFS download
+		configJSON       []byte         // raw serialized image config
+		downloadedRootFS *image.RootFS  // rootFS from registered layers
+		configRootFS     *image.RootFS  // rootFS from configuration
+		release          func()         // release resources from rootFS download
+		platform         layer.Platform // for LCOW when registering downloaded layers
 	)
 
 	// https://github.com/docker/docker/issues/24766 - Err on the side of caution,
@@ -571,7 +592,7 @@ func (p *v2Puller) pullSchema2(ctx context.Context, ref reference.Named, mfst *s
 	// check to block Windows images being pulled on Linux is implemented, it
 	// may be necessary to perform the same type of serialisation.
 	if runtime.GOOS == "windows" {
-		configJSON, configRootFS, err = receiveConfig(p.config.ImageStore, configChan, configErrChan)
+		configJSON, configRootFS, platform, err = receiveConfig(p.config.ImageStore, configChan, configErrChan)
 		if err != nil {
 			return "", "", err
 		}
@@ -598,7 +619,7 @@ func (p *v2Puller) pullSchema2(ctx context.Context, ref reference.Named, mfst *s
 				rootFS image.RootFS
 			)
 			downloadRootFS := *image.NewRootFS()
-			rootFS, release, err = p.config.DownloadManager.Download(ctx, downloadRootFS, descriptors, p.config.ProgressOutput)
+			rootFS, release, err = p.config.DownloadManager.Download(ctx, downloadRootFS, platform, descriptors, p.config.ProgressOutput)
 			if err != nil {
 				// Intentionally do not cancel the config download here
 				// as the error from config download (if there is one)
@@ -616,7 +637,7 @@ func (p *v2Puller) pullSchema2(ctx context.Context, ref reference.Named, mfst *s
 	}
 
 	if configJSON == nil {
-		configJSON, configRootFS, err = receiveConfig(p.config.ImageStore, configChan, configErrChan)
+		configJSON, configRootFS, _, err = receiveConfig(p.config.ImageStore, configChan, configErrChan)
 		if err == nil && configRootFS == nil {
 			err = errRootFSInvalid
 		}
@@ -663,16 +684,16 @@ func (p *v2Puller) pullSchema2(ctx context.Context, ref reference.Named, mfst *s
 	return imageID, manifestDigest, nil
 }
 
-func receiveConfig(s ImageConfigStore, configChan <-chan []byte, errChan <-chan error) ([]byte, *image.RootFS, error) {
+func receiveConfig(s ImageConfigStore, configChan <-chan []byte, errChan <-chan error) ([]byte, *image.RootFS, layer.Platform, error) {
 	select {
 	case configJSON := <-configChan:
-		rootfs, err := s.RootFSFromConfig(configJSON)
+		rootfs, platform, err := s.RootFSAndPlatformFromConfig(configJSON)
 		if err != nil {
-			return nil, nil, err
+			return nil, nil, "", err
 		}
-		return configJSON, rootfs, nil
+		return configJSON, rootfs, platform, nil
 	case err := <-errChan:
-		return nil, nil, err
+		return nil, nil, "", err
 		// Don't need a case for ctx.Done in the select because cancellation
 		// will trigger an error in p.pullSchema2ImageConfig.
 	}
diff --git a/components/engine/distribution/push_v2.go b/components/engine/distribution/push_v2.go
index 5a6673780c..504083367e 100644
--- a/components/engine/distribution/push_v2.go
+++ b/components/engine/distribution/push_v2.go
@@ -118,7 +118,7 @@ func (p *v2Pusher) pushV2Tag(ctx context.Context, ref reference.NamedTagged, id
 		return fmt.Errorf("could not find image from tag %s: %v", reference.FamiliarString(ref), err)
 	}
 
-	rootfs, err := p.config.ImageStore.RootFSFromConfig(imgConfig)
+	rootfs, _, err := p.config.ImageStore.RootFSAndPlatformFromConfig(imgConfig)
 	if err != nil {
 		return fmt.Errorf("unable to get rootfs for image %s: %s", reference.FamiliarString(ref), err)
 	}
diff --git a/components/engine/distribution/registry_unit_test.go b/components/engine/distribution/registry_unit_test.go
index ebe6ecad97..910061f45a 100644
--- a/components/engine/distribution/registry_unit_test.go
+++ b/components/engine/distribution/registry_unit_test.go
@@ -152,7 +152,7 @@ func testDirectory(templateDir string) (dir string, err error) {
 		return
 	}
 	if templateDir != "" {
-		if err = archive.CopyWithTar(templateDir, dir); err != nil {
+		if err = archive.NewDefaultArchiver().CopyWithTar(templateDir, dir); err != nil {
 			return
 		}
 	}
diff --git a/components/engine/distribution/xfer/download.go b/components/engine/distribution/xfer/download.go
index 8bd48646d4..6769ee1cdf 100644
--- a/components/engine/distribution/xfer/download.go
+++ b/components/engine/distribution/xfer/download.go
@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"runtime"
 	"time"
 
 	"github.com/Sirupsen/logrus"
@@ -22,7 +23,7 @@ const maxDownloadAttempts = 5
 // registers and downloads those, taking into account dependencies between
 // layers.
 type LayerDownloadManager struct {
-	layerStore   layer.Store
+	layerStores  map[string]layer.Store
 	tm           TransferManager
 	waitDuration time.Duration
 }
@@ -33,9 +34,9 @@ func (ldm *LayerDownloadManager) SetConcurrency(concurrency int) {
 }
 
 // NewLayerDownloadManager returns a new LayerDownloadManager.
-func NewLayerDownloadManager(layerStore layer.Store, concurrencyLimit int, options ...func(*LayerDownloadManager)) *LayerDownloadManager {
+func NewLayerDownloadManager(layerStores map[string]layer.Store, concurrencyLimit int, options ...func(*LayerDownloadManager)) *LayerDownloadManager {
 	manager := LayerDownloadManager{
-		layerStore:   layerStore,
+		layerStores:  layerStores,
 		tm:           NewTransferManager(concurrencyLimit),
 		waitDuration: time.Second,
 	}
@@ -94,7 +95,7 @@ type DownloadDescriptorWithRegistered interface {
 // Download method is called to get the layer tar data. Layers are then
 // registered in the appropriate order.  The caller must call the returned
 // release function once it is done with the returned RootFS object.
-func (ldm *LayerDownloadManager) Download(ctx context.Context, initialRootFS image.RootFS, layers []DownloadDescriptor, progressOutput progress.Output) (image.RootFS, func(), error) {
+func (ldm *LayerDownloadManager) Download(ctx context.Context, initialRootFS image.RootFS, platform layer.Platform, layers []DownloadDescriptor, progressOutput progress.Output) (image.RootFS, func(), error) {
 	var (
 		topLayer       layer.Layer
 		topDownload    *downloadTransfer
@@ -104,6 +105,11 @@ func (ldm *LayerDownloadManager) Download(ctx context.Context, initialRootFS ima
 		downloadsByKey = make(map[string]*downloadTransfer)
 	)
 
+	// Assume that the platform is the host OS if blank
+	if platform == "" {
+		platform = layer.Platform(runtime.GOOS)
+	}
+
 	rootFS := initialRootFS
 	for _, descriptor := range layers {
 		key := descriptor.Key()
@@ -115,13 +121,13 @@ func (ldm *LayerDownloadManager) Download(ctx context.Context, initialRootFS ima
 			if err == nil {
 				getRootFS := rootFS
 				getRootFS.Append(diffID)
-				l, err := ldm.layerStore.Get(getRootFS.ChainID())
+				l, err := ldm.layerStores[string(platform)].Get(getRootFS.ChainID())
 				if err == nil {
 					// Layer already exists.
 					logrus.Debugf("Layer already exists: %s", descriptor.ID())
 					progress.Update(progressOutput, descriptor.ID(), "Already exists")
 					if topLayer != nil {
-						layer.ReleaseAndLog(ldm.layerStore, topLayer)
+						layer.ReleaseAndLog(ldm.layerStores[string(platform)], topLayer)
 					}
 					topLayer = l
 					missingLayer = false
@@ -140,7 +146,7 @@ func (ldm *LayerDownloadManager) Download(ctx context.Context, initialRootFS ima
 		// the stack? If so, avoid downloading it more than once.
 		var topDownloadUncasted Transfer
 		if existingDownload, ok := downloadsByKey[key]; ok {
-			xferFunc := ldm.makeDownloadFuncFromDownload(descriptor, existingDownload, topDownload)
+			xferFunc := ldm.makeDownloadFuncFromDownload(descriptor, existingDownload, topDownload, platform)
 			defer topDownload.Transfer.Release(watcher)
 			topDownloadUncasted, watcher = ldm.tm.Transfer(transferKey, xferFunc, progressOutput)
 			topDownload = topDownloadUncasted.(*downloadTransfer)
@@ -152,10 +158,10 @@ func (ldm *LayerDownloadManager) Download(ctx context.Context, initialRootFS ima
 
 		var xferFunc DoFunc
 		if topDownload != nil {
-			xferFunc = ldm.makeDownloadFunc(descriptor, "", topDownload)
+			xferFunc = ldm.makeDownloadFunc(descriptor, "", topDownload, platform)
 			defer topDownload.Transfer.Release(watcher)
 		} else {
-			xferFunc = ldm.makeDownloadFunc(descriptor, rootFS.ChainID(), nil)
+			xferFunc = ldm.makeDownloadFunc(descriptor, rootFS.ChainID(), nil, platform)
 		}
 		topDownloadUncasted, watcher = ldm.tm.Transfer(transferKey, xferFunc, progressOutput)
 		topDownload = topDownloadUncasted.(*downloadTransfer)
@@ -165,7 +171,7 @@ func (ldm *LayerDownloadManager) Download(ctx context.Context, initialRootFS ima
 	if topDownload == nil {
 		return rootFS, func() {
 			if topLayer != nil {
-				layer.ReleaseAndLog(ldm.layerStore, topLayer)
+				layer.ReleaseAndLog(ldm.layerStores[string(platform)], topLayer)
 			}
 		}, nil
 	}
@@ -176,7 +182,7 @@ func (ldm *LayerDownloadManager) Download(ctx context.Context, initialRootFS ima
 
 	defer func() {
 		if topLayer != nil {
-			layer.ReleaseAndLog(ldm.layerStore, topLayer)
+			layer.ReleaseAndLog(ldm.layerStores[string(platform)], topLayer)
 		}
 	}()
 
@@ -212,11 +218,11 @@ func (ldm *LayerDownloadManager) Download(ctx context.Context, initialRootFS ima
 // complete before the registration step, and registers the downloaded data
 // on top of parentDownload's resulting layer. Otherwise, it registers the
 // layer on top of the ChainID given by parentLayer.
-func (ldm *LayerDownloadManager) makeDownloadFunc(descriptor DownloadDescriptor, parentLayer layer.ChainID, parentDownload *downloadTransfer) DoFunc {
+func (ldm *LayerDownloadManager) makeDownloadFunc(descriptor DownloadDescriptor, parentLayer layer.ChainID, parentDownload *downloadTransfer, platform layer.Platform) DoFunc {
 	return func(progressChan chan<- progress.Progress, start <-chan struct{}, inactive chan<- struct{}) Transfer {
 		d := &downloadTransfer{
 			Transfer:   NewTransfer(),
-			layerStore: ldm.layerStore,
+			layerStore: ldm.layerStores[string(platform)],
 		}
 
 		go func() {
@@ -335,9 +341,9 @@ func (ldm *LayerDownloadManager) makeDownloadFunc(descriptor DownloadDescriptor,
 				src = fs.Descriptor()
 			}
 			if ds, ok := d.layerStore.(layer.DescribableStore); ok {
-				d.layer, err = ds.RegisterWithDescriptor(inflatedLayerData, parentLayer, src)
+				d.layer, err = ds.RegisterWithDescriptor(inflatedLayerData, parentLayer, platform, src)
 			} else {
-				d.layer, err = d.layerStore.Register(inflatedLayerData, parentLayer)
+				d.layer, err = d.layerStore.Register(inflatedLayerData, parentLayer, platform)
 			}
 			if err != nil {
 				select {
@@ -376,11 +382,11 @@ func (ldm *LayerDownloadManager) makeDownloadFunc(descriptor DownloadDescriptor,
 // parentDownload. This function does not log progress output because it would
 // interfere with the progress reporting for sourceDownload, which has the same
 // Key.
-func (ldm *LayerDownloadManager) makeDownloadFuncFromDownload(descriptor DownloadDescriptor, sourceDownload *downloadTransfer, parentDownload *downloadTransfer) DoFunc {
+func (ldm *LayerDownloadManager) makeDownloadFuncFromDownload(descriptor DownloadDescriptor, sourceDownload *downloadTransfer, parentDownload *downloadTransfer, platform layer.Platform) DoFunc {
 	return func(progressChan chan<- progress.Progress, start <-chan struct{}, inactive chan<- struct{}) Transfer {
 		d := &downloadTransfer{
 			Transfer:   NewTransfer(),
-			layerStore: ldm.layerStore,
+			layerStore: ldm.layerStores[string(platform)],
 		}
 
 		go func() {
@@ -434,9 +440,9 @@ func (ldm *LayerDownloadManager) makeDownloadFuncFromDownload(descriptor Downloa
 				src = fs.Descriptor()
 			}
 			if ds, ok := d.layerStore.(layer.DescribableStore); ok {
-				d.layer, err = ds.RegisterWithDescriptor(layerReader, parentLayer, src)
+				d.layer, err = ds.RegisterWithDescriptor(layerReader, parentLayer, platform, src)
 			} else {
-				d.layer, err = d.layerStore.Register(layerReader, parentLayer)
+				d.layer, err = d.layerStore.Register(layerReader, parentLayer, platform)
 			}
 			if err != nil {
 				d.err = fmt.Errorf("failed to register layer: %v", err)
diff --git a/components/engine/distribution/xfer/download_test.go b/components/engine/distribution/xfer/download_test.go
index 69323bb869..e5aba02e3b 100644
--- a/components/engine/distribution/xfer/download_test.go
+++ b/components/engine/distribution/xfer/download_test.go
@@ -26,6 +26,7 @@ type mockLayer struct {
 	diffID    layer.DiffID
 	chainID   layer.ChainID
 	parent    layer.Layer
+	platform  layer.Platform
 }
 
 func (ml *mockLayer) TarStream() (io.ReadCloser, error) {
@@ -56,6 +57,10 @@ func (ml *mockLayer) DiffSize() (size int64, err error) {
 	return 0, nil
 }
 
+func (ml *mockLayer) Platform() layer.Platform {
+	return ml.platform
+}
+
 func (ml *mockLayer) Metadata() (map[string]string, error) {
 	return make(map[string]string), nil
 }
@@ -86,7 +91,7 @@ func (ls *mockLayerStore) Map() map[layer.ChainID]layer.Layer {
 	return layers
 }
 
-func (ls *mockLayerStore) Register(reader io.Reader, parentID layer.ChainID) (layer.Layer, error) {
+func (ls *mockLayerStore) Register(reader io.Reader, parentID layer.ChainID, platform layer.Platform) (layer.Layer, error) {
 	return ls.RegisterWithDescriptor(reader, parentID, distribution.Descriptor{})
 }
 
@@ -267,7 +272,9 @@ func TestSuccessfulDownload(t *testing.T) {
 	}
 
 	layerStore := &mockLayerStore{make(map[layer.ChainID]*mockLayer)}
-	ldm := NewLayerDownloadManager(layerStore, maxDownloadConcurrency, func(m *LayerDownloadManager) { m.waitDuration = time.Millisecond })
+	lsMap := make(map[string]layer.Store)
+	lsMap[runtime.GOOS] = layerStore
+	ldm := NewLayerDownloadManager(lsMap, maxDownloadConcurrency, func(m *LayerDownloadManager) { m.waitDuration = time.Millisecond })
 
 	progressChan := make(chan progress.Progress)
 	progressDone := make(chan struct{})
@@ -286,13 +293,13 @@ func TestSuccessfulDownload(t *testing.T) {
 	firstDescriptor := descriptors[0].(*mockDownloadDescriptor)
 
 	// Pre-register the first layer to simulate an already-existing layer
-	l, err := layerStore.Register(firstDescriptor.mockTarStream(), "")
+	l, err := layerStore.Register(firstDescriptor.mockTarStream(), "", layer.Platform(runtime.GOOS))
 	if err != nil {
 		t.Fatal(err)
 	}
 	firstDescriptor.diffID = l.DiffID()
 
-	rootFS, releaseFunc, err := ldm.Download(context.Background(), *image.NewRootFS(), descriptors, progress.ChanOutput(progressChan))
+	rootFS, releaseFunc, err := ldm.Download(context.Background(), *image.NewRootFS(), layer.Platform(runtime.GOOS), descriptors, progress.ChanOutput(progressChan))
 	if err != nil {
 		t.Fatalf("download error: %v", err)
 	}
@@ -328,7 +335,10 @@ func TestSuccessfulDownload(t *testing.T) {
 }
 
 func TestCancelledDownload(t *testing.T) {
-	ldm := NewLayerDownloadManager(&mockLayerStore{make(map[layer.ChainID]*mockLayer)}, maxDownloadConcurrency, func(m *LayerDownloadManager) { m.waitDuration = time.Millisecond })
+	layerStore := &mockLayerStore{make(map[layer.ChainID]*mockLayer)}
+	lsMap := make(map[string]layer.Store)
+	lsMap[runtime.GOOS] = layerStore
+	ldm := NewLayerDownloadManager(lsMap, maxDownloadConcurrency, func(m *LayerDownloadManager) { m.waitDuration = time.Millisecond })
 
 	progressChan := make(chan progress.Progress)
 	progressDone := make(chan struct{})
@@ -347,7 +357,7 @@ func TestCancelledDownload(t *testing.T) {
 	}()
 
 	descriptors := downloadDescriptors(nil)
-	_, _, err := ldm.Download(ctx, *image.NewRootFS(), descriptors, progress.ChanOutput(progressChan))
+	_, _, err := ldm.Download(ctx, *image.NewRootFS(), layer.Platform(runtime.GOOS), descriptors, progress.ChanOutput(progressChan))
 	if err != context.Canceled {
 		t.Fatal("expected download to be cancelled")
 	}
diff --git a/components/engine/docs/README.md b/components/engine/docs/README.md
deleted file mode 100644
index da93093075..0000000000
--- a/components/engine/docs/README.md
+++ /dev/null
@@ -1,30 +0,0 @@
-# The non-reference docs have been moved!
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-The documentation for Docker Engine has been merged into
-[the general documentation repo](https://github.com/docker/docker.github.io).
-
-See the [README](https://github.com/docker/docker.github.io/blob/master/README.md)
-for instructions on contributing to and building the documentation.
-
-If you'd like to edit the current published version of the Engine docs,
-do it in the master branch here:
-https://github.com/docker/docker.github.io/tree/master/engine
-
-If you need to document the functionality of an upcoming Engine release,
-use the `vnext-engine` branch:
-https://github.com/docker/docker.github.io/tree/vnext-engine/engine
-
-The reference docs have been left in docker/docker (this repo), which remains
-the place to edit them.
-
-The docs in the general repo are open-source and we appreciate
-your feedback and pull requests!
diff --git a/components/engine/docs/api/version-history.md b/components/engine/docs/api/version-history.md
index 3891d35c04..1d19d56dce 100644
--- a/components/engine/docs/api/version-history.md
+++ b/components/engine/docs/api/version-history.md
@@ -13,6 +13,19 @@ keywords: "API, Docker, rcli, REST, documentation"
      will be rejected.
 -->
 
+## v1.31 API changes
+
+[Docker Engine API v1.31](https://docs.docker.com/engine/api/v1.31/) documentation
+
+* `DELETE /secrets/(name)` now returns status code 404 instead of 500 when the secret does not exist.
+* `POST /secrets/create` now returns status code 409 instead of 500 when creating an already existing secret.
+* `POST /secrets/(name)/update` now returns status code 400 instead of 500 when updating a secret's content which is not the labels.
+* `POST /nodes/(name)/update` now returns status code 400 instead of 500 when demoting last node fails.
+* `GET /networks/(id or name)` now takes an optional query parameter `scope` that will filter the network based on the scope (`local`, `swarm`, or `global`).
+* `POST /session` is a new endpoint that can be used for running interactive long-running protocols between client and
+  the daemon. This endpoint is experimental and only available if the daemon is started with experimental features
+  enabled.
+
 ## v1.30 API changes
 
 [Docker Engine API v1.30](https://docs.docker.com/engine/api/v1.30/) documentation
diff --git a/components/engine/docs/deprecated.md b/components/engine/docs/deprecated.md
deleted file mode 100644
index 7e0bfc0a60..0000000000
--- a/components/engine/docs/deprecated.md
+++ /dev/null
@@ -1,321 +0,0 @@
----
-aliases: ["/engine/misc/deprecated/"]
-title: "Deprecated Engine Features"
-description: "Deprecated Features."
-keywords: "docker, documentation, about, technology, deprecate"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# Deprecated Engine Features
-
-The following list of features are deprecated in Engine.
-To learn more about Docker Engine's deprecation policy,
-see [Feature Deprecation Policy](https://docs.docker.com/engine/#feature-deprecation-policy).
-
-### Asynchronous `service create` and `service update`
-
-**Deprecated In Release: v17.05.0**
-
-**Disabled by default in release: v17.09**
-
-Docker 17.05.0 added an optional `--detach=false` option to make the
-`docker service create` and `docker service update` work synchronously. This
-option will be enable by default in Docker 17.09, at which point the `--detach`
-flag can be used to use the previous (asynchronous) behavior.
-
-### `-g` and `--graph` flags on `dockerd`
-
-**Deprecated In Release: v17.05.0**
-
-The `-g` or `--graph` flag for the `dockerd` or `docker daemon` command was
-used to indicate the directory in which to store persistent data and resource
-configuration and has been replaced with the more descriptive `--data-root`
-flag.
-
-These flags were added before Docker 1.0, so will not be _removed_, only
-_hidden_, to discourage their use.
-
-### Top-level network properties in NetworkSettings
-
-**Deprecated In Release: [v1.13.0](https://github.com/docker/docker/releases/tag/v1.13.0)**
-
-**Target For Removal In Release: v17.12**
-
-When inspecting a container, `NetworkSettings` contains top-level information
-about the default ("bridge") network;
-
-`EndpointID`, `Gateway`, `GlobalIPv6Address`, `GlobalIPv6PrefixLen`, `IPAddress`,
-`IPPrefixLen`, `IPv6Gateway`, and `MacAddress`.
-
-These properties are deprecated in favor of per-network properties in
-`NetworkSettings.Networks`. These properties were already "deprecated" in
-docker 1.9, but kept around for backward compatibility.
-
-Refer to [#17538](https://github.com/docker/docker/pull/17538) for further
-information.
-
-### `filter` param for `/images/json` endpoint
-**Deprecated In Release: [v1.13.0](https://github.com/docker/docker/releases/tag/v1.13.0)**
-
-**Target For Removal In Release: v17.12**
-
-The `filter` param to filter the list of image by reference (name or name:tag) is now implemented as a regular filter, named `reference`.
-
-### `repository:shortid` image references
-**Deprecated In Release: [v1.13.0](https://github.com/docker/docker/releases/tag/v1.13.0)**
-
-**Target For Removal In Release: v17.12**
-
-`repository:shortid` syntax for referencing images is very little used, collides with tag references can be confused with digest references.
-
-### `docker daemon` subcommand
-**Deprecated In Release: [v1.13.0](https://github.com/docker/docker/releases/tag/v1.13.0)**
-
-**Target For Removal In Release: v17.12**
-
-The daemon is moved to a separate binary (`dockerd`), and should be used instead.
-
-### Duplicate keys with conflicting values in engine labels
-**Deprecated In Release: [v1.13.0](https://github.com/docker/docker/releases/tag/v1.13.0)**
-
-**Target For Removal In Release: v17.12**
-
-Duplicate keys with conflicting values have been deprecated. A warning is displayed
-in the output, and an error will be returned in the future.
-
-### `MAINTAINER` in Dockerfile
-**Deprecated In Release: [v1.13.0](https://github.com/docker/docker/releases/tag/v1.13.0)**
-
-`MAINTAINER` was an early very limited form of `LABEL` which should be used instead.
-
-### API calls without a version
-**Deprecated In Release: [v1.13.0](https://github.com/docker/docker/releases/tag/v1.13.0)**
-
-**Target For Removal In Release: v17.12**
-
-API versions should be supplied to all API calls to ensure compatibility with
-future Engine versions. Instead of just requesting, for example, the URL
-`/containers/json`, you must now request `/v1.25/containers/json`.
-
-### Backing filesystem without `d_type` support for overlay/overlay2
-**Deprecated In Release: [v1.13.0](https://github.com/docker/docker/releases/tag/v1.13.0)**
-
-**Target For Removal In Release: v17.12**
-
-The overlay and overlay2 storage driver does not work as expected if the backing
-filesystem does not support `d_type`. For example, XFS does not support `d_type`
-if it is formatted with the `ftype=0` option.
-
-Please also refer to [#27358](https://github.com/docker/docker/issues/27358) for
-further information.
-
-### Three arguments form in `docker import`
-**Deprecated In Release: [v0.6.7](https://github.com/docker/docker/releases/tag/v0.6.7)**
-
-**Removed In Release: [v1.12.0](https://github.com/docker/docker/releases/tag/v1.12.0)**
-
-The `docker import` command format `file|URL|- [REPOSITORY [TAG]]` is deprecated since November 2013. It's no more supported.
-
-### `-h` shorthand for `--help`
-
-**Deprecated In Release: [v1.12.0](https://github.com/docker/docker/releases/tag/v1.12.0)**
-
-**Target For Removal In Release: v17.09**
-
-The shorthand (`-h`) is less common than `--help` on Linux and cannot be used
-on all subcommands (due to it conflicting with, e.g. `-h` / `--hostname` on
-`docker create`). For this reason, the `-h` shorthand was not printed in the
-"usage" output of subcommands, nor documented, and is now marked "deprecated".
-
-### `-e` and `--email` flags on `docker login`
-**Deprecated In Release: [v1.11.0](https://github.com/docker/docker/releases/tag/v1.11.0)**
-
-**Target For Removal In Release: v17.06**
-
-The docker login command is removing the ability to automatically register for an account with the target registry if the given username doesn't exist. Due to this change, the email flag is no longer required, and will be deprecated.
-
-### Separator (`:`) of `--security-opt` flag on `docker run`
-**Deprecated In Release: [v1.11.0](https://github.com/docker/docker/releases/tag/v1.11.0)**
-
-**Target For Removal In Release: v17.06**
-
-The flag `--security-opt` doesn't use the colon separator(`:`) anymore to divide keys and values, it uses the equal symbol(`=`) for consistency with other similar flags, like `--storage-opt`.
-
-### `/containers/(id or name)/copy` endpoint
-
-**Deprecated In Release: [v1.8.0](https://github.com/docker/docker/releases/tag/v1.8.0)**
-
-**Removed In Release: [v1.12.0](https://github.com/docker/docker/releases/tag/v1.12.0)**
-
-The endpoint `/containers/(id or name)/copy` is deprecated in favor of `/containers/(id or name)/archive`.
-
-### Ambiguous event fields in API
-**Deprecated In Release: [v1.10.0](https://github.com/docker/docker/releases/tag/v1.10.0)**
-
-The fields `ID`, `Status` and `From` in the events API have been deprecated in favor of a more rich structure.
-See the events API documentation for the new format.
-
-### `-f` flag on `docker tag`
-**Deprecated In Release: [v1.10.0](https://github.com/docker/docker/releases/tag/v1.10.0)**
-
-**Removed In Release: [v1.12.0](https://github.com/docker/docker/releases/tag/v1.12.0)**
-
-To make tagging consistent across the various `docker` commands, the `-f` flag on the `docker tag` command is deprecated. It is not longer necessary to specify `-f` to move a tag from one image to another. Nor will `docker` generate an error if the `-f` flag is missing and the specified tag is already in use.
-
-### HostConfig at API container start
-**Deprecated In Release: [v1.10.0](https://github.com/docker/docker/releases/tag/v1.10.0)**
-
-**Removed In Release: [v1.12.0](https://github.com/docker/docker/releases/tag/v1.12.0)**
-
-Passing an `HostConfig` to `POST /containers/{name}/start` is deprecated in favor of
-defining it at container creation (`POST /containers/create`).
-
-### `--before` and `--since` flags on `docker ps`
-
-**Deprecated In Release: [v1.10.0](https://github.com/docker/docker/releases/tag/v1.10.0)**
-
-**Removed In Release: [v1.12.0](https://github.com/docker/docker/releases/tag/v1.12.0)**
-
-The `docker ps --before` and `docker ps --since` options are deprecated.
-Use `docker ps --filter=before=...` and `docker ps --filter=since=...` instead.
-
-### `--automated` and `--stars` flags on `docker search`
-
-**Deprecated in Release: [v1.12.0](https://github.com/docker/docker/releases/tag/v1.12.0)**
-
-**Target For Removal In Release: v17.09**
-
-The `docker search --automated` and `docker search --stars` options are deprecated.
-Use `docker search --filter=is-automated=...` and `docker search --filter=stars=...` instead.
-
-### Driver Specific Log Tags
-**Deprecated In Release: [v1.9.0](https://github.com/docker/docker/releases/tag/v1.9.0)**
-
-**Removed In Release: [v1.12.0](https://github.com/docker/docker/releases/tag/v1.12.0)**
-
-Log tags are now generated in a standard way across different logging drivers.
-Because of which, the driver specific log tag options `syslog-tag`, `gelf-tag` and
-`fluentd-tag` have been deprecated in favor of the generic `tag` option.
-
-```bash
-{% raw %}
-docker --log-driver=syslog --log-opt tag="{{.ImageName}}/{{.Name}}/{{.ID}}"
-{% endraw %}
-```
-
-### LXC built-in exec driver
-**Deprecated In Release: [v1.8.0](https://github.com/docker/docker/releases/tag/v1.8.0)**
-
-**Removed In Release: [v1.10.0](https://github.com/docker/docker/releases/tag/v1.10.0)**
-
-The built-in LXC execution driver, the lxc-conf flag, and API fields have been removed.
-
-### Old Command Line Options
-**Deprecated In Release: [v1.8.0](https://github.com/docker/docker/releases/tag/v1.8.0)**
-
-**Removed In Release: [v1.10.0](https://github.com/docker/docker/releases/tag/v1.10.0)**
-
-The flags `-d` and `--daemon` are deprecated in favor of the `daemon` subcommand:
-
-    docker daemon -H ...
-
-The following single-dash (`-opt`) variant of certain command line options
-are deprecated and replaced with double-dash options (`--opt`):
-
-    docker attach -nostdin
-    docker attach -sig-proxy
-    docker build -no-cache
-    docker build -rm
-    docker commit -author
-    docker commit -run
-    docker events -since
-    docker history -notrunc
-    docker images -notrunc
-    docker inspect -format
-    docker ps -beforeId
-    docker ps -notrunc
-    docker ps -sinceId
-    docker rm -link
-    docker run -cidfile
-    docker run -dns
-    docker run -entrypoint
-    docker run -expose
-    docker run -link
-    docker run -lxc-conf
-    docker run -n
-    docker run -privileged
-    docker run -volumes-from
-    docker search -notrunc
-    docker search -stars
-    docker search -t
-    docker search -trusted
-    docker tag -force
-
-The following double-dash options are deprecated and have no replacement:
-
-    docker run --cpuset
-    docker run --networking
-    docker ps --since-id
-    docker ps --before-id
-    docker search --trusted
-
-**Deprecated In Release: [v1.5.0](https://github.com/docker/docker/releases/tag/v1.5.0)**
-
-**Removed In Release: [v1.12.0](https://github.com/docker/docker/releases/tag/v1.12.0)**
-
-The single-dash (`-help`) was removed, in favor of the double-dash `--help`
-
-    docker -help
-    docker [COMMAND] -help
-
-### `--run` flag on docker commit
-
-**Deprecated In Release: [v0.10.0](https://github.com/docker/docker/releases/tag/v0.10.0)**
-
-**Removed In Release: [v1.13.0](https://github.com/docker/docker/releases/tag/v1.13.0)**
-
-The flag `--run` of the docker commit (and its short version `-run`) were deprecated in favor
-of the `--changes` flag that allows to pass `Dockerfile` commands.
-
-
-### Interacting with V1 registries
-
-**Disabled By Default In Release: v17.06**
-
-**Target For Removal In Release: v17.12**
-
-Version 1.9 adds a flag (`--disable-legacy-registry=false`) which prevents the
-docker daemon from `pull`, `push`, and `login` operations against v1
-registries.  Though enabled by default, this signals the intent to deprecate
-the v1 protocol.
-
-Support for the v1 protocol to the public registry was removed in 1.13. Any
-mirror configurations using v1 should be updated to use a
-[v2 registry mirror](https://docs.docker.com/registry/recipes/mirror/).
-
-### Docker Content Trust ENV passphrase variables name change
-**Deprecated In Release: [v1.9.0](https://github.com/docker/docker/releases/tag/v1.9.0)**
-
-**Removed In Release: [v1.12.0](https://github.com/docker/docker/releases/tag/v1.12.0)**
-
-Since 1.9, Docker Content Trust Offline key has been renamed to Root key and the Tagging key has been renamed to Repository key. Due to this renaming, we're also changing the corresponding environment variables
-
-- DOCKER_CONTENT_TRUST_OFFLINE_PASSPHRASE is now named DOCKER_CONTENT_TRUST_ROOT_PASSPHRASE
-- DOCKER_CONTENT_TRUST_TAGGING_PASSPHRASE is now named DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE
-
-### `--api-enable-cors` flag on dockerd
-
-**Deprecated In Release: [v1.6.0](https://github.com/docker/docker/releases/tag/v1.6.0)**
-
-**Target For Removal In Release: v17.09**
-
-The flag `--api-enable-cors` is deprecated since v1.6.0. Use the flag
-`--api-cors-header` instead.
diff --git a/components/engine/docs/extend/EBS_volume.md b/components/engine/docs/extend/EBS_volume.md
deleted file mode 100644
index 8c64efa164..0000000000
--- a/components/engine/docs/extend/EBS_volume.md
+++ /dev/null
@@ -1,164 +0,0 @@
----
-description: Volume plugin for Amazon EBS
-keywords: "API, Usage, plugins, documentation, developer, amazon, ebs, rexray, volume"
-title: Volume plugin for Amazon EBS
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# A proof-of-concept Rexray plugin
-
-In this example, a simple Rexray plugin will be created for the purposes of using
-it on an Amazon EC2 instance with EBS. It is not meant to be a complete Rexray plugin.
-
-The example source is available at [https://github.com/tiborvass/rexray-plugin](https://github.com/tiborvass/rexray-plugin).
-
-To learn more about Rexray: [https://github.com/codedellemc/rexray](https://github.com/codedellemc/rexray)
-
-## 1. Make a Docker image
-
-The following is the Dockerfile used to containerize rexray.
-
-```Dockerfile
-FROM debian:jessie
-RUN apt-get update && apt-get install -y --no-install-recommends wget ca-certificates
-RUN wget https://dl.bintray.com/emccode/rexray/stable/0.6.4/rexray-Linux-x86_64-0.6.4.tar.gz -O rexray.tar.gz && tar -xvzf rexray.tar.gz -C /usr/bin && rm rexray.tar.gz
-RUN mkdir -p /run/docker/plugins /var/lib/libstorage/volumes
-ENTRYPOINT ["rexray"]
-CMD ["--help"]
-```
-
-To build it you can run `image=$(cat Dockerfile | docker build -q -)` and `$image`
-will reference the containerized rexray image.
-
-## 2. Extract rootfs
-
-```sh
-$ TMPDIR=/tmp/rexray  # for the purpose of this example
-$  # create container without running it, to extract the rootfs from image
-$ docker create --name rexray "$image"
-$  # save the rootfs to a tar archive
-$ docker export -o $TMPDIR/rexray.tar rexray
-$  # extract rootfs from tar archive to a rootfs folder
-$ ( mkdir -p $TMPDIR/rootfs; cd $TMPDIR/rootfs; tar xf ../rexray.tar )
-```
-
-## 3. Add plugin configuration
-
-We have to put the following JSON to `$TMPDIR/config.json`:
-
-```json
-{
-      "Args": {
-        "Description": "",
-        "Name": "",
-        "Settable": null,
-        "Value": null
-      },
-      "Description": "A proof-of-concept EBS plugin (using rexray) for Docker",
-      "Documentation": "https://github.com/tiborvass/rexray-plugin",
-      "Entrypoint": [
-        "/usr/bin/rexray", "service", "start", "-f"
-      ],
-      "Env": [
-        {
-          "Description": "",
-          "Name": "REXRAY_SERVICE",
-          "Settable": [
-            "value"
-          ],
-          "Value": "ebs"
-        },
-        {
-          "Description": "",
-          "Name": "EBS_ACCESSKEY",
-          "Settable": [
-            "value"
-          ],
-          "Value": ""
-        },
-        {
-          "Description": "",
-          "Name": "EBS_SECRETKEY",
-          "Settable": [
-            "value"
-          ],
-          "Value": ""
-        }
-      ],
-      "Interface": {
-        "Socket": "rexray.sock",
-        "Types": [
-          "docker.volumedriver/1.0"
-        ]
-      },
-      "Linux": {
-        "AllowAllDevices": true,
-        "Capabilities": ["CAP_SYS_ADMIN"],
-        "Devices": null
-      },
-      "Mounts": [
-        {
-          "Source": "/dev",
-          "Destination": "/dev",
-          "Type": "bind",
-          "Options": ["rbind"]
-        }
-      ],
-      "Network": {
-        "Type": "host"
-      },
-      "PropagatedMount": "/var/lib/libstorage/volumes",
-      "User": {},
-      "WorkDir": ""
-}
-```
-
-Please note a couple of points:
-- `PropagatedMount` is needed so that the docker daemon can see mounts done by the
-rexray plugin from within the container, otherwise the docker daemon is not able
-to mount a docker volume.
-- The rexray plugin needs dynamic access to host devices. For that reason, we
-have to give it access to all devices under `/dev` and set `AllowAllDevices` to
-true for proper access.
-- The user of this simple plugin can change only 3 settings: `REXRAY_SERVICE`,
-`EBS_ACCESSKEY` and `EBS_SECRETKEY`. This is because of the reduced scope of this
-plugin. Ideally other rexray parameters could also be set.
-
-## 4. Create plugin
-
-`docker plugin create tiborvass/rexray-plugin "$TMPDIR"` will create the plugin.
-
-```sh
-$ docker plugin ls
-ID                  NAME                             DESCRIPTION                         ENABLED
-2475a4bd0ca5        tiborvass/rexray-plugin:latest   A rexray volume plugin for Docker   false
-```
-
-## 5. Test plugin
-
-```sh
-$ docker plugin set tiborvass/rexray-plugin EBS_ACCESSKEY=$AWS_ACCESSKEY EBS_SECRETKEY=$AWS_SECRETKEY`
-$ docker plugin enable tiborvass/rexray-plugin
-$ docker volume create -d tiborvass/rexray-plugin my-ebs-volume
-$ docker volume ls
-DRIVER                              VOLUME NAME
-tiborvass/rexray-plugin:latest      my-ebs-volume
-$ docker run --rm -v my-ebs-volume:/volume busybox sh -c 'echo bye > /volume/hi'
-$ docker run --rm -v my-ebs-volume:/volume busybox cat /volume/hi
-bye
-```
-
-## 6. Push plugin
-
-First, ensure you are logged in with `docker login`. Then you can run:
-`docker plugin push tiborvass/rexray-plugin` to push it like a regular docker
-image to a registry, to make it available for others to install via
-`docker plugin install tiborvass/rexray-plugin EBS_ACCESSKEY=$AWS_ACCESSKEY EBS_SECRETKEY=$AWS_SECRETKEY`.
diff --git a/components/engine/docs/extend/config.md b/components/engine/docs/extend/config.md
deleted file mode 100644
index bb6c7f2ceb..0000000000
--- a/components/engine/docs/extend/config.md
+++ /dev/null
@@ -1,238 +0,0 @@
----
-title: "Plugin config"
-description: "How develop and use a plugin with the managed plugin system"
-keywords: "API, Usage, plugins, documentation, developer"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-
-# Plugin Config Version 1 of Plugin V2
-
-This document outlines the format of the V0 plugin configuration. The plugin
-config described herein was introduced in the Docker daemon in the [v1.12.0
-release](https://github.com/docker/docker/commit/f37117045c5398fd3dca8016ea8ca0cb47e7312b).
-
-Plugin configs describe the various constituents of a docker plugin. Plugin
-configs can be serialized to JSON format with the following media types:
-
-Config Type  | Media Type
-------------- | -------------
-config  | "application/vnd.docker.plugin.v1+json"
-
-
-## *Config* Field Descriptions
-
-Config provides the base accessible fields for working with V0 plugin format
- in the registry.
-
-- **`description`** *string*
-
-	description of the plugin
-
-- **`documentation`** *string*
-
-  	link to the documentation about the plugin
-
-- **`interface`** *PluginInterface*
-
-   interface implemented by the plugins, struct consisting of the following fields
-
-    - **`types`** *string array*
-
-      types indicate what interface(s) the plugin currently implements.
-
-      currently supported:
-
-        - **docker.volumedriver/1.0**
-
-        - **docker.networkdriver/1.0**
-
-        - **docker.ipamdriver/1.0**
-
-        - **docker.authz/1.0**
-
-        - **docker.logdriver/1.0**
-
-        - **docker.metricscollector/1.0**
-
-    - **`socket`** *string*
-
-      socket is the name of the socket the engine should use to communicate with the plugins.
-      the socket will be created in `/run/docker/plugins`.
-
-
-- **`entrypoint`** *string array*
-
-   entrypoint of the plugin, see [`ENTRYPOINT`](../reference/builder.md#entrypoint)
-
-- **`workdir`** *string*
-
-   workdir of the plugin, see [`WORKDIR`](../reference/builder.md#workdir)
-
-- **`network`** *PluginNetwork*
-
-   network of the plugin, struct consisting of the following fields
-
-    - **`type`** *string*
-
-      network type.
-
-      currently supported:
-
-      	- **bridge**
-      	- **host**
-      	- **none**
-
-- **`mounts`** *PluginMount array*
-
-   mount of the plugin, struct consisting of the following fields, see [`MOUNTS`](https://github.com/opencontainers/runtime-spec/blob/master/config.md#mounts)
-
-    - **`name`** *string*
-
-	  name of the mount.
-
-    - **`description`** *string*
-
-      description of the mount.
-
-    - **`source`** *string*
-
-	  source of the mount.
-
-    - **`destination`** *string*
-
-	  destination of the mount.
-
-    - **`type`** *string*
-
-      mount type.
-
-    - **`options`** *string array*
-
-	  options of the mount.
-
-- **`ipchost`** *boolean*
-   Access to host ipc namespace.
-- **`pidhost`** *boolean*
-   Access to host pid namespace.
-
-- **`propagatedMount`** *string*
-
-   path to be mounted as rshared, so that mounts under that path are visible to docker. This is useful for volume plugins.
-   This path will be bind-mounted outisde of the plugin rootfs so it's contents
-   are preserved on upgrade.
-
-- **`env`** *PluginEnv array*
-
-   env of the plugin, struct consisting of the following fields
-
-    - **`name`** *string*
-
-	  name of the env.
-
-    - **`description`** *string*
-
-      description of the env.
-
-    - **`value`** *string*
-
-	  value of the env.
-
-- **`args`** *PluginArgs*
-
-   args of the plugin, struct consisting of the following fields
-
-    - **`name`** *string*
-
-	  name of the args.
-
-    - **`description`** *string*
-
-      description of the args.
-
-    - **`value`** *string array*
-
-	  values of the args.
-
-- **`linux`** *PluginLinux*
-
-    - **`capabilities`** *string array*
-
-       capabilities of the plugin (*Linux only*), see list [`here`](https://github.com/opencontainers/runc/blob/master/libcontainer/SPEC.md#security)
-
-    - **`allowAllDevices`** *boolean*
-
-	   If `/dev` is bind mounted from the host, and allowAllDevices is set to true, the plugin will have `rwm` access to all devices on the host.
-
-    - **`devices`** *PluginDevice array*
-
-       device of the plugin, (*Linux only*), struct consisting of the following fields, see [`DEVICES`](https://github.com/opencontainers/runtime-spec/blob/master/config-linux.md#devices)
-
-         - **`name`** *string*
-
-	       name of the device.
-
-         - **`description`** *string*
-
-           description of the device.
-
-         - **`path`** *string*
-
-           path of the device.
-
-## Example Config
-
-*Example showing the 'tiborvass/sample-volume-plugin' plugin config.*
-
-```json
-{
-            "Args": {
-                "Description": "",
-                "Name": "",
-                "Settable": null,
-                "Value": null
-            },
-            "Description": "A sample volume plugin for Docker",
-            "Documentation": "https://docs.docker.com/engine/extend/plugins/",
-            "Entrypoint": [
-                "/usr/bin/sample-volume-plugin",
-                "/data"
-            ],
-            "Env": [
-                {
-                    "Description": "",
-                    "Name": "DEBUG",
-                    "Settable": [
-                        "value"
-                    ],
-                    "Value": "0"
-                }
-            ],
-            "Interface": {
-                "Socket": "plugin.sock",
-                "Types": [
-                    "docker.volumedriver/1.0"
-                ]
-            },
-            "Linux": {
-                "Capabilities": null,
-                "AllowAllDevices": false,
-                "Devices": null
-            },
-            "Mounts": null,
-            "Network": {
-                "Type": ""
-            },
-            "PropagatedMount": "/data",
-            "User": {},
-            "Workdir": ""
-}
-```
diff --git a/components/engine/docs/extend/images/authz_additional_info.png b/components/engine/docs/extend/images/authz_additional_info.png
deleted file mode 100644
index 1a6a6d01d2..0000000000
Binary files a/components/engine/docs/extend/images/authz_additional_info.png and /dev/null differ
diff --git a/components/engine/docs/extend/images/authz_allow.png b/components/engine/docs/extend/images/authz_allow.png
deleted file mode 100644
index f42108040b..0000000000
Binary files a/components/engine/docs/extend/images/authz_allow.png and /dev/null differ
diff --git a/components/engine/docs/extend/images/authz_chunked.png b/components/engine/docs/extend/images/authz_chunked.png
deleted file mode 100644
index 5bde2c71f9..0000000000
Binary files a/components/engine/docs/extend/images/authz_chunked.png and /dev/null differ
diff --git a/components/engine/docs/extend/images/authz_connection_hijack.png b/components/engine/docs/extend/images/authz_connection_hijack.png
deleted file mode 100644
index f13a2987b2..0000000000
Binary files a/components/engine/docs/extend/images/authz_connection_hijack.png and /dev/null differ
diff --git a/components/engine/docs/extend/images/authz_deny.png b/components/engine/docs/extend/images/authz_deny.png
deleted file mode 100644
index fa4a48584a..0000000000
Binary files a/components/engine/docs/extend/images/authz_deny.png and /dev/null differ
diff --git a/components/engine/docs/extend/index.md b/components/engine/docs/extend/index.md
deleted file mode 100644
index 2fe2d83687..0000000000
--- a/components/engine/docs/extend/index.md
+++ /dev/null
@@ -1,262 +0,0 @@
----
-description: Develop and use a plugin with the managed plugin system
-keywords: "API, Usage, plugins, documentation, developer"
-title: Managed plugin system
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# Docker Engine managed plugin system
-
-* [Installing and using a plugin](index.md#installing-and-using-a-plugin)
-* [Developing a plugin](index.md#developing-a-plugin)
-* [Debugging plugins](index.md#debugging-plugins)
-
-Docker Engine's plugin system allows you to install, start, stop, and remove
-plugins using Docker Engine.
-
-For information about the legacy plugin system available in Docker Engine 1.12
-and earlier, see [Understand legacy Docker Engine plugins](legacy_plugins.md).
-
-> **Note**: Docker Engine managed plugins are currently not supported
-on Windows daemons.
-
-## Installing and using a plugin
-
-Plugins are distributed as Docker images and can be hosted on Docker Hub or on
-a private registry.
-
-To install a plugin, use the `docker plugin install` command, which pulls the
-plugin from Docker Hub or your private registry, prompts you to grant
-permissions or capabilities if necessary, and enables the plugin.
-
-To check the status of installed plugins, use the `docker plugin ls` command.
-Plugins that start successfully are listed as enabled in the output.
-
-After a plugin is installed, you can use it as an option for another Docker
-operation, such as creating a volume.
-
-In the following example, you install the `sshfs` plugin, verify that it is
-enabled, and use it to create a volume.
-
-> **Note**: This example is intended for instructional purposes only. Once the volume is created, your SSH password to the remote host will be exposed as plaintext when inspecting the volume. You should delete the volume as soon as you are done with the example.
-
-1.  Install the `sshfs` plugin.
-
-    ```bash
-    $ docker plugin install vieux/sshfs
-
-    Plugin "vieux/sshfs" is requesting the following privileges:
-    - network: [host]
-    - capabilities: [CAP_SYS_ADMIN]
-    Do you grant the above permissions? [y/N] y
-
-    vieux/sshfs
-    ```
-
-    The plugin requests 2 privileges:
-    
-    - It needs access to the `host` network.
-    - It needs the `CAP_SYS_ADMIN` capability, which allows the plugin to run
-    the `mount` command.
-
-2.  Check that the plugin is enabled in the output of `docker plugin ls`.
-
-    ```bash
-    $ docker plugin ls
-
-    ID                    NAME                  TAG                 DESCRIPTION                   ENABLED
-    69553ca1d789          vieux/sshfs           latest              the `sshfs` plugin            true
-    ```
-
-3.  Create a volume using the plugin.
-    This example mounts the `/remote` directory on host `1.2.3.4` into a
-    volume named `sshvolume`.   
-
-    This volume can now be mounted into containers.
-
-    ```bash
-    $ docker volume create \
-      -d vieux/sshfs \
-      --name sshvolume \
-      -o sshcmd=user@1.2.3.4:/remote \
-      -o password=$(cat file_containing_password_for_remote_host)
-
-    sshvolume
-    ```
-4.  Verify that the volume was created successfully.
-
-    ```bash
-    $ docker volume ls
-
-    DRIVER              NAME
-    vieux/sshfs         sshvolume
-    ```
-
-5.  Start a container that uses the volume `sshvolume`.
-
-    ```bash
-    $ docker run --rm -v sshvolume:/data busybox ls /data
-
-    <content of /remote on machine 1.2.3.4>
-    ```
-
-6.  Remove the volume `sshvolume`
-    ```bash
-    docker volume rm sshvolume
-
-    sshvolume
-    ```
-To disable a plugin, use the `docker plugin disable` command. To completely
-remove it, use the `docker plugin remove` command. For other available
-commands and options, see the
-[command line reference](../reference/commandline/index.md).
-
-
-## Developing a plugin
-
-#### The rootfs directory
-The `rootfs` directory represents the root filesystem of the plugin. In this
-example, it was created from a Dockerfile:
-
->**Note:** The `/run/docker/plugins` directory is mandatory inside of the
-plugin's filesystem for docker to communicate with the plugin.
-
-```bash
-$ git clone https://github.com/vieux/docker-volume-sshfs
-$ cd docker-volume-sshfs
-$ docker build -t rootfsimage .
-$ id=$(docker create rootfsimage true) # id was cd851ce43a403 when the image was created
-$ sudo mkdir -p myplugin/rootfs
-$ sudo docker export "$id" | sudo tar -x -C myplugin/rootfs
-$ docker rm -vf "$id"
-$ docker rmi rootfsimage
-```
-
-#### The config.json file
-
-The `config.json` file describes the plugin. See the [plugins config reference](config.md).
-
-Consider the following `config.json` file.
-
-```json
-{
-	"description": "sshFS plugin for Docker",
-	"documentation": "https://docs.docker.com/engine/extend/plugins/",
-	"entrypoint": ["/docker-volume-sshfs"],
-	"network": {
-		   "type": "host"
-		   },
-	"interface" : {
-		   "types": ["docker.volumedriver/1.0"],
-		   "socket": "sshfs.sock"
-	},
-	"linux": {
-		"capabilities": ["CAP_SYS_ADMIN"]
-	}
-}
-```
-
-This plugin is a volume driver. It requires a `host` network and the
-`CAP_SYS_ADMIN` capability. It depends upon the `/docker-volume-sshfs`
-entrypoint and uses the `/run/docker/plugins/sshfs.sock` socket to communicate
-with Docker Engine. This plugin has no runtime parameters.
-
-#### Creating the plugin
-
-A new plugin can be created by running
-`docker plugin create <plugin-name> ./path/to/plugin/data` where the plugin
-data contains a plugin configuration file `config.json` and a root filesystem
-in subdirectory `rootfs`.
-
-After that the plugin `<plugin-name>` will show up in `docker plugin ls`.
-Plugins can be pushed to remote registries with
-`docker plugin push <plugin-name>`.
-
-
-## Debugging plugins
-
-Stdout of a plugin is redirected to dockerd logs. Such entries have a
-`plugin=<ID>` suffix. Here are a few examples of commands for pluginID
-`f52a3df433b9aceee436eaada0752f5797aab1de47e5485f1690a073b860ff62` and their
-corresponding log entries in the docker daemon logs.
-
-```bash
-$ docker plugin install tiborvass/sample-volume-plugins
-
-INFO[0036] Starting...       Found 0 volumes on startup  plugin=f52a3df433b9aceee436eaada0752f5797aab1de47e5485f1690a073b860ff62
-```
-
-```bash
-$ docker volume create -d tiborvass/sample-volume-plugins samplevol
-
-INFO[0193] Create Called...  Ensuring directory /data/samplevol exists on host...  plugin=f52a3df433b9aceee436eaada0752f5797aab1de47e5485f1690a073b860ff62
-INFO[0193] open /var/lib/docker/plugin-data/local-persist.json: no such file or directory  plugin=f52a3df433b9aceee436eaada0752f5797aab1de47e5485f1690a073b860ff62
-INFO[0193]                   Created volume samplevol with mountpoint /data/samplevol  plugin=f52a3df433b9aceee436eaada0752f5797aab1de47e5485f1690a073b860ff62
-INFO[0193] Path Called...    Returned path /data/samplevol  plugin=f52a3df433b9aceee436eaada0752f5797aab1de47e5485f1690a073b860ff62
-```
-
-```bash
-$ docker run -v samplevol:/tmp busybox sh
-
-INFO[0421] Get Called...     Found samplevol                plugin=f52a3df433b9aceee436eaada0752f5797aab1de47e5485f1690a073b860ff62
-INFO[0421] Mount Called...   Mounted samplevol              plugin=f52a3df433b9aceee436eaada0752f5797aab1de47e5485f1690a073b860ff62
-INFO[0421] Path Called...    Returned path /data/samplevol  plugin=f52a3df433b9aceee436eaada0752f5797aab1de47e5485f1690a073b860ff62
-INFO[0421] Unmount Called... Unmounted samplevol            plugin=f52a3df433b9aceee436eaada0752f5797aab1de47e5485f1690a073b860ff62
-```
-
-#### Using docker-runc to obtain logfiles and shell into the plugin.
-
-`docker-runc`, the default docker container runtime can be used for debugging
-plugins. This is specifically useful to collect plugin logs if they are
-redirected to a file.
-
-```bash
-$ docker-runc list
-ID                                                                 PID         STATUS      BUNDLE                                                                                       CREATED
-f52a3df433b9aceee436eaada0752f5797aab1de47e5485f1690a073b860ff62   2679        running     /run/docker/libcontainerd/f52a3df433b9aceee436eaada0752f5797aab1de47e5485f1690a073b860ff62	2017-02-06T21:53:03.031537592Z
-r
-```
-
-```bash
-$ docker-runc exec f52a3df433b9aceee436eaada0752f5797aab1de47e5485f1690a073b860ff62 cat /var/log/plugin.log
-```
-
-If the plugin has a built-in shell, then exec into the plugin can be done as
-follows:
-```bash
-$ docker-runc exec -t f52a3df433b9aceee436eaada0752f5797aab1de47e5485f1690a073b860ff62 sh
-```
-
-#### Using curl to debug plugin socket issues.
-
-To verify if the plugin API socket that the docker daemon communicates with
-is responsive, use curl. In this example, we will make API calls from the
-docker host to volume and network plugins using curl 7.47.0 to ensure that
-the plugin is listening on the said socket. For a well functioning plugin,
-these basic requests should work. Note that plugin sockets are available on the host under `/var/run/docker/plugins/<pluginID>`
-
-
-```bash
-curl -H "Content-Type: application/json" -XPOST -d '{}' --unix-socket /var/run/docker/plugins/e8a37ba56fc879c991f7d7921901723c64df6b42b87e6a0b055771ecf8477a6d/plugin.sock http:/VolumeDriver.List
-
-{"Mountpoint":"","Err":"","Volumes":[{"Name":"myvol1","Mountpoint":"/data/myvol1"},{"Name":"myvol2","Mountpoint":"/data/myvol2"}],"Volume":null}
-```
-
-```bash
-curl -H "Content-Type: application/json" -XPOST -d '{}' --unix-socket /var/run/docker/plugins/45e00a7ce6185d6e365904c8bcf62eb724b1fe307e0d4e7ecc9f6c1eb7bcdb70/plugin.sock http:/NetworkDriver.GetCapabilities
-
-{"Scope":"local"}
-```
-When using curl 7.5 and above, the URL should be of the form
-`http://hostname/APICall`, where `hostname` is the valid hostname where the
-plugin is installed and `APICall` is the call to the plugin API.
-
-For example, `http://localhost/VolumeDriver.List`
diff --git a/components/engine/docs/extend/legacy_plugins.md b/components/engine/docs/extend/legacy_plugins.md
deleted file mode 100644
index 68bba59f46..0000000000
--- a/components/engine/docs/extend/legacy_plugins.md
+++ /dev/null
@@ -1,101 +0,0 @@
----
-redirect_from:
-- "/engine/extend/plugins/"
-title: "Use Docker Engine plugins"
-description: "How to add additional functionality to Docker with plugins extensions"
-keywords: "Examples, Usage, plugins, docker, documentation, user guide"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-This document describes the Docker Engine plugins generally available in Docker
-Engine. To view information on plugins managed by Docker,
-refer to [Docker Engine plugin system](index.md).
-
-You can extend the capabilities of the Docker Engine by loading third-party
-plugins. This page explains the types of plugins and provides links to several
-volume and network plugins for Docker.
-
-## Types of plugins
-
-Plugins extend Docker's functionality. They come in specific types.  For
-example, a [volume plugin](plugins_volume.md) might enable Docker
-volumes to persist across multiple Docker hosts and a
-[network plugin](plugins_network.md) might provide network plumbing.
-
-Currently Docker supports authorization, volume and network driver plugins. In the future it
-will support additional plugin types.
-
-## Installing a plugin
-
-Follow the instructions in the plugin's documentation.
-
-## Finding a plugin
-
-The sections below provide an inexhaustive overview of available plugins.
-
-<style>
-#DocumentationText  tr td:first-child { white-space: nowrap;}
-</style>
-
-### Network plugins
-
-Plugin                                                                              | Description
------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
-[Contiv Networking](https://github.com/contiv/netplugin)                            | An open source network plugin to provide infrastructure and security policies for a multi-tenant micro services deployment, while providing an integration to physical network for non-container workload. Contiv Networking implements the remote driver and IPAM APIs available in Docker 1.9 onwards.
-[Kuryr Network Plugin](https://github.com/openstack/kuryr)                          | A network plugin is developed as part of the OpenStack Kuryr project and implements the Docker networking (libnetwork) remote driver API by utilizing Neutron, the OpenStack networking service. It includes an IPAM driver as well.
-[Weave Network Plugin](https://www.weave.works/docs/net/latest/introducing-weave/)    | A network plugin that creates a virtual network that connects your Docker containers - across multiple hosts or clouds and enables automatic discovery of applications. Weave networks are resilient, partition tolerant, secure and work in partially connected networks, and other adverse environments - all configured with delightful simplicity.
-
-### Volume plugins
-
-Plugin                                                                              | Description
------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
-[Azure File Storage plugin](https://github.com/Azure/azurefile-dockervolumedriver)  | Lets you mount Microsoft [Azure File Storage](https://azure.microsoft.com/blog/azure-file-storage-now-generally-available/) shares to Docker containers as volumes using the SMB 3.0 protocol. [Learn more](https://azure.microsoft.com/blog/persistent-docker-volumes-with-azure-file-storage/).
-[BeeGFS Volume Plugin](https://github.com/RedCoolBeans/docker-volume-beegfs)        | An open source volume plugin to create persistent volumes in a BeeGFS parallel file system.
-[Blockbridge plugin](https://github.com/blockbridge/blockbridge-docker-volume)      | A volume plugin that provides access to an extensible set of container-based persistent storage options. It supports single and multi-host Docker environments with features that include tenant isolation, automated provisioning, encryption, secure deletion, snapshots and QoS.
-[Contiv Volume Plugin](https://github.com/contiv/volplugin)                         | An open source volume plugin that provides multi-tenant, persistent, distributed storage with intent based consumption. It has support for Ceph and NFS.
-[Convoy plugin](https://github.com/rancher/convoy)                                  | A volume plugin for a variety of storage back-ends including device mapper and NFS. It's a simple standalone executable written in Go and provides the framework to support vendor-specific extensions such as snapshots, backups and restore.
-[DigitalOcean Block Storage plugin](https://github.com/omallo/docker-volume-plugin-dostorage) | Integrates DigitalOcean's [block storage solution](https://www.digitalocean.com/products/storage/) into the Docker ecosystem by automatically attaching a given block storage volume to a DigitalOcean droplet and making the contents of the volume available to Docker containers running on that droplet.
-[DRBD plugin](https://www.drbd.org/en/supported-projects/docker)                    | A volume plugin that provides highly available storage replicated by [DRBD](https://www.drbd.org). Data written to the docker volume is replicated in a cluster of DRBD nodes.
-[Flocker plugin](https://clusterhq.com/docker-plugin/)                              | A volume plugin that provides multi-host portable volumes for Docker, enabling you to run databases and other stateful containers and move them around across a cluster of machines.
-[Fuxi Volume Plugin](https://github.com/openstack/fuxi)                             | A volume plugin that is developed as part of the OpenStack Kuryr project and implements the Docker volume plugin API by utilizing Cinder, the OpenStack block storage service.
-[gce-docker plugin](https://github.com/mcuadros/gce-docker)                         | A volume plugin able to attach, format and mount Google Compute [persistent-disks](https://cloud.google.com/compute/docs/disks/persistent-disks).
-[GlusterFS plugin](https://github.com/calavera/docker-volume-glusterfs)             | A volume plugin that provides multi-host volumes management for Docker using GlusterFS.
-[Horcrux Volume Plugin](https://github.com/muthu-r/horcrux)                         | A volume plugin that allows on-demand, version controlled access to your data. Horcrux is an open-source plugin, written in Go, and supports SCP, [Minio](https://www.minio.io) and Amazon S3.
-[HPE 3Par Volume Plugin](https://github.com/hpe-storage/python-hpedockerplugin/)    | A volume plugin that supports HPE 3Par and StoreVirtual iSCSI storage arrays.
-[IPFS Volume Plugin](http://github.com/vdemeester/docker-volume-ipfs)               | An open source volume plugin that allows using an [ipfs](https://ipfs.io/) filesystem as a volume.
-[Keywhiz plugin](https://github.com/calavera/docker-volume-keywhiz)                 | A plugin that provides credentials and secret management using Keywhiz as a central repository.
-[Local Persist Plugin](https://github.com/CWSpear/local-persist)                    | A volume plugin that extends the default `local` driver's functionality by allowing you specify a mountpoint anywhere on the host, which enables the files to *always persist*, even if the volume is removed via `docker volume rm`.
-[NetApp Plugin](https://github.com/NetApp/netappdvp) (nDVP)                         | A volume plugin that provides direct integration with the Docker ecosystem for the NetApp storage portfolio. The nDVP package supports the provisioning and management of storage resources from the storage platform to Docker hosts, with a robust framework for adding additional platforms in the future.
-[Netshare plugin](https://github.com/ContainX/docker-volume-netshare)                 | A volume plugin that provides volume management for NFS 3/4, AWS EFS and CIFS file systems.
-[Nimble Storage Volume Plugin](https://connect.nimblestorage.com/community/app-integration/docker)| A volume plug-in that integrates with Nimble Storage Unified Flash Fabric arrays. The plug-in abstracts array volume capabilities to the Docker administrator to allow self-provisioning of secure multi-tenant volumes and clones.
-[OpenStorage Plugin](https://github.com/libopenstorage/openstorage)                 | A cluster-aware volume plugin that provides volume management for file and block storage solutions.  It implements a vendor neutral specification for implementing extensions such as CoS, encryption, and snapshots. It has example drivers based on FUSE, NFS, NBD and EBS to name a few.
-[Portworx Volume Plugin](https://github.com/portworx/px-dev)                        | A volume plugin that turns any server into a scale-out converged compute/storage node, providing container granular storage and highly available volumes across any node, using a shared-nothing storage backend that works with any docker scheduler.
-[Quobyte Volume Plugin](https://github.com/quobyte/docker-volume)                   | A volume plugin that connects Docker to [Quobyte](http://www.quobyte.com/containers)'s data center file system, a general-purpose scalable and fault-tolerant storage platform.
-[REX-Ray plugin](https://github.com/emccode/rexray)                                 | A volume plugin which is written in Go and provides advanced storage functionality for many platforms including VirtualBox, EC2, Google Compute Engine, OpenStack, and EMC.
-[Virtuozzo Storage and Ploop plugin](https://github.com/virtuozzo/docker-volume-ploop) | A volume plugin with support for Virtuozzo Storage distributed cloud file system as well as ploop devices.
-[VMware vSphere Storage Plugin](https://github.com/vmware/docker-volume-vsphere)    | Docker Volume Driver for vSphere enables customers to address persistent storage requirements for Docker containers in vSphere environments.
-
-### Authorization plugins
-
- Plugin                                                       | Description
-------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
- [Twistlock AuthZ Broker](https://github.com/twistlock/authz) | A basic extendable authorization plugin that runs directly on the host or inside a container. This plugin allows you to define user policies that it evaluates during authorization. Basic authorization is provided if Docker daemon is started with the --tlsverify flag (username is extracted from the certificate common name).
- [HBM plugin](https://github.com/kassisol/hbm)                | An authorization plugin that prevents from executing commands with certains parameters.
-
-## Troubleshooting a plugin
-
-If you are having problems with Docker after loading a plugin, ask the authors
-of the plugin for help. The Docker team may not be able to assist you.
-
-## Writing a plugin
-
-If you are interested in writing a plugin for Docker, or seeing how they work
-under the hood, see the [docker plugins reference](plugin_api.md).
diff --git a/components/engine/docs/extend/plugin_api.md b/components/engine/docs/extend/plugin_api.md
deleted file mode 100644
index 693b77a2f3..0000000000
--- a/components/engine/docs/extend/plugin_api.md
+++ /dev/null
@@ -1,196 +0,0 @@
----
-title: "Plugins API"
-description: "How to write Docker plugins extensions "
-keywords: "API, Usage, plugins, documentation, developer"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# Docker Plugin API
-
-Docker plugins are out-of-process extensions which add capabilities to the
-Docker Engine.
-
-This document describes the Docker Engine plugin API. To view information on
-plugins managed by Docker Engine, refer to [Docker Engine plugin system](index.md).
-
-This page is intended for people who want to develop their own Docker plugin.
-If you just want to learn about or use Docker plugins, look
-[here](legacy_plugins.md).
-
-## What plugins are
-
-A plugin is a process running on the same or a different host as the docker daemon,
-which registers itself by placing a file on the same docker host in one of the plugin
-directories described in [Plugin discovery](#plugin-discovery).
-
-Plugins have human-readable names, which are short, lowercase strings. For
-example, `flocker` or `weave`.
-
-Plugins can run inside or outside containers. Currently running them outside
-containers is recommended.
-
-## Plugin discovery
-
-Docker discovers plugins by looking for them in the plugin directory whenever a
-user or container tries to use one by name.
-
-There are three types of files which can be put in the plugin directory.
-
-* `.sock` files are UNIX domain sockets.
-* `.spec` files are text files containing a URL, such as `unix:///other.sock` or `tcp://localhost:8080`.
-* `.json` files are text files containing a full json specification for the plugin.
-
-Plugins with UNIX domain socket files must run on the same docker host, whereas
-plugins with spec or json files can run on a different host if a remote URL is specified.
-
-UNIX domain socket files must be located under `/run/docker/plugins`, whereas
-spec files can be located either under `/etc/docker/plugins` or `/usr/lib/docker/plugins`.
-
-The name of the file (excluding the extension) determines the plugin name.
-
-For example, the `flocker` plugin might create a UNIX socket at
-`/run/docker/plugins/flocker.sock`.
-
-You can define each plugin into a separated subdirectory if you want to isolate definitions from each other.
-For example, you can create the `flocker` socket under `/run/docker/plugins/flocker/flocker.sock` and only
-mount `/run/docker/plugins/flocker` inside the `flocker` container.
-
-Docker always searches for unix sockets in `/run/docker/plugins` first. It checks for spec or json files under
-`/etc/docker/plugins` and `/usr/lib/docker/plugins` if the socket doesn't exist. The directory scan stops as
-soon as it finds the first plugin definition with the given name.
-
-### JSON specification
-
-This is the JSON format for a plugin:
-
-```json
-{
-  "Name": "plugin-example",
-  "Addr": "https://example.com/docker/plugin",
-  "TLSConfig": {
-    "InsecureSkipVerify": false,
-    "CAFile": "/usr/shared/docker/certs/example-ca.pem",
-    "CertFile": "/usr/shared/docker/certs/example-cert.pem",
-    "KeyFile": "/usr/shared/docker/certs/example-key.pem"
-  }
-}
-```
-
-The `TLSConfig` field is optional and TLS will only be verified if this configuration is present.
-
-## Plugin lifecycle
-
-Plugins should be started before Docker, and stopped after Docker.  For
-example, when packaging a plugin for a platform which supports `systemd`, you
-might use [`systemd` dependencies](
-http://www.freedesktop.org/software/systemd/man/systemd.unit.html#Before=) to
-manage startup and shutdown order.
-
-When upgrading a plugin, you should first stop the Docker daemon, upgrade the
-plugin, then start Docker again.
-
-## Plugin activation
-
-When a plugin is first referred to -- either by a user referring to it by name
-(e.g.  `docker run --volume-driver=foo`) or a container already configured to
-use a plugin being started -- Docker looks for the named plugin in the plugin
-directory and activates it with a handshake. See Handshake API below.
-
-Plugins are *not* activated automatically at Docker daemon startup. Rather,
-they are activated only lazily, or on-demand, when they are needed.
-
-## Systemd socket activation
-
-Plugins may also be socket activated by `systemd`. The official [Plugins helpers](https://github.com/docker/go-plugins-helpers)
-natively supports socket activation. In order for a plugin to be socket activated it needs
-a `service` file and a `socket` file.
-
-The `service` file (for example `/lib/systemd/system/your-plugin.service`):
-
-```
-[Unit]
-Description=Your plugin
-Before=docker.service
-After=network.target your-plugin.socket
-Requires=your-plugin.socket docker.service
-
-[Service]
-ExecStart=/usr/lib/docker/your-plugin
-
-[Install]
-WantedBy=multi-user.target
-```
-The `socket` file (for example `/lib/systemd/system/your-plugin.socket`):
-
-```
-[Unit]
-Description=Your plugin
-
-[Socket]
-ListenStream=/run/docker/plugins/your-plugin.sock
-
-[Install]
-WantedBy=sockets.target
-```
-
-This will allow plugins to be actually started when the Docker daemon connects to
-the sockets they're listening on (for instance the first time the daemon uses them
-or if one of the plugin goes down accidentally).
-
-## API design
-
-The Plugin API is RPC-style JSON over HTTP, much like webhooks.
-
-Requests flow *from* the Docker daemon *to* the plugin.  So the plugin needs to
-implement an HTTP server and bind this to the UNIX socket mentioned in the
-"plugin discovery" section.
-
-All requests are HTTP `POST` requests.
-
-The API is versioned via an Accept header, which currently is always set to
-`application/vnd.docker.plugins.v1+json`.
-
-## Handshake API
-
-Plugins are activated via the following "handshake" API call.
-
-### /Plugin.Activate
-
-**Request:** empty body
-
-**Response:**
-```
-{
-    "Implements": ["VolumeDriver"]
-}
-```
-
-Responds with a list of Docker subsystems which this plugin implements.
-After activation, the plugin will then be sent events from this subsystem.
-
-Possible values are:
-
-* [`authz`](plugins_authorization.md)
-* [`NetworkDriver`](plugins_network.md)
-* [`VolumeDriver`](plugins_volume.md)
-
-
-## Plugin retries
-
-Attempts to call a method on a plugin are retried with an exponential backoff
-for up to 30 seconds. This may help when packaging plugins as containers, since
-it gives plugin containers a chance to start up before failing any user
-containers which depend on them.
-
-## Plugins helpers
-
-To ease plugins development, we're providing an `sdk` for each kind of plugins
-currently supported by Docker at [docker/go-plugins-helpers](https://github.com/docker/go-plugins-helpers).
diff --git a/components/engine/docs/extend/plugins_authorization.md b/components/engine/docs/extend/plugins_authorization.md
deleted file mode 100644
index ac1837f754..0000000000
--- a/components/engine/docs/extend/plugins_authorization.md
+++ /dev/null
@@ -1,260 +0,0 @@
----
-title: "Access authorization plugin"
-description: "How to create authorization plugins to manage access control to your Docker daemon."
-keywords: "security, authorization, authentication, docker, documentation, plugin, extend"
-redirect_from:
-- "/engine/extend/authorization/"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# Create an authorization plugin
-
-This document describes the Docker Engine plugins generally available in Docker
-Engine. To view information on plugins managed by Docker Engine,
-refer to [Docker Engine plugin system](index.md).
-
-Docker's out-of-the-box authorization model is all or nothing. Any user with
-permission to access the Docker daemon can run any Docker client command. The
-same is true for callers using Docker's Engine API to contact the daemon. If you
-require greater access control, you can create authorization plugins and add
-them to your Docker daemon configuration. Using an authorization plugin, a
-Docker administrator can configure granular access policies for managing access
-to Docker daemon.
-
-Anyone with the appropriate skills can develop an authorization plugin. These
-skills, at their most basic, are knowledge of Docker, understanding of REST, and
-sound programming knowledge. This document describes the architecture, state,
-and methods information available to an authorization plugin developer.
-
-## Basic principles
-
-Docker's [plugin infrastructure](plugin_api.md) enables
-extending Docker by loading, removing and communicating with
-third-party components using a generic API. The access authorization subsystem
-was built using this mechanism.
-
-Using this subsystem, you don't need to rebuild the Docker daemon to add an
-authorization plugin.  You can add a plugin to an installed Docker daemon. You do
-need to restart the Docker daemon to add a new plugin.
-
-An authorization plugin approves or denies requests to the Docker daemon based
-on both the current authentication context and the command context. The
-authentication context contains all user details and the authentication method.
-The command context contains all the relevant request data.
-
-Authorization plugins must follow the rules described in [Docker Plugin API](plugin_api.md).
-Each plugin must reside within directories described under the
-[Plugin discovery](plugin_api.md#plugin-discovery) section.
-
-**Note**: the abbreviations `AuthZ` and `AuthN` mean authorization and authentication
-respectively.
-
-## Default user authorization mechanism
-
-If TLS is enabled in the [Docker daemon](https://docs.docker.com/engine/security/https/), the default user authorization flow extracts the user details from the certificate subject name.
-That is, the `User` field is set to the client certificate subject common name, and the `AuthenticationMethod` field is set to `TLS`.
-
-## Basic architecture
-
-You are responsible for registering your plugin as part of the Docker daemon
-startup. You can install multiple plugins and chain them together. This chain
-can be ordered. Each request to the daemon passes in order through the chain.
-Only when all the plugins grant access to the resource, is the access granted.
-
-When an HTTP request is made to the Docker daemon through the CLI or via the
-Engine API, the authentication subsystem passes the request to the installed
-authentication plugin(s). The request contains the user (caller) and command
-context. The plugin is responsible for deciding whether to allow or deny the
-request.
-
-The sequence diagrams below depict an allow and deny authorization flow:
-
-![Authorization Allow flow](images/authz_allow.png)
-
-![Authorization Deny flow](images/authz_deny.png)
-
-Each request sent to the plugin includes the authenticated user, the HTTP
-headers, and the request/response body. Only the user name and the
-authentication method used are passed to the plugin. Most importantly, no user
-credentials or tokens are passed. Finally, not all request/response bodies
-are sent to the authorization plugin. Only those request/response bodies where
-the `Content-Type` is either `text/*` or `application/json` are sent.
-
-For commands that can potentially hijack the HTTP connection (`HTTP
-Upgrade`), such as `exec`, the authorization plugin is only called for the
-initial HTTP requests. Once the plugin approves the command, authorization is
-not applied to the rest of the flow. Specifically, the streaming data is not
-passed to the authorization plugins. For commands that return chunked HTTP
-response, such as `logs` and `events`, only the HTTP request is sent to the
-authorization plugins.
-
-During request/response processing, some authorization flows might
-need to do additional queries to the Docker daemon. To complete such flows,
-plugins can call the daemon API similar to a regular user. To enable these
-additional queries, the plugin must provide the means for an administrator to
-configure proper authentication and security policies.
-
-## Docker client flows
-
-To enable and configure the authorization plugin, the plugin developer must
-support the Docker client interactions detailed in this section.
-
-### Setting up Docker daemon
-
-Enable the authorization plugin with a dedicated command line flag in the
-`--authorization-plugin=PLUGIN_ID` format. The flag supplies a `PLUGIN_ID`
-value. This value can be the plugin’s socket or a path to a specification file.
-Authorization plugins can be loaded without restarting the daemon. Refer
-to the [`dockerd` documentation](../reference/commandline/dockerd.md#configuration-reloading) for more information.
-
-```bash
-$ dockerd --authorization-plugin=plugin1 --authorization-plugin=plugin2,...
-```
-
-Docker's authorization subsystem supports multiple `--authorization-plugin` parameters.
-
-### Calling authorized command (allow)
-
-```bash
-$ docker pull centos
-...
-f1b10cd84249: Pull complete
-...
-```
-
-### Calling unauthorized command (deny)
-
-```bash
-$ docker pull centos
-...
-docker: Error response from daemon: authorization denied by plugin PLUGIN_NAME: volumes are not allowed.
-```
-
-### Error from plugins
-
-```bash
-$ docker pull centos
-...
-docker: Error response from daemon: plugin PLUGIN_NAME failed with error: AuthZPlugin.AuthZReq: Cannot connect to the Docker daemon. Is the docker daemon running on this host?.
-```
-
-## API schema and implementation
-
-In addition to Docker's standard plugin registration method, each plugin
-should implement the following two methods:
-
-* `/AuthZPlugin.AuthZReq` This authorize request method is called before the Docker daemon processes the client request.
-
-* `/AuthZPlugin.AuthZRes` This authorize response method is called before the response is returned from Docker daemon to the client.
-
-#### /AuthZPlugin.AuthZReq
-
-**Request**:
-
-```json
-{
-    "User":              "The user identification",
-    "UserAuthNMethod":   "The authentication method used",
-    "RequestMethod":     "The HTTP method",
-    "RequestURI":        "The HTTP request URI",
-    "RequestBody":       "Byte array containing the raw HTTP request body",
-    "RequestHeader":     "Byte array containing the raw HTTP request header as a map[string][]string "
-}
-```
-
-**Response**:
-
-```json
-{
-    "Allow": "Determined whether the user is allowed or not",
-    "Msg":   "The authorization message",
-    "Err":   "The error message if things go wrong"
-}
-```
-#### /AuthZPlugin.AuthZRes
-
-**Request**:
-
-```json
-{
-    "User":              "The user identification",
-    "UserAuthNMethod":   "The authentication method used",
-    "RequestMethod":     "The HTTP method",
-    "RequestURI":        "The HTTP request URI",
-    "RequestBody":       "Byte array containing the raw HTTP request body",
-    "RequestHeader":     "Byte array containing the raw HTTP request header as a map[string][]string",
-    "ResponseBody":      "Byte array containing the raw HTTP response body",
-    "ResponseHeader":    "Byte array containing the raw HTTP response header as a map[string][]string",
-    "ResponseStatusCode":"Response status code"
-}
-```
-
-**Response**:
-
-```json
-{
-   "Allow":              "Determined whether the user is allowed or not",
-   "Msg":                "The authorization message",
-   "Err":                "The error message if things go wrong"
-}
-```
-
-### Request authorization
-
-Each plugin must support two request authorization messages formats, one from the daemon to the plugin and then from the plugin to the daemon. The tables below detail the content expected in each message.
-
-#### Daemon -> Plugin
-
-Name                   | Type              | Description
------------------------|-------------------|-------------------------------------------------------
-User                   | string            | The user identification
-Authentication method  | string            | The authentication method used
-Request method         | enum              | The HTTP method (GET/DELETE/POST)
-Request URI            | string            | The HTTP request URI including API version (e.g., v.1.17/containers/json)
-Request headers        | map[string]string | Request headers as key value pairs (without the authorization header)
-Request body           | []byte            | Raw request body
-
-
-#### Plugin -> Daemon
-
-Name    | Type   | Description
---------|--------|----------------------------------------------------------------------------------
-Allow   | bool   | Boolean value indicating whether the request is allowed or denied
-Msg     | string | Authorization message (will be returned to the client in case the access is denied)
-Err     | string | Error message (will be returned to the client in case the plugin encounter an error. The string value supplied may appear in logs, so should not include confidential information)
-
-### Response authorization
-
-The plugin must support two authorization messages formats, one from the daemon to the plugin and then from the plugin to the daemon. The tables below detail the content expected in each message.
-
-#### Daemon -> Plugin
-
-
-Name                    | Type              | Description
------------------------ |------------------ |----------------------------------------------------
-User                    | string            | The user identification
-Authentication method   | string            | The authentication method used
-Request method          | string            | The HTTP method (GET/DELETE/POST)
-Request URI             | string            | The HTTP request URI including API version (e.g., v.1.17/containers/json)
-Request headers         | map[string]string | Request headers as key value pairs (without the authorization header)
-Request body            | []byte            | Raw request body
-Response status code    | int               | Status code from the docker daemon
-Response headers        | map[string]string | Response headers as key value pairs
-Response body           | []byte            | Raw docker daemon response body
-
-
-#### Plugin -> Daemon
-
-Name    | Type   | Description
---------|--------|----------------------------------------------------------------------------------
-Allow   | bool   | Boolean value indicating whether the response is allowed or denied
-Msg     | string | Authorization message (will be returned to the client in case the access is denied)
-Err     | string | Error message (will be returned to the client in case the plugin encounter an error. The string value supplied may appear in logs, so should not include confidential information)
diff --git a/components/engine/docs/extend/plugins_graphdriver.md b/components/engine/docs/extend/plugins_graphdriver.md
deleted file mode 100644
index c134b1ebc4..0000000000
--- a/components/engine/docs/extend/plugins_graphdriver.md
+++ /dev/null
@@ -1,403 +0,0 @@
----
-title: "Graphdriver plugins"
-description: "How to manage image and container filesystems with external plugins"
-keywords: "Examples, Usage, storage, image, docker, data, graph, plugin, api"
-advisory: experimental
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-
-## Changelog
-
-### 1.13.0
-
-- Support v2 plugins
-
-# Docker graph driver plugins
-
-Docker graph driver plugins enable admins to use an external/out-of-process
-graph driver for use with Docker engine. This is an alternative to using the
-built-in storage drivers, such as aufs/overlay/devicemapper/btrfs.
-
-You need to install and enable the plugin and then restart the Docker daemon
-before using the plugin. See the following example for the correct ordering
-of steps.
-
-```
-$ docker plugin install cpuguy83/docker-overlay2-graphdriver-plugin # this command also enables the driver
-<output suppressed>
-$ pkill dockerd
-$ dockerd --experimental -s cpuguy83/docker-overlay2-graphdriver-plugin
-```
-
-# Write a graph driver plugin
-
-See the [plugin documentation](https://docs.docker.com/engine/extend/) for detailed information
-on the underlying plugin protocol.
-
-
-## Graph Driver plugin protocol
-
-If a plugin registers itself as a `GraphDriver` when activated, then it is
-expected to provide the rootfs for containers as well as image layer storage.
-
-### /GraphDriver.Init
-
-**Request**:
-```json
-{
-  "Home": "/graph/home/path",
-  "Opts": [],
-  "UIDMaps": [],
-  "GIDMaps": []
-}
-```
-
-Initialize the graph driver plugin with a home directory and array of options.
-These are passed through from the user, but the plugin is not required to parse
-or honor them.
-
-The request also includes a list of UID and GID mappings, structed as follows:
-```json
-{
-  "ContainerID": 0,
-  "HostID": 0,
-  "Size": 0
-}
-```
-
-**Response**:
-```json
-{
-  "Err": ""
-}
-```
-
-Respond with a non-empty string error if an error occurred.
-
-
-### /GraphDriver.Capabilities
-
-**Request**:
-```json
-{}
-```
-
-Get behavioral characteristics of the graph driver. If a plugin does not handle
-this request, the engine will use default values for all capabilities.
-
-**Response**:
-```json
-{
-  "ReproducesExactDiffs": false,
-}
-```
-
-Respond with values of capabilities:
-
-* **ReproducesExactDiffs** Defaults to false. Flags that this driver is capable
-of reproducing exactly equivalent diffs for read-only filesystem layers.
-
-
-### /GraphDriver.Create
-
-**Request**:
-```json
-{
-  "ID": "46fe8644f2572fd1e505364f7581e0c9dbc7f14640bd1fb6ce97714fb6fc5187",
-  "Parent": "2cd9c322cb78a55e8212aa3ea8425a4180236d7106938ec921d0935a4b8ca142",
-  "MountLabel": "",
-  "StorageOpt": {}
-}
-```
-
-Create a new, empty, read-only filesystem layer with the specified
-`ID`, `Parent` and `MountLabel`. If `Parent` is an empty string, there is no
-parent layer. `StorageOpt` is map of strings which indicate storage options.
-
-**Response**:
-```json
-{
-  "Err": ""
-}
-```
-
-Respond with a non-empty string error if an error occurred.
-
-### /GraphDriver.CreateReadWrite
-
-**Request**:
-```json
-{
-  "ID": "46fe8644f2572fd1e505364f7581e0c9dbc7f14640bd1fb6ce97714fb6fc5187",
-  "Parent": "2cd9c322cb78a55e8212aa3ea8425a4180236d7106938ec921d0935a4b8ca142",
-  "MountLabel": "",
-  "StorageOpt": {}
-}
-```
-
-Similar to `/GraphDriver.Create` but creates a read-write filesystem layer.
-
-### /GraphDriver.Remove
-
-**Request**:
-```json
-{
-  "ID": "46fe8644f2572fd1e505364f7581e0c9dbc7f14640bd1fb6ce97714fb6fc5187"
-}
-```
-
-Remove the filesystem layer with this given `ID`.
-
-**Response**:
-```json
-{
-  "Err": ""
-}
-```
-
-Respond with a non-empty string error if an error occurred.
-
-### /GraphDriver.Get
-
-**Request**:
-```json
-{
-  "ID": "46fe8644f2572fd1e505364f7581e0c9dbc7f14640bd1fb6ce97714fb6fc5187",
-  "MountLabel": ""
-}
-```
-
-Get the mountpoint for the layered filesystem referred to by the given `ID`.
-
-**Response**:
-```json
-{
-  "Dir": "/var/mygraph/46fe8644f2572fd1e505364f7581e0c9dbc7f14640bd1fb6ce97714fb6fc5187",
-  "Err": ""
-}
-```
-
-Respond with the absolute path to the mounted layered filesystem.
-Respond with a non-empty string error if an error occurred.
-
-### /GraphDriver.Put
-
-**Request**:
-```json
-{
-  "ID": "46fe8644f2572fd1e505364f7581e0c9dbc7f14640bd1fb6ce97714fb6fc5187"
-}
-```
-
-Release the system resources for the specified `ID`, such as unmounting the
-filesystem layer.
-
-**Response**:
-```json
-{
-  "Err": ""
-}
-```
-
-Respond with a non-empty string error if an error occurred.
-
-### /GraphDriver.Exists
-
-**Request**:
-```json
-{
-  "ID": "46fe8644f2572fd1e505364f7581e0c9dbc7f14640bd1fb6ce97714fb6fc5187"
-}
-```
-
-Determine if a filesystem layer with the specified `ID` exists.
-
-**Response**:
-```json
-{
-  "Exists": true
-}
-```
-
-Respond with a boolean for whether or not the filesystem layer with the specified
-`ID` exists.
-
-### /GraphDriver.Status
-
-**Request**:
-```json
-{}
-```
-
-Get low-level diagnostic information about the graph driver.
-
-**Response**:
-```json
-{
-  "Status": [[]]
-}
-```
-
-Respond with a 2-D array with key/value pairs for the underlying status
-information.
-
-
-### /GraphDriver.GetMetadata
-
-**Request**:
-```json
-{
-  "ID": "46fe8644f2572fd1e505364f7581e0c9dbc7f14640bd1fb6ce97714fb6fc5187"
-}
-```
-
-Get low-level diagnostic information about the layered filesystem with the
-with the specified `ID`
-
-**Response**:
-```json
-{
-  "Metadata": {},
-  "Err": ""
-}
-```
-
-Respond with a set of key/value pairs containing the low-level diagnostic
-information about the layered filesystem.
-Respond with a non-empty string error if an error occurred.
-
-### /GraphDriver.Cleanup
-
-**Request**:
-```json
-{}
-```
-
-Perform necessary tasks to release resources help by the plugin, such as
-unmounting all the layered file systems.
-
-**Response**:
-```json
-{
-  "Err": ""
-}
-```
-
-Respond with a non-empty string error if an error occurred.
-
-
-### /GraphDriver.Diff
-
-**Request**:
-```json
-{
-  "ID": "46fe8644f2572fd1e505364f7581e0c9dbc7f14640bd1fb6ce97714fb6fc5187",
-  "Parent": "2cd9c322cb78a55e8212aa3ea8425a4180236d7106938ec921d0935a4b8ca142"
-}
-```
-
-Get an archive of the changes between the filesystem layers specified by the `ID`
-and `Parent`. `Parent` may be an empty string, in which case there is no parent.
-
-**Response**:
-```
-{% raw %}
-{{ TAR STREAM }}
-{% endraw %}
-```
-
-### /GraphDriver.Changes
-
-**Request**:
-```json
-{
-  "ID": "46fe8644f2572fd1e505364f7581e0c9dbc7f14640bd1fb6ce97714fb6fc5187",
-  "Parent": "2cd9c322cb78a55e8212aa3ea8425a4180236d7106938ec921d0935a4b8ca142"
-}
-```
-
-Get a list of changes between the filesystem layers specified by the `ID` and
-`Parent`. If `Parent` is an empty string, there is no parent.
-
-**Response**:
-```json
-{
-  "Changes": [{}],
-  "Err": ""
-}
-```
-
-Respond with a list of changes. The structure of a change is:
-```json
-  "Path": "/some/path",
-  "Kind": 0,
-```
-
-Where the `Path` is the filesystem path within the layered filesystem that is
-changed and `Kind` is an integer specifying the type of change that occurred:
-
-- 0 - Modified
-- 1 - Added
-- 2 - Deleted
-
-Respond with a non-empty string error if an error occurred.
-
-### /GraphDriver.ApplyDiff
-
-**Request**:
-```
-{% raw %}
-{{ TAR STREAM }}
-{% endraw %}
-```
-
-Extract the changeset from the given diff into the layer with the specified `ID`
-and `Parent`
-
-**Query Parameters**:
-
-- id (required)- the `ID` of the new filesystem layer to extract the diff to
-- parent (required)- the `Parent` of the given `ID`
-
-**Response**:
-```json
-{
-  "Size": 512366,
-  "Err": ""
-}
-```
-
-Respond with the size of the new layer in bytes.
-Respond with a non-empty string error if an error occurred.
-
-### /GraphDriver.DiffSize
-
-**Request**:
-```json
-{
-  "ID": "46fe8644f2572fd1e505364f7581e0c9dbc7f14640bd1fb6ce97714fb6fc5187",
-  "Parent": "2cd9c322cb78a55e8212aa3ea8425a4180236d7106938ec921d0935a4b8ca142"
-}
-```
-
-Calculate the changes between the specified `ID`
-
-**Response**:
-```json
-{
-  "Size": 512366,
-  "Err": ""
-}
-```
-
-Respond with the size changes between the specified `ID` and `Parent`
-Respond with a non-empty string error if an error occurred.
diff --git a/components/engine/docs/extend/plugins_logging.md b/components/engine/docs/extend/plugins_logging.md
deleted file mode 100644
index 8f687b4a01..0000000000
--- a/components/engine/docs/extend/plugins_logging.md
+++ /dev/null
@@ -1,220 +0,0 @@
----
-title: "Docker log driver plugins"
-description: "Log driver plugins."
-keywords: "Examples, Usage, plugins, docker, documentation, user guide, logging"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# Logging driver plugins
-
-This document describes logging driver plugins for Docker.
-
-Logging drivers enables users to forward container logs to another service for
-processing. Docker includes several logging drivers as built-ins, however can
-never hope to support all use-cases with built-in drivers. Plugins allow Docker
-to support a wide range of logging services without requiring to embed client
-libraries for these services in the main Docker codebase. See the
-[plugin documentation](legacy_plugins.md) for more information.
-
-## Create a logging plugin
-
-The main interface for logging plugins uses the same JSON+HTTP RPC protocol used
-by other plugin types. See the
-[example](https://github.com/cpuguy83/docker-log-driver-test) plugin for a
-reference implementation of a logging plugin. The example wraps the built-in
-`jsonfilelog` log driver.
-
-## LogDriver protocol
-
-Logging plugins must register as a `LogDriver` during plugin activation. Once
-activated users can specify the plugin as a log driver.
-
-There are two HTTP endpoints that logging plugins must implement:
-
-### `/LogDriver.StartLogging`
-
-Signals to the plugin that a container is starting that the plugin should start
-receiving logs for.
-
-Logs will be streamed over the defined file in the request. On Linux this file
-is a FIFO. Logging plugins are not currently supported on Windows.
-
-**Request**:
-```json
-{
-		"File": "/path/to/file/stream",
-		"Info": {
-			"ContainerID": "123456"
-		}
-}
-```
-
-`File` is the path to the log stream that needs to be consumed. Each call to
-`StartLogging` should provide a different file path, even if it's a container
-that the plugin has already received logs for prior. The file is created by
-docker with a randomly generated name.
-
-`Info` is details about the container that's being logged. This is fairly
-free-form, but is defined by the following struct definition:
-
-```go
-type Info struct {
-	Config              map[string]string
-	ContainerID         string
-	ContainerName       string
-	ContainerEntrypoint string
-	ContainerArgs       []string
-	ContainerImageID    string
-	ContainerImageName  string
-	ContainerCreated    time.Time
-	ContainerEnv        []string
-	ContainerLabels     map[string]string
-	LogPath             string
-	DaemonName          string
-}
-```
-
-
-`ContainerID` will always be supplied with this struct, but other fields may be
-empty or missing.
-
-**Response**
-```json
-{
-	"Err": ""
-}
-```
-
-If an error occurred during this request, add an error message to the `Err` field
-in the response. If no error then you can either send an empty response (`{}`)
-or an empty value for the `Err` field.
-
-The driver should at this point be consuming log messages from the passed in file.
-If messages are unconsumed, it may cause the container to block while trying to
-write to its stdio streams.
-
-Log stream messages are encoded as protocol buffers. The protobuf definitions are
-in the
-[docker repository](https://github.com/docker/docker/blob/master/api/types/plugins/logdriver/entry.proto).
-
-Since protocol buffers are not self-delimited you must decode them from the stream
-using the following stream format:
-
-```
-[size][message]
-```
-
-Where `size` is a 4-byte big endian binary encoded uint32. `size` in this case
-defines the size of the next message. `message` is the actual log entry.
-
-A reference golang implementation of a stream encoder/decoder can be found
-[here](https://github.com/docker/docker/blob/master/api/types/plugins/logdriver/io.go)
-
-### `/LogDriver.StopLogging`
-
-Signals to the plugin to stop collecting logs from the defined file.
-Once a response is received, the file will be removed by Docker. You must make
-sure to collect all logs on the stream before responding to this request or risk
-losing log data.
-
-Requests on this endpoint does not mean that the container has been removed
-only that it has stopped.
-
-**Request**:
-```json
-{
-		"File": "/path/to/file/stream"
-}
-```
-
-**Response**:
-```json
-{
-	"Err": ""
-}
-```
-
-If an error occurred during this request, add an error message to the `Err` field
-in the response. If no error then you can either send an empty response (`{}`)
-or an empty value for the `Err` field.
-
-## Optional endpoints
-
-Logging plugins can implement two extra logging endpoints:
-
-### `/LogDriver.Capabilities`
-
-Defines the capabilities of the log driver. You must implement this endpoint for
-Docker to be able to take advantage of any of the defined capabilities.
-
-**Request**:
-```json
-{}
-```
-
-**Response**:
-```json
-{
-	"ReadLogs": true
-}
-```
-
-Supported capabilities:
-
-- `ReadLogs` - this tells Docker that the plugin is capable of reading back logs
-to clients. Plugins that report that they support `ReadLogs` must implement the
-`/LogDriver.ReadLogs` endpoint
-
-### `/LogDriver.ReadLogs`
-
-Reads back logs to the client. This is used when `docker logs <container>` is
-called.
-
-In order for Docker to use this endpoint, the plugin must specify as much when
-`/LogDriver.Capabilities` is called.
-
-
-**Request**:
-```json
-{
-	"ReadConfig": {},
-	"Info": {
-		"ContainerID": "123456"
-	}
-}
-```
-
-`ReadConfig` is the list of options for reading, it is defined with the following
-golang struct:
-
-```go
-type ReadConfig struct {
-	Since  time.Time
-	Tail   int
-	Follow bool
-}
-```
-
-- `Since` defines the oldest log that should be sent.
-- `Tail` defines the number of lines to read (e.g. like the command `tail -n 10`)
-- `Follow` signals that the client wants to stay attached to receive new log messages
-as they come in once the existing logs have been read.
-
-`Info` is the same type defined in `/LogDriver.StartLogging`. It should be used
-to determine what set of logs to read.
-
-**Response**:
-```
-{{ log stream }}
-```
-
-The response should be the encoded log message using the same format as the
-messages that the plugin consumed from Docker.
diff --git a/components/engine/docs/extend/plugins_metrics.md b/components/engine/docs/extend/plugins_metrics.md
deleted file mode 100644
index a86c7f22d2..0000000000
--- a/components/engine/docs/extend/plugins_metrics.md
+++ /dev/null
@@ -1,85 +0,0 @@
----
-title: "Docker metrics collector plugins"
-description: "Metrics plugins."
-keywords: "Examples, Usage, plugins, docker, documentation, user guide, metrics"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# Metrics Collector Plugins
-
-Docker exposes internal metrics based on the prometheus format. Metrics plugins
-enable accessing these metrics in a consistent way by providing a Unix
-socket at a predefined path where the plugin can scrape the metrics.
-
-> **Note**: that while the plugin interface for metrics is non-experimental, the naming
-of the metrics and metric labels is still considered experimental and may change
-in a future version.
-
-## Creating a metrics plugin
-
-You must currently set `PropagatedMount` in the plugin `config.json` to
-`/run/docker`. This allows the plugin to receive updated mounts
-(the bind-mounted socket) from Docker after the plugin is already configured.
-
-## MetricsCollector protocol
-
-Metrics plugins must register as implementing the`MetricsCollector` interface
-in `config.json`.
-
-On Unix platforms, the socket is located at `/run/docker/metrics.sock` in the
-plugin's rootfs.
-
-`MetricsCollector` must implement two endpoints:
-
-### `MetricsCollector.StartMetrics`
-
-Signals to the plugin that the metrics socket is now available for scraping
-
-**Request**
-```json
-{}
-```
-
-The request has no playload.
-
-**Response**
-```json
-{
-	"Err": ""
-}
-```
-
-If an error occurred during this request, add an error message to the `Err` field
-in the response. If no error then you can either send an empty response (`{}`)
-or an empty value for the `Err` field. Errors will only be logged.
-
-### `MetricsCollector.StopMetrics`
-
-Signals to the plugin that the metrics socket is no longer available.
-This may happen when the daemon is shutting down.
-
-**Request**
-```json
-{}
-```
-
-The request has no playload.
-
-**Response**
-```json
-{
-	"Err": ""
-}
-```
-
-If an error occurred during this request, add an error message to the `Err` field
-in the response. If no error then you can either send an empty response (`{}`)
-or an empty value for the `Err` field. Errors will only be logged.
diff --git a/components/engine/docs/extend/plugins_network.md b/components/engine/docs/extend/plugins_network.md
deleted file mode 100644
index a974862fa6..0000000000
--- a/components/engine/docs/extend/plugins_network.md
+++ /dev/null
@@ -1,77 +0,0 @@
----
-title: "Docker network driver plugins"
-description: "Network driver plugins."
-keywords: "Examples, Usage, plugins, docker, documentation, user guide"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# Engine network driver plugins
-
-This document describes Docker Engine network driver plugins generally
-available in Docker Engine. To view information on plugins
-managed by Docker Engine, refer to [Docker Engine plugin system](index.md).
-
-Docker Engine network plugins enable Engine deployments to be extended to
-support a wide range of networking technologies, such as VXLAN, IPVLAN, MACVLAN
-or something completely different. Network driver plugins are supported via the
-LibNetwork project. Each plugin is implemented as a  "remote driver" for
-LibNetwork, which shares plugin infrastructure with Engine. Effectively, network
-driver plugins are activated in the same way as other plugins, and use the same
-kind of protocol.
-
-## Network driver plugins and swarm mode
-
-Docker 1.12 adds support for cluster management and orchestration called
-[swarm mode](https://docs.docker.com/engine/swarm/). Docker Engine running in swarm mode currently
-only supports the built-in overlay driver for networking. Therefore existing
-networking plugins will not work in swarm mode.
-
-When you run Docker Engine outside of swarm mode, all networking plugins that
-worked in Docker 1.11 will continue to function normally. They do not require
-any modification.
-
-## Using network driver plugins
-
-The means of installing and running a network driver plugin depend on the
-particular plugin. So, be sure to install your plugin according to the
-instructions obtained from the plugin developer.
-
-Once running however, network driver plugins are used just like the built-in
-network drivers: by being mentioned as a driver in network-oriented Docker
-commands. For example,
-
-    $ docker network create --driver weave mynet
-
-Some network driver plugins are listed in [plugins](legacy_plugins.md)
-
-The `mynet` network is now owned by `weave`, so subsequent commands
-referring to that network will be sent to the plugin,
-
-    $ docker run --network=mynet busybox top
-
-
-## Write a network plugin
-
-Network plugins implement the [Docker plugin
-API](plugin_api.md) and the network plugin protocol
-
-## Network plugin protocol
-
-The network driver protocol, in addition to the plugin activation call, is
-documented as part of libnetwork:
-[https://github.com/docker/libnetwork/blob/master/docs/remote.md](https://github.com/docker/libnetwork/blob/master/docs/remote.md).
-
-# Related Information
-
-To interact with the Docker maintainers and other interested users, see the IRC channel `#docker-network`.
-
--  [Docker networks feature overview](https://docs.docker.com/engine/userguide/networking/)
--  The [LibNetwork](https://github.com/docker/libnetwork) project
diff --git a/components/engine/docs/extend/plugins_services.md b/components/engine/docs/extend/plugins_services.md
deleted file mode 100644
index 79e344f9ce..0000000000
--- a/components/engine/docs/extend/plugins_services.md
+++ /dev/null
@@ -1,186 +0,0 @@
----
-description: Using services with plugins
-keywords: "API, Usage, plugins, documentation, developer"
-title: Plugins and Services
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# Using Volume and Network plugins in Docker services
-
-In swarm mode, it is possible to create a service that allows for attaching
-to networks or mounting volumes that are backed by plugins. Swarm schedules
-services based on plugin availability on a node.
-
-
-### Volume plugins
-
-In this example, a volume plugin is installed on a swarm worker and a volume
-is created using the plugin. In the manager, a service is created with the
-relevant mount options. It can be observed that the service is scheduled to
-run on the worker node with the said volume plugin and volume. Note that,
-node1 is the manager and node2 is the worker.
-
-1.  Prepare manager. In node 1:
-
-    ```bash
-    $ docker swarm init
-    Swarm initialized: current node (dxn1zf6l61qsb1josjja83ngz) is now a manager.
-    ```
-
-2. Join swarm, install plugin and create volume on worker. In node 2:
-
-    ```bash
-    $ docker swarm join \
-    --token SWMTKN-1-49nj1cmql0jkz5s954yi3oex3nedyz0fb0xx14ie39trti4wxv-8vxv8rssmk743ojnwacrr2e7c \
-    192.168.99.100:2377
-    ```
-
-    ```bash
-    $ docker plugin install tiborvass/sample-volume-plugin
-    latest: Pulling from tiborvass/sample-volume-plugin
-    eb9c16fbdc53: Download complete
-    Digest: sha256:00b42de88f3a3e0342e7b35fa62394b0a9ceb54d37f4c50be5d3167899994639
-    Status: Downloaded newer image for tiborvass/sample-volume-plugin:latest
-    Installed plugin tiborvass/sample-volume-plugin
-    ```
-
-    ```bash
-    $ docker volume create -d tiborvass/sample-volume-plugin --name pluginVol
-    ```
-
-3. Create a service using the plugin and volume. In node1:
-
-    ```bash
-    $ docker service create --name my-service --mount type=volume,volume-driver=tiborvass/sample-volume-plugin,source=pluginVol,destination=/tmp busybox top
-
-    $ docker service ls
-    z1sj8bb8jnfn  my-service   replicated  1/1       busybox:latest
-    ```
-    docker service ls shows service 1 instance of service running.
-
-4. Observe the task getting scheduled in node 2:
-
-    ```bash
-    {% raw %}
-    $ docker ps --format '{{.ID}}\t {{.Status}} {{.Names}} {{.Command}}' 
-    83fc1e842599     Up 2 days my-service.1.9jn59qzn7nbc3m0zt1hij12xs "top"
-    {% endraw %}
-    ```
-
-### Network plugins
-
-In this example, a global scope network plugin is installed on both the
-swarm manager and worker. A service is created with replicated instances
-using the installed plugin. We will observe how the availability of the
-plugin determines network creation and container scheduling.
-
-Note that node1 is the manager and node2 is the worker.
-
-
-1. Install a global scoped network plugin on both manager and worker. On node1
-   and node2:
-
-    ```bash
-    $ docker plugin install bboreham/weave2
-    Plugin "bboreham/weave2" is requesting the following privileges:
-    - network: [host]
-    - capabilities: [CAP_SYS_ADMIN CAP_NET_ADMIN]
-    Do you grant the above permissions? [y/N] y
-    latest: Pulling from bboreham/weave2
-    7718f575adf7: Download complete
-    Digest: sha256:2780330cc15644b60809637ee8bd68b4c85c893d973cb17f2981aabfadfb6d72
-    Status: Downloaded newer image for bboreham/weave2:latest
-    Installed plugin bboreham/weave2
-    ```
-
-2. Create a network using plugin on manager. On node1:
-
-    ```bash
-    $ docker network create --driver=bboreham/weave2:latest globalnet
-
-    $ docker network ls
-    NETWORK ID          NAME                DRIVER                   SCOPE
-    qlj7ueteg6ly        globalnet           bboreham/weave2:latest   swarm
-    ```
-
-3. Create a service on the manager and have replicas set to 8. Observe that
-containers get scheduled on both manager and worker.
-
-    On node 1:
-
-    ```bash
-    $ docker service create --network globalnet --name myservice --replicas=8 mrjana/simpleweb simpleweb
-w90drnfzw85nygbie9kb89vpa
-    ```
-
-    ```bash
-    $ docker ps
-    CONTAINER ID        IMAGE                                                                                      COMMAND             CREATED             STATUS              PORTS               NAMES
-    87520965206a        mrjana/simpleweb@sha256:317d7f221d68c86d503119b0ea12c29de42af0a22ca087d522646ad1069a47a4   "simpleweb"         5 seconds ago       Up 4 seconds                            myservice.4.ytdzpktmwor82zjxkh118uf1v
-    15e24de0f7aa        mrjana/simpleweb@sha256:317d7f221d68c86d503119b0ea12c29de42af0a22ca087d522646ad1069a47a4   "simpleweb"         5 seconds ago       Up 4 seconds                            myservice.2.kh7a9n3iauq759q9mtxyfs9hp
-    c8c8f0144cdc        mrjana/simpleweb@sha256:317d7f221d68c86d503119b0ea12c29de42af0a22ca087d522646ad1069a47a4   "simpleweb"         5 seconds ago       Up 4 seconds                            myservice.6.sjhpj5gr3xt33e3u2jycoj195
-    2e8e4b2c5c08        mrjana/simpleweb@sha256:317d7f221d68c86d503119b0ea12c29de42af0a22ca087d522646ad1069a47a4   "simpleweb"         5 seconds ago       Up 4 seconds                            myservice.8.2z29zowsghx66u2velublwmrh
-    ```
-
-    On node 2:
-
-    ```bash
-    $ docker ps
-    CONTAINER ID        IMAGE                                                                                      COMMAND             CREATED             STATUS                  PORTS               NAMES
-    53c0ae7c1dae        mrjana/simpleweb@sha256:317d7f221d68c86d503119b0ea12c29de42af0a22ca087d522646ad1069a47a4   "simpleweb"         2 seconds ago       Up Less than a second                       myservice.7.x44tvvdm3iwkt9kif35f7ykz1
-    9b56c627fee0        mrjana/simpleweb@sha256:317d7f221d68c86d503119b0ea12c29de42af0a22ca087d522646ad1069a47a4   "simpleweb"         2 seconds ago       Up Less than a second                       myservice.1.x7n1rm6lltw5gja3ueikze57q
-    d4f5927ba52c        mrjana/simpleweb@sha256:317d7f221d68c86d503119b0ea12c29de42af0a22ca087d522646ad1069a47a4   "simpleweb"         2 seconds ago       Up 1 second                                 myservice.5.i97bfo9uc6oe42lymafs9rz6k
-    478c0d395bd7        mrjana/simpleweb@sha256:317d7f221d68c86d503119b0ea12c29de42af0a22ca087d522646ad1069a47a4   "simpleweb"         2 seconds ago       Up Less than a second                       myservice.3.yr7nkffa48lff1vrl2r1m1ucs
-    ```
-
-4. Scale down the number of instances. On node1:
-
-    ```bash
-    $ docker service scale myservice=0
-    myservice scaled to 0
-    ```
-
-5. Disable and uninstall the plugin on the worker. On node2:
-
-    ```bash
-    $ docker plugin rm -f bboreham/weave2
-    bboreham/weave2
-    ```
-
-6. Scale up the number of instances again. Observe that all containers are
-scheduled on the master and not on the worker, because the plugin is not available on the worker anymore.
-
-    On node 1:
-
-    ```bash
-    $ docker service scale myservice=8
-    myservice scaled to 8
-    ```
-
-    ```bash
-    $ docker ps
-    CONTAINER ID        IMAGE                                                                                      COMMAND             CREATED             STATUS              PORTS               NAMES
-    cf4b0ec2415e        mrjana/simpleweb@sha256:317d7f221d68c86d503119b0ea12c29de42af0a22ca087d522646ad1069a47a4   "simpleweb"         39 seconds ago      Up 36 seconds                           myservice.3.r7p5o208jmlzpcbm2ytl3q6n1
-    57c64a6a2b88        mrjana/simpleweb@sha256:317d7f221d68c86d503119b0ea12c29de42af0a22ca087d522646ad1069a47a4   "simpleweb"         39 seconds ago      Up 36 seconds                           myservice.4.dwoezsbb02ccstkhlqjy2xe7h
-    3ac68cc4e7b8        mrjana/simpleweb@sha256:317d7f221d68c86d503119b0ea12c29de42af0a22ca087d522646ad1069a47a4   "simpleweb"         39 seconds ago      Up 35 seconds                           myservice.5.zx4ezdrm2nwxzkrwnxthv0284
-    006c3cb318fc        mrjana/simpleweb@sha256:317d7f221d68c86d503119b0ea12c29de42af0a22ca087d522646ad1069a47a4   "simpleweb"         39 seconds ago      Up 36 seconds                           myservice.8.q0e3umt19y3h3gzo1ty336k5r
-    dd2ffebde435        mrjana/simpleweb@sha256:317d7f221d68c86d503119b0ea12c29de42af0a22ca087d522646ad1069a47a4   "simpleweb"         39 seconds ago      Up 36 seconds                           myservice.7.a77y3u22prjipnrjg7vzpv3ba
-    a86c74d8b84b        mrjana/simpleweb@sha256:317d7f221d68c86d503119b0ea12c29de42af0a22ca087d522646ad1069a47a4   "simpleweb"         39 seconds ago      Up 36 seconds                           myservice.6.z9nbn14bagitwol1biveeygl7
-    2846a7850ba0        mrjana/simpleweb@sha256:317d7f221d68c86d503119b0ea12c29de42af0a22ca087d522646ad1069a47a4   "simpleweb"         39 seconds ago      Up 37 seconds                           myservice.2.ypufz2eh9fyhppgb89g8wtj76
-    e2ec01efcd8a        mrjana/simpleweb@sha256:317d7f221d68c86d503119b0ea12c29de42af0a22ca087d522646ad1069a47a4   "simpleweb"         39 seconds ago      Up 38 seconds                           myservice.1.8w7c4ttzr6zcb9sjsqyhwp3yl
-    ```
-
-    On node 2:
-
-    ```bash
-    $ docker ps
-    CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
-    ```
diff --git a/components/engine/docs/extend/plugins_volume.md b/components/engine/docs/extend/plugins_volume.md
deleted file mode 100644
index 807ab5a486..0000000000
--- a/components/engine/docs/extend/plugins_volume.md
+++ /dev/null
@@ -1,360 +0,0 @@
----
-title: "Volume plugins"
-description: "How to manage data with external volume plugins"
-keywords: "Examples, Usage, volume, docker, data, volumes, plugin, api"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# Write a volume plugin
-
-Docker Engine volume plugins enable Engine deployments to be integrated with
-external storage systems such as Amazon EBS, and enable data volumes to persist
-beyond the lifetime of a single Docker host. See the
-[plugin documentation](legacy_plugins.md) for more information.
-
-## Changelog
-
-### 1.13.0
-
-- If used as part of the v2 plugin architecture, mountpoints that are part of
-  paths returned by the plugin must be mounted under the directory specified by
-  `PropagatedMount` in the plugin configuration
-  ([#26398](https://github.com/docker/docker/pull/26398))
-
-### 1.12.0
-
-- Add `Status` field to `VolumeDriver.Get` response
-  ([#21006](https://github.com/docker/docker/pull/21006#))
-- Add `VolumeDriver.Capabilities` to get capabilities of the volume driver
-  ([#22077](https://github.com/docker/docker/pull/22077))
-
-### 1.10.0
-
-- Add `VolumeDriver.Get` which gets the details about the volume
-  ([#16534](https://github.com/docker/docker/pull/16534))
-- Add `VolumeDriver.List` which lists all volumes owned by the driver
-  ([#16534](https://github.com/docker/docker/pull/16534))
-
-### 1.8.0
-
-- Initial support for volume driver plugins
-  ([#14659](https://github.com/docker/docker/pull/14659))
-
-## Command-line changes
-
-To give a container access to a volume, use the `--volume` and `--volume-driver`
-flags on the `docker container run` command.  The `--volume` (or `-v`) flag
-accepts a volume name and path on the host, and the `--volume-driver` flag
-accepts a driver type.
-
-```bash
-$ docker volume create --driver=flocker volumename
-
-$ docker container run -it --volume volumename:/data busybox sh
-```
-
-### `--volume`
-
-The `--volume` (or `-v`) flag takes a value that is in the format
-`<volume_name>:<mountpoint>`. The two parts of the value are
-separated by a colon (`:`) character.
-
-- The volume name is a human-readable name for the volume, and cannot begin with
-  a `/` character. It is referred to as `volume_name` in the rest of this topic.
-- The `Mountpoint` is the path on the host (v1) or in the plugin (v2) where the
-  volume has been made available.
-
-### `volumedriver`
-
-Specifying a `volumedriver` in conjunction with a `volumename` allows you to
-use plugins such as [Flocker](https://github.com/ScatterHQ/flocker) to manage
-volumes external to a single host, such as those on EBS.
-
-## Create a VolumeDriver
-
-The container creation endpoint (`/containers/create`) accepts a `VolumeDriver`
-field of type `string` allowing to specify the name of the driver. If not
-specified, it defaults to `"local"` (the default driver for local volumes).
-
-## Volume plugin protocol
-
-If a plugin registers itself as a `VolumeDriver` when activated, it must
-provide the Docker Daemon with writeable paths on the host filesystem. The Docker
-daemon provides these paths to containers to consume. The Docker daemon makes
-the volumes available by bind-mounting the provided paths into the containers.
-
-> **Note**: Volume plugins should *not* write data to the `/var/lib/docker/`
-> directory, including `/var/lib/docker/volumes`. The `/var/lib/docker/`
-> directory is reserved for Docker.
-
-### `/VolumeDriver.Create`
-
-**Request**:
-```json
-{
-    "Name": "volume_name",
-    "Opts": {}
-}
-```
-
-Instruct the plugin that the user wants to create a volume, given a user
-specified volume name. The plugin does not need to actually manifest the
-volume on the filesystem yet (until `Mount` is called).
-`Opts` is a map of driver specific options passed through from the user request.
-
-**Response**:
-```json
-{
-    "Err": ""
-}
-```
-
-Respond with a string error if an error occurred.
-
-### `/VolumeDriver.Remove`
-
-**Request**:
-```json
-{
-    "Name": "volume_name"
-}
-```
-
-Delete the specified volume from disk. This request is issued when a user
-invokes `docker rm -v` to remove volumes associated with a container.
-
-**Response**:
-```json
-{
-    "Err": ""
-}
-```
-
-Respond with a string error if an error occurred.
-
-### `/VolumeDriver.Mount`
-
-**Request**:
-```json
-{
-    "Name": "volume_name",
-    "ID": "b87d7442095999a92b65b3d9691e697b61713829cc0ffd1bb72e4ccd51aa4d6c"
-}
-```
-
-Docker requires the plugin to provide a volume, given a user specified volume
-name. `Mount` is called once per container start. If the same `volume_name` is requested
-more than once, the plugin may need to keep track of each new mount request and provision
-at the first mount request and deprovision at the last corresponding unmount request.
-
-`ID` is a unique ID for the caller that is requesting the mount.
-
-**Response**:
-
-- **v1**:
-
-  ```json
-  {
-      "Mountpoint": "/path/to/directory/on/host",
-      "Err": ""
-  }
-  ```
-
-- **v2**:
-
-  ```json
-  {
-      "Mountpoint": "/path/under/PropagatedMount",
-      "Err": ""
-  }
-  ```
-
-`Mountpoint` is the path on the host (v1) or in the plugin (v2) where the volume
-has been made available.
-
-`Err` is either empty or contains an error string.
-
-### `/VolumeDriver.Path`
-
-**Request**:
-
-```json
-{
-    "Name": "volume_name"
-}
-```
-
-Request the path to the volume with the given `volume_name`.
-
-**Response**:
-
-- **v1**:
-
-  ```json
-  {
-      "Mountpoin": "/path/to/directory/on/host",
-      "Err": ""
-  }
-  ```
-
-- **v2**:
-
-  ```json
-  {
-      "Mountpoint": "/path/under/PropagatedMount",
-      "Err": ""
-  }
-  ```
-
-Respond with the path on the host (v1) or inside the plugin (v2) where the
-volume has been made available, and/or a string error if an error occurred.
-
-`Mountpoint` is optional. However, the plugin may be queried again later if one
-is not provided.
-
-### `/VolumeDriver.Unmount`
-
-**Request**:
-```json
-{
-    "Name": "volume_name",
-    "ID": "b87d7442095999a92b65b3d9691e697b61713829cc0ffd1bb72e4ccd51aa4d6c"
-}
-```
-
-Docker is no longer using the named volume. `Unmount` is called once per
-container stop. Plugin may deduce that it is safe to deprovision the volume at
-this point.
-
-`ID` is a unique ID for the caller that is requesting the mount.
-
-**Response**:
-```json
-{
-    "Err": ""
-}
-```
-
-Respond with a string error if an error occurred.
-
-
-### `/VolumeDriver.Get`
-
-**Request**:
-```json
-{
-    "Name": "volume_name"
-}
-```
-
-Get info about `volume_name`.
-
-
-**Response**:
-
-- **v1**:
-
-  ```json
-  {
-    "Volume": {
-      "Name": "volume_name",
-      "Mountpoint": "/path/to/directory/on/host",
-      "Status": {}
-    },
-    "Err": ""
-  }
-  ```
-
-- **v2**:
-
-  ```json
-  {
-    "Volume": {
-      "Name": "volume_name",
-      "Mountpoint": "/path/under/PropagatedMount",
-      "Status": {}
-    },
-    "Err": ""
-  }
-  ```
-
-Respond with a string error if an error occurred. `Mountpoint` and `Status` are
-optional.
-
-
-### /VolumeDriver.List
-
-**Request**:
-```json
-{}
-```
-
-Get the list of volumes registered with the plugin.
-
-**Response**:
-
-- **v1**:
-
-  ```json
-  {
-    "Volumes": [
-      {
-        "Name": "volume_name",
-        "Mountpoint": "/path/to/directory/on/host"
-      }
-    ],
-    "Err": ""
-  }
-  ```
-
-- **v2**:
-
-  ```json
-  {
-    "Volumes": [
-      {
-        "Name": "volume_name",
-        "Mountpoint": "/path/under/PropagatedMount"
-      }
-    ],
-    "Err": ""
-  }
-  ```
-
-
-Respond with a string error if an error occurred. `Mountpoint` is optional.
-
-### /VolumeDriver.Capabilities
-
-**Request**:
-```json
-{}
-```
-
-Get the list of capabilities the driver supports.
-
-The driver is not required to implement `Capabilities`. If it is not
-implemented, the default values are used.
-
-**Response**:
-```json
-{
-  "Capabilities": {
-    "Scope": "global"
-  }
-}
-```
-
-Supported scopes are `global` and `local`. Any other value in `Scope` will be
-ignored, and `local` is used. `Scope` allows cluster managers to handle the
-volume in different ways. For instance, a scope of `global`, signals to the
-cluster manager that it only needs to create the volume once instead of on each
-Docker host. More capabilities may be added in the future.
diff --git a/components/engine/docs/reference/builder.md b/components/engine/docs/reference/builder.md
deleted file mode 100644
index 2571511b64..0000000000
--- a/components/engine/docs/reference/builder.md
+++ /dev/null
@@ -1,1849 +0,0 @@
----
-title: "Dockerfile reference"
-description: "Dockerfiles use a simple DSL which allows you to automate the steps you would normally manually take to create an image."
-keywords: "builder, docker, Dockerfile, automation, image creation"
-redirect_from:
-- /reference/builder/
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# Dockerfile reference
-
-Docker can build images automatically by reading the instructions from a
-`Dockerfile`. A `Dockerfile` is a text document that contains all the commands a
-user could call on the command line to assemble an image. Using `docker build`
-users can create an automated build that executes several command-line
-instructions in succession.
-
-This page describes the commands you can use in a `Dockerfile`. When you are
-done reading this page, refer to the [`Dockerfile` Best
-Practices](https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/) for a tip-oriented guide.
-
-## Usage
-
-The [`docker build`](commandline/build.md) command builds an image from
-a `Dockerfile` and a *context*. The build's context is the files at a specified
-location `PATH` or `URL`. The `PATH` is a directory on your local filesystem.
-The `URL` is a Git repository location.
-
-A context is processed recursively. So, a `PATH` includes any subdirectories and
-the `URL` includes the repository and its submodules. A simple build command
-that uses the current directory as context:
-
-    $ docker build .
-    Sending build context to Docker daemon  6.51 MB
-    ...
-
-The build is run by the Docker daemon, not by the CLI. The first thing a build
-process does is send the entire context (recursively) to the daemon.  In most
-cases, it's best to start with an empty directory as context and keep your
-Dockerfile in that directory. Add only the files needed for building the
-Dockerfile.
-
->**Warning**: Do not use your root directory, `/`, as the `PATH` as it causes
->the build to transfer the entire contents of your hard drive to the Docker
->daemon.
-
-To use a file in the build context, the `Dockerfile` refers to the file specified
-in an instruction, for example,  a `COPY` instruction. To increase the build's
-performance, exclude files and directories by adding a `.dockerignore` file to
-the context directory.  For information about how to [create a `.dockerignore`
-file](#dockerignore-file) see the documentation on this page.
-
-Traditionally, the `Dockerfile` is called `Dockerfile` and located in the root
-of the context. You use the `-f` flag with `docker build` to point to a Dockerfile
-anywhere in your file system.
-
-    $ docker build -f /path/to/a/Dockerfile .
-
-You can specify a repository and tag at which to save the new image if
-the build succeeds:
-
-    $ docker build -t shykes/myapp .
-
-To tag the image into multiple repositories after the build,
-add multiple `-t` parameters when you run the `build` command:
-
-    $ docker build -t shykes/myapp:1.0.2 -t shykes/myapp:latest .
-
-Before the Docker daemon runs the instructions in the `Dockerfile`, it performs
-a preliminary validation of the `Dockerfile` and returns an error if the syntax is incorrect:
-
-    $ docker build -t test/myapp .
-    Sending build context to Docker daemon 2.048 kB
-    Error response from daemon: Unknown instruction: RUNCMD
-
-The Docker daemon runs the instructions in the `Dockerfile` one-by-one,
-committing the result of each instruction
-to a new image if necessary, before finally outputting the ID of your
-new image. The Docker daemon will automatically clean up the context you
-sent.
-
-Note that each instruction is run independently, and causes a new image
-to be created - so `RUN cd /tmp` will not have any effect on the next
-instructions.
-
-Whenever possible, Docker will re-use the intermediate images (cache),
-to accelerate the `docker build` process significantly. This is indicated by
-the `Using cache` message in the console output.
-(For more information, see the [Build cache section](https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/#/build-cache)) in the
-`Dockerfile` best practices guide:
-
-    $ docker build -t svendowideit/ambassador .
-    Sending build context to Docker daemon 15.36 kB
-    Step 1/4 : FROM alpine:3.2
-     ---> 31f630c65071
-    Step 2/4 : MAINTAINER SvenDowideit@home.org.au
-     ---> Using cache
-     ---> 2a1c91448f5f
-    Step 3/4 : RUN apk update &&      apk add socat &&        rm -r /var/cache/
-     ---> Using cache
-     ---> 21ed6e7fbb73
-    Step 4/4 : CMD env | grep _TCP= | (sed 's/.*_PORT_\([0-9]*\)_TCP=tcp:\/\/\(.*\):\(.*\)/socat -t 100000000 TCP4-LISTEN:\1,fork,reuseaddr TCP4:\2:\3 \&/' && echo wait) | sh
-     ---> Using cache
-     ---> 7ea8aef582cc
-    Successfully built 7ea8aef582cc
-
-Build cache is only used from images that have a local parent chain. This means
-that these images were created by previous builds or the whole chain of images
-was loaded with `docker load`. If you wish to use build cache of a specific
-image you can specify it with `--cache-from` option. Images specified with
-`--cache-from` do not need to have a parent chain and may be pulled from other
-registries.
-
-When you're done with your build, you're ready to look into [*Pushing a
-repository to its registry*](https://docs.docker.com/engine/tutorials/dockerrepos/#/contributing-to-docker-hub).
-
-## Format
-
-Here is the format of the `Dockerfile`:
-
-```Dockerfile
-# Comment
-INSTRUCTION arguments
-```
-
-The instruction is not case-sensitive. However, convention is for them to
-be UPPERCASE to distinguish them from arguments more easily.
-
-
-Docker runs instructions in a `Dockerfile` in order. A `Dockerfile` **must
-start with a \`FROM\` instruction**. The `FROM` instruction specifies the [*Base
-Image*](glossary.md#base-image) from which you are building. `FROM` may only be
-proceeded by one or more `ARG` instructions, which declare arguments that are used
-in `FROM` lines in the `Dockerfile`.
-
-Docker treats lines that *begin* with `#` as a comment, unless the line is
-a valid [parser directive](#parser-directives). A `#` marker anywhere
-else in a line is treated as an argument. This allows statements like:
-
-```Dockerfile
-# Comment
-RUN echo 'we are running some # of cool things'
-```
-
-Line continuation characters are not supported in comments.
-
-## Parser directives
-
-Parser directives are optional, and affect the way in which subsequent lines
-in a `Dockerfile` are handled. Parser directives do not add layers to the build,
-and will not be shown as a build step. Parser directives are written as a
-special type of comment in the form `# directive=value`. A single directive
-may only be used once.
-
-Once a comment, empty line or builder instruction has been processed, Docker
-no longer looks for parser directives. Instead it treats anything formatted
-as a parser directive as a comment and does not attempt to validate if it might
-be a parser directive. Therefore, all parser directives must be at the very
-top of a `Dockerfile`.
-
-Parser directives are not case-sensitive. However, convention is for them to
-be lowercase. Convention is also to include a blank line following any
-parser directives. Line continuation characters are not supported in parser
-directives.
-
-Due to these rules, the following examples are all invalid:
-
-Invalid due to line continuation:
-
-```Dockerfile
-# direc \
-tive=value
-```
-
-Invalid due to appearing twice:
-
-```Dockerfile
-# directive=value1
-# directive=value2
-
-FROM ImageName
-```
-
-Treated as a comment due to appearing after a builder instruction:
-
-```Dockerfile
-FROM ImageName
-# directive=value
-```
-
-Treated as a comment due to appearing after a comment which is not a parser
-directive:
-
-```Dockerfile
-# About my dockerfile
-# directive=value
-FROM ImageName
-```
-
-The unknown directive is treated as a comment due to not being recognized. In
-addition, the known directive is treated as a comment due to appearing after
-a comment which is not a parser directive.
-
-```Dockerfile
-# unknowndirective=value
-# knowndirective=value
-```
-
-Non line-breaking whitespace is permitted in a parser directive. Hence, the
-following lines are all treated identically:
-
-```Dockerfile
-#directive=value
-# directive =value
-#	directive= value
-# directive = value
-#	  dIrEcTiVe=value
-```
-
-The following parser directive is supported:
-
-* `escape`
-
-## escape
-
-    # escape=\ (backslash)
-
-Or
-
-    # escape=` (backtick)
-
-The `escape` directive sets the character used to escape characters in a
-`Dockerfile`. If not specified, the default escape character is `\`.
-
-The escape character is used both to escape characters in a line, and to
-escape a newline. This allows a `Dockerfile` instruction to
-span multiple lines. Note that regardless of whether the `escape` parser
-directive is included in a `Dockerfile`, *escaping is not performed in
-a `RUN` command, except at the end of a line.*
-
-Setting the escape character to `` ` `` is especially useful on
-`Windows`, where `\` is the directory path separator. `` ` `` is consistent
-with [Windows PowerShell](https://technet.microsoft.com/en-us/library/hh847755.aspx).
-
-Consider the following example which would fail in a non-obvious way on
-`Windows`. The second `\` at the end of the second line would be interpreted as an
-escape for the newline, instead of a target of the escape from the first `\`.
-Similarly, the `\` at the end of the third line would, assuming it was actually
-handled as an instruction, cause it be treated as a line continuation. The result
-of this dockerfile is that second and third lines are considered a single
-instruction:
-
-```Dockerfile
-FROM microsoft/nanoserver
-COPY testfile.txt c:\\
-RUN dir c:\
-```
-
-Results in:
-
-    PS C:\John> docker build -t cmd .
-    Sending build context to Docker daemon 3.072 kB
-    Step 1/2 : FROM microsoft/nanoserver
-     ---> 22738ff49c6d
-    Step 2/2 : COPY testfile.txt c:\RUN dir c:
-    GetFileAttributesEx c:RUN: The system cannot find the file specified.
-    PS C:\John>
-
-One solution to the above would be to use `/` as the target of both the `COPY`
-instruction, and `dir`. However, this syntax is, at best, confusing as it is not
-natural for paths on `Windows`, and at worst, error prone as not all commands on
-`Windows` support `/` as the path separator.
-
-By adding the `escape` parser directive, the following `Dockerfile` succeeds as
-expected with the use of natural platform semantics for file paths on `Windows`:
-
-    # escape=`
-
-    FROM microsoft/nanoserver
-    COPY testfile.txt c:\
-    RUN dir c:\
-
-Results in:
-
-    PS C:\John> docker build -t succeeds --no-cache=true .
-    Sending build context to Docker daemon 3.072 kB
-    Step 1/3 : FROM microsoft/nanoserver
-     ---> 22738ff49c6d
-    Step 2/3 : COPY testfile.txt c:\
-     ---> 96655de338de
-    Removing intermediate container 4db9acbb1682
-    Step 3/3 : RUN dir c:\
-     ---> Running in a2c157f842f5
-     Volume in drive C has no label.
-     Volume Serial Number is 7E6D-E0F7
-    
-     Directory of c:\
-    
-    10/05/2016  05:04 PM             1,894 License.txt
-    10/05/2016  02:22 PM    <DIR>          Program Files
-    10/05/2016  02:14 PM    <DIR>          Program Files (x86)
-    10/28/2016  11:18 AM                62 testfile.txt
-    10/28/2016  11:20 AM    <DIR>          Users
-    10/28/2016  11:20 AM    <DIR>          Windows
-               2 File(s)          1,956 bytes
-               4 Dir(s)  21,259,096,064 bytes free
-     ---> 01c7f3bef04f
-    Removing intermediate container a2c157f842f5
-    Successfully built 01c7f3bef04f
-    PS C:\John>
-
-## Environment replacement
-
-Environment variables (declared with [the `ENV` statement](#env)) can also be
-used in certain instructions as variables to be interpreted by the
-`Dockerfile`. Escapes are also handled for including variable-like syntax
-into a statement literally.
-
-Environment variables are notated in the `Dockerfile` either with
-`$variable_name` or `${variable_name}`. They are treated equivalently and the
-brace syntax is typically used to address issues with variable names with no
-whitespace, like `${foo}_bar`.
-
-The `${variable_name}` syntax also supports a few of the standard `bash`
-modifiers as specified below:
-
-* `${variable:-word}` indicates that if `variable` is set then the result
-  will be that value. If `variable` is not set then `word` will be the result.
-* `${variable:+word}` indicates that if `variable` is set then `word` will be
-  the result, otherwise the result is the empty string.
-
-In all cases, `word` can be any string, including additional environment
-variables.
-
-Escaping is possible by adding a `\` before the variable: `\$foo` or `\${foo}`,
-for example, will translate to `$foo` and `${foo}` literals respectively.
-
-Example (parsed representation is displayed after the `#`):
-
-    FROM busybox
-    ENV foo /bar
-    WORKDIR ${foo}   # WORKDIR /bar
-    ADD . $foo       # ADD . /bar
-    COPY \$foo /quux # COPY $foo /quux
-
-Environment variables are supported by the following list of instructions in
-the `Dockerfile`:
-
-* `ADD`
-* `COPY`
-* `ENV`
-* `EXPOSE`
-* `FROM`
-* `LABEL`
-* `STOPSIGNAL`
-* `USER`
-* `VOLUME`
-* `WORKDIR`
-
-as well as:
-
-* `ONBUILD` (when combined with one of the supported instructions above)
-
-> **Note**:
-> prior to 1.4, `ONBUILD` instructions did **NOT** support environment
-> variable, even when combined with any of the instructions listed above.
-
-Environment variable substitution will use the same value for each variable
-throughout the entire instruction. In other words, in this example:
-
-    ENV abc=hello
-    ENV abc=bye def=$abc
-    ENV ghi=$abc
-
-will result in `def` having a value of `hello`, not `bye`. However,
-`ghi` will have a value of `bye` because it is not part of the same instruction 
-that set `abc` to `bye`.
-
-## .dockerignore file
-
-Before the docker CLI sends the context to the docker daemon, it looks
-for a file named `.dockerignore` in the root directory of the context.
-If this file exists, the CLI modifies the context to exclude files and
-directories that match patterns in it.  This helps to avoid
-unnecessarily sending large or sensitive files and directories to the
-daemon and potentially adding them to images using `ADD` or `COPY`.
-
-The CLI interprets the `.dockerignore` file as a newline-separated
-list of patterns similar to the file globs of Unix shells.  For the
-purposes of matching, the root of the context is considered to be both
-the working and the root directory.  For example, the patterns
-`/foo/bar` and `foo/bar` both exclude a file or directory named `bar`
-in the `foo` subdirectory of `PATH` or in the root of the git
-repository located at `URL`.  Neither excludes anything else.
-
-If a line in `.dockerignore` file starts with `#` in column 1, then this line is
-considered as a comment and is ignored before interpreted by the CLI.
-
-Here is an example `.dockerignore` file:
-
-```
-# comment
-*/temp*
-*/*/temp*
-temp?
-```
-
-This file causes the following build behavior:
-
-| Rule           | Behavior                                                                                                                                                                     |
-|----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `# comment`    | Ignored.                 |
-| `*/temp*`      | Exclude files and directories whose names start with `temp` in any immediate subdirectory of the root.  For example, the plain file `/somedir/temporary.txt` is excluded, as is the directory `/somedir/temp`.                 |
-| `*/*/temp*`    | Exclude files and directories starting with `temp` from any subdirectory that is two levels below the root. For example, `/somedir/subdir/temporary.txt` is excluded. |
-| `temp?`        | Exclude files and directories in the root directory whose names are a one-character extension of `temp`.  For example, `/tempa` and `/tempb` are excluded.
-
-
-Matching is done using Go's
-[filepath.Match](http://golang.org/pkg/path/filepath#Match) rules.  A
-preprocessing step removes leading and trailing whitespace and
-eliminates `.` and `..` elements using Go's
-[filepath.Clean](http://golang.org/pkg/path/filepath/#Clean).  Lines
-that are blank after preprocessing are ignored.
-
-Beyond Go's filepath.Match rules, Docker also supports a special
-wildcard string `**` that matches any number of directories (including
-zero). For example, `**/*.go` will exclude all files that end with `.go`
-that are found in all directories, including the root of the build context.
-
-Lines starting with `!` (exclamation mark) can be used to make exceptions
-to exclusions.  The following is an example `.dockerignore` file that
-uses this mechanism:
-
-```
-    *.md
-    !README.md
-```
-
-All markdown files *except* `README.md` are excluded from the context.
-
-The placement of `!` exception rules influences the behavior: the last
-line of the `.dockerignore` that matches a particular file determines
-whether it is included or excluded.  Consider the following example:
-
-```
-    *.md
-    !README*.md
-    README-secret.md
-```
-
-No markdown files are included in the context except README files other than
-`README-secret.md`.
-
-Now consider this example:
-
-```
-    *.md
-    README-secret.md
-    !README*.md
-```
-
-All of the README files are included.  The middle line has no effect because
-`!README*.md` matches `README-secret.md` and comes last.
-
-You can even use the `.dockerignore` file to exclude the `Dockerfile`
-and `.dockerignore` files.  These files are still sent to the daemon
-because it needs them to do its job.  But the `ADD` and `COPY` instructions
-do not copy them to the image.
-
-Finally, you may want to specify which files to include in the
-context, rather than which to exclude. To achieve this, specify `*` as
-the first pattern, followed by one or more `!` exception patterns.
-
-**Note**: For historical reasons, the pattern `.` is ignored.
-
-## FROM
-
-    FROM <image> [AS <name>]
-
-Or
-
-    FROM <image>[:<tag>] [AS <name>]
-
-Or
-
-    FROM <image>[@<digest>] [AS <name>]
-
-The `FROM` instruction initializes a new build stage and sets the 
-[*Base Image*](glossary.md#base-image) for subsequent instructions. As such, a 
-valid `Dockerfile` must start with a `FROM` instruction. The image can be
-any valid image – it is especially easy to start by **pulling an image** from 
-the [*Public Repositories*](https://docs.docker.com/engine/tutorials/dockerrepos/).
-
-- `ARG` is the only instruction that may proceed `FROM` in the `Dockerfile`. 
-  See [Understand how ARG and FROM interact](#understand-how-arg-and-from-interact).
-
-- `FROM` can appear multiple times within a single `Dockerfile` to 
-  create multiple images or use one build stage as a dependency for another.
-  Simply make a note of the last image ID output by the commit before each new 
-  `FROM` instruction. Each `FROM` instruction clears any state created by previous
-  instructions.
-
-- Optionally a name can be given to a new build stage by adding `AS name` to the 
-  `FROM` instruction. The name can be used in subsequent `FROM` and
-  `COPY --from=<name|index>` instructions to refer to the image built in this stage.
-
-- The `tag` or `digest` values are optional. If you omit either of them, the 
-  builder assumes a `latest` tag by default. The builder returns an error if it
-  cannot find the `tag` value.
-
-### Understand how ARG and FROM interact
-
-`FROM` instructions support variables that are declared by any `ARG` 
-instructions that occur before the first `FROM`.
-
-```Dockerfile
-ARG  CODE_VERSION=latest
-FROM base:${CODE_VERSION}
-CMD  /code/run-app
-
-FROM extras:${CODE_VERSION}
-CMD  /code/run-extras
-```
-
-To use the default value of an `ARG` declared before the first `FROM` use an
-`ARG` instruction without a value:
-
-```Dockerfile
-ARG  SETTINGS=default
-
-FROM busybox
-ARG  SETTINGS
-
-```
-
-## RUN
-
-RUN has 2 forms:
-
-- `RUN <command>` (*shell* form, the command is run in a shell, which by
-default is `/bin/sh -c` on Linux or `cmd /S /C` on Windows)
-- `RUN ["executable", "param1", "param2"]` (*exec* form)
-
-The `RUN` instruction will execute any commands in a new layer on top of the
-current image and commit the results. The resulting committed image will be
-used for the next step in the `Dockerfile`.
-
-Layering `RUN` instructions and generating commits conforms to the core
-concepts of Docker where commits are cheap and containers can be created from
-any point in an image's history, much like source control.
-
-The *exec* form makes it possible to avoid shell string munging, and to `RUN`
-commands using a base image that does not contain the specified shell executable.
-
-The default shell for the *shell* form can be changed using the `SHELL`
-command.
-
-In the *shell* form you can use a `\` (backslash) to continue a single
-RUN instruction onto the next line. For example, consider these two lines:
-
-```
-RUN /bin/bash -c 'source $HOME/.bashrc; \
-echo $HOME'
-```
-Together they are equivalent to this single line:
-
-```
-RUN /bin/bash -c 'source $HOME/.bashrc; echo $HOME'
-```
-
-> **Note**:
-> To use a different shell, other than '/bin/sh', use the *exec* form
-> passing in the desired shell. For example,
-> `RUN ["/bin/bash", "-c", "echo hello"]`
-
-> **Note**:
-> The *exec* form is parsed as a JSON array, which means that
-> you must use double-quotes (") around words not single-quotes (').
-
-> **Note**:
-> Unlike the *shell* form, the *exec* form does not invoke a command shell.
-> This means that normal shell processing does not happen. For example,
-> `RUN [ "echo", "$HOME" ]` will not do variable substitution on `$HOME`.
-> If you want shell processing then either use the *shell* form or execute
-> a shell directly, for example: `RUN [ "sh", "-c", "echo $HOME" ]`.
-> When using the exec form and executing a shell directly, as in the case for
-> the shell form, it is the shell that is doing the environment variable
-> expansion, not docker.
->
-> **Note**:
-> In the *JSON* form, it is necessary to escape backslashes. This is
-> particularly relevant on Windows where the backslash is the path separator.
-> The following line would otherwise be treated as *shell* form due to not
-> being valid JSON, and fail in an unexpected way:
-> `RUN ["c:\windows\system32\tasklist.exe"]`
-> The correct syntax for this example is:
-> `RUN ["c:\\windows\\system32\\tasklist.exe"]`
-
-The cache for `RUN` instructions isn't invalidated automatically during
-the next build. The cache for an instruction like
-`RUN apt-get dist-upgrade -y` will be reused during the next build. The
-cache for `RUN` instructions can be invalidated by using the `--no-cache`
-flag, for example `docker build --no-cache`.
-
-See the [`Dockerfile` Best Practices
-guide](https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/#/build-cache) for more information.
-
-The cache for `RUN` instructions can be invalidated by `ADD` instructions. See
-[below](#add) for details.
-
-### Known issues (RUN)
-
-- [Issue 783](https://github.com/docker/docker/issues/783) is about file
-  permissions problems that can occur when using the AUFS file system. You
-  might notice it during an attempt to `rm` a file, for example.
-
-  For systems that have recent aufs version (i.e., `dirperm1` mount option can
-  be set), docker will attempt to fix the issue automatically by mounting
-  the layers with `dirperm1` option. More details on `dirperm1` option can be
-  found at [`aufs` man page](https://github.com/sfjro/aufs3-linux/tree/aufs3.18/Documentation/filesystems/aufs)
-
-  If your system doesn't have support for `dirperm1`, the issue describes a workaround.
-
-## CMD
-
-The `CMD` instruction has three forms:
-
-- `CMD ["executable","param1","param2"]` (*exec* form, this is the preferred form)
-- `CMD ["param1","param2"]` (as *default parameters to ENTRYPOINT*)
-- `CMD command param1 param2` (*shell* form)
-
-There can only be one `CMD` instruction in a `Dockerfile`. If you list more than one `CMD`
-then only the last `CMD` will take effect.
-
-**The main purpose of a `CMD` is to provide defaults for an executing
-container.** These defaults can include an executable, or they can omit
-the executable, in which case you must specify an `ENTRYPOINT`
-instruction as well.
-
-> **Note**:
-> If `CMD` is used to provide default arguments for the `ENTRYPOINT`
-> instruction, both the `CMD` and `ENTRYPOINT` instructions should be specified
-> with the JSON array format.
-
-> **Note**:
-> The *exec* form is parsed as a JSON array, which means that
-> you must use double-quotes (") around words not single-quotes (').
-
-> **Note**:
-> Unlike the *shell* form, the *exec* form does not invoke a command shell.
-> This means that normal shell processing does not happen. For example,
-> `CMD [ "echo", "$HOME" ]` will not do variable substitution on `$HOME`.
-> If you want shell processing then either use the *shell* form or execute
-> a shell directly, for example: `CMD [ "sh", "-c", "echo $HOME" ]`.
-> When using the exec form and executing a shell directly, as in the case for
-> the shell form, it is the shell that is doing the environment variable
-> expansion, not docker.
-
-When used in the shell or exec formats, the `CMD` instruction sets the command
-to be executed when running the image.
-
-If you use the *shell* form of the `CMD`, then the `<command>` will execute in
-`/bin/sh -c`:
-
-    FROM ubuntu
-    CMD echo "This is a test." | wc -
-
-If you want to **run your** `<command>` **without a shell** then you must
-express the command as a JSON array and give the full path to the executable.
-**This array form is the preferred format of `CMD`.** Any additional parameters
-must be individually expressed as strings in the array:
-
-    FROM ubuntu
-    CMD ["/usr/bin/wc","--help"]
-
-If you would like your container to run the same executable every time, then
-you should consider using `ENTRYPOINT` in combination with `CMD`. See
-[*ENTRYPOINT*](#entrypoint).
-
-If the user specifies arguments to `docker run` then they will override the
-default specified in `CMD`.
-
-> **Note**:
-> Don't confuse `RUN` with `CMD`. `RUN` actually runs a command and commits
-> the result; `CMD` does not execute anything at build time, but specifies
-> the intended command for the image.
-
-## LABEL
-
-    LABEL <key>=<value> <key>=<value> <key>=<value> ...
-
-The `LABEL` instruction adds metadata to an image. A `LABEL` is a
-key-value pair. To include spaces within a `LABEL` value, use quotes and
-backslashes as you would in command-line parsing. A few usage examples:
-
-    LABEL "com.example.vendor"="ACME Incorporated"
-    LABEL com.example.label-with-value="foo"
-    LABEL version="1.0"
-    LABEL description="This text illustrates \
-    that label-values can span multiple lines."
-
-An image can have more than one label. To specify multiple labels,
-Docker recommends combining labels into a single `LABEL` instruction where
-possible. Each `LABEL` instruction produces a new layer which can result in an
-inefficient image if you use many labels. This example results in a single image
-layer.
-
-    LABEL multi.label1="value1" multi.label2="value2" other="value3"
-
-The above can also be written as:
-
-    LABEL multi.label1="value1" \
-          multi.label2="value2" \
-          other="value3"
-
-Labels are additive including `LABEL`s in `FROM` images. If Docker
-encounters a label/key that already exists, the new value overrides any previous
-labels with identical keys.
-
-To view an image's labels, use the `docker inspect` command.
-
-    "Labels": {
-        "com.example.vendor": "ACME Incorporated"
-        "com.example.label-with-value": "foo",
-        "version": "1.0",
-        "description": "This text illustrates that label-values can span multiple lines.",
-        "multi.label1": "value1",
-        "multi.label2": "value2",
-        "other": "value3"
-    },
-
-## MAINTAINER (deprecated)
-
-    MAINTAINER <name>
-
-The `MAINTAINER` instruction sets the *Author* field of the generated images.
-The `LABEL` instruction is a much more flexible version of this and you should use
-it instead, as it enables setting any metadata you require, and can be viewed
-easily, for example with `docker inspect`. To set a label corresponding to the
-`MAINTAINER` field you could use:
-
-    LABEL maintainer="SvenDowideit@home.org.au"
-
-This will then be visible from `docker inspect` with the other labels.
-
-## EXPOSE
-
-    EXPOSE <port> [<port>...]
-
-The `EXPOSE` instruction informs Docker that the container listens on the
-specified network ports at runtime. `EXPOSE` does not make the ports of the
-container accessible to the host. To do that, you must use either the `-p` flag
-to publish a range of ports or the `-P` flag to publish all of the exposed
-ports. You can expose one port number and publish it externally under another
-number.
-
-To set up port redirection on the host system, see [using the -P
-flag](run.md#expose-incoming-ports). The Docker network feature supports
-creating networks without the need to expose ports within the network, for
-detailed information see the  [overview of this
-feature](https://docs.docker.com/engine/userguide/networking/)).
-
-## ENV
-
-    ENV <key> <value>
-    ENV <key>=<value> ...
-
-The `ENV` instruction sets the environment variable `<key>` to the value
-`<value>`. This value will be in the environment of all "descendant"
-`Dockerfile` commands and can be [replaced inline](#environment-replacement) in
-many as well.
-
-The `ENV` instruction has two forms. The first form, `ENV <key> <value>`,
-will set a single variable to a value. The entire string after the first
-space will be treated as the `<value>` - including characters such as
-spaces and quotes.
-
-The second form, `ENV <key>=<value> ...`, allows for multiple variables to
-be set at one time. Notice that the second form uses the equals sign (=)
-in the syntax, while the first form does not. Like command line parsing,
-quotes and backslashes can be used to include spaces within values.
-
-For example:
-
-    ENV myName="John Doe" myDog=Rex\ The\ Dog \
-        myCat=fluffy
-
-and
-
-    ENV myName John Doe
-    ENV myDog Rex The Dog
-    ENV myCat fluffy
-
-will yield the same net results in the final image, but the first form
-is preferred because it produces a single cache layer.
-
-The environment variables set using `ENV` will persist when a container is run
-from the resulting image. You can view the values using `docker inspect`, and
-change them using `docker run --env <key>=<value>`.
-
-> **Note**:
-> Environment persistence can cause unexpected side effects. For example,
-> setting `ENV DEBIAN_FRONTEND noninteractive` may confuse apt-get
-> users on a Debian-based image. To set a value for a single command, use
-> `RUN <key>=<value> <command>`.
-
-## ADD
-
-ADD has two forms:
-
-- `ADD <src>... <dest>`
-- `ADD ["<src>",... "<dest>"]` (this form is required for paths containing
-whitespace)
-
-The `ADD` instruction copies new files, directories or remote file URLs from `<src>`
-and adds them to the filesystem of the image at the path `<dest>`.
-
-Multiple `<src>` resource may be specified but if they are files or
-directories then they must be relative to the source directory that is
-being built (the context of the build).
-
-Each `<src>` may contain wildcards and matching will be done using Go's
-[filepath.Match](http://golang.org/pkg/path/filepath#Match) rules. For example:
-
-    ADD hom* /mydir/        # adds all files starting with "hom"
-    ADD hom?.txt /mydir/    # ? is replaced with any single character, e.g., "home.txt"
-
-The `<dest>` is an absolute path, or a path relative to `WORKDIR`, into which
-the source will be copied inside the destination container.
-
-    ADD test relativeDir/          # adds "test" to `WORKDIR`/relativeDir/
-    ADD test /absoluteDir/         # adds "test" to /absoluteDir/
-
-When adding files or directories that contain special characters (such as `[`
-and `]`), you need to escape those paths following the Golang rules to prevent
-them from being treated as a matching pattern. For example, to add a file
-named `arr[0].txt`, use the following;
-
-    ADD arr[[]0].txt /mydir/    # copy a file named "arr[0].txt" to /mydir/
-
-
-All new files and directories are created with a UID and GID of 0.
-
-In the case where `<src>` is a remote file URL, the destination will
-have permissions of 600. If the remote file being retrieved has an HTTP
-`Last-Modified` header, the timestamp from that header will be used
-to set the `mtime` on the destination file. However, like any other file
-processed during an `ADD`, `mtime` will not be included in the determination
-of whether or not the file has changed and the cache should be updated.
-
-> **Note**:
-> If you build by passing a `Dockerfile` through STDIN (`docker
-> build - < somefile`), there is no build context, so the `Dockerfile`
-> can only contain a URL based `ADD` instruction. You can also pass a
-> compressed archive through STDIN: (`docker build - < archive.tar.gz`),
-> the `Dockerfile` at the root of the archive and the rest of the
-> archive will be used as the context of the build.
-
-> **Note**:
-> If your URL files are protected using authentication, you
-> will need to use `RUN wget`, `RUN curl` or use another tool from
-> within the container as the `ADD` instruction does not support
-> authentication.
-
-> **Note**:
-> The first encountered `ADD` instruction will invalidate the cache for all
-> following instructions from the Dockerfile if the contents of `<src>` have
-> changed. This includes invalidating the cache for `RUN` instructions.
-> See the [`Dockerfile` Best Practices
-guide](https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/#/build-cache) for more information.
-
-
-`ADD` obeys the following rules:
-
-- The `<src>` path must be inside the *context* of the build;
-  you cannot `ADD ../something /something`, because the first step of a
-  `docker build` is to send the context directory (and subdirectories) to the
-  docker daemon.
-
-- If `<src>` is a URL and `<dest>` does not end with a trailing slash, then a
-  file is downloaded from the URL and copied to `<dest>`.
-
-- If `<src>` is a URL and `<dest>` does end with a trailing slash, then the
-  filename is inferred from the URL and the file is downloaded to
-  `<dest>/<filename>`. For instance, `ADD http://example.com/foobar /` would
-  create the file `/foobar`. The URL must have a nontrivial path so that an
-  appropriate filename can be discovered in this case (`http://example.com`
-  will not work).
-
-- If `<src>` is a directory, the entire contents of the directory are copied,
-  including filesystem metadata.
-
-> **Note**:
-> The directory itself is not copied, just its contents.
-
-- If `<src>` is a *local* tar archive in a recognized compression format
-  (identity, gzip, bzip2 or xz) then it is unpacked as a directory. Resources
-  from *remote* URLs are **not** decompressed. When a directory is copied or
-  unpacked, it has the same behavior as `tar -x`, the result is the union of:
-
-    1. Whatever existed at the destination path and
-    2. The contents of the source tree, with conflicts resolved in favor
-       of "2." on a file-by-file basis.
-
-  > **Note**:
-  > Whether a file is identified as a recognized compression format or not
-  > is done solely based on the contents of the file, not the name of the file.
-  > For example, if an empty file happens to end with `.tar.gz` this will not
-  > be recognized as a compressed file and **will not** generate any kind of
-  > decompression error message, rather the file will simply be copied to the
-  > destination.
-
-- If `<src>` is any other kind of file, it is copied individually along with
-  its metadata. In this case, if `<dest>` ends with a trailing slash `/`, it
-  will be considered a directory and the contents of `<src>` will be written
-  at `<dest>/base(<src>)`.
-
-- If multiple `<src>` resources are specified, either directly or due to the
-  use of a wildcard, then `<dest>` must be a directory, and it must end with
-  a slash `/`.
-
-- If `<dest>` does not end with a trailing slash, it will be considered a
-  regular file and the contents of `<src>` will be written at `<dest>`.
-
-- If `<dest>` doesn't exist, it is created along with all missing directories
-  in its path.
-
-## COPY
-
-COPY has two forms:
-
-- `COPY <src>... <dest>`
-- `COPY ["<src>",... "<dest>"]` (this form is required for paths containing
-whitespace)
-
-The `COPY` instruction copies new files or directories from `<src>`
-and adds them to the filesystem of the container at the path `<dest>`.
-
-Multiple `<src>` resource may be specified but they must be relative
-to the source directory that is being built (the context of the build).
-
-Each `<src>` may contain wildcards and matching will be done using Go's
-[filepath.Match](http://golang.org/pkg/path/filepath#Match) rules. For example:
-
-    COPY hom* /mydir/        # adds all files starting with "hom"
-    COPY hom?.txt /mydir/    # ? is replaced with any single character, e.g., "home.txt"
-
-The `<dest>` is an absolute path, or a path relative to `WORKDIR`, into which
-the source will be copied inside the destination container.
-
-    COPY test relativeDir/   # adds "test" to `WORKDIR`/relativeDir/
-    COPY test /absoluteDir/  # adds "test" to /absoluteDir/
-
-
-When copying files or directories that contain special characters (such as `[`
-and `]`), you need to escape those paths following the Golang rules to prevent
-them from being treated as a matching pattern. For example, to copy a file
-named `arr[0].txt`, use the following;
-
-    COPY arr[[]0].txt /mydir/    # copy a file named "arr[0].txt" to /mydir/
-
-All new files and directories are created with a UID and GID of 0.
-
-> **Note**:
-> If you build using STDIN (`docker build - < somefile`), there is no
-> build context, so `COPY` can't be used.
-
-Optionally `COPY` accepts a flag `--from=<name|index>` that can be used to set
-the source location to a previous build stage (created with `FROM .. AS <name>`)
-that will be used instead of a build context sent by the user. The flag also 
-accepts a numeric index assigned for all previous build stages started with 
-`FROM` instruction. In case a build stage with a specified name can't be found an 
-image with the same name is attempted to be used instead.
-
-`COPY` obeys the following rules:
-
-- The `<src>` path must be inside the *context* of the build;
-  you cannot `COPY ../something /something`, because the first step of a
-  `docker build` is to send the context directory (and subdirectories) to the
-  docker daemon.
-
-- If `<src>` is a directory, the entire contents of the directory are copied,
-  including filesystem metadata.
-
-> **Note**:
-> The directory itself is not copied, just its contents.
-
-- If `<src>` is any other kind of file, it is copied individually along with
-  its metadata. In this case, if `<dest>` ends with a trailing slash `/`, it
-  will be considered a directory and the contents of `<src>` will be written
-  at `<dest>/base(<src>)`.
-
-- If multiple `<src>` resources are specified, either directly or due to the
-  use of a wildcard, then `<dest>` must be a directory, and it must end with
-  a slash `/`.
-
-- If `<dest>` does not end with a trailing slash, it will be considered a
-  regular file and the contents of `<src>` will be written at `<dest>`.
-
-- If `<dest>` doesn't exist, it is created along with all missing directories
-  in its path.
-
-## ENTRYPOINT
-
-ENTRYPOINT has two forms:
-
-- `ENTRYPOINT ["executable", "param1", "param2"]`
-  (*exec* form, preferred)
-- `ENTRYPOINT command param1 param2`
-  (*shell* form)
-
-An `ENTRYPOINT` allows you to configure a container that will run as an executable.
-
-For example, the following will start nginx with its default content, listening
-on port 80:
-
-    docker run -i -t --rm -p 80:80 nginx
-
-Command line arguments to `docker run <image>` will be appended after all
-elements in an *exec* form `ENTRYPOINT`, and will override all elements specified
-using `CMD`.
-This allows arguments to be passed to the entry point, i.e., `docker run <image> -d`
-will pass the `-d` argument to the entry point.
-You can override the `ENTRYPOINT` instruction using the `docker run --entrypoint`
-flag.
-
-The *shell* form prevents any `CMD` or `run` command line arguments from being
-used, but has the disadvantage that your `ENTRYPOINT` will be started as a
-subcommand of `/bin/sh -c`, which does not pass signals.
-This means that the executable will not be the container's `PID 1` - and
-will _not_ receive Unix signals - so your executable will not receive a
-`SIGTERM` from `docker stop <container>`.
-
-Only the last `ENTRYPOINT` instruction in the `Dockerfile` will have an effect.
-
-### Exec form ENTRYPOINT example
-
-You can use the *exec* form of `ENTRYPOINT` to set fairly stable default commands
-and arguments and then use either form of `CMD` to set additional defaults that
-are more likely to be changed.
-
-    FROM ubuntu
-    ENTRYPOINT ["top", "-b"]
-    CMD ["-c"]
-
-When you run the container, you can see that `top` is the only process:
-
-    $ docker run -it --rm --name test  top -H
-    top - 08:25:00 up  7:27,  0 users,  load average: 0.00, 0.01, 0.05
-    Threads:   1 total,   1 running,   0 sleeping,   0 stopped,   0 zombie
-    %Cpu(s):  0.1 us,  0.1 sy,  0.0 ni, 99.7 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
-    KiB Mem:   2056668 total,  1616832 used,   439836 free,    99352 buffers
-    KiB Swap:  1441840 total,        0 used,  1441840 free.  1324440 cached Mem
-
-      PID USER      PR  NI    VIRT    RES    SHR S %CPU %MEM     TIME+ COMMAND
-        1 root      20   0   19744   2336   2080 R  0.0  0.1   0:00.04 top
-
-To examine the result further, you can use `docker exec`:
-
-    $ docker exec -it test ps aux
-    USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
-    root         1  2.6  0.1  19752  2352 ?        Ss+  08:24   0:00 top -b -H
-    root         7  0.0  0.1  15572  2164 ?        R+   08:25   0:00 ps aux
-
-And you can gracefully request `top` to shut down using `docker stop test`.
-
-The following `Dockerfile` shows using the `ENTRYPOINT` to run Apache in the
-foreground (i.e., as `PID 1`):
-
-```
-FROM debian:stable
-RUN apt-get update && apt-get install -y --force-yes apache2
-EXPOSE 80 443
-VOLUME ["/var/www", "/var/log/apache2", "/etc/apache2"]
-ENTRYPOINT ["/usr/sbin/apache2ctl", "-D", "FOREGROUND"]
-```
-
-If you need to write a starter script for a single executable, you can ensure that
-the final executable receives the Unix signals by using `exec` and `gosu`
-commands:
-
-```bash
-#!/usr/bin/env bash
-set -e
-
-if [ "$1" = 'postgres' ]; then
-    chown -R postgres "$PGDATA"
-
-    if [ -z "$(ls -A "$PGDATA")" ]; then
-        gosu postgres initdb
-    fi
-
-    exec gosu postgres "$@"
-fi
-
-exec "$@"
-```
-
-Lastly, if you need to do some extra cleanup (or communicate with other containers)
-on shutdown, or are co-ordinating more than one executable, you may need to ensure
-that the `ENTRYPOINT` script receives the Unix signals, passes them on, and then
-does some more work:
-
-```
-#!/bin/sh
-# Note: I've written this using sh so it works in the busybox container too
-
-# USE the trap if you need to also do manual cleanup after the service is stopped,
-#     or need to start multiple services in the one container
-trap "echo TRAPed signal" HUP INT QUIT TERM
-
-# start service in background here
-/usr/sbin/apachectl start
-
-echo "[hit enter key to exit] or run 'docker stop <container>'"
-read
-
-# stop service and clean up here
-echo "stopping apache"
-/usr/sbin/apachectl stop
-
-echo "exited $0"
-```
-
-If you run this image with `docker run -it --rm -p 80:80 --name test apache`,
-you can then examine the container's processes with `docker exec`, or `docker top`,
-and then ask the script to stop Apache:
-
-```bash
-$ docker exec -it test ps aux
-USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
-root         1  0.1  0.0   4448   692 ?        Ss+  00:42   0:00 /bin/sh /run.sh 123 cmd cmd2
-root        19  0.0  0.2  71304  4440 ?        Ss   00:42   0:00 /usr/sbin/apache2 -k start
-www-data    20  0.2  0.2 360468  6004 ?        Sl   00:42   0:00 /usr/sbin/apache2 -k start
-www-data    21  0.2  0.2 360468  6000 ?        Sl   00:42   0:00 /usr/sbin/apache2 -k start
-root        81  0.0  0.1  15572  2140 ?        R+   00:44   0:00 ps aux
-$ docker top test
-PID                 USER                COMMAND
-10035               root                {run.sh} /bin/sh /run.sh 123 cmd cmd2
-10054               root                /usr/sbin/apache2 -k start
-10055               33                  /usr/sbin/apache2 -k start
-10056               33                  /usr/sbin/apache2 -k start
-$ /usr/bin/time docker stop test
-test
-real	0m 0.27s
-user	0m 0.03s
-sys	0m 0.03s
-```
-
-> **Note:** you can override the `ENTRYPOINT` setting using `--entrypoint`,
-> but this can only set the binary to *exec* (no `sh -c` will be used).
-
-> **Note**:
-> The *exec* form is parsed as a JSON array, which means that
-> you must use double-quotes (") around words not single-quotes (').
-
-> **Note**:
-> Unlike the *shell* form, the *exec* form does not invoke a command shell.
-> This means that normal shell processing does not happen. For example,
-> `ENTRYPOINT [ "echo", "$HOME" ]` will not do variable substitution on `$HOME`.
-> If you want shell processing then either use the *shell* form or execute
-> a shell directly, for example: `ENTRYPOINT [ "sh", "-c", "echo $HOME" ]`.
-> When using the exec form and executing a shell directly, as in the case for
-> the shell form, it is the shell that is doing the environment variable
-> expansion, not docker.
-
-### Shell form ENTRYPOINT example
-
-You can specify a plain string for the `ENTRYPOINT` and it will execute in `/bin/sh -c`.
-This form will use shell processing to substitute shell environment variables,
-and will ignore any `CMD` or `docker run` command line arguments.
-To ensure that `docker stop` will signal any long running `ENTRYPOINT` executable
-correctly, you need to remember to start it with `exec`:
-
-    FROM ubuntu
-    ENTRYPOINT exec top -b
-
-When you run this image, you'll see the single `PID 1` process:
-
-    $ docker run -it --rm --name test top
-    Mem: 1704520K used, 352148K free, 0K shrd, 0K buff, 140368121167873K cached
-    CPU:   5% usr   0% sys   0% nic  94% idle   0% io   0% irq   0% sirq
-    Load average: 0.08 0.03 0.05 2/98 6
-      PID  PPID USER     STAT   VSZ %VSZ %CPU COMMAND
-        1     0 root     R     3164   0%   0% top -b
-
-Which will exit cleanly on `docker stop`:
-
-    $ /usr/bin/time docker stop test
-    test
-    real	0m 0.20s
-    user	0m 0.02s
-    sys	0m 0.04s
-
-If you forget to add `exec` to the beginning of your `ENTRYPOINT`:
-
-    FROM ubuntu
-    ENTRYPOINT top -b
-    CMD --ignored-param1
-
-You can then run it (giving it a name for the next step):
-
-    $ docker run -it --name test top --ignored-param2
-    Mem: 1704184K used, 352484K free, 0K shrd, 0K buff, 140621524238337K cached
-    CPU:   9% usr   2% sys   0% nic  88% idle   0% io   0% irq   0% sirq
-    Load average: 0.01 0.02 0.05 2/101 7
-      PID  PPID USER     STAT   VSZ %VSZ %CPU COMMAND
-        1     0 root     S     3168   0%   0% /bin/sh -c top -b cmd cmd2
-        7     1 root     R     3164   0%   0% top -b
-
-You can see from the output of `top` that the specified `ENTRYPOINT` is not `PID 1`.
-
-If you then run `docker stop test`, the container will not exit cleanly - the
-`stop` command will be forced to send a `SIGKILL` after the timeout:
-
-    $ docker exec -it test ps aux
-    PID   USER     COMMAND
-        1 root     /bin/sh -c top -b cmd cmd2
-        7 root     top -b
-        8 root     ps aux
-    $ /usr/bin/time docker stop test
-    test
-    real	0m 10.19s
-    user	0m 0.04s
-    sys	0m 0.03s
-
-### Understand how CMD and ENTRYPOINT interact
-
-Both `CMD` and `ENTRYPOINT` instructions define what command gets executed when running a container.
-There are few rules that describe their co-operation.
-
-1. Dockerfile should specify at least one of `CMD` or `ENTRYPOINT` commands.
-
-2. `ENTRYPOINT` should be defined when using the container as an executable.
-
-3. `CMD` should be used as a way of defining default arguments for an `ENTRYPOINT` command
-or for executing an ad-hoc command in a container.
-
-4. `CMD` will be overridden when running the container with alternative arguments.
-
-The table below shows what command is executed for different `ENTRYPOINT` / `CMD` combinations:
-
-|                                | No ENTRYPOINT              | ENTRYPOINT exec_entry p1_entry | ENTRYPOINT ["exec_entry", "p1_entry"]          |
-|--------------------------------|----------------------------|--------------------------------|------------------------------------------------|
-| **No CMD**                     | *error, not allowed*       | /bin/sh -c exec_entry p1_entry | exec_entry p1_entry                            |
-| **CMD ["exec_cmd", "p1_cmd"]** | exec_cmd p1_cmd            | /bin/sh -c exec_entry p1_entry | exec_entry p1_entry exec_cmd p1_cmd            |
-| **CMD ["p1_cmd", "p2_cmd"]**   | p1_cmd p2_cmd              | /bin/sh -c exec_entry p1_entry | exec_entry p1_entry p1_cmd p2_cmd              |
-| **CMD exec_cmd p1_cmd**        | /bin/sh -c exec_cmd p1_cmd | /bin/sh -c exec_entry p1_entry | exec_entry p1_entry /bin/sh -c exec_cmd p1_cmd |
-
-## VOLUME
-
-    VOLUME ["/data"]
-
-The `VOLUME` instruction creates a mount point with the specified name
-and marks it as holding externally mounted volumes from native host or other
-containers. The value can be a JSON array, `VOLUME ["/var/log/"]`, or a plain
-string with multiple arguments, such as `VOLUME /var/log` or `VOLUME /var/log
-/var/db`. For more information/examples and mounting instructions via the
-Docker client, refer to
-[*Share Directories via Volumes*](https://docs.docker.com/engine/tutorials/dockervolumes/#/mount-a-host-directory-as-a-data-volume)
-documentation.
-
-The `docker run` command initializes the newly created volume with any data
-that exists at the specified location within the base image. For example,
-consider the following Dockerfile snippet:
-
-    FROM ubuntu
-    RUN mkdir /myvol
-    RUN echo "hello world" > /myvol/greeting
-    VOLUME /myvol
-
-This Dockerfile results in an image that causes `docker run`, to
-create a new mount point at `/myvol` and copy the  `greeting` file
-into the newly created volume.
-
-> **Note**:
-> When using Windows-based containers, the destination of a volume inside the
-> container must be one of: a non-existing or empty directory; or a drive other
-> than C:.
-
-> **Note**:
-> If any build steps change the data within the volume after it has been
-> declared, those changes will be discarded.
-
-> **Note**:
-> The list is parsed as a JSON array, which means that
-> you must use double-quotes (") around words not single-quotes (').
-
-## USER
-
-    USER daemon
-
-The `USER` instruction sets the user name or UID to use when running the image
-and for any `RUN`, `CMD` and `ENTRYPOINT` instructions that follow it in the
-`Dockerfile`.
-
-## WORKDIR
-
-    WORKDIR /path/to/workdir
-
-The `WORKDIR` instruction sets the working directory for any `RUN`, `CMD`,
-`ENTRYPOINT`, `COPY` and `ADD` instructions that follow it in the `Dockerfile`.
-If the `WORKDIR` doesn't exist, it will be created even if it's not used in any
-subsequent `Dockerfile` instruction.
-
-It can be used multiple times in the one `Dockerfile`. If a relative path
-is provided, it will be relative to the path of the previous `WORKDIR`
-instruction. For example:
-
-    WORKDIR /a
-    WORKDIR b
-    WORKDIR c
-    RUN pwd
-
-The output of the final `pwd` command in this `Dockerfile` would be
-`/a/b/c`.
-
-The `WORKDIR` instruction can resolve environment variables previously set using
-`ENV`. You can only use environment variables explicitly set in the `Dockerfile`.
-For example:
-
-    ENV DIRPATH /path
-    WORKDIR $DIRPATH/$DIRNAME
-    RUN pwd
-
-The output of the final `pwd` command in this `Dockerfile` would be
-`/path/$DIRNAME`
-
-## ARG
-
-    ARG <name>[=<default value>]
-
-The `ARG` instruction defines a variable that users can pass at build-time to
-the builder with the `docker build` command using the `--build-arg <varname>=<value>`
-flag. If a user specifies a build argument that was not
-defined in the Dockerfile, the build outputs a warning.
-
-```
-[Warning] One or more build-args [foo] were not consumed.
-```
-
-The Dockerfile author can define a single variable by specifying `ARG` once or many
-variables by specifying `ARG` more than once. For example, a valid Dockerfile:
-
-```
-FROM busybox
-ARG user1
-ARG buildno
-...
-```
-
-A Dockerfile author may optionally specify a default value for an `ARG` instruction:
-
-```
-FROM busybox
-ARG user1=someuser
-ARG buildno=1
-...
-```
-
-If an `ARG` value has a default and if there is no value passed at build-time, the
-builder uses the default.
-
-An `ARG` variable definition comes into effect from the line on which it is
-defined in the `Dockerfile` not from the argument's use on the command-line or
-elsewhere.  For example, consider this Dockerfile:
-
-```
-1 FROM busybox
-2 USER ${user:-some_user}
-3 ARG user
-4 USER $user
-...
-```
-A user builds this file by calling:
-
-```
-$ docker build --build-arg user=what_user .
-```
-
-The `USER` at line 2 evaluates to `some_user` as the `user` variable is defined on the
-subsequent line 3. The `USER` at line 4 evaluates to `what_user` as `user` is
-defined and the `what_user` value was passed on the command line. Prior to its definition by an
-`ARG` instruction, any use of a variable results in an empty string.
-
-> **Warning:** It is not recommended to use build-time variables for
->  passing secrets like github keys, user credentials etc. Build-time variable
->  values are visible to any user of the image with the `docker history` command.
-
-You can use an `ARG` or an `ENV` instruction to specify variables that are
-available to the `RUN` instruction. Environment variables defined using the
-`ENV` instruction always override an `ARG` instruction of the same name. Consider
-this Dockerfile with an `ENV` and `ARG` instruction.
-
-```
-1 FROM ubuntu
-2 ARG CONT_IMG_VER
-3 ENV CONT_IMG_VER v1.0.0
-4 RUN echo $CONT_IMG_VER
-```
-Then, assume this image is built with this command:
-
-```
-$ docker build --build-arg CONT_IMG_VER=v2.0.1 .
-```
-
-In this case, the `RUN` instruction uses `v1.0.0` instead of the `ARG` setting
-passed by the user:`v2.0.1` This behavior is similar to a shell
-script where a locally scoped variable overrides the variables passed as
-arguments or inherited from environment, from its point of definition.
-
-Using the example above but a different `ENV` specification you can create more
-useful interactions between `ARG` and `ENV` instructions:
-
-```
-1 FROM ubuntu
-2 ARG CONT_IMG_VER
-3 ENV CONT_IMG_VER ${CONT_IMG_VER:-v1.0.0}
-4 RUN echo $CONT_IMG_VER
-```
-
-Unlike an `ARG` instruction, `ENV` values are always persisted in the built
-image. Consider a docker build without the `--build-arg` flag:
-
-```
-$ docker build .
-```
-
-Using this Dockerfile example, `CONT_IMG_VER` is still persisted in the image but
-its value would be `v1.0.0` as it is the default set in line 3 by the `ENV` instruction.
-
-The variable expansion technique in this example allows you to pass arguments
-from the command line and persist them in the final image by leveraging the
-`ENV` instruction. Variable expansion is only supported for [a limited set of
-Dockerfile instructions.](#environment-replacement)
-
-Docker has a set of predefined `ARG` variables that you can use without a
-corresponding `ARG` instruction in the Dockerfile.
-
-* `HTTP_PROXY`
-* `http_proxy`
-* `HTTPS_PROXY`
-* `https_proxy`
-* `FTP_PROXY`
-* `ftp_proxy`
-* `NO_PROXY`
-* `no_proxy`
-
-To use these, simply pass them on the command line using the flag:
-
-```
---build-arg <varname>=<value>
-```
-
-By default, these pre-defined variables are excluded from the output of
-`docker history`. Excluding them reduces the risk of accidentally leaking
-sensitive authentication information in an `HTTP_PROXY` variable.
-
-For example, consider building the following Dockerfile using
-`--build-arg HTTP_PROXY=http://user:pass@proxy.lon.example.com`
-
-``` Dockerfile
-FROM ubuntu
-RUN echo "Hello World"
-```
-
-In this case, the value of the `HTTP_PROXY` variable is not available in the
-`docker history` and is not cached. If you were to change location, and your
-proxy server changed to `http://user:pass@proxy.sfo.example.com`, a subsequent
-build does not result in a cache miss.
-
-If you need to override this behaviour then you may do so by adding an `ARG`
-statement in the Dockerfile as follows:
-
-``` Dockerfile
-FROM ubuntu
-ARG HTTP_PROXY
-RUN echo "Hello World"
-```
-
-When building this Dockerfile, the `HTTP_PROXY` is preserved in the
-`docker history`, and changing its value invalidates the build cache.
-
-### Impact on build caching
-
-`ARG` variables are not persisted into the built image as `ENV` variables are.
-However, `ARG` variables do impact the build cache in similar ways. If a
-Dockerfile defines an `ARG` variable whose value is different from a previous
-build, then a "cache miss" occurs upon its first usage, not its definition. In
-particular, all `RUN` instructions following an `ARG` instruction use the `ARG`
-variable implicitly (as an environment variable), thus can cause a cache miss.
-All predefined `ARG` variables are exempt from caching unless there is a
-matching `ARG` statement in the `Dockerfile`.
-
-For example, consider these two Dockerfile:
-
-```
-1 FROM ubuntu
-2 ARG CONT_IMG_VER
-3 RUN echo $CONT_IMG_VER
-```
-
-```
-1 FROM ubuntu
-2 ARG CONT_IMG_VER
-3 RUN echo hello
-```
-
-If you specify `--build-arg CONT_IMG_VER=<value>` on the command line, in both
-cases, the specification on line 2 does not cause a cache miss; line 3 does
-cause a cache miss.`ARG CONT_IMG_VER` causes the RUN line to be identified
-as the same as running `CONT_IMG_VER=<value>` echo hello, so if the `<value>`
-changes, we get a cache miss.
-
-Consider another example under the same command line:
-
-```
-1 FROM ubuntu
-2 ARG CONT_IMG_VER
-3 ENV CONT_IMG_VER $CONT_IMG_VER
-4 RUN echo $CONT_IMG_VER
-```
-In this example, the cache miss occurs on line 3. The miss happens because
-the variable's value in the `ENV` references the `ARG` variable and that
-variable is changed through the command line. In this example, the `ENV`
-command causes the image to include the value.
-
-If an `ENV` instruction overrides an `ARG` instruction of the same name, like
-this Dockerfile:
-
-```
-1 FROM ubuntu
-2 ARG CONT_IMG_VER
-3 ENV CONT_IMG_VER hello
-4 RUN echo $CONT_IMG_VER
-```
-
-Line 3 does not cause a cache miss because the value of `CONT_IMG_VER` is a
-constant (`hello`). As a result, the environment variables and values used on
-the `RUN` (line 4) doesn't change between builds.
-
-## ONBUILD
-
-    ONBUILD [INSTRUCTION]
-
-The `ONBUILD` instruction adds to the image a *trigger* instruction to
-be executed at a later time, when the image is used as the base for
-another build. The trigger will be executed in the context of the
-downstream build, as if it had been inserted immediately after the
-`FROM` instruction in the downstream `Dockerfile`.
-
-Any build instruction can be registered as a trigger.
-
-This is useful if you are building an image which will be used as a base
-to build other images, for example an application build environment or a
-daemon which may be customized with user-specific configuration.
-
-For example, if your image is a reusable Python application builder, it
-will require application source code to be added in a particular
-directory, and it might require a build script to be called *after*
-that. You can't just call `ADD` and `RUN` now, because you don't yet
-have access to the application source code, and it will be different for
-each application build. You could simply provide application developers
-with a boilerplate `Dockerfile` to copy-paste into their application, but
-that is inefficient, error-prone and difficult to update because it
-mixes with application-specific code.
-
-The solution is to use `ONBUILD` to register advance instructions to
-run later, during the next build stage.
-
-Here's how it works:
-
-1. When it encounters an `ONBUILD` instruction, the builder adds a
-   trigger to the metadata of the image being built. The instruction
-   does not otherwise affect the current build.
-2. At the end of the build, a list of all triggers is stored in the
-   image manifest, under the key `OnBuild`. They can be inspected with
-   the `docker inspect` command.
-3. Later the image may be used as a base for a new build, using the
-   `FROM` instruction. As part of processing the `FROM` instruction,
-   the downstream builder looks for `ONBUILD` triggers, and executes
-   them in the same order they were registered. If any of the triggers
-   fail, the `FROM` instruction is aborted which in turn causes the
-   build to fail. If all triggers succeed, the `FROM` instruction
-   completes and the build continues as usual.
-4. Triggers are cleared from the final image after being executed. In
-   other words they are not inherited by "grand-children" builds.
-
-For example you might add something like this:
-
-    [...]
-    ONBUILD ADD . /app/src
-    ONBUILD RUN /usr/local/bin/python-build --dir /app/src
-    [...]
-
-> **Warning**: Chaining `ONBUILD` instructions using `ONBUILD ONBUILD` isn't allowed.
-
-> **Warning**: The `ONBUILD` instruction may not trigger `FROM` or `MAINTAINER` instructions.
-
-## STOPSIGNAL
-
-    STOPSIGNAL signal
-
-The `STOPSIGNAL` instruction sets the system call signal that will be sent to the container to exit.
-This signal can be a valid unsigned number that matches a position in the kernel's syscall table, for instance 9,
-or a signal name in the format SIGNAME, for instance SIGKILL.
-
-## HEALTHCHECK
-
-The `HEALTHCHECK` instruction has two forms:
-
-* `HEALTHCHECK [OPTIONS] CMD command` (check container health by running a command inside the container)
-* `HEALTHCHECK NONE` (disable any healthcheck inherited from the base image)
-
-The `HEALTHCHECK` instruction tells Docker how to test a container to check that
-it is still working. This can detect cases such as a web server that is stuck in
-an infinite loop and unable to handle new connections, even though the server
-process is still running.
-
-When a container has a healthcheck specified, it has a _health status_ in
-addition to its normal status. This status is initially `starting`. Whenever a
-health check passes, it becomes `healthy` (whatever state it was previously in).
-After a certain number of consecutive failures, it becomes `unhealthy`.
-
-The options that can appear before `CMD` are:
-
-* `--interval=DURATION` (default: `30s`)
-* `--timeout=DURATION` (default: `30s`)
-* `--start-period=DURATION` (default: `0s`)
-* `--retries=N` (default: `3`)
-
-The health check will first run **interval** seconds after the container is
-started, and then again **interval** seconds after each previous check completes.
-
-If a single run of the check takes longer than **timeout** seconds then the check
-is considered to have failed.
-
-It takes **retries** consecutive failures of the health check for the container
-to be considered `unhealthy`.
-
-**start period** provides initialization time for containers that need time to bootstrap.
-Probe failure during that period will not be counted towards the maximum number of retries.
-However, if a health check succeeds during the start period, the container is considered
-started and all consecutive failures will be counted towards the maximum number of retries.
-
-There can only be one `HEALTHCHECK` instruction in a Dockerfile. If you list
-more than one then only the last `HEALTHCHECK` will take effect.
-
-The command after the `CMD` keyword can be either a shell command (e.g. `HEALTHCHECK
-CMD /bin/check-running`) or an _exec_ array (as with other Dockerfile commands;
-see e.g. `ENTRYPOINT` for details).
-
-The command's exit status indicates the health status of the container.
-The possible values are:
-
-- 0: success - the container is healthy and ready for use
-- 1: unhealthy - the container is not working correctly
-- 2: reserved - do not use this exit code
-
-For example, to check every five minutes or so that a web-server is able to
-serve the site's main page within three seconds:
-
-    HEALTHCHECK --interval=5m --timeout=3s \
-      CMD curl -f http://localhost/ || exit 1
-
-To help debug failing probes, any output text (UTF-8 encoded) that the command writes
-on stdout or stderr will be stored in the health status and can be queried with
-`docker inspect`. Such output should be kept short (only the first 4096 bytes
-are stored currently).
-
-When the health status of a container changes, a `health_status` event is
-generated with the new status.
-
-The `HEALTHCHECK` feature was added in Docker 1.12.
-
-
-## SHELL
-
-    SHELL ["executable", "parameters"]
-
-The `SHELL` instruction allows the default shell used for the *shell* form of
-commands to be overridden. The default shell on Linux is `["/bin/sh", "-c"]`, and on
-Windows is `["cmd", "/S", "/C"]`. The `SHELL` instruction *must* be written in JSON
-form in a Dockerfile.
-
-The `SHELL` instruction is particularly useful on Windows where there are
-two commonly used and quite different native shells: `cmd` and `powershell`, as
-well as alternate shells available including `sh`.
-
-The `SHELL` instruction can appear multiple times. Each `SHELL` instruction overrides
-all previous `SHELL` instructions, and affects all subsequent instructions. For example:
-
-    FROM microsoft/windowsservercore
-
-    # Executed as cmd /S /C echo default
-    RUN echo default
-
-    # Executed as cmd /S /C powershell -command Write-Host default
-    RUN powershell -command Write-Host default
-
-    # Executed as powershell -command Write-Host hello
-    SHELL ["powershell", "-command"]
-    RUN Write-Host hello
-
-    # Executed as cmd /S /C echo hello
-    SHELL ["cmd", "/S"", "/C"]
-    RUN echo hello
-
-The following instructions can be affected by the `SHELL` instruction when the
-*shell* form of them is used in a Dockerfile: `RUN`, `CMD` and `ENTRYPOINT`.
-
-The following example is a common pattern found on Windows which can be
-streamlined by using the `SHELL` instruction:
-
-    ...
-    RUN powershell -command Execute-MyCmdlet -param1 "c:\foo.txt"
-    ...
-
-The command invoked by docker will be:
-
-    cmd /S /C powershell -command Execute-MyCmdlet -param1 "c:\foo.txt"
-
-This is inefficient for two reasons. First, there is an un-necessary cmd.exe command
-processor (aka shell) being invoked. Second, each `RUN` instruction in the *shell*
-form requires an extra `powershell -command` prefixing the command.
-
-To make this more efficient, one of two mechanisms can be employed. One is to
-use the JSON form of the RUN command such as:
-
-    ...
-    RUN ["powershell", "-command", "Execute-MyCmdlet", "-param1 \"c:\\foo.txt\""]
-    ...
-
-While the JSON form is unambiguous and does not use the un-necessary cmd.exe,
-it does require more verbosity through double-quoting and escaping. The alternate
-mechanism is to use the `SHELL` instruction and the *shell* form,
-making a more natural syntax for Windows users, especially when combined with
-the `escape` parser directive:
-
-    # escape=`
-
-    FROM microsoft/nanoserver
-    SHELL ["powershell","-command"]
-    RUN New-Item -ItemType Directory C:\Example
-    ADD Execute-MyCmdlet.ps1 c:\example\
-    RUN c:\example\Execute-MyCmdlet -sample 'hello world'
-
-Resulting in:
-
-    PS E:\docker\build\shell> docker build -t shell .
-    Sending build context to Docker daemon 4.096 kB
-    Step 1/5 : FROM microsoft/nanoserver
-     ---> 22738ff49c6d
-    Step 2/5 : SHELL powershell -command
-     ---> Running in 6fcdb6855ae2
-     ---> 6331462d4300
-    Removing intermediate container 6fcdb6855ae2
-    Step 3/5 : RUN New-Item -ItemType Directory C:\Example
-     ---> Running in d0eef8386e97
-    
-    
-        Directory: C:\
-    
-    
-    Mode                LastWriteTime         Length Name
-    ----                -------------         ------ ----
-    d-----       10/28/2016  11:26 AM                Example
-    
-    
-     ---> 3f2fbf1395d9
-    Removing intermediate container d0eef8386e97
-    Step 4/5 : ADD Execute-MyCmdlet.ps1 c:\example\
-     ---> a955b2621c31
-    Removing intermediate container b825593d39fc
-    Step 5/5 : RUN c:\example\Execute-MyCmdlet 'hello world'
-     ---> Running in be6d8e63fe75
-    hello world
-     ---> 8e559e9bf424
-    Removing intermediate container be6d8e63fe75
-    Successfully built 8e559e9bf424
-    PS E:\docker\build\shell>
-
-The `SHELL` instruction could also be used to modify the way in which
-a shell operates. For example, using `SHELL cmd /S /C /V:ON|OFF` on Windows, delayed
-environment variable expansion semantics could be modified.
-
-The `SHELL` instruction can also be used on Linux should an alternate shell be
-required such as `zsh`, `csh`, `tcsh` and others.
-
-The `SHELL` feature was added in Docker 1.12.
-
-## Dockerfile examples
-
-Below you can see some examples of Dockerfile syntax. If you're interested in
-something more realistic, take a look at the list of [Dockerization examples](https://docs.docker.com/engine/examples/).
-
-```
-# Nginx
-#
-# VERSION               0.0.1
-
-FROM      ubuntu
-LABEL Description="This image is used to start the foobar executable" Vendor="ACME Products" Version="1.0"
-RUN apt-get update && apt-get install -y inotify-tools nginx apache2 openssh-server
-```
-
-```
-# Firefox over VNC
-#
-# VERSION               0.3
-
-FROM ubuntu
-
-# Install vnc, xvfb in order to create a 'fake' display and firefox
-RUN apt-get update && apt-get install -y x11vnc xvfb firefox
-RUN mkdir ~/.vnc
-# Setup a password
-RUN x11vnc -storepasswd 1234 ~/.vnc/passwd
-# Autostart firefox (might not be the best way, but it does the trick)
-RUN bash -c 'echo "firefox" >> /.bashrc'
-
-EXPOSE 5900
-CMD    ["x11vnc", "-forever", "-usepw", "-create"]
-```
-
-```
-# Multiple images example
-#
-# VERSION               0.1
-
-FROM ubuntu
-RUN echo foo > bar
-# Will output something like ===> 907ad6c2736f
-
-FROM ubuntu
-RUN echo moo > oink
-# Will output something like ===> 695d7793cbe4
-
-# You'll now have two images, 907ad6c2736f with /bar, and 695d7793cbe4 with
-# /oink.
-```
diff --git a/components/engine/docs/reference/commandline/attach.md b/components/engine/docs/reference/commandline/attach.md
deleted file mode 100644
index 4153331bad..0000000000
--- a/components/engine/docs/reference/commandline/attach.md
+++ /dev/null
@@ -1,160 +0,0 @@
----
-title: "attach"
-description: "The attach command description and usage"
-keywords: "attach, running, container"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# attach
-
-```markdown
-Usage: docker attach [OPTIONS] CONTAINER
-
-Attach local standard input, output, and error streams to a running container
-
-Options:
-      --detach-keys string   Override the key sequence for detaching a container
-      --help                 Print usage
-      --no-stdin             Do not attach STDIN
-      --sig-proxy            Proxy all received signals to the process (default true)
-```
-
-## Description
-
-Use `docker attach` to attach your terminal's standard input, output, and error
-(or any combination of the three) to a running container using the container's
-ID or name. This allows you to view its ongoing output or to control it
-interactively, as though the commands were running directly in your terminal.
-
-> **Note:**
-> The `attach` command will display the output of the `ENTRYPOINT/CMD` process.  This
-> can appear as if the attach command is hung when in fact the process may simply
-> not be interacting with the terminal at that time.
-
-You can attach to the same contained process multiple times simultaneously,
-even as a different user with the appropriate permissions.
-
-To stop a container, use `CTRL-c`. This key sequence sends `SIGKILL` to the
-container. If `--sig-proxy` is true (the default),`CTRL-c` sends a `SIGINT` to
-the container. You can detach from a container and leave it running using the
- `CTRL-p CTRL-q` key sequence.
-
-> **Note:**
-> A process running as PID 1 inside a container is treated specially by
-> Linux: it ignores any signal with the default action. So, the process
-> will not terminate on `SIGINT` or `SIGTERM` unless it is coded to do
-> so.
-
-It is forbidden to redirect the standard input of a `docker attach` command
-while attaching to a tty-enabled container (i.e.: launched with `-t`).
-
-While a client is connected to container's stdio using `docker attach`, Docker
-uses a ~1MB memory buffer to maximize the throughput of the application. If
-this buffer is filled, the speed of the API connection will start to have an
-effect on the process output writing speed. This is similar to other
-applications like SSH. Because of this, it is not recommended to run
-performance critical applications that generate a lot of output in the
-foreground over a slow client connection. Instead, users should use the
-`docker logs` command to get access to the logs.
-
-### Override the detach sequence
-
-If you want, you can configure an override the Docker key sequence for detach.
-This is useful if the Docker default sequence conflicts with key sequence you
-use for other applications. There are two ways to define your own detach key
-sequence, as a per-container override or as a configuration property on  your
-entire configuration.
-
-To override the sequence for an individual container, use the
-`--detach-keys="<sequence>"` flag with the `docker attach` command. The format of
-the `<sequence>` is either a letter [a-Z], or the `ctrl-` combined with any of
-the following:
-
-* `a-z` (a single lowercase alpha character )
-* `@` (at sign)
-* `[` (left bracket)
-* `\\` (two backward slashes)
-*  `_` (underscore)
-* `^` (caret)
-
-These `a`, `ctrl-a`, `X`, or `ctrl-\\` values are all examples of valid key
-sequences. To configure a different configuration default key sequence for all
-containers, see [**Configuration file** section](cli.md#configuration-files).
-
-## Examples
-
-### Attach to and detach from a running container
-
-```bash
-$ docker run -d --name topdemo ubuntu /usr/bin/top -b
-
-$ docker attach topdemo
-
-top - 02:05:52 up  3:05,  0 users,  load average: 0.01, 0.02, 0.05
-Tasks:   1 total,   1 running,   0 sleeping,   0 stopped,   0 zombie
-Cpu(s):  0.1%us,  0.2%sy,  0.0%ni, 99.7%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
-Mem:    373572k total,   355560k used,    18012k free,    27872k buffers
-Swap:   786428k total,        0k used,   786428k free,   221740k cached
-
-PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
- 1 root      20   0 17200 1116  912 R    0  0.3   0:00.03 top
-
- top - 02:05:55 up  3:05,  0 users,  load average: 0.01, 0.02, 0.05
- Tasks:   1 total,   1 running,   0 sleeping,   0 stopped,   0 zombie
- Cpu(s):  0.0%us,  0.2%sy,  0.0%ni, 99.8%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
- Mem:    373572k total,   355244k used,    18328k free,    27872k buffers
- Swap:   786428k total,        0k used,   786428k free,   221776k cached
-
-   PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
-       1 root      20   0 17208 1144  932 R    0  0.3   0:00.03 top
-
-
- top - 02:05:58 up  3:06,  0 users,  load average: 0.01, 0.02, 0.05
- Tasks:   1 total,   1 running,   0 sleeping,   0 stopped,   0 zombie
- Cpu(s):  0.2%us,  0.3%sy,  0.0%ni, 99.5%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
- Mem:    373572k total,   355780k used,    17792k free,    27880k buffers
- Swap:   786428k total,        0k used,   786428k free,   221776k cached
-
- PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
-      1 root      20   0 17208 1144  932 R    0  0.3   0:00.03 top
-^C$
-
-$ echo $?
-0
-$ docker ps -a | grep topdemo
-
-7998ac8581f9        ubuntu:14.04        "/usr/bin/top -b"   38 seconds ago      Exited (0) 21 seconds ago                          topdemo
-```
-
-### Get the exit code of the container's command
-
-And in this second example, you can see the exit code returned by the `bash`
-process is returned by the `docker attach` command to its caller too:
-
-```bash
-    $ docker run --name test -d -it debian
-
-    275c44472aebd77c926d4527885bb09f2f6db21d878c75f0a1c212c03d3bcfab
-
-    $ docker attach test
-
-    root@f38c87f2a42d:/# exit 13
-
-    exit
-
-    $ echo $?
-
-    13
-
-    $ docker ps -a | grep test
-
-    275c44472aeb        debian:7            "/bin/bash"         26 seconds ago      Exited (13) 17 seconds ago                         test
-```
diff --git a/components/engine/docs/reference/commandline/build.md b/components/engine/docs/reference/commandline/build.md
deleted file mode 100644
index 9f587372c6..0000000000
--- a/components/engine/docs/reference/commandline/build.md
+++ /dev/null
@@ -1,581 +0,0 @@
----
-title: "build"
-description: "The build command description and usage"
-keywords: "build, docker, image"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# build
-
-```markdown
-Usage:  docker build [OPTIONS] PATH | URL | -
-
-Build an image from a Dockerfile
-
-Options:
-      --add-host value          Add a custom host-to-IP mapping (host:ip) (default [])
-      --build-arg value         Set build-time variables (default [])
-      --cache-from value        Images to consider as cache sources (default [])
-      --cgroup-parent string    Optional parent cgroup for the container
-      --compress                Compress the build context using gzip
-      --cpu-period int          Limit the CPU CFS (Completely Fair Scheduler) period
-      --cpu-quota int           Limit the CPU CFS (Completely Fair Scheduler) quota
-  -c, --cpu-shares int          CPU shares (relative weight)
-      --cpuset-cpus string      CPUs in which to allow execution (0-3, 0,1)
-      --cpuset-mems string      MEMs in which to allow execution (0-3, 0,1)
-      --disable-content-trust   Skip image verification (default true)
-  -f, --file string             Name of the Dockerfile (Default is 'PATH/Dockerfile')
-      --force-rm                Always remove intermediate containers
-      --help                    Print usage
-      --iidfile string          Write the image ID to the file
-      --isolation string        Container isolation technology
-      --label value             Set metadata for an image (default [])
-  -m, --memory string           Memory limit
-      --memory-swap string      Swap limit equal to memory plus swap: '-1' to enable unlimited swap
-      --network string          Set the networking mode for the RUN instructions during build
-                                'bridge': use default Docker bridge
-                                'none': no networking
-                                'container:<name|id>': reuse another container's network stack
-                                'host': use the Docker host network stack
-                                '<network-name>|<network-id>': connect to a user-defined network
-      --no-cache                Do not use cache when building the image
-      --pull                    Always attempt to pull a newer version of the image
-  -q, --quiet                   Suppress the build output and print image ID on success
-      --rm                      Remove intermediate containers after a successful build (default true)
-      --security-opt value      Security Options (default [])
-      --shm-size bytes          Size of /dev/shm
-                                The format is `<number><unit>`. `number` must be greater than `0`.
-                                Unit is optional and can be `b` (bytes), `k` (kilobytes), `m` (megabytes),
-                                or `g` (gigabytes). If you omit the unit, the system uses bytes.
-      --squash                  Squash newly built layers into a single new layer (**Experimental Only**)
-  -t, --tag value               Name and optionally a tag in the 'name:tag' format (default [])
-      --target string           Set the target build stage to build.
-      --ulimit value            Ulimit options (default [])
-```
-
-## Description
-
-Builds Docker images from a Dockerfile and a "context". A build's context is
-the files located in the specified `PATH` or `URL`. The build process can refer
-to any of the files in the context. For example, your build can use an
-[*ADD*](../builder.md#add) instruction to reference a file in the
-context.
-
-The `URL` parameter can refer to three kinds of resources: Git repositories,
-pre-packaged tarball contexts and plain text files.
-
-### Git repositories
-
-When the `URL` parameter points to the location of a Git repository, the
-repository acts as the build context. The system recursively fetches the
-repository and its submodules. The commit history is not preserved. A
-repository is first pulled into a temporary directory on your local host. After
-the that succeeds, the directory is sent to the Docker daemon as the context.
-Local copy gives you the ability to access private repositories using local
-user credentials, VPN's, and so forth.
-
-> **Note:**
-> If the `URL` parameter contains a fragment the system will recursively clone
-> the repository and its submodules using a `git clone --recursive` command.
-
-Git URLs accept context configuration in their fragment section, separated by a
-colon `:`.  The first part represents the reference that Git will check out,
-this can be either a branch, a tag, or a remote reference. The second part
-represents a subdirectory inside the repository that will be used as a build
-context.
-
-For example, run this command to use a directory called `docker` in the branch
-`container`:
-
-```bash
-$ docker build https://github.com/docker/rootfs.git#container:docker
-```
-
-The following table represents all the valid suffixes with their build
-contexts:
-
-Build Syntax Suffix             | Commit Used           | Build Context Used
---------------------------------|-----------------------|-------------------
-`myrepo.git`                    | `refs/heads/master`   | `/`
-`myrepo.git#mytag`              | `refs/tags/mytag`     | `/`
-`myrepo.git#mybranch`           | `refs/heads/mybranch` | `/`
-`myrepo.git#pull/42/head`       | `refs/pull/42/head`   | `/`
-`myrepo.git#:myfolder`          | `refs/heads/master`   | `/myfolder`
-`myrepo.git#master:myfolder`    | `refs/heads/master`   | `/myfolder`
-`myrepo.git#mytag:myfolder`     | `refs/tags/mytag`     | `/myfolder`
-`myrepo.git#mybranch:myfolder`  | `refs/heads/mybranch` | `/myfolder`
-
-
-### Tarball contexts
-
-If you pass an URL to a remote tarball, the URL itself is sent to the daemon:
-
-```bash
-$ docker build http://server/context.tar.gz
-```
-
-The download operation will be performed on the host the Docker daemon is
-running on, which is not necessarily the same host from which the build command
-is being issued. The Docker daemon will fetch `context.tar.gz` and use it as the
-build context. Tarball contexts must be tar archives conforming to the standard
-`tar` UNIX format and can be compressed with any one of the 'xz', 'bzip2',
-'gzip' or 'identity' (no compression) formats.
-
-### Text files
-
-Instead of specifying a context, you can pass a single `Dockerfile` in the
-`URL` or pipe the file in via `STDIN`. To pipe a `Dockerfile` from `STDIN`:
-
-```bash
-$ docker build - < Dockerfile
-```
-
-With Powershell on Windows, you can run:
-
-```powershell
-Get-Content Dockerfile | docker build -
-```
-
-If you use `STDIN` or specify a `URL` pointing to a plain text file, the system
-places the contents into a file called `Dockerfile`, and any `-f`, `--file`
-option is ignored. In this scenario, there is no context.
-
-By default the `docker build` command will look for a `Dockerfile` at the root
-of the build context. The `-f`, `--file`, option lets you specify the path to
-an alternative file to use instead. This is useful in cases where the same set
-of files are used for multiple builds. The path must be to a file within the
-build context. If a relative path is specified then it is interpreted as
-relative to the root of the context.
-
-In most cases, it's best to put each Dockerfile in an empty directory. Then,
-add to that directory only the files needed for building the Dockerfile. To
-increase the build's performance, you can exclude files and directories by
-adding a `.dockerignore` file to that directory as well. For information on
-creating one, see the [.dockerignore file](../builder.md#dockerignore-file).
-
-If the Docker client loses connection to the daemon, the build is canceled.
-This happens if you interrupt the Docker client with `CTRL-c` or if the Docker
-client is killed for any reason. If the build initiated a pull which is still
-running at the time the build is cancelled, the pull is cancelled as well.
-
-## Return code
-
-On a successful build, a return code of success `0` will be returned.  When the
-build fails, a non-zero failure code will be returned.
-
-There should be informational output of the reason for failure output to
-`STDERR`:
-
-```bash
-$ docker build -t fail .
-
-Sending build context to Docker daemon 2.048 kB
-Sending build context to Docker daemon
-Step 1/3 : FROM busybox
- ---> 4986bf8c1536
-Step 2/3 : RUN exit 13
- ---> Running in e26670ec7a0a
-INFO[0000] The command [/bin/sh -c exit 13] returned a non-zero code: 13
-$ echo $?
-1
-```
-
-See also:
-
-[*Dockerfile Reference*](../builder.md).
-
-## Examples
-
-### Build with PATH
-
-```bash
-$ docker build .
-
-Uploading context 10240 bytes
-Step 1/3 : FROM busybox
-Pulling repository busybox
- ---> e9aa60c60128MB/2.284 MB (100%) endpoint: https://cdn-registry-1.docker.io/v1/
-Step 2/3 : RUN ls -lh /
- ---> Running in 9c9e81692ae9
-total 24
-drwxr-xr-x    2 root     root        4.0K Mar 12  2013 bin
-drwxr-xr-x    5 root     root        4.0K Oct 19 00:19 dev
-drwxr-xr-x    2 root     root        4.0K Oct 19 00:19 etc
-drwxr-xr-x    2 root     root        4.0K Nov 15 23:34 lib
-lrwxrwxrwx    1 root     root           3 Mar 12  2013 lib64 -> lib
-dr-xr-xr-x  116 root     root           0 Nov 15 23:34 proc
-lrwxrwxrwx    1 root     root           3 Mar 12  2013 sbin -> bin
-dr-xr-xr-x   13 root     root           0 Nov 15 23:34 sys
-drwxr-xr-x    2 root     root        4.0K Mar 12  2013 tmp
-drwxr-xr-x    2 root     root        4.0K Nov 15 23:34 usr
- ---> b35f4035db3f
-Step 3/3 : CMD echo Hello world
- ---> Running in 02071fceb21b
- ---> f52f38b7823e
-Successfully built f52f38b7823e
-Removing intermediate container 9c9e81692ae9
-Removing intermediate container 02071fceb21b
-```
-
-This example specifies that the `PATH` is `.`, and so all the files in the
-local directory get `tar`d and sent to the Docker daemon. The `PATH` specifies
-where to find the files for the "context" of the build on the Docker daemon.
-Remember that the daemon could be running on a remote machine and that no
-parsing of the Dockerfile happens at the client side (where you're running
-`docker build`). That means that *all* the files at `PATH` get sent, not just
-the ones listed to [*ADD*](../builder.md#add) in the Dockerfile.
-
-The transfer of context from the local machine to the Docker daemon is what the
-`docker` client means when you see the "Sending build context" message.
-
-If you wish to keep the intermediate containers after the build is complete,
-you must use `--rm=false`. This does not affect the build cache.
-
-### Build with URL
-
-```bash
-$ docker build github.com/creack/docker-firefox
-```
-
-This will clone the GitHub repository and use the cloned repository as context.
-The Dockerfile at the root of the repository is used as Dockerfile. You can
-specify an arbitrary Git repository by using the `git://` or `git@` scheme.
-
-```bash
-$ docker build -f ctx/Dockerfile http://server/ctx.tar.gz
-
-Downloading context: http://server/ctx.tar.gz [===================>]    240 B/240 B
-Step 1/3 : FROM busybox
- ---> 8c2e06607696
-Step 2/3 : ADD ctx/container.cfg /
- ---> e7829950cee3
-Removing intermediate container b35224abf821
-Step 3/3 : CMD /bin/ls
- ---> Running in fbc63d321d73
- ---> 3286931702ad
-Removing intermediate container fbc63d321d73
-Successfully built 377c409b35e4
-```
-
-This sends the URL `http://server/ctx.tar.gz` to the Docker daemon, which
-downloads and extracts the referenced tarball. The `-f ctx/Dockerfile`
-parameter specifies a path inside `ctx.tar.gz` to the `Dockerfile` that is used
-to build the image. Any `ADD` commands in that `Dockerfile` that refers to local
-paths must be relative to the root of the contents inside `ctx.tar.gz`. In the
-example above, the tarball contains a directory `ctx/`, so the `ADD
-ctx/container.cfg /` operation works as expected.
-
-### Build with -
-
-```bash
-$ docker build - < Dockerfile
-```
-
-This will read a Dockerfile from `STDIN` without context. Due to the lack of a
-context, no contents of any local directory will be sent to the Docker daemon.
-Since there is no context, a Dockerfile `ADD` only works if it refers to a
-remote URL.
-
-```bash
-$ docker build - < context.tar.gz
-```
-
-This will build an image for a compressed context read from `STDIN`.  Supported
-formats are: bzip2, gzip and xz.
-
-### Use a .dockerignore file
-
-```bash
-$ docker build .
-
-Uploading context 18.829 MB
-Uploading context
-Step 1/2 : FROM busybox
- ---> 769b9341d937
-Step 2/2 : CMD echo Hello world
- ---> Using cache
- ---> 99cc1ad10469
-Successfully built 99cc1ad10469
-$ echo ".git" > .dockerignore
-$ docker build .
-Uploading context  6.76 MB
-Uploading context
-Step 1/2 : FROM busybox
- ---> 769b9341d937
-Step 2/2 : CMD echo Hello world
- ---> Using cache
- ---> 99cc1ad10469
-Successfully built 99cc1ad10469
-```
-
-This example shows the use of the `.dockerignore` file to exclude the `.git`
-directory from the context. Its effect can be seen in the changed size of the
-uploaded context. The builder reference contains detailed information on
-[creating a .dockerignore file](../builder.md#dockerignore-file)
-
-### Tag an image (-t)
-
-```bash
-$ docker build -t vieux/apache:2.0 .
-```
-
-This will build like the previous example, but it will then tag the resulting
-image. The repository name will be `vieux/apache` and the tag will be `2.0`.
-[Read more about valid tags](tag.md).
-
-You can apply multiple tags to an image. For example, you can apply the `latest`
-tag to a newly built image and add another tag that references a specific
-version.
-For example, to tag an image both as `whenry/fedora-jboss:latest` and
-`whenry/fedora-jboss:v2.1`, use the following:
-
-```bash
-$ docker build -t whenry/fedora-jboss:latest -t whenry/fedora-jboss:v2.1 .
-```
-
-### Specify a Dockerfile (-f)
-
-```bash
-$ docker build -f Dockerfile.debug .
-```
-
-This will use a file called `Dockerfile.debug` for the build instructions
-instead of `Dockerfile`.
-
-```bash
-$ curl example.com/remote/Dockerfile | docker build -f - .
-```
-
-The above command will use the current directory as the build context and read
-a Dockerfile from stdin.
-
-```bash
-$ docker build -f dockerfiles/Dockerfile.debug -t myapp_debug .
-$ docker build -f dockerfiles/Dockerfile.prod  -t myapp_prod .
-```
-
-The above commands will build the current build context (as specified by the
-`.`) twice, once using a debug version of a `Dockerfile` and once using a
-production version.
-
-```bash
-$ cd /home/me/myapp/some/dir/really/deep
-$ docker build -f /home/me/myapp/dockerfiles/debug /home/me/myapp
-$ docker build -f ../../../../dockerfiles/debug /home/me/myapp
-```
-
-These two `docker build` commands do the exact same thing. They both use the
-contents of the `debug` file instead of looking for a `Dockerfile` and will use
-`/home/me/myapp` as the root of the build context. Note that `debug` is in the
-directory structure of the build context, regardless of how you refer to it on
-the command line.
-
-> **Note:**
-> `docker build` will return a `no such file or directory` error if the
-> file or directory does not exist in the uploaded context. This may
-> happen if there is no context, or if you specify a file that is
-> elsewhere on the Host system. The context is limited to the current
-> directory (and its children) for security reasons, and to ensure
-> repeatable builds on remote Docker hosts. This is also the reason why
-> `ADD ../file` will not work.
-
-### Use a custom parent cgroup (--cgroup-parent)
-
-When `docker build` is run with the `--cgroup-parent` option the containers
-used in the build will be run with the [corresponding `docker run`
-flag](../run.md#specifying-custom-cgroups).
-
-### Set ulimits in container (--ulimit)
-
-Using the `--ulimit` option with `docker build` will cause each build step's
-container to be started using those [`--ulimit`
-flag values](./run.md#set-ulimits-in-container-ulimit).
-
-### Set build-time variables (--build-arg)
-
-You can use `ENV` instructions in a Dockerfile to define variable
-values. These values persist in the built image. However, often
-persistence is not what you want. Users want to specify variables differently
-depending on which host they build an image on.
-
-A good example is `http_proxy` or source versions for pulling intermediate
-files. The `ARG` instruction lets Dockerfile authors define values that users
-can set at build-time using the  `--build-arg` flag:
-
-```bash
-$ docker build --build-arg HTTP_PROXY=http://10.20.30.2:1234 .
-```
-
-This flag allows you to pass the build-time variables that are
-accessed like regular environment variables in the `RUN` instruction of the
-Dockerfile. Also, these values don't persist in the intermediate or final images
-like `ENV` values do.
-
-Using this flag will not alter the output you see when the `ARG` lines from the
-Dockerfile are echoed during the build process.
-
-For detailed information on using `ARG` and `ENV` instructions, see the
-[Dockerfile reference](../builder.md).
-
-### Optional security options (--security-opt)
-
-This flag is only supported on a daemon running on Windows, and only supports
-the `credentialspec` option. The `credentialspec` must be in the format
-`file://spec.txt` or `registry://keyname`.
-
-### Specify isolation technology for container (--isolation)
-
-This option is useful in situations where you are running Docker containers on
-Windows. The `--isolation=<value>` option sets a container's isolation
-technology. On Linux, the only supported is the `default` option which uses
-Linux namespaces. On Microsoft Windows, you can specify these values:
-
-
-| Value     | Description                                                                                                                                                   |
-|-----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `default` | Use the value specified by the Docker daemon's `--exec-opt` . If the `daemon` does not specify an isolation technology, Microsoft Windows uses `process` as its default value.  |
-| `process` | Namespace isolation only.                                                                                                                                     |
-| `hyperv`  | Hyper-V hypervisor partition-based isolation.                                                                                                                 |
-
-Specifying the `--isolation` flag without a value is the same as setting `--isolation="default"`.
-
-### Add entries to container hosts file (--add-host)
-
-You can add other hosts into a container's `/etc/hosts` file by using one or
-more `--add-host` flags. This example adds a static address for a host named
-`docker`:
-
-    $ docker build --add-host=docker:10.180.0.1 .
-
-### Specifying target build stage (--target)
-
-When building a Dockerfile with multiple build stages, `--target` can be used to
-specify an intermediate build stage by name as a final stage for the resulting
-image. Commands after the target stage will be skipped.
-
-```Dockerfile
-FROM debian AS build-env
-...
-
-FROM alpine AS production-env
-...
-```
-
-```bash
-$ docker build -t mybuildimage --target build-env .
-```
-
-### Squash an image's layers (--squash) **Experimental Only**
-
-#### Overview
-
-Once the image is built, squash the new layers into a new image with a single
-new layer. Squashing does not destroy any existing image, rather it creates a new
-image with the content of the squashed layers. This effectively makes it look
-like all `Dockerfile` commands were created with a single layer. The build
-cache is preserved with this method.
-
-**Note**: using this option means the new image will not be able to take
-advantage of layer sharing with other images and may use significantly more
-space.
-
-**Note**: using this option you may see significantly more space used due to
-storing two copies of the image, one for the build cache with all the cache
-layers in tact, and one for the squashed version.
-
-#### Prerequisites
-
-The example on this page is using experimental mode in Docker 1.13.
-
-Experimental mode can be enabled by using the `--experimental` flag when starting the Docker daemon or setting `experimental: true` in the `daemon.json` configuration file.
-
-By default, experimental mode is disabled. To see the current configuration, use the `docker version` command.
-
-```none
-
-Server:
- Version:      1.13.1
- API version:  1.26 (minimum version 1.12)
- Go version:   go1.7.5
- Git commit:   092cba3
- Built:        Wed Feb  8 06:35:24 2017
- OS/Arch:      linux/amd64
- Experimental: false
-
- [...]
-
-```
-
-To enable experimental mode, users need to restart the docker daemon with the experimental flag enabled.
-
-#### Enable Docker experimental
-
-Experimental features are now included in the standard Docker binaries as of version 1.13.0. For enabling experimental features, you need to start the Docker daemon with `--experimental` flag. You can also enable the daemon flag via /etc/docker/daemon.json. e.g.
-
-```
-
-{
-    "experimental": true
-}
-
-```
-Then make sure the experimental flag is enabled:
-
-```bash
-
-$ docker version -f '{{.Server.Experimental}}'
-true
-
-```
-
-#### Build an image with `--squash` argument
-
-The following is an example of docker build with `--squash` argument
-
-```Dockerfile
-
-FROM busybox
-RUN echo hello > /hello
-RUN echo world >> /hello
-RUN touch remove_me /remove_me
-ENV HELLO world
-RUN rm /remove_me
-
-```
-An image named `test` is built with `--squash` argument.
-
-```bash
-
-$ docker build --squash -t test .
-
-[...]
-
-```
-
-If everything is right, the history will look like this:
-
-```bash
-$ docker history test 
-
-IMAGE               CREATED             CREATED BY                                      SIZE                COMMENT
-4e10cb5b4cac        3 seconds ago                                                       12 B                merge sha256:88a7b0112a41826885df0e7072698006ee8f621c6ab99fca7fe9151d7b599702 to sha256:47bcc53f74dc94b1920f0b34f6036096526296767650f223433fe65c35f149eb
-<missing>           5 minutes ago       /bin/sh -c rm /remove_me                        0 B
-<missing>           5 minutes ago       /bin/sh -c #(nop) ENV HELLO=world               0 B
-<missing>           5 minutes ago       /bin/sh -c touch remove_me /remove_me           0 B
-<missing>           5 minutes ago       /bin/sh -c echo world >> /hello                 0 B
-<missing>           6 minutes ago       /bin/sh -c echo hello > /hello                  0 B
-<missing>           7 weeks ago         /bin/sh -c #(nop) CMD ["sh"]                    0 B
-<missing>           7 weeks ago         /bin/sh -c #(nop) ADD file:47ca6e777c36a4cfff   1.113 MB
-
-```
-We could find that all layer's name is `<missing>`, and there is a new layer with COMMENT `merge`.
-
-Test the image, check for `/remove_me` being gone, make sure `hello\nworld` is in `/hello`, make sure the `HELLO` envvar's value is `world`.
diff --git a/components/engine/docs/reference/commandline/cli.md b/components/engine/docs/reference/commandline/cli.md
deleted file mode 100644
index 4d1cd2a638..0000000000
--- a/components/engine/docs/reference/commandline/cli.md
+++ /dev/null
@@ -1,317 +0,0 @@
----
-title: "Use the Docker command line"
-description: "Docker's CLI command description and usage"
-keywords: "Docker, Docker documentation, CLI, command line"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# docker
-
-To list available commands, either run `docker` with no parameters
-or execute `docker help`:
-
-```bash
-$ docker
-Usage: docker [OPTIONS] COMMAND [ARG...]
-       docker [ --help | -v | --version ]
-
-A self-sufficient runtime for containers.
-
-Options:
-      --config string      Location of client config files (default "/root/.docker")
-  -D, --debug              Enable debug mode
-      --help               Print usage
-  -H, --host value         Daemon socket(s) to connect to (default [])
-  -l, --log-level string   Set the logging level ("debug"|"info"|"warn"|"error"|"fatal") (default "info")
-      --tls                Use TLS; implied by --tlsverify
-      --tlscacert string   Trust certs signed only by this CA (default "/root/.docker/ca.pem")
-      --tlscert string     Path to TLS certificate file (default "/root/.docker/cert.pem")
-      --tlskey string      Path to TLS key file (default "/root/.docker/key.pem")
-      --tlsverify          Use TLS and verify the remote
-  -v, --version            Print version information and quit
-
-Commands:
-    attach    Attach to a running container
-    # […]
-```
-
-## Description
-
-Depending on your Docker system configuration, you may be required to preface
-each `docker` command with `sudo`. To avoid having to use `sudo` with the
-`docker` command, your system administrator can create a Unix group called
-`docker` and add users to it.
-
-For more information about installing Docker or `sudo` configuration, refer to
-the [installation](https://docs.docker.com/engine/installation/) instructions for your operating system.
-
-### Environment variables
-
-For easy reference, the following list of environment variables are supported
-by the `docker` command line:
-
-* `DOCKER_API_VERSION` The API version to use (e.g. `1.19`)
-* `DOCKER_CONFIG` The location of your client configuration files.
-* `DOCKER_CERT_PATH` The location of your authentication keys.
-* `DOCKER_DRIVER` The graph driver to use.
-* `DOCKER_HOST` Daemon socket to connect to.
-* `DOCKER_NOWARN_KERNEL_VERSION` Prevent warnings that your Linux kernel is
-  unsuitable for Docker.
-* `DOCKER_RAMDISK` If set this will disable 'pivot_root'.
-* `DOCKER_TLS_VERIFY` When set Docker uses TLS and verifies the remote.
-* `DOCKER_CONTENT_TRUST` When set Docker uses notary to sign and verify images.
-  Equates to `--disable-content-trust=false` for build, create, pull, push, run.
-* `DOCKER_CONTENT_TRUST_SERVER` The URL of the Notary server to use. This defaults
-  to the same URL as the registry.
-* `DOCKER_HIDE_LEGACY_COMMANDS` When set, Docker hides "legacy" top-level commands (such as `docker rm`, and
-  `docker pull`) in `docker help` output, and only `Management commands` per object-type (e.g., `docker container`) are
-  printed. This may become the default in a future release, at which point this environment-variable is removed.
-* `DOCKER_TMPDIR` Location for temporary Docker files.
-
-Because Docker is developed using Go, you can also use any environment
-variables used by the Go runtime. In particular, you may find these useful:
-
-* `HTTP_PROXY`
-* `HTTPS_PROXY`
-* `NO_PROXY`
-
-These Go environment variables are case-insensitive. See the
-[Go specification](http://golang.org/pkg/net/http/) for details on these
-variables.
-
-### Configuration files
-
-By default, the Docker command line stores its configuration files in a
-directory called `.docker` within your `$HOME` directory. However, you can
-specify a different location via the `DOCKER_CONFIG` environment variable
-or the `--config` command line option. If both are specified, then the
-`--config` option overrides the `DOCKER_CONFIG` environment variable.
-For example:
-
-    docker --config ~/testconfigs/ ps
-
-Instructs Docker to use the configuration files in your `~/testconfigs/`
-directory when running the `ps` command.
-
-Docker manages most of the files in the configuration directory
-and you should not modify them. However, you *can modify* the
-`config.json` file to control certain aspects of how the `docker`
-command behaves.
-
-Currently, you can modify the `docker` command behavior using environment
-variables or command-line options. You can also use options within
-`config.json` to modify some of the same behavior. When using these
-mechanisms, you must keep in mind the order of precedence among them. Command
-line options override environment variables and environment variables override
-properties you specify in a `config.json` file.
-
-The `config.json` file stores a JSON encoding of several properties:
-
-The property `HttpHeaders` specifies a set of headers to include in all messages
-sent from the Docker client to the daemon. Docker does not try to interpret or
-understand these header; it simply puts them into the messages. Docker does
-not allow these headers to change any headers it sets for itself.
-
-The property `psFormat` specifies the default format for `docker ps` output.
-When the `--format` flag is not provided with the `docker ps` command,
-Docker's client uses this property. If this property is not set, the client
-falls back to the default table format. For a list of supported formatting
-directives, see the
-[**Formatting** section in the `docker ps` documentation](ps.md)
-
-The property `imagesFormat` specifies the default format for `docker images` output.
-When the `--format` flag is not provided with the `docker images` command,
-Docker's client uses this property. If this property is not set, the client
-falls back to the default table format. For a list of supported formatting
-directives, see the [**Formatting** section in the `docker images` documentation](images.md)
-
-The property `pluginsFormat` specifies the default format for `docker plugin ls` output.
-When the `--format` flag is not provided with the `docker plugin ls` command,
-Docker's client uses this property. If this property is not set, the client
-falls back to the default table format. For a list of supported formatting
-directives, see the [**Formatting** section in the `docker plugin ls` documentation](plugin_ls.md)
-
-The property `servicesFormat` specifies the default format for `docker
-service ls` output. When the `--format` flag is not provided with the
-`docker service ls` command, Docker's client uses this property. If this
-property is not set, the client falls back to the default json format. For a
-list of supported formatting directives, see the
-[**Formatting** section in the `docker service ls` documentation](service_ls.md)
-
-The property `serviceInspectFormat` specifies the default format for `docker
-service inspect` output. When the `--format` flag is not provided with the
-`docker service inspect` command, Docker's client uses this property. If this
-property is not set, the client falls back to the default json format. For a
-list of supported formatting directives, see the
-[**Formatting** section in the `docker service inspect` documentation](service_inspect.md)
-
-The property `statsFormat` specifies the default format for `docker
-stats` output. When the `--format` flag is not provided with the
-`docker stats` command, Docker's client uses this property. If this
-property is not set, the client falls back to the default table
-format. For a list of supported formatting directives, see
-[**Formatting** section in the `docker stats` documentation](stats.md)
-
-The property `secretFormat` specifies the default format for `docker
-secret ls` output. When the `--format` flag is not provided with the
-`docker secret ls` command, Docker's client uses this property. If this
-property is not set, the client falls back to the default table
-format. For a list of supported formatting directives, see
-[**Formatting** section in the `docker secret ls` documentation](secret_ls.md)
-
-
-The property `nodesFormat` specifies the default format for `docker node ls` output.
-When the `--format` flag is not provided with the `docker node ls` command,
-Docker's client uses the value of `nodesFormat`. If the value of `nodesFormat` is not set,
-the client uses the default table format. For a list of supported formatting
-directives, see the [**Formatting** section in the `docker node ls` documentation](node_ls.md)
-
-The property `configFormat` specifies the default format for `docker
-config ls` output. When the `--format` flag is not provided with the
-`docker config ls` command, Docker's client uses this property. If this
-property is not set, the client falls back to the default table
-format. For a list of supported formatting directives, see
-[**Formatting** section in the `docker config ls` documentation](config_ls.md)
-
-The property `credsStore` specifies an external binary to serve as the default
-credential store. When this property is set, `docker login` will attempt to
-store credentials in the binary specified by `docker-credential-<value>` which
-is visible on `$PATH`. If this property is not set, credentials will be stored
-in the `auths` property of the config. For more information, see the
-[**Credentials store** section in the `docker login` documentation](login.md#credentials-store)
-
-The property `credHelpers` specifies a set of credential helpers to use
-preferentially over `credsStore` or `auths` when storing and retrieving
-credentials for specific registries. If this property is set, the binary
-`docker-credential-<value>` will be used when storing or retrieving credentials
-for a specific registry. For more information, see the
-[**Credential helpers** section in the `docker login` documentation](login.md#credential-helpers)
-
-Once attached to a container, users detach from it and leave it running using
-the using `CTRL-p CTRL-q` key sequence. This detach key sequence is customizable
-using the `detachKeys` property. Specify a `<sequence>` value for the
-property. The format of the `<sequence>` is a comma-separated list of either
-a letter [a-Z], or the `ctrl-` combined with any of the following:
-
-* `a-z` (a single lowercase alpha character )
-* `@` (at sign)
-* `[` (left bracket)
-* `\\` (two backward slashes)
-*  `_` (underscore)
-* `^` (caret)
-
-Your customization applies to all containers started in with your Docker client.
-Users can override your custom or the default key sequence on a per-container
-basis. To do this, the user specifies the `--detach-keys` flag with the `docker
-attach`, `docker exec`, `docker run` or `docker start` command.
-
-Following is a sample `config.json` file:
-
-```json
-{
-  "HttpHeaders": {
-    "MyHeader": "MyValue"
-  },
-  "psFormat": "table {{.ID}}\\t{{.Image}}\\t{{.Command}}\\t{{.Labels}}",
-  "imagesFormat": "table {{.ID}}\\t{{.Repository}}\\t{{.Tag}}\\t{{.CreatedAt}}",
-  "pluginsFormat": "table {{.ID}}\t{{.Name}}\t{{.Enabled}}",
-  "statsFormat": "table {{.Container}}\t{{.CPUPerc}}\t{{.MemUsage}}",
-  "servicesFormat": "table {{.ID}}\t{{.Name}}\t{{.Mode}}",
-  "secretFormat": "table {{.ID}}\t{{.Name}}\t{{.CreatedAt}}\t{{.UpdatedAt}}",
-  "configFormat": "table {{.ID}}\t{{.Name}}\t{{.CreatedAt}}\t{{.UpdatedAt}}",
-  "serviceInspectFormat": "pretty",
-  "nodesFormat": "table {{.ID}}\t{{.Hostname}}\t{{.Availability}}",
-  "detachKeys": "ctrl-e,e",
-  "credsStore": "secretservice",
-  "credHelpers": {
-    "awesomereg.example.org": "hip-star",
-    "unicorn.example.com": "vcbait"
-  }
-}
-```
-
-### Notary
-
-If using your own notary server and a self-signed certificate or an internal
-Certificate Authority, you need to place the certificate at
-`tls/<registry_url>/ca.crt` in your docker config directory.
-
-Alternatively you can trust the certificate globally by adding it to your system's
-list of root Certificate Authorities.
-
-## Examples
-
-### Display help text
-
-To list the help on any command just execute the command, followed by the
-`--help` option.
-
-    $ docker run --help
-
-    Usage: docker run [OPTIONS] IMAGE [COMMAND] [ARG...]
-
-    Run a command in a new container
-
-    Options:
-          --add-host value             Add a custom host-to-IP mapping (host:ip) (default [])
-      -a, --attach value               Attach to STDIN, STDOUT or STDERR (default [])
-    ...
-
-### Option types
-
-Single character command line options can be combined, so rather than
-typing `docker run -i -t --name test busybox sh`,
-you can write `docker run -it --name test busybox sh`.
-
-#### Boolean
-
-Boolean options take the form `-d=false`. The value you see in the help text is
-the default value which is set if you do **not** specify that flag. If you
-specify a Boolean flag without a value, this will set the flag to `true`,
-irrespective of the default value.
-
-For example, running `docker run -d` will set the value to `true`, so your
-container **will** run in "detached" mode, in the background.
-
-Options which default to `true` (e.g., `docker build --rm=true`) can only be
-set to the non-default value by explicitly setting them to `false`:
-
-```bash
-$ docker build --rm=false .
-```
-
-#### Multi
-
-You can specify options like `-a=[]` multiple times in a single command line,
-for example in these commands:
-
-```bash
-$ docker run -a stdin -a stdout -i -t ubuntu /bin/bash
-
-$ docker run -a stdin -a stdout -a stderr ubuntu /bin/ls
-```
-
-Sometimes, multiple options can call for a more complex value string as for
-`-v`:
-
-```bash
-$ docker run -v /host:/container example/mysql
-```
-
-> **Note**: Do not use the `-t` and `-a stderr` options together due to
-> limitations in the `pty` implementation. All `stderr` in `pty` mode
-> simply goes to `stdout`.
-
-#### Strings and Integers
-
-Options like `--name=""` expect a string, and they
-can only be specified once. Options like `-c=0`
-expect an integer, and they can only be specified once.
diff --git a/components/engine/docs/reference/commandline/commit.md b/components/engine/docs/reference/commandline/commit.md
deleted file mode 100644
index f713eeab97..0000000000
--- a/components/engine/docs/reference/commandline/commit.md
+++ /dev/null
@@ -1,117 +0,0 @@
----
-title: "commit"
-description: "The commit command description and usage"
-keywords: "commit, file, changes"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# commit
-
-```markdown
-Usage:  docker commit [OPTIONS] CONTAINER [REPOSITORY[:TAG]]
-
-Create a new image from a container's changes
-
-Options:
-  -a, --author string    Author (e.g., "John Hannibal Smith <hannibal@a-team.com>")
-  -c, --change value     Apply Dockerfile instruction to the created image (default [])
-      --help             Print usage
-  -m, --message string   Commit message
-  -p, --pause            Pause container during commit (default true)
-```
-
-## Description
-
-It can be useful to commit a container's file changes or settings into a new
-image. This allows you to debug a container by running an interactive shell, or to
-export a working dataset to another server. Generally, it is better to use
-Dockerfiles to manage your images in a documented and maintainable way.
-[Read more about valid image names and tags](tag.md).
-
-The commit operation will not include any data contained in
-volumes mounted inside the container.
-
-By default, the container being committed and its processes will be paused
-while the image is committed. This reduces the likelihood of encountering data
-corruption during the process of creating the commit.  If this behavior is
-undesired, set the `--pause` option to false.
-
-The `--change` option will apply `Dockerfile` instructions to the image that is
-created.  Supported `Dockerfile` instructions:
-`CMD`|`ENTRYPOINT`|`ENV`|`EXPOSE`|`LABEL`|`ONBUILD`|`USER`|`VOLUME`|`WORKDIR`
-
-## Examples
-
-### Commit a container
-
-```bash
-$ docker ps
-
-CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS              NAMES
-c3f279d17e0a        ubuntu:12.04        /bin/bash           7 days ago          Up 25 hours                            desperate_dubinsky
-197387f1b436        ubuntu:12.04        /bin/bash           7 days ago          Up 25 hours                            focused_hamilton
-
-$ docker commit c3f279d17e0a  svendowideit/testimage:version3
-
-f5283438590d
-
-$ docker images
-
-REPOSITORY                        TAG                 ID                  CREATED             SIZE
-svendowideit/testimage            version3            f5283438590d        16 seconds ago      335.7 MB
-```
-
-### Commit a container with new configurations
-
-```bash
-$ docker ps
-
-CONTAINER ID       IMAGE               COMMAND             CREATED             STATUS              PORTS              NAMES
-c3f279d17e0a        ubuntu:12.04        /bin/bash           7 days ago          Up 25 hours                            desperate_dubinsky
-197387f1b436        ubuntu:12.04        /bin/bash           7 days ago          Up 25 hours                            focused_hamilton
-
-$ docker inspect -f "{{ .Config.Env }}" c3f279d17e0a
-
-[HOME=/ PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin]
-
-$ docker commit --change "ENV DEBUG true" c3f279d17e0a  svendowideit/testimage:version3
-
-f5283438590d
-
-$ docker inspect -f "{{ .Config.Env }}" f5283438590d
-
-[HOME=/ PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin DEBUG=true]
-```
-
-### Commit a container with new `CMD` and `EXPOSE` instructions
-
-```bash
-$ docker ps
-
-CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS              NAMES
-c3f279d17e0a        ubuntu:12.04        /bin/bash           7 days ago          Up 25 hours                            desperate_dubinsky
-197387f1b436        ubuntu:12.04        /bin/bash           7 days ago          Up 25 hours                            focused_hamilton
-
-$ docker commit --change='CMD ["apachectl", "-DFOREGROUND"]' -c "EXPOSE 80" c3f279d17e0a  svendowideit/testimage:version4
-
-f5283438590d
-
-$ docker run -d svendowideit/testimage:version4
-
-89373736e2e7f00bc149bd783073ac43d0507da250e999f3f1036e0db60817c0
-
-$ docker ps
-
-CONTAINER ID        IMAGE               COMMAND                 CREATED             STATUS              PORTS              NAMES
-89373736e2e7        testimage:version4  "apachectl -DFOREGROU"  3 seconds ago       Up 2 seconds        80/tcp             distracted_fermat
-c3f279d17e0a        ubuntu:12.04        /bin/bash               7 days ago          Up 25 hours                            desperate_dubinsky
-197387f1b436        ubuntu:12.04        /bin/bash               7 days ago          Up 25 hours                            focused_hamilton
-```
diff --git a/components/engine/docs/reference/commandline/container.md b/components/engine/docs/reference/commandline/container.md
deleted file mode 100644
index 5eefbf2c3e..0000000000
--- a/components/engine/docs/reference/commandline/container.md
+++ /dev/null
@@ -1,61 +0,0 @@
-
----
-title: "container"
-description: "The container command description and usage"
-keywords: "container"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# container
-
-```markdown
-Usage:  docker container COMMAND
-
-Manage containers
-
-Options:
-      --help   Print usage
-
-Commands:
-  attach      Attach to a running container
-  commit      Create a new image from a container's changes
-  cp          Copy files/folders between a container and the local filesystem
-  create      Create a new container
-  diff        Inspect changes to files or directories on a container's filesystem
-  exec        Run a command in a running container
-  export      Export a container's filesystem as a tar archive
-  inspect     Display detailed information on one or more containers
-  kill        Kill one or more running containers
-  logs        Fetch the logs of a container
-  ls          List containers
-  pause       Pause all processes within one or more containers
-  port        List port mappings or a specific mapping for the container
-  prune       Remove all stopped containers
-  rename      Rename a container
-  restart     Restart one or more containers
-  rm          Remove one or more containers
-  run         Run a command in a new container
-  start       Start one or more stopped containers
-  stats       Display a live stream of container(s) resource usage statistics
-  stop        Stop one or more running containers
-  top         Display the running processes of a container
-  unpause     Unpause all processes within one or more containers
-  update      Update configuration of one or more containers
-  wait        Block until one or more containers stop, then print their exit codes
-
-Run 'docker container COMMAND --help' for more information on a command.
-
-```
-
-## Description
-
-Manage containers.
-
diff --git a/components/engine/docs/reference/commandline/container_prune.md b/components/engine/docs/reference/commandline/container_prune.md
deleted file mode 100644
index 72488901ed..0000000000
--- a/components/engine/docs/reference/commandline/container_prune.md
+++ /dev/null
@@ -1,126 +0,0 @@
----
-title: "container prune"
-description: "Remove all stopped containers"
-keywords: container, prune, delete, remove
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# container prune
-
-```markdown
-Usage:	docker container prune [OPTIONS]
-
-Remove all stopped containers
-
-Options:
-Options:
-      --filter filter   Provide filter values (e.g. 'until=<timestamp>')
-  -f, --force           Do not prompt for confirmation
-      --help            Print usage
-```
-
-## Description
-
-Removes all stopped containers.
-
-## Examples
-
-### Prune containers
-
-```bash
-$ docker container prune
-WARNING! This will remove all stopped containers.
-Are you sure you want to continue? [y/N] y
-Deleted Containers:
-4a7f7eebae0f63178aff7eb0aa39cd3f0627a203ab2df258c1a00b456cf20063
-f98f9c2aa1eaf727e4ec9c0283bc7d4aa4762fbdba7f26191f26c97f64090360
-
-Total reclaimed space: 212 B
-```
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is of "key=value". If there is more
-than one filter, then pass multiple flags (e.g., `--filter "foo=bar" --filter "bif=baz"`)
-
-The currently supported filters are:
-
-* until (`<timestamp>`) - only remove containers created before given timestamp
-* label (`label=<key>`, `label=<key>=<value>`, `label!=<key>`, or `label!=<key>=<value>`) - only remove containers with (or without, in case `label!=...` is used) the specified labels.
-
-The `until` filter can be Unix timestamps, date formatted
-timestamps, or Go duration strings (e.g. `10m`, `1h30m`) computed
-relative to the daemon machine’s time. Supported formats for date
-formatted time stamps include RFC3339Nano, RFC3339, `2006-01-02T15:04:05`,
-`2006-01-02T15:04:05.999999999`, `2006-01-02Z07:00`, and `2006-01-02`. The local
-timezone on the daemon will be used if you do not provide either a `Z` or a
-`+-00:00` timezone offset at the end of the timestamp.  When providing Unix
-timestamps enter seconds[.nanoseconds], where seconds is the number of seconds
-that have elapsed since January 1, 1970 (midnight UTC/GMT), not counting leap
-seconds (aka Unix epoch or Unix time), and the optional .nanoseconds field is a
-fraction of a second no more than nine digits long.
-
-The `label` filter accepts two formats. One is the `label=...` (`label=<key>` or `label=<key>=<value>`),
-which removes containers with the specified labels. The other
-format is the `label!=...` (`label!=<key>` or `label!=<key>=<value>`), which removes
-containers without the specified labels.
-
-The following removes containers created more than 5 minutes ago:
-
-```bash
-$ docker ps -a --format 'table {{.ID}}\t{{.Image}}\t{{.Command}}\t{{.CreatedAt}}\t{{.Status}}'
-
-CONTAINER ID        IMAGE               COMMAND             CREATED AT                      STATUS
-61b9efa71024        busybox             "sh"                2017-01-04 13:23:33 -0800 PST   Exited (0) 41 seconds ago
-53a9bc23a516        busybox             "sh"                2017-01-04 13:11:59 -0800 PST   Exited (0) 12 minutes ago
-
-$ docker container prune --force --filter "until=5m"
-
-Deleted Containers:
-53a9bc23a5168b6caa2bfbefddf1b30f93c7ad57f3dec271fd32707497cb9369
-
-Total reclaimed space: 25 B
-
-$ docker ps -a --format 'table {{.ID}}\t{{.Image}}\t{{.Command}}\t{{.CreatedAt}}\t{{.Status}}'
-
-CONTAINER ID        IMAGE               COMMAND             CREATED AT                      STATUS
-61b9efa71024        busybox             "sh"                2017-01-04 13:23:33 -0800 PST   Exited (0) 44 seconds ago
-```
-
-The following removes containers created before `2017-01-04T13:10:00`:
-
-```bash
-$ docker ps -a --format 'table {{.ID}}\t{{.Image}}\t{{.Command}}\t{{.CreatedAt}}\t{{.Status}}'
-
-CONTAINER ID        IMAGE               COMMAND             CREATED AT                      STATUS
-53a9bc23a516        busybox             "sh"                2017-01-04 13:11:59 -0800 PST   Exited (0) 7 minutes ago
-4a75091a6d61        busybox             "sh"                2017-01-04 13:09:53 -0800 PST   Exited (0) 9 minutes ago
-
-$ docker container prune --force --filter "until=2017-01-04T13:10:00"
-
-Deleted Containers:
-4a75091a6d618526fcd8b33ccd6e5928ca2a64415466f768a6180004b0c72c6c
-
-Total reclaimed space: 27 B
-
-$ docker ps -a --format 'table {{.ID}}\t{{.Image}}\t{{.Command}}\t{{.CreatedAt}}\t{{.Status}}'
-
-CONTAINER ID        IMAGE               COMMAND             CREATED AT                      STATUS
-53a9bc23a516        busybox             "sh"                2017-01-04 13:11:59 -0800 PST   Exited (0) 9 minutes ago
-```
-
-## Related commands
-
-* [system df](system_df.md)
-* [volume prune](volume_prune.md)
-* [image prune](image_prune.md)
-* [network prune](network_prune.md)
-* [system prune](system_prune.md)
diff --git a/components/engine/docs/reference/commandline/cp.md b/components/engine/docs/reference/commandline/cp.md
deleted file mode 100644
index 5cbbee25ae..0000000000
--- a/components/engine/docs/reference/commandline/cp.md
+++ /dev/null
@@ -1,115 +0,0 @@
----
-title: "cp"
-description: "The cp command description and usage"
-keywords: "copy, container, files, folders"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# cp
-
-```markdown
-Usage:  docker cp [OPTIONS] CONTAINER:SRC_PATH DEST_PATH|-
-        docker cp [OPTIONS] SRC_PATH|- CONTAINER:DEST_PATH
-
-Copy files/folders between a container and the local filesystem
-
-Use '-' as the source to read a tar archive from stdin
-and extract it to a directory destination in a container.
-Use '-' as the destination to stream a tar archive of a
-container source to stdout.
-
-Options:
-  -L, --follow-link   Always follow symbol link in SRC_PATH
-      --help          Print usage
-```
-
-## Description
-
-The `docker cp` utility copies the contents of `SRC_PATH` to the `DEST_PATH`.
-You can copy from the container's file system to the local machine or the
-reverse, from the local filesystem to the container. If `-` is specified for
-either the `SRC_PATH` or `DEST_PATH`, you can also stream a tar archive from
-`STDIN` or to `STDOUT`. The `CONTAINER` can be a running or stopped container.
-The `SRC_PATH` or `DEST_PATH` can be a file or directory.
-
-The `docker cp` command assumes container paths are relative to the container's
-`/` (root) directory. This means supplying the initial forward slash is optional;
-The command sees `compassionate_darwin:/tmp/foo/myfile.txt` and
-`compassionate_darwin:tmp/foo/myfile.txt` as identical. Local machine paths can
-be an absolute or relative value. The command interprets a local machine's
-relative paths as relative to the current working directory where `docker cp` is
-run.
-
-The `cp` command behaves like the Unix `cp -a` command in that directories are
-copied recursively with permissions preserved if possible. Ownership is set to
-the user and primary group at the destination. For example, files copied to a
-container are created with `UID:GID` of the root user. Files copied to the local
-machine are created with the `UID:GID` of the user which invoked the `docker cp`
-command.  If you specify the `-L` option, `docker cp` follows any symbolic link
-in the `SRC_PATH`.  `docker cp` does *not* create parent directories for
-`DEST_PATH` if they do not exist.
-
-Assuming a path separator of `/`, a first argument of `SRC_PATH` and second
-argument of `DEST_PATH`, the behavior is as follows:
-
-- `SRC_PATH` specifies a file
-    - `DEST_PATH` does not exist
-        - the file is saved to a file created at `DEST_PATH`
-    - `DEST_PATH` does not exist and ends with `/`
-        - Error condition: the destination directory must exist.
-    - `DEST_PATH` exists and is a file
-        - the destination is overwritten with the source file's contents
-    - `DEST_PATH` exists and is a directory
-        - the file is copied into this directory using the basename from
-          `SRC_PATH`
-- `SRC_PATH` specifies a directory
-    - `DEST_PATH` does not exist
-        - `DEST_PATH` is created as a directory and the *contents* of the source
-           directory are copied into this directory
-    - `DEST_PATH` exists and is a file
-        - Error condition: cannot copy a directory to a file
-    - `DEST_PATH` exists and is a directory
-        - `SRC_PATH` does not end with `/.` (that is: _slash_ followed by _dot_)
-            - the source directory is copied into this directory
-        - `SRC_PATH` does end with `/.` (that is: _slash_ followed by _dot_)
-            - the *content* of the source directory is copied into this
-              directory
-
-The command requires `SRC_PATH` and `DEST_PATH` to exist according to the above
-rules. If `SRC_PATH` is local and is a symbolic link, the symbolic link, not
-the target, is copied by default. To copy the link target and not the link, specify
-the `-L` option.
-
-A colon (`:`) is used as a delimiter between `CONTAINER` and its path. You can
-also use `:` when specifying paths to a `SRC_PATH` or `DEST_PATH` on a local
-machine, for example  `file:name.txt`. If you use a `:` in a local machine path,
-you must be explicit with a relative or absolute path, for example:
-
-    `/path/to/file:name.txt` or `./file:name.txt`
-
-It is not possible to copy certain system files such as resources under
-`/proc`, `/sys`, `/dev`, [tmpfs](run.md#mount-tmpfs-tmpfs), and mounts created by
-the user in the container. However, you can still copy such files by manually
-running `tar` in `docker exec`. Both of the following examples do the same thing
-in different ways (consider `SRC_PATH` and `DEST_PATH` are directories):
-
-```bash
-$ docker exec foo tar Ccf $(dirname SRC_PATH) - $(basename SRC_PATH) | tar Cxf DEST_PATH -
-```
-
-```bash
-$ tar Ccf $(dirname SRC_PATH) - $(basename SRC_PATH) | docker exec -i foo tar Cxf DEST_PATH -
-```
-
-Using `-` as the `SRC_PATH` streams the contents of `STDIN` as a tar archive.
-The command extracts the content of the tar to the `DEST_PATH` in container's
-filesystem. In this case, `DEST_PATH` must specify a directory. Using `-` as
-the `DEST_PATH` streams the contents of the resource as a tar archive to `STDOUT`.
diff --git a/components/engine/docs/reference/commandline/create.md b/components/engine/docs/reference/commandline/create.md
deleted file mode 100644
index 8a57f2ffe9..0000000000
--- a/components/engine/docs/reference/commandline/create.md
+++ /dev/null
@@ -1,260 +0,0 @@
----
-title: "create"
-description: "The create command description and usage"
-keywords: "docker, create, container"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# create
-
-Creates a new container.
-
-```markdown
-Usage:  docker create [OPTIONS] IMAGE [COMMAND] [ARG...]
-
-Create a new container
-
-Options:
-      --add-host value                Add a custom host-to-IP mapping (host:ip) (default [])
-  -a, --attach value                  Attach to STDIN, STDOUT or STDERR (default [])
-      --blkio-weight value            Block IO (relative weight), between 10 and 1000
-      --blkio-weight-device value     Block IO weight (relative device weight) (default [])
-      --cap-add value                 Add Linux capabilities (default [])
-      --cap-drop value                Drop Linux capabilities (default [])
-      --cgroup-parent string          Optional parent cgroup for the container
-      --cidfile string                Write the container ID to the file
-      --cpu-count int                 The number of CPUs available for execution by the container.
-                                      Windows daemon only. On Windows Server containers, this is
-                                      approximated as a percentage of total CPU usage.
-      --cpu-percent int               CPU percent (Windows only)
-      --cpu-period int                Limit CPU CFS (Completely Fair Scheduler) period
-      --cpu-quota int                 Limit CPU CFS (Completely Fair Scheduler) quota
-  -c, --cpu-shares int                CPU shares (relative weight)
-      --cpus NanoCPUs                 Number of CPUs (default 0.000)
-      --cpu-rt-period int             Limit the CPU real-time period in microseconds
-      --cpu-rt-runtime int            Limit the CPU real-time runtime in microseconds
-      --cpuset-cpus string            CPUs in which to allow execution (0-3, 0,1)
-      --cpuset-mems string            MEMs in which to allow execution (0-3, 0,1)
-      --device value                  Add a host device to the container (default [])
-      --device-cgroup-rule value      Add a rule to the cgroup allowed devices list
-      --device-read-bps value         Limit read rate (bytes per second) from a device (default [])
-      --device-read-iops value        Limit read rate (IO per second) from a device (default [])
-      --device-write-bps value        Limit write rate (bytes per second) to a device (default [])
-      --device-write-iops value       Limit write rate (IO per second) to a device (default [])
-      --disable-content-trust         Skip image verification (default true)
-      --dns value                     Set custom DNS servers (default [])
-      --dns-option value              Set DNS options (default [])
-      --dns-search value              Set custom DNS search domains (default [])
-      --entrypoint string             Overwrite the default ENTRYPOINT of the image
-  -e, --env value                     Set environment variables (default [])
-      --env-file value                Read in a file of environment variables (default [])
-      --expose value                  Expose a port or a range of ports (default [])
-      --group-add value               Add additional groups to join (default [])
-      --health-cmd string             Command to run to check health
-      --health-interval duration      Time between running the check (ns|us|ms|s|m|h) (default 0s)
-      --health-retries int            Consecutive failures needed to report unhealthy
-      --health-timeout duration       Maximum time to allow one check to run (ns|us|ms|s|m|h) (default 0s)
-      --health-start-period duration  Start period for the container to initialize before counting retries towards unstable (ns|us|ms|s|m|h) (default 0s)
-      --help                          Print usage
-  -h, --hostname string               Container host name
-      --init                          Run an init inside the container that forwards signals and reaps processes
-  -i, --interactive                   Keep STDIN open even if not attached
-      --io-maxbandwidth string        Maximum IO bandwidth limit for the system drive (Windows only)
-      --io-maxiops uint               Maximum IOps limit for the system drive (Windows only)
-      --ip string                     IPv4 address (e.g., 172.30.100.104)
-      --ip6 string                    IPv6 address (e.g., 2001:db8::33)
-      --ipc string                    IPC namespace to use
-      --isolation string              Container isolation technology
-      --kernel-memory string          Kernel memory limit
-  -l, --label value                   Set meta data on a container (default [])
-      --label-file value              Read in a line delimited file of labels (default [])
-      --link value                    Add link to another container (default [])
-      --link-local-ip value           Container IPv4/IPv6 link-local addresses (default [])
-      --log-driver string             Logging driver for the container
-      --log-opt value                 Log driver options (default [])
-      --mac-address string            Container MAC address (e.g., 92:d0:c6:0a:29:33)
-  -m, --memory string                 Memory limit
-      --memory-reservation string     Memory soft limit
-      --memory-swap string            Swap limit equal to memory plus swap: '-1' to enable unlimited swap
-      --memory-swappiness int         Tune container memory swappiness (0 to 100) (default -1)
-      --mount value                   Attach a filesytem mount to the container (default [])
-      --name string                   Assign a name to the container
-      --network-alias value           Add network-scoped alias for the container (default [])
-      --network string                Connect a container to a network (default "default")
-                                      'bridge': create a network stack on the default Docker bridge
-                                      'none': no networking
-                                      'container:<name|id>': reuse another container's network stack
-                                      'host': use the Docker host network stack
-                                      '<network-name>|<network-id>': connect to a user-defined network
-      --no-healthcheck                Disable any container-specified HEALTHCHECK
-      --oom-kill-disable              Disable OOM Killer
-      --oom-score-adj int             Tune host's OOM preferences (-1000 to 1000)
-      --pid string                    PID namespace to use
-      --pids-limit int                Tune container pids limit (set -1 for unlimited), kernel >= 4.3
-      --privileged                    Give extended privileges to this container
-  -p, --publish value                 Publish a container's port(s) to the host (default [])
-  -P, --publish-all                   Publish all exposed ports to random ports
-      --read-only                     Mount the container's root filesystem as read only
-      --restart string                Restart policy to apply when a container exits (default "no")
-                                      Possible values are: no, on-failure[:max-retry], always, unless-stopped
-      --rm                            Automatically remove the container when it exits
-      --runtime string                Runtime to use for this container
-      --security-opt value            Security Options (default [])
-      --shm-size bytes                Size of /dev/shm
-                                      The format is `<number><unit>`. `number` must be greater than `0`.
-                                      Unit is optional and can be `b` (bytes), `k` (kilobytes), `m` (megabytes),
-                                      or `g` (gigabytes). If you omit the unit, the system uses bytes.
-      --stop-signal string            Signal to stop a container (default "SIGTERM")
-      --stop-timeout=10               Timeout (in seconds) to stop a container
-      --storage-opt value             Storage driver options for the container (default [])
-      --sysctl value                  Sysctl options (default map[])
-      --tmpfs value                   Mount a tmpfs directory (default [])
-  -t, --tty                           Allocate a pseudo-TTY
-      --ulimit value                  Ulimit options (default [])
-  -u, --user string                   Username or UID (format: <name|uid>[:<group|gid>])
-      --userns string                 User namespace to use
-                                      'host': Use the Docker host user namespace
-                                      '': Use the Docker daemon user namespace specified by `--userns-remap` option.
-      --uts string                    UTS namespace to use
-  -v, --volume value                  Bind mount a volume (default []). The format
-                                      is `[host-src:]container-dest[:<options>]`.
-                                      The comma-delimited `options` are [rw|ro],
-                                      [z|Z], [[r]shared|[r]slave|[r]private],
-                                      [delegated|cached|consistent], and
-                                      [nocopy]. The 'host-src' is an absolute path
-                                      or a name value.
-      --volume-driver string          Optional volume driver for the container
-      --volumes-from value            Mount volumes from the specified container(s) (default [])
-  -w, --workdir string                Working directory inside the container
-```
-## Description
-
-The `docker create` command creates a writeable container layer over the
-specified image and prepares it for running the specified command.  The
-container ID is then printed to `STDOUT`.  This is similar to `docker run -d`
-except the container is never started.  You can then use the
-`docker start <container_id>` command to start the container at any point.
-
-This is useful when you want to set up a container configuration ahead of time
-so that it is ready to start when you need it. The initial status of the
-new container is `created`.
-
-Please see the [run command](run.md) section and the [Docker run reference](../run.md) for more details.
-
-## Examples
-
-### Create and start a container
-
-```bash
-$ docker create -t -i fedora bash
-
-6d8af538ec541dd581ebc2a24153a28329acb5268abe5ef868c1f1a261221752
-
-$ docker start -a -i 6d8af538ec5
-
-bash-4.2#
-```
-
-### Initialize volumes
-
-As of v1.4.0 container volumes are initialized during the `docker create` phase
-(i.e., `docker run` too). For example, this allows you to `create` the `data`
-volume container, and then use it from another container:
-
-```bash
-$ docker create -v /data --name data ubuntu
-
-240633dfbb98128fa77473d3d9018f6123b99c454b3251427ae190a7d951ad57
-
-$ docker run --rm --volumes-from data ubuntu ls -la /data
-
-total 8
-drwxr-xr-x  2 root root 4096 Dec  5 04:10 .
-drwxr-xr-x 48 root root 4096 Dec  5 04:11 ..
-```
-
-Similarly, `create` a host directory bind mounted volume container, which can
-then be used from the subsequent container:
-
-```bash
-$ docker create -v /home/docker:/docker --name docker ubuntu
-
-9aa88c08f319cd1e4515c3c46b0de7cc9aa75e878357b1e96f91e2c773029f03
-
-$ docker run --rm --volumes-from docker ubuntu ls -la /docker
-
-total 20
-drwxr-sr-x  5 1000 staff  180 Dec  5 04:00 .
-drwxr-xr-x 48 root root  4096 Dec  5 04:13 ..
--rw-rw-r--  1 1000 staff 3833 Dec  5 04:01 .ash_history
--rw-r--r--  1 1000 staff  446 Nov 28 11:51 .ashrc
--rw-r--r--  1 1000 staff   25 Dec  5 04:00 .gitconfig
-drwxr-sr-x  3 1000 staff   60 Dec  1 03:28 .local
--rw-r--r--  1 1000 staff  920 Nov 28 11:51 .profile
-drwx--S---  2 1000 staff  460 Dec  5 00:51 .ssh
-drwxr-xr-x 32 1000 staff 1140 Dec  5 04:01 docker
-```
-
-
-Set storage driver options per container.
-
-```bash
-$ docker create -it --storage-opt size=120G fedora /bin/bash
-```
-
-This (size) will allow to set the container rootfs size to 120G at creation time.
-This option is only available for the `devicemapper`, `btrfs`, `overlay2`,
-`windowsfilter` and `zfs` graph drivers.
-For the `devicemapper`, `btrfs`, `windowsfilter` and `zfs` graph drivers,
-user cannot pass a size less than the Default BaseFS Size.
-For the `overlay2` storage driver, the size option is only available if the
-backing fs is `xfs` and mounted with the `pquota` mount option.
-Under these conditions, user can pass any size less then the backing fs size.
-
-### Specify isolation technology for container (--isolation)
-
-This option is useful in situations where you are running Docker containers on
-Windows. The `--isolation=<value>` option sets a container's isolation
-technology. On Linux, the only supported is the `default` option which uses
-Linux namespaces. On Microsoft Windows, you can specify these values:
-
-
-| Value     | Description                                                                                                                                                   |
-|-----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `default` | Use the value specified by the Docker daemon's `--exec-opt` . If the `daemon` does not specify an isolation technology, Microsoft Windows uses `process` as its default value if the
-daemon is running on Windows server, or `hyperv` if running on Windows client.  |
-| `process` | Namespace isolation only.                                                                                                                                     |
-| `hyperv`   | Hyper-V hypervisor partition-based isolation.                                                                                                                  |
-
-Specifying the `--isolation` flag without a value is the same as setting `--isolation="default"`.
-
-### Dealing with dynamically created devices (--device-cgroup-rule)
-
-Devices available to a container are assigned at creation time. The
-assigned devices will both be added to the cgroup.allow file and
-created into the container once it is run. This poses a problem when
-a new device needs to be added to running container.
-
-One of the solution is to add a more permissive rule to a container
-allowing it access to a wider range of devices. For example, supposing
-our container needs access to a character device with major `42` and
-any number of minor number (added as new devices appear), the
-following rule would be added:
-
-```
-docker create --device-cgroup-rule='c 42:* rmw' -name my-container my-image
-```
-
-Then, a user could ask `udev` to execute a script that would `docker exec my-container mknod newDevX c 42 <minor>`
-the required device when it is added.
-
-NOTE: initially present devices still need to be explicitely added to
-the create/run command
diff --git a/components/engine/docs/reference/commandline/deploy.md b/components/engine/docs/reference/commandline/deploy.md
deleted file mode 100644
index a86b2b4b45..0000000000
--- a/components/engine/docs/reference/commandline/deploy.md
+++ /dev/null
@@ -1,112 +0,0 @@
----
-title: "deploy"
-description: "The deploy command description and usage"
-keywords: "stack, deploy"
-advisory: "experimental"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# deploy (experimental)
-
-An alias for `stack deploy`.
-
-```markdown
-Usage:  docker deploy [OPTIONS] STACK
-
-Deploy a new stack or update an existing stack
-
-Aliases:
-  deploy, up
-
-Options:
-      --bundle-file string    Path to a Distributed Application Bundle file
-      --compose-file string   Path to a Compose file
-      --help                  Print usage
-      --prune                 Prune services that are no longer referenced
-      --with-registry-auth    Send registry authentication details to Swarm agents
-```
-
-## Description
-
-Create and update a stack from a `compose` or a `dab` file on the swarm. This command
-has to be run targeting a manager node.
-
-## Examples
-
-### Compose file
-
-The `deploy` command supports compose file version `3.0` and above.
-
-```bash
-$ docker stack deploy --compose-file docker-compose.yml vossibility
-
-Ignoring unsupported options: links
-
-Creating network vossibility_vossibility
-Creating network vossibility_default
-Creating service vossibility_nsqd
-Creating service vossibility_logstash
-Creating service vossibility_elasticsearch
-Creating service vossibility_kibana
-Creating service vossibility_ghollector
-Creating service vossibility_lookupd
-```
-
-You can verify that the services were correctly created
-
-```bash
-$ docker service ls
-
-ID            NAME                               MODE        REPLICAS  IMAGE
-29bv0vnlm903  vossibility_lookupd                replicated  1/1       nsqio/nsq@sha256:eeba05599f31eba418e96e71e0984c3dc96963ceb66924dd37a47bf7ce18a662
-4awt47624qwh  vossibility_nsqd                   replicated  1/1       nsqio/nsq@sha256:eeba05599f31eba418e96e71e0984c3dc96963ceb66924dd37a47bf7ce18a662
-4tjx9biia6fs  vossibility_elasticsearch          replicated  1/1       elasticsearch@sha256:12ac7c6af55d001f71800b83ba91a04f716e58d82e748fa6e5a7359eed2301aa
-7563uuzr9eys  vossibility_kibana                 replicated  1/1       kibana@sha256:6995a2d25709a62694a937b8a529ff36da92ebee74bafd7bf00e6caf6db2eb03
-9gc5m4met4he  vossibility_logstash               replicated  1/1       logstash@sha256:2dc8bddd1bb4a5a34e8ebaf73749f6413c101b2edef6617f2f7713926d2141fe
-axqh55ipl40h  vossibility_vossibility-collector  replicated  1/1       icecrime/vossibility-collector@sha256:f03f2977203ba6253988c18d04061c5ec7aab46bca9dfd89a9a1fa4500989fba
-```
-
-### DAB file
-
-```bash
-$ docker stack deploy --bundle-file vossibility-stack.dab vossibility
-
-Loading bundle from vossibility-stack.dab
-Creating service vossibility_elasticsearch
-Creating service vossibility_kibana
-Creating service vossibility_logstash
-Creating service vossibility_lookupd
-Creating service vossibility_nsqd
-Creating service vossibility_vossibility-collector
-```
-
-You can verify that the services were correctly created:
-
-```bash
-$ docker service ls
-
-ID            NAME                               MODE        REPLICAS  IMAGE
-29bv0vnlm903  vossibility_lookupd                replicated  1/1       nsqio/nsq@sha256:eeba05599f31eba418e96e71e0984c3dc96963ceb66924dd37a47bf7ce18a662
-4awt47624qwh  vossibility_nsqd                   replicated  1/1       nsqio/nsq@sha256:eeba05599f31eba418e96e71e0984c3dc96963ceb66924dd37a47bf7ce18a662
-4tjx9biia6fs  vossibility_elasticsearch          replicated  1/1       elasticsearch@sha256:12ac7c6af55d001f71800b83ba91a04f716e58d82e748fa6e5a7359eed2301aa
-7563uuzr9eys  vossibility_kibana                 replicated  1/1       kibana@sha256:6995a2d25709a62694a937b8a529ff36da92ebee74bafd7bf00e6caf6db2eb03
-9gc5m4met4he  vossibility_logstash               replicated  1/1       logstash@sha256:2dc8bddd1bb4a5a34e8ebaf73749f6413c101b2edef6617f2f7713926d2141fe
-axqh55ipl40h  vossibility_vossibility-collector  replicated  1/1       icecrime/vossibility-collector@sha256:f03f2977203ba6253988c18d04061c5ec7aab46bca9dfd89a9a1fa4500989fba
-```
-
-## Related commands
-
-* [stack config](stack_config.md)
-* [stack deploy](stack_deploy.md)
-* [stack ls](stack_ls.md)
-* [stack ps](stack_ps.md)
-* [stack rm](stack_rm.md)
-* [stack services](stack_services.md)
diff --git a/components/engine/docs/reference/commandline/diff.md b/components/engine/docs/reference/commandline/diff.md
deleted file mode 100644
index e6e12cef80..0000000000
--- a/components/engine/docs/reference/commandline/diff.md
+++ /dev/null
@@ -1,67 +0,0 @@
----
-title: "diff"
-description: "The diff command description and usage"
-keywords: "list, changed, files, container"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# diff
-
-```markdown
-Usage:  docker diff CONTAINER
-
-Inspect changes to files or directories on a container's filesystem
-
-Options:
-      --help   Print usage
-```
-
-## Description
-
-List the changed files and directories in a container᾿s filesystem since the
-container was created. Three different types of change are tracked:
-
-| Symbol | Description                     |
-|--------|---------------------------------|
-| `A`    | A file or directory was added   |
-| `D`    | A file or directory was deleted |
-| `C`    | A file or directory was changed |
-
-You can use the full or shortened container ID or the container name set using
-`docker run --name` option.
-
-## Examples
-
-Inspect the changes to an `nginx` container:
-
-```bash
-$ docker diff 1fdfd1f54c1b
-
-C /dev
-C /dev/console
-C /dev/core
-C /dev/stdout
-C /dev/fd
-C /dev/ptmx
-C /dev/stderr
-C /dev/stdin
-C /run
-A /run/nginx.pid
-C /var/lib/nginx/tmp
-A /var/lib/nginx/tmp/client_body
-A /var/lib/nginx/tmp/fastcgi
-A /var/lib/nginx/tmp/proxy
-A /var/lib/nginx/tmp/scgi
-A /var/lib/nginx/tmp/uwsgi
-C /var/log/nginx
-A /var/log/nginx/access.log
-A /var/log/nginx/error.log
-```
diff --git a/components/engine/docs/reference/commandline/dockerd.md b/components/engine/docs/reference/commandline/dockerd.md
deleted file mode 100644
index 93774c841b..0000000000
--- a/components/engine/docs/reference/commandline/dockerd.md
+++ /dev/null
@@ -1,1469 +0,0 @@
----
-title: "dockerd"
-aliases: ["/engine/reference/commandline/daemon/"]
-description: "The daemon command description and usage"
-keywords: "container, daemon, runtime"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# daemon
-
-```markdown
-Usage:	dockerd COMMAND
-
-A self-sufficient runtime for containers.
-
-Options:
-      --add-runtime runtime                   Register an additional OCI compatible runtime (default [])
-      --allow-nondistributable-artifacts list Push nondistributable artifacts to specified registries (default [])
-      --api-cors-header string                Set CORS headers in the Engine API
-      --authorization-plugin list             Authorization plugins to load (default [])
-      --bip string                            Specify network bridge IP
-  -b, --bridge string                         Attach containers to a network bridge
-      --cgroup-parent string                  Set parent cgroup for all containers
-      --cluster-advertise string              Address or interface name to advertise
-      --cluster-store string                  URL of the distributed storage backend
-      --cluster-store-opt map                 Set cluster store options (default map[])
-      --config-file string                    Daemon configuration file (default "/etc/docker/daemon.json")
-      --containerd string                     Path to containerd socket
-      --cpu-rt-period int                     Limit the CPU real-time period in microseconds
-      --cpu-rt-runtime int                    Limit the CPU real-time runtime in microseconds
-      --data-root string                      Root directory of persistent Docker state (default "/var/lib/docker")
-  -D, --debug                                 Enable debug mode
-      --default-gateway ip                    Container default gateway IPv4 address
-      --default-gateway-v6 ip                 Container default gateway IPv6 address
-      --default-runtime string                Default OCI runtime for containers (default "runc")
-      --default-ulimit ulimit                 Default ulimits for containers (default [])
-      --disable-legacy-registry               Disable contacting legacy registries
-      --dns list                              DNS server to use (default [])
-      --dns-opt list                          DNS options to use (default [])
-      --dns-search list                       DNS search domains to use (default [])
-      --exec-opt list                         Runtime execution options (default [])
-      --exec-root string                      Root directory for execution state files (default "/var/run/docker")
-      --experimental                          Enable experimental features
-      --fixed-cidr string                     IPv4 subnet for fixed IPs
-      --fixed-cidr-v6 string                  IPv6 subnet for fixed IPs
-  -G, --group string                          Group for the unix socket (default "docker")
-      --help                                  Print usage
-  -H, --host list                             Daemon socket(s) to connect to (default [])
-      --icc                                   Enable inter-container communication (default true)
-      --init                                  Run an init in the container to forward signals and reap processes
-      --init-path string                      Path to the docker-init binary
-      --insecure-registry list                Enable insecure registry communication (default [])
-      --ip ip                                 Default IP when binding container ports (default 0.0.0.0)
-      --ip-forward                            Enable net.ipv4.ip_forward (default true)
-      --ip-masq                               Enable IP masquerading (default true)
-      --iptables                              Enable addition of iptables rules (default true)
-      --ipv6                                  Enable IPv6 networking
-      --label list                            Set key=value labels to the daemon (default [])
-      --live-restore                          Enable live restore of docker when containers are still running
-      --log-driver string                     Default driver for container logs (default "json-file")
-  -l, --log-level string                      Set the logging level ("debug", "info", "warn", "error", "fatal") (default "info")
-      --log-opt map                           Default log driver options for containers (default map[])
-      --max-concurrent-downloads int          Set the max concurrent downloads for each pull (default 3)
-      --max-concurrent-uploads int            Set the max concurrent uploads for each push (default 5)
-      --metrics-addr string                   Set default address and port to serve the metrics api on
-      --mtu int                               Set the containers network MTU
-      --no-new-privileges                     Set no-new-privileges by default for new containers
-      --oom-score-adjust int                  Set the oom_score_adj for the daemon (default -500)
-  -p, --pidfile string                        Path to use for daemon PID file (default "/var/run/docker.pid")
-      --raw-logs                              Full timestamps without ANSI coloring
-      --registry-mirror list                  Preferred Docker registry mirror (default [])
-      --seccomp-profile string                Path to seccomp profile
-      --selinux-enabled                       Enable selinux support
-      --shutdown-timeout int                  Set the default shutdown timeout (default 15)
-  -s, --storage-driver string                 Storage driver to use
-      --storage-opt list                      Storage driver options (default [])
-      --swarm-default-advertise-addr string   Set default address or interface for swarm advertised address
-      --tls                                   Use TLS; implied by --tlsverify
-      --tlscacert string                      Trust certs signed only by this CA (default "~/.docker/ca.pem")
-      --tlscert string                        Path to TLS certificate file (default "~/.docker/cert.pem")
-      --tlskey string                         Path to TLS key file (default ~/.docker/key.pem")
-      --tlsverify                             Use TLS and verify the remote
-      --userland-proxy                        Use userland proxy for loopback traffic (default true)
-      --userland-proxy-path string            Path to the userland proxy binary
-      --userns-remap string                   User/Group setting for user namespaces
-  -v, --version                               Print version information and quit
-```
-
-Options with [] may be specified multiple times.
-
-## Description
-
-`dockerd` is the persistent process that manages containers. Docker
-uses different binaries for the daemon and client. To run the daemon you
-type `dockerd`.
-
-To run the daemon with debug output, use `dockerd -D` or add `debug: true` to
-the `daemon.json` file.
-
-> **Note**: In Docker 1.13 and higher, enable experimental features by starting
-> `dockerd` with the `--experimental` flag or adding `experimental: true` to the
-> `daemon.json` file. In earlier Docker versions, a different build was required
-> to enable experimental features.
-
-## Examples
-
-### Daemon socket option
-
-The Docker daemon can listen for [Docker Engine API](../api/)
-requests via three different types of Socket: `unix`, `tcp`, and `fd`.
-
-By default, a `unix` domain socket (or IPC socket) is created at
-`/var/run/docker.sock`, requiring either `root` permission, or `docker` group
-membership.
-
-If you need to access the Docker daemon remotely, you need to enable the `tcp`
-Socket. Beware that the default setup provides un-encrypted and
-un-authenticated direct access to the Docker daemon - and should be secured
-either using the [built in HTTPS encrypted socket](https://docs.docker.com/engine/security/https/), or by
-putting a secure web proxy in front of it. You can listen on port `2375` on all
-network interfaces with `-H tcp://0.0.0.0:2375`, or on a particular network
-interface using its IP address: `-H tcp://192.168.59.103:2375`. It is
-conventional to use port `2375` for un-encrypted, and port `2376` for encrypted
-communication with the daemon.
-
-> **Note**: If you're using an HTTPS encrypted socket, keep in mind that only
-> TLS1.0 and greater are supported. Protocols SSLv3 and under are not
-> supported anymore for security reasons.
-
-On Systemd based systems, you can communicate with the daemon via
-[Systemd socket activation](http://0pointer.de/blog/projects/socket-activation.html),
-use `dockerd -H fd://`. Using `fd://` will work perfectly for most setups but
-you can also specify individual sockets: `dockerd -H fd://3`. If the
-specified socket activated files aren't found, then Docker will exit. You can
-find examples of using Systemd socket activation with Docker and Systemd in the
-[Docker source tree](https://github.com/docker/docker/tree/master/contrib/init/systemd/).
-
-You can configure the Docker daemon to listen to multiple sockets at the same
-time using multiple `-H` options:
-
-```bash
-# listen using the default unix socket, and on 2 specific IP addresses on this host.
-
-$ sudo dockerd -H unix:///var/run/docker.sock -H tcp://192.168.59.106 -H tcp://10.10.10.2
-```
-
-The Docker client will honor the `DOCKER_HOST` environment variable to set the
-`-H` flag for the client. Use **one** of the following commands:
-
-```bash
-$ docker -H tcp://0.0.0.0:2375 ps
-```
-
-```bash
-$ export DOCKER_HOST="tcp://0.0.0.0:2375"
-
-$ docker ps
-```
-
-Setting the `DOCKER_TLS_VERIFY` environment variable to any value other than
-the empty string is equivalent to setting the `--tlsverify` flag. The following
-are equivalent:
-
-```bash
-$ docker --tlsverify ps
-# or
-$ export DOCKER_TLS_VERIFY=1
-$ docker ps
-```
-
-The Docker client will honor the `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`
-environment variables (or the lowercase versions thereof). `HTTPS_PROXY` takes
-precedence over `HTTP_PROXY`.
-
-#### Bind Docker to another host/port or a Unix socket
-
-> **Warning**:
-> Changing the default `docker` daemon binding to a
-> TCP port or Unix *docker* user group will increase your security risks
-> by allowing non-root users to gain *root* access on the host. Make sure
-> you control access to `docker`. If you are binding
-> to a TCP port, anyone with access to that port has full Docker access;
-> so it is not advisable on an open network.
-
-With `-H` it is possible to make the Docker daemon to listen on a
-specific IP and port. By default, it will listen on
-`unix:///var/run/docker.sock` to allow only local connections by the
-*root* user. You *could* set it to `0.0.0.0:2375` or a specific host IP
-to give access to everybody, but that is **not recommended** because
-then it is trivial for someone to gain root access to the host where the
-daemon is running.
-
-Similarly, the Docker client can use `-H` to connect to a custom port.
-The Docker client will default to connecting to `unix:///var/run/docker.sock`
-on Linux, and `tcp://127.0.0.1:2376` on Windows.
-
-`-H` accepts host and port assignment in the following format:
-
-    tcp://[host]:[port][path] or unix://path
-
-For example:
-
--   `tcp://` -> TCP connection to `127.0.0.1` on either port `2376` when TLS encryption
-    is on, or port `2375` when communication is in plain text.
--   `tcp://host:2375` -> TCP connection on
-    host:2375
--   `tcp://host:2375/path` -> TCP connection on
-    host:2375 and prepend path to all requests
--   `unix://path/to/socket` -> Unix socket located
-    at `path/to/socket`
-
-`-H`, when empty, will default to the same value as
-when no `-H` was passed in.
-
-`-H` also accepts short form for TCP bindings: `host:` or `host:port` or `:port`
-
-Run Docker in daemon mode:
-
-```bash
-$ sudo <path to>/dockerd -H 0.0.0.0:5555 &
-```
-
-Download an `ubuntu` image:
-
-```bash
-$ docker -H :5555 pull ubuntu
-```
-
-You can use multiple `-H`, for example, if you want to listen on both
-TCP and a Unix socket
-
-```bash
-# Run docker in daemon mode
-$ sudo <path to>/dockerd -H tcp://127.0.0.1:2375 -H unix:///var/run/docker.sock &
-# Download an ubuntu image, use default Unix socket
-$ docker pull ubuntu
-# OR use the TCP port
-$ docker -H tcp://127.0.0.1:2375 pull ubuntu
-```
-
-### Daemon storage-driver
-
-The Docker daemon has support for several different image layer storage
-drivers: `aufs`, `devicemapper`, `btrfs`, `zfs`, `overlay` and `overlay2`.
-
-The `aufs` driver is the oldest, but is based on a Linux kernel patch-set that
-is unlikely to be merged into the main kernel. These are also known to cause
-some serious kernel crashes. However `aufs` allows containers to share
-executable and shared library memory, so is a useful choice when running
-thousands of containers with the same program or libraries.
-
-The `devicemapper` driver uses thin provisioning and Copy on Write (CoW)
-snapshots. For each devicemapper graph location – typically
-`/var/lib/docker/devicemapper` – a thin pool is created based on two block
-devices, one for data and one for metadata. By default, these block devices
-are created automatically by using loopback mounts of automatically created
-sparse files. Refer to [Storage driver options](#storage-driver-options) below
-for a way how to customize this setup.
-[~jpetazzo/Resizing Docker containers with the Device Mapper plugin](http://jpetazzo.github.io/2014/01/29/docker-device-mapper-resize/)
-article explains how to tune your existing setup without the use of options.
-
-The `btrfs` driver is very fast for `docker build` - but like `devicemapper`
-does not share executable memory between devices. Use
-`dockerd -s btrfs -g /mnt/btrfs_partition`.
-
-The `zfs` driver is probably not as fast as `btrfs` but has a longer track record
-on stability. Thanks to `Single Copy ARC` shared blocks between clones will be
-cached only once. Use `dockerd -s zfs`. To select a different zfs filesystem
-set `zfs.fsname` option as described in [Storage driver options](#storage-driver-options).
-
-The `overlay` is a very fast union filesystem. It is now merged in the main
-Linux kernel as of [3.18.0](https://lkml.org/lkml/2014/10/26/137). `overlay`
-also supports page cache sharing, this means multiple containers accessing
-the same file can share a single page cache entry (or entries), it makes
-`overlay` as efficient with memory as `aufs` driver. Call
-`dockerd -s overlay` to use it.
-
-> **Note**: As promising as `overlay` is, the feature is still quite young and
-> should not be used in production. Most notably, using `overlay` can cause
-> excessive inode consumption (especially as the number of images grows), as
-> well as > being incompatible with the use of RPMs.
-
-The `overlay2` uses the same fast union filesystem but takes advantage of
-[additional features](https://lkml.org/lkml/2015/2/11/106) added in Linux
-kernel 4.0 to avoid excessive inode consumption. Call `dockerd -s overlay2`
-to use it.
-
-> **Note**: Both `overlay` and `overlay2` are currently unsupported on `btrfs`
-> or any Copy on Write filesystem and should only be used over `ext4` partitions.
-
-### Options per storage driver
-
-Particular storage-driver can be configured with options specified with
-`--storage-opt` flags. Options for `devicemapper` are prefixed with `dm`,
-options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
-
-#### Devicemapper options
-
-This is an example of the configuration file for devicemapper on Linux:
-
-```json
-{
-  "storage-driver": "devicemapper",
-  "storage-opts": [
-    "dm.thinpooldev=/dev/mapper/thin-pool",
-    "dm.use_deferred_deletion=true",
-    "dm.use_deferred_removal=true"
-  ]
-}
-```
-
-##### `dm.thinpooldev`
-
-Specifies a custom block storage device to use for the thin pool.
-
-If using a block device for device mapper storage, it is best to use `lvm`
-to create and manage the thin-pool volume. This volume is then handed to Docker
-to exclusively create snapshot volumes needed for images and containers.
-
-Managing the thin-pool outside of Engine makes for the most feature-rich
-method of having Docker utilize device mapper thin provisioning as the
-backing storage for Docker containers. The highlights of the lvm-based
-thin-pool management feature include: automatic or interactive thin-pool
-resize support, dynamically changing thin-pool features, automatic thinp
-metadata checking when lvm activates the thin-pool, etc.
-
-As a fallback if no thin pool is provided, loopback files are
-created. Loopback is very slow, but can be used without any
-pre-configuration of storage. It is strongly recommended that you do
-not use loopback in production. Ensure your Engine daemon has a
-`--storage-opt dm.thinpooldev` argument provided.
-
-###### Example:
-
-```bash
-$ sudo dockerd --storage-opt dm.thinpooldev=/dev/mapper/thin-pool
-```
-
-##### `dm.directlvm_device`
-
-As an alternative to providing a thin pool as above, Docker can setup a block
-device for you.
-
-###### Example:
-
-```bash
-$ sudo dockerd --storage-opt dm.directlvm_device=/dev/xvdf
-```
-
-##### `dm.thinp_percent`
-
-Sets the percentage of passed in block device to use for storage.
-
-###### Example:
-
-```bash
-$ sudo dockerd --storage-opt dm.thinp_percent=95
-```
-
-##### `dm.thinp_metapercent`
-
-Sets the percentage of the passed in block device to use for metadata storage.
-
-###### Example:
-
-```bash
-$ sudo dockerd --storage-opt dm.thinp_metapercent=1
-```
-
-##### `dm.thinp_autoextend_threshold`
-
-Sets the value of the percentage of space used before `lvm` attempts to
-autoextend the available space [100 = disabled]
-
-###### Example:
-
-```bash
-$ sudo dockerd --storage-opt dm.thinp_autoextend_threshold=80
-```
-
-##### `dm.thinp_autoextend_percent`
-
-Sets the value percentage value to increase the thin pool by when when `lvm`
-attempts to autoextend the available space [100 = disabled]
-
-###### Example:
-
-```bash
-$ sudo dockerd --storage-opt dm.thinp_autoextend_percent=20
-```
-
-
-##### `dm.basesize`
-
-Specifies the size to use when creating the base device, which limits the
-size of images and containers. The default value is 10G. Note, thin devices
-are inherently "sparse", so a 10G device which is mostly empty doesn't use
-10 GB of space on the pool. However, the filesystem will use more space for
-the empty case the larger the device is.
-
-The base device size can be increased at daemon restart which will allow
-all future images and containers (based on those new images) to be of the
-new base device size.
-
-###### Examples
-
-```bash
-$ sudo dockerd --storage-opt dm.basesize=50G
-```
-
-This will increase the base device size to 50G. The Docker daemon will throw an
-error if existing base device size is larger than 50G. A user can use
-this option to expand the base device size however shrinking is not permitted.
-
-This value affects the system-wide "base" empty filesystem
-that may already be initialized and inherited by pulled images. Typically,
-a change to this value requires additional steps to take effect:
-
- ```bash
-$ sudo service docker stop
-
-$ sudo rm -rf /var/lib/docker
-
-$ sudo service docker start
-```
-
-
-##### `dm.loopdatasize`
-
-> **Note**: This option configures devicemapper loopback, which should not
-> be used in production.
-
-Specifies the size to use when creating the loopback file for the
-"data" device which is used for the thin pool. The default size is
-100G. The file is sparse, so it will not initially take up this
-much space.
-
-###### Example
-
-```bash
-$ sudo dockerd --storage-opt dm.loopdatasize=200G
-```
-
-##### `dm.loopmetadatasize`
-
-> **Note**: This option configures devicemapper loopback, which should not
-> be used in production.
-
-Specifies the size to use when creating the loopback file for the
-"metadata" device which is used for the thin pool. The default size
-is 2G. The file is sparse, so it will not initially take up
-this much space.
-
-###### Example
-
-```bash
-$ sudo dockerd --storage-opt dm.loopmetadatasize=4G
-```
-
-##### `dm.fs`
-
-Specifies the filesystem type to use for the base device. The supported
-options are "ext4" and "xfs". The default is "xfs"
-
-###### Example
-
-```bash
-$ sudo dockerd --storage-opt dm.fs=ext4
-```
-
-##### `dm.mkfsarg`
-
-Specifies extra mkfs arguments to be used when creating the base device.
-
-###### Example
-
-```bash
-$ sudo dockerd --storage-opt "dm.mkfsarg=-O ^has_journal"
-```
-
-##### `dm.mountopt`
-
-Specifies extra mount options used when mounting the thin devices.
-
-###### Example
-
-```bash
-$ sudo dockerd --storage-opt dm.mountopt=nodiscard
-```
-
-##### `dm.datadev`
-
-(Deprecated, use `dm.thinpooldev`)
-
-Specifies a custom blockdevice to use for data for the thin pool.
-
-If using a block device for device mapper storage, ideally both `datadev` and
-`metadatadev` should be specified to completely avoid using the loopback
-device.
-
-###### Example
-
-```bash
-$ sudo dockerd \
-      --storage-opt dm.datadev=/dev/sdb1 \
-      --storage-opt dm.metadatadev=/dev/sdc1
-```
-
-##### `dm.metadatadev`
-
-(Deprecated, use `dm.thinpooldev`)
-
-Specifies a custom blockdevice to use for metadata for the thin pool.
-
-For best performance the metadata should be on a different spindle than the
-data, or even better on an SSD.
-
-If setting up a new metadata pool it is required to be valid. This can be
-achieved by zeroing the first 4k to indicate empty metadata, like this:
-
-```bash
-$ dd if=/dev/zero of=$metadata_dev bs=4096 count=1
-```
-
-###### Example
-
-```bash
-$ sudo dockerd \
-      --storage-opt dm.datadev=/dev/sdb1 \
-      --storage-opt dm.metadatadev=/dev/sdc1
-```
-
-##### `dm.blocksize`
-
-Specifies a custom blocksize to use for the thin pool. The default
-blocksize is 64K.
-
-###### Example
-
-```bash
-$ sudo dockerd --storage-opt dm.blocksize=512K
-```
-
-##### `dm.blkdiscard`
-
-Enables or disables the use of `blkdiscard` when removing devicemapper
-devices. This is enabled by default (only) if using loopback devices and is
-required to resparsify the loopback file on image/container removal.
-
-Disabling this on loopback can lead to *much* faster container removal
-times, but will make the space used in `/var/lib/docker` directory not be
-returned to the system for other use when containers are removed.
-
-###### Examples
-
-```bash
-$ sudo dockerd --storage-opt dm.blkdiscard=false
-```
-
-##### `dm.override_udev_sync_check`
-
-Overrides the `udev` synchronization checks between `devicemapper` and `udev`.
-`udev` is the device manager for the Linux kernel.
-
-To view the `udev` sync support of a Docker daemon that is using the
-`devicemapper` driver, run:
-
-```bash
-$ docker info
-[...]
-Udev Sync Supported: true
-[...]
-```
-
-When `udev` sync support is `true`, then `devicemapper` and udev can
-coordinate the activation and deactivation of devices for containers.
-
-When `udev` sync support is `false`, a race condition occurs between
-the`devicemapper` and `udev` during create and cleanup. The race condition
-results in errors and failures. (For information on these failures, see
-[docker#4036](https://github.com/docker/docker/issues/4036))
-
-To allow the `docker` daemon to start, regardless of `udev` sync not being
-supported, set `dm.override_udev_sync_check` to true:
-
-```bash
-$ sudo dockerd --storage-opt dm.override_udev_sync_check=true
-```
-
-When this value is `true`, the  `devicemapper` continues and simply warns
-you the errors are happening.
-
-> **Note**: The ideal is to pursue a `docker` daemon and environment that does
-> support synchronizing with `udev`. For further discussion on this
-> topic, see [docker#4036](https://github.com/docker/docker/issues/4036).
-> Otherwise, set this flag for migrating existing Docker daemons to
-> a daemon with a supported environment.
-
-##### `dm.use_deferred_removal`
-
-Enables use of deferred device removal if `libdm` and the kernel driver
-support the mechanism.
-
-Deferred device removal means that if device is busy when devices are
-being removed/deactivated, then a deferred removal is scheduled on
-device. And devices automatically go away when last user of the device
-exits.
-
-For example, when a container exits, its associated thin device is removed.
-If that device has leaked into some other mount namespace and can't be
-removed, the container exit still succeeds and this option causes the
-system to schedule the device for deferred removal. It does not wait in a
-loop trying to remove a busy device.
-
-###### Example
-
-```bash
-$ sudo dockerd --storage-opt dm.use_deferred_removal=true
-```
-
-##### `dm.use_deferred_deletion`
-
-Enables use of deferred device deletion for thin pool devices. By default,
-thin pool device deletion is synchronous. Before a container is deleted,
-the Docker daemon removes any associated devices. If the storage driver
-can not remove a device, the container deletion fails and daemon returns.
-
-```none
-Error deleting container: Error response from daemon: Cannot destroy container
-```
-
-To avoid this failure, enable both deferred device deletion and deferred
-device removal on the daemon.
-
-```bash
-$ sudo dockerd \
-      --storage-opt dm.use_deferred_deletion=true \
-      --storage-opt dm.use_deferred_removal=true
-```
-
-With these two options enabled, if a device is busy when the driver is
-deleting a container, the driver marks the device as deleted. Later, when
-the device isn't in use, the driver deletes it.
-
-In general it should be safe to enable this option by default. It will help
-when unintentional leaking of mount point happens across multiple mount
-namespaces.
-
-##### `dm.min_free_space`
-
-Specifies the min free space percent in a thin pool require for new device
-creation to succeed. This check applies to both free data space as well
-as free metadata space. Valid values are from 0% - 99%. Value 0% disables
-free space checking logic. If user does not specify a value for this option,
-the Engine uses a default value of 10%.
-
-Whenever a new a thin pool device is created (during `docker pull` or during
-container creation), the Engine checks if the minimum free space is
-available. If sufficient space is unavailable, then device creation fails
-and any relevant `docker` operation fails.
-
-To recover from this error, you must create more free space in the thin pool
-to recover from the error. You can create free space by deleting some images
-and containers from the thin pool. You can also add more storage to the thin
-pool.
-
-To add more space to a LVM (logical volume management) thin pool, just add
-more storage to the volume group container thin pool; this should automatically
-resolve any errors. If your configuration uses loop devices, then stop the
-Engine daemon, grow the size of loop files and restart the daemon to resolve
-the issue.
-
-###### Example
-
-```bash
-$ sudo dockerd --storage-opt dm.min_free_space=10%
-```
-
-##### `dm.xfs_nospace_max_retries`
-
-Specifies the maximum number of retries XFS should attempt to complete
-IO when ENOSPC (no space) error is returned by underlying storage device.
-
-By default XFS retries infinitely for IO to finish and this can result
-in unkillable process. To change this behavior one can set
-xfs_nospace_max_retries to say 0 and XFS will not retry IO after getting
-ENOSPC and will shutdown filesystem.
-
-###### Example
-
-```bash
-$ sudo dockerd --storage-opt dm.xfs_nospace_max_retries=0
-```
-
-#### ZFS options
-
-##### `zfs.fsname`
-
-Set zfs filesystem under which docker will create its own datasets.
-By default docker will pick up the zfs filesystem where docker graph
-(`/var/lib/docker`) is located.
-
-###### Example
-
-```bash
-$ sudo dockerd -s zfs --storage-opt zfs.fsname=zroot/docker
-```
-
-#### Btrfs options
-
-##### `btrfs.min_space`
-
-Specifies the minimum size to use when creating the subvolume which is used
-for containers. If user uses disk quota for btrfs when creating or running
-a container with **--storage-opt size** option, docker should ensure the
-**size** cannot be smaller than **btrfs.min_space**.
-
-###### Example
-
-```bash
-$ sudo dockerd -s btrfs --storage-opt btrfs.min_space=10G
-```
-
-#### Overlay2 options
-
-##### `overlay2.override_kernel_check`
-
-Overrides the Linux kernel version check allowing overlay2. Support for
-specifying multiple lower directories needed by overlay2 was added to the
-Linux kernel in 4.0.0. However, some older kernel versions may be patched
-to add multiple lower directory support for OverlayFS. This option should
-only be used after verifying this support exists in the kernel. Applying
-this option on a kernel without this support will cause failures on mount.
-
-### Docker runtime execution options
-
-The Docker daemon relies on a
-[OCI](https://github.com/opencontainers/runtime-spec) compliant runtime
-(invoked via the `containerd` daemon) as its interface to the Linux
-kernel `namespaces`, `cgroups`, and `SELinux`.
-
-By default, the Docker daemon automatically starts `containerd`. If you want to
-control `containerd` startup, manually start `containerd` and pass the path to
-the `containerd` socket using the `--containerd` flag. For example:
-
-```bash
-$ sudo dockerd --containerd /var/run/dev/docker-containerd.sock
-```
-
-Runtimes can be registered with the daemon either via the
-configuration file or using the `--add-runtime` command line argument.
-
-The following is an example adding 2 runtimes via the configuration:
-
-```json
-{
-	"default-runtime": "runc",
-	"runtimes": {
-		"runc": {
-			"path": "runc"
-		},
-		"custom": {
-			"path": "/usr/local/bin/my-runc-replacement",
-			"runtimeArgs": [
-				"--debug"
-			]
-		}
-	}
-}
-```
-
-This is the same example via the command line:
-
-```bash
-$ sudo dockerd --add-runtime runc=runc --add-runtime custom=/usr/local/bin/my-runc-replacement
-```
-
-> **Note**: Defining runtime arguments via the command line is not supported.
-
-#### Options for the runtime
-
-You can configure the runtime using options specified
-with the `--exec-opt` flag. All the flag's options have the `native` prefix. A
-single `native.cgroupdriver` option is available.
-
-The `native.cgroupdriver` option specifies the management of the container's
-cgroups. You can only specify `cgroupfs` or `systemd`. If you specify
-`systemd` and it is not available, the system errors out. If you omit the
-`native.cgroupdriver` option,` cgroupfs` is used.
-
-This example sets the `cgroupdriver` to `systemd`:
-
-```bash
-$ sudo dockerd --exec-opt native.cgroupdriver=systemd
-```
-
-Setting this option applies to all containers the daemon launches.
-
-Also Windows Container makes use of `--exec-opt` for special purpose. Docker user
-can specify default container isolation technology with this, for example:
-
-```console
-> dockerd --exec-opt isolation=hyperv
-```
-
-Will make `hyperv` the default isolation technology on Windows. If no isolation
-value is specified on daemon start, on Windows client, the default is
-`hyperv`, and on Windows server, the default is `process`.
-
-#### Daemon DNS options
-
-To set the DNS server for all Docker containers, use:
-
-```bash
-$ sudo dockerd --dns 8.8.8.8
-```
-
-To set the DNS search domain for all Docker containers, use:
-
-```bash
-$ sudo dockerd --dns-search example.com
-```
-
-#### Allow push of nondistributable artifacts
-
-Some images (e.g., Windows base images) contain artifacts whose distribution is
-restricted by license. When these images are pushed to a registry, restricted
-artifacts are not included.
-
-To override this behavior for specific registries, use the
-`--allow-nondistributable-artifacts` option in one of the following forms:
-
-* `--allow-nondistributable-artifacts myregistry:5000` tells the Docker daemon
-  to push nondistributable artifacts to myregistry:5000.
-* `--allow-nondistributable-artifacts 10.1.0.0/16` tells the Docker daemon to
-  push nondistributable artifacts to all registries whose resolved IP address
-  is within the subnet described by the CIDR syntax.
-
-This option can be used multiple times.
-
-This option is useful when pushing images containing nondistributable artifacts
-to a registry on an air-gapped network so hosts on that network can pull the
-images without connecting to another server.
-
-> **Warning**: Nondistributable artifacts typically have restrictions on how
-> and where they can be distributed and shared. Only use this feature to push
-> artifacts to private registries and ensure that you are in compliance with
-> any terms that cover redistributing nondistributable artifacts.
-
-#### Insecure registries
-
-Docker considers a private registry either secure or insecure. In the rest of
-this section, *registry* is used for *private registry*, and `myregistry:5000`
-is a placeholder example for a private registry.
-
-A secure registry uses TLS and a copy of its CA certificate is placed on the
-Docker host at `/etc/docker/certs.d/myregistry:5000/ca.crt`. An insecure
-registry is either not using TLS (i.e., listening on plain text HTTP), or is
-using TLS with a CA certificate not known by the Docker daemon. The latter can
-happen when the certificate was not found under
-`/etc/docker/certs.d/myregistry:5000/`, or if the certificate verification
-failed (i.e., wrong CA).
-
-By default, Docker assumes all, but local (see local registries below),
-registries are secure. Communicating with an insecure registry is not possible
-if Docker assumes that registry is secure. In order to communicate with an
-insecure registry, the Docker daemon requires `--insecure-registry` in one of
-the following two forms:
-
-* `--insecure-registry myregistry:5000` tells the Docker daemon that
-  myregistry:5000 should be considered insecure.
-* `--insecure-registry 10.1.0.0/16` tells the Docker daemon that all registries
-  whose domain resolve to an IP address is part of the subnet described by the
-  CIDR syntax, should be considered insecure.
-
-The flag can be used multiple times to allow multiple registries to be marked
-as insecure.
-
-If an insecure registry is not marked as insecure, `docker pull`,
-`docker push`, and `docker search` will result in an error message prompting
-the user to either secure or pass the `--insecure-registry` flag to the Docker
-daemon as described above.
-
-Local registries, whose IP address falls in the 127.0.0.0/8 range, are
-automatically marked as insecure as of Docker 1.3.2. It is not recommended to
-rely on this, as it may change in the future.
-
-Enabling `--insecure-registry`, i.e., allowing un-encrypted and/or untrusted
-communication, can be useful when running a local registry.  However,
-because its use creates security vulnerabilities it should ONLY be enabled for
-testing purposes.  For increased security, users should add their CA to their
-system's list of trusted CAs instead of enabling `--insecure-registry`.
-
-##### Legacy Registries
-
-Enabling `--disable-legacy-registry` forces a docker daemon to only interact with registries which support the V2 protocol.  Specifically, the daemon will not attempt `push`, `pull` and `login` to v1 registries.  The exception to this is `search` which can still be performed on v1 registries.
-
-#### Running a Docker daemon behind an HTTPS_PROXY
-
-When running inside a LAN that uses an `HTTPS` proxy, the Docker Hub
-certificates will be replaced by the proxy's certificates. These certificates
-need to be added to your Docker host's configuration:
-
-1. Install the `ca-certificates` package for your distribution
-2. Ask your network admin for the proxy's CA certificate and append them to
-   `/etc/pki/tls/certs/ca-bundle.crt`
-3. Then start your Docker daemon with `HTTPS_PROXY=http://username:password@proxy:port/ dockerd`.
-   The `username:` and `password@` are optional - and are only needed if your
-   proxy is set up to require authentication.
-
-This will only add the proxy and authentication to the Docker daemon's requests -
-your `docker build`s and running containers will need extra configuration to
-use the proxy
-
-#### Default `ulimit` settings
-
-`--default-ulimit` allows you to set the default `ulimit` options to use for
-all containers. It takes the same options as `--ulimit` for `docker run`. If
-these defaults are not set, `ulimit` settings will be inherited, if not set on
-`docker run`, from the Docker daemon. Any `--ulimit` options passed to
-`docker run` will overwrite these defaults.
-
-Be careful setting `nproc` with the `ulimit` flag as `nproc` is designed by Linux to
-set the maximum number of processes available to a user, not to a container. For details
-please check the [run](run.md) reference.
-
-#### Node discovery
-
-The `--cluster-advertise` option specifies the `host:port` or `interface:port`
-combination that this particular daemon instance should use when advertising
-itself to the cluster. The daemon is reached by remote hosts through this value.
-If you  specify an interface, make sure it includes the IP address of the actual
-Docker host. For Engine installation created through `docker-machine`, the
-interface is typically `eth1`.
-
-The daemon uses [libkv](https://github.com/docker/libkv/) to advertise
-the node within the cluster. Some key-value backends support mutual
-TLS. To configure the client TLS settings used by the daemon can be configured
-using the `--cluster-store-opt` flag, specifying the paths to PEM encoded
-files. For example:
-
-```bash
-$ sudo dockerd \
-    --cluster-advertise 192.168.1.2:2376 \
-    --cluster-store etcd://192.168.1.2:2379 \
-    --cluster-store-opt kv.cacertfile=/path/to/ca.pem \
-    --cluster-store-opt kv.certfile=/path/to/cert.pem \
-    --cluster-store-opt kv.keyfile=/path/to/key.pem
-```
-
-The currently supported cluster store options are:
-
-| Option                | Description |
-|-----------------------|-------------|
-| `discovery.heartbeat` | Specifies the heartbeat timer in seconds which is used by the daemon as a `keepalive` mechanism to make sure discovery module treats the node as alive in the cluster. If not configured, the default value is 20 seconds. |
-| `discovery.ttl`       | Specifies the TTL (time-to-live) in seconds which is used by the discovery module to timeout a node if a valid heartbeat is not received within the configured ttl value. If not configured, the default value is 60 seconds. |
-| `kv.cacertfile`       | Specifies the path to a local file with PEM encoded CA certificates to trust. |
-| `kv.certfile`         | Specifies the path to a local file with a PEM encoded certificate. This certificate is used as the client cert for communication with the Key/Value store. |
-| `kv.keyfile`          | Specifies the path to a local file with a PEM encoded private key. This private key is used as the client key for communication with the Key/Value store. |
-| `kv.path`             | Specifies the path in the Key/Value store. If not configured, the default value is 'docker/nodes'. |
-
-#### Access authorization
-
-Docker's access authorization can be extended by authorization plugins that your
-organization can purchase or build themselves. You can install one or more
-authorization plugins when you start the Docker `daemon` using the
-`--authorization-plugin=PLUGIN_ID` option.
-
-```bash
-$ sudo dockerd --authorization-plugin=plugin1 --authorization-plugin=plugin2,...
-```
-
-The `PLUGIN_ID` value is either the plugin's name or a path to its specification
-file. The plugin's implementation determines whether you can specify a name or
-path. Consult with your Docker administrator to get information about the
-plugins available to you.
-
-Once a plugin is installed, requests made to the `daemon` through the
-command line or Docker's Engine API are allowed or denied by the plugin.
-If you have multiple plugins installed, each plugin, in order, must
-allow the request for it to complete.
-
-For information about how to create an authorization plugin, see [authorization
-plugin](../../extend/plugins_authorization.md) section in the Docker extend section of this documentation.
-
-
-#### Daemon user namespace options
-
-The Linux kernel [user namespace support](http://man7.org/linux/man-pages/man7/user_namespaces.7.html) provides additional security by enabling
-a process, and therefore a container, to have a unique range of user and
-group IDs which are outside the traditional user and group range utilized by
-the host system. Potentially the most important security improvement is that,
-by default, container processes running as the `root` user will have expected
-administrative privilege (with some restrictions) inside the container but will
-effectively be mapped to an unprivileged `uid` on the host.
-
-When user namespace support is enabled, Docker creates a single daemon-wide mapping
-for all containers running on the same engine instance. The mappings will
-utilize the existing subordinate user and group ID feature available on all modern
-Linux distributions.
-The [`/etc/subuid`](http://man7.org/linux/man-pages/man5/subuid.5.html) and
-[`/etc/subgid`](http://man7.org/linux/man-pages/man5/subgid.5.html) files will be
-read for the user, and optional group, specified to the `--userns-remap`
-parameter.  If you do not wish to specify your own user and/or group, you can
-provide `default` as the value to this flag, and a user will be created on your behalf
-and provided subordinate uid and gid ranges. This default user will be named
-`dockremap`, and entries will be created for it in `/etc/passwd` and
-`/etc/group` using your distro's standard user and group creation tools.
-
-> **Note**: The single mapping per-daemon restriction is in place for now
-> because Docker shares image layers from its local cache across all
-> containers running on the engine instance.  Since file ownership must be
-> the same for all containers sharing the same layer content, the decision
-> was made to map the file ownership on `docker pull` to the daemon's user and
-> group mappings so that there is no delay for running containers once the
-> content is downloaded. This design preserves the same performance for `docker
-> pull`, `docker push`, and container startup as users expect with
-> user namespaces disabled.
-
-##### Start the daemon with user namespaces enabled
-
-To enable user namespace support, start the daemon with the
-`--userns-remap` flag, which accepts values in the following formats:
-
- - uid
- - uid:gid
- - username
- - username:groupname
-
-If numeric IDs are provided, translation back to valid user or group names
-will occur so that the subordinate uid and gid information can be read, given
-these resources are name-based, not id-based.  If the numeric ID information
-provided does not exist as entries in `/etc/passwd` or `/etc/group`, daemon
-startup will fail with an error message.
-
-**Example: starting with default Docker user management:**
-
-```bash
-$ sudo dockerd --userns-remap=default
-```
-
-When `default` is provided, Docker will create - or find the existing - user and group
-named `dockremap`. If the user is created, and the Linux distribution has
-appropriate support, the `/etc/subuid` and `/etc/subgid` files will be populated
-with a contiguous 65536 length range of subordinate user and group IDs, starting
-at an offset based on prior entries in those files.  For example, Ubuntu will
-create the following range, based on an existing user named `user1` already owning
-the first 65536 range:
-
-```bash
-$ cat /etc/subuid
-user1:100000:65536
-dockremap:165536:65536
-```
-
-If you have a preferred/self-managed user with subordinate ID mappings already
-configured, you can provide that username or uid to the `--userns-remap` flag.
-If you have a group that doesn't match the username, you may provide the `gid`
-or group name as well; otherwise the username will be used as the group name
-when querying the system for the subordinate group ID range.
-
-The output of `docker info` can be used to determine if the daemon is running
-with user namespaces enabled or not. If the daemon is configured with user
-namespaces, the Security Options entry in the response will list "userns" as
-one of the enabled security features.
-
-##### Behavior differences when user namespaces are enabled
-
-When you start the Docker daemon with `--userns-remap`, Docker segregates the graph directory
-where the images are stored by adding an extra directory with a name corresponding to the
-remapped UID and GID. For example, if the remapped UID and GID begin with `165536`, all
-images and containers running with that remap setting are located in `/var/lib/docker/165536.165536`
-instead of `/var/lib/docker/`.
-
-In addition, the files and directories within the new directory, which correspond to
-images and container layers, are also owned by the new UID and GID. To set the ownership
-correctly, you need to re-pull the images and restart the containers after starting the
-daemon with `--userns-remap`.
-
-##### Detailed information on `subuid`/`subgid` ranges
-
-Given potential advanced use of the subordinate ID ranges by power users, the
-following paragraphs define how the Docker daemon currently uses the range entries
-found within the subordinate range files.
-
-The simplest case is that only one contiguous range is defined for the
-provided user or group. In this case, Docker will use that entire contiguous
-range for the mapping of host uids and gids to the container process.  This
-means that the first ID in the range will be the remapped root user, and the
-IDs above that initial ID will map host ID 1 through the end of the range.
-
-From the example `/etc/subuid` content shown above, the remapped root
-user would be uid 165536.
-
-If the system administrator has set up multiple ranges for a single user or
-group, the Docker daemon will read all the available ranges and use the
-following algorithm to create the mapping ranges:
-
-1. The range segments found for the particular user will be sorted by *start ID* ascending.
-2. Map segments will be created from each range in increasing value with a length matching the length of each segment. Therefore the range segment with the lowest numeric starting value will be equal to the remapped root, and continue up through host uid/gid equal to the range segment length. As an example, if the lowest segment starts at ID 1000 and has a length of 100, then a map of 1000 -> 0 (the remapped root) up through 1100 -> 100 will be created from this segment. If the next segment starts at ID 10000, then the next map will start with mapping 10000 -> 101 up to the length of this second segment. This will continue until no more segments are found in the subordinate files for this user.
-3. If more than five range segments exist for a single user, only the first five will be utilized, matching the kernel's limitation of only five entries in `/proc/self/uid_map` and `proc/self/gid_map`.
-
-##### Disable user namespace for a container
-
-If you enable user namespaces on the daemon, all containers are started
-with user namespaces enabled. In some situations you might want to disable
-this feature for a container, for example, to start a privileged container (see
-[user namespace known restrictions](#user-namespace-known-restrictions)).
-To enable those advanced features for a specific container use `--userns=host`
-in the `run/exec/create` command.
-This option will completely disable user namespace mapping for the container's user.
-
-##### User namespace known restrictions
-
-The following standard Docker features are currently incompatible when
-running a Docker daemon with user namespaces enabled:
-
- - sharing PID or NET namespaces with the host (`--pid=host` or `--net=host`)
- - Using `--privileged` mode flag on `docker run` (unless also specifying `--userns=host`)
-
-In general, user namespaces are an advanced feature and will require
-coordination with other capabilities. For example, if volumes are mounted from
-the host, file ownership will have to be pre-arranged if the user or
-administrator wishes the containers to have expected access to the volume
-contents. Note that when using external volume or graph driver plugins, those
-external software programs must be made aware of user and group mapping ranges
-if they are to work seamlessly with user namespace support.
-
-Finally, while the `root` user inside a user namespaced container process has
-many of the expected admin privileges that go along with being the superuser, the
-Linux kernel has restrictions based on internal knowledge that this is a user namespaced
-process. The most notable restriction that we are aware of at this time is the
-inability to use `mknod`. Permission will be denied for device creation even as
-container `root` inside a user namespace.
-
-### Miscellaneous options
-
-IP masquerading uses address translation to allow containers without a public
-IP to talk to other machines on the Internet. This may interfere with some
-network topologies and can be disabled with `--ip-masq=false`.
-
-Docker supports softlinks for the Docker data directory (`/var/lib/docker`) and
-for `/var/lib/docker/tmp`. The `DOCKER_TMPDIR` and the data directory can be
-set like this:
-
-    DOCKER_TMPDIR=/mnt/disk2/tmp /usr/local/bin/dockerd -D -g /var/lib/docker -H unix:// > /var/lib/docker-machine/docker.log 2>&1
-    # or
-    export DOCKER_TMPDIR=/mnt/disk2/tmp
-    /usr/local/bin/dockerd -D -g /var/lib/docker -H unix:// > /var/lib/docker-machine/docker.log 2>&1
-
-#### Default cgroup parent
-
-The `--cgroup-parent` option allows you to set the default cgroup parent
-to use for containers. If this option is not set, it defaults to `/docker` for
-fs cgroup driver and `system.slice` for systemd cgroup driver.
-
-If the cgroup has a leading forward slash (`/`), the cgroup is created
-under the root cgroup, otherwise the cgroup is created under the daemon
-cgroup.
-
-Assuming the daemon is running in cgroup `daemoncgroup`,
-`--cgroup-parent=/foobar` creates a cgroup in
-`/sys/fs/cgroup/memory/foobar`, whereas using `--cgroup-parent=foobar`
-creates the cgroup in `/sys/fs/cgroup/memory/daemoncgroup/foobar`
-
-The systemd cgroup driver has different rules for `--cgroup-parent`. Systemd
-represents hierarchy by slice and the name of the slice encodes the location in
-the tree. So `--cgroup-parent` for systemd cgroups should be a slice name. A
-name can consist of a dash-separated series of names, which describes the path
-to the slice from the root slice. For example, `--cgroup-parent=user-a-b.slice`
-means the memory cgroup for the container is created in
-`/sys/fs/cgroup/memory/user.slice/user-a.slice/user-a-b.slice/docker-<id>.scope`.
-
-This setting can also be set per container, using the `--cgroup-parent`
-option on `docker create` and `docker run`, and takes precedence over
-the `--cgroup-parent` option on the daemon.
-
-#### Daemon metrics
-
-The `--metrics-addr` option takes a tcp address to serve the metrics API.
-This feature is still experimental, therefore, the daemon must be running in experimental
-mode for this feature to work.
-
-To serve the metrics API on localhost:1337 you would specify `--metrics-addr 127.0.0.1:1337`
-allowing you to make requests on the API at `127.0.0.1:1337/metrics` to receive metrics in the
-[prometheus](https://prometheus.io/docs/instrumenting/exposition_formats/) format.
-
-If you are running a prometheus server you can add this address to your scrape configs
-to have prometheus collect metrics on Docker.  For more information
-on prometheus you can view the website [here](https://prometheus.io/).
-
-```none
-scrape_configs:
-  - job_name: 'docker'
-    static_configs:
-      - targets: ['127.0.0.1:1337']
-```
-
-Please note that this feature is still marked as experimental as metrics and metric
-names could change while this feature is still in experimental.  Please provide
-feedback on what you would like to see collected in the API.
-
-#### Daemon configuration file
-
-The `--config-file` option allows you to set any configuration option
-for the daemon in a JSON format. This file uses the same flag names as keys,
-except for flags that allow several entries, where it uses the plural
-of the flag name, e.g., `labels` for the `label` flag.
-
-The options set in the configuration file must not conflict with options set
-via flags. The docker daemon fails to start if an option is duplicated between
-the file and the flags, regardless their value. We do this to avoid
-silently ignore changes introduced in configuration reloads.
-For example, the daemon fails to start if you set daemon labels
-in the configuration file and also set daemon labels via the `--label` flag.
-Options that are not present in the file are ignored when the daemon starts.
-
-##### On Linux
-
-The default location of the configuration file on Linux is
-`/etc/docker/daemon.json`. The `--config-file` flag can be used to specify a
- non-default location.
-
-This is a full example of the allowed configuration options on Linux:
-
-```json
-{
-	"authorization-plugins": [],
-	"data-root": "",
-	"dns": [],
-	"dns-opts": [],
-	"dns-search": [],
-	"exec-opts": [],
-	"exec-root": "",
-	"experimental": false,
-	"storage-driver": "",
-	"storage-opts": [],
-	"labels": [],
-	"live-restore": true,
-	"log-driver": "",
-	"log-opts": {},
-	"mtu": 0,
-	"pidfile": "",
-	"cluster-store": "",
-	"cluster-store-opts": {},
-	"cluster-advertise": "",
-	"max-concurrent-downloads": 3,
-	"max-concurrent-uploads": 5,
-	"default-shm-size": "64M",
-	"shutdown-timeout": 15,
-	"debug": true,
-	"hosts": [],
-	"log-level": "",
-	"tls": true,
-	"tlsverify": true,
-	"tlscacert": "",
-	"tlscert": "",
-	"tlskey": "",
-	"swarm-default-advertise-addr": "",
-	"api-cors-header": "",
-	"selinux-enabled": false,
-	"userns-remap": "",
-	"group": "",
-	"cgroup-parent": "",
-	"default-ulimits": {},
-	"init": false,
-	"init-path": "/usr/libexec/docker-init",
-	"ipv6": false,
-	"iptables": false,
-	"ip-forward": false,
-	"ip-masq": false,
-	"userland-proxy": false,
-	"userland-proxy-path": "/usr/libexec/docker-proxy",
-	"ip": "0.0.0.0",
-	"bridge": "",
-	"bip": "",
-	"fixed-cidr": "",
-	"fixed-cidr-v6": "",
-	"default-gateway": "",
-	"default-gateway-v6": "",
-	"icc": false,
-	"raw-logs": false,
-	"allow-nondistributable-artifacts": [],
-	"registry-mirrors": [],
-	"seccomp-profile": "",
-	"insecure-registries": [],
-	"disable-legacy-registry": false,
-	"no-new-privileges": false,
-	"default-runtime": "runc",
-	"oom-score-adjust": -500,
-	"runtimes": {
-		"runc": {
-			"path": "runc"
-		},
-		"custom": {
-			"path": "/usr/local/bin/my-runc-replacement",
-			"runtimeArgs": [
-				"--debug"
-			]
-		}
-	}
-}
-```
-
-> **Note:** You cannot set options in `daemon.json` that have already been set on
-> daemon startup as a flag.
-> On systems that use `systemd` to start the Docker daemon, `-H` is already set, so
-> you cannot use the `hosts` key in `daemon.json` to add listening addresses.
-> See https://docs.docker.com/engine/admin/systemd/#custom-docker-daemon-options for how
-> to accomplish this task with a systemd drop-in file.
-
-##### On Windows
-
-The default location of the configuration file on Windows is
- `%programdata%\docker\config\daemon.json`. The `--config-file` flag can be
- used to specify a non-default location.
-
-This is a full example of the allowed configuration options on Windows:
-
-```json
-{
-    "authorization-plugins": [],
-    "data-root": "",
-    "dns": [],
-    "dns-opts": [],
-    "dns-search": [],
-    "exec-opts": [],
-    "experimental": false,
-    "storage-driver": "",
-    "storage-opts": [],
-    "labels": [],
-    "log-driver": "",
-    "mtu": 0,
-    "pidfile": "",
-    "cluster-store": "",
-    "cluster-advertise": "",
-    "max-concurrent-downloads": 3,
-    "max-concurrent-uploads": 5,
-    "shutdown-timeout": 15,
-    "debug": true,
-    "hosts": [],
-    "log-level": "",
-    "tlsverify": true,
-    "tlscacert": "",
-    "tlscert": "",
-    "tlskey": "",
-    "swarm-default-advertise-addr": "",
-    "group": "",
-    "default-ulimits": {},
-    "bridge": "",
-    "fixed-cidr": "",
-    "raw-logs": false,
-    "allow-nondistributable-artifacts": [],
-    "registry-mirrors": [],
-    "insecure-registries": [],
-    "disable-legacy-registry": false
-}
-```
-
-#### Configuration reload behavior
-
-Some options can be reconfigured when the daemon is running without requiring
-to restart the process. We use the `SIGHUP` signal in Linux to reload, and a global event
-in Windows with the key `Global\docker-daemon-config-$PID`. The options can
-be modified in the configuration file but still will check for conflicts with
-the provided flags. The daemon fails to reconfigure itself
-if there are conflicts, but it won't stop execution.
-
-The list of currently supported options that can be reconfigured is this:
-
-- `debug`: it changes the daemon to debug mode when set to true.
-- `cluster-store`: it reloads the discovery store with the new address.
-- `cluster-store-opts`: it uses the new options to reload the discovery store.
-- `cluster-advertise`: it modifies the address advertised after reloading.
-- `labels`: it replaces the daemon labels with a new set of labels.
-- `live-restore`: Enables [keeping containers alive during daemon downtime](https://docs.docker.com/engine/admin/live-restore/).
-- `max-concurrent-downloads`: it updates the max concurrent downloads for each pull.
-- `max-concurrent-uploads`: it updates the max concurrent uploads for each push.
-- `default-runtime`: it updates the runtime to be used if not is
-  specified at container creation. It defaults to "default" which is
-  the runtime shipped with the official docker packages.
-- `runtimes`: it updates the list of available OCI runtimes that can
-  be used to run containers
-- `authorization-plugin`: specifies the authorization plugins to use.
-- `allow-nondistributable-artifacts`: Replaces the set of registries to which the daemon will push nondistributable artifacts with a new set of registries.
-- `insecure-registries`: it replaces the daemon insecure registries with a new set of insecure registries. If some existing insecure registries in daemon's configuration are not in newly reloaded insecure resgitries, these existing ones will be removed from daemon's config.
-- `registry-mirrors`: it replaces the daemon registry mirrors with a new set of registry mirrors. If some existing registry mirrors in daemon's configuration are not in newly reloaded registry mirrors, these existing ones will be removed from daemon's config.
-
-Updating and reloading the cluster configurations such as `--cluster-store`,
-`--cluster-advertise` and `--cluster-store-opts` will take effect only if
-these configurations were not previously configured. If `--cluster-store`
-has been provided in flags and `cluster-advertise` not, `cluster-advertise`
-can be added in the configuration file without accompanied by `--cluster-store`.
-Configuration reload will log a warning message if it detects a change in
-previously configured cluster configurations.
-
-
-### Run multiple daemons
-
-> **Note:** Running multiple daemons on a single host is considered as "experimental". The user should be aware of
-> unsolved problems. This solution may not work properly in some cases. Solutions are currently under development
-> and will be delivered in the near future.
-
-This section describes how to run multiple Docker daemons on a single host. To
-run multiple daemons, you must configure each daemon so that it does not
-conflict with other daemons on the same host. You can set these options either
-by providing them as flags, or by using a [daemon configuration file](#daemon-configuration-file).
-
-The following daemon options must be configured for each daemon:
-
-```none
--b, --bridge=                          Attach containers to a network bridge
---exec-root=/var/run/docker            Root of the Docker execdriver
---data-root=/var/lib/docker            Root of persisted Docker data
--p, --pidfile=/var/run/docker.pid      Path to use for daemon PID file
--H, --host=[]                          Daemon socket(s) to connect to
---iptables=true                        Enable addition of iptables rules
---config-file=/etc/docker/daemon.json  Daemon configuration file
---tlscacert="~/.docker/ca.pem"         Trust certs signed only by this CA
---tlscert="~/.docker/cert.pem"         Path to TLS certificate file
---tlskey="~/.docker/key.pem"           Path to TLS key file
-```
-
-When your daemons use different values for these flags, you can run them on the same host without any problems.
-It is very important to properly understand the meaning of those options and to use them correctly.
-
-- The `-b, --bridge=` flag is set to `docker0` as default bridge network. It is created automatically when you install Docker.
-If you are not using the default, you must create and configure the bridge manually or just set it to 'none': `--bridge=none`
-- `--exec-root` is the path where the container state is stored. The default value is `/var/run/docker`. Specify the path for
-your running daemon here.
-- `--data-root` is the path where persisted data such as images, volumes, and
-cluster state are stored. The default value is `/var/lib/docker`. To avoid any
-conflict with other daemons, set this parameter separately for each daemon.
-- `-p, --pidfile=/var/run/docker.pid` is the path where the process ID of the daemon is stored. Specify the path for your
-pid file here.
-- `--host=[]` specifies where the Docker daemon will listen for client connections. If unspecified, it defaults to `/var/run/docker.sock`.
--  `--iptables=false` prevents the Docker daemon from adding iptables rules. If
-multiple daemons manage iptables rules, they may overwrite rules set by another
-daemon. Be aware that disabling this option requires you to manually add
-iptables rules to expose container ports. If you prevent Docker from adding
-iptables rules, Docker will also not add IP masquerading rules, even if you set
-`--ip-masq` to `true`. Without IP masquerading rules, Docker containers will not be
-able to connect to external hosts or the internet when using network other than
-default bridge.
-- `--config-file=/etc/docker/daemon.json` is the path where configuration file is stored. You can use it instead of
-daemon flags. Specify the path for each daemon.
-- `--tls*` Docker daemon supports `--tlsverify` mode that enforces encrypted and authenticated remote connections.
-The `--tls*` options enable use of specific certificates for individual daemons.
-
-Example script for a separate “bootstrap” instance of the Docker daemon without network:
-
-```bash
-$ sudo dockerd \
-        -H unix:///var/run/docker-bootstrap.sock \
-        -p /var/run/docker-bootstrap.pid \
-        --iptables=false \
-        --ip-masq=false \
-        --bridge=none \
-        --data-root=/var/lib/docker-bootstrap \
-        --exec-root=/var/run/docker-bootstrap
-```
diff --git a/components/engine/docs/reference/commandline/events.md b/components/engine/docs/reference/commandline/events.md
deleted file mode 100644
index 71475b43ec..0000000000
--- a/components/engine/docs/reference/commandline/events.md
+++ /dev/null
@@ -1,345 +0,0 @@
----
-title: "events"
-description: "The events command description and usage"
-keywords: "events, container, report"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/moby/moby/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# events
-
-```markdown
-Usage:  docker events [OPTIONS]
-
-Get real time events from the server
-
-Options:
-  -f, --filter value   Filter output based on conditions provided (default [])
-      --format string  Format the output using the given Go template
-      --help           Print usage
-      --since string   Show all events created since timestamp
-      --until string   Stream events until this timestamp
-```
-
-## Description
-
-Use `docker events` to get real-time events from the server. These events differ
-per Docker object type.
-
-### Object types
-
-#### Containers
-
-Docker containers report the following events:
-
-- `attach`
-- `commit`
-- `copy`
-- `create`
-- `destroy`
-- `detach`
-- `die`
-- `exec_create`
-- `exec_detach`
-- `exec_start`
-- `export`
-- `health_status`
-- `kill`
-- `oom`
-- `pause`
-- `rename`
-- `resize`
-- `restart`
-- `start`
-- `stop`
-- `top`
-- `unpause`
-- `update`
-
-#### Images
-
-Docker images report the following events:
-
-- `delete`
-- `import`
-- `load`
-- `pull`
-- `push`
-- `save`
-- `tag`
-- `untag`
-
-#### Plugins
-
-Docker plugins report the following events:
-
-- `install`
-- `enable`
-- `disable`
-- `remove`
-
-#### Volumes
-
-Docker volumes report the following events:
-
-- `create`
-- `mount`
-- `unmount`
-- `destroy`
-
-#### Networks
-
-Docker networks report the following events:
-
-- `create`
-- `connect`
-- `disconnect`
-- `destroy`
-
-#### Daemons
-
-Docker daemons report the following events:
-
-- `reload`
-
-### Limiting, filtering, and formatting the output
-
-#### Limit events by time
-
-The `--since` and `--until` parameters can be Unix timestamps, date formatted
-timestamps, or Go duration strings (e.g. `10m`, `1h30m`) computed
-relative to the client machine’s time. If you do not provide the `--since` option,
-the command returns only new and/or live events.  Supported formats for date
-formatted time stamps include RFC3339Nano, RFC3339, `2006-01-02T15:04:05`,
-`2006-01-02T15:04:05.999999999`, `2006-01-02Z07:00`, and `2006-01-02`. The local
-timezone on the client will be used if you do not provide either a `Z` or a
-`+-00:00` timezone offset at the end of the timestamp.  When providing Unix
-timestamps enter seconds[.nanoseconds], where seconds is the number of seconds
-that have elapsed since January 1, 1970 (midnight UTC/GMT), not counting leap
-seconds (aka Unix epoch or Unix time), and the optional .nanoseconds field is a
-fraction of a second no more than nine digits long.
-
-#### Filtering
-
-The filtering flag (`-f` or `--filter`) format is of "key=value". If you would
-like to use multiple filters, pass multiple flags (e.g.,
-`--filter "foo=bar" --filter "bif=baz"`)
-
-Using the same filter multiple times will be handled as a *OR*; for example
-`--filter container=588a23dac085 --filter container=a8f7720b8c22` will display
-events for container 588a23dac085 *OR* container a8f7720b8c22
-
-Using multiple filters will be handled as a *AND*; for example
-`--filter container=588a23dac085 --filter event=start` will display events for
-container container 588a23dac085 *AND* the event type is *start*
-
-The currently supported filters are:
-
-* container (`container=<name or id>`)
-* daemon (`daemon=<name or id>`)
-* event (`event=<event action>`)
-* image (`image=<tag or id>`)
-* label (`label=<key>` or `label=<key>=<value>`)
-* network (`network=<name or id>`)
-* plugin (`plugin=<name or id>`)
-* type (`type=<container or image or volume or network or daemon or plugin>`)
-* volume (`volume=<name or id>`)
-
-#### Format
-
-If a format (`--format`) is specified, the given template will be executed
-instead of the default
-format. Go's [text/template](http://golang.org/pkg/text/template/) package
-describes all the details of the format.
-
-If a format is set to `{{json .}}`, the events are streamed as valid JSON
-Lines. For information about JSON Lines, please refer to http://jsonlines.org/ .
-
-## Examples
-
-### Basic example
-
-You'll need two shells for this example.
-
-**Shell 1: Listening for events:**
-
-```bash
-$ docker events
-```
-
-**Shell 2: Start and Stop containers:**
-
-```bash
-$ docker create --name test alpine:latest top
-$ docker start test
-$ docker stop test
-```
-
-**Shell 1: (Again .. now showing events):**
-
-```none
-2017-01-05T00:35:58.859401177+08:00 container create 0fdb48addc82871eb34eb23a847cfd033dedd1a0a37bef2e6d9eb3870fc7ff37 (image=alpine:latest, name=test)
-2017-01-05T00:36:04.703631903+08:00 network connect e2e1f5ceda09d4300f3a846f0acfaa9a8bb0d89e775eb744c5acecd60e0529e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:04.795031609+08:00 container start 0fdb...ff37 (image=alpine:latest, name=test)
-2017-01-05T00:36:09.830268747+08:00 container kill 0fdb...ff37 (image=alpine:latest, name=test, signal=15)
-2017-01-05T00:36:09.840186338+08:00 container die 0fdb...ff37 (exitCode=143, image=alpine:latest, name=test)
-2017-01-05T00:36:09.880113663+08:00 network disconnect e2e...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:09.890214053+08:00 container stop 0fdb...ff37 (image=alpine:latest, name=test)
-```
-
-To exit the `docker events` command, use `CTRL+C`.
-
-### Filter events by time
-
-You can filter the output by an absolute timestamp or relative time on the host
-machine, using the following different time syntaxes:
-
-```bash
-$ docker events --since 1483283804
-2017-01-05T00:35:41.241772953+08:00 volume create testVol (driver=local)
-2017-01-05T00:35:58.859401177+08:00 container create d9cd...4d70 (image=alpine:latest, name=test)
-2017-01-05T00:36:04.703631903+08:00 network connect e2e1...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:04.795031609+08:00 container start 0fdb...ff37 (image=alpine:latest, name=test)
-2017-01-05T00:36:09.830268747+08:00 container kill 0fdb...ff37 (image=alpine:latest, name=test, signal=15)
-2017-01-05T00:36:09.840186338+08:00 container die 0fdb...ff37 (exitCode=143, image=alpine:latest, name=test)
-2017-01-05T00:36:09.880113663+08:00 network disconnect e2e...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:09.890214053+08:00 container stop 0fdb...ff37 (image=alpine:latest, name=test)
-
-$ docker events --since '2017-01-05'
-2017-01-05T00:35:41.241772953+08:00 volume create testVol (driver=local)
-2017-01-05T00:35:58.859401177+08:00 container create d9cd...4d70 (image=alpine:latest, name=test)
-2017-01-05T00:36:04.703631903+08:00 network connect e2e1...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:04.795031609+08:00 container start 0fdb...ff37 (image=alpine:latest, name=test)
-2017-01-05T00:36:09.830268747+08:00 container kill 0fdb...ff37 (image=alpine:latest, name=test, signal=15)
-2017-01-05T00:36:09.840186338+08:00 container die 0fdb...ff37 (exitCode=143, image=alpine:latest, name=test)
-2017-01-05T00:36:09.880113663+08:00 network disconnect e2e...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:09.890214053+08:00 container stop 0fdb...ff37 (image=alpine:latest, name=test)
-
-$ docker events --since '2013-09-03T15:49:29'
-2017-01-05T00:35:41.241772953+08:00 volume create testVol (driver=local)
-2017-01-05T00:35:58.859401177+08:00 container create d9cd...4d70 (image=alpine:latest, name=test)
-2017-01-05T00:36:04.703631903+08:00 network connect e2e1...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:04.795031609+08:00 container start 0fdb...ff37 (image=alpine:latest, name=test)
-2017-01-05T00:36:09.830268747+08:00 container kill 0fdb...ff37 (image=alpine:latest, name=test, signal=15)
-2017-01-05T00:36:09.840186338+08:00 container die 0fdb...ff37 (exitCode=143, image=alpine:latest, name=test)
-2017-01-05T00:36:09.880113663+08:00 network disconnect e2e...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:09.890214053+08:00 container stop 0fdb...ff37 (image=alpine:latest, name=test)
-
-$ docker events --since '10m'
-2017-01-05T00:35:41.241772953+08:00 volume create testVol (driver=local)
-2017-01-05T00:35:58.859401177+08:00 container create d9cd...4d70 (image=alpine:latest, name=test)
-2017-01-05T00:36:04.703631903+08:00 network connect e2e1...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:04.795031609+08:00 container start 0fdb...ff37 (image=alpine:latest, name=test)
-2017-01-05T00:36:09.830268747+08:00 container kill 0fdb...ff37 (image=alpine:latest, name=test, signal=15)
-2017-01-05T00:36:09.840186338+08:00 container die 0fdb...ff37 (exitCode=143, image=alpine:latest, name=test)
-2017-01-05T00:36:09.880113663+08:00 network disconnect e2e...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:09.890214053+08:00 container stop 0fdb...ff37 (image=alpine:latest, name=test)
-```
-
-### Filter events by criteria
-
-The following commands show several different ways to filter the `docker event`
-output.
-
-```bash
-$ docker events --filter 'event=stop'
-
-2017-01-05T00:40:22.880175420+08:00 container stop 0fdb...ff37 (image=alpine:latest, name=test)
-2017-01-05T00:41:17.888104182+08:00 container stop 2a8f...4e78 (image=alpine, name=kickass_brattain)
-
-$ docker events --filter 'image=alpine'
-
-2017-01-05T00:41:55.784240236+08:00 container create d9cd...4d70 (image=alpine, name=happy_meitner)
-2017-01-05T00:41:55.913156783+08:00 container start d9cd...4d70 (image=alpine, name=happy_meitner)
-2017-01-05T00:42:01.106875249+08:00 container kill d9cd...4d70 (image=alpine, name=happy_meitner, signal=15)
-2017-01-05T00:42:11.111934041+08:00 container kill d9cd...4d70 (image=alpine, name=happy_meitner, signal=9)
-2017-01-05T00:42:11.119578204+08:00 container die d9cd...4d70 (exitCode=137, image=alpine, name=happy_meitner)
-2017-01-05T00:42:11.173276611+08:00 container stop d9cd...4d70 (image=alpine, name=happy_meitner)
-
-$ docker events --filter 'container=test'
-
-2017-01-05T00:43:00.139719934+08:00 container start 0fdb...ff37 (image=alpine:latest, name=test)
-2017-01-05T00:43:09.259951086+08:00 container kill 0fdb...ff37 (image=alpine:latest, name=test, signal=15)
-2017-01-05T00:43:09.270102715+08:00 container die 0fdb...ff37 (exitCode=143, image=alpine:latest, name=test)
-2017-01-05T00:43:09.312556440+08:00 container stop 0fdb...ff37 (image=alpine:latest, name=test)
-
-$ docker events --filter 'container=test' --filter 'container=d9cdb1525ea8'
-
-2017-01-05T00:44:11.517071981+08:00 container start 0fdb...ff37 (image=alpine:latest, name=test)
-2017-01-05T00:44:17.685870901+08:00 container start d9cd...4d70 (image=alpine, name=happy_meitner)
-2017-01-05T00:44:29.757658470+08:00 container kill 0fdb...ff37 (image=alpine:latest, name=test, signal=9)
-2017-01-05T00:44:29.767718510+08:00 container die 0fdb...ff37 (exitCode=137, image=alpine:latest, name=test)
-2017-01-05T00:44:29.815798344+08:00 container destroy 0fdb...ff37 (image=alpine:latest, name=test)
-
-$ docker events --filter 'container=test' --filter 'event=stop'
-
-2017-01-05T00:46:13.664099505+08:00 container stop a9d1...e130 (image=alpine, name=test)
-
-$ docker events --filter 'type=volume'
-
-2015-12-23T21:05:28.136212689Z volume create test-event-volume-local (driver=local)
-2015-12-23T21:05:28.383462717Z volume mount test-event-volume-local (read/write=true, container=562f...5025, destination=/foo, driver=local, propagation=rprivate)
-2015-12-23T21:05:28.650314265Z volume unmount test-event-volume-local (container=562f...5025, driver=local)
-2015-12-23T21:05:28.716218405Z volume destroy test-event-volume-local (driver=local)
-
-$ docker events --filter 'type=network'
-
-2015-12-23T21:38:24.705709133Z network create 8b11...2c5b (name=test-event-network-local, type=bridge)
-2015-12-23T21:38:25.119625123Z network connect 8b11...2c5b (name=test-event-network-local, container=b4be...c54e, type=bridge)
-
-$ docker events --filter 'container=container_1' --filter 'container=container_2'
-
-2014-09-03T15:49:29.999999999Z07:00 container die 4386fb97867d (image=ubuntu-1:14.04)
-2014-05-10T17:42:14.999999999Z07:00 container stop 4386fb97867d (image=ubuntu-1:14.04)
-2014-05-10T17:42:14.999999999Z07:00 container die 7805c1d35632 (imager=redis:2.8)
-2014-09-03T15:49:29.999999999Z07:00 container stop 7805c1d35632 (image=redis:2.8)
-
-$ docker events --filter 'type=volume'
-
-2015-12-23T21:05:28.136212689Z volume create test-event-volume-local (driver=local)
-2015-12-23T21:05:28.383462717Z volume mount test-event-volume-local (read/write=true, container=562fe10671e9273da25eed36cdce26159085ac7ee6707105fd534866340a5025, destination=/foo, driver=local, propagation=rprivate)
-2015-12-23T21:05:28.650314265Z volume unmount test-event-volume-local (container=562fe10671e9273da25eed36cdce26159085ac7ee6707105fd534866340a5025, driver=local)
-2015-12-23T21:05:28.716218405Z volume destroy test-event-volume-local (driver=local)
-
-$ docker events --filter 'type=network'
-
-2015-12-23T21:38:24.705709133Z network create 8b111217944ba0ba844a65b13efcd57dc494932ee2527577758f939315ba2c5b (name=test-event-network-local, type=bridge)
-2015-12-23T21:38:25.119625123Z network connect 8b111217944ba0ba844a65b13efcd57dc494932ee2527577758f939315ba2c5b (name=test-event-network-local, container=b4be644031a3d90b400f88ab3d4bdf4dc23adb250e696b6328b85441abe2c54e, type=bridge)
-
-$ docker events --filter 'type=plugin'
-
-2016-07-25T17:30:14.825557616Z plugin pull ec7b87f2ce84330fe076e666f17dfc049d2d7ae0b8190763de94e1f2d105993f (name=tiborvass/sample-volume-plugin:latest)
-2016-07-25T17:30:14.888127370Z plugin enable ec7b87f2ce84330fe076e666f17dfc049d2d7ae0b8190763de94e1f2d105993f (name=tiborvass/sample-volume-plugin:latest)
-```
-
-### Format the output
-
-```bash
-$ docker events --filter 'type=container' --format 'Type={{.Type}}  Status={{.Status}}  ID={{.ID}}'
-
-Type=container  Status=create  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-Type=container  Status=attach  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-Type=container  Status=start  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-Type=container  Status=resize  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-Type=container  Status=die  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-Type=container  Status=destroy  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-```
-
-#### Format as JSON
-
-```none
-    $ docker events --format '{{json .}}'
-
-    {"status":"create","id":"196016a57679bf42424484918746a9474cd905dd993c4d0f4..
-    {"status":"attach","id":"196016a57679bf42424484918746a9474cd905dd993c4d0f4..
-    {"Type":"network","Action":"connect","Actor":{"ID":"1b50a5bf755f6021dfa78e..
-    {"status":"start","id":"196016a57679bf42424484918746a9474cd905dd993c4d0f42..
-    {"status":"resize","id":"196016a57679bf42424484918746a9474cd905dd993c4d0f4..
-```
diff --git a/components/engine/docs/reference/commandline/exec.md b/components/engine/docs/reference/commandline/exec.md
deleted file mode 100644
index e2e5d607b9..0000000000
--- a/components/engine/docs/reference/commandline/exec.md
+++ /dev/null
@@ -1,99 +0,0 @@
----
-title: "exec"
-description: "The exec command description and usage"
-keywords: "command, container, run, execute"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# exec
-
-```markdown
-Usage:  docker exec [OPTIONS] CONTAINER COMMAND [ARG...]
-
-Run a command in a running container
-
-Options:
-  -d, --detach         Detached mode: run command in the background
-      --detach-keys    Override the key sequence for detaching a container
-  -e, --env=[]         Set environment variables
-      --help           Print usage
-  -i, --interactive    Keep STDIN open even if not attached
-      --privileged     Give extended privileges to the command
-  -t, --tty            Allocate a pseudo-TTY
-  -u, --user           Username or UID (format: <name|uid>[:<group|gid>])
-```
-
-## Description
-
-The `docker exec` command runs a new command in a running container.
-
-The command started using `docker exec` only runs while the container's primary
-process (`PID 1`) is running, and it is not restarted if the container is
-restarted.
-
-COMMAND will run in the default directory of the container. It the
-underlying image has a custom directory specified with the WORKDIR directive
-in its Dockerfile, this will be used instead.
-
-COMMAND should be an executable, a chained or a quoted command
-will not work. Example: `docker exec -ti my_container "echo a && echo b"` will
-not work, but `docker exec -ti my_container sh -c "echo a && echo b"` will.
-
-## Examples
-
-### Run `docker exec` on a running container
-
-First, start a container.
-
-```bash
-$ docker run --name ubuntu_bash --rm -i -t ubuntu bash
-```
-
-This will create a container named `ubuntu_bash` and start a Bash session.
-
-Next, execute a command on the container.
-
-```bash
-$ docker exec -d ubuntu_bash touch /tmp/execWorks
-```
-
-This will create a new file `/tmp/execWorks` inside the running container
-`ubuntu_bash`, in the background.
-
-Next, execute an interactive `bash` shell on the container.
-
-```bash
-$ docker exec -it ubuntu_bash bash
-```
-
-This will create a new Bash session in the container `ubuntu_bash`.
-
-### Try to run `docker exec` on a paused container
-
-If the container is paused, then the `docker exec` command will fail with an error:
-
-```bash
-$ docker pause test
-
-test
-
-$ docker ps
-
-CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                   PORTS               NAMES
-1ae3b36715d2        ubuntu:latest       "bash"              17 seconds ago      Up 16 seconds (Paused)                       test
-
-$ docker exec test ls
-
-FATA[0000] Error response from daemon: Container test is paused, unpause the container before exec
-
-$ echo $?
-1
-```
diff --git a/components/engine/docs/reference/commandline/export.md b/components/engine/docs/reference/commandline/export.md
deleted file mode 100644
index 9de509714a..0000000000
--- a/components/engine/docs/reference/commandline/export.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-title: "export"
-description: "The export command description and usage"
-keywords: "export, file, system, container"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# export
-
-```markdown
-Usage:  docker export [OPTIONS] CONTAINER
-
-Export a container's filesystem as a tar archive
-
-Options:
-      --help            Print usage
-  -o, --output string   Write to a file, instead of STDOUT
-```
-
-## Description
-
-The `docker export` command does not export the contents of volumes associated
-with the container. If a volume is mounted on top of an existing directory in
-the container, `docker export` will export the contents of the *underlying*
-directory, not the contents of the volume.
-
-Refer to [Backup, restore, or migrate data volumes](https://docs.docker.com/engine/tutorials/dockervolumes/#backup-restore-or-migrate-data-volumes)
-in the user guide for examples on exporting data in a volume.
-
-## Examples
-
-Each of these commands has the same result.
-
-```bash
-$ docker export red_panda > latest.tar
-```
-
-```bash
-$ docker export --output="latest.tar" red_panda
-```
diff --git a/components/engine/docs/reference/commandline/history.md b/components/engine/docs/reference/commandline/history.md
deleted file mode 100644
index 014ceddaf3..0000000000
--- a/components/engine/docs/reference/commandline/history.md
+++ /dev/null
@@ -1,93 +0,0 @@
----
-title: "history"
-description: "The history command description and usage"
-keywords: "docker, image, history"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# history
-
-```markdown
-Usage:  docker history [OPTIONS] IMAGE
-
-Show the history of an image
-
-Options:
-      --format string   Pretty-print images using a Go template
-      --help            Print usage
-  -H, --human           Print sizes and dates in human readable format (default true)
-      --no-trunc        Don't truncate output
-  -q, --quiet           Only show numeric IDs
-```
-
-
-## Examples
-
-To see how the `docker:latest` image was built:
-
-```bash
-$ docker history docker
-
-IMAGE               CREATED             CREATED BY                                      SIZE                COMMENT
-3e23a5875458        8 days ago          /bin/sh -c #(nop) ENV LC_ALL=C.UTF-8            0 B
-8578938dd170        8 days ago          /bin/sh -c dpkg-reconfigure locales &&    loc   1.245 MB
-be51b77efb42        8 days ago          /bin/sh -c apt-get update && apt-get install    338.3 MB
-4b137612be55        6 weeks ago         /bin/sh -c #(nop) ADD jessie.tar.xz in /        121 MB
-750d58736b4b        6 weeks ago         /bin/sh -c #(nop) MAINTAINER Tianon Gravi <ad   0 B
-511136ea3c5a        9 months ago                                                        0 B                 Imported from -
-```
-
-To see how the `docker:apache` image was added to a container's base image:
-
-```bash
-$ docker history docker:scm
-IMAGE               CREATED             CREATED BY                                      SIZE                COMMENT
-2ac9d1098bf1        3 months ago        /bin/bash                                       241.4 MB            Added Apache to Fedora base image
-88b42ffd1f7c        5 months ago        /bin/sh -c #(nop) ADD file:1fd8d7f9f6557cafc7   373.7 MB
-c69cab00d6ef        5 months ago        /bin/sh -c #(nop) MAINTAINER Lokesh Mandvekar   0 B
-511136ea3c5a        19 months ago                                                       0 B                 Imported from -
-```
-
-### Format the output
-
-The formatting option (`--format`) will pretty-prints history output
-using a Go template.
-
-Valid placeholders for the Go template are listed below:
-
-| Placeholder     | Description |
-| --------------- | ----------- |
-| `.ID`           | Image ID    |
-| `.CreatedSince` | Elapsed time since the image was created if `--human=true`, otherwise timestamp of when image was created |
-| `.CreatedAt`    | Timestamp of when image was created |
-| `.CreatedBy`    | Command that was used to create the image |
-| `.Size`         | Image disk size |
-| `.Comment`      | Comment for image |
-
-When using the `--format` option, the `history` command will either
-output the data exactly as the template declares or, when using the
-`table` directive, will include column headers as well.
-
-The following example uses a template without headers and outputs the
-`ID` and `CreatedSince` entries separated by a colon for all images:
-
-```bash
-$ docker images --format "{{.ID}}: {{.Created}} ago"
-
-cc1b61406712: 2 weeks ago
-<missing>: 2 weeks ago
-<missing>: 2 weeks ago
-<missing>: 2 weeks ago
-<missing>: 2 weeks ago
-<missing>: 3 weeks ago
-<missing>: 3 weeks ago
-<missing>: 3 weeks ago
-```
diff --git a/components/engine/docs/reference/commandline/image.md b/components/engine/docs/reference/commandline/image.md
deleted file mode 100644
index fef161aa99..0000000000
--- a/components/engine/docs/reference/commandline/image.md
+++ /dev/null
@@ -1,47 +0,0 @@
-
----
-title: "image"
-description: "The image command description and usage"
-keywords: "image"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# image
-
-```markdown
-Usage:  docker image COMMAND
-
-Manage images
-
-Options:
-      --help   Print usage
-
-Commands:
-  build       Build an image from a Dockerfile
-  history     Show the history of an image
-  import      Import the contents from a tarball to create a filesystem image
-  inspect     Display detailed information on one or more images
-  load        Load an image from a tar archive or STDIN
-  ls          List images
-  prune       Remove unused images
-  pull        Pull an image or a repository from a registry
-  push        Push an image or a repository to a registry
-  rm          Remove one or more images
-  save        Save one or more images to a tar archive (streamed to STDOUT by default)
-  tag         Create a tag TARGET_IMAGE that refers to SOURCE_IMAGE
-
-Run 'docker image COMMAND --help' for more information on a command.
-
-```
-
-## Description
-
-Manage images.
diff --git a/components/engine/docs/reference/commandline/image_prune.md b/components/engine/docs/reference/commandline/image_prune.md
deleted file mode 100644
index f3b1545407..0000000000
--- a/components/engine/docs/reference/commandline/image_prune.md
+++ /dev/null
@@ -1,171 +0,0 @@
----
-title: "image prune"
-description: "Remove all stopped images"
-keywords: "image, prune, delete, remove"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# image prune
-
-```markdown
-Usage:	docker image prune [OPTIONS]
-
-Remove unused images
-
-Options:
-  -a, --all             Remove all unused images, not just dangling ones
-      --filter filter   Provide filter values (e.g. 'until=<timestamp>')
-  -f, --force           Do not prompt for confirmation
-      --help            Print usage
-```
-
-## Description
-
-Remove all dangling images. If `-a` is specified, will also remove all images not referenced by any container.
-
-## Examples
-
-Example output:
-
-```bash
-$ docker image prune -a
-
-WARNING! This will remove all images without at least one container associated to them.
-Are you sure you want to continue? [y/N] y
-Deleted Images:
-untagged: alpine:latest
-untagged: alpine@sha256:3dcdb92d7432d56604d4545cbd324b14e647b313626d99b889d0626de158f73a
-deleted: sha256:4e38e38c8ce0b8d9041a9c4fefe786631d1416225e13b0bfe8cfa2321aec4bba
-deleted: sha256:4fe15f8d0ae69e169824f25f1d4da3015a48feeeeebb265cd2e328e15c6a869f
-untagged: alpine:3.3
-untagged: alpine@sha256:4fa633f4feff6a8f02acfc7424efd5cb3e76686ed3218abf4ca0fa4a2a358423
-untagged: my-jq:latest
-deleted: sha256:ae67841be6d008a374eff7c2a974cde3934ffe9536a7dc7ce589585eddd83aff
-deleted: sha256:34f6f1261650bc341eb122313372adc4512b4fceddc2a7ecbb84f0958ce5ad65
-deleted: sha256:cf4194e8d8db1cb2d117df33f2c75c0369c3a26d96725efb978cc69e046b87e7
-untagged: my-curl:latest
-deleted: sha256:b2789dd875bf427de7f9f6ae001940073b3201409b14aba7e5db71f408b8569e
-deleted: sha256:96daac0cb203226438989926fc34dd024f365a9a8616b93e168d303cfe4cb5e9
-deleted: sha256:5cbd97a14241c9cd83250d6b6fc0649833c4a3e84099b968dd4ba403e609945e
-deleted: sha256:a0971c4015c1e898c60bf95781c6730a05b5d8a2ae6827f53837e6c9d38efdec
-deleted: sha256:d8359ca3b681cc5396a4e790088441673ed3ce90ebc04de388bfcd31a0716b06
-deleted: sha256:83fc9ba8fb70e1da31dfcc3c88d093831dbd4be38b34af998df37e8ac538260c
-deleted: sha256:ae7041a4cc625a9c8e6955452f7afe602b401f662671cea3613f08f3d9343b35
-deleted: sha256:35e0f43a37755b832f0bbea91a2360b025ee351d7309dae0d9737bc96b6d0809
-deleted: sha256:0af941dd29f00e4510195dd00b19671bc591e29d1495630e7e0f7c44c1e6a8c0
-deleted: sha256:9fc896fc2013da84f84e45b3096053eb084417b42e6b35ea0cce5a3529705eac
-deleted: sha256:47cf20d8c26c46fff71be614d9f54997edacfe8d46d51769706e5aba94b16f2b
-deleted: sha256:2c675ee9ed53425e31a13e3390bf3f539bf8637000e4bcfbb85ee03ef4d910a1
-
-Total reclaimed space: 16.43 MB
-```
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is of "key=value". If there is more
-than one filter, then pass multiple flags (e.g., `--filter "foo=bar" --filter "bif=baz"`)
-
-The currently supported filters are:
-
-* until (`<timestamp>`) - only remove images created before given timestamp
-* label (`label=<key>`, `label=<key>=<value>`, `label!=<key>`, or `label!=<key>=<value>`) - only remove images with (or without, in case `label!=...` is used) the specified labels.
-
-The `until` filter can be Unix timestamps, date formatted
-timestamps, or Go duration strings (e.g. `10m`, `1h30m`) computed
-relative to the daemon machine’s time. Supported formats for date
-formatted time stamps include RFC3339Nano, RFC3339, `2006-01-02T15:04:05`,
-`2006-01-02T15:04:05.999999999`, `2006-01-02Z07:00`, and `2006-01-02`. The local
-timezone on the daemon will be used if you do not provide either a `Z` or a
-`+-00:00` timezone offset at the end of the timestamp.  When providing Unix
-timestamps enter seconds[.nanoseconds], where seconds is the number of seconds
-that have elapsed since January 1, 1970 (midnight UTC/GMT), not counting leap
-seconds (aka Unix epoch or Unix time), and the optional .nanoseconds field is a
-fraction of a second no more than nine digits long.
-
-The `label` filter accepts two formats. One is the `label=...` (`label=<key>` or `label=<key>=<value>`),
-which removes images with the specified labels. The other
-format is the `label!=...` (`label!=<key>` or `label!=<key>=<value>`), which removes
-images without the specified labels.
-
-The following removes images created before `2017-01-04T00:00:00`:
-
-```bash
-$ docker images --format 'table {{.Repository}}\t{{.Tag}}\t{{.ID}}\t{{.CreatedAt}}\t{{.Size}}'
-REPOSITORY          TAG                 IMAGE ID            CREATED AT                      SIZE
-foo                 latest              2f287ac753da        2017-01-04 13:42:23 -0800 PST   3.98 MB
-alpine              latest              88e169ea8f46        2016-12-27 10:17:25 -0800 PST   3.98 MB
-busybox             latest              e02e811dd08f        2016-10-07 14:03:58 -0700 PDT   1.09 MB
-
-$ docker image prune -a --force --filter "until=2017-01-04T00:00:00"
-
-Deleted Images:
-untagged: alpine:latest
-untagged: alpine@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
-untagged: busybox:latest
-untagged: busybox@sha256:29f5d56d12684887bdfa50dcd29fc31eea4aaf4ad3bec43daf19026a7ce69912
-deleted: sha256:e02e811dd08fd49e7f6032625495118e63f597eb150403d02e3238af1df240ba
-deleted: sha256:e88b3f82283bc59d5e0df427c824e9f95557e661fcb0ea15fb0fb6f97760f9d9
-
-Total reclaimed space: 1.093 MB
-
-$ docker images --format 'table {{.Repository}}\t{{.Tag}}\t{{.ID}}\t{{.CreatedAt}}\t{{.Size}}'
-
-REPOSITORY          TAG                 IMAGE ID            CREATED AT                      SIZE
-foo                 latest              2f287ac753da        2017-01-04 13:42:23 -0800 PST   3.98 MB
-```
-
-The following removes images created more than 10 days (`240h`) ago:
-
-```bash
-$ docker images
-
-REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
-foo                 latest              2f287ac753da        14 seconds ago      3.98 MB
-alpine              latest              88e169ea8f46        8 days ago          3.98 MB
-debian              jessie              7b0a06c805e8        2 months ago        123 MB
-busybox             latest              e02e811dd08f        2 months ago        1.09 MB
-golang              1.7.0               138c2e655421        4 months ago        670 MB
-
-$ docker image prune -a --force --filter "until=240h"
-
-Deleted Images:
-untagged: golang:1.7.0
-untagged: golang@sha256:6765038c2b8f407fd6e3ecea043b44580c229ccfa2a13f6d85866cf2b4a9628e
-deleted: sha256:138c2e6554219de65614d88c15521bfb2da674cbb0bf840de161f89ff4264b96
-deleted: sha256:ec353c2e1a673f456c4b78906d0d77f9d9456cfb5229b78c6a960bfb7496b76a
-deleted: sha256:fe22765feaf3907526b4921c73ea6643ff9e334497c9b7e177972cf22f68ee93
-deleted: sha256:ff845959c80148421a5c3ae11cc0e6c115f950c89bc949646be55ed18d6a2912
-deleted: sha256:a4320831346648c03db64149eafc83092e2b34ab50ca6e8c13112388f25899a7
-deleted: sha256:4c76020202ee1d9709e703b7c6de367b325139e74eebd6b55b30a63c196abaf3
-deleted: sha256:d7afd92fb07236c8a2045715a86b7d5f0066cef025018cd3ca9a45498c51d1d6
-deleted: sha256:9e63c5bce4585dd7038d830a1f1f4e44cb1a1515b00e620ac718e934b484c938
-untagged: debian:jessie
-untagged: debian@sha256:c1af755d300d0c65bb1194d24bce561d70c98a54fb5ce5b1693beb4f7988272f
-deleted: sha256:7b0a06c805e8f23807fb8856621c60851727e85c7bcb751012c813f122734c8d
-deleted: sha256:f96222d75c5563900bc4dd852179b720a0885de8f7a0619ba0ac76e92542bbc8
-
-Total reclaimed space: 792.6 MB
-
-$ docker images
-
-REPOSITORY          TAG                 IMAGE ID            CREATED              SIZE
-foo                 latest              2f287ac753da        About a minute ago   3.98 MB
-alpine              latest              88e169ea8f46        8 days ago           3.98 MB
-busybox             latest              e02e811dd08f        2 months ago         1.09 MB
-```
-
-## Related commands
-
-* [system df](system_df.md)
-* [container prune](container_prune.md)
-* [volume prune](volume_prune.md)
-* [network prune](network_prune.md)
-* [system prune](system_prune.md)
diff --git a/components/engine/docs/reference/commandline/images.md b/components/engine/docs/reference/commandline/images.md
deleted file mode 100644
index 86a32aed27..0000000000
--- a/components/engine/docs/reference/commandline/images.md
+++ /dev/null
@@ -1,343 +0,0 @@
----
-title: "images"
-description: "The images command description and usage"
-keywords: "list, docker, images"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# images
-
-```markdown
-Usage:  docker images [OPTIONS] [REPOSITORY[:TAG]]
-
-List images
-
-Options:
-  -a, --all             Show all images (default hides intermediate images)
-      --digests         Show digests
-  -f, --filter value    Filter output based on conditions provided (default [])
-                        - dangling=(true|false)
-                        - label=<key> or label=<key>=<value>
-                        - before=(<image-name>[:tag]|<image-id>|<image@digest>)
-                        - since=(<image-name>[:tag]|<image-id>|<image@digest>)
-                        - reference=(pattern of an image reference)
-      --format string   Pretty-print images using a Go template
-      --help            Print usage
-      --no-trunc        Don't truncate output
-  -q, --quiet           Only show numeric IDs
-```
-
-## Description
-
-The default `docker images` will show all top level
-images, their repository and tags, and their size.
-
-Docker images have intermediate layers that increase reusability,
-decrease disk usage, and speed up `docker build` by
-allowing each step to be cached. These intermediate layers are not shown
-by default.
-
-The `SIZE` is the cumulative space taken up by the image and all
-its parent images. This is also the disk space used by the contents of the
-Tar file created when you `docker save` an image.
-
-An image will be listed more than once if it has multiple repository names
-or tags. This single image (identifiable by its matching `IMAGE ID`)
-uses up the `SIZE` listed only once.
-
-## Examples
-
-### List the most recently created images
-
-```bash
-$ docker images
-
-REPOSITORY                TAG                 IMAGE ID            CREATED             SIZE
-<none>                    <none>              77af4d6b9913        19 hours ago        1.089 GB
-committ                   latest              b6fa739cedf5        19 hours ago        1.089 GB
-<none>                    <none>              78a85c484f71        19 hours ago        1.089 GB
-docker                    latest              30557a29d5ab        20 hours ago        1.089 GB
-<none>                    <none>              5ed6274db6ce        24 hours ago        1.089 GB
-postgres                  9                   746b819f315e        4 days ago          213.4 MB
-postgres                  9.3                 746b819f315e        4 days ago          213.4 MB
-postgres                  9.3.5               746b819f315e        4 days ago          213.4 MB
-postgres                  latest              746b819f315e        4 days ago          213.4 MB
-```
-
-### List images by name and tag
-
-The `docker images` command takes an optional `[REPOSITORY[:TAG]]` argument
-that restricts the list to images that match the argument. If you specify
-`REPOSITORY`but no `TAG`, the `docker images` command lists all images in the
-given repository.
-
-For example, to list all images in the "java" repository, run this command :
-
-```bash
-$ docker images java
-
-REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
-java                8                   308e519aac60        6 days ago          824.5 MB
-java                7                   493d82594c15        3 months ago        656.3 MB
-java                latest              2711b1d6f3aa        5 months ago        603.9 MB
-```
-
-The `[REPOSITORY[:TAG]]` value must be an "exact match". This means that, for example,
-`docker images jav` does not match the image `java`.
-
-If both `REPOSITORY` and `TAG` are provided, only images matching that
-repository and tag are listed.  To find all local images in the "java"
-repository with tag "8" you can use:
-
-```bash
-$ docker images java:8
-
-REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
-java                8                   308e519aac60        6 days ago          824.5 MB
-```
-
-If nothing matches `REPOSITORY[:TAG]`, the list is empty.
-
-```bash
-$ docker images java:0
-
-REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
-```
-
-### List the full length image IDs
-
-```bash
-$ docker images --no-trunc
-
-REPOSITORY                    TAG                 IMAGE ID                                                                  CREATED             SIZE
-<none>                        <none>              sha256:77af4d6b9913e693e8d0b4b294fa62ade6054e6b2f1ffb617ac955dd63fb0182   19 hours ago        1.089 GB
-committest                    latest              sha256:b6fa739cedf5ea12a620a439402b6004d057da800f91c7524b5086a5e4749c9f   19 hours ago        1.089 GB
-<none>                        <none>              sha256:78a85c484f71509adeaace20e72e941f6bdd2b25b4c75da8693efd9f61a37921   19 hours ago        1.089 GB
-docker                        latest              sha256:30557a29d5abc51e5f1d5b472e79b7e296f595abcf19fe6b9199dbbc809c6ff4   20 hours ago        1.089 GB
-<none>                        <none>              sha256:0124422dd9f9cf7ef15c0617cda3931ee68346455441d66ab8bdc5b05e9fdce5   20 hours ago        1.089 GB
-<none>                        <none>              sha256:18ad6fad340262ac2a636efd98a6d1f0ea775ae3d45240d3418466495a19a81b   22 hours ago        1.082 GB
-<none>                        <none>              sha256:f9f1e26352f0a3ba6a0ff68167559f64f3e21ff7ada60366e2d44a04befd1d3a   23 hours ago        1.089 GB
-tryout                        latest              sha256:2629d1fa0b81b222fca63371ca16cbf6a0772d07759ff80e8d1369b926940074   23 hours ago        131.5 MB
-<none>                        <none>              sha256:5ed6274db6ceb2397844896966ea239290555e74ef307030ebb01ff91b1914df   24 hours ago        1.089 GB
-```
-
-### List image digests
-
-Images that use the v2 or later format have a content-addressable identifier
-called a `digest`. As long as the input used to generate the image is
-unchanged, the digest value is predictable. To list image digest values, use
-the `--digests` flag:
-
-```bash
-$ docker images --digests
-REPOSITORY                         TAG                 DIGEST                                                                    IMAGE ID            CREATED             SIZE
-localhost:5000/test/busybox        <none>              sha256:cbbf2f9a99b47fc460d422812b6a5adff7dfee951d8fa2e4a98caa0382cfbdbf   4986bf8c1536        9 weeks ago         2.43 MB
-```
-
-When pushing or pulling to a 2.0 registry, the `push` or `pull` command
-output includes the image digest. You can `pull` using a digest value. You can
-also reference by digest in `create`, `run`, and `rmi` commands, as well as the
-`FROM` image reference in a Dockerfile.
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is of "key=value". If there is more
-than one filter, then pass multiple flags (e.g., `--filter "foo=bar" --filter "bif=baz"`)
-
-The currently supported filters are:
-
-* dangling (boolean - true or false)
-* label (`label=<key>` or `label=<key>=<value>`)
-* before (`<image-name>[:<tag>]`,  `<image id>` or `<image@digest>`) - filter images created before given id or references
-* since (`<image-name>[:<tag>]`,  `<image id>` or `<image@digest>`) - filter images created since given id or references
-* reference (pattern of an image reference) - filter images whose reference matches the specified pattern
-
-#### Show untagged images (dangling)
-
-```bash
-$ docker images --filter "dangling=true"
-
-REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
-<none>              <none>              8abc22fbb042        4 weeks ago         0 B
-<none>              <none>              48e5f45168b9        4 weeks ago         2.489 MB
-<none>              <none>              bf747efa0e2f        4 weeks ago         0 B
-<none>              <none>              980fe10e5736        12 weeks ago        101.4 MB
-<none>              <none>              dea752e4e117        12 weeks ago        101.4 MB
-<none>              <none>              511136ea3c5a        8 months ago        0 B
-```
-
-This will display untagged images that are the leaves of the images tree (not
-intermediary layers). These images occur when a new build of an image takes the
-`repo:tag` away from the image ID, leaving it as `<none>:<none>` or untagged.
-A warning will be issued if trying to remove an image when a container is presently
-using it. By having this flag it allows for batch cleanup.
-
-You can use this in conjunction with `docker rmi ...`:
-
-```bash
-$ docker rmi $(docker images -f "dangling=true" -q)
-
-8abc22fbb042
-48e5f45168b9
-bf747efa0e2f
-980fe10e5736
-dea752e4e117
-511136ea3c5a
-```
-
-> **Note**: Docker warns you if any containers exist that are using these
-> untagged images.
-
-
-#### Show images with a given label
-
-The `label` filter matches images based on the presence of a `label` alone or a `label` and a
-value.
-
-The following filter matches images with the `com.example.version` label regardless of its value.
-
-```bash
-$ docker images --filter "label=com.example.version"
-
-REPOSITORY          TAG                 IMAGE ID            CREATED              SIZE
-match-me-1          latest              eeae25ada2aa        About a minute ago   188.3 MB
-match-me-2          latest              dea752e4e117        About a minute ago   188.3 MB
-```
-
-The following filter matches images with the `com.example.version` label with the `1.0` value.
-
-```bash
-$ docker images --filter "label=com.example.version=1.0"
-
-REPOSITORY          TAG                 IMAGE ID            CREATED              SIZE
-match-me            latest              511136ea3c5a        About a minute ago   188.3 MB
-```
-
-In this example, with the `0.1` value, it returns an empty set because no matches were found.
-
-```bash
-$ docker images --filter "label=com.example.version=0.1"
-REPOSITORY          TAG                 IMAGE ID            CREATED              SIZE
-```
-
-#### Filter images by time
-
-The `before` filter shows only images created before the image with
-given id or reference. For example, having these images:
-
-```bash
-$ docker images
-
-REPOSITORY          TAG                 IMAGE ID            CREATED              SIZE
-image1              latest              eeae25ada2aa        4 minutes ago        188.3 MB
-image2              latest              dea752e4e117        9 minutes ago        188.3 MB
-image3              latest              511136ea3c5a        25 minutes ago       188.3 MB
-```
-
-Filtering with `before` would give:
-
-```bash
-$ docker images --filter "before=image1"
-
-REPOSITORY          TAG                 IMAGE ID            CREATED              SIZE
-image2              latest              dea752e4e117        9 minutes ago        188.3 MB
-image3              latest              511136ea3c5a        25 minutes ago       188.3 MB
-```
-
-Filtering with `since` would give:
-
-```bash
-$ docker images --filter "since=image3"
-REPOSITORY          TAG                 IMAGE ID            CREATED              SIZE
-image1              latest              eeae25ada2aa        4 minutes ago        188.3 MB
-image2              latest              dea752e4e117        9 minutes ago        188.3 MB
-```
-
-#### Filter images by reference
-
-The `reference` filter shows only images whose reference matches
-the specified pattern.
-
-```bash
-$ docker images
-
-REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
-busybox             latest              e02e811dd08f        5 weeks ago         1.09 MB
-busybox             uclibc              e02e811dd08f        5 weeks ago         1.09 MB
-busybox             musl                733eb3059dce        5 weeks ago         1.21 MB
-busybox             glibc               21c16b6787c6        5 weeks ago         4.19 MB
-```
-
-Filtering with `reference` would give:
-
-```bash
-$ docker images --filter=reference='busy*:*libc'
-
-REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
-busybox             uclibc              e02e811dd08f        5 weeks ago         1.09 MB
-busybox             glibc               21c16b6787c6        5 weeks ago         4.19 MB
-```
-
-### Format the output
-
-The formatting option (`--format`) will pretty print container output
-using a Go template.
-
-Valid placeholders for the Go template are listed below:
-
-| Placeholder | Description|
-| ---- | ---- |
-| `.ID` | Image ID |
-| `.Repository` | Image repository |
-| `.Tag` | Image tag |
-| `.Digest` | Image digest |
-| `.CreatedSince` | Elapsed time since the image was created |
-| `.CreatedAt` | Time when the image was created |
-| `.Size` | Image disk size |
-
-When using the `--format` option, the `image` command will either
-output the data exactly as the template declares or, when using the
-`table` directive, will include column headers as well.
-
-The following example uses a template without headers and outputs the
-`ID` and `Repository` entries separated by a colon for all images:
-
-```bash
-$ docker images --format "{{.ID}}: {{.Repository}}"
-
-77af4d6b9913: <none>
-b6fa739cedf5: committ
-78a85c484f71: <none>
-30557a29d5ab: docker
-5ed6274db6ce: <none>
-746b819f315e: postgres
-746b819f315e: postgres
-746b819f315e: postgres
-746b819f315e: postgres
-```
-
-To list all images with their repository and tag in a table format you
-can use:
-
-```bash
-$ docker images --format "table {{.ID}}\t{{.Repository}}\t{{.Tag}}"
-
-IMAGE ID            REPOSITORY                TAG
-77af4d6b9913        <none>                    <none>
-b6fa739cedf5        committ                   latest
-78a85c484f71        <none>                    <none>
-30557a29d5ab        docker                    latest
-5ed6274db6ce        <none>                    <none>
-746b819f315e        postgres                  9
-746b819f315e        postgres                  9.3
-746b819f315e        postgres                  9.3.5
-746b819f315e        postgres                  latest
-```
diff --git a/components/engine/docs/reference/commandline/import.md b/components/engine/docs/reference/commandline/import.md
deleted file mode 100644
index 57edf650c9..0000000000
--- a/components/engine/docs/reference/commandline/import.md
+++ /dev/null
@@ -1,89 +0,0 @@
----
-title: "import"
-description: "The import command description and usage"
-keywords: "import, file, system, container"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# import
-
-```markdown
-Usage:  docker import [OPTIONS] file|URL|- [REPOSITORY[:TAG]]
-
-Import the contents from a tarball to create a filesystem image
-
-Options:
-  -c, --change value     Apply Dockerfile instruction to the created image (default [])
-      --help             Print usage
-  -m, --message string   Set commit message for imported image
-```
-
-## Description
-
-You can specify a `URL` or `-` (dash) to take data directly from `STDIN`. The
-`URL` can point to an archive (.tar, .tar.gz, .tgz, .bzip, .tar.xz, or .txz)
-containing a filesystem or to an individual file on the Docker host.  If you
-specify an archive, Docker untars it in the container relative to the `/`
-(root). If you specify an individual file, you must specify the full path within
-the host. To import from a remote location, specify a `URI` that begins with the
-`http://` or `https://` protocol.
-
-The `--change` option will apply `Dockerfile` instructions to the image
-that is created.
-Supported `Dockerfile` instructions:
-`CMD`|`ENTRYPOINT`|`ENV`|`EXPOSE`|`ONBUILD`|`USER`|`VOLUME`|`WORKDIR`
-
-## Examples
-
-### Import from a remote location
-
-This will create a new untagged image.
-
-```bash
-$ docker import http://example.com/exampleimage.tgz
-```
-
-### Import from a local file
-
-- Import to docker via pipe and `STDIN`.
-
-  ```bash
-  $ cat exampleimage.tgz | docker import - exampleimagelocal:new
-  ```
-
-- Import with a commit message.
-
-  ```bash
-  $ cat exampleimage.tgz | docker import --message "New image imported from tarball" - exampleimagelocal:new
-  ```
-
-- Import to docker from a local archive.
-
-  ```bash
-    $ docker import /path/to/exampleimage.tgz
-  ```
-
-### Import from a local directory
-
-```bash
-$ sudo tar -c . | docker import - exampleimagedir
-```
-
-### Import from a local directory with new configurations
-
-```bash
-$ sudo tar -c . | docker import --change "ENV DEBUG true" - exampleimagedir
-```
-
-Note the `sudo` in this example – you must preserve
-the ownership of the files (especially root ownership) during the
-archiving with tar. If you are not root (or the sudo command) when you
-tar, then the ownerships might not get preserved.
diff --git a/components/engine/docs/reference/commandline/index.md b/components/engine/docs/reference/commandline/index.md
deleted file mode 100644
index c000082fab..0000000000
--- a/components/engine/docs/reference/commandline/index.md
+++ /dev/null
@@ -1,184 +0,0 @@
----
-title: "Docker commands"
-description: "Docker's CLI command description and usage"
-keywords: "Docker, Docker documentation, CLI, command line"
-identifier: "smn_cli_guide"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# The Docker commands
-
-This section contains reference information on using Docker's command line
-client. Each command has a reference page along with samples. If you are
-unfamiliar with the command line, you should start by reading about how to [Use
-the Docker command line](cli.md).
-
-You start the Docker daemon with the command line. How you start the daemon
-affects your Docker containers. For that reason you should also make sure to
-read the [`dockerd`](dockerd.md) reference page.
-
-## Commands by object
-
-### Docker management commands
-
-| Command | Description                                                        |
-|:--------|:-------------------------------------------------------------------|
-| [dockerd](dockerd.md) | Launch the Docker daemon                             |
-| [info](info.md) | Display system-wide information                            |
-| [inspect](inspect.md)| Return low-level information on a container or image  |
-| [version](version.md) | Show the Docker version information                  |
-
-
-### Image commands
-
-| Command | Description                                                        |
-|:--------|:-------------------------------------------------------------------|
-| [build](build.md) |  Build an image from a Dockerfile                        |
-| [commit](commit.md) | Create a new image from a container's changes          |
-| [history](history.md) | Show the history of an image                         |
-| [images](images.md) | List images                                            |
-| [import](import.md) | Import the contents from a tarball to create a filesystem image |
-| [load](load.md) | Load an image from a tar archive or STDIN                  |
-| [image prune](image_prune.md) | Remove unused images                         |
-| [rmi](rmi.md) | Remove one or more images                                    |
-| [save](save.md) | Save images to a tar archive                               |
-| [tag](tag.md) | Tag an image into a repository                               |
-
-### Container commands
-
-| Command | Description                                                        |
-|:--------|:-------------------------------------------------------------------|
-| [attach](attach.md) | Attach to a running container                          |
-| [container prune](container_prune.md) | Remove all stopped containers        |
-| [cp](cp.md) | Copy files/folders from a container to a HOSTDIR or to STDOUT  |
-| [create](create.md) | Create a new container                                 |
-| [diff](diff.md) | Inspect changes on a container's filesystem                |
-| [events](events.md) | Get real time events from the server                   |
-| [exec](exec.md) | Run a command in a running container                       |
-| [export](export.md) | Export a container's filesystem as a tar archive       |
-| [kill](kill.md) | Kill a running container                                   |
-| [logs](logs.md) | Fetch the logs of a container                              |
-| [pause](pause.md) | Pause all processes within a container                   |
-| [port](port.md) | List port mappings or a specific mapping for the container |
-| [ps](ps.md) | List containers                                                |
-| [rename](rename.md) | Rename a container                                     |
-| [restart](restart.md) | Restart a running container                          |
-| [rm](rm.md) | Remove one or more containers                                  |
-| [run](run.md) | Run a command in a new container                             |
-| [start](start.md) | Start one or more stopped containers                     |
-| [stats](stats.md) | Display a live stream of container(s) resource usage  statistics |
-| [stop](stop.md) | Stop a running container                                   |
-| [top](top.md) | Display the running processes of a container                 |
-| [unpause](unpause.md) | Unpause all processes within a container             |
-| [update](update.md) | Update configuration of one or more containers         |
-| [wait](wait.md) | Block until a container stops, then print its exit code    |
-
-### Hub and registry commands
-
-| Command | Description                                                        |
-|:--------|:-------------------------------------------------------------------|
-| [login](login.md) | Register or log in to a Docker registry                  |
-| [logout](logout.md) | Log out from a Docker registry                         |
-| [pull](pull.md) | Pull an image or a repository from a Docker registry       |
-| [push](push.md) | Push an image or a repository to a Docker registry         |
-| [search](search.md) | Search the Docker Hub for images                       |
-
-### Network and connectivity commands
-
-| Command | Description                                                        |
-|:--------|:-------------------------------------------------------------------|
-| [network connect](network_connect.md) | Connect a container to a network     |
-| [network create](network_create.md) | Create a new network                   |
-| [network disconnect](network_disconnect.md) | Disconnect a container from a network |
-| [network inspect](network_inspect.md) | Display information about a network  |
-| [network ls](network_ls.md) | Lists all the networks the Engine `daemon` knows about |
-| [network prune](network_prune.md) | Remove all unused networks               |
-| [network rm](network_rm.md) | Removes one or more networks                   |
-
-### Shared data volume commands
-
-| Command | Description                                                        |
-|:--------|:-------------------------------------------------------------------|
-| [volume create](volume_create.md) | Creates a new volume where containers can consume and store data |
-| [volume inspect](volume_inspect.md) | Display information about a volume     |
-| [volume ls](volume_ls.md) | Lists all the volumes Docker knows about         |
-| [volume prune](volume_prune.md) | Remove all unused volumes                  |
-| [volume rm](volume_rm.md) | Remove one or more volumes                       |
-
-### Swarm node commands
-
-| Command | Description                                                        |
-|:--------|:-------------------------------------------------------------------|
-| [node demote](node_demote.md) | Demotes an existing manager so that it is no longer a manager |
-| [node inspect](node_inspect.md) | Inspect a node in the swarm                |
-| [node ls](node_ls.md) | List nodes in the swarm                              |
-| [node promote](node_promote.md) | Promote a node that is pending a promotion to manager |
-| [node ps](node_ps.md) | List tasks running on one or more nodes                         |
-| [node rm](node_rm.md) | Remove one or more nodes from the swarm                         |
-| [node update](node_update.md) | Update attributes for a node                 |
-
-### Swarm management commands
-
-| Command | Description                                                        |
-|:--------|:-------------------------------------------------------------------|
-| [swarm init](swarm_init.md) | Initialize a swarm                             |
-| [swarm join](swarm_join.md) | Join a swarm as a manager node or worker node  |
-| [swarm leave](swarm_leave.md) | Remove the current node from the swarm       |
-| [swarm join-token](swarm_join_token.md) | Display or rotate join tokens      |
-| [swarm unlock](swarm_unlock.md) | Unlock swarm                               |
-| [swarm unlock-key](swarm_unlock_key.md) | Manage the unlock key              |
-| [swarm update](swarm_update.md) | Update attributes of a swarm               |
-
-### Swarm service commands
-
-| Command | Description                                                        |
-|:--------|:-------------------------------------------------------------------|
-| [service create](service_create.md) | Create a new service                   |
-| [service inspect](service_inspect.md) | Inspect a service                    |
-| [service logs](service_logs.md)  | Fetch the logs of a service or task       |
-| [service ls](service_ls.md) | List services in the swarm                     |
-| [service ps](service_ps.md) | List the tasks of a service              |
-| [service rm](service_rm.md) | Remove a service from the swarm                |
-| [service scale](service_scale.md) | Set the number of replicas for the desired state of the service |
-| [service update](service_update.md)  | Update the attributes of a service    |
-
-### Swarm secret commands
-
-| Command | Description                                                        |
-|:--------|:-------------------------------------------------------------------|
-| [secret create](secret_create.md) | Create a secret from a file or STDIN as content |
-| [secret inspect](service_inspect.md) | Inspect the specified secret          |
-| [secret ls](secret_ls.md) | List secrets in the swarm                        |
-| [secret rm](secret_rm.md) | Remove the specified secrets from the swarm      |
-
-### Swarm stack commands
-
-| Command | Description                                                        |
-|:--------|:-------------------------------------------------------------------|
-| [stack deploy](stack_deploy.md) | Deploy a new stack or update an existing stack |
-| [stack ls](stack_ls.md) | List stacks in the swarm                           |
-| [stack ps](stack_ps.md) | List the tasks in the stack                        |
-| [stack rm](stack_rm.md) | Remove the stack from the swarm                    |
-| [stack services](stack_services.md) | List the services in the stack         |
-
-### Plugin commands
-
-| Command | Description                                                        |
-|:--------|:-------------------------------------------------------------------|
-| [plugin create](plugin_create.md) | Create a plugin from a rootfs and configuration |
-| [plugin disable](plugin_disable.md) | Disable a plugin                       |
-| [plugin enable](plugin_enable.md)  | Enable a plugin                         |
-| [plugin inspect](plugin_inspect.md) | Display detailed information on a plugin |
-| [plugin install](plugin_install.md) | Install a plugin                       |
-| [plugin ls](plugin_ls.md) | List plugins                                     |
-| [plugin push](plugin_push.md) | Push a plugin to a registry                  |
-| [plugin rm](plugin_rm.md) | Remove a plugin                                  |
-| [plugin set](plugin_set.md)  | Change settings for a plugin                  |
diff --git a/components/engine/docs/reference/commandline/info.md b/components/engine/docs/reference/commandline/info.md
deleted file mode 100644
index 9929c04af3..0000000000
--- a/components/engine/docs/reference/commandline/info.md
+++ /dev/null
@@ -1,245 +0,0 @@
----
-title: "info"
-description: "The info command description and usage"
-keywords: "display, docker, information"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# info
-
-```markdown
-Usage:  docker info [OPTIONS]
-
-Display system-wide information
-
-Options:
-  -f, --format string   Format the output using the given Go template
-      --help            Print usage
-```
-
-## Description
-
-This command displays system wide information regarding the Docker installation.
-Information displayed includes the kernel version, number of containers and images.
-The number of images shown is the number of unique images. The same image tagged
-under different names is counted only once.
-
-If a format is specified, the given template will be executed instead of the
-default format. Go's [text/template](http://golang.org/pkg/text/template/) package
-describes all the details of the format.
-
-Depending on the storage driver in use, additional information can be shown, such
-as pool name, data file, metadata file, data space used, total data space, metadata
-space used, and total metadata space.
-
-The data file is where the images are stored and the metadata file is where the
-meta data regarding those images are stored. When run for the first time Docker
-allocates a certain amount of data space and meta data space from the space
-available on the volume where `/var/lib/docker` is mounted.
-
-## Examples
-
-### Show output
-
-The example below shows the output for a daemon running on Red Hat Enterprise Linux,
-using the `devicemapper` storage driver. As can be seen in the output, additional
-information about the `devicemapper` storage driver is shown:
-
-```bash
-$ docker info
-
-Containers: 14
- Running: 3
- Paused: 1
- Stopped: 10
-Images: 52
-Server Version: 1.10.3
-Storage Driver: devicemapper
- Pool Name: docker-202:2-25583803-pool
- Pool Blocksize: 65.54 kB
- Base Device Size: 10.74 GB
- Backing Filesystem: xfs
- Data file: /dev/loop0
- Metadata file: /dev/loop1
- Data Space Used: 1.68 GB
- Data Space Total: 107.4 GB
- Data Space Available: 7.548 GB
- Metadata Space Used: 2.322 MB
- Metadata Space Total: 2.147 GB
- Metadata Space Available: 2.145 GB
- Udev Sync Supported: true
- Deferred Removal Enabled: false
- Deferred Deletion Enabled: false
- Deferred Deleted Device Count: 0
- Data loop file: /var/lib/docker/devicemapper/devicemapper/data
- Metadata loop file: /var/lib/docker/devicemapper/devicemapper/metadata
- Library Version: 1.02.107-RHEL7 (2015-12-01)
-Execution Driver: native-0.2
-Logging Driver: json-file
-Plugins:
- Volume: local
- Network: null host bridge
-Kernel Version: 3.10.0-327.el7.x86_64
-Operating System: Red Hat Enterprise Linux Server 7.2 (Maipo)
-OSType: linux
-Architecture: x86_64
-CPUs: 1
-Total Memory: 991.7 MiB
-Name: ip-172-30-0-91.ec2.internal
-ID: I54V:OLXT:HVMM:TPKO:JPHQ:CQCD:JNLC:O3BZ:4ZVJ:43XJ:PFHZ:6N2S
-Docker Root Dir: /var/lib/docker
-Debug mode (client): false
-Debug mode (server): false
-Username: gordontheturtle
-Registry: https://index.docker.io/v1/
-Insecure registries:
- myinsecurehost:5000
- 127.0.0.0/8
-```
-
-### Show debugging output
-
-Here is a sample output for a daemon running on Ubuntu, using the overlay2
-storage driver and a node that is part of a 2-node swarm:
-
-```bash
-$ docker -D info
-
-Containers: 14
- Running: 3
- Paused: 1
- Stopped: 10
-Images: 52
-Server Version: 1.13.0
-Storage Driver: overlay2
- Backing Filesystem: extfs
- Supports d_type: true
- Native Overlay Diff: false
-Logging Driver: json-file
-Cgroup Driver: cgroupfs
-Plugins:
- Volume: local
- Network: bridge host macvlan null overlay
-Swarm: active
- NodeID: rdjq45w1op418waxlairloqbm
- Is Manager: true
- ClusterID: te8kdyw33n36fqiz74bfjeixd
- Managers: 1
- Nodes: 2
- Orchestration:
-  Task History Retention Limit: 5
- Raft:
-  Snapshot Interval: 10000
-  Number of Old Snapshots to Retain: 0
-  Heartbeat Tick: 1
-  Election Tick: 3
- Dispatcher:
-  Heartbeat Period: 5 seconds
- CA Configuration:
-  Expiry Duration: 3 months
- Root Rotation In Progress: false
- Node Address: 172.16.66.128 172.16.66.129
- Manager Addresses:
-  172.16.66.128:2477
-Runtimes: runc
-Default Runtime: runc
-Init Binary: docker-init
-containerd version: 8517738ba4b82aff5662c97ca4627e7e4d03b531
-runc version: ac031b5bf1cc92239461125f4c1ffb760522bbf2
-init version: N/A (expected: v0.13.0)
-Security Options:
- apparmor
- seccomp
-  Profile: default
-Kernel Version: 4.4.0-31-generic
-Operating System: Ubuntu 16.04.1 LTS
-OSType: linux
-Architecture: x86_64
-CPUs: 2
-Total Memory: 1.937 GiB
-Name: ubuntu
-ID: H52R:7ZR6:EIIA:76JG:ORIY:BVKF:GSFU:HNPG:B5MK:APSC:SZ3Q:N326
-Docker Root Dir: /var/lib/docker
-Debug Mode (client): true
-Debug Mode (server): true
- File Descriptors: 30
- Goroutines: 123
- System Time: 2016-11-12T17:24:37.955404361-08:00
- EventsListeners: 0
-Http Proxy: http://test:test@proxy.example.com:8080
-Https Proxy: https://test:test@proxy.example.com:8080
-No Proxy: localhost,127.0.0.1,docker-registry.somecorporation.com
-Registry: https://index.docker.io/v1/
-WARNING: No swap limit support
-Labels:
- storage=ssd
- staging=true
-Experimental: false
-Insecure Registries:
- 127.0.0.0/8
-Registry Mirrors:
-  http://192.168.1.2/
-  http://registry-mirror.example.com:5000/
-Live Restore Enabled: false
-```
-
-The global `-D` option causes all `docker` commands to output debug information.
-
-### Format the output
-
-You can also specify the output format:
-
-```bash
-$ docker info --format '{{json .}}'
-
-{"ID":"I54V:OLXT:HVMM:TPKO:JPHQ:CQCD:JNLC:O3BZ:4ZVJ:43XJ:PFHZ:6N2S","Containers":14, ...}
-```
-
-### Run `docker info` on Windows
-
-Here is a sample output for a daemon running on Windows Server 2016:
-
-```none
-E:\docker>docker info
-
-Containers: 1
- Running: 0
- Paused: 0
- Stopped: 1
-Images: 17
-Server Version: 1.13.0
-Storage Driver: windowsfilter
- Windows:
-Logging Driver: json-file
-Plugins:
- Volume: local
- Network: nat null overlay
-Swarm: inactive
-Default Isolation: process
-Kernel Version: 10.0 14393 (14393.206.amd64fre.rs1_release.160912-1937)
-Operating System: Windows Server 2016 Datacenter
-OSType: windows
-Architecture: x86_64
-CPUs: 8
-Total Memory: 3.999 GiB
-Name: WIN-V0V70C0LU5P
-ID: NYMS:B5VK:UMSL:FVDZ:EWB5:FKVK:LPFL:FJMQ:H6FT:BZJ6:L2TD:XH62
-Docker Root Dir: C:\control
-Debug Mode (client): false
-Debug Mode (server): false
-Registry: https://index.docker.io/v1/
-Insecure Registries:
- 127.0.0.0/8
-Registry Mirrors:
-  http://192.168.1.2/
-  http://registry-mirror.example.com:5000/
-Live Restore Enabled: false
-```
diff --git a/components/engine/docs/reference/commandline/inspect.md b/components/engine/docs/reference/commandline/inspect.md
deleted file mode 100644
index 9ce4f5f517..0000000000
--- a/components/engine/docs/reference/commandline/inspect.md
+++ /dev/null
@@ -1,122 +0,0 @@
----
-title: "inspect"
-description: "The inspect command description and usage"
-keywords: "inspect, container, json"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# inspect
-
-```markdown
-Usage:  docker inspect [OPTIONS] NAME|ID [NAME|ID...]
-
-Return low-level information on Docker object(s) (e.g. container, image, volume,
-network, node, service, or task) identified by name or ID
-
-Options:
-  -f, --format       Format the output using the given Go template
-      --help         Print usage
-  -s, --size         Display total file sizes if the type is container
-      --type         Return JSON for specified type
-```
-
-## Description
-
-Docker inspect provides detailed information on constructs controlled by Docker.
-
-By default, `docker inspect` will render results in a JSON array.
-
-## Request a custom response format (--format)
-
-If a format is specified, the given template will be executed for each result.
-
-Go's [text/template](http://golang.org/pkg/text/template/) package
-describes all the details of the format.
-
-## Specify target type (--type)
-
-`--type container|image|node|network|secret|service|volume|task|plugin`
-
-The `docker inspect` command matches any type of object by either ID or name.
-In some cases multiple type of objects (for example, a container and a volume)
-exist with the same name, making the result ambigious.
-
-To restrict `docker inspect` to a specific type of object, use the `--type`
-option.
-
-The following example inspects a _volume_ named "myvolume"
-
-```bash
-$ docker inspect --type=volume myvolume
-```
-
-## Examples
-
-### Get an instance's IP address
-
-For the most part, you can pick out any field from the JSON in a fairly
-straightforward manner.
-
-```bash
-$ docker inspect --format='{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' $INSTANCE_ID
-```
-
-### Get an instance's MAC address
-
-```bash
-$ docker inspect --format='{{range .NetworkSettings.Networks}}{{.MacAddress}}{{end}}' $INSTANCE_ID
-```
-
-### Get an instance's log path
-
-```bash
-$ docker inspect --format='{{.LogPath}}' $INSTANCE_ID
-```
-
-### Get an instance's image name
-
-```bash
-$ docker inspect --format='{{.Config.Image}}' $INSTANCE_ID
-```
-
-### List all port bindings
-
-You can loop over arrays and maps in the results to produce simple text
-output:
-
-```bash
-$ docker inspect --format='{{range $p, $conf := .NetworkSettings.Ports}} {{$p}} -> {{(index $conf 0).HostPort}} {{end}}' $INSTANCE_ID
-```
-
-### Find a specific port mapping
-
-The `.Field` syntax doesn't work when the field name begins with a
-number, but the template language's `index` function does. The
-`.NetworkSettings.Ports` section contains a map of the internal port
-mappings to a list of external address/port objects. To grab just the
-numeric public port, you use `index` to find the specific port map, and
-then `index` 0 contains the first object inside of that. Then we ask for
-the `HostPort` field to get the public address.
-
-```bash
-$ docker inspect --format='{{(index (index .NetworkSettings.Ports "8787/tcp") 0).HostPort}}' $INSTANCE_ID
-```
-
-### Get a subsection in JSON format
-
-If you request a field which is itself a structure containing other
-fields, by default you get a Go-style dump of the inner values.
-Docker adds a template function, `json`, which can be applied to get
-results in JSON format.
-
-```bash
-$ docker inspect --format='{{json .Config}}' $INSTANCE_ID
-```
diff --git a/components/engine/docs/reference/commandline/kill.md b/components/engine/docs/reference/commandline/kill.md
deleted file mode 100644
index 97b15add9b..0000000000
--- a/components/engine/docs/reference/commandline/kill.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-title: "kill"
-description: "The kill command description and usage"
-keywords: "container, kill, signal"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# kill
-
-```markdown
-Usage:  docker kill [OPTIONS] CONTAINER [CONTAINER...]
-
-Kill one or more running containers
-
-Options:
-      --help            Print usage
-  -s, --signal string   Signal to send to the container (default "KILL")
-```
-
-## Description
-
-The main process inside the container will be sent `SIGKILL`, or any
-signal specified with option `--signal`.
-
-> **Note**: `ENTRYPOINT` and `CMD` in the *shell* form run as a subcommand of
-> `/bin/sh -c`, which does not pass signals. This means that the executable is
-> not the container’s PID 1 and does not receive Unix signals.
diff --git a/components/engine/docs/reference/commandline/load.md b/components/engine/docs/reference/commandline/load.md
deleted file mode 100644
index 3ce6c19e24..0000000000
--- a/components/engine/docs/reference/commandline/load.md
+++ /dev/null
@@ -1,62 +0,0 @@
----
-title: "load"
-description: "The load command description and usage"
-keywords: "stdin, tarred, repository"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# load
-
-```markdown
-Usage:  docker load [OPTIONS]
-
-Load an image from a tar archive or STDIN
-
-Options:
-      --help           Print usage
-  -i, --input string   Read from tar archive file, instead of STDIN.
-                       The tarball may be compressed with gzip, bzip, or xz
-  -q, --quiet          Suppress the load output but still outputs the imported images
-```
-## Description
-
-`docker load` loads a tarred repository from a file or the standard input stream.
-It restores both images and tags.
-
-## Examples
-
-```bash
-$ docker images
-
-REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
-
-$ docker load < busybox.tar.gz
-
-Loaded image: busybox:latest
-$ docker images
-REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
-busybox             latest              769b9341d937        7 weeks ago         2.489 MB
-
-$ docker load --input fedora.tar
-
-Loaded image: fedora:rawhide
-
-Loaded image: fedora:20
-
-$ docker images
-
-REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
-busybox             latest              769b9341d937        7 weeks ago         2.489 MB
-fedora              rawhide             0d20aec6529d        7 weeks ago         387 MB
-fedora              20                  58394af37342        7 weeks ago         385.5 MB
-fedora              heisenbug           58394af37342        7 weeks ago         385.5 MB
-fedora              latest              58394af37342        7 weeks ago         385.5 MB
-```
diff --git a/components/engine/docs/reference/commandline/login.md b/components/engine/docs/reference/commandline/login.md
deleted file mode 100644
index 0b8e697281..0000000000
--- a/components/engine/docs/reference/commandline/login.md
+++ /dev/null
@@ -1,158 +0,0 @@
----
-title: "login"
-description: "The login command description and usage"
-keywords: "registry, login, image"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# login
-
-```markdown
-Usage:  docker login [OPTIONS] [SERVER]
-
-Log in to a Docker registry.
-If no server is specified, the default is defined by the daemon.
-
-Options:
-      --help              Print usage
-  -p, --password string   Password
-  -u, --username string   Username
-```
-
-## Description
-
-Login to a registry.
-
-### Login to a self-hosted registry
-
-If you want to login to a self-hosted registry you can specify this by
-adding the server name.
-
-```bash
-$ docker login localhost:8080
-```
-
-### Privileged user requirement
-
-`docker login` requires user to use `sudo` or be `root`, except when:
-
-1.  connecting to a remote daemon, such as a `docker-machine` provisioned `docker engine`.
-2.  user is added to the `docker` group.  This will impact the security of your system; the `docker` group is `root` equivalent.  See [Docker Daemon Attack Surface](https://docs.docker.com/security/security/#docker-daemon-attack-surface) for details.
-
-You can log into any public or private repository for which you have
-credentials.  When you log in, the command stores encoded credentials in
-`$HOME/.docker/config.json` on Linux or `%USERPROFILE%/.docker/config.json` on Windows.
-
-### Credentials store
-
-The Docker Engine can keep user credentials in an external credentials store,
-such as the native keychain of the operating system. Using an external store
-is more secure than storing credentials in the Docker configuration file.
-
-To use a credentials store, you need an external helper program to interact
-with a specific keychain or external store. Docker requires the helper
-program to be in the client's host `$PATH`.
-
-This is the list of currently available credentials helpers and where
-you can download them from:
-
-- D-Bus Secret Service: https://github.com/docker/docker-credential-helpers/releases
-- Apple macOS keychain: https://github.com/docker/docker-credential-helpers/releases
-- Microsoft Windows Credential Manager: https://github.com/docker/docker-credential-helpers/releases
-
-You need to specify the credentials store in `$HOME/.docker/config.json`
-to tell the docker engine to use it. The value of the config property should be
-the suffix of the program to use (i.e. everything after `docker-credential-`).
-For example, to use `docker-credential-osxkeychain`:
-
-```json
-{
-	"credsStore": "osxkeychain"
-}
-```
-
-If you are currently logged in, run `docker logout` to remove
-the credentials from the file and run `docker login` again.
-
-### Credential helper protocol
-
-Credential helpers can be any program or script that follows a very simple protocol.
-This protocol is heavily inspired by Git, but it differs in the information shared.
-
-The helpers always use the first argument in the command to identify the action.
-There are only three possible values for that argument: `store`, `get`, and `erase`.
-
-The `store` command takes a JSON payload from the standard input. That payload carries
-the server address, to identify the credential, the user name, and either a password
-or an identity token.
-
-```json
-{
-	"ServerURL": "https://index.docker.io/v1",
-	"Username": "david",
-	"Secret": "passw0rd1"
-}
-```
-
-If the secret being stored is an identity token, the Username should be set to
-`<token>`.
-
-The `store` command can write error messages to `STDOUT` that the docker engine
-will show if there was an issue.
-
-The `get` command takes a string payload from the standard input. That payload carries
-the server address that the docker engine needs credentials for. This is
-an example of that payload: `https://index.docker.io/v1`.
-
-The `get` command writes a JSON payload to `STDOUT`. Docker reads the user name
-and password from this payload:
-
-```json
-{
-	"Username": "david",
-	"Secret": "passw0rd1"
-}
-```
-
-The `erase` command takes a string payload from `STDIN`. That payload carries
-the server address that the docker engine wants to remove credentials for. This is
-an example of that payload: `https://index.docker.io/v1`.
-
-The `erase` command can write error messages to `STDOUT` that the docker engine
-will show if there was an issue.
-
-### Credential helpers
-
-Credential helpers are similar to the credential store above, but act as the
-designated programs to handle credentials for *specific registries*. The default
-credential store (`credsStore` or the config file itself) will not be used for
-operations concerning credentials of the specified registries.
-
-### Logging out
-
-If you are currently logged in, run `docker logout` to remove
-the credentials from the default store.
-
-Credential helpers are specified in a similar way to `credsStore`, but
-allow for multiple helpers to be configured at a time. Keys specify the
-registry domain, and values specify the suffix of the program to use
-(i.e. everything after `docker-credential-`).
-For example:
-
-```json
-{
-  "credHelpers": {
-    "registry.example.com": "registryhelper",
-    "awesomereg.example.org": "hip-star",
-    "unicorn.example.io": "vcbait"
-  }
-}
-```
diff --git a/components/engine/docs/reference/commandline/logout.md b/components/engine/docs/reference/commandline/logout.md
deleted file mode 100644
index 1e150eb848..0000000000
--- a/components/engine/docs/reference/commandline/logout.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-title: "logout"
-description: "The logout command description and usage"
-keywords: "logout, docker, registry"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# logout
-
-```markdown
-Usage:  docker logout [SERVER]
-
-Log out from a Docker registry.
-If no server is specified, the default is defined by the daemon.
-
-Options:
-      --help   Print usage
-```
-
-## Examples
-
-```bash
-$ docker logout localhost:8080
-```
diff --git a/components/engine/docs/reference/commandline/logs.md b/components/engine/docs/reference/commandline/logs.md
deleted file mode 100644
index 75f25f7657..0000000000
--- a/components/engine/docs/reference/commandline/logs.md
+++ /dev/null
@@ -1,68 +0,0 @@
----
-title: "logs"
-description: "The logs command description and usage"
-keywords: "logs, retrieve, docker"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# logs
-
-```markdown
-Usage:  docker logs [OPTIONS] CONTAINER
-
-Fetch the logs of a container
-
-Options:
-      --details        Show extra details provided to logs
-  -f, --follow         Follow log output
-      --help           Print usage
-      --since string   Show logs since timestamp (e.g. 2013-01-02T13:23:37) or relative (e.g. 42m for 42 minutes)
-      --tail string    Number of lines to show from the end of the logs (default "all")
-  -t, --timestamps     Show timestamps
-```
-
-## Description
-
-The `docker logs` command batch-retrieves logs present at the time of execution.
-
-> **Note**: this command is only functional for containers that are started with
-> the `json-file` or `journald` logging driver.
-
-For more information about selecting and configuring logging drivers, refer to
-[Configure logging drivers](https://docs.docker.com/engine/admin/logging/overview/).
-
-The `docker logs --follow` command will continue streaming the new output from
-the container's `STDOUT` and `STDERR`.
-
-Passing a negative number or a non-integer to `--tail` is invalid and the
-value is set to `all` in that case.
-
-The `docker logs --timestamps` command will add an [RFC3339Nano timestamp](https://golang.org/pkg/time/#pkg-constants)
-, for example `2014-09-16T06:17:46.000000000Z`, to each
-log entry. To ensure that the timestamps are aligned the
-nano-second part of the timestamp will be padded with zero when necessary.
-
-The `docker logs --details` command will add on extra attributes, such as
-environment variables and labels, provided to `--log-opt` when creating the
-container.
-
-The `--since` option shows only the container logs generated after
-a given date. You can specify the date as an RFC 3339 date, a UNIX
-timestamp, or a Go duration string (e.g. `1m30s`, `3h`). Besides RFC3339 date
-format you may also use RFC3339Nano, `2006-01-02T15:04:05`,
-`2006-01-02T15:04:05.999999999`, `2006-01-02Z07:00`, and `2006-01-02`. The local
-timezone on the client will be used if you do not provide either a `Z` or a
-`+-00:00` timezone offset at the end of the timestamp. When providing Unix
-timestamps enter seconds[.nanoseconds], where seconds is the number of seconds
-that have elapsed since January 1, 1970 (midnight UTC/GMT), not counting leap
-seconds (aka Unix epoch or Unix time), and the optional .nanoseconds field is a
-fraction of a second no more than nine digits long. You can combine the
-`--since` option with either or both of the `--follow` or `--tail` options.
diff --git a/components/engine/docs/reference/commandline/network.md b/components/engine/docs/reference/commandline/network.md
deleted file mode 100644
index 4555740dad..0000000000
--- a/components/engine/docs/reference/commandline/network.md
+++ /dev/null
@@ -1,51 +0,0 @@
----
-title: "network"
-description: "The network command description and usage"
-keywords: "network"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# network
-
-```markdown
-Usage:  docker network COMMAND
-
-Manage networks
-
-Options:
-      --help   Print usage
-
-Commands:
-  connect     Connect a container to a network
-  create      Create a network
-  disconnect  Disconnect a container from a network
-  inspect     Display detailed information on one or more networks
-  ls          List networks
-  prune       Remove all unused networks
-  rm          Remove one or more networks
-
-Run 'docker network COMMAND --help' for more information on a command.
-```
-
-## Description
-
-Manage networks. You can use subcommands to create, inspect, list, remove,
-prune, connect, and disconnect networks.
-
-## Related commands
-
-* [network create](network_create.md)
-* [network inspect](network_inspect.md)
-* [network list](network_list.md)
-* [network rm](network_rm.md)
-* [network prune](network_prune.md)
-* [network connect](network_connect.md)
-* [network disconnect](network_disconnect.md)
diff --git a/components/engine/docs/reference/commandline/network_connect.md b/components/engine/docs/reference/commandline/network_connect.md
deleted file mode 100644
index ba01fc6add..0000000000
--- a/components/engine/docs/reference/commandline/network_connect.md
+++ /dev/null
@@ -1,117 +0,0 @@
----
-title: "network connect"
-description: "The network connect command description and usage"
-keywords: "network, connect, user-defined"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# network connect
-
-```markdown
-Usage:  docker network connect [OPTIONS] NETWORK CONTAINER
-
-Connect a container to a network
-
-Options:
-      --alias value           Add network-scoped alias for the container (default [])
-      --help                  Print usage
-      --ip string             IPv4 address (e.g., 172.30.100.104)
-      --ip6 string            IPv6 address (e.g., 2001:db8::33)
-      --link value            Add link to another container (default [])
-      --link-local-ip value   Add a link-local address for the container (default [])
-```
-
-## Description
-
-Connects a container to a network. You can connect a container by name
-or by ID. Once connected, the container can communicate with other containers in
-the same network.
-
-## Examples
-
-### Connect a running container to a network
-
-```bash
-$ docker network connect multi-host-network container1
-```
-
-### Connect a container to a network when it starts
-
-You can also use the `docker run --network=<network-name>` option to start a container and immediately connect it to a network.
-
-```bash
-$ docker run -itd --network=multi-host-network busybox
-```
-
-### Specify the IP address a container will use on a given network
-
-You can specify the IP address you want to be assigned to the container's interface.
-
-```bash
-$ docker network connect --ip 10.10.36.122 multi-host-network container2
-```
-
-### Use the legacy `--link` option
-
-You can use `--link` option to link another container with a preferred alias
-
-```bash
-$ docker network connect --link container1:c1 multi-host-network container2
-```
-
-### Create a network alias for a container
-
-`--alias` option can be used to resolve the container by another name in the network
-being connected to.
-
-```bash
-$ docker network connect --alias db --alias mysql multi-host-network container2
-```
-
-### Network implications of stopping, pausing, or restarting containers
-
-You can pause, restart, and stop containers that are connected to a network.
-A container connects to its configured networks when it runs.
-
-If specified, the container's IP address(es) is reapplied when a stopped
-container is restarted. If the IP address is no longer available, the container
-fails to start. One way to guarantee that the IP address is available is
-to specify an `--ip-range` when creating the network, and choose the static IP
-address(es) from outside that range. This ensures that the IP address is not
-given to another container while this container is not on the network.
-
-```bash
-$ docker network create --subnet 172.20.0.0/16 --ip-range 172.20.240.0/20 multi-host-network
-```
-
-```bash
-$ docker network connect --ip 172.20.128.2 multi-host-network container2
-```
-
-To verify the container is connected, use the `docker network inspect` command. Use `docker network disconnect` to remove a container from the network.
-
-Once connected in network, containers can communicate using only another
-container's IP address or name. For `overlay` networks or custom plugins that
-support multi-host connectivity, containers connected to the same multi-host
-network but launched from different Engines can also communicate in this way.
-
-You can connect a container to one or more networks. The networks need not be the same type. For example, you can connect a single container bridge and overlay networks.
-
-## Related commands
-
-* [network inspect](network_inspect.md)
-* [network create](network_create.md)
-* [network disconnect](network_disconnect.md)
-* [network ls](network_ls.md)
-* [network rm](network_rm.md)
-* [network prune](network_prune.md)
-* [Understand Docker container networks](https://docs.docker.com/engine/userguide/networking/)
-* [Work with networks](https://docs.docker.com/engine/userguide/networking/work-with-networks/)
diff --git a/components/engine/docs/reference/commandline/network_create.md b/components/engine/docs/reference/commandline/network_create.md
deleted file mode 100644
index 099cc1439a..0000000000
--- a/components/engine/docs/reference/commandline/network_create.md
+++ /dev/null
@@ -1,227 +0,0 @@
----
-title: "network create"
-description: "The network create command description and usage"
-keywords: "network, create"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# network create
-
-```markdown
-Usage:	docker network create [OPTIONS] NETWORK
-
-Create a network
-
-Options:
-      --attachable           Enable manual container attachment
-      --ingress              Specify the network provides the routing-mesh
-      --aux-address value    Auxiliary IPv4 or IPv6 addresses used by Network
-                             driver (default map[])
-  -d, --driver string        Driver to manage the Network (default "bridge")
-      --gateway value        IPv4 or IPv6 Gateway for the master subnet (default [])
-      --help                 Print usage
-      --internal             Restrict external access to the network
-      --ip-range value       Allocate container ip from a sub-range (default [])
-      --ipam-driver string   IP Address Management Driver (default "default")
-      --ipam-opt value       Set IPAM driver specific options (default map[])
-      --ipv6                 Enable IPv6 networking
-      --label value          Set metadata on a network (default [])
-  -o, --opt value            Set driver specific options (default map[])
-      --subnet value         Subnet in CIDR format that represents a
-                             network segment (default [])
-      --scope value          Promote a network to swarm scope (value = [ local | swarm ])
-      --config-only          Creates a configuration only network
-      --config-from          The name of the network from which copying the configuration
-```
-
-## Description
-
-Creates a new network. The `DRIVER` accepts `bridge` or `overlay` which are the
-built-in network drivers. If you have installed a third party or your own custom
-network driver you can specify that `DRIVER` here also. If you don't specify the
-`--driver` option, the command automatically creates a `bridge` network for you.
-When you install Docker Engine it creates a `bridge` network automatically. This
-network corresponds to the `docker0` bridge that Engine has traditionally relied
-on. When you launch a new container with  `docker run` it automatically connects to
-this bridge network. You cannot remove this default bridge network, but you can
-create new ones using the `network create` command.
-
-```bash
-$ docker network create -d bridge my-bridge-network
-```
-
-Bridge networks are isolated networks on a single Engine installation. If you
-want to create a network that spans multiple Docker hosts each running an
-Engine, you must create an `overlay` network. Unlike `bridge` networks, overlay
-networks require some pre-existing conditions before you can create one. These
-conditions are:
-
-* Access to a key-value store. Engine supports Consul, Etcd, and ZooKeeper (Distributed store) key-value stores.
-* A cluster of hosts with connectivity to the key-value store.
-* A properly configured Engine `daemon` on each host in the cluster.
-
-The `dockerd` options that support the `overlay` network are:
-
-* `--cluster-store`
-* `--cluster-store-opt`
-* `--cluster-advertise`
-
-To read more about these options and how to configure them, see ["*Get started
-with multi-host network*"](https://docs.docker.com/engine/userguide/networking/get-started-overlay).
-
-While not required, it is a good idea to install Docker Swarm to
-manage the cluster that makes up your network. Swarm provides sophisticated
-discovery and server management tools that can assist your implementation.
-
-Once you have prepared the `overlay` network prerequisites you simply choose a
-Docker host in the cluster and issue the following to create the network:
-
-```bash
-$ docker network create -d overlay my-multihost-network
-```
-
-Network names must be unique. The Docker daemon attempts to identify naming
-conflicts but this is not guaranteed. It is the user's responsibility to avoid
-name conflicts.
-
-## Examples
-
-### Connect containers
-
-When you start a container, use the `--network` flag to connect it to a network.
-This example adds the `busybox` container to the `mynet` network:
-
-```bash
-$ docker run -itd --network=mynet busybox
-```
-
-If you want to add a container to a network after the container is already
-running, use the `docker network connect` subcommand.
-
-You can connect multiple containers to the same network. Once connected, the
-containers can communicate using only another container's IP address or name.
-For `overlay` networks or custom plugins that support multi-host connectivity,
-containers connected to the same multi-host network but launched from different
-Engines can also communicate in this way.
-
-You can disconnect a container from a network using the `docker network
-disconnect` command.
-
-### Specify advanced options
-
-When you create a network, Engine creates a non-overlapping subnetwork for the
-network by default. This subnetwork is not a subdivision of an existing
-network. It is purely for ip-addressing purposes. You can override this default
-and specify subnetwork values directly using the `--subnet` option. On a
-`bridge` network you can only create a single subnet:
-
-```bash
-$ docker network create --driver=bridge --subnet=192.168.0.0/16 br0
-```
-
-Additionally, you also specify the `--gateway` `--ip-range` and `--aux-address`
-options.
-
-```bash
-$ docker network create \
-  --driver=bridge \
-  --subnet=172.28.0.0/16 \
-  --ip-range=172.28.5.0/24 \
-  --gateway=172.28.5.254 \
-  br0
-```
-
-If you omit the `--gateway` flag the Engine selects one for you from inside a
-preferred pool. For `overlay` networks and for network driver plugins that
-support it you can create multiple subnetworks.
-
-```bash
-$ docker network create -d overlay \
-  --subnet=192.168.0.0/16 \
-  --subnet=192.170.0.0/16 \
-  --gateway=192.168.0.100 \
-  --gateway=192.170.0.100 \
-  --ip-range=192.168.1.0/24 \
-  --aux-address="my-router=192.168.1.5" --aux-address="my-switch=192.168.1.6" \
-  --aux-address="my-printer=192.170.1.5" --aux-address="my-nas=192.170.1.6" \
-  my-multihost-network
-```
-
-Be sure that your subnetworks do not overlap. If they do, the network create
-fails and Engine returns an error.
-
-### Bridge driver options
-
-When creating a custom network, the default network driver (i.e. `bridge`) has
-additional options that can be passed. The following are those options and the
-equivalent docker daemon flags used for docker0 bridge:
-
-| Option                                           | Equivalent  | Description                                           |
-|--------------------------------------------------|-------------|-------------------------------------------------------|
-| `com.docker.network.bridge.name`                 | -           | bridge name to be used when creating the Linux bridge |
-| `com.docker.network.bridge.enable_ip_masquerade` | `--ip-masq` | Enable IP masquerading                                |
-| `com.docker.network.bridge.enable_icc`           | `--icc`     | Enable or Disable Inter Container Connectivity        |
-| `com.docker.network.bridge.host_binding_ipv4`    | `--ip`      | Default IP when binding container ports               |
-| `com.docker.network.driver.mtu`                  | `--mtu`     | Set the containers network MTU                        |
-
-The following arguments can be passed to `docker network create` for any
-network driver, again with their approximate equivalents to `docker daemon`.
-
-| Argument     | Equivalent     | Description                                |
-|--------------|----------------|--------------------------------------------|
-| `--gateway`  | -              | IPv4 or IPv6 Gateway for the master subnet |
-| `--ip-range` | `--fixed-cidr` | Allocate IPs from a range                  |
-| `--internal` | -              | Restrict external access to the network   |
-| `--ipv6`     | `--ipv6`       | Enable IPv6 networking                     |
-| `--subnet`   | `--bip`        | Subnet for network                         |
-
-For example, let's use `-o` or `--opt` options to specify an IP address binding
-when publishing ports:
-
-```bash
-$ docker network create \
-    -o "com.docker.network.bridge.host_binding_ipv4"="172.19.0.1" \
-    simple-network
-```
-
-### Network internal mode
-
-By default, when you connect a container to an `overlay` network, Docker also
-connects a bridge network to it to provide external connectivity. If you want
-to create an externally isolated `overlay` network, you can specify the
-`--internal` option.
-
-### Network ingress mode
-
-You can create the network which will be used to provide the routing-mesh in the
-swarm cluster. You do so by specifying `--ingress` when creating the network. Only
-one ingress network can be created at the time. The network can be removed only
-if no services depend on it. Any option available when creating a overlay network
-is also available when creating the ingress network, besides the `--attachable` option.
-
-```bash
-$ docker network create -d overlay \
-  --subnet=10.11.0.0/16 \
-  --ingress \
-  --opt com.docker.network.mtu=9216 \
-  --opt encrypted=true \
-  my-ingress-network
-```
-
-## Related commands
-
-* [network inspect](network_inspect.md)
-* [network connect](network_connect.md)
-* [network disconnect](network_disconnect.md)
-* [network ls](network_ls.md)
-* [network rm](network_rm.md)
-* [network prune](network_prune.md)
-* [Understand Docker container networks](https://docs.docker.com/engine/userguide/networking/)
diff --git a/components/engine/docs/reference/commandline/network_disconnect.md b/components/engine/docs/reference/commandline/network_disconnect.md
deleted file mode 100644
index e855894d27..0000000000
--- a/components/engine/docs/reference/commandline/network_disconnect.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-title: "network disconnect"
-description: "The network disconnect command description and usage"
-keywords: "network, disconnect, user-defined"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# network disconnect
-
-```markdown
-Usage:  docker network disconnect [OPTIONS] NETWORK CONTAINER
-
-Disconnect a container from a network
-
-Options:
-  -f, --force   Force the container to disconnect from a network
-      --help    Print usage
-```
-
-## Description
-
-Disconnects a container from a network. The container must be running to
-disconnect it from the network.
-
-## Examples
-
-```bash
-  $ docker network disconnect multi-host-network container1
-```
-
-
-## Related commands
-
-* [network inspect](network_inspect.md)
-* [network connect](network_connect.md)
-* [network create](network_create.md)
-* [network ls](network_ls.md)
-* [network rm](network_rm.md)
-* [network prune](network_prune.md)
-* [Understand Docker container networks](https://docs.docker.com/engine/userguide/networking/)
diff --git a/components/engine/docs/reference/commandline/network_inspect.md b/components/engine/docs/reference/commandline/network_inspect.md
deleted file mode 100644
index 1a856ddcb1..0000000000
--- a/components/engine/docs/reference/commandline/network_inspect.md
+++ /dev/null
@@ -1,307 +0,0 @@
----
-title: "network inspect"
-description: "The network inspect command description and usage"
-keywords: "network, inspect, user-defined"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# network inspect
-
-```markdown
-Usage:  docker network inspect [OPTIONS] NETWORK [NETWORK...]
-
-Display detailed information on one or more networks
-
-Options:
-  -f, --format string   Format the output using the given Go template
-      --help            Print usage
-```
-
-## Description
-
-Returns information about one or more networks. By default, this command renders
-all results in a JSON object.
-
-## Examples
-
-## Inspect the `bridge` network
-
-Connect two containers to the default `bridge` network:
-
-```bash
-$ sudo docker run -itd --name=container1 busybox
-f2870c98fd504370fb86e59f32cd0753b1ac9b69b7d80566ffc7192a82b3ed27
-
-$ sudo docker run -itd --name=container2 busybox
-bda12f8922785d1f160be70736f26c1e331ab8aaf8ed8d56728508f2e2fd4727
-```
-
-The `network inspect` command shows the containers, by id, in its
-results. For networks backed by multi-host network driver, such as Overlay,
-this command also shows the container endpoints in other hosts in the
-cluster. These endpoints are represented as "ep-{endpoint-id}" in the output.
-However, for swarm mode networks, only the endpoints that are local to the
-node are shown.
-
-You can specify an alternate format to execute a given
-template for each result. Go's
-[text/template](http://golang.org/pkg/text/template/) package describes all the
-details of the format.
-
-```none
-$ sudo docker network inspect bridge
-
-[
-    {
-        "Name": "bridge",
-        "Id": "b2b1a2cba717161d984383fd68218cf70bbbd17d328496885f7c921333228b0f",
-        "Created": "2016-10-19T04:33:30.360899459Z",
-        "Scope": "local",
-        "Driver": "bridge",
-        "IPAM": {
-            "Driver": "default",
-            "Config": [
-                {
-                    "Subnet": "172.17.42.1/16",
-                    "Gateway": "172.17.42.1"
-                }
-            ]
-        },
-        "Internal": false,
-        "Containers": {
-            "bda12f8922785d1f160be70736f26c1e331ab8aaf8ed8d56728508f2e2fd4727": {
-                "Name": "container2",
-                "EndpointID": "0aebb8fcd2b282abe1365979536f21ee4ceaf3ed56177c628eae9f706e00e019",
-                "MacAddress": "02:42:ac:11:00:02",
-                "IPv4Address": "172.17.0.2/16",
-                "IPv6Address": ""
-            },
-            "f2870c98fd504370fb86e59f32cd0753b1ac9b69b7d80566ffc7192a82b3ed27": {
-                "Name": "container1",
-                "EndpointID": "a00676d9c91a96bbe5bcfb34f705387a33d7cc365bac1a29e4e9728df92d10ad",
-                "MacAddress": "02:42:ac:11:00:01",
-                "IPv4Address": "172.17.0.1/16",
-                "IPv6Address": ""
-            }
-        },
-        "Options": {
-            "com.docker.network.bridge.default_bridge": "true",
-            "com.docker.network.bridge.enable_icc": "true",
-            "com.docker.network.bridge.enable_ip_masquerade": "true",
-            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
-            "com.docker.network.bridge.name": "docker0",
-            "com.docker.network.driver.mtu": "1500"
-        },
-        "Labels": {}
-    }
-]
-```
-
-### Inspect a user-defined network
-
-Create and inspect a user-defined network:
-
-```bash
-$ docker network create simple-network
-
-69568e6336d8c96bbf57869030919f7c69524f71183b44d80948bd3927c87f6a
-```
-
-```none
-$ docker network inspect simple-network
-
-[
-    {
-        "Name": "simple-network",
-        "Id": "69568e6336d8c96bbf57869030919f7c69524f71183b44d80948bd3927c87f6a",
-        "Created": "2016-10-19T04:33:30.360899459Z",
-        "Scope": "local",
-        "Driver": "bridge",
-        "IPAM": {
-            "Driver": "default",
-            "Config": [
-                {
-                    "Subnet": "172.22.0.0/16",
-                    "Gateway": "172.22.0.1"
-                }
-            ]
-        },
-        "Containers": {},
-        "Options": {},
-        "Labels": {}
-    }
-]
-```
-
-### Inspect the `ingress` network
-
-For swarm mode overlay networks `network inspect` also shows the IP address and node name
-of the peers. Peers are the nodes in the swarm cluster which have at least one task attached
-to the network. Node name is of the format `<hostname>-<unique ID>`.
-
-```none
-$ docker network inspect ingress
-
-[
-    {
-        "Name": "ingress",
-        "Id": "j0izitrut30h975vk4m1u5kk3",
-        "Created": "2016-11-08T06:49:59.803387552Z",
-        "Scope": "swarm",
-        "Driver": "overlay",
-        "EnableIPv6": false,
-        "IPAM": {
-            "Driver": "default",
-            "Options": null,
-            "Config": [
-                {
-                    "Subnet": "10.255.0.0/16",
-                    "Gateway": "10.255.0.1"
-                }
-            ]
-        },
-        "Internal": false,
-        "Attachable": false,
-        "Containers": {
-            "ingress-sbox": {
-                "Name": "ingress-endpoint",
-                "EndpointID": "40e002d27b7e5d75f60bc72199d8cae3344e1896abec5eddae9743755fe09115",
-                "MacAddress": "02:42:0a:ff:00:03",
-                "IPv4Address": "10.255.0.3/16",
-                "IPv6Address": ""
-            }
-        },
-        "Options": {
-            "com.docker.network.driver.overlay.vxlanid_list": "256"
-        },
-        "Labels": {},
-        "Peers": [
-            {
-                "Name": "net-1-1d22adfe4d5c",
-                "IP": "192.168.33.11"
-            },
-            {
-                "Name": "net-2-d55d838b34af",
-                "IP": "192.168.33.12"
-            },
-            {
-                "Name": "net-3-8473f8140bd9",
-                "IP": "192.168.33.13"
-            }
-        ]
-    }
-]
-```
-
-### Using `verbose` option for `network inspect`
-
-`docker network inspect --verbose` for swarm mode overlay networks shows service-specific
-details such as the service's VIP and port mappings. It also shows IPs of service tasks,
-and the IPs of the nodes where the tasks are running.
-
-Following is an example output for a overlay network `ov1` that has one service `s1`
-attached to. service `s1` in this case has three replicas.
-
-```bash
-$ docker network inspect --verbose ov1
-[
-    {
-        "Name": "ov1",
-        "Id": "ybmyjvao9vtzy3oorxbssj13b",
-        "Created": "2017-03-13T17:04:39.776106792Z",
-        "Scope": "swarm",
-        "Driver": "overlay",
-        "EnableIPv6": false,
-        "IPAM": {
-            "Driver": "default",
-            "Options": null,
-            "Config": [
-                {
-                    "Subnet": "10.0.0.0/24",
-                    "Gateway": "10.0.0.1"
-                }
-            ]
-        },
-        "Internal": false,
-        "Attachable": false,
-        "Containers": {
-            "020403bd88a15f60747fd25d1ad5fa1272eb740e8a97fc547d8ad07b2f721c5e": {
-                "Name": "s1.1.pjn2ik0sfgkfzed3h0s00gs9o",
-                "EndpointID": "ad16946f416562d658f3bb30b9830d73ad91ccf6feae44411269cd0ff674714e",
-                "MacAddress": "02:42:0a:00:00:04",
-                "IPv4Address": "10.0.0.4/24",
-                "IPv6Address": ""
-            }
-        },
-        "Options": {
-            "com.docker.network.driver.overlay.vxlanid_list": "4097"
-        },
-        "Labels": {},
-        "Peers": [
-            {
-                "Name": "net-3-5d3cfd30a58c",
-                "IP": "192.168.33.13"
-            },
-            {
-                "Name": "net-1-6ecbc0040a73",
-                "IP": "192.168.33.11"
-            },
-            {
-                "Name": "net-2-fb80208efd75",
-                "IP": "192.168.33.12"
-            }
-        ],
-        "Services": {
-            "s1": {
-                "VIP": "10.0.0.2",
-                "Ports": [],
-                "LocalLBIndex": 257,
-                "Tasks": [
-                    {
-                        "Name": "s1.2.q4hcq2aiiml25ubtrtg4q1txt",
-                        "EndpointID": "040879b027e55fb658e8b60ae3b87c6cdac7d291e86a190a3b5ac6567b26511a",
-                        "EndpointIP": "10.0.0.5",
-                        "Info": {
-                            "Host IP": "192.168.33.11"
-                        }
-                    },
-                    {
-                        "Name": "s1.3.yawl4cgkp7imkfx469kn9j6lm",
-                        "EndpointID": "106edff9f120efe44068b834e1cddb5b39dd4a3af70211378b2f7a9e562bbad8",
-                        "EndpointIP": "10.0.0.3",
-                        "Info": {
-                            "Host IP": "192.168.33.12"
-                        }
-                    },
-                    {
-                        "Name": "s1.1.pjn2ik0sfgkfzed3h0s00gs9o",
-                        "EndpointID": "ad16946f416562d658f3bb30b9830d73ad91ccf6feae44411269cd0ff674714e",
-                        "EndpointIP": "10.0.0.4",
-                        "Info": {
-                            "Host IP": "192.168.33.13"
-                        }
-                    }
-                ]
-            }
-        }
-    }
-]
-```
-
-## Related commands
-
-* [network disconnect ](network_disconnect.md)
-* [network connect](network_connect.md)
-* [network create](network_create.md)
-* [network ls](network_ls.md)
-* [network rm](network_rm.md)
-* [network prune](network_prune.md)
-* [Understand Docker container networks](https://docs.docker.com/engine/userguide/networking/)
diff --git a/components/engine/docs/reference/commandline/network_ls.md b/components/engine/docs/reference/commandline/network_ls.md
deleted file mode 100644
index 8bb8a2c48a..0000000000
--- a/components/engine/docs/reference/commandline/network_ls.md
+++ /dev/null
@@ -1,250 +0,0 @@
----
-title: "network ls"
-description: "The network ls command description and usage"
-keywords: "network, list, user-defined"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# docker network ls
-
-```markdown
-Usage:  docker network ls [OPTIONS]
-
-List networks
-
-Aliases:
-  ls, list
-
-Options:
-  -f, --filter filter   Provide filter values (e.g. 'driver=bridge')
-      --format string   Pretty-print networks using a Go template
-      --help            Print usage
-      --no-trunc        Do not truncate the output
-  -q, --quiet           Only display network IDs
-```
-
-## Description
-
-Lists all the networks the Engine `daemon` knows about. This includes the
-networks that span across multiple hosts in a cluster.
-
-## Examples
-
-### List all networks
-
-```bash
-$ sudo docker network ls
-NETWORK ID          NAME                DRIVER          SCOPE
-7fca4eb8c647        bridge              bridge          local
-9f904ee27bf5        none                null            local
-cf03ee007fb4        host                host            local
-78b03ee04fc4        multi-host          overlay         swarm
-```
-
-Use the `--no-trunc` option to display the full network id:
-
-```bash
-$ docker network ls --no-trunc
-NETWORK ID                                                         NAME                DRIVER           SCOPE
-18a2866682b85619a026c81b98a5e375bd33e1b0936a26cc497c283d27bae9b3   none                null             local
-c288470c46f6c8949c5f7e5099b5b7947b07eabe8d9a27d79a9cbf111adcbf47   host                host             local
-7b369448dccbf865d397c8d2be0cda7cf7edc6b0945f77d2529912ae917a0185   bridge              bridge           local
-95e74588f40db048e86320c6526440c504650a1ff3e9f7d60a497c4d2163e5bd   foo                 bridge           local
-63d1ff1f77b07ca51070a8c227e962238358bd310bde1529cf62e6c307ade161   dev                 bridge           local
-```
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is a `key=value` pair. If there
-is more than one filter, then pass multiple flags (e.g. `--filter "foo=bar" --filter "bif=baz"`).
-Multiple filter flags are combined as an `OR` filter. For example,
-`-f type=custom -f type=builtin` returns both `custom` and `builtin` networks.
-
-The currently supported filters are:
-
-* driver
-* id (network's id)
-* label (`label=<key>` or `label=<key>=<value>`)
-* name (network's name)
-* scope (`swarm|global|local`)
-* type (`custom|builtin`)
-
-#### Driver
-
-The `driver` filter matches networks based on their driver.
-
-The following example matches networks with the `bridge` driver:
-
-```bash
-$ docker network ls --filter driver=bridge
-NETWORK ID          NAME                DRIVER            SCOPE
-db9db329f835        test1               bridge            local
-f6e212da9dfd        test2               bridge            local
-```
-
-#### ID
-
-The `id` filter matches on all or part of a network's ID.
-
-The following filter matches all networks with an ID containing the
-`63d1ff1f77b0...` string.
-
-```bash
-$ docker network ls --filter id=63d1ff1f77b07ca51070a8c227e962238358bd310bde1529cf62e6c307ade161
-NETWORK ID          NAME                DRIVER           SCOPE
-63d1ff1f77b0        dev                 bridge           local
-```
-
-You can also filter for a substring in an ID as this shows:
-
-```bash
-$ docker network ls --filter id=95e74588f40d
-NETWORK ID          NAME                DRIVER          SCOPE
-95e74588f40d        foo                 bridge          local
-
-$ docker network ls --filter id=95e
-NETWORK ID          NAME                DRIVER          SCOPE
-95e74588f40d        foo                 bridge          local
-```
-
-#### Label
-
-The `label` filter matches networks based on the presence of a `label` alone or a `label` and a
-value.
-
-The following filter matches networks with the `usage` label regardless of its value.
-
-```bash
-$ docker network ls -f "label=usage"
-NETWORK ID          NAME                DRIVER         SCOPE
-db9db329f835        test1               bridge         local
-f6e212da9dfd        test2               bridge         local
-```
-
-The following filter matches networks with the `usage` label with the `prod` value.
-
-```bash
-$ docker network ls -f "label=usage=prod"
-NETWORK ID          NAME                DRIVER        SCOPE
-f6e212da9dfd        test2               bridge        local
-```
-
-#### Name
-
-The `name` filter matches on all or part of a network's name.
-
-The following filter matches all networks with a name containing the `foobar` string.
-
-```bash
-$ docker network ls --filter name=foobar
-NETWORK ID          NAME                DRIVER       SCOPE
-06e7eef0a170        foobar              bridge       local
-```
-
-You can also filter for a substring in a name as this shows:
-
-```bash
-$ docker network ls --filter name=foo
-NETWORK ID          NAME                DRIVER       SCOPE
-95e74588f40d        foo                 bridge       local
-06e7eef0a170        foobar              bridge       local
-```
-
-#### Scope
-
-The `scope` filter matches networks based on their scope.
-
-The following example matches networks with the `swarm` scope:
-
-```bash
-$ docker network ls --filter scope=swarm
-NETWORK ID          NAME                DRIVER              SCOPE
-xbtm0v4f1lfh        ingress             overlay             swarm
-ic6r88twuu92        swarmnet            overlay             swarm
-```
-
-The following example matches networks with the `local` scope:
-
-```bash
-$ docker network ls --filter scope=local
-NETWORK ID          NAME                DRIVER              SCOPE
-e85227439ac7        bridge              bridge              local
-0ca0e19443ed        host                host                local
-ca13cc149a36        localnet            bridge              local
-f9e115d2de35        none                null                local
-```
-
-#### Type
-
-The `type` filter supports two values; `builtin` displays predefined networks
-(`bridge`, `none`, `host`), whereas `custom` displays user defined networks.
-
-The following filter matches all user defined networks:
-
-```bash
-$ docker network ls --filter type=custom
-NETWORK ID          NAME                DRIVER       SCOPE
-95e74588f40d        foo                 bridge       local  
-63d1ff1f77b0        dev                 bridge       local
-```
-
-By having this flag it allows for batch cleanup. For example, use this filter
-to delete all user defined networks:
-
-```bash
-$ docker network rm `docker network ls --filter type=custom -q`
-```
-
-A warning will be issued when trying to remove a network that has containers
-attached.
-
-### Formatting
-
-The formatting options (`--format`) pretty-prints networks output
-using a Go template.
-
-Valid placeholders for the Go template are listed below:
-
-Placeholder  | Description
--------------|------------------------------------------------------------------------------------------
-`.ID`        | Network ID
-`.Name`      | Network name
-`.Driver`    | Network driver
-`.Scope`     | Network scope (local, global)
-`.IPv6`      | Whether IPv6 is enabled on the network or not.
-`.Internal`  | Whether the network is internal or not.
-`.Labels`    | All labels assigned to the network.
-`.Label`     | Value of a specific label for this network. For example `{{.Label "project.version"}}`
-`.CreatedAt` | Time when the network was created
-
-When using the `--format` option, the `network ls` command will either
-output the data exactly as the template declares or, when using the
-`table` directive, includes column headers as well.
-
-The following example uses a template without headers and outputs the
-`ID` and `Driver` entries separated by a colon for all networks:
-
-```bash
-$ docker network ls --format "{{.ID}}: {{.Driver}}"
-afaaab448eb2: bridge
-d1584f8dc718: host
-391df270dc66: null
-```
-
-## Related commands
-
-* [network disconnect ](network_disconnect.md)
-* [network connect](network_connect.md)
-* [network create](network_create.md)
-* [network inspect](network_inspect.md)
-* [network rm](network_rm.md)
-* [network prune](network_prune.md)
-* [Understand Docker container networks](https://docs.docker.com/engine/userguide/networking/)
diff --git a/components/engine/docs/reference/commandline/network_prune.md b/components/engine/docs/reference/commandline/network_prune.md
deleted file mode 100644
index 9ef541061d..0000000000
--- a/components/engine/docs/reference/commandline/network_prune.md
+++ /dev/null
@@ -1,104 +0,0 @@
----
-title: "network prune"
-description: "Remove unused networks"
-keywords: "network, prune, delete"
----
-
-# network prune
-
-```markdown
-Usage:	docker network prune [OPTIONS]
-
-Remove all unused networks
-
-Options:
-      --filter filter   Provide filter values (e.g. 'until=<timestamp>')
-  -f, --force           Do not prompt for confirmation
-      --help            Print usage
-```
-
-## Description
-
-Remove all unused networks. Unused networks are those which are not referenced
-by any containers.
-
-## Examples
-
-```bash
-$ docker network prune
-
-WARNING! This will remove all networks not used by at least one container.
-Are you sure you want to continue? [y/N] y
-Deleted Networks:
-n1
-n2
-```
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is of "key=value". If there is more
-than one filter, then pass multiple flags (e.g., `--filter "foo=bar" --filter "bif=baz"`)
-
-The currently supported filters are:
-
-* until (`<timestamp>`) - only remove networks created before given timestamp
-* label (`label=<key>`, `label=<key>=<value>`, `label!=<key>`, or `label!=<key>=<value>`) - only remove networks with (or without, in case `label!=...` is used) the specified labels.
-
-The `until` filter can be Unix timestamps, date formatted
-timestamps, or Go duration strings (e.g. `10m`, `1h30m`) computed
-relative to the daemon machine’s time. Supported formats for date
-formatted time stamps include RFC3339Nano, RFC3339, `2006-01-02T15:04:05`,
-`2006-01-02T15:04:05.999999999`, `2006-01-02Z07:00`, and `2006-01-02`. The local
-timezone on the daemon will be used if you do not provide either a `Z` or a
-`+-00:00` timezone offset at the end of the timestamp.  When providing Unix
-timestamps enter seconds[.nanoseconds], where seconds is the number of seconds
-that have elapsed since January 1, 1970 (midnight UTC/GMT), not counting leap
-seconds (aka Unix epoch or Unix time), and the optional .nanoseconds field is a
-fraction of a second no more than nine digits long.
-
-The `label` filter accepts two formats. One is the `label=...` (`label=<key>` or `label=<key>=<value>`),
-which removes networks with the specified labels. The other
-format is the `label!=...` (`label!=<key>` or `label!=<key>=<value>`), which removes
-networks without the specified labels.
-
-The following removes networks created more than 5 minutes ago. Note that
-system networks such as `bridge`, `host`, and `none` will never be pruned:
-
-```none
-$ docker network ls
-
-NETWORK ID          NAME                DRIVER              SCOPE
-7430df902d7a        bridge              bridge              local
-ea92373fd499        foo-1-day-ago       bridge              local
-ab53663ed3c7        foo-1-min-ago       bridge              local
-97b91972bc3b        host                host                local
-f949d337b1f5        none                null                local
-
-$ docker network prune --force --filter until=5m
-
-Deleted Networks:
-foo-1-day-ago
-
-$ docker network ls
-
-NETWORK ID          NAME                DRIVER              SCOPE
-7430df902d7a        bridge              bridge              local
-ab53663ed3c7        foo-1-min-ago       bridge              local
-97b91972bc3b        host                host                local
-f949d337b1f5        none                null                local
-```
-
-## Related commands
-
-* [network disconnect ](network_disconnect.md)
-* [network connect](network_connect.md)
-* [network create](network_create.md)
-* [network ls](network_ls.md)
-* [network inspect](network_inspect.md)
-* [network rm](network_rm.md)
-* [Understand Docker container networks](https://docs.docker.com/engine/userguide/networking/)
-* [system df](system_df.md)
-* [container prune](container_prune.md)
-* [image prune](image_prune.md)
-* [volume prune](volume_prune.md)
-* [system prune](system_prune.md)
diff --git a/components/engine/docs/reference/commandline/network_rm.md b/components/engine/docs/reference/commandline/network_rm.md
deleted file mode 100644
index aab487a044..0000000000
--- a/components/engine/docs/reference/commandline/network_rm.md
+++ /dev/null
@@ -1,68 +0,0 @@
----
-title: "network rm"
-description: "the network rm command description and usage"
-keywords: "network, rm, user-defined"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# network rm
-
-```markdown
-Usage:  docker network rm NETWORK [NETWORK...]
-
-Remove one or more networks
-
-Aliases:
-  rm, remove
-
-Options:
-      --help   Print usage
-```
-
-## Description
-
-Removes one or more networks by name or identifier. To remove a network,
-you must first disconnect any containers connected to it.
-
-## Examples
-
-### Remove a network
-
-To remove the network named 'my-network':
-
-```bash
-  $ docker network rm my-network
-```
-
-### Remove multiple networks
-
-To delete multiple networks in a single `docker network rm` command, provide
-multiple network names or ids. The following example deletes a network with id
-`3695c422697f` and a network named `my-network`:
-
-```bash
-  $ docker network rm 3695c422697f my-network
-```
-
-When you specify multiple networks, the command attempts to delete each in turn.
-If the deletion of one network fails, the command continues to the next on the
-list and tries to delete that. The command reports success or failure for each
-deletion.
-
-## Related commands
-
-* [network disconnect ](network_disconnect.md)
-* [network connect](network_connect.md)
-* [network create](network_create.md)
-* [network ls](network_ls.md)
-* [network inspect](network_inspect.md)
-* [network prune](network_prune.md)
-* [Understand Docker container networks](https://docs.docker.com/engine/userguide/networking/)
diff --git a/components/engine/docs/reference/commandline/node.md b/components/engine/docs/reference/commandline/node.md
deleted file mode 100644
index 3a7d4b3a76..0000000000
--- a/components/engine/docs/reference/commandline/node.md
+++ /dev/null
@@ -1,42 +0,0 @@
-
----
-title: "node"
-description: "The node command description and usage"
-keywords: "node"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# node
-
-```markdown
-Usage:  docker node COMMAND
-
-Manage Swarm nodes
-
-Options:
-      --help   Print usage
-
-Commands:
-  demote      Demote one or more nodes from manager in the swarm
-  inspect     Display detailed information on one or more nodes
-  ls          List nodes in the swarm
-  promote     Promote one or more nodes to manager in the swarm
-  ps          List tasks running on one or more nodes, defaults to current node
-  rm          Remove one or more nodes from the swarm
-  update      Update a node
-
-Run 'docker node COMMAND --help' for more information on a command.
-```
-
-## Description
-
-Manage nodes.
-
diff --git a/components/engine/docs/reference/commandline/node_demote.md b/components/engine/docs/reference/commandline/node_demote.md
deleted file mode 100644
index e6e59d8945..0000000000
--- a/components/engine/docs/reference/commandline/node_demote.md
+++ /dev/null
@@ -1,47 +0,0 @@
----
-title: "node demote"
-description: "The node demote command description and usage"
-keywords: "node, demote"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# node demote
-
-```markdown
-Usage:  docker node demote NODE [NODE...]
-
-Demote one or more nodes from manager in the swarm
-
-Options:
-      --help   Print usage
-
-```
-
-## Description
-
-Demotes an existing manager so that it is no longer a manager. This command
-targets a docker engine that is a manager in the swarm.
-
-
-## Examples
-
-```bash
-$ docker node demote <node name>
-```
-
-## Related commands
-
-* [node inspect](node_inspect.md)
-* [node ls](node_ls.md)
-* [node promote](node_promote.md)
-* [node ps](node_ps.md)
-* [node rm](node_rm.md)
-* [node update](node_update.md)
diff --git a/components/engine/docs/reference/commandline/node_inspect.md b/components/engine/docs/reference/commandline/node_inspect.md
deleted file mode 100644
index 6ee9e17e6f..0000000000
--- a/components/engine/docs/reference/commandline/node_inspect.md
+++ /dev/null
@@ -1,167 +0,0 @@
----
-title: "node inspect"
-description: "The node inspect command description and usage"
-keywords: "node, inspect"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# node inspect
-
-```markdown
-Usage:  docker node inspect [OPTIONS] self|NODE [NODE...]
-
-Display detailed information on one or more nodes
-
-Options:
-  -f, --format string   Format the output using the given Go template
-      --help            Print usage
-      --pretty          Print the information in a human friendly format
-```
-
-## Description
-
-Returns information about a node. By default, this command renders all results
-in a JSON array. You can specify an alternate format to execute a
-given template for each result. Go's
-[text/template](http://golang.org/pkg/text/template/) package describes all the
-details of the format.
-
-## Examples
-
-### Inspect a node
-
-```none
-$ docker node inspect swarm-manager
-
-[
-{
-    "ID": "e216jshn25ckzbvmwlnh5jr3g",
-    "Version": {
-        "Index": 10
-    },
-    "CreatedAt": "2017-05-16T22:52:44.9910662Z",
-    "UpdatedAt": "2017-05-16T22:52:45.230878043Z",
-    "Spec": {
-        "Role": "manager",
-        "Availability": "active"
-    },
-    "Description": {
-        "Hostname": "swarm-manager",
-        "Platform": {
-            "Architecture": "x86_64",
-            "OS": "linux"
-        },
-        "Resources": {
-            "NanoCPUs": 1000000000,
-            "MemoryBytes": 1039843328
-        },
-        "Engine": {
-            "EngineVersion": "17.06.0-ce",
-            "Plugins": [
-                {
-                    "Type": "Volume",
-                    "Name": "local"
-                },
-                {
-                    "Type": "Network",
-                    "Name": "overlay"
-                },
-                {
-                    "Type": "Network",
-                    "Name": "null"
-                },
-                {
-                    "Type": "Network",
-                    "Name": "host"
-                },
-                {
-                    "Type": "Network",
-                    "Name": "bridge"
-                },
-                {
-                    "Type": "Network",
-                    "Name": "overlay"
-                }
-            ]
-        },
-        "TLSInfo": {
-            "TrustRoot": "-----BEGIN CERTIFICATE-----\nMIIBazCCARCgAwIBAgIUOzgqU4tA2q5Yv1HnkzhSIwGyIBswCgYIKoZIzj0EAwIw\nEzERMA8GA1UEAxMIc3dhcm0tY2EwHhcNMTcwNTAyMDAyNDAwWhcNMzcwNDI3MDAy\nNDAwWjATMREwDwYDVQQDEwhzd2FybS1jYTBZMBMGByqGSM49AgEGCCqGSM49AwEH\nA0IABMbiAmET+HZyve35ujrnL2kOLBEQhFDZ5MhxAuYs96n796sFlfxTxC1lM/2g\nAh8DI34pm3JmHgZxeBPKUURJHKWjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB\nAf8EBTADAQH/MB0GA1UdDgQWBBS3sjTJOcXdkls6WSY2rTx1KIJueTAKBggqhkjO\nPQQDAgNJADBGAiEAoeVWkaXgSUAucQmZ3Yhmx22N/cq1EPBgYHOBZmHt0NkCIQC3\nzONcJ/+WA21OXtb+vcijpUOXtNjyHfcox0N8wsLDqQ==\n-----END CERTIFICATE-----\n",
-            "CertIssuerSubject": "MBMxETAPBgNVBAMTCHN3YXJtLWNh",
-            "CertIssuerPublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExuICYRP4dnK97fm6OucvaQ4sERCEUNnkyHEC5iz3qfv3qwWV/FPELWUz/aACHwMjfimbcmYeBnF4E8pRREkcpQ=="
-        }
-    },
-    "Status": {
-        "State": "ready",
-        "Addr": "168.0.32.137"
-    },
-    "ManagerStatus": {
-        "Leader": true,
-        "Reachability": "reachable",
-        "Addr": "168.0.32.137:2377"
-    }
-}
-]
-```
-
-### Specify an output format
-
-```none
-$ docker node inspect --format '{{ .ManagerStatus.Leader }}' self
-
-false
-
-$ docker node inspect --pretty self
-ID:                     e216jshn25ckzbvmwlnh5jr3g
-Hostname:               swarm-manager
-Joined at:              2017-05-16 22:52:44.9910662 +0000 utc
-Status:
- State:                 Ready
- Availability:          Active
- Address:               172.17.0.2
-Manager Status:
- Address:               172.17.0.2:2377
- Raft Status:           Reachable
- Leader:                Yes
-Platform:
- Operating System:      linux
- Architecture:          x86_64
-Resources:
- CPUs:                  4
- Memory:                7.704 GiB
-Plugins:
-  Network:              overlay, bridge, null, host, overlay
-  Volume:               local
-Engine Version:         17.06.0-ce
-TLS Info:
- TrustRoot:
------BEGIN CERTIFICATE-----
-MIIBazCCARCgAwIBAgIUOzgqU4tA2q5Yv1HnkzhSIwGyIBswCgYIKoZIzj0EAwIw
-EzERMA8GA1UEAxMIc3dhcm0tY2EwHhcNMTcwNTAyMDAyNDAwWhcNMzcwNDI3MDAy
-NDAwWjATMREwDwYDVQQDEwhzd2FybS1jYTBZMBMGByqGSM49AgEGCCqGSM49AwEH
-A0IABMbiAmET+HZyve35ujrnL2kOLBEQhFDZ5MhxAuYs96n796sFlfxTxC1lM/2g
-Ah8DI34pm3JmHgZxeBPKUURJHKWjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB
-Af8EBTADAQH/MB0GA1UdDgQWBBS3sjTJOcXdkls6WSY2rTx1KIJueTAKBggqhkjO
-PQQDAgNJADBGAiEAoeVWkaXgSUAucQmZ3Yhmx22N/cq1EPBgYHOBZmHt0NkCIQC3
-zONcJ/+WA21OXtb+vcijpUOXtNjyHfcox0N8wsLDqQ==
------END CERTIFICATE-----
-
- Issuer Public Key:	MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExuICYRP4dnK97fm6OucvaQ4sERCEUNnkyHEC5iz3qfv3qwWV/FPELWUz/aACHwMjfimbcmYeBnF4E8pRREkcpQ==
- Issuer Subject:	MBMxETAPBgNVBAMTCHN3YXJtLWNh
-```
-
-## Related commands
-
-* [node demote](node_demote.md)
-* [node ls](node_ls.md)
-* [node promote](node_promote.md)
-* [node ps](node_ps.md)
-* [node rm](node_rm.md)
-* [node update](node_update.md)
diff --git a/components/engine/docs/reference/commandline/node_ls.md b/components/engine/docs/reference/commandline/node_ls.md
deleted file mode 100644
index 224642c2e5..0000000000
--- a/components/engine/docs/reference/commandline/node_ls.md
+++ /dev/null
@@ -1,171 +0,0 @@
----
-title: "node ls"
-description: "The node ls command description and usage"
-keywords: "node, list"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# node ls
-
-```markdown
-Usage:  docker node ls [OPTIONS]
-
-List nodes in the swarm
-
-Aliases:
-  ls, list
-
-Options:
-  -f, --filter filter   Filter output based on conditions provided
-      --format string   Pretty-print nodes using a Go template
-      --help            Print usage
-  -q, --quiet           Only display IDs
-```
-
-## Description
-
-Lists all the nodes that the Docker Swarm manager knows about. You can filter
-using the `-f` or `--filter` flag. Refer to the [filtering](#filtering) section
-for more information about available filter options.
-
-## Examples
-
-```bash
-$ docker node ls
-
-ID                           HOSTNAME        STATUS  AVAILABILITY  MANAGER STATUS
-1bcef6utixb0l0ca7gxuivsj0    swarm-worker2   Ready   Active
-38ciaotwjuritcdtn9npbnkuz    swarm-worker1   Ready   Active
-e216jshn25ckzbvmwlnh5jr3g *  swarm-manager1  Ready   Active        Leader
-```
-> **Note**:
-> In the above example output, there is a hidden column of `.Self` that indicates if the
-> node is the same node as the current docker daemon. A `*` (e.g., `e216jshn25ckzbvmwlnh5jr3g *`)
-> means this node is the current docker daemon.
-
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is of "key=value". If there is more
-than one filter, then pass multiple flags (e.g., `--filter "foo=bar" --filter "bif=baz"`)
-
-The currently supported filters are:
-
-* [id](node_ls.md#id)
-* [label](node_ls.md#label)
-* [membership](node_ls.md#membership)
-* [name](node_ls.md#name)
-* [role](node_ls.md#role)
-
-#### id
-
-The `id` filter matches all or part of a node's id.
-
-```bash
-$ docker node ls -f id=1
-
-ID                         HOSTNAME       STATUS  AVAILABILITY  MANAGER STATUS
-1bcef6utixb0l0ca7gxuivsj0  swarm-worker2  Ready   Active
-```
-
-#### label
-
-The `label` filter matches nodes based on engine labels and on the presence of a `label` alone or a `label` and a value. Node labels are currently not used for filtering.
-
-The following filter matches nodes with the `foo` label regardless of its value.
-
-```bash
-$ docker node ls -f "label=foo"
-
-ID                         HOSTNAME       STATUS  AVAILABILITY  MANAGER STATUS
-1bcef6utixb0l0ca7gxuivsj0  swarm-worker2  Ready   Active
-```
-
-#### membersip
-
-The `membership` filter matches nodes based on the presence of a `membership` and a value
-`accepted` or `pending`.
-
-The following filter matches nodes with the `membership` of `accepted`.
-
-```bash
-$ docker node ls -f "membership=accepted"
-
-ID                           HOSTNAME        STATUS  AVAILABILITY  MANAGER STATUS
-1bcef6utixb0l0ca7gxuivsj0    swarm-worker2   Ready   Active
-38ciaotwjuritcdtn9npbnkuz    swarm-worker1   Ready   Active
-```
-
-#### name
-
-The `name` filter matches on all or part of a node hostname.
-
-The following filter matches the nodes with a name equal to `swarm-master` string.
-
-```bash
-$ docker node ls -f name=swarm-manager1
-
-ID                           HOSTNAME        STATUS  AVAILABILITY  MANAGER STATUS
-e216jshn25ckzbvmwlnh5jr3g *  swarm-manager1  Ready   Active        Leader
-```
-
-#### role
-
-The `role` filter matches nodes based on the presence of a `role` and a value `worker` or `manager`.
-
-The following filter matches nodes with the `manager` role.
-
-```bash
-$ docker node ls -f "role=manager"
-
-ID                           HOSTNAME        STATUS  AVAILABILITY  MANAGER STATUS
-e216jshn25ckzbvmwlnh5jr3g *  swarm-manager1  Ready   Active        Leader
-```
-
-### Formatting
-
-The formatting options (`--format`) pretty-prints nodes output
-using a Go template.
-
-Valid placeholders for the Go template are listed below:
-
-Placeholder      | Description
------------------|------------------------------------------------------------------------------------------
-`.ID`            | Node ID
-`.Self`          | Node of the daemon (`true/false`, `true`indicates that the node is the same as current docker daemon)
-`.Hostname`      | Node hostname
-`.Status`        | Node status
-`.Availability`  | Node availability ("active", "pause", or "drain")
-`.ManagerStatus` | Manager status of the node
-`.TLSStatus`     | TLS status of the node ("Ready", or "Needs Rotation" has TLS certificate signed by an old CA)
-
-When using the `--format` option, the `node ls` command will either
-output the data exactly as the template declares or, when using the
-`table` directive, includes column headers as well.
-
-The following example uses a template without headers and outputs the
-`ID`, `Hostname`, and `TLS Status` entries separated by a colon for all nodes:
-
-```bash
-$ docker node ls --format "{{.ID}}: {{.Hostname}} {{.TLSStatus}}"
-e216jshn25ckzbvmwlnh5jr3g: swarm-manager1 Ready
-35o6tiywb700jesrt3dmllaza: swarm-worker1 Needs Rotation  
-``
-
-
-## Related commands
-
-* [node demote](node_demote.md)
-* [node inspect](node_inspect.md)
-* [node promote](node_promote.md)
-* [node ps](node_ps.md)
-* [node rm](node_rm.md)
-* [node update](node_update.md)
diff --git a/components/engine/docs/reference/commandline/node_promote.md b/components/engine/docs/reference/commandline/node_promote.md
deleted file mode 100644
index 1ebbe9550c..0000000000
--- a/components/engine/docs/reference/commandline/node_promote.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-title: "node promote"
-description: "The node promote command description and usage"
-keywords: "node, promote"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# node promote
-
-```markdown
-Usage:  docker node promote NODE [NODE...]
-
-Promote one or more nodes to manager in the swarm
-
-Options:
-      --help   Print usage
-```
-
-## Description
-
-Promotes a node to manager. This command targets a docker engine that is a
-manager in the swarm.
-
-## Examples
-
-```bash
-$ docker node promote <node name>
-```
-
-## Related commands
-
-* [node demote](node_demote.md)
-* [node inspect](node_inspect.md)
-* [node ls](node_ls.md)
-* [node ps](node_ps.md)
-* [node rm](node_rm.md)
-* [node update](node_update.md)
diff --git a/components/engine/docs/reference/commandline/node_ps.md b/components/engine/docs/reference/commandline/node_ps.md
deleted file mode 100644
index 0bf76e0d8e..0000000000
--- a/components/engine/docs/reference/commandline/node_ps.md
+++ /dev/null
@@ -1,148 +0,0 @@
----
-title: "node ps"
-description: "The node ps command description and usage"
-keywords: node, tasks, ps
-aliases: ["/engine/reference/commandline/node_tasks/"]
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# node ps
-
-```markdown
-Usage:  docker node ps [OPTIONS] [NODE...]
-
-List tasks running on one or more nodes, defaults to current node.
-
-Options:
-  -f, --filter filter   Filter output based on conditions provided
-      --format string   Pretty-print tasks using a Go template
-      --help            Print usage
-      --no-resolve      Do not map IDs to Names
-      --no-trunc        Do not truncate output
-  -q, --quiet           Only display task IDs
-```
-
-## Description
-
-Lists all the tasks on a Node that Docker knows about. You can filter using the `-f` or `--filter` flag. Refer to the [filtering](#filtering) section for more information about available filter options.
-
-## Examples
-
-```bash
-$ docker node ps swarm-manager1
-NAME                                IMAGE        NODE            DESIRED STATE  CURRENT STATE
-redis.1.7q92v0nr1hcgts2amcjyqg3pq   redis:3.0.6  swarm-manager1  Running        Running 5 hours
-redis.6.b465edgho06e318egmgjbqo4o   redis:3.0.6  swarm-manager1  Running        Running 29 seconds
-redis.7.bg8c07zzg87di2mufeq51a2qp   redis:3.0.6  swarm-manager1  Running        Running 5 seconds
-redis.9.dkkual96p4bb3s6b10r7coxxt   redis:3.0.6  swarm-manager1  Running        Running 5 seconds
-redis.10.0tgctg8h8cech4w0k0gwrmr23  redis:3.0.6  swarm-manager1  Running        Running 5 seconds
-```
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is of "key=value". If there is more
-than one filter, then pass multiple flags (e.g., `--filter "foo=bar" --filter "bif=baz"`)
-
-The currently supported filters are:
-
-* [name](#name)
-* [id](#id)
-* [label](#label)
-* [desired-state](#desired-state)
-
-#### name
-
-The `name` filter matches on all or part of a task's name.
-
-The following filter matches all tasks with a name containing the `redis` string.
-
-```bash
-$ docker node ps -f name=redis swarm-manager1
-
-NAME                                IMAGE        NODE            DESIRED STATE  CURRENT STATE
-redis.1.7q92v0nr1hcgts2amcjyqg3pq   redis:3.0.6  swarm-manager1  Running        Running 5 hours
-redis.6.b465edgho06e318egmgjbqo4o   redis:3.0.6  swarm-manager1  Running        Running 29 seconds
-redis.7.bg8c07zzg87di2mufeq51a2qp   redis:3.0.6  swarm-manager1  Running        Running 5 seconds
-redis.9.dkkual96p4bb3s6b10r7coxxt   redis:3.0.6  swarm-manager1  Running        Running 5 seconds
-redis.10.0tgctg8h8cech4w0k0gwrmr23  redis:3.0.6  swarm-manager1  Running        Running 5 seconds
-```
-
-#### id
-
-The `id` filter matches a task's id.
-
-```bash
-$ docker node ps -f id=bg8c07zzg87di2mufeq51a2qp swarm-manager1
-
-NAME                                IMAGE        NODE            DESIRED STATE  CURRENT STATE
-redis.7.bg8c07zzg87di2mufeq51a2qp   redis:3.0.6  swarm-manager1  Running        Running 5 seconds
-```
-
-#### label
-
-The `label` filter matches tasks based on the presence of a `label` alone or a `label` and a
-value.
-
-The following filter matches tasks with the `usage` label regardless of its value.
-
-```bash
-$ docker node ps -f "label=usage"
-
-NAME                               IMAGE        NODE            DESIRED STATE  CURRENT STATE
-redis.6.b465edgho06e318egmgjbqo4o  redis:3.0.6  swarm-manager1  Running        Running 10 minutes
-redis.7.bg8c07zzg87di2mufeq51a2qp  redis:3.0.6  swarm-manager1  Running        Running 9 minutes
-```
-
-
-#### desired-state
-
-The `desired-state` filter can take the values `running`, `shutdown`, or `accepted`.
-
-
-### Formatting
-
-The formatting options (`--format`) pretty-prints tasks output
-using a Go template.
-
-Valid placeholders for the Go template are listed below:
-
-Placeholder     | Description
-----------------|------------------------------------------------------------------------------------------
-`.Name`         | Task name
-`.Image`        | Task image
-`.Node`         | Node ID
-`.DesiredState` | Desired state of the task (`running`, `shutdown`, or `accepted`)
-`.CurrentState` | Current state of the task
-`.Error`        | Error
-`.Ports`        | Task published ports
-
-When using the `--format` option, the `node ps` command will either
-output the data exactly as the template declares or, when using the
-`table` directive, includes column headers as well.
-
-The following example uses a template without headers and outputs the
-`Name` and `Image` entries separated by a colon for all tasks:
-
-```bash
-$ docker node ps --format "{{.Name}}: {{.Image}}"
-top.1: busybox
-top.2: busybox
-top.3: busybox
-```
-
-## Related commands
-
-* [node demote](node_demote.md)
-* [node inspect](node_inspect.md)
-* [node ls](node_ls.md)
-* [node promote](node_promote.md)
-* [node rm](node_rm.md)
-* [node update](node_update.md)
diff --git a/components/engine/docs/reference/commandline/node_rm.md b/components/engine/docs/reference/commandline/node_rm.md
deleted file mode 100644
index c2fdd4d156..0000000000
--- a/components/engine/docs/reference/commandline/node_rm.md
+++ /dev/null
@@ -1,80 +0,0 @@
----
-title: "node rm"
-description: "The node rm command description and usage"
-keywords: "node, remove"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# node rm
-
-```markdown
-Usage:	docker node rm [OPTIONS] NODE [NODE...]
-
-Remove one or more nodes from the swarm
-
-Aliases:
-  rm, remove
-
-Options:
-  -f, --force   Force remove a node from the swarm
-      --help    Print usage
-```
-
-## Description
-
-When run from a manager node, removes the specified nodes from a swarm.
-
-
-## Examples
-
-### Remove a stopped node from the swarm
-
-```bash
-$ docker node rm swarm-node-02
-
-Node swarm-node-02 removed from swarm
-```
-### Attempt to remove a running node from a swarm
-
-Removes the specified nodes from the swarm, but only if the nodes are in the
-down state. If you attempt to remove an active node you will receive an error:
-
-```non
-$ docker node rm swarm-node-03
-
-Error response from daemon: rpc error: code = 9 desc = node swarm-node-03 is not
-down and can't be removed
-```
-
-### Forcibly remove an inaccessible node from a swarm
-
-If you lose access to a worker node or need to shut it down because it has been
-compromised or is not behaving as expected, you can use the `--force` option.
-This may cause transient errors or interruptions, depending on the type of task
-being run on the node.
-
-```bash
-$ docker node rm --force swarm-node-03
-
-Node swarm-node-03 removed from swarm
-```
-
-A manager node must be demoted to a worker node (using `docker node demote`)
-before you can remove it from the swarm.
-
-## Related commands
-
-* [node demote](node_demote.md)
-* [node inspect](node_inspect.md)
-* [node ls](node_ls.md)
-* [node promote](node_promote.md)
-* [node ps](node_ps.md)
-* [node update](node_update.md)
diff --git a/components/engine/docs/reference/commandline/node_update.md b/components/engine/docs/reference/commandline/node_update.md
deleted file mode 100644
index 11117c7a9b..0000000000
--- a/components/engine/docs/reference/commandline/node_update.md
+++ /dev/null
@@ -1,77 +0,0 @@
----
-title: "node update"
-description: "The node update command description and usage"
-keywords: "resources, update, dynamically"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# update
-
-```markdown
-Usage:  docker node update [OPTIONS] NODE
-
-Update a node
-
-Options:
-      --availability string   Availability of the node ("active"|"pause"|"drain")
-      --help                  Print usage
-      --label-add value       Add or update a node label (key=value) (default [])
-      --label-rm value        Remove a node label if exists (default [])
-      --role string           Role of the node ("worker"|"manager")
-```
-
-## Description
-
-Update metadata about a node, such as its availability, labels, or roles.
-
-## Examples
-
-### Add label metadata to a node
-
-Add metadata to a swarm node using node labels. You can specify a node label as
-a key with an empty value:
-
-``` bash
-$ docker node update --label-add foo worker1
-```
-
-To add multiple labels to a node, pass the `--label-add` flag for each label:
-
-```bash
-$ docker node update --label-add foo --label-add bar worker1
-```
-
-When you [create a service](service_create.md),
-you can use node labels as a constraint. A constraint limits the nodes where the
-scheduler deploys tasks for a service.
-
-For example, to add a `type` label to identify nodes where the scheduler should
-deploy message queue service tasks:
-
-``` bash
-$ docker node update --label-add type=queue worker1
-```
-
-The labels you set for nodes using `docker node update` apply only to the node
-entity within the swarm. Do not confuse them with the docker daemon labels for
-[dockerd](https://docs.docker.com/engine/userguide/labels-custom-metadata/#daemon-labels).
-
-For more information about labels, refer to [apply custom
-metadata](https://docs.docker.com/engine/userguide/labels-custom-metadata/).
-
-## Related commands
-
-* [node demote](node_demote.md)
-* [node inspect](node_inspect.md)
-* [node ls](node_ls.md)
-* [node promote](node_promote.md)
-* [node ps](node_ps.md)
-* [node rm](node_rm.md)
diff --git a/components/engine/docs/reference/commandline/pause.md b/components/engine/docs/reference/commandline/pause.md
deleted file mode 100644
index 5bb652b923..0000000000
--- a/components/engine/docs/reference/commandline/pause.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-title: "pause"
-description: "The pause command description and usage"
-keywords: "cgroups, container, suspend, SIGSTOP"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# pause
-
-```markdown
-Usage:  docker pause CONTAINER [CONTAINER...]
-
-Pause all processes within one or more containers
-
-Options:
-      --help   Print usage
-```
-
-## Description
-
-The `docker pause` command suspends all processes in the specified containers.
-On Linux, this uses the cgroups freezer. Traditionally, when suspending a process
-the `SIGSTOP` signal is used, which is observable by the process being suspended.
-With the cgroups freezer the process is unaware, and unable to capture,
-that it is being suspended, and subsequently resumed. On Windows, only Hyper-V
-containers can be paused.
-
-See the
-[cgroups freezer documentation](https://www.kernel.org/doc/Documentation/cgroup-v1/freezer-subsystem.txt)
-for further details.
-
-## Examples
-
-```bash
-$ docker pause my_container
-```
-
-## Related commands
-
-* [unpause](unpause.md)
diff --git a/components/engine/docs/reference/commandline/plugin.md b/components/engine/docs/reference/commandline/plugin.md
deleted file mode 100644
index 75082477d1..0000000000
--- a/components/engine/docs/reference/commandline/plugin.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-title: "plugin"
-description: "The plugin command description and usage"
-keywords: "plugin"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# plugin
-
-```markdown
-Usage:  docker plugin COMMAND
-
-Manage plugins
-
-Options:
-      --help   Print usage
-
-Commands:
-  create      Create a plugin from a rootfs and configuration. Plugin data directory must contain config.json and rootfs directory.
-  disable     Disable a plugin
-  enable      Enable a plugin
-  inspect     Display detailed information on one or more plugins
-  install     Install a plugin
-  ls          List plugins
-  push        Push a plugin to a registry
-  rm          Remove one or more plugins
-  set         Change settings for a plugin
-  upgrade     Upgrade an existing plugin
-
-Run 'docker plugin COMMAND --help' for more information on a command.
-
-```
-
-## Description
-
-Manage plugins.
diff --git a/components/engine/docs/reference/commandline/plugin_create.md b/components/engine/docs/reference/commandline/plugin_create.md
deleted file mode 100644
index 5f16ac3e43..0000000000
--- a/components/engine/docs/reference/commandline/plugin_create.md
+++ /dev/null
@@ -1,66 +0,0 @@
----
-title: "plugin create"
-description: "the plugin create command description and usage"
-keywords: "plugin, create"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# plugin create
-
-```markdown
-Usage:  docker plugin create [OPTIONS] PLUGIN PLUGIN-DATA-DIR
-
-Create a plugin from a rootfs and configuration. Plugin data directory must contain config.json and rootfs directory.
-
-Options:
-      --compress   Compress the context using gzip
-      --help       Print usage
-```
-
-## Description
-
-Creates a plugin. Before creating the plugin, prepare the plugin's root filesystem as well as
-[the config.json](../../extend/config.md)
-
-## Examples
-
-The following example shows how to create a sample `plugin`.
-
-```bash
-$ ls -ls /home/pluginDir
-
-total 4
-4 -rw-r--r--  1 root root 431 Nov  7 01:40 config.json
-0 drwxr-xr-x 19 root root 420 Nov  7 01:40 rootfs
-
-$ docker plugin create plugin /home/pluginDir
-
-plugin
-
-$ docker plugin ls
-
-ID                  NAME                TAG                 DESCRIPTION                  ENABLED
-672d8144ec02        plugin              latest              A sample plugin for Docker   false
-```
-
-The plugin can subsequently be enabled for local use or pushed to the public registry.
-
-## Related commands
-
-* [plugin disable](plugin_disable.md)
-* [plugin enable](plugin_enable.md)
-* [plugin inspect](plugin_inspect.md)
-* [plugin install](plugin_install.md)
-* [plugin ls](plugin_ls.md)
-* [plugin push](plugin_push.md)
-* [plugin rm](plugin_rm.md)
-* [plugin set](plugin_set.md)
-* [plugin upgrade](plugin_upgrade.md)
diff --git a/components/engine/docs/reference/commandline/plugin_disable.md b/components/engine/docs/reference/commandline/plugin_disable.md
deleted file mode 100644
index fa1327b0c7..0000000000
--- a/components/engine/docs/reference/commandline/plugin_disable.md
+++ /dev/null
@@ -1,69 +0,0 @@
----
-title: "plugin disable"
-description: "the plugin disable command description and usage"
-keywords: "plugin, disable"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# plugin disable
-
-```markdown
-Usage:  docker plugin disable [OPTIONS] PLUGIN
-
-Disable a plugin
-
-Options:
-  -f, --force   Force the disable of an active plugin
-      --help    Print usage
-```
-
-## Description
-
-Disables a plugin. The plugin must be installed before it can be disabled,
-see [`docker plugin install`](plugin_install.md). Without the `-f` option,
-a plugin that has references (e.g., volumes, networks) cannot be disabled.
-
-## Examples
-
-The following example shows that the `sample-volume-plugin` plugin is installed
-and enabled:
-
-```bash
-$ docker plugin ls
-
-ID                  NAME                             TAG                 DESCRIPTION                ENABLED
-69553ca1d123        tiborvass/sample-volume-plugin   latest              A test plugin for Docker   true
-```
-
-To disable the plugin, use the following command:
-
-```bash
-$ docker plugin disable tiborvass/sample-volume-plugin
-
-tiborvass/sample-volume-plugin
-
-$ docker plugin ls
-
-ID                  NAME                             TAG                 DESCRIPTION                ENABLED
-69553ca1d123        tiborvass/sample-volume-plugin   latest              A test plugin for Docker   false
-```
-
-## Related commands
-
-* [plugin create](plugin_create.md)
-* [plugin enable](plugin_enable.md)
-* [plugin inspect](plugin_inspect.md)
-* [plugin install](plugin_install.md)
-* [plugin ls](plugin_ls.md)
-* [plugin push](plugin_push.md)
-* [plugin rm](plugin_rm.md)
-* [plugin set](plugin_set.md)
-* [plugin upgrade](plugin_upgrade.md)
diff --git a/components/engine/docs/reference/commandline/plugin_enable.md b/components/engine/docs/reference/commandline/plugin_enable.md
deleted file mode 100644
index 2098a115ad..0000000000
--- a/components/engine/docs/reference/commandline/plugin_enable.md
+++ /dev/null
@@ -1,68 +0,0 @@
----
-title: "plugin enable"
-description: "the plugin enable command description and usage"
-keywords: "plugin, enable"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# plugin enable
-
-```markdown
-Usage:  docker plugin enable [OPTIONS] PLUGIN
-
-Enable a plugin
-
-Options:
-      --help          Print usage
-      --timeout int   HTTP client timeout (in seconds)
-```
-
-## Description
-
-Enables a plugin. The plugin must be installed before it can be enabled,
-see [`docker plugin install`](plugin_install.md).
-
-## Examples
-
-The following example shows that the `sample-volume-plugin` plugin is installed,
-but disabled:
-
-```bash
-$ docker plugin ls
-
-ID                  NAME                             TAG                 DESCRIPTION                ENABLED
-69553ca1d123        tiborvass/sample-volume-plugin   latest              A test plugin for Docker   false
-```
-
-To enable the plugin, use the following command:
-
-```bash
-$ docker plugin enable tiborvass/sample-volume-plugin
-
-tiborvass/sample-volume-plugin
-
-$ docker plugin ls
-
-ID                  NAME                             TAG                 DESCRIPTION                ENABLED
-69553ca1d123        tiborvass/sample-volume-plugin   latest              A test plugin for Docker   true
-```
-
-## Related commands
-
-* [plugin create](plugin_create.md)
-* [plugin disable](plugin_disable.md)
-* [plugin inspect](plugin_inspect.md)
-* [plugin install](plugin_install.md)
-* [plugin ls](plugin_ls.md)
-* [plugin push](plugin_push.md)
-* [plugin rm](plugin_rm.md)
-* [plugin set](plugin_set.md)
-* [plugin upgrade](plugin_upgrade.md)
diff --git a/components/engine/docs/reference/commandline/plugin_inspect.md b/components/engine/docs/reference/commandline/plugin_inspect.md
deleted file mode 100644
index e1a6403343..0000000000
--- a/components/engine/docs/reference/commandline/plugin_inspect.md
+++ /dev/null
@@ -1,166 +0,0 @@
----
-title: "plugin inspect"
-description: "The plugin inspect command description and usage"
-keywords: "plugin, inspect"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# plugin inspect
-
-```markdown
-Usage:	docker plugin inspect [OPTIONS] PLUGIN [PLUGIN...]
-
-Display detailed information on one or more plugins
-
-Options:
-  -f, --format string   Format the output using the given Go template
-      --help            Print usage
-```
-
-## Description
-
-Returns information about a plugin. By default, this command renders all results
-in a JSON array.
-
-## Examples
-
-
-```none
-$ docker plugin inspect tiborvass/sample-volume-plugin:latest
-
-{
-  "Id": "8c74c978c434745c3ade82f1bc0acf38d04990eaf494fa507c16d9f1daa99c21",
-  "Name": "tiborvass/sample-volume-plugin:latest",
-  "PluginReference": "tiborvas/sample-volume-plugin:latest",
-  "Enabled": true,
-  "Config": {
-    "Mounts": [
-      {
-        "Name": "",
-        "Description": "",
-        "Settable": null,
-        "Source": "/data",
-        "Destination": "/data",
-        "Type": "bind",
-        "Options": [
-          "shared",
-          "rbind"
-        ]
-      },
-      {
-        "Name": "",
-        "Description": "",
-        "Settable": null,
-        "Source": null,
-        "Destination": "/foobar",
-        "Type": "tmpfs",
-        "Options": null
-      }
-    ],
-    "Env": [
-      "DEBUG=1"
-    ],
-    "Args": null,
-    "Devices": null
-  },
-  "Manifest": {
-    "ManifestVersion": "v0",
-    "Description": "A test plugin for Docker",
-    "Documentation": "https://docs.docker.com/engine/extend/plugins/",
-    "Interface": {
-      "Types": [
-        "docker.volumedriver/1.0"
-      ],
-      "Socket": "plugins.sock"
-    },
-    "Entrypoint": [
-      "plugin-sample-volume-plugin",
-      "/data"
-    ],
-    "Workdir": "",
-    "User": {
-    },
-    "Network": {
-      "Type": "host"
-    },
-    "Capabilities": null,
-    "Mounts": [
-      {
-        "Name": "",
-        "Description": "",
-        "Settable": null,
-        "Source": "/data",
-        "Destination": "/data",
-        "Type": "bind",
-        "Options": [
-          "shared",
-          "rbind"
-        ]
-      },
-      {
-        "Name": "",
-        "Description": "",
-        "Settable": null,
-        "Source": null,
-        "Destination": "/foobar",
-        "Type": "tmpfs",
-        "Options": null
-      }
-    ],
-    "Devices": [
-      {
-        "Name": "device",
-        "Description": "a host device to mount",
-        "Settable": null,
-        "Path": "/dev/cpu_dma_latency"
-      }
-    ],
-    "Env": [
-      {
-        "Name": "DEBUG",
-        "Description": "If set, prints debug messages",
-        "Settable": null,
-        "Value": "1"
-      }
-    ],
-    "Args": {
-      "Name": "args",
-      "Description": "command line arguments",
-      "Settable": null,
-      "Value": [
-
-      ]
-    }
-  }
-}
-```
-
-(output formatted for readability)
-
-### Formatting the output
-
-```bash
-$ docker plugin inspect -f '{{.Id}}' tiborvass/sample-volume-plugin:latest
-
-8c74c978c434745c3ade82f1bc0acf38d04990eaf494fa507c16d9f1daa99c21
-```
-
-## Related commands
-
-* [plugin create](plugin_create.md)
-* [plugin enable](plugin_enable.md)
-* [plugin disable](plugin_disable.md)
-* [plugin install](plugin_install.md)
-* [plugin ls](plugin_ls.md)
-* [plugin push](plugin_push.md)
-* [plugin rm](plugin_rm.md)
-* [plugin set](plugin_set.md)
-* [plugin upgrade](plugin_upgrade.md)
diff --git a/components/engine/docs/reference/commandline/plugin_install.md b/components/engine/docs/reference/commandline/plugin_install.md
deleted file mode 100644
index 78d9a61b75..0000000000
--- a/components/engine/docs/reference/commandline/plugin_install.md
+++ /dev/null
@@ -1,75 +0,0 @@
----
-title: "plugin install"
-description: "the plugin install command description and usage"
-keywords: "plugin, install"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# plugin install
-
-```markdown
-Usage:  docker plugin install [OPTIONS] PLUGIN [KEY=VALUE...]
-
-Install a plugin
-
-Options:
-      --alias string            Local name for plugin
-      --disable                 Do not enable the plugin on install
-      --disable-content-trust   Skip image verification (default true)
-      --grant-all-permissions   Grant all permissions necessary to run the plugin
-      --help                    Print usage
-```
-
-## Description
-
-Installs and enables a plugin. Docker looks first for the plugin on your Docker
-host. If the plugin does not exist locally, then the plugin is pulled from
-the registry. Note that the minimum required registry version to distribute
-plugins is 2.3.0
-
-## Examples
-
-The following example installs `vieus/sshfs` plugin and [sets](plugin_set.md) its
-`DEBUG` environment variable to `1`. To install, `pull` the plugin from Docker
-Hub and prompt the user to accept the list of privileges that the plugin needs,
-set the plugin's parameters and enable the plugin.
-
-```bash
-$ docker plugin install vieux/sshfs DEBUG=1
-
-Plugin "vieux/sshfs" is requesting the following privileges:
- - network: [host]
- - device: [/dev/fuse]
- - capabilities: [CAP_SYS_ADMIN]
-Do you grant the above permissions? [y/N] y
-vieux/sshfs
-```
-
-After the plugin is installed, it appears in the list of plugins:
-
-```bash
-$ docker plugin ls
-
-ID                  NAME                  TAG                 DESCRIPTION                ENABLED
-69553ca1d123        vieux/sshfs           latest              sshFS plugin for Docker    true
-```
-
-## Related commands
-
-* [plugin create](plugin_create.md)
-* [plugin disable](plugin_disable.md)
-* [plugin enable](plugin_enable.md)
-* [plugin inspect](plugin_inspect.md)
-* [plugin ls](plugin_ls.md)
-* [plugin push](plugin_push.md)
-* [plugin rm](plugin_rm.md)
-* [plugin set](plugin_set.md)
-* [plugin upgrade](plugin_upgrade.md)
diff --git a/components/engine/docs/reference/commandline/plugin_ls.md b/components/engine/docs/reference/commandline/plugin_ls.md
deleted file mode 100644
index 3ba29fee03..0000000000
--- a/components/engine/docs/reference/commandline/plugin_ls.md
+++ /dev/null
@@ -1,118 +0,0 @@
----
-title: "plugin ls"
-description: "The plugin ls command description and usage"
-keywords: "plugin, list"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# plugin ls
-
-```markdown
-Usage:  docker plugin ls [OPTIONS]
-
-List plugins
-
-Aliases:
-  ls, list
-
-Options:
-  -f, --filter filter   Provide filter values (e.g. 'enabled=true')
-      --format string   Pretty-print plugins using a Go template
-      --help            Print usage
-      --no-trunc        Don't truncate output
-  -q, --quiet           Only display plugin IDs
-```
-
-## Description
-
-Lists all the plugins that are currently installed. You can install plugins
-using the [`docker plugin install`](plugin_install.md) command.
-You can also filter using the `-f` or `--filter` flag.
-Refer to the [filtering](#filtering) section for more information about available filter options.
-
-## Examples
-
-```bash
-$ docker plugin ls
-
-ID                  NAME                             TAG                 DESCRIPTION                ENABLED
-69553ca1d123        tiborvass/sample-volume-plugin   latest              A test plugin for Docker   true
-```
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is of "key=value". If there is more
-than one filter, then pass multiple flags (e.g., `--filter "foo=bar" --filter "bif=baz"`)
-
-The currently supported filters are:
-
-* enabled (boolean - true or false, 0 or 1)
-* capability (string - currently `volumedriver`, `networkdriver`, `ipamdriver`, `logdriver`, `metricscollector`, or `authz`)
-
-#### enabled
-
-The `enabled` filter matches on plugins enabled or disabled.
-
-#### capability
-
-The `capability` filter matches on plugin capabilities. One plugin
-might have multiple capabilities. Currently `volumedriver`, `networkdriver`,
-`ipamdriver`, `logdriver`, `metricscollector`, and `authz` are supported capabilities.
-
-```bash
-$ docker plugin install --disable tiborvass/no-remove
-
-tiborvass/no-remove
-
-$ docker plugin ls --filter enabled=true
-
-NAME                  TAG                 DESCRIPTION                ENABLED
-```
-
-### Formatting
-
-The formatting options (`--format`) pretty-prints plugins output
-using a Go template.
-
-Valid placeholders for the Go template are listed below:
-
-Placeholder    | Description
----------------|------------------------------------------------------------------------------------------
-`.ID`              | Plugin ID
-`.Name`            | Plugin name
-`.Description`     | Plugin description
-`.Enabled`         | Whether plugin is enabled or not
-`.PluginReference` | The reference used to push/pull from a registry
-
-When using the `--format` option, the `plugin ls` command will either
-output the data exactly as the template declares or, when using the
-`table` directive, includes column headers as well.
-
-The following example uses a template without headers and outputs the
-`ID` and `Name` entries separated by a colon for all plugins:
-
-```bash
-$ docker plugin ls --format "{{.ID}}: {{.Name}}"
-
-4be01827a72e: tiborvass/no-remove
-```
-
-## Related commands
-
-* [plugin create](plugin_create.md)
-* [plugin disable](plugin_disable.md)
-* [plugin enable](plugin_enable.md)
-* [plugin inspect](plugin_inspect.md)
-* [plugin install](plugin_install.md)
-* [plugin push](plugin_push.md)
-* [plugin rm](plugin_rm.md)
-* [plugin set](plugin_set.md)
-* [plugin upgrade](plugin_upgrade.md)
diff --git a/components/engine/docs/reference/commandline/plugin_push.md b/components/engine/docs/reference/commandline/plugin_push.md
deleted file mode 100644
index f444ed4d4d..0000000000
--- a/components/engine/docs/reference/commandline/plugin_push.md
+++ /dev/null
@@ -1,57 +0,0 @@
----
-title: "plugin push"
-description: "the plugin push command description and usage"
-keywords: "plugin, push"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-```markdown
-Usage:	docker plugin push [OPTIONS] PLUGIN[:TAG]
-
-Push a plugin to a registry
-
-Options:
-      --disable-content-trust   Skip image signing (default true)
-      --help                    Print usage
-```
-
-## Description
-
-After you have created a plugin using `docker plugin create` and the plugin is
-ready for distribution, use `docker plugin push` to share your images to Docker
-Hub or a self-hosted registry.
-
-Registry credentials are managed by [docker login](login.md).
-
-## Examples
-
-The following example shows how to push a sample `user/plugin`.
-
-```bash
-$ docker plugin ls
-
-ID                  NAME                  TAG                 DESCRIPTION                ENABLED
-69553ca1d456        user/plugin           latest              A sample plugin for Docker false
-
-$ docker plugin push user/plugin
-```
-
-## Related commands
-
-* [plugin create](plugin_create.md)
-* [plugin disable](plugin_disable.md)
-* [plugin enable](plugin_enable.md)
-* [plugin inspect](plugin_inspect.md)
-* [plugin install](plugin_install.md)
-* [plugin ls](plugin_ls.md)
-* [plugin rm](plugin_rm.md)
-* [plugin set](plugin_set.md)
-* [plugin upgrade](plugin_upgrade.md)
diff --git a/components/engine/docs/reference/commandline/plugin_rm.md b/components/engine/docs/reference/commandline/plugin_rm.md
deleted file mode 100644
index d599ed8fc1..0000000000
--- a/components/engine/docs/reference/commandline/plugin_rm.md
+++ /dev/null
@@ -1,63 +0,0 @@
----
-title: "plugin rm"
-description: "the plugin rm command description and usage"
-keywords: "plugin, rm"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# plugin rm
-
-```markdown
-Usage:  docker plugin rm [OPTIONS] PLUGIN [PLUGIN...]
-
-Remove one or more plugins
-
-Aliases:
-  rm, remove
-
-Options:
-      -f, --force  Force the removal of an active plugin
-          --help   Print usage
-```
-
-## Description
-
-Removes a plugin. You cannot remove a plugin if it is enabled, you must disable
-a plugin using the [`docker plugin disable`](plugin_disable.md) before removing
-it (or use --force, use of force is not recommended, since it can affect
-functioning of running containers using the plugin).
-
-## Examples
-
-The following example disables and removes the `sample-volume-plugin:latest`
-plugin:
-
-```bash
-$ docker plugin disable tiborvass/sample-volume-plugin
-
-tiborvass/sample-volume-plugin
-
-$ docker plugin rm tiborvass/sample-volume-plugin:latest
-
-tiborvass/sample-volume-plugin
-```
-
-## Related commands
-
-* [plugin create](plugin_create.md)
-* [plugin disable](plugin_disable.md)
-* [plugin enable](plugin_enable.md)
-* [plugin inspect](plugin_inspect.md)
-* [plugin install](plugin_install.md)
-* [plugin ls](plugin_ls.md)
-* [plugin push](plugin_push.md)
-* [plugin set](plugin_set.md)
-* [plugin upgrade](plugin_upgrade.md)
diff --git a/components/engine/docs/reference/commandline/plugin_set.md b/components/engine/docs/reference/commandline/plugin_set.md
deleted file mode 100644
index ea7d92e735..0000000000
--- a/components/engine/docs/reference/commandline/plugin_set.md
+++ /dev/null
@@ -1,172 +0,0 @@
----
-title: "plugin set"
-description: "the plugin set command description and usage"
-keywords: "plugin, set"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# plugin set
-
-```markdown
-Usage:  docker plugin set PLUGIN KEY=VALUE [KEY=VALUE...]
-
-Change settings for a plugin
-
-Options:
-      --help                    Print usage
-```
-
-## Description
-
-Change settings for a plugin. The plugin must be disabled.
-
-The settings currently supported are:
- * env variables
- * source of mounts
- * path of devices
- * args
-
-## What is settable ?
-
-Look at the plugin manifest, it's easy to see what fields are settable,
-by looking at the `Settable` field.
-
-Here is an extract of a plugin manifest:
-
-```
-{
-        "config": {
-            ...
-            "args": {
-                "name": "myargs",
-                "settable": ["value"],
-                "value": ["foo", "bar"]
-            },
-            "env": [
-                {
-                    "name": "DEBUG",
-                    "settable": ["value"],
-                    "value": "0"
-                },
-                {
-                    "name": "LOGGING",
-                    "value": "1"
-                }
-            ],
-	    "devices": [
-                {
-                    "name": "mydevice",
-                    "path": "/dev/foo",
-                    "settable": ["path"]
-                }
-            ],
-	    "mounts": [
-                {
-                    "destination": "/baz",
-                    "name": "mymount",
-                    "options": ["rbind"],
-                    "settable": ["source"],
-                    "source": "/foo",
-                    "type": "bind"
-                }
-            ],
-	    ...
-	 }
-}
-```
-
-In this example, we can see that the `value` of the `DEBUG` environment variable is settable,
-the `source` of the `mymount` mount is also settable. Same for the `path` of `mydevice` and `value` of `myargs`.
-
-On the contrary, the `LOGGING` environment variable doesn't have any settable field, which implies that user cannot tweak it.
-
-## Examples
-
-### Change an environment variable
-
-The following example change the env variable `DEBUG` on the
-`sample-volume-plugin` plugin.
-
-```bash
-$ docker plugin inspect -f {{.Settings.Env}} tiborvass/sample-volume-plugin
-[DEBUG=0]
-
-$ docker plugin set tiborvass/sample-volume-plugin DEBUG=1
-
-$ docker plugin inspect -f {{.Settings.Env}} tiborvass/sample-volume-plugin
-[DEBUG=1]
-```
-
-### Change the source of a mount
-
-The following example change the source of the `mymount` mount on
-the `myplugin` plugin.
-
-```bash
-$ docker plugin inspect -f '{{with $mount := index .Settings.Mounts 0}}{{$mount.Source}}{{end}}' myplugin
-/foo
-
-$ docker plugins set myplugin mymount.source=/bar
-
-$ docker plugin inspect -f '{{with $mount := index .Settings.Mounts 0}}{{$mount.Source}}{{end}}' myplugin
-/bar
-```
-
-> **Note**: Since only `source` is settable in `mymount`,
-> `docker plugins set mymount=/bar myplugin` would work too.
-
-### Change a device path
-
-The following example change the path of the `mydevice` device on
-the `myplugin` plugin.
-
-```bash
-$ docker plugin inspect -f '{{with $device := index .Settings.Devices 0}}{{$device.Path}}{{end}}' myplugin
-
-/dev/foo
-
-$ docker plugins set myplugin mydevice.path=/dev/bar
-
-$ docker plugin inspect -f '{{with $device := index .Settings.Devices 0}}{{$device.Path}}{{end}}' myplugin
-
-/dev/bar
-```
-
-> **Note**: Since only `path` is settable in `mydevice`,
-> `docker plugins set mydevice=/dev/bar myplugin` would work too.
-
-### Change the source of the arguments
-
-The following example change the value of the args on the `myplugin` plugin.
-
-```bash
-$ docker plugin inspect -f '{{.Settings.Args}}' myplugin
-
-["foo", "bar"]
-
-$ docker plugins set myplugin myargs="foo bar baz"
-
-$ docker plugin inspect -f '{{.Settings.Args}}' myplugin
-
-["foo", "bar", "baz"]
-```
-
-## Related commands
-
-* [plugin create](plugin_create.md)
-* [plugin disable](plugin_disable.md)
-* [plugin enable](plugin_enable.md)
-* [plugin inspect](plugin_inspect.md)
-* [plugin install](plugin_install.md)
-* [plugin ls](plugin_ls.md)
-* [plugin push](plugin_push.md)
-* [plugin rm](plugin_rm.md)
-* [plugin upgrade](plugin_upgrade.md)
diff --git a/components/engine/docs/reference/commandline/plugin_upgrade.md b/components/engine/docs/reference/commandline/plugin_upgrade.md
deleted file mode 100644
index 8c79ebdabf..0000000000
--- a/components/engine/docs/reference/commandline/plugin_upgrade.md
+++ /dev/null
@@ -1,100 +0,0 @@
----
-title: "plugin upgrade"
-description: "the plugin upgrade command description and usage"
-keywords: "plugin, upgrade"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# plugin upgrade
-
-```markdown
-Usage:  docker plugin upgrade [OPTIONS] PLUGIN [REMOTE]
-
-Upgrade a plugin
-
-Options:
-      --disable-content-trust   Skip image verification (default true)
-      --grant-all-permissions   Grant all permissions necessary to run the plugin
-      --help                    Print usage
-      --skip-remote-check       Do not check if specified remote plugin matches existing plugin image
-```
-
-## Description
-
-Upgrades an existing plugin to the specified remote plugin image. If no remote
-is specified, Docker will re-pull the current image and use the updated version.
-All existing references to the plugin will continue to work.
-The plugin must be disabled before running the upgrade.
-
-## Examples
-
-The following example installs `vieus/sshfs` plugin, uses it to create and use
-a volume, then upgrades the plugin.
-
-```bash
-$ docker plugin install vieux/sshfs DEBUG=1
-
-Plugin "vieux/sshfs:next" is requesting the following privileges:
- - network: [host]
- - device: [/dev/fuse]
- - capabilities: [CAP_SYS_ADMIN]
-Do you grant the above permissions? [y/N] y
-vieux/sshfs:next
-
-$ docker volume create -d vieux/sshfs:next -o sshcmd=root@1.2.3.4:/tmp/shared -o password=XXX sshvolume
-
-sshvolume
-
-$ docker run -it -v sshvolume:/data alpine sh -c "touch /data/hello"
-
-$ docker plugin disable -f vieux/sshfs:next
-
-viex/sshfs:next
-
-# Here docker volume ls doesn't show 'sshfsvolume', since the plugin is disabled
-$ docker volume ls
-
-DRIVER              VOLUME NAME
-
-$ docker plugin upgrade vieux/sshfs:next vieux/sshfs:next
-
-Plugin "vieux/sshfs:next" is requesting the following privileges:
- - network: [host]
- - device: [/dev/fuse]
- - capabilities: [CAP_SYS_ADMIN]
-Do you grant the above permissions? [y/N] y
-Upgrade plugin vieux/sshfs:next to vieux/sshfs:next
-
-$ docker plugin enable vieux/sshfs:next
-
-viex/sshfs:next
-
-$ docker volume ls
-
-DRIVER              VOLUME NAME
-viuex/sshfs:next    sshvolume
-
-$ docker run -it -v sshvolume:/data alpine sh -c "ls /data"
-
-hello
-```
-
-## Related commands
-
-* [plugin create](plugin_create.md)
-* [plugin disable](plugin_disable.md)
-* [plugin enable](plugin_enable.md)
-* [plugin inspect](plugin_inspect.md)
-* [plugin install](plugin_install.md)
-* [plugin ls](plugin_ls.md)
-* [plugin push](plugin_push.md)
-* [plugin rm](plugin_rm.md)
-* [plugin set](plugin_set.md)
diff --git a/components/engine/docs/reference/commandline/port.md b/components/engine/docs/reference/commandline/port.md
deleted file mode 100644
index c38763ea34..0000000000
--- a/components/engine/docs/reference/commandline/port.md
+++ /dev/null
@@ -1,47 +0,0 @@
----
-title: "port"
-description: "The port command description and usage"
-keywords: "port, mapping, container"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# port
-
-```markdown
-Usage:  docker port CONTAINER [PRIVATE_PORT[/PROTO]]
-
-List port mappings or a specific mapping for the container
-
-Options:
-      --help   Print usage
-```
-
-## Examples
-
-### Show all mapped ports
-
-You can find out all the ports mapped by not specifying a `PRIVATE_PORT`, or
-just a specific mapping:
-
-```bash
-$ docker ps
-CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS                                            NAMES
-b650456536c7        busybox:latest      top                 54 minutes ago      Up 54 minutes       0.0.0.0:1234->9876/tcp, 0.0.0.0:4321->7890/tcp   test
-$ docker port test
-7890/tcp -> 0.0.0.0:4321
-9876/tcp -> 0.0.0.0:1234
-$ docker port test 7890/tcp
-0.0.0.0:4321
-$ docker port test 7890/udp
-2014/06/24 11:53:36 Error: No public port '7890/udp' published for test
-$ docker port test 7890
-0.0.0.0:4321
-```
diff --git a/components/engine/docs/reference/commandline/ps.md b/components/engine/docs/reference/commandline/ps.md
deleted file mode 100644
index 51bab4834d..0000000000
--- a/components/engine/docs/reference/commandline/ps.md
+++ /dev/null
@@ -1,432 +0,0 @@
----
-title: "ps"
-description: "The ps command description and usage"
-keywords: "container, running, list"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# ps
-
-```markdown
-Usage: docker ps [OPTIONS]
-
-List containers
-
-Options:
-  -a, --all             Show all containers (default shows just running)
-  -f, --filter value    Filter output based on conditions provided (default [])
-                        - ancestor=(<image-name>[:tag]|<image-id>|<image@digest>)
-                          containers created from an image or a descendant.
-                        - before=(<container-name>|<container-id>)
-                        - expose=(<port>[/<proto>]|<startport-endport>/[<proto>])
-                        - exited=<int> an exit code of <int>
-                        - health=(starting|healthy|unhealthy|none)
-                        - id=<ID> a container's ID
-                        - isolation=(`default`|`process`|`hyperv`) (Windows daemon only)
-                        - is-task=(true|false)
-                        - label=<key> or label=<key>=<value>
-                        - name=<string> a container's name
-                        - network=(<network-id>|<network-name>)
-                        - publish=(<port>[/<proto>]|<startport-endport>/[<proto>])
-                        - since=(<container-name>|<container-id>)
-                        - status=(created|restarting|removing|running|paused|exited)
-                        - volume=(<volume name>|<mount point destination>)
-      --format string   Pretty-print containers using a Go template
-      --help            Print usage
-  -n, --last int        Show n last created containers (includes all states) (default -1)
-  -l, --latest          Show the latest created container (includes all states)
-      --no-trunc        Don't truncate output
-  -q, --quiet           Only display numeric IDs
-  -s, --size            Display total file sizes
-```
-
-## Examples
-
-### Prevent truncating output
-
-Running `docker ps --no-trunc` showing 2 linked containers.
-
-```bash
-$ docker ps
-
-CONTAINER ID        IMAGE                        COMMAND                CREATED              STATUS              PORTS               NAMES
-4c01db0b339c        ubuntu:12.04                 bash                   17 seconds ago       Up 16 seconds       3300-3310/tcp       webapp
-d7886598dbe2        crosbymichael/redis:latest   /redis-server --dir    33 minutes ago       Up 33 minutes       6379/tcp            redis,webapp/db
-```
-
-### Show both running and stopped containers
-
-The `docker ps` command only shows running containers by default. To see all
-containers, use the `-a` (or `--all`) flag:
-
-```bash
-$ docker ps -a
-```
-
-`docker ps` groups exposed ports into a single range if possible. E.g., a
-container that exposes TCP ports `100, 101, 102` displays `100-102/tcp` in
-the `PORTS` column.
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is a `key=value` pair. If there is more
-than one filter, then pass multiple flags (e.g. `--filter "foo=bar" --filter "bif=baz"`)
-
-The currently supported filters are:
-
-* id (container's id)
-* label (`label=<key>` or `label=<key>=<value>`)
-* name (container's name)
-* exited (int - the code of exited containers. Only useful with `--all`)
-* status (`created|restarting|running|removing|paused|exited|dead`)
-* ancestor (`<image-name>[:<tag>]`,  `<image id>` or `<image@digest>`) - filters containers that were created from the given image or a descendant.
-* before (container's id or name) - filters containers created before given id or name
-* since (container's id or name) - filters containers created since given id or name
-* isolation (`default|process|hyperv`)   (Windows daemon only)
-* volume (volume name or mount point) - filters containers that mount volumes.
-* network (network id or name) - filters containers connected to the provided network
-* health (starting|healthy|unhealthy|none) - filters containers based on healthcheck status
-* publish=(container's published port) - filters published ports by containers
-* expose=(container's exposed port) - filters exposed ports by containers
-
-#### label
-
-The `label` filter matches containers based on the presence of a `label` alone or a `label` and a
-value.
-
-The following filter matches containers with the `color` label regardless of its value.
-
-```bash
-$ docker ps --filter "label=color"
-
-CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
-673394ef1d4c        busybox             "top"               47 seconds ago      Up 45 seconds                           nostalgic_shockley
-d85756f57265        busybox             "top"               52 seconds ago      Up 51 seconds                           high_albattani
-```
-
-The following filter matches containers with the `color` label with the `blue` value.
-
-```bash
-$ docker ps --filter "label=color=blue"
-
-CONTAINER ID        IMAGE               COMMAND             CREATED              STATUS              PORTS               NAMES
-d85756f57265        busybox             "top"               About a minute ago   Up About a minute                       high_albattani
-```
-
-#### name
-
-The `name` filter matches on all or part of a container's name.
-
-The following filter matches all containers with a name containing the `nostalgic_stallman` string.
-
-```bash
-$ docker ps --filter "name=nostalgic_stallman"
-
-CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
-9b6247364a03        busybox             "top"               2 minutes ago       Up 2 minutes                            nostalgic_stallman
-```
-
-You can also filter for a substring in a name as this shows:
-
-```bash
-$ docker ps --filter "name=nostalgic"
-
-CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
-715ebfcee040        busybox             "top"               3 seconds ago       Up 1 second                             i_am_nostalgic
-9b6247364a03        busybox             "top"               7 minutes ago       Up 7 minutes                            nostalgic_stallman
-673394ef1d4c        busybox             "top"               38 minutes ago      Up 38 minutes                           nostalgic_shockley
-```
-
-#### exited
-
-The `exited` filter matches containers by exist status code. For example, to
-filter for containers that have exited successfully:
-
-```bash
-$ docker ps -a --filter 'exited=0'
-
-CONTAINER ID        IMAGE             COMMAND                CREATED             STATUS                   PORTS                      NAMES
-ea09c3c82f6e        registry:latest   /srv/run.sh            2 weeks ago         Exited (0) 2 weeks ago   127.0.0.1:5000->5000/tcp   desperate_leakey
-106ea823fe4e        fedora:latest     /bin/sh -c 'bash -l'   2 weeks ago         Exited (0) 2 weeks ago                              determined_albattani
-48ee228c9464        fedora:20         bash                   2 weeks ago         Exited (0) 2 weeks ago                              tender_torvalds
-```
-
-#### Filter by exit signal
-
-You can use a filter to locate containers that exited with status of `137`
-meaning a `SIGKILL(9)` killed them.
-
-```none
-$ docker ps -a --filter 'exited=137'
-
-CONTAINER ID        IMAGE               COMMAND                CREATED             STATUS                       PORTS               NAMES
-b3e1c0ed5bfe        ubuntu:latest       "sleep 1000"           12 seconds ago      Exited (137) 5 seconds ago                       grave_kowalevski
-a2eb5558d669        redis:latest        "/entrypoint.sh redi   2 hours ago         Exited (137) 2 hours ago                         sharp_lalande
-```
-
-Any of these events result in a `137` status:
-
-* the `init` process of the container is killed manually
-* `docker kill` kills the container
-* Docker daemon restarts which kills all running containers
-
-#### status
-
-The `status` filter matches containers by status. You can filter using
-`created`, `restarting`, `running`, `removing`, `paused`, `exited` and `dead`. For example,
-to filter for `running` containers:
-
-```bash
-$ docker ps --filter status=running
-
-CONTAINER ID        IMAGE                  COMMAND             CREATED             STATUS              PORTS               NAMES
-715ebfcee040        busybox                "top"               16 minutes ago      Up 16 minutes                           i_am_nostalgic
-d5c976d3c462        busybox                "top"               23 minutes ago      Up 23 minutes                           top
-9b6247364a03        busybox                "top"               24 minutes ago      Up 24 minutes                           nostalgic_stallman
-```
-
-To filter for `paused` containers:
-
-```bash
-$ docker ps --filter status=paused
-
-CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                      PORTS               NAMES
-673394ef1d4c        busybox             "top"               About an hour ago   Up About an hour (Paused)                       nostalgic_shockley
-```
-
-#### ancestor
-
-The `ancestor` filter matches containers based on its image or a descendant of
-it. The filter supports the following image representation:
-
-- image
-- image:tag
-- image:tag@digest
-- short-id
-- full-id
-
-If you don't specify a `tag`, the `latest` tag is used. For example, to filter
-for containers that use the latest `ubuntu` image:
-
-```bash
-$ docker ps --filter ancestor=ubuntu
-
-CONTAINER ID        IMAGE               COMMAND             CREATED              STATUS              PORTS               NAMES
-919e1179bdb8        ubuntu-c1           "top"               About a minute ago   Up About a minute                       admiring_lovelace
-5d1e4a540723        ubuntu-c2           "top"               About a minute ago   Up About a minute                       admiring_sammet
-82a598284012        ubuntu              "top"               3 minutes ago        Up 3 minutes                            sleepy_bose
-bab2a34ba363        ubuntu              "top"               3 minutes ago        Up 3 minutes                            focused_yonath
-```
-
-Match containers based on the `ubuntu-c1` image which, in this case, is a child
-of `ubuntu`:
-
-```bash
-$ docker ps --filter ancestor=ubuntu-c1
-
-CONTAINER ID        IMAGE               COMMAND             CREATED              STATUS              PORTS               NAMES
-919e1179bdb8        ubuntu-c1           "top"               About a minute ago   Up About a minute                       admiring_lovelace
-```
-
-Match containers based on the `ubuntu` version `12.04.5` image:
-
-```bash
-$ docker ps --filter ancestor=ubuntu:12.04.5
-
-CONTAINER ID        IMAGE               COMMAND             CREATED              STATUS              PORTS               NAMES
-82a598284012        ubuntu:12.04.5      "top"               3 minutes ago        Up 3 minutes                            sleepy_bose
-```
-
-The following matches containers based on the layer `d0e008c6cf02` or an image
-that have this layer in its layer stack.
-
-```bash
-$ docker ps --filter ancestor=d0e008c6cf02
-
-CONTAINER ID        IMAGE               COMMAND             CREATED              STATUS              PORTS               NAMES
-82a598284012        ubuntu:12.04.5      "top"               3 minutes ago        Up 3 minutes                            sleepy_bose
-```
-
-#### Create time
-
-##### before
-
-The `before` filter shows only containers created before the container with
-given id or name. For example, having these containers created:
-
-```bash
-$ docker ps
-
-CONTAINER ID        IMAGE       COMMAND       CREATED              STATUS              PORTS              NAMES
-9c3527ed70ce        busybox     "top"         14 seconds ago       Up 15 seconds                          desperate_dubinsky
-4aace5031105        busybox     "top"         48 seconds ago       Up 49 seconds                          focused_hamilton
-6e63f6ff38b0        busybox     "top"         About a minute ago   Up About a minute                      distracted_fermat
-```
-
-Filtering with `before` would give:
-
-```bash
-$ docker ps -f before=9c3527ed70ce
-
-CONTAINER ID        IMAGE       COMMAND       CREATED              STATUS              PORTS              NAMES
-4aace5031105        busybox     "top"         About a minute ago   Up About a minute                      focused_hamilton
-6e63f6ff38b0        busybox     "top"         About a minute ago   Up About a minute                      distracted_fermat
-```
-
-##### since
-
-The `since` filter shows only containers created since the container with given
-id or name. For example, with the same containers as in `before` filter:
-
-```bash
-$ docker ps -f since=6e63f6ff38b0
-
-CONTAINER ID        IMAGE       COMMAND       CREATED             STATUS              PORTS               NAMES
-9c3527ed70ce        busybox     "top"         10 minutes ago      Up 10 minutes                           desperate_dubinsky
-4aace5031105        busybox     "top"         10 minutes ago      Up 10 minutes                           focused_hamilton
-```
-
-#### volume
-
-The `volume` filter shows only containers that mount a specific volume or have
-a volume mounted in a specific path:
-
-```bash
-$ docker ps --filter volume=remote-volume --format "table {{.ID}}\t{{.Mounts}}"
-CONTAINER ID        MOUNTS
-9c3527ed70ce        remote-volume
-
-$ docker ps --filter volume=/data --format "table {{.ID}}\t{{.Mounts}}"
-CONTAINER ID        MOUNTS
-9c3527ed70ce        remote-volume
-```
-
-#### network
-
-The `network` filter shows only containers that are connected to a network with
-a given name or id.
-
-The following filter matches all containers that are connected to a network
-with a name containing `net1`.
-
-```bash
-$ docker run -d --net=net1 --name=test1 ubuntu top
-$ docker run -d --net=net2 --name=test2 ubuntu top
-
-$ docker ps --filter network=net1
-
-CONTAINER ID        IMAGE       COMMAND       CREATED             STATUS              PORTS               NAMES
-9d4893ed80fe        ubuntu      "top"         10 minutes ago      Up 10 minutes                           test1
-```
-
-The network filter matches on both the network's name and id. The following
-example shows all containers that are attached to the `net1` network, using
-the network id as a filter;
-
-```bash
-$ docker network inspect --format "{{.ID}}" net1
-
-8c0b4110ae930dbe26b258de9bc34a03f98056ed6f27f991d32919bfe401d7c5
-
-$ docker ps --filter network=8c0b4110ae930dbe26b258de9bc34a03f98056ed6f27f991d32919bfe401d7c5
-
-CONTAINER ID        IMAGE       COMMAND       CREATED             STATUS              PORTS               NAMES
-9d4893ed80fe        ubuntu      "top"         10 minutes ago      Up 10 minutes                           test1
-```
-
-#### publish and expose
-
-The `publish` and `expose` filters show only containers that have published or exposed port with a given port
-number, port range, and/or protocol. The default protocol is `tcp` when not specified.
-
-The following filter matches all containers that have published port of 80:
-
-```bash
-$ docker run -d --publish=80 busybox top
-$ docker run -d --expose=8080 busybox top
-
-$ docker ps -a
-
-CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS                   NAMES
-9833437217a5        busybox             "top"               5 seconds ago       Up 4 seconds        8080/tcp                dreamy_mccarthy
-fc7e477723b7        busybox             "top"               50 seconds ago      Up 50 seconds       0.0.0.0:32768->80/tcp   admiring_roentgen
-
-$ docker ps --filter publish=80
-
-CONTAINER ID        IMAGE               COMMAND             CREATED              STATUS              PORTS                   NAMES
-fc7e477723b7        busybox             "top"               About a minute ago   Up About a minute   0.0.0.0:32768->80/tcp   admiring_roentgen
-```
-
-The following filter matches all containers that have exposed TCP port in the range of `8000-8080`:
-```bash
-$ docker ps --filter expose=8000-8080/tcp
-
-CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
-9833437217a5        busybox             "top"               21 seconds ago      Up 19 seconds       8080/tcp            dreamy_mccarthy
-```
-
-The following filter matches all containers that have exposed UDP port `80`:
-```bash
-$ docker ps --filter publish=80/udp
-
-CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
-```
-
-### Formatting
-
-The formatting option (`--format`) pretty-prints container output using a Go
-template.
-
-Valid placeholders for the Go template are listed below:
-
-Placeholder   | Description
---------------|----------------------------------------------------------------------------------------------------
-`.ID`         | Container ID
-`.Image`      | Image ID
-`.Command`    | Quoted command
-`.CreatedAt`  | Time when the container was created.
-`.RunningFor` | Elapsed time since the container was started.
-`.Ports`      | Exposed ports.
-`.Status`     | Container status.
-`.Size`       | Container disk size.
-`.Names`      | Container names.
-`.Labels`     | All labels assigned to the container.
-`.Label`      | Value of a specific label for this container. For example `'{{.Label "com.docker.swarm.cpu"}}'`
-`.Mounts`     | Names of the volumes mounted in this container.
-`.Networks`   | Names of the networks attached to this container.
-
-When using the `--format` option, the `ps` command will either output the data
-exactly as the template declares or, when using the `table` directive, includes
-column headers as well.
-
-The following example uses a template without headers and outputs the `ID` and
-`Command` entries separated by a colon for all running containers:
-
-```bash
-$ docker ps --format "{{.ID}}: {{.Command}}"
-
-a87ecb4f327c: /bin/sh -c #(nop) MA
-01946d9d34d8: /bin/sh -c #(nop) MA
-c1d3b0166030: /bin/sh -c yum -y up
-41d50ecd2f57: /bin/sh -c #(nop) MA
-```
-
-To list all running containers with their labels in a table format you can use:
-
-```bash
-$ docker ps --format "table {{.ID}}\t{{.Labels}}"
-
-CONTAINER ID        LABELS
-a87ecb4f327c        com.docker.swarm.node=ubuntu,com.docker.swarm.storage=ssd
-01946d9d34d8
-c1d3b0166030        com.docker.swarm.node=debian,com.docker.swarm.cpu=6
-41d50ecd2f57        com.docker.swarm.node=fedora,com.docker.swarm.cpu=3,com.docker.swarm.storage=ssd
-```
diff --git a/components/engine/docs/reference/commandline/pull.md b/components/engine/docs/reference/commandline/pull.md
deleted file mode 100644
index 7bf3df8363..0000000000
--- a/components/engine/docs/reference/commandline/pull.md
+++ /dev/null
@@ -1,254 +0,0 @@
----
-title: "pull"
-description: "The pull command description and usage"
-keywords: "pull, image, hub, docker"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# pull
-
-```markdown
-Usage:  docker pull [OPTIONS] NAME[:TAG|@DIGEST]
-
-Pull an image or a repository from a registry
-
-Options:
-  -a, --all-tags                Download all tagged images in the repository
-      --disable-content-trust   Skip image verification (default true)
-      --help                    Print usage
-```
-
-## Description
-
-Most of your images will be created on top of a base image from the
-[Docker Hub](https://hub.docker.com) registry.
-
-[Docker Hub](https://hub.docker.com) contains many pre-built images that you
-can `pull` and try without needing to define and configure your own.
-
-To download a particular image, or set of images (i.e., a repository),
-use `docker pull`.
-
-### Proxy configuration
-
-If you are behind an HTTP proxy server, for example in corporate settings,
-before open a connect to registry, you may need to configure the Docker
-daemon's proxy settings, using the `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`
-environment variables. To set these environment variables on a host using
-`systemd`, refer to the [control and configure Docker with systemd](https://docs.docker.com/engine/admin/systemd/#http-proxy)
-for variables configuration.
-
-### Concurrent downloads
-
-By default the Docker daemon will pull three layers of an image at a time.
-If you are on a low bandwidth connection this may cause timeout issues and you may want to lower
-this via the `--max-concurrent-downloads` daemon option. See the
-[daemon documentation](dockerd.md) for more details.
-
-## Examples
-
-### Pull an image from Docker Hub
-
-To download a particular image, or set of images (i.e., a repository), use
-`docker pull`. If no tag is provided, Docker Engine uses the `:latest` tag as a
-default. This command pulls the `debian:latest` image:
-
-```bash
-$ docker pull debian
-
-Using default tag: latest
-latest: Pulling from library/debian
-fdd5d7827f33: Pull complete
-a3ed95caeb02: Pull complete
-Digest: sha256:e7d38b3517548a1c71e41bffe9c8ae6d6d29546ce46bf62159837aad072c90aa
-Status: Downloaded newer image for debian:latest
-```
-
-Docker images can consist of multiple layers. In the example above, the image
-consists of two layers; `fdd5d7827f33` and `a3ed95caeb02`.
-
-Layers can be reused by images. For example, the `debian:jessie` image shares
-both layers with `debian:latest`. Pulling the `debian:jessie` image therefore
-only pulls its metadata, but not its layers, because all layers are already
-present locally:
-
-```bash
-$ docker pull debian:jessie
-
-jessie: Pulling from library/debian
-fdd5d7827f33: Already exists
-a3ed95caeb02: Already exists
-Digest: sha256:a9c958be96d7d40df920e7041608f2f017af81800ca5ad23e327bc402626b58e
-Status: Downloaded newer image for debian:jessie
-```
-
-To see which images are present locally, use the [`docker images`](images.md)
-command:
-
-```bash
-$ docker images
-
-REPOSITORY   TAG      IMAGE ID        CREATED      SIZE
-debian       jessie   f50f9524513f    5 days ago   125.1 MB
-debian       latest   f50f9524513f    5 days ago   125.1 MB
-```
-
-Docker uses a content-addressable image store, and the image ID is a SHA256
-digest covering the image's configuration and layers. In the example above,
-`debian:jessie` and `debian:latest` have the same image ID because they are
-actually the *same* image tagged with different names. Because they are the
-same image, their layers are stored only once and do not consume extra disk
-space.
-
-For more information about images, layers, and the content-addressable store,
-refer to [understand images, containers, and storage drivers](https://docs.docker.com/engine/userguide/storagedriver/imagesandcontainers/).
-
-
-### Pull an image by digest (immutable identifier)
-
-So far, you've pulled images by their name (and "tag"). Using names and tags is
-a convenient way to work with images. When using tags, you can `docker pull` an
-image again to make sure you have the most up-to-date version of that image.
-For example, `docker pull ubuntu:14.04` pulls the latest version of the Ubuntu
-14.04 image.
-
-In some cases you don't want images to be updated to newer versions, but prefer
-to use a fixed version of an image. Docker enables you to pull an image by its
-*digest*. When pulling an image by digest, you specify *exactly* which version
-of an image to pull. Doing so, allows you to "pin" an image to that version,
-and guarantee that the image you're using is always the same.
-
-To know the digest of an image, pull the image first. Let's pull the latest
-`ubuntu:14.04` image from Docker Hub:
-
-```bash
-$ docker pull ubuntu:14.04
-
-14.04: Pulling from library/ubuntu
-5a132a7e7af1: Pull complete
-fd2731e4c50c: Pull complete
-28a2f68d1120: Pull complete
-a3ed95caeb02: Pull complete
-Digest: sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
-Status: Downloaded newer image for ubuntu:14.04
-```
-
-Docker prints the digest of the image after the pull has finished. In the example
-above, the digest of the image is:
-
-    sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
-
-Docker also prints the digest of an image when *pushing* to a registry. This
-may be useful if you want to pin to a version of the image you just pushed.
-
-A digest takes the place of the tag when pulling an image, for example, to
-pull the above image by digest, run the following command:
-
-```bash
-$ docker pull ubuntu@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
-
-sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2: Pulling from library/ubuntu
-5a132a7e7af1: Already exists
-fd2731e4c50c: Already exists
-28a2f68d1120: Already exists
-a3ed95caeb02: Already exists
-Digest: sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
-Status: Downloaded newer image for ubuntu@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
-```
-
-Digest can also be used in the `FROM` of a Dockerfile, for example:
-
-```Dockerfile
-FROM ubuntu@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
-MAINTAINER some maintainer <maintainer@example.com>
-```
-
-> **Note**: Using this feature "pins" an image to a specific version in time.
-> Docker will therefore not pull updated versions of an image, which may include
-> security updates. If you want to pull an updated image, you need to change the
-> digest accordingly.
-
-
-### Pull from a different registry
-
-By default, `docker pull` pulls images from [Docker Hub](https://hub.docker.com). It is also possible to
-manually specify the path of a registry to pull from. For example, if you have
-set up a local registry, you can specify its path to pull from it. A registry
-path is similar to a URL, but does not contain a protocol specifier (`https://`).
-
-The following command pulls the `testing/test-image` image from a local registry
-listening on port 5000 (`myregistry.local:5000`):
-
-```bash
-$ docker pull myregistry.local:5000/testing/test-image
-```
-
-Registry credentials are managed by [docker login](login.md).
-
-Docker uses the `https://` protocol to communicate with a registry, unless the
-registry is allowed to be accessed over an insecure connection. Refer to the
-[insecure registries](dockerd.md#insecure-registries) section for more information.
-
-
-### Pull a repository with multiple images
-
-By default, `docker pull` pulls a *single* image from the registry. A repository
-can contain multiple images. To pull all images from a repository, provide the
-`-a` (or `--all-tags`) option when using `docker pull`.
-
-This command pulls all images from the `fedora` repository:
-
-```bash
-$ docker pull --all-tags fedora
-
-Pulling repository fedora
-ad57ef8d78d7: Download complete
-105182bb5e8b: Download complete
-511136ea3c5a: Download complete
-73bd853d2ea5: Download complete
-....
-
-Status: Downloaded newer image for fedora
-```
-
-After the pull has completed use the `docker images` command to see the
-images that were pulled. The example below shows all the `fedora` images
-that are present locally:
-
-```bash
-$ docker images fedora
-
-REPOSITORY   TAG         IMAGE ID        CREATED      SIZE
-fedora       rawhide     ad57ef8d78d7    5 days ago   359.3 MB
-fedora       20          105182bb5e8b    5 days ago   372.7 MB
-fedora       heisenbug   105182bb5e8b    5 days ago   372.7 MB
-fedora       latest      105182bb5e8b    5 days ago   372.7 MB
-```
-
-### Cancel a pull
-
-Killing the `docker pull` process, for example by pressing `CTRL-c` while it is
-running in a terminal, will terminate the pull operation.
-
-```bash
-$ docker pull fedora
-
-Using default tag: latest
-latest: Pulling from library/fedora
-a3ed95caeb02: Pulling fs layer
-236608c7b546: Pulling fs layer
-^C
-```
-
-> **Note**: Technically, the Engine terminates a pull operation when the
-> connection between the Docker Engine daemon and the Docker Engine client
-> initiating the pull is lost. If the connection with the Engine daemon is
-> lost for other reasons than a manual interaction, the pull is also aborted.
diff --git a/components/engine/docs/reference/commandline/push.md b/components/engine/docs/reference/commandline/push.md
deleted file mode 100644
index 61c37139fd..0000000000
--- a/components/engine/docs/reference/commandline/push.md
+++ /dev/null
@@ -1,82 +0,0 @@
----
-title: "push"
-description: "The push command description and usage"
-keywords: "share, push, image"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# push
-
-```markdown
-Usage:  docker push [OPTIONS] NAME[:TAG]
-
-Push an image or a repository to a registry
-
-Options:
-      --disable-content-trust   Skip image signing (default true)
-      --help                    Print usage
-```
-
-## Description
-
-Use `docker push` to share your images to the [Docker Hub](https://hub.docker.com)
-registry or to a self-hosted one.
-
-Refer to the [`docker tag`](tag.md) reference for more information about valid
-image and tag names.
-
-Killing the `docker push` process, for example by pressing `CTRL-c` while it is
-running in a terminal, terminates the push operation.
-
-Progress bars are shown during docker push, which show the uncompressed size. The 
-actual amount of data that's pushed will be compressed before sending, so the uploaded
- size will not be reflected by the progress bar. 
-
-Registry credentials are managed by [docker login](login.md).
-
-### Concurrent uploads
-
-By default the Docker daemon will push five layers of an image at a time.
-If you are on a low bandwidth connection this may cause timeout issues and you may want to lower
-this via the `--max-concurrent-uploads` daemon option. See the
-[daemon documentation](dockerd.md) for more details.
-
-## Examples
-
-### Push a new image to a registry
-
-First save the new image by finding the container ID (using [`docker ps`](ps.md))
-and then committing it to a new image name.  Note that only `a-z0-9-_.` are
-allowed when naming images:
-
-```bash
-$ docker commit c16378f943fe rhel-httpd
-```
-
-Now, push the image to the registry using the image ID. In this example the
-registry is on host named `registry-host` and listening on port `5000`. To do
-this, tag the image with the host name or IP address, and the port of the
-registry:
-
-```bash
-$ docker tag rhel-httpd registry-host:5000/myadmin/rhel-httpd
-
-$ docker push registry-host:5000/myadmin/rhel-httpd
-```
-
-Check that this worked by running:
-
-```bash
-$ docker images
-```
-
-You should see both `rhel-httpd` and `registry-host:5000/myadmin/rhel-httpd`
-listed.
diff --git a/components/engine/docs/reference/commandline/rename.md b/components/engine/docs/reference/commandline/rename.md
deleted file mode 100644
index 90268a2a2c..0000000000
--- a/components/engine/docs/reference/commandline/rename.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-title: "rename"
-description: "The rename command description and usage"
-keywords: "rename, docker, container"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# rename
-
-```markdown
-Usage:  docker rename CONTAINER NEW_NAME
-
-Rename a container
-
-Options:
-      --help   Print usage
-```
-
-## Description
-
-The `docker rename` command renames a container.
-
-## Examples
-
-```bash
-$ docker rename my_container my_new_container
-```
diff --git a/components/engine/docs/reference/commandline/restart.md b/components/engine/docs/reference/commandline/restart.md
deleted file mode 100644
index a2796afe33..0000000000
--- a/components/engine/docs/reference/commandline/restart.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-title: "restart"
-description: "The restart command description and usage"
-keywords: "restart, container, Docker"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# restart
-
-```markdown
-Usage:  docker restart [OPTIONS] CONTAINER [CONTAINER...]
-
-Restart one or more containers
-
-Options:
-      --help       Print usage
-  -t, --time int   Seconds to wait for stop before killing the container (default 10)
-```
-
-## Examples
-
-```bash
-$ docker restart my_container
-```
diff --git a/components/engine/docs/reference/commandline/rm.md b/components/engine/docs/reference/commandline/rm.md
deleted file mode 100644
index 8ee5b2874d..0000000000
--- a/components/engine/docs/reference/commandline/rm.md
+++ /dev/null
@@ -1,100 +0,0 @@
----
-title: "rm"
-description: "The rm command description and usage"
-keywords: "remove, Docker, container"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# rm
-
-```markdown
-Usage:  docker rm [OPTIONS] CONTAINER [CONTAINER...]
-
-Remove one or more containers
-
-Options:
-  -f, --force     Force the removal of a running container (uses SIGKILL)
-      --help      Print usage
-  -l, --link      Remove the specified link
-  -v, --volumes   Remove the volumes associated with the container
-```
-
-## Examples
-
-### Remove a container
-
-This will remove the container referenced under the link
-`/redis`.
-
-```bash
-$ docker rm /redis
-
-/redis
-```
-
-### Remove a link specified with `--link` on the default bridge network
-
-This will remove the underlying link between `/webapp` and the `/redis`
-containers on the default bridge network, removing all network communication
-between the two containers. This does not apply when `--link` is used with
-user-specified networks.
-
-```bash
-$ docker rm --link /webapp/redis
-
-/webapp/redis
-```
-
-### Force-remove a running container
-
-This command will force-remove a running container.
-
-```bash
-$ docker rm --force redis
-
-redis
-```
-
-The main process inside the container referenced under the link `redis` will receive
-`SIGKILL`, then the container will be removed.
-
-### Remove all stopped containers
-
-```bash
-$ docker rm $(docker ps -a -q)
-```
-
-This command will delete all stopped containers. The command
-`docker ps -a -q` will return all existing container IDs and pass them to
-the `rm` command which will delete them. Any running containers will not be
-deleted.
-
-### Remove a container and its volumes
-
-```bash
-$ docker rm -v redis
-redis
-```
-
-This command will remove the container and any volumes associated with it.
-Note that if a volume was specified with a name, it will not be removed.
-
-### Remove a container and selectively remove volumes
-
-```bash
-$ docker create -v awesome:/foo -v /bar --name hello redis
-hello
-$ docker rm -v hello
-```
-
-In this example, the volume for `/foo` will remain intact, but the volume for
-`/bar` will be removed. The same behavior holds for volumes inherited with
-`--volumes-from`.
diff --git a/components/engine/docs/reference/commandline/rmi.md b/components/engine/docs/reference/commandline/rmi.md
deleted file mode 100644
index 28e21d4398..0000000000
--- a/components/engine/docs/reference/commandline/rmi.md
+++ /dev/null
@@ -1,105 +0,0 @@
----
-title: "rmi"
-description: "The rmi command description and usage"
-keywords: "remove, image, Docker"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# rmi
-
-```markdown
-Usage:  docker rmi [OPTIONS] IMAGE [IMAGE...]
-
-Remove one or more images
-
-Options:
-  -f, --force      Force removal of the image
-      --help       Print usage
-      --no-prune   Do not delete untagged parents
-```
-
-## Examples
-
-You can remove an image using its short or long ID, its tag, or its digest. If
-an image has one or more tag referencing it, you must remove all of them before
-the image is removed. Digest references are removed automatically when an image
-is removed by tag.
-
-```bash
-$ docker images
-
-REPOSITORY                TAG                 IMAGE ID            CREATED             SIZE
-test1                     latest              fd484f19954f        23 seconds ago      7 B (virtual 4.964 MB)
-test                      latest              fd484f19954f        23 seconds ago      7 B (virtual 4.964 MB)
-test2                     latest              fd484f19954f        23 seconds ago      7 B (virtual 4.964 MB)
-
-$ docker rmi fd484f19954f
-
-Error: Conflict, cannot delete image fd484f19954f because it is tagged in multiple repositories, use -f to force
-2013/12/11 05:47:16 Error: failed to remove one or more images
-
-$ docker rmi test1
-
-Untagged: test1:latest
-
-$ docker rmi test2
-
-Untagged: test2:latest
-
-
-$ docker images
-
-REPOSITORY                TAG                 IMAGE ID            CREATED             SIZE
-test                      latest              fd484f19954f        23 seconds ago      7 B (virtual 4.964 MB)
-
-$ docker rmi test
-
-Untagged: test:latest
-Deleted: fd484f19954f4920da7ff372b5067f5b7ddb2fd3830cecd17b96ea9e286ba5b8
-```
-
-If you use the `-f` flag and specify the image's short or long ID, then this
-command untags and removes all images that match the specified ID.
-
-```bash
-$ docker images
-
-REPOSITORY                TAG                 IMAGE ID            CREATED             SIZE
-test1                     latest              fd484f19954f        23 seconds ago      7 B (virtual 4.964 MB)
-test                      latest              fd484f19954f        23 seconds ago      7 B (virtual 4.964 MB)
-test2                     latest              fd484f19954f        23 seconds ago      7 B (virtual 4.964 MB)
-
-$ docker rmi -f fd484f19954f
-
-Untagged: test1:latest
-Untagged: test:latest
-Untagged: test2:latest
-Deleted: fd484f19954f4920da7ff372b5067f5b7ddb2fd3830cecd17b96ea9e286ba5b8
-```
-
-An image pulled by digest has no tag associated with it:
-
-```bash
-$ docker images --digests
-
-REPOSITORY                     TAG       DIGEST                                                                    IMAGE ID        CREATED         SIZE
-localhost:5000/test/busybox    <none>    sha256:cbbf2f9a99b47fc460d422812b6a5adff7dfee951d8fa2e4a98caa0382cfbdbf   4986bf8c1536    9 weeks ago     2.43 MB
-```
-
-To remove an image using its digest:
-
-```bash
-$ docker rmi localhost:5000/test/busybox@sha256:cbbf2f9a99b47fc460d422812b6a5adff7dfee951d8fa2e4a98caa0382cfbdbf
-Untagged: localhost:5000/test/busybox@sha256:cbbf2f9a99b47fc460d422812b6a5adff7dfee951d8fa2e4a98caa0382cfbdbf
-Deleted: 4986bf8c15363d1c5d15512d5266f8777bfba4974ac56e3270e7760f6f0a8125
-Deleted: ea13149945cb6b1e746bf28032f02e9b5a793523481a0a18645fc77ad53c4ea2
-Deleted: df7546f9f060a2268024c8a230d8639878585defcc1bc6f79d2728a13957871b
-```
diff --git a/components/engine/docs/reference/commandline/run.md b/components/engine/docs/reference/commandline/run.md
deleted file mode 100644
index ecb676dc20..0000000000
--- a/components/engine/docs/reference/commandline/run.md
+++ /dev/null
@@ -1,777 +0,0 @@
----
-title: "run"
-description: "The run command description and usage"
-keywords: "run, command, container"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# run
-
-```markdown
-Usage:  docker run [OPTIONS] IMAGE [COMMAND] [ARG...]
-
-Run a command in a new container
-
-Options:
-      --add-host value                Add a custom host-to-IP mapping (host:ip) (default [])
-  -a, --attach value                  Attach to STDIN, STDOUT or STDERR (default [])
-      --blkio-weight value            Block IO (relative weight), between 10 and 1000
-      --blkio-weight-device value     Block IO weight (relative device weight) (default [])
-      --cap-add value                 Add Linux capabilities (default [])
-      --cap-drop value                Drop Linux capabilities (default [])
-      --cgroup-parent string          Optional parent cgroup for the container
-      --cidfile string                Write the container ID to the file
-      --cpu-count int                 The number of CPUs available for execution by the container.
-                                      Windows daemon only. On Windows Server containers, this is
-                                      approximated as a percentage of total CPU usage.
-      --cpu-percent int               Limit percentage of CPU available for execution
-                                      by the container. Windows daemon only.
-                                      The processor resource controls are mutually
-                                      exclusive, the order of precedence is CPUCount
-                                      first, then CPUShares, and CPUPercent last.
-      --cpu-period int                Limit CPU CFS (Completely Fair Scheduler) period
-      --cpu-quota int                 Limit CPU CFS (Completely Fair Scheduler) quota
-  -c, --cpu-shares int                CPU shares (relative weight)
-      --cpus NanoCPUs                 Number of CPUs (default 0.000)
-      --cpu-rt-period int             Limit the CPU real-time period in microseconds
-      --cpu-rt-runtime int            Limit the CPU real-time runtime in microseconds
-      --cpuset-cpus string            CPUs in which to allow execution (0-3, 0,1)
-      --cpuset-mems string            MEMs in which to allow execution (0-3, 0,1)
-  -d, --detach                        Run container in background and print container ID
-      --detach-keys string            Override the key sequence for detaching a container
-      --device value                  Add a host device to the container (default [])
-      --device-cgroup-rule value      Add a rule to the cgroup allowed devices list
-      --device-read-bps value         Limit read rate (bytes per second) from a device (default [])
-      --device-read-iops value        Limit read rate (IO per second) from a device (default [])
-      --device-write-bps value        Limit write rate (bytes per second) to a device (default [])
-      --device-write-iops value       Limit write rate (IO per second) to a device (default [])
-      --disable-content-trust         Skip image verification (default true)
-      --dns value                     Set custom DNS servers (default [])
-      --dns-option value              Set DNS options (default [])
-      --dns-search value              Set custom DNS search domains (default [])
-      --entrypoint string             Overwrite the default ENTRYPOINT of the image
-  -e, --env value                     Set environment variables (default [])
-      --env-file value                Read in a file of environment variables (default [])
-      --expose value                  Expose a port or a range of ports (default [])
-      --group-add value               Add additional groups to join (default [])
-      --health-cmd string             Command to run to check health
-      --health-interval duration      Time between running the check (ns|us|ms|s|m|h) (default 0s)
-      --health-retries int            Consecutive failures needed to report unhealthy
-      --health-timeout duration       Maximum time to allow one check to run (ns|us|ms|s|m|h) (default 0s)
-      --health-start-period duration  Start period for the container to initialize before counting retries towards unstable (ns|us|ms|s|m|h) (default 0s)
-      --help                          Print usage
-  -h, --hostname string               Container host name
-      --init                          Run an init inside the container that forwards signals and reaps processes
-  -i, --interactive                   Keep STDIN open even if not attached
-      --io-maxbandwidth string        Maximum IO bandwidth limit for the system drive (Windows only)
-                                      (Windows only). The format is `<number><unit>`.
-                                      Unit is optional and can be `b` (bytes per second),
-                                      `k` (kilobytes per second), `m` (megabytes per second),
-                                      or `g` (gigabytes per second). If you omit the unit,
-                                      the system uses bytes per second.
-                                      --io-maxbandwidth and --io-maxiops are mutually exclusive options.
-      --io-maxiops uint               Maximum IOps limit for the system drive (Windows only)
-      --ip string                     IPv4 address (e.g., 172.30.100.104)
-      --ip6 string                    IPv6 address (e.g., 2001:db8::33)
-      --ipc string                    IPC namespace to use
-      --isolation string              Container isolation technology
-      --kernel-memory string          Kernel memory limit
-  -l, --label value                   Set meta data on a container (default [])
-      --label-file value              Read in a line delimited file of labels (default [])
-      --link value                    Add link to another container (default [])
-      --link-local-ip value           Container IPv4/IPv6 link-local addresses (default [])
-      --log-driver string             Logging driver for the container
-      --log-opt value                 Log driver options (default [])
-      --mac-address string            Container MAC address (e.g., 92:d0:c6:0a:29:33)
-  -m, --memory string                 Memory limit
-      --memory-reservation string     Memory soft limit
-      --memory-swap string            Swap limit equal to memory plus swap: '-1' to enable unlimited swap
-      --memory-swappiness int         Tune container memory swappiness (0 to 100) (default -1)
-      --mount value                   Attach a filesystem mount to the container (default [])
-      --name string                   Assign a name to the container
-      --network-alias value           Add network-scoped alias for the container (default [])
-      --network string                Connect a container to a network
-                                      'bridge': create a network stack on the default Docker bridge
-                                      'none': no networking
-                                      'container:<name|id>': reuse another container's network stack
-                                      'host': use the Docker host network stack
-                                      '<network-name>|<network-id>': connect to a user-defined network
-      --no-healthcheck                Disable any container-specified HEALTHCHECK
-      --oom-kill-disable              Disable OOM Killer
-      --oom-score-adj int             Tune host's OOM preferences (-1000 to 1000)
-      --pid string                    PID namespace to use
-      --pids-limit int                Tune container pids limit (set -1 for unlimited)
-      --privileged                    Give extended privileges to this container
-  -p, --publish value                 Publish a container's port(s) to the host (default [])
-  -P, --publish-all                   Publish all exposed ports to random ports
-      --read-only                     Mount the container's root filesystem as read only
-      --restart string                Restart policy to apply when a container exits (default "no")
-                                      Possible values are : no, on-failure[:max-retry], always, unless-stopped
-      --rm                            Automatically remove the container when it exits
-      --runtime string                Runtime to use for this container
-      --security-opt value            Security Options (default [])
-      --shm-size bytes                Size of /dev/shm
-                                      The format is `<number><unit>`. `number` must be greater than `0`.
-                                      Unit is optional and can be `b` (bytes), `k` (kilobytes), `m` (megabytes),
-                                      or `g` (gigabytes). If you omit the unit, the system uses bytes.
-      --sig-proxy                     Proxy received signals to the process (default true)
-      --stop-signal string            Signal to stop a container (default "SIGTERM")
-      --stop-timeout=10               Timeout (in seconds) to stop a container
-      --storage-opt value             Storage driver options for the container (default [])
-      --sysctl value                  Sysctl options (default map[])
-      --tmpfs value                   Mount a tmpfs directory (default [])
-  -t, --tty                           Allocate a pseudo-TTY
-      --ulimit value                  Ulimit options (default [])
-  -u, --user string                   Username or UID (format: <name|uid>[:<group|gid>])
-      --userns string                 User namespace to use
-                                      'host': Use the Docker host user namespace
-                                      '': Use the Docker daemon user namespace specified by `--userns-remap` option.
-      --uts string                    UTS namespace to use
-  -v, --volume value                  Bind mount a volume (default []). The format
-                                      is `[host-src:]container-dest[:<options>]`.
-                                      The comma-delimited `options` are [rw|ro],
-                                      [z|Z], [[r]shared|[r]slave|[r]private],
-                                      [delegated|cached|consistent], and
-                                      [nocopy]. The 'host-src' is an absolute path
-                                      or a name value.
-      --volume-driver string          Optional volume driver for the container
-      --volumes-from value            Mount volumes from the specified container(s) (default [])
-  -w, --workdir string                Working directory inside the container
-```
-
-## Description
-
-The `docker run` command first `creates` a writeable container layer over the
-specified image, and then `starts` it using the specified command. That is,
-`docker run` is equivalent to the API `/containers/create` then
-`/containers/(id)/start`. A stopped container can be restarted with all its
-previous changes intact using `docker start`. See `docker ps -a` to view a list
-of all containers.
-
-The `docker run` command can be used in combination with `docker commit` to
-[*change the command that a container runs*](commit.md). There is additional detailed information about `docker run` in the [Docker run reference](../run.md).
-
-For information on connecting a container to a network, see the ["*Docker network overview*"](https://docs.docker.com/engine/userguide/networking/).
-
-## Examples
-
-### Assign name and allocate pseudo-TTY (--name, -it)
-
-```bash
-$ docker run --name test -it debian
-
-root@d6c0fe130dba:/# exit 13
-$ echo $?
-13
-$ docker ps -a | grep test
-d6c0fe130dba        debian:7            "/bin/bash"         26 seconds ago      Exited (13) 17 seconds ago                         test
-```
-
-This example runs a container named `test` using the `debian:latest`
-image. The `-it` instructs Docker to allocate a pseudo-TTY connected to
-the container's stdin; creating an interactive `bash` shell in the container.
-In the example, the `bash` shell is quit by entering
-`exit 13`. This exit code is passed on to the caller of
-`docker run`, and is recorded in the `test` container's metadata.
-
-### Capture container ID (--cidfile)
-
-```bash
-$ docker run --cidfile /tmp/docker_test.cid ubuntu echo "test"
-```
-
-This will create a container and print `test` to the console. The `cidfile`
-flag makes Docker attempt to create a new file and write the container ID to it.
-If the file exists already, Docker will return an error. Docker will close this
-file when `docker run` exits.
-
-### Full container capabilities (--privileged)
-
-```bash
-$ docker run -t -i --rm ubuntu bash
-root@bc338942ef20:/# mount -t tmpfs none /mnt
-mount: permission denied
-```
-
-This will *not* work, because by default, most potentially dangerous kernel
-capabilities are dropped; including `cap_sys_admin` (which is required to mount
-filesystems). However, the `--privileged` flag will allow it to run:
-
-```bash
-$ docker run -t -i --privileged ubuntu bash
-root@50e3f57e16e6:/# mount -t tmpfs none /mnt
-root@50e3f57e16e6:/# df -h
-Filesystem      Size  Used Avail Use% Mounted on
-none            1.9G     0  1.9G   0% /mnt
-```
-
-The `--privileged` flag gives *all* capabilities to the container, and it also
-lifts all the limitations enforced by the `device` cgroup controller. In other
-words, the container can then do almost everything that the host can do. This
-flag exists to allow special use-cases, like running Docker within Docker.
-
-### Set working directory (-w)
-
-```bash
-$ docker  run -w /path/to/dir/ -i -t  ubuntu pwd
-```
-
-The `-w` lets the command being executed inside directory given, here
-`/path/to/dir/`. If the path does not exist it is created inside the container.
-
-### Set storage driver options per container
-
-```bash
-$ docker run -it --storage-opt size=120G fedora /bin/bash
-```
-
-This (size) will allow to set the container rootfs size to 120G at creation time.
-This option is only available for the `devicemapper`, `btrfs`, `overlay2`,
-`windowsfilter` and `zfs` graph drivers.
-For the `devicemapper`, `btrfs`, `windowsfilter` and `zfs` graph drivers,
-user cannot pass a size less than the Default BaseFS Size.
-For the `overlay2` storage driver, the size option is only available if the
-backing fs is `xfs` and mounted with the `pquota` mount option.
-Under these conditions, user can pass any size less then the backing fs size.
-
-### Mount tmpfs (--tmpfs)
-
-```bash
-$ docker run -d --tmpfs /run:rw,noexec,nosuid,size=65536k my_image
-```
-
-The `--tmpfs` flag mounts an empty tmpfs into the container with the `rw`,
-`noexec`, `nosuid`, `size=65536k` options.
-
-### Mount volume (-v, --read-only)
-
-```bash
-$ docker  run  -v `pwd`:`pwd` -w `pwd` -i -t  ubuntu pwd
-```
-
-The `-v` flag mounts the current working directory into the container. The `-w`
-lets the command being executed inside the current working directory, by
-changing into the directory to the value returned by `pwd`. So this
-combination executes the command using the container, but inside the
-current working directory.
-
-```bash
-$ docker run -v /doesnt/exist:/foo -w /foo -i -t ubuntu bash
-```
-
-When the host directory of a bind-mounted volume doesn't exist, Docker
-will automatically create this directory on the host for you. In the
-example above, Docker will create the `/doesnt/exist`
-folder before starting your container.
-
-```bash
-$ docker run --read-only -v /icanwrite busybox touch /icanwrite/here
-```
-
-Volumes can be used in combination with `--read-only` to control where
-a container writes files. The `--read-only` flag mounts the container's root
-filesystem as read only prohibiting writes to locations other than the
-specified volumes for the container.
-
-```bash
-$ docker run -t -i -v /var/run/docker.sock:/var/run/docker.sock -v /path/to/static-docker-binary:/usr/bin/docker busybox sh
-```
-
-By bind-mounting the docker unix socket and statically linked docker
-binary (refer to [get the linux binary](
-https://docs.docker.com/engine/installation/binaries/#/get-the-linux-binary)),
-you give the container the full access to create and manipulate the host's
-Docker daemon.
-
-On Windows, the paths must be specified using Windows-style semantics.
-
-```powershell
-PS C:\> docker run -v c:\foo:c:\dest microsoft/nanoserver cmd /s /c type c:\dest\somefile.txt
-Contents of file
-
-PS C:\> docker run -v c:\foo:d: microsoft/nanoserver cmd /s /c type d:\somefile.txt
-Contents of file
-```
-
-The following examples will fail when using Windows-based containers, as the
-destination of a volume or bind-mount inside the container must be one of:
-a non-existing or empty directory; or a drive other than C:. Further, the source
-of a bind mount must be a local directory, not a file.
-
-```powershell
-net use z: \\remotemachine\share
-docker run -v z:\foo:c:\dest ...
-docker run -v \\uncpath\to\directory:c:\dest ...
-docker run -v c:\foo\somefile.txt:c:\dest ...
-docker run -v c:\foo:c: ...
-docker run -v c:\foo:c:\existing-directory-with-contents ...
-```
-
-For in-depth information about volumes, refer to [manage data in containers](https://docs.docker.com/engine/tutorials/dockervolumes/)
-
-
-### Add bind-mounts or volumes using the --mount flag
-
-The `--mount` flag allows you to mount volumes, host-directories and `tmpfs`
-mounts in a container.
-
-The `--mount` flag supports most options that are supported by the `-v` or the
-`--volume` flag, but uses a different syntax. For in-depth information on the
-`--mount` flag, and a comparison between `--volume` and `--mount`, refer to
-the [service create command reference](service_create.md#add-bind-mounts-or-volumes).
-
-Even though there is no plan to deprecate `--volume`, usage of `--mount` is recommended.
-
-Examples:
-
-```bash
-$ docker run --read-only --mount type=volume,target=/icanwrite busybox touch /icanwrite/here
-```
-
-```bash
-$ docker run -t -i --mount type=bind,src=/data,dst=/data busybox sh
-```
-
-### Publish or expose port (-p, --expose)
-
-```bash
-$ docker run -p 127.0.0.1:80:8080 ubuntu bash
-```
-
-This binds port `8080` of the container to port `80` on `127.0.0.1` of the host
-machine. The [Docker User
-Guide](https://docs.docker.com/engine/userguide/networking/default_network/dockerlinks/)
-explains in detail how to manipulate ports in Docker.
-
-```bash
-$ docker run --expose 80 ubuntu bash
-```
-
-This exposes port `80` of the container without publishing the port to the host
-system's interfaces.
-
-### Set environment variables (-e, --env, --env-file)
-
-```bash
-$ docker run -e MYVAR1 --env MYVAR2=foo --env-file ./env.list ubuntu bash
-```
-
-Use the `-e`, `--env`, and `--env-file` flags to set simple (non-array)
-environment variables in the container you're running, or overwrite variables
-that are defined in the Dockerfile of the image you're running.
-
-You can define the variable and its value when running the container:
-
-```bash
-$ docker run --env VAR1=value1 --env VAR2=value2 ubuntu env | grep VAR
-VAR1=value1
-VAR2=value2
-```
-
-You can also use variables that you've exported to your local environment:
-
-```bash
-export VAR1=value1
-export VAR2=value2
-
-$ docker run --env VAR1 --env VAR2 ubuntu env | grep VAR
-VAR1=value1
-VAR2=value2
-```
-
-When running the command, the Docker CLI client checks the value the variable
-has in your local environment and passes it to the container.
-If no `=` is provided and that variable is not exported in your local
-environment, the variable won't be set in the container.
-
-You can also load the environment variables from a file. This file should use
-the syntax `<variable>=value` (which sets the variable to the given value) or
-`<variable>` (which takes the value from the local environment), and `#` for comments.
-
-```bash
-$ cat env.list
-# This is a comment
-VAR1=value1
-VAR2=value2
-USER
-
-$ docker run --env-file env.list ubuntu env | grep VAR
-VAR1=value1
-VAR2=value2
-USER=denis
-```
-
-### Set metadata on container (-l, --label, --label-file)
-
-A label is a `key=value` pair that applies metadata to a container. To label a container with two labels:
-
-```bash
-$ docker run -l my-label --label com.example.foo=bar ubuntu bash
-```
-
-The `my-label` key doesn't specify a value so the label defaults to an empty
-string(`""`). To add multiple labels, repeat the label flag (`-l` or `--label`).
-
-The `key=value` must be unique to avoid overwriting the label value. If you
-specify labels with identical keys but different values, each subsequent value
-overwrites the previous. Docker uses the last `key=value` you supply.
-
-Use the `--label-file` flag to load multiple labels from a file. Delimit each
-label in the file with an EOL mark. The example below loads labels from a
-labels file in the current directory:
-
-```bash
-$ docker run --label-file ./labels ubuntu bash
-```
-
-The label-file format is similar to the format for loading environment
-variables. (Unlike environment variables, labels are not visible to processes
-running inside a container.) The following example illustrates a label-file
-format:
-
-```none
-com.example.label1="a label"
-
-# this is a comment
-com.example.label2=another\ label
-com.example.label3
-```
-
-You can load multiple label-files by supplying multiple  `--label-file` flags.
-
-For additional information on working with labels, see [*Labels - custom
-metadata in Docker*](https://docs.docker.com/engine/userguide/labels-custom-metadata/) in the Docker User
-Guide.
-
-### Connect a container to a network (--network)
-
-When you start a container use the `--network` flag to connect it to a network.
-This adds the `busybox` container to the `my-net` network.
-
-```bash
-$ docker run -itd --network=my-net busybox
-```
-
-You can also choose the IP addresses for the container with `--ip` and `--ip6`
-flags when you start the container on a user-defined network.
-
-```bash
-$ docker run -itd --network=my-net --ip=10.10.9.75 busybox
-```
-
-If you want to add a running container to a network use the `docker network connect` subcommand.
-
-You can connect multiple containers to the same network. Once connected, the
-containers can communicate easily need only another container's IP address
-or name. For `overlay` networks or custom plugins that support multi-host
-connectivity, containers connected to the same multi-host network but launched
-from different Engines can also communicate in this way.
-
-> **Note**: Service discovery is unavailable on the default bridge network.
-> Containers can communicate via their IP addresses by default. To communicate
-> by name, they must be linked.
-
-You can disconnect a container from a network using the `docker network
-disconnect` command.
-
-### Mount volumes from container (--volumes-from)
-
-```bash
-$ docker run --volumes-from 777f7dc92da7 --volumes-from ba8c0c54f0f2:ro -i -t ubuntu pwd
-```
-
-The `--volumes-from` flag mounts all the defined volumes from the referenced
-containers. Containers can be specified by repetitions of the `--volumes-from`
-argument. The container ID may be optionally suffixed with `:ro` or `:rw` to
-mount the volumes in read-only or read-write mode, respectively. By default,
-the volumes are mounted in the same mode (read write or read only) as
-the reference container.
-
-Labeling systems like SELinux require that proper labels are placed on volume
-content mounted into a container. Without a label, the security system might
-prevent the processes running inside the container from using the content. By
-default, Docker does not change the labels set by the OS.
-
-To change the label in the container context, you can add either of two suffixes
-`:z` or `:Z` to the volume mount. These suffixes tell Docker to relabel file
-objects on the shared volumes. The `z` option tells Docker that two containers
-share the volume content. As a result, Docker labels the content with a shared
-content label. Shared volume labels allow all containers to read/write content.
-The `Z` option tells Docker to label the content with a private unshared label.
-Only the current container can use a private volume.
-
-### Attach to STDIN/STDOUT/STDERR (-a)
-
-The `-a` flag tells `docker run` to bind to the container's `STDIN`, `STDOUT`
-or `STDERR`. This makes it possible to manipulate the output and input as
-needed.
-
-```bash
-$ echo "test" | docker run -i -a stdin ubuntu cat -
-```
-
-This pipes data into a container and prints the container's ID by attaching
-only to the container's `STDIN`.
-
-```bash
-$ docker run -a stderr ubuntu echo test
-```
-
-This isn't going to print anything unless there's an error because we've
-only attached to the `STDERR` of the container. The container's logs
-still store what's been written to `STDERR` and `STDOUT`.
-
-```bash
-$ cat somefile | docker run -i -a stdin mybuilder dobuild
-```
-
-This is how piping a file into a container could be done for a build.
-The container's ID will be printed after the build is done and the build
-logs could be retrieved using `docker logs`. This is
-useful if you need to pipe a file or something else into a container and
-retrieve the container's ID once the container has finished running.
-
-### Add host device to container (--device)
-
-```bash
-$ docker run --device=/dev/sdc:/dev/xvdc \
-             --device=/dev/sdd --device=/dev/zero:/dev/nulo \
-             -i -t \
-             ubuntu ls -l /dev/{xvdc,sdd,nulo}
-
-brw-rw---- 1 root disk 8, 2 Feb  9 16:05 /dev/xvdc
-brw-rw---- 1 root disk 8, 3 Feb  9 16:05 /dev/sdd
-crw-rw-rw- 1 root root 1, 5 Feb  9 16:05 /dev/nulo
-```
-
-It is often necessary to directly expose devices to a container. The `--device`
-option enables that. For example, a specific block storage device or loop
-device or audio device can be added to an otherwise unprivileged container
-(without the `--privileged` flag) and have the application directly access it.
-
-By default, the container will be able to `read`, `write` and `mknod` these devices.
-This can be overridden using a third `:rwm` set of options to each `--device`
-flag:
-
-```bash
-$ docker run --device=/dev/sda:/dev/xvdc --rm -it ubuntu fdisk  /dev/xvdc
-
-Command (m for help): q
-$ docker run --device=/dev/sda:/dev/xvdc:r --rm -it ubuntu fdisk  /dev/xvdc
-You will not be able to write the partition table.
-
-Command (m for help): q
-
-$ docker run --device=/dev/sda:/dev/xvdc:rw --rm -it ubuntu fdisk  /dev/xvdc
-
-Command (m for help): q
-
-$ docker run --device=/dev/sda:/dev/xvdc:m --rm -it ubuntu fdisk  /dev/xvdc
-fdisk: unable to open /dev/xvdc: Operation not permitted
-```
-
-> **Note**: `--device` cannot be safely used with ephemeral devices. Block devices
-> that may be removed should not be added to untrusted containers with
-> `--device`.
-
-### Restart policies (--restart)
-
-Use Docker's `--restart` to specify a container's *restart policy*. A restart
-policy controls whether the Docker daemon restarts a container after exit.
-Docker supports the following restart policies:
-
-| Policy    | Result                                                                                                                                                                                                                                                           |
-|:----------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `no`      | Do not automatically restart the container when it exits. This is the default.                                                                                                                                                                                   |
-| `failure` | Restart only if the container exits with a non-zero exit status. Optionally, limit the number of restart retries the Docker daemon attempts.                                                                                                                     |
-| `always`  | Always restart the container regardless of the exit status. When you specify always, the Docker daemon will try to restart the container indefinitely. The container will also always start on daemon startup, regardless of the current state of the container. |
-
-```bash
-$ docker run --restart=always redis
-```
-
-This will run the `redis` container with a restart policy of **always**
-so that if the container exits, Docker will restart it.
-
-More detailed information on restart policies can be found in the
-[Restart Policies (--restart)](../run.md#restart-policies-restart)
-section of the Docker run reference page.
-
-### Add entries to container hosts file (--add-host)
-
-You can add other hosts into a container's `/etc/hosts` file by using one or
-more `--add-host` flags. This example adds a static address for a host named
-`docker`:
-
-```bash
-$ docker run --add-host=docker:10.180.0.1 --rm -it debian
-
-root@f38c87f2a42d:/# ping docker
-PING docker (10.180.0.1): 48 data bytes
-56 bytes from 10.180.0.1: icmp_seq=0 ttl=254 time=7.600 ms
-56 bytes from 10.180.0.1: icmp_seq=1 ttl=254 time=30.705 ms
-^C--- docker ping statistics ---
-2 packets transmitted, 2 packets received, 0% packet loss
-round-trip min/avg/max/stddev = 7.600/19.152/30.705/11.553 ms
-```
-
-Sometimes you need to connect to the Docker host from within your
-container. To enable this, pass the Docker host's IP address to
-the container using the `--add-host` flag. To find the host's address,
-use the `ip addr show` command.
-
-The flags you pass to `ip addr show` depend on whether you are
-using IPv4 or IPv6 networking in your containers. Use the following
-flags for IPv4 address retrieval for a network device named `eth0`:
-
-```bash
-$ HOSTIP=`ip -4 addr show scope global dev eth0 | grep inet | awk '{print \$2}' | cut -d / -f 1`
-$ docker run  --add-host=docker:${HOSTIP} --rm -it debian
-```
-
-For IPv6 use the `-6` flag instead of the `-4` flag. For other network
-devices, replace `eth0` with the correct device name (for example `docker0`
-for the bridge device).
-
-### Set ulimits in container (--ulimit)
-
-Since setting `ulimit` settings in a container requires extra privileges not
-available in the default container, you can set these using the `--ulimit` flag.
-`--ulimit` is specified with a soft and hard limit as such:
-`<type>=<soft limit>[:<hard limit>]`, for example:
-
-```bash
-$ docker run --ulimit nofile=1024:1024 --rm debian sh -c "ulimit -n"
-1024
-```
-
-> **Note**: If you do not provide a `hard limit`, the `soft limit` will be used
-> for both values. If no `ulimits` are set, they will be inherited from
-> the default `ulimits` set on the daemon.  `as` option is disabled now.
-> In other words, the following script is not supported:
->
-> ```bash
-> $ docker run -it --ulimit as=1024 fedora /bin/bash`
-> ```
-
-The values are sent to the appropriate `syscall` as they are set.
-Docker doesn't perform any byte conversion. Take this into account when setting the values.
-
-#### For `nproc` usage
-
-Be careful setting `nproc` with the `ulimit` flag as `nproc` is designed by Linux to set the
-maximum number of processes available to a user, not to a container.  For example, start four
-containers with `daemon` user:
-
-```bash
-$ docker run -d -u daemon --ulimit nproc=3 busybox top
-
-$ docker run -d -u daemon --ulimit nproc=3 busybox top
-
-$ docker run -d -u daemon --ulimit nproc=3 busybox top
-
-$ docker run -d -u daemon --ulimit nproc=3 busybox top
-```
-
-The 4th container fails and reports "[8] System error: resource temporarily unavailable" error.
-This fails because the caller set `nproc=3` resulting in the first three containers using up
-the three processes quota set for the `daemon` user.
-
-### Stop container with signal (--stop-signal)
-
-The `--stop-signal` flag sets the system call signal that will be sent to the container to exit.
-This signal can be a valid unsigned number that matches a position in the kernel's syscall table, for instance 9,
-or a signal name in the format SIGNAME, for instance SIGKILL.
-
-### Optional security options (--security-opt)
-
-On Windows, this flag can be used to specify the `credentialspec` option.
-The `credentialspec` must be in the format `file://spec.txt` or `registry://keyname`.
-
-### Stop container with timeout (--stop-timeout)
-
-The `--stop-timeout` flag sets the timeout (in seconds) that a pre-defined (see `--stop-signal`) system call
-signal that will be sent to the container to exit. After timeout elapses the container will be killed with SIGKILL.
-
-### Specify isolation technology for container (--isolation)
-
-This option is useful in situations where you are running Docker containers on
-Windows. The `--isolation <value>` option sets a container's isolation technology.
-On Linux, the only supported is the `default` option which uses
-Linux namespaces. These two commands are equivalent on Linux:
-
-```bash
-$ docker run -d busybox top
-$ docker run -d --isolation default busybox top
-```
-
-On Windows, `--isolation` can take one of these values:
-
-
-| Value     | Description                                                                                |
-|:----------|:-------------------------------------------------------------------------------------------|
-| `default` | Use the value specified by the Docker daemon's `--exec-opt` or system default (see below). |
-| `process` | Shared-kernel namespace isolation (not supported on Windows client operating systems).     |
-| `hyperv`  | Hyper-V hypervisor partition-based isolation.                                              |
-
-The default isolation on Windows server operating systems is `process`. The default (and only supported)
-isolation on Windows client operating systems is `hyperv`. An attempt to start a container on a client
-operating system with `--isolation process` will fail.
-
-On Windows server, assuming the default configuration, these commands are equivalent
-and result in `process` isolation:
-
-```PowerShell
-PS C:\> docker run -d microsoft/nanoserver powershell echo process
-PS C:\> docker run -d --isolation default microsoft/nanoserver powershell echo process
-PS C:\> docker run -d --isolation process microsoft/nanoserver powershell echo process
-```
-
-If you have set the `--exec-opt isolation=hyperv` option on the Docker `daemon`, or
-are running against a Windows client-based daemon, these commands are equivalent and
-result in `hyperv` isolation:
-
-```PowerShell
-PS C:\> docker run -d microsoft/nanoserver powershell echo hyperv
-PS C:\> docker run -d --isolation default microsoft/nanoserver powershell echo hyperv
-PS C:\> docker run -d --isolation hyperv microsoft/nanoserver powershell echo hyperv
-```
-
-### Configure namespaced kernel parameters (sysctls) at runtime
-
-The `--sysctl` sets namespaced kernel parameters (sysctls) in the
-container. For example, to turn on IP forwarding in the containers
-network namespace, run this command:
-
-```bash
-$ docker run --sysctl net.ipv4.ip_forward=1 someimage
-```
-
-> **Note**: Not all sysctls are namespaced. Docker does not support changing sysctls
-> inside of a container that also modify the host system. As the kernel
-> evolves we expect to see more sysctls become namespaced.
-
-#### Currently supported sysctls
-
-- `IPC Namespace`:
-
-  ```none
-  kernel.msgmax, kernel.msgmnb, kernel.msgmni, kernel.sem, kernel.shmall, kernel.shmmax, kernel.shmmni, kernel.shm_rmid_forced
-  Sysctls beginning with fs.mqueue.*
-  ```
-
-  If you use the `--ipc=host` option these sysctls will not be allowed.
-
-- `Network Namespace`:
-
-  Sysctls beginning with net.*
-
-  If you use the `--network=host` option using these sysctls will not be allowed.
diff --git a/components/engine/docs/reference/commandline/save.md b/components/engine/docs/reference/commandline/save.md
deleted file mode 100644
index cba7385e11..0000000000
--- a/components/engine/docs/reference/commandline/save.md
+++ /dev/null
@@ -1,62 +0,0 @@
----
-title: "save"
-description: "The save command description and usage"
-keywords: "tarred, repository, backup"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# save
-
-```markdown
-Usage:  docker save [OPTIONS] IMAGE [IMAGE...]
-
-Save one or more images to a tar archive (streamed to STDOUT by default)
-
-Options:
-      --help            Print usage
-  -o, --output string   Write to a file, instead of STDOUT
-```
-
-## Description
-
-Produces a tarred repository to the standard output stream.
-Contains all parent layers, and all tags + versions, or specified `repo:tag`, for
-each argument provided.
-
-## Examples
-
-### Create a backup that can then be used with `docker load`.
-
-```bash
-$ docker save busybox > busybox.tar
-
-$ ls -sh busybox.tar
-
-2.7M busybox.tar
-
-$ docker save --output busybox.tar busybox
-
-$ ls -sh busybox.tar
-
-2.7M busybox.tar
-
-$ docker save -o fedora-all.tar fedora
-
-$ docker save -o fedora-latest.tar fedora:latest
-```
-
-### Cherry-pick particular tags
-
-You can even cherry-pick particular tags of an image repository.
-
-```bash
-$ docker save -o ubuntu.tar ubuntu:lucid ubuntu:saucy
-```
diff --git a/components/engine/docs/reference/commandline/search.md b/components/engine/docs/reference/commandline/search.md
deleted file mode 100644
index f645c78603..0000000000
--- a/components/engine/docs/reference/commandline/search.md
+++ /dev/null
@@ -1,149 +0,0 @@
----
-title: "search"
-description: "The search command description and usage"
-keywords: "search, hub, images"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# search
-
-```markdown
-Usage:  docker search [OPTIONS] TERM
-
-Search the Docker Hub for images
-
-Options:
-  -f, --filter value   Filter output based on conditions provided (default [])
-                       - is-automated=(true|false)
-                       - is-official=(true|false)
-                       - stars=<number> - image has at least 'number' stars
-      --help           Print usage
-      --limit int      Max number of search results (default 25)
-      --no-trunc       Don't truncate output
-```
-
-## Description
-
-Search [Docker Hub](https://hub.docker.com) for images
-
-See [*Find Public Images on Docker Hub*](https://docs.docker.com/engine/tutorials/dockerrepos/#searching-for-images) for
-more details on finding shared images from the command line.
-
-> **Note**: Search queries return a maximum of 25 results.
-
-## Examples
-
-### Search images by name
-
-This example displays images with a name containing 'busybox':
-
-```none
-$ docker search busybox
-
-NAME                             DESCRIPTION                                     STARS     OFFICIAL   AUTOMATED
-busybox                          Busybox base image.                             316       [OK]       
-progrium/busybox                                                                 50                   [OK]
-radial/busyboxplus               Full-chain, Internet enabled, busybox made...   8                    [OK]
-odise/busybox-python                                                             2                    [OK]
-azukiapp/busybox                 This image is meant to be used as the base...   2                    [OK]
-ofayau/busybox-jvm               Prepare busybox to install a 32 bits JVM.       1                    [OK]
-shingonoide/archlinux-busybox    Arch Linux, a lightweight and flexible Lin...   1                    [OK]
-odise/busybox-curl                                                               1                    [OK]
-ofayau/busybox-libc32            Busybox with 32 bits (and 64 bits) libs         1                    [OK]
-peelsky/zulu-openjdk-busybox                                                     1                    [OK]
-skomma/busybox-data              Docker image suitable for data volume cont...   1                    [OK]
-elektritter/busybox-teamspeak    Lightweight teamspeak3 container based on...    1                    [OK]
-socketplane/busybox                                                              1                    [OK]
-oveits/docker-nginx-busybox      This is a tiny NginX docker image based on...   0                    [OK]
-ggtools/busybox-ubuntu           Busybox ubuntu version with extra goodies       0                    [OK]
-nikfoundas/busybox-confd         Minimal busybox based distribution of confd     0                    [OK]
-openshift/busybox-http-app                                                       0                    [OK]
-jllopis/busybox                                                                  0                    [OK]
-swyckoff/busybox                                                                 0                    [OK]
-powellquiring/busybox                                                            0                    [OK]
-williamyeh/busybox-sh            Docker image for BusyBox's sh                   0                    [OK]
-simplexsys/busybox-cli-powered   Docker busybox images, with a few often us...   0                    [OK]
-fhisamoto/busybox-java           Busybox java                                    0                    [OK]
-scottabernethy/busybox                                                           0                    [OK]
-marclop/busybox-solr
-```
-
-### Display non-truncated description (--no-trunc)
-
-This example displays images with a name containing 'busybox',
-at least 3 stars and the description isn't truncated in the output:
-
-```bash
-$ docker search --stars=3 --no-trunc busybox
-NAME                 DESCRIPTION                                                                               STARS     OFFICIAL   AUTOMATED
-busybox              Busybox base image.                                                                       325       [OK]       
-progrium/busybox                                                                                               50                   [OK]
-radial/busyboxplus   Full-chain, Internet enabled, busybox made from scratch. Comes in git and cURL flavors.   8                    [OK]
-```
-
-### Limit search results (--limit)
-
-The flag `--limit` is the maximum number of results returned by a search. This value could
-be in the range between 1 and 100. The default value of `--limit` is 25.
-
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is a `key=value` pair. If there is more
-than one filter, then pass multiple flags (e.g. `--filter "foo=bar" --filter "bif=baz"`)
-
-The currently supported filters are:
-
-* stars (int - number of stars the image has)
-* is-automated (true|false) - is the image automated or not
-* is-official (true|false) - is the image official or not
-
-
-#### stars
-
-This example displays images with a name containing 'busybox' and at
-least 3 stars:
-
-```bash
-$ docker search --filter stars=3 busybox
-
-NAME                 DESCRIPTION                                     STARS     OFFICIAL   AUTOMATED
-busybox              Busybox base image.                             325       [OK]       
-progrium/busybox                                                     50                   [OK]
-radial/busyboxplus   Full-chain, Internet enabled, busybox made...   8                    [OK]
-```
-
-
-#### is-automated
-
-This example displays images with a name containing 'busybox'
-and are automated builds:
-
-```bash
-$ docker search --filter is-automated busybox
-
-NAME                 DESCRIPTION                                     STARS     OFFICIAL   AUTOMATED
-progrium/busybox                                                     50                   [OK]
-radial/busyboxplus   Full-chain, Internet enabled, busybox made...   8                    [OK]
-```
-
-#### is-official
-
-This example displays images with a name containing 'busybox', at least
-3 stars and are official builds:
-
-```bash
-$ docker search --filter "is-official=true" --filter "stars=3" busybox
-
-NAME                 DESCRIPTION                                     STARS     OFFICIAL   AUTOMATED
-progrium/busybox                                                     50                   [OK]
-radial/busyboxplus   Full-chain, Internet enabled, busybox made...   8                    [OK]
-```
diff --git a/components/engine/docs/reference/commandline/secret.md b/components/engine/docs/reference/commandline/secret.md
deleted file mode 100644
index 50734407ab..0000000000
--- a/components/engine/docs/reference/commandline/secret.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-title: "secret"
-description: "The secret command description and usage"
-keywords: "secret"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# secret
-
-```markdown
-Usage:  docker secret COMMAND
-
-Manage Docker secrets
-
-Options:
-      --help   Print usage
-
-Commands:
-  create      Create a secret from a file or STDIN as content
-  inspect     Display detailed information on one or more secrets
-  ls          List secrets
-  rm          Remove one or more secrets
-
-Run 'docker secret COMMAND --help' for more information on a command.
-
-```
-
-## Description
-
-Manage secrets.
-
-## Related commands
-
-* [secret create](secret_create.md)
-* [secret inspect](secret_inspect.md)
-* [secret list](secret_list.md)
-* [secret rm](secret_rm.md)
diff --git a/components/engine/docs/reference/commandline/secret_create.md b/components/engine/docs/reference/commandline/secret_create.md
deleted file mode 100644
index e534dde553..0000000000
--- a/components/engine/docs/reference/commandline/secret_create.md
+++ /dev/null
@@ -1,99 +0,0 @@
----
-title: "secret create"
-description: "The secret create command description and usage"
-keywords: ["secret, create"]
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# secret create
-
-```Markdown
-Usage:	docker secret create [OPTIONS] SECRET file|-
-
-Create a secret from a file or STDIN as content
-
-Options:
-      --help          Print usage
-  -l, --label list    Secret labels (default [])
-```
-
-## Description
-
-Creates a secret using standard input or from a file for the secret content. You must run this command on a manager node. 
-
-For detailed information about using secrets, refer to [manage sensitive data with Docker secrets](https://docs.docker.com/engine/swarm/secrets/).
-
-## Examples
-
-### Create a secret
-
-```bash
-$ echo <secret> | docker secret create my_secret -
-
-onakdyv307se2tl7nl20anokv
-
-$ docker secret ls
-
-ID                          NAME                CREATED             UPDATED
-onakdyv307se2tl7nl20anokv   my_secret           6 seconds ago       6 seconds ago
-```
-
-### Create a secret with a file
-
-```bash
-$ docker secret create my_secret ./secret.json
-
-dg426haahpi5ezmkkj5kyl3sn
-
-$ docker secret ls
-
-ID                          NAME                CREATED             UPDATED
-dg426haahpi5ezmkkj5kyl3sn   my_secret           7 seconds ago       7 seconds ago
-```
-
-### Create a secret with labels
-
-```bash
-$ docker secret create --label env=dev \
-                       --label rev=20170324 \
-                       my_secret ./secret.json
-
-eo7jnzguqgtpdah3cm5srfb97
-```
-
-```none
-$ docker secret inspect my_secret
-
-[
-    {
-        "ID": "eo7jnzguqgtpdah3cm5srfb97",
-        "Version": {
-            "Index": 17
-        },
-        "CreatedAt": "2017-03-24T08:15:09.735271783Z",
-        "UpdatedAt": "2017-03-24T08:15:09.735271783Z",
-        "Spec": {
-            "Name": "my_secret",
-            "Labels": {
-                "env": "dev",
-                "rev": "20170324"
-            }
-        }
-    }
-]
-```
-
-
-## Related commands
-
-* [secret inspect](secret_inspect.md)
-* [secret ls](secret_ls.md)
-* [secret rm](secret_rm.md)
diff --git a/components/engine/docs/reference/commandline/secret_inspect.md b/components/engine/docs/reference/commandline/secret_inspect.md
deleted file mode 100644
index cecf3c1ddc..0000000000
--- a/components/engine/docs/reference/commandline/secret_inspect.md
+++ /dev/null
@@ -1,95 +0,0 @@
----
-title: "secret inspect"
-description: "The secret inspect command description and usage"
-keywords: ["secret, inspect"]
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# secret inspect
-
-```Markdown
-Usage:  docker secret inspect [OPTIONS] SECRET [SECRET...]
-
-Display detailed information on one or more secrets
-
-Options:
-  -f, --format string   Format the output using the given Go template
-      --help            Print usage
-```
-
-## Description
-
-Inspects the specified secret. This command has to be run targeting a manager
-node.
-
-By default, this renders all results in a JSON array. If a format is specified,
-the given template will be executed for each result.
-
-Go's [text/template](http://golang.org/pkg/text/template/) package
-describes all the details of the format.
-
-For detailed information about using secrets, refer to [manage sensitive data with Docker secrets](https://docs.docker.com/engine/swarm/secrets/).
-
-## Examples
-
-### Inspect a secret by name or ID
-
-You can inspect a secret, either by its *name*, or *ID*
-
-For example, given the following secret:
-
-```bash
-$ docker secret ls
-
-ID                          NAME                CREATED             UPDATED
-eo7jnzguqgtpdah3cm5srfb97   my_secret           3 minutes ago       3 minutes ago
-```
-
-```none
-$ docker secret inspect secret.json
-
-[
-    {
-        "ID": "eo7jnzguqgtpdah3cm5srfb97",
-        "Version": {
-            "Index": 17
-        },
-        "CreatedAt": "2017-03-24T08:15:09.735271783Z",
-        "UpdatedAt": "2017-03-24T08:15:09.735271783Z",
-        "Spec": {
-            "Name": "my_secret",
-            "Labels": {
-                "env": "dev",
-                "rev": "20170324"
-            }
-        }
-    }
-]
-```
-
-### Formatting
-
-You can use the --format option to obtain specific information about a
-secret. The following example command outputs the creation time of the
-secret.
-
-```bash
-$ docker secret inspect --format='{{.CreatedAt}}' eo7jnzguqgtpdah3cm5srfb97
-
-2017-03-24 08:15:09.735271783 +0000 UTC
-```
-
-
-## Related commands
-
-* [secret create](secret_create.md)
-* [secret ls](secret_ls.md)
-* [secret rm](secret_rm.md)
diff --git a/components/engine/docs/reference/commandline/secret_ls.md b/components/engine/docs/reference/commandline/secret_ls.md
deleted file mode 100644
index 9b60227b8e..0000000000
--- a/components/engine/docs/reference/commandline/secret_ls.md
+++ /dev/null
@@ -1,157 +0,0 @@
----
-title: "secret ls"
-description: "The secret ls command description and usage"
-keywords: ["secret, ls"]
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# secret ls
-
-```Markdown
-Usage:	docker secret ls [OPTIONS]
-
-List secrets
-
-Aliases:
-  ls, list
-
-Options:
-  -f, --filter filter   Filter output based on conditions provided
-      --format string   Pretty-print secrets using a Go template
-      --help            Print usage
-  -q, --quiet           Only display IDs
-```
-
-## Description
-
-Run this command on a manager node to list the secrets in the swarm.
-
-For detailed information about using secrets, refer to [manage sensitive data with Docker secrets](https://docs.docker.com/engine/swarm/secrets/).
-
-## Examples
-
-```bash
-$ docker secret ls
-
-ID                          NAME                        CREATED             UPDATED
-6697bflskwj1998km1gnnjr38   q5s5570vtvnimefos1fyeo2u2   6 weeks ago         6 weeks ago
-9u9hk4br2ej0wgngkga6rp4hq   my_secret                   5 weeks ago         5 weeks ago
-mem02h8n73mybpgqjf0kfi1n0   test_secret                 3 seconds ago       3 seconds ago
-```
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is a `key=value` pair. If there is more
-than one filter, then pass multiple flags (e.g., `--filter "foo=bar" --filter "bif=baz"`)
-
-The currently supported filters are:
-
-* [id](secret_ls.md#id) (secret's ID)
-* [label](secret_ls.md#label) (`label=<key>` or `label=<key>=<value>`)
-* [name](secret_ls.md#name) (secret's name)
-
-#### id
-
-The `id` filter matches all or prefix of a secret's id.
-
-```bash
-$ docker secret ls -f "id=6697bflskwj1998km1gnnjr38"
-
-ID                          NAME                        CREATED             UPDATED
-6697bflskwj1998km1gnnjr38   q5s5570vtvnimefos1fyeo2u2   6 weeks ago         6 weeks ago
-```
-
-#### label
-
-The `label` filter matches secrets based on the presence of a `label` alone or
-a `label` and a value.
-
-The following filter matches all secrets with a `project` label regardless of
-its value:
-
-```bash
-$ docker secret ls --filter label=project
-
-ID                          NAME                        CREATED             UPDATED
-mem02h8n73mybpgqjf0kfi1n0   test_secret                 About an hour ago   About an hour ago
-```
-
-The following filter matches only services with the `project` label with the
-`project-a` value.
-
-```bash
-$ docker service ls --filter label=project=test
-
-ID                          NAME                        CREATED             UPDATED
-mem02h8n73mybpgqjf0kfi1n0   test_secret                 About an hour ago   About an hour ago
-```
-
-#### name
-
-The `name` filter matches on all or prefix of a secret's name.
-
-The following filter matches secret with a name containing a prefix of `test`.
-
-```bash
-$ docker secret ls --filter name=test_secret
-
-ID                          NAME                        CREATED             UPDATED
-mem02h8n73mybpgqjf0kfi1n0   test_secret                 About an hour ago   About an hour ago
-```
-
-### Format the output
-
-The formatting option (`--format`) pretty prints secrets output
-using a Go template.
-
-Valid placeholders for the Go template are listed below:
-
-| Placeholder  | Description                                                                          |
-| ------------ | ------------------------------------------------------------------------------------ |
-| `.ID`        | Secret ID                                                                            |
-| `.Name`      | Secret name                                                                          |
-| `.CreatedAt` | Time when the secret was created                                                     |
-| `.UpdatedAt` | Time when the secret was updated                                                     |
-| `.Labels`    | All labels assigned to the secret                                                    |
-| `.Label`     | Value of a specific label for this secret. For example `{{.Label "secret.ssh.key"}}` |
-
-When using the `--format` option, the `secret ls` command will either
-output the data exactly as the template declares or, when using the
-`table` directive, will include column headers as well.
-
-The following example uses a template without headers and outputs the
-`ID` and `Name` entries separated by a colon for all images:
-
-```bash
-$ docker secret ls --format "{{.ID}}: {{.Name}}"
-
-77af4d6b9913: secret-1
-b6fa739cedf5: secret-2
-78a85c484f71: secret-3
-```
-
-To list all secrets with their name and created date in a table format you
-can use:
-
-```bash
-$ docker secret ls --format "table {{.ID}}\t{{.Name}}\t{{.CreatedAt}}"
-
-ID                  NAME                      CREATED
-77af4d6b9913        secret-1                  5 minutes ago
-b6fa739cedf5        secret-2                  3 hours ago
-78a85c484f71        secret-3                  10 days ago
-```
-
-## Related commands
-
-* [secret create](secret_create.md)
-* [secret inspect](secret_inspect.md)
-* [secret rm](secret_rm.md)
diff --git a/components/engine/docs/reference/commandline/secret_rm.md b/components/engine/docs/reference/commandline/secret_rm.md
deleted file mode 100644
index 1e10350f96..0000000000
--- a/components/engine/docs/reference/commandline/secret_rm.md
+++ /dev/null
@@ -1,54 +0,0 @@
----
-title: "secret rm"
-description: "The secret rm command description and usage"
-keywords: ["secret, rm"]
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# secret rm
-
-```Markdown
-Usage:	docker secret rm SECRET [SECRET...]
-
-Remove one or more secrets
-
-Aliases:
-  rm, remove
-
-Options:
-      --help   Print usage
-```
-
-## Description
-
-Removes the specified secrets from the swarm. This command has to be run
-targeting a manager node.
-
-For detailed information about using secrets, refer to [manage sensitive data with Docker secrets](https://docs.docker.com/engine/swarm/secrets/).
-
-## Examples
-
-This example removes a secret:
-
-```bash
-$ docker secret rm secret.json
-sapth4csdo5b6wz2p5uimh5xg
-```
-
-> **Warning**: Unlike `docker rm`, this command does not ask for confirmation
-> before removing a secret.
-
-
-## Related commands
-
-* [secret create](secret_create.md)
-* [secret inspect](secret_inspect.md)
-* [secret ls](secret_ls.md)
diff --git a/components/engine/docs/reference/commandline/service.md b/components/engine/docs/reference/commandline/service.md
deleted file mode 100644
index 2c12c67648..0000000000
--- a/components/engine/docs/reference/commandline/service.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-title: "service"
-description: "The service command description and usage"
-keywords: "service"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# service
-
-```markdown
-Usage:  docker service COMMAND
-
-Manage services
-
-Options:
-      --help   Print usage
-
-Commands:
-  create      Create a new service
-  inspect     Display detailed information on one or more services
-  logs        Fetch the logs of a service or task
-  ls          List services
-  ps          List the tasks of one or more services
-  rm          Remove one or more services
-  scale       Scale one or multiple replicated services
-  update      Update a service
-
-Run 'docker service COMMAND --help' for more information on a command.
-```
-
-## Description
-
-Manage services.
-
diff --git a/components/engine/docs/reference/commandline/service_create.md b/components/engine/docs/reference/commandline/service_create.md
deleted file mode 100644
index 78faa98bf7..0000000000
--- a/components/engine/docs/reference/commandline/service_create.md
+++ /dev/null
@@ -1,846 +0,0 @@
----
-title: "service create"
-description: "The service create command description and usage"
-keywords: "service, create"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# service create
-
-```Markdown
-Usage:  docker service create [OPTIONS] IMAGE [COMMAND] [ARG...]
-
-Create a new service
-
-Options:
-      --constraint list                    Placement constraints
-      --container-label list               Container labels
-  -d, --detach                             Exit immediately instead of waiting for the service to converge (default true)
-      --dns list                           Set custom DNS servers
-      --dns-option list                    Set DNS options
-      --dns-search list                    Set custom DNS search domains
-      --endpoint-mode string               Endpoint mode (vip or dnsrr) (default "vip")
-      --entrypoint command                 Overwrite the default ENTRYPOINT of the image
-  -e, --env list                           Set environment variables
-      --env-file list                      Read in a file of environment variables
-      --group list                         Set one or more supplementary user groups for the container
-      --health-cmd string                  Command to run to check health
-      --health-interval duration           Time between running the check (ms|s|m|h)
-      --health-retries int                 Consecutive failures needed to report unhealthy
-      --health-start-period duration       Start period for the container to initialize before counting retries towards unstable (ms|s|m|h)
-      --health-timeout duration            Maximum time to allow one check to run (ms|s|m|h)
-      --help                               Print usage
-      --host list                          Set one or more custom host-to-IP mappings (host:ip)
-      --hostname string                    Container hostname
-  -l, --label list                         Service labels
-      --limit-cpu decimal                  Limit CPUs
-      --limit-memory bytes                 Limit Memory
-      --log-driver string                  Logging driver for service
-      --log-opt list                       Logging driver options
-      --mode string                        Service mode (replicated or global) (default "replicated")
-      --mount mount                        Attach a filesystem mount to the service
-      --name string                        Service name
-      --network list                       Network attachments
-      --no-healthcheck                     Disable any container-specified HEALTHCHECK
-      --placement-pref pref                Add a placement preference
-  -p, --publish port                       Publish a port as a node port
-  -q, --quiet                              Suppress progress output
-      --read-only                          Mount the container's root filesystem as read only
-      --replicas uint                      Number of tasks
-      --reserve-cpu decimal                Reserve CPUs
-      --reserve-memory bytes               Reserve Memory
-      --restart-condition string           Restart when condition is met ("none"|"on-failure"|"any") (default "any")
-      --restart-delay duration             Delay between restart attempts (ns|us|ms|s|m|h) (default 5s)
-      --restart-max-attempts uint          Maximum number of restarts before giving up
-      --restart-window duration            Window used to evaluate the restart policy (ns|us|ms|s|m|h)
-      --rollback-delay duration            Delay between task rollbacks (ns|us|ms|s|m|h) (default 0s)
-      --rollback-failure-action string     Action on rollback failure ("pause"|"continue") (default "pause")
-      --rollback-max-failure-ratio float   Failure rate to tolerate during a rollback (default 0)
-      --rollback-monitor duration          Duration after each task rollback to monitor for failure (ns|us|ms|s|m|h) (default 5s)
-      --rollback-order string              Rollback order ("start-first"|"stop-first") (default "stop-first")
-      --rollback-parallelism uint          Maximum number of tasks rolled back simultaneously (0 to roll back all at once) (default 1)
-      --secret secret                      Specify secrets to expose to the service
-      --stop-grace-period duration         Time to wait before force killing a container (ns|us|ms|s|m|h) (default 10s)
-      --stop-signal string                 Signal to stop the container
-  -t, --tty                                Allocate a pseudo-TTY
-      --update-delay duration              Delay between updates (ns|us|ms|s|m|h) (default 0s)
-      --update-failure-action string       Action on update failure ("pause"|"continue"|"rollback") (default "pause")
-      --update-max-failure-ratio float     Failure rate to tolerate during an update (default 0)
-      --update-monitor duration            Duration after each task update to monitor for failure (ns|us|ms|s|m|h) (default 5s)
-      --update-order string                Update order ("start-first"|"stop-first") (default "stop-first")
-      --update-parallelism uint            Maximum number of tasks updated simultaneously (0 to update all at once) (default 1)
-  -u, --user string                        Username or UID (format: <name|uid>[:<group|gid>])
-      --with-registry-auth                 Send registry authentication details to swarm agents
-  -w, --workdir string                     Working directory inside the container
-```
-
-## Description
-
-Creates a service as described by the specified parameters. You must run this
-command on a manager node.
-
-## Examples
-
-### Create a service
-
-```bash
-$ docker service create --name redis redis:3.0.6
-
-dmu1ept4cxcfe8k8lhtux3ro3
-
-$ docker service create --mode global --name redis2 redis:3.0.6
-
-a8q9dasaafudfs8q8w32udass
-
-$ docker service ls
-
-ID            NAME    MODE        REPLICAS  IMAGE
-dmu1ept4cxcf  redis   replicated  1/1       redis:3.0.6
-a8q9dasaafud  redis2  global      1/1       redis:3.0.6
-```
-
-### Create a service with 5 replica tasks (--replicas)
-
-Use the `--replicas` flag to set the number of replica tasks for a replicated
-service. The following command creates a `redis` service with `5` replica tasks:
-
-```bash
-$ docker service create --name redis --replicas=5 redis:3.0.6
-
-4cdgfyky7ozwh3htjfw0d12qv
-```
-
-The above command sets the *desired* number of tasks for the service. Even
-though the command returns immediately, actual scaling of the service may take
-some time. The `REPLICAS` column shows both the *actual* and *desired* number
-of replica tasks for the service.
-
-In the following example the desired state is  `5` replicas, but the current
-number of `RUNNING` tasks is `3`:
-
-```bash
-$ docker service ls
-
-ID            NAME   MODE        REPLICAS  IMAGE
-4cdgfyky7ozw  redis  replicated  3/5       redis:3.0.7
-```
-
-Once all the tasks are created and `RUNNING`, the actual number of tasks is
-equal to the desired number:
-
-```bash
-$ docker service ls
-
-ID            NAME   MODE        REPLICAS  IMAGE
-4cdgfyky7ozw  redis  replicated  5/5       redis:3.0.7
-```
-
-### Create a service with secrets
-
-Use the `--secret` flag to give a container access to a
-[secret](secret_create.md).
-
-Create a service specifying a secret:
-
-```bash
-$ docker service create --name redis --secret secret.json redis:3.0.6
-
-4cdgfyky7ozwh3htjfw0d12qv
-```
-
-Create a service specifying the secret, target, user/group ID and mode:
-
-```bash
-$ docker service create --name redis \
-    --secret source=ssh-key,target=ssh \
-    --secret source=app-key,target=app,uid=1000,gid=1001,mode=0400 \
-    redis:3.0.6
-
-4cdgfyky7ozwh3htjfw0d12qv
-```
-
-Secrets are located in `/run/secrets` in the container.  If no target is
-specified, the name of the secret will be used as the in memory file in the
-container.  If a target is specified, that will be the filename.  In the
-example above, two files will be created: `/run/secrets/ssh` and
-`/run/secrets/app` for each of the secret targets specified.
-
-### Create a service with a rolling update policy
-
-```bash
-$ docker service create \
-  --replicas 10 \
-  --name redis \
-  --update-delay 10s \
-  --update-parallelism 2 \
-  redis:3.0.6
-```
-
-When you run a [service update](service_update.md), the scheduler updates a
-maximum of 2 tasks at a time, with `10s` between updates. For more information,
-refer to the [rolling updates
-tutorial](https://docs.docker.com/engine/swarm/swarm-tutorial/rolling-update/).
-
-### Set environment variables (-e, --env)
-
-This sets environmental variables for all tasks in a service. For example:
-
-```bash
-$ docker service create --name redis_2 --replicas 5 --env MYVAR=foo redis:3.0.6
-```
-
-### Create a service with specific hostname (--hostname)
-
-This option sets the docker service containers hostname to a specific string.
-For example:
-
-```bash
-$ docker service create --name redis --hostname myredis redis:3.0.6
-```
-
-### Set metadata on a service (-l, --label)
-
-A label is a `key=value` pair that applies metadata to a service. To label a
-service with two labels:
-
-```bash
-$ docker service create \
-  --name redis_2 \
-  --label com.example.foo="bar"
-  --label bar=baz \
-  redis:3.0.6
-```
-
-For more information about labels, refer to [apply custom
-metadata](https://docs.docker.com/engine/userguide/labels-custom-metadata/).
-
-### Add bind-mounts or volumes
-
-Docker supports two different kinds of mounts, which allow containers to read to
-or write from files or directories on other containers or the host operating
-system. These types are _data volumes_ (often referred to simply as volumes) and
-_bind-mounts_.
-
-Additionally, Docker supports `tmpfs` mounts.
-
-A **bind-mount** makes a file or directory on the host available to the
-container it is mounted within. A bind-mount may be either read-only or
-read-write. For example, a container might share its host's DNS information by
-means of a bind-mount of the host's `/etc/resolv.conf` or a container might
-write logs to its host's `/var/log/myContainerLogs` directory. If you use
-bind-mounts and your host and containers have different notions of permissions,
-access controls, or other such details, you will run into portability issues.
-
-A **named volume** is a mechanism for decoupling persistent data needed by your
-container from the image used to create the container and from the host machine.
-Named volumes are created and managed by Docker, and a named volume persists
-even when no container is currently using it. Data in named volumes can be
-shared between a container and the host machine, as well as between multiple
-containers. Docker uses a _volume driver_ to create, manage, and mount volumes.
-You can back up or restore volumes using Docker commands.
-
-A **tmpfs** mounts a tmpfs inside a container for volatile data.
-
-Consider a situation where your image starts a lightweight web server. You could
-use that image as a base image, copy in your website's HTML files, and package
-that into another image. Each time your website changed, you'd need to update
-the new image and redeploy all of the containers serving your website. A better
-solution is to store the website in a named volume which is attached to each of
-your web server containers when they start. To update the website, you just
-update the named volume.
-
-For more information about named volumes, see
-[Data Volumes](https://docs.docker.com/engine/tutorials/dockervolumes/).
-
-The following table describes options which apply to both bind-mounts and named
-volumes in a service:
-
-<table>
-  <tr>
-    <th>Option</th>
-    <th>Required</th>
-    <th>Description</th>
-  </tr>
-  <tr>
-    <td><b>types</b></td>
-    <td></td>
-    <td>
-      <p>The type of mount, can be either <tt>volume</tt>, <tt>bind</tt>, or <tt>tmpfs</tt>. Defaults to <tt>volume</tt> if no type is specified.
-      <ul>
-        <li><tt>volume</tt>: mounts a [managed volume](volume_create.md) into the container.</li>
-        <li><tt>bind</tt>: bind-mounts a directory or file from the host into the container.</li>
-        <li><tt>tmpfs</tt>: mount a tmpfs in the container</li>
-      </ul></p>
-    </td>
-  </tr>
-  <tr>
-    <td><b>src</b> or <b>source</b></td>
-    <td>for <tt>type=bind</tt> only></td>
-    <td>
-      <ul>
-        <li>
-         <tt>type=volume</tt>: <tt>src</tt> is an optional way to specify the name of the volume (for example, <tt>src=my-volume</tt>).
-          If the named volume does not exist, it is automatically created. If no <tt>src</tt> is specified, the volume is
-          assigned a random name which is guaranteed to be unique on the host, but may not be unique cluster-wide.
-          A randomly-named volume has the same lifecycle as its container and is destroyed when the <i>container</i>
-          is destroyed (which is upon <tt>service update</tt>, or when scaling or re-balancing the service)
-        </li>
-        <li>
-          <tt>type=bind</tt>: <tt>src</tt> is required, and specifies an absolute path to the file or directory to bind-mount
-          (for example, <tt>src=/path/on/host/</tt>). An error is produced if the file or directory does not exist.
-        </li>
-        <li>
-          <tt>type=tmpfs</tt>: <tt>src</tt> is not supported.
-        </li>
-      </ul>
-    </td>
-  </tr>
-  <tr>
-    <td><p><b>dst</b> or <b>destination</b> or <b>target</b></p></td>
-    <td>yes</td>
-    <td>
-      <p>Mount path inside the container, for example <tt>/some/path/in/container/</tt>.
-      If the path does not exist in the container's filesystem, the Engine creates
-      a directory at the specified location before mounting the volume or bind-mount.</p>
-    </td>
-  </tr>
-  <tr>
-    <td><p><b>readonly</b> or <b>ro</b></p></td>
-    <td></td>
-    <td>
-      <p>The Engine mounts binds and volumes <tt>read-write</tt> unless <tt>readonly</tt> option
-      is given when mounting the bind or volume.
-      <ul>
-        <li><tt>true</tt> or <tt>1</tt> or no value: Mounts the bind or volume read-only.</li>
-        <li><tt>false</tt> or <tt>0</tt>: Mounts the bind or volume read-write.</li>
-      </ul></p>
-    </td>
-  </tr>
-  <tr>
-    <td><b>consistency</b></td>
-    <td></td>
-    <td>
-      <p>The consistency requirements for the mount; one of
-         <ul>
-           <li><tt>default</tt>: Equivalent to <tt>consistent</tt>.</li>
-           <li><tt>consistent</tt>: Full consistency.  The container runtime and the host maintain an identical view of the mount at all times.</li>
-           <li><tt>cached</tt>: The host's view of the mount is authoritative.  There may be delays before updates made on the host are visible within a container.</li>
-           <li><tt>delegated</tt>: The container runtime's view of the mount is authoritative.  There may be delays before updates made in a container are are visible on the host.</li>
-        </ul>
-     </p>
-    </td>
-  </tr>
-</table>
-
-#### Bind Propagation
-
-Bind propagation refers to whether or not mounts created within a given
-bind-mount or named volume can be propagated to replicas of that mount. Consider
-a mount point `/mnt`, which is also mounted on `/tmp`. The propation settings
-control whether a mount on `/tmp/a` would also be available on `/mnt/a`. Each
-propagation setting has a recursive counterpoint. In the case of recursion,
-consider that `/tmp/a` is also mounted as `/foo`. The propagation settings
-control whether `/mnt/a` and/or `/tmp/a` would exist.
-
-The `bind-propagation` option defaults to `rprivate` for both bind-mounts and
-volume mounts, and is only configurable for bind-mounts. In other words, named
-volumes do not support bind propagation.
-
-- **`shared`**: Sub-mounts of the original mount are exposed to replica mounts,
-                and sub-mounts of replica mounts are also propagated to the
-                original mount.
-- **`slave`**: similar to a shared mount, but only in one direction. If the
-               original mount exposes a sub-mount, the replica mount can see it.
-               However, if the replica mount exposes a sub-mount, the original
-               mount cannot see it.
-- **`private`**: The mount is private. Sub-mounts within it are not exposed to
-                 replica mounts, and sub-mounts of replica mounts are not
-                 exposed to the original mount.
-- **`rshared`**: The same as shared, but the propagation also extends to and from
-                 mount points nested within any of the original or replica mount
-                 points.
-- **`rslave`**: The same as `slave`, but the propagation also extends to and from
-                 mount points nested within any of the original or replica mount
-                 points.
-- **`rprivate`**: The default. The same as `private`, meaning that no mount points
-                  anywhere within the original or replica mount points propagate
-                  in either direction.
-
-For more information about bind propagation, see the
-[Linux kernel documentation for shared subtree](https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt).
-
-#### Options for Named Volumes
-
-The following options can only be used for named volumes (`type=volume`);
-
-
-<table>
-  <tr>
-    <th>Option</th>
-    <th>Description</th>
-  </tr>
-  <tr>
-    <td><b>volume-driver</b></td>
-    <td>
-      <p>Name of the volume-driver plugin to use for the volume. Defaults to
-      <tt>"local"</tt>, to use the local volume driver to create the volume if the
-      volume does not exist.</p>
-    </td>
-  </tr>
-  <tr>
-    <td><b>volume-label</b></td>
-    <td>
-      One or more custom metadata ("labels") to apply to the volume upon
-      creation. For example,
-      `volume-label=mylabel=hello-world,my-other-label=hello-mars`. For more
-      information about labels, refer to
-      <a href="https://docs.docker.com/engine/userguide/labels-custom-metadata/">apply custom metadata</a>.
-    </td>
-  </tr>
-  <tr>
-    <td><b>volume-nocopy</b></td>
-    <td>
-      By default, if you attach an empty volume to a container, and files or
-      directories already existed at the mount-path in the container (<tt>dst</tt>),
-      the Engine copies those files and directories into the volume, allowing
-      the host to access them. Set `volume-nocopy` to disables copying files
-      from the container's filesystem to the volume and mount the empty volume.
-
-      A value is optional:
-
-      <ul>
-        <li><tt>true</tt> or <tt>1</tt>: Default if you do not provide a value. Disables copying.</li>
-        <li><tt>false</tt> or <tt>0</tt>: Enables copying.</li>
-      </ul>
-    </td>
-  </tr>
-  <tr>
-    <td><b>volume-opt</b></td>
-    <td>
-      Options specific to a given volume driver, which will be passed to the
-      driver when creating the volume. Options are provided as a comma-separated
-      list of key/value pairs, for example,
-      <tt>volume-opt=some-option=some-value,volume-opt=some-other-option=some-other-value</tt>.
-      For available options for a given driver, refer to that driver's
-      documentation.
-    </td>
-  </tr>
-</table>
-
-
-#### Options for tmpfs
-
-The following options can only be used for tmpfs mounts (`type=tmpfs`);
-
-
-<table>
-  <tr>
-    <th>Option</th>
-    <th>Description</th>
-  </tr>
-  <tr>
-    <td><b>tmpfs-size</b></td>
-    <td>Size of the tmpfs mount in bytes. Unlimited by default in Linux.</td>
-  </tr>
-  <tr>
-    <td><b>tmpfs-mode</b></td>
-    <td>File mode of the tmpfs in octal. (e.g. <tt>"700"</tt> or <tt>"0700"</tt>.) Defaults to <tt>"1777"</tt> in Linux.</td>
-  </tr>
-</table>
-
-
-#### Differences between "--mount" and "--volume"
-
-The `--mount` flag supports most options that are supported by the `-v`
-or `--volume` flag for `docker run`, with some important exceptions:
-
-- The `--mount` flag allows you to specify a volume driver and volume driver
-  options *per volume*, without creating the volumes in advance. In contrast,
-  `docker run` allows you to specify a single volume driver which is shared
-  by all volumes, using the `--volume-driver` flag.
-
-- The `--mount` flag allows you to specify custom metadata ("labels") for a volume,
-  before the volume is created.
-
-- When you use `--mount` with `type=bind`, the host-path must refer to an *existing*
-  path on the host. The path will not be created for you and the service will fail
-  with an error if the path does not exist.
-
-- The `--mount` flag does not allow you to relabel a volume with `Z` or `z` flags,
-  which are used for `selinux` labeling.
-
-#### Create a service using a named volume
-
-The following example creates a service that uses a named volume:
-
-```bash
-$ docker service create \
-  --name my-service \
-  --replicas 3 \
-  --mount type=volume,source=my-volume,destination=/path/in/container,volume-label="color=red",volume-label="shape=round" \
-  nginx:alpine
-```
-
-For each replica of the service, the engine requests a volume named "my-volume"
-from the default ("local") volume driver where the task is deployed. If the
-volume does not exist, the engine creates a new volume and applies the "color"
-and "shape" labels.
-
-When the task is started, the volume is mounted on `/path/in/container/` inside
-the container.
-
-Be aware that the default ("local") volume is a locally scoped volume driver.
-This means that depending on where a task is deployed, either that task gets a
-*new* volume named "my-volume", or shares the same "my-volume" with other tasks
-of the same service. Multiple containers writing to a single shared volume can
-cause data corruption if the software running inside the container is not
-designed to handle concurrent processes writing to the same location. Also take
-into account that containers can be re-scheduled by the Swarm orchestrator and
-be deployed on a different node.
-
-#### Create a service that uses an anonymous volume
-
-The following command creates a service with three replicas with an anonymous
-volume on `/path/in/container`:
-
-```bash
-$ docker service create \
-  --name my-service \
-  --replicas 3 \
-  --mount type=volume,destination=/path/in/container \
-  nginx:alpine
-```
-
-In this example, no name (`source`) is specified for the volume, so a new volume
-is created for each task. This guarantees that each task gets its own volume,
-and volumes are not shared between tasks. Anonymous volumes are removed after
-the task using them is complete.
-
-#### Create a service that uses a bind-mounted host directory
-
-The following example bind-mounts a host directory at `/path/in/container` in
-the containers backing the service:
-
-```bash
-$ docker service create \
-  --name my-service \
-  --mount type=bind,source=/path/on/host,destination=/path/in/container \
-  nginx:alpine
-```
-
-### Set service mode (--mode)
-
-The service mode determines whether this is a _replicated_ service or a _global_
-service. A replicated service runs as many tasks as specified, while a global
-service runs on each active node in the swarm.
-
-The following command creates a global service:
-
-```bash
-$ docker service create \
- --name redis_2 \
- --mode global \
- redis:3.0.6
-```
-
-### Specify service constraints (--constraint)
-
-You can limit the set of nodes where a task can be scheduled by defining
-constraint expressions. Multiple constraints find nodes that satisfy every
-expression (AND match). Constraints can match node or Docker Engine labels as
-follows:
-
-
-<table>
-  <tr>
-    <th>node attribute</th>
-    <th>matches</th>
-    <th>example</th>
-  </tr>
-  <tr>
-    <td><tt>node.id</tt></td>
-    <td>Node ID</td>
-    <td><tt>node.id == 2ivku8v2gvtg4</tt></td>
-  </tr>
-  <tr>
-    <td><tt>node.hostname</tt></td>
-    <td>Node hostname</td>
-    <td><tt>node.hostname != node-2</tt></td>
-  </tr>
-  <tr>
-    <td><tt>node.role</tt></td>
-    <td>Node role</td>
-    <td><tt>node.role == manager</tt></td>
-  </tr>
-  <tr>
-    <td><tt>node.labels</tt></td>
-    <td>user defined node labels</td>
-    <td><tt>node.labels.security == high</tt></td>
-  </tr>
-  <tr>
-    <td><tt>engine.labels</tt></td>
-    <td>Docker Engine's labels</td>
-    <td><tt>engine.labels.operatingsystem == ubuntu 14.04</tt></td>
-  </tr>
-</table>
-
-
-`engine.labels` apply to Docker Engine labels like operating system,
-drivers, etc. Swarm administrators add `node.labels` for operational purposes by
-using the [`docker node update`](node_update.md) command.
-
-For example, the following limits tasks for the redis service to nodes where the
-node type label equals queue:
-
-```bash
-$ docker service create \
-  --name redis_2 \
-  --constraint 'node.labels.type == queue' \
-  redis:3.0.6
-```
-
-### Specify service placement preferences (--placement-pref)
-
-You can set up the service to divide tasks evenly over different categories of
-nodes. One example of where this can be useful is to balance tasks over a set
-of datacenters or availability zones. The example below illustrates this:
-
-```bash
-$ docker service create \
-  --replicas 9 \
-  --name redis_2 \
-  --placement-pref 'spread=node.labels.datacenter' \
-  redis:3.0.6
-```
-
-This uses `--placement-pref` with a `spread` strategy (currently the only
-supported strategy) to spread tasks evenly over the values of the `datacenter`
-node label. In this example, we assume that every node has a `datacenter` node
-label attached to it. If there are three different values of this label among
-nodes in the swarm, one third of the tasks will be placed on the nodes
-associated with each value. This is true even if there are more nodes with one
-value than another. For example, consider the following set of nodes:
-
-- Three nodes with `node.labels.datacenter=east`
-- Two nodes with `node.labels.datacenter=south`
-- One node with `node.labels.datacenter=west`
-
-Since we are spreading over the values of the `datacenter` label and the
-service has 9 replicas, 3 replicas will end up in each datacenter. There are
-three nodes associated with the value `east`, so each one will get one of the
-three replicas reserved for this value. There are two nodes with the value
-`south`, and the three replicas for this value will be divided between them,
-with one receiving two replicas and another receiving just one. Finally, `west`
-has a single node that will get all three replicas reserved for `west`.
-
-If the nodes in one category (for example, those with
-`node.labels.datacenter=south`) can't handle their fair share of tasks due to
-constraints or resource limitations, the extra tasks will be assigned to other
-nodes instead, if possible.
-
-Both engine labels and node labels are supported by placement preferences. The
-example above uses a node label, because the label is referenced with
-`node.labels.datacenter`. To spread over the values of an engine label, use
-`--placement-pref spread=engine.labels.<labelname>`.
-
-It is possible to add multiple placement preferences to a service. This
-establishes a hierarchy of preferences, so that tasks are first divided over
-one category, and then further divided over additional categories. One example
-of where this may be useful is dividing tasks fairly between datacenters, and
-then splitting the tasks within each datacenter over a choice of racks. To add
-multiple placement preferences, specify the `--placement-pref` flag multiple
-times. The order is significant, and the placement preferences will be applied
-in the order given when making scheduling decisions.
-
-The following example sets up a service with multiple placement preferences.
-Tasks are spread first over the various datacenters, and then over racks
-(as indicated by the respective labels):
-
-```bash
-$ docker service create \
-  --replicas 9 \
-  --name redis_2 \
-  --placement-pref 'spread=node.labels.datacenter' \
-  --placement-pref 'spread=node.labels.rack' \
-  redis:3.0.6
-```
-
-When updating a service with `docker service update`, `--placement-pref-add`
-appends a new placement preference after all existing placement preferences.
-`--placement-pref-rm` removes an existing placement preference that matches the
-argument.
-
-### Attach a service to an existing network (--network)
-
-You can use overlay networks to connect one or more services within the swarm.
-
-First, create an overlay network on a manager node the docker network create
-command:
-
-```bash
-$ docker network create --driver overlay my-network
-
-etjpu59cykrptrgw0z0hk5snf
-```
-
-After you create an overlay network in swarm mode, all manager nodes have
-access to the network.
-
-When you create a service and pass the --network flag to attach the service to
-the overlay network:
-
-```bash
-$ docker service create \
-  --replicas 3 \
-  --network my-network \
-  --name my-web \
-  nginx
-
-716thylsndqma81j6kkkb5aus
-```
-
-The swarm extends my-network to each node running the service.
-
-Containers on the same network can access each other using
-[service discovery](https://docs.docker.com/engine/swarm/networking/#use-swarm-mode-service-discovery).
-
-### Publish service ports externally to the swarm (-p, --publish)
-
-You can publish service ports to make them available externally to the swarm
-using the `--publish` flag:
-
-```bash
-$ docker service create --publish <TARGET-PORT>:<SERVICE-PORT> nginx
-```
-
-For example:
-
-```bash
-$ docker service create --name my_web --replicas 3 --publish 8080:80 nginx
-```
-
-When you publish a service port, the swarm routing mesh makes the service
-accessible at the target port on every node regardless if there is a task for
-the service running on the node. For more information refer to
-[Use swarm mode routing mesh](https://docs.docker.com/engine/swarm/ingress/).
-
-### Publish a port for TCP only or UDP only
-
-By default, when you publish a port, it is a TCP port. You can
-specifically publish a UDP port instead of or in addition to a TCP port. When
-you publish both TCP and UDP ports, Docker 1.12.2 and earlier require you to
-add the suffix `/tcp` for TCP ports. Otherwise it is optional.
-
-#### TCP only
-
-The following two commands are equivalent.
-
-```bash
-$ docker service create --name dns-cache -p 53:53 dns-cache
-
-$ docker service create --name dns-cache -p 53:53/tcp dns-cache
-```
-
-#### TCP and UDP
-
-```bash
-$ docker service create --name dns-cache -p 53:53/tcp -p 53:53/udp dns-cache
-```
-
-#### UDP only
-
-```bash
-$ docker service create --name dns-cache -p 53:53/udp dns-cache
-```
-
-### Create services using templates
-
-You can use templates for some flags of `service create`, using the syntax
-provided by the Go's [text/template](http://golang.org/pkg/text/template/) package.
-
-The supported flags are the following :
-
-- `--hostname`
-- `--mount`
-- `--env`
-
-Valid placeholders for the Go template are listed below:
-
-
-<table>
-  <tr>
-    <th>Placeholder</th>
-    <th>Description</th>
-  </tr>
-  <tr>
-    <td><tt>.Service.ID</tt></td>
-    <td>Service ID</td>
-  </tr>
-  <tr>
-    <td><tt>.Service.Name</tt></td>
-    <td>Service name</td>
-  </tr>
-  <tr>
-    <td><tt>.Service.Labels</tt></td>
-    <td>Service labels</td>
-  </tr>
-  <tr>
-    <td><tt>.Node.ID</tt></td>
-    <td>Node ID</td>
-  </tr>
-  <tr>
-    <td><tt>.Task.ID</tt></td>
-    <td>Task ID</td>
-  </tr>
-  <tr>
-    <td><tt>.Task.Name</tt></td>
-    <td>Task name</td>
-  </tr>
-  <tr>
-    <td><tt>.Task.Slot</tt></td>
-    <td>Task slot</td>
-  </tr>
-</table>
-
-
-#### Template example
-
-In this example, we are going to set the template of the created containers based on the
-service's name and the node's ID where it sits.
-
-```bash
-$ docker service create --name hosttempl \
-                        --hostname="{{.Node.ID}}-{{.Service.Name}}"\
-                         busybox top
-
-va8ew30grofhjoychbr6iot8c
-
-$ docker service ps va8ew30grofhjoychbr6iot8c
-
-ID            NAME         IMAGE                                                                                   NODE          DESIRED STATE  CURRENT STATE               ERROR  PORTS
-wo41w8hg8qan  hosttempl.1  busybox:latest@sha256:29f5d56d12684887bdfa50dcd29fc31eea4aaf4ad3bec43daf19026a7ce69912  2e7a8a9c4da2  Running        Running about a minute ago
-
-$ docker inspect --format="{{.Config.Hostname}}" hosttempl.1.wo41w8hg8qanxwjwsg4kxpprj
-
-x3ti0erg11rjpg64m75kej2mz-hosttempl
-```
-
-## Related commands
-
-* [service inspect](service_inspect.md)
-* [service logs](service_logs.md)
-* [service ls](service_ls.md)
-* [service rm](service_rm.md)
-* [service scale](service_scale.md)
-* [service ps](service_ps.md)
-* [service update](service_update.md)
-
-<style>table tr > td:first-child { white-space: nowrap;}</style>
diff --git a/components/engine/docs/reference/commandline/service_inspect.md b/components/engine/docs/reference/commandline/service_inspect.md
deleted file mode 100644
index 24c593cec9..0000000000
--- a/components/engine/docs/reference/commandline/service_inspect.md
+++ /dev/null
@@ -1,170 +0,0 @@
----
-title: "service inspect"
-description: "The service inspect command description and usage"
-keywords: "service, inspect"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# service inspect
-
-```Markdown
-Usage:  docker service inspect [OPTIONS] SERVICE [SERVICE...]
-
-Display detailed information on one or more services
-
-Options:
-  -f, --format string   Format the output using the given Go template
-      --help            Print usage
-      --pretty          Print the information in a human friendly format
-```
-
-## Description
-
-Inspects the specified service. This command has to be run targeting a manager
-node.
-
-By default, this renders all results in a JSON array. If a format is specified,
-the given template will be executed for each result.
-
-Go's [text/template](http://golang.org/pkg/text/template/) package
-describes all the details of the format.
-
-## Examples
-
-### Inspect a service by name or ID
-
-You can inspect a service, either by its *name*, or *ID*
-
-For example, given the following service;
-
-```bash
-$ docker service ls
-ID            NAME   MODE        REPLICAS  IMAGE
-dmu1ept4cxcf  redis  replicated  3/3       redis:3.0.6
-```
-
-Both `docker service inspect redis`, and `docker service inspect dmu1ept4cxcf`
-produce the same result:
-
-```none
-$ docker service inspect redis
-
-[
-    {
-        "ID": "dmu1ept4cxcfe8k8lhtux3ro3",
-        "Version": {
-            "Index": 12
-        },
-        "CreatedAt": "2016-06-17T18:44:02.558012087Z",
-        "UpdatedAt": "2016-06-17T18:44:02.558012087Z",
-        "Spec": {
-            "Name": "redis",
-            "TaskTemplate": {
-                "ContainerSpec": {
-                    "Image": "redis:3.0.6"
-                },
-                "Resources": {
-                    "Limits": {},
-                    "Reservations": {}
-                },
-                "RestartPolicy": {
-                    "Condition": "any",
-                    "MaxAttempts": 0
-                },
-                "Placement": {}
-            },
-            "Mode": {
-                "Replicated": {
-                    "Replicas": 1
-                }
-            },
-            "UpdateConfig": {},
-            "EndpointSpec": {
-                "Mode": "vip"
-            }
-        },
-        "Endpoint": {
-            "Spec": {}
-        }
-    }
-]
-```
-
-```bash
-$ docker service inspect dmu1ept4cxcf
-
-[
-    {
-        "ID": "dmu1ept4cxcfe8k8lhtux3ro3",
-        "Version": {
-            "Index": 12
-        },
-        ...
-    }
-]
-```
-
-### Formatting
-
-You can print the inspect output in a human-readable format instead of the default
-JSON output, by using the `--pretty` option:
-
-```bash
-$ docker service inspect --pretty frontend
-
-ID:		c8wgl7q4ndfd52ni6qftkvnnp
-Name:		frontend
-Labels:
- - org.example.projectname=demo-app
-Service Mode:	REPLICATED
- Replicas:		5
-Placement:
-UpdateConfig:
- Parallelism:	0
- On failure:	pause
- Max failure ratio:	0
-ContainerSpec:
- Image:		nginx:alpine
-Resources:
-Networks:	net1
-Endpoint Mode:  vip
-Ports:
- PublishedPort = 4443
-  Protocol = tcp
-  TargetPort = 443
-  PublishMode = ingress
-```
-
-You can also use `--format pretty` for the same effect.
-
-
-#### Find the number of tasks running as part of a service
-
-The `--format` option can be used to obtain specific information about a
-service. For example, the following command outputs the number of replicas
-of the "redis" service.
-
-```bash
-$ docker service inspect --format='{{.Spec.Mode.Replicated.Replicas}}' redis
-
-10
-```
-
-
-## Related commands
-
-* [service create](service_create.md)
-* [service logs](service_logs.md)
-* [service ls](service_ls.md)
-* [service rm](service_rm.md)
-* [service scale](service_scale.md)
-* [service ps](service_ps.md)
-* [service update](service_update.md)
diff --git a/components/engine/docs/reference/commandline/service_logs.md b/components/engine/docs/reference/commandline/service_logs.md
deleted file mode 100644
index fd328d0f6d..0000000000
--- a/components/engine/docs/reference/commandline/service_logs.md
+++ /dev/null
@@ -1,85 +0,0 @@
----
-title: "service logs"
-description: "The service logs command description and usage"
-keywords: "service, task, logs"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# service logs
-
-```Markdown
-Usage:  docker service logs [OPTIONS] SERVICE|TASK
-
-Fetch the logs of a service or task
-
-Options:
-  -f, --follow         Follow log output
-      --help           Print usage
-      --no-resolve     Do not map IDs to Names in output
-      --no-task-ids    Do not include task IDs in output
-      --no-trunc        Do not truncate output
-      --since string   Show logs since timestamp
-      --tail string    Number of lines to show from the end of the logs (default "all")
-  -t, --timestamps     Show timestamps
-```
-
-## Description
-
-The `docker service logs` command batch-retrieves logs present at the time of execution.
-
-The `docker service logs` command can be used with either the name or ID of a
-service, or with the ID of a task. If a service is passed, it will display logs
-for all of the containers in that service. If a task is passed, it will only
-display logs from that particular task.
-
-> **Note**: This command is only functional for services that are started with
-> the `json-file` or `journald` logging driver.
-
-For more information about selecting and configuring logging drivers, refer to
-[Configure logging drivers](https://docs.docker.com/engine/admin/logging/overview/).
-
-The `docker service logs --follow` command will continue streaming the new output from
-the service's `STDOUT` and `STDERR`.
-
-Passing a negative number or a non-integer to `--tail` is invalid and the
-value is set to `all` in that case.
-
-The `docker service logs --timestamps` command will add an [RFC3339Nano timestamp](https://golang.org/pkg/time/#pkg-constants)
-, for example `2014-09-16T06:17:46.000000000Z`, to each
-log entry. To ensure that the timestamps are aligned the
-nano-second part of the timestamp will be padded with zero when necessary.
-
-The `docker service logs --details` command will add on extra attributes, such as
-environment variables and labels, provided to `--log-opt` when creating the
-service.
-
-The `--since` option shows only the service logs generated after
-a given date. You can specify the date as an RFC 3339 date, a UNIX
-timestamp, or a Go duration string (e.g. `1m30s`, `3h`). Besides RFC3339 date
-format you may also use RFC3339Nano, `2006-01-02T15:04:05`,
-`2006-01-02T15:04:05.999999999`, `2006-01-02Z07:00`, and `2006-01-02`. The local
-timezone on the client will be used if you do not provide either a `Z` or a
-`+-00:00` timezone offset at the end of the timestamp. When providing Unix
-timestamps enter seconds[.nanoseconds], where seconds is the number of seconds
-that have elapsed since January 1, 1970 (midnight UTC/GMT), not counting leap
-seconds (aka Unix epoch or Unix time), and the optional .nanoseconds field is a
-fraction of a second no more than nine digits long. You can combine the
-`--since` option with either or both of the `--follow` or `--tail` options.
-
-## Related commands
-
-* [service create](service_create.md)
-* [service inspect](service_inspect.md)
-* [service ls](service_ls.md)
-* [service rm](service_rm.md)
-* [service scale](service_scale.md)
-* [service ps](service_ps.md)
-* [service update](service_update.md)
diff --git a/components/engine/docs/reference/commandline/service_ls.md b/components/engine/docs/reference/commandline/service_ls.md
deleted file mode 100644
index c222c04857..0000000000
--- a/components/engine/docs/reference/commandline/service_ls.md
+++ /dev/null
@@ -1,164 +0,0 @@
----
-title: "service ls"
-description: "The service ls command description and usage"
-keywords: "service, ls"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# service ls
-
-```Markdown
-Usage:	docker service ls [OPTIONS]
-
-List services
-
-Aliases:
-  ls, list
-
-Options:
-  -f, --filter filter   Filter output based on conditions provided
-      --format string   Pretty-print services using a Go template
-      --help            Print usage
-  -q, --quiet           Only display IDs
-```
-
-## Description
-
-This command when run targeting a manager, lists services are running in the
-swarm.
-
-## Examples
-
-On a manager node:
-
-```bash
-$ docker service ls
-
-ID            NAME      MODE        REPLICAS    IMAGE
-c8wgl7q4ndfd  frontend  replicated  5/5         nginx:alpine
-dmu1ept4cxcf  redis     replicated  3/3         redis:3.0.6
-iwe3278osahj  mongo     global      7/7         mongo:3.3
-```
-
-The `REPLICAS` column shows both the *actual* and *desired* number of tasks for
-the service.
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is of "key=value". If there is more
-than one filter, then pass multiple flags (e.g., `--filter "foo=bar" --filter "bif=baz"`)
-
-The currently supported filters are:
-
-* [id](service_ls.md#id)
-* [label](service_ls.md#label)
-* [mode](service_ls.md#mode)
-* [name](service_ls.md#name)
-
-#### id
-
-The `id` filter matches all or part of a service's id.
-
-```bash
-$ docker service ls -f "id=0bcjw"
-ID            NAME   MODE        REPLICAS  IMAGE
-0bcjwfh8ychr  redis  replicated  1/1       redis:3.0.6
-```
-
-#### label
-
-The `label` filter matches services based on the presence of a `label` alone or
-a `label` and a value.
-
-The following filter matches all services with a `project` label regardless of
-its value:
-
-```bash
-$ docker service ls --filter label=project
-ID            NAME       MODE        REPLICAS  IMAGE
-01sl1rp6nj5u  frontend2  replicated  1/1       nginx:alpine
-36xvvwwauej0  frontend   replicated  5/5       nginx:alpine
-74nzcxxjv6fq  backend    replicated  3/3       redis:3.0.6
-```
-
-The following filter matches only services with the `project` label with the
-`project-a` value.
-
-```bash
-$ docker service ls --filter label=project=project-a
-ID            NAME      MODE        REPLICAS  IMAGE
-36xvvwwauej0  frontend  replicated  5/5       nginx:alpine
-74nzcxxjv6fq  backend   replicated  3/3       redis:3.0.6
-```
-
-#### mode
-
-The `mode` filter matches on the mode (either `replicated` or `global`) of a service.
-
-The following filter matches only `global` services.
-
-```bash
-$ docker service ls --filter mode=global
-ID                  NAME                MODE                REPLICAS            IMAGE
-w7y0v2yrn620        top                 global              1/1                 busybox
-```
-
-#### name
-
-The `name` filter matches on all or part of a service's name.
-
-The following filter matches services with a name containing `redis`.
-
-```bash
-$ docker service ls --filter name=redis
-ID            NAME   MODE        REPLICAS  IMAGE
-0bcjwfh8ychr  redis  replicated  1/1       redis:3.0.6
-```
-
-### Formatting
-
-The formatting options (`--format`) pretty-prints services output
-using a Go template.
-
-Valid placeholders for the Go template are listed below:
-
-Placeholder | Description
-------------|------------------------------------------------------------------------------------------
-`.ID`       | Service ID
-`.Name`     | Service name
-`.Mode`     | Service mode (replicated, global)
-`.Replicas` | Service replicas
-`.Image`    | Service image
-`.Ports`    | Service ports published in ingress mode
-
-When using the `--format` option, the `service ls` command will either
-output the data exactly as the template declares or, when using the
-`table` directive, includes column headers as well.
-
-The following example uses a template without headers and outputs the
-`ID`, `Mode`, and `Replicas` entries separated by a colon for all services:
-
-```bash
-$ docker service ls --format "{{.ID}}: {{.Mode}} {{.Replicas}}"
-
-0zmvwuiu3vue: replicated 10/10
-fm6uf97exkul: global 5/5
-```
-
-## Related commands
-
-* [service create](service_create.md)
-* [service inspect](service_inspect.md)
-* [service logs](service_logs.md)
-* [service rm](service_rm.md)
-* [service scale](service_scale.md)
-* [service ps](service_ps.md)
-* [service update](service_update.md)
diff --git a/components/engine/docs/reference/commandline/service_ps.md b/components/engine/docs/reference/commandline/service_ps.md
deleted file mode 100644
index 51e8604c7e..0000000000
--- a/components/engine/docs/reference/commandline/service_ps.md
+++ /dev/null
@@ -1,194 +0,0 @@
----
-title: "service ps"
-description: "The service ps command description and usage"
-keywords: "service, tasks, ps"
-aliases: ["/engine/reference/commandline/service_tasks/"]
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# service ps
-
-```Markdown
-Usage:  docker service ps [OPTIONS] SERVICE [SERVICE...]
-
-List the tasks of one or more services
-
-Options:
-  -f, --filter filter   Filter output based on conditions provided
-      --format string   Pretty-print tasks using a Go template
-      --help            Print usage
-      --no-resolve      Do not map IDs to Names
-      --no-trunc        Do not truncate output
-  -q, --quiet           Only display task IDs
-```
-
-## Description
-
-Lists the tasks that are running as part of the specified services. This command
-has to be run targeting a manager node.
-
-## Examples
-
-### List the tasks that are part of a service
-
-The following command shows all the tasks that are part of the `redis` service:
-
-```bash
-$ docker service ps redis
-
-ID             NAME      IMAGE        NODE      DESIRED STATE  CURRENT STATE          ERROR  PORTS
-0qihejybwf1x   redis.1   redis:3.0.5  manager1  Running        Running 8 seconds
-bk658fpbex0d   redis.2   redis:3.0.5  worker2   Running        Running 9 seconds
-5ls5s5fldaqg   redis.3   redis:3.0.5  worker1   Running        Running 9 seconds
-8ryt076polmc   redis.4   redis:3.0.5  worker1   Running        Running 9 seconds
-1x0v8yomsncd   redis.5   redis:3.0.5  manager1  Running        Running 8 seconds
-71v7je3el7rr   redis.6   redis:3.0.5  worker2   Running        Running 9 seconds
-4l3zm9b7tfr7   redis.7   redis:3.0.5  worker2   Running        Running 9 seconds
-9tfpyixiy2i7   redis.8   redis:3.0.5  worker1   Running        Running 9 seconds
-3w1wu13yupln   redis.9   redis:3.0.5  manager1  Running        Running 8 seconds
-8eaxrb2fqpbn   redis.10  redis:3.0.5  manager1  Running        Running 8 seconds
-```
-
-In addition to _running_ tasks, the output also shows the task history. For
-example, after updating the service to use the `redis:3.0.6` image, the output
-may look like this:
-
-```bash
-$ docker service ps redis
-
-ID            NAME         IMAGE        NODE      DESIRED STATE  CURRENT STATE                   ERROR  PORTS
-50qe8lfnxaxk  redis.1      redis:3.0.6  manager1  Running        Running 6 seconds ago
-ky2re9oz86r9   \_ redis.1  redis:3.0.5  manager1  Shutdown       Shutdown 8 seconds ago
-3s46te2nzl4i  redis.2      redis:3.0.6  worker2   Running        Running less than a second ago
-nvjljf7rmor4   \_ redis.2  redis:3.0.6  worker2   Shutdown       Rejected 23 seconds ago        "No such image: redis@sha256:6…"
-vtiuz2fpc0yb   \_ redis.2  redis:3.0.5  worker2   Shutdown       Shutdown 1 second ago
-jnarweeha8x4  redis.3      redis:3.0.6  worker1   Running        Running 3 seconds ago
-vs448yca2nz4   \_ redis.3  redis:3.0.5  worker1   Shutdown       Shutdown 4 seconds ago
-jf1i992619ir  redis.4      redis:3.0.6  worker1   Running        Running 10 seconds ago
-blkttv7zs8ee   \_ redis.4  redis:3.0.5  worker1   Shutdown       Shutdown 11 seconds ago
-```
-
-The number of items in the task history is determined by the
-`--task-history-limit` option that was set when initializing the swarm. You can
-change the task history retention limit using the
-[`docker swarm update`](swarm_update.md) command.
-
-When deploying a service, docker resolves the digest for the service's
-image, and pins the service to that digest. The digest is not shown by
-default, but is printed if `--no-trunc` is used. The `--no-trunc` option
-also shows the non-truncated task ID, and error-messages, as can be seen below;
-
-```bash
-$ docker service ps --no-trunc redis
-
-ID                          NAME         IMAGE                                                                                NODE      DESIRED STATE  CURRENT STATE            ERROR                                                                                           PORTS
-50qe8lfnxaxksi9w2a704wkp7   redis.1      redis:3.0.6@sha256:6a692a76c2081888b589e26e6ec835743119fe453d67ecf03df7de5b73d69842  manager1  Running        Running 5 minutes ago
-ky2re9oz86r9556i2szb8a8af   \_ redis.1   redis:3.0.5@sha256:f8829e00d95672c48c60f468329d6693c4bdd28d1f057e755f8ba8b40008682e  worker2   Shutdown       Shutdown 5 minutes ago
-bk658fpbex0d57cqcwoe3jthu   redis.2      redis:3.0.6@sha256:6a692a76c2081888b589e26e6ec835743119fe453d67ecf03df7de5b73d69842  worker2   Running        Running 5 seconds
-nvjljf7rmor4htv7l8rwcx7i7   \_ redis.2   redis:3.0.6@sha256:6a692a76c2081888b589e26e6ec835743119fe453d67ecf03df7de5b73d69842  worker2   Shutdown       Rejected 5 minutes ago   "No such image: redis@sha256:6a692a76c2081888b589e26e6ec835743119fe453d67ecf03df7de5b73d69842"
-```
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is a `key=value` pair. If there
-is more than one filter, then pass multiple flags (e.g. `--filter "foo=bar" --filter "bif=baz"`).
-Multiple filter flags are combined as an `OR` filter. For example,
-`-f name=redis.1 -f name=redis.7` returns both `redis.1` and `redis.7` tasks.
-
-The currently supported filters are:
-
-* [id](#id)
-* [name](#name)
-* [node](#node)
-* [desired-state](#desired-state)
-
-
-#### id
-
-The `id` filter matches on all or a prefix of a task's ID.
-
-```bash
-$ docker service ps -f "id=8" redis
-
-ID             NAME      IMAGE        NODE      DESIRED STATE  CURRENT STATE      ERROR  PORTS
-8ryt076polmc   redis.4   redis:3.0.6  worker1   Running        Running 9 seconds
-8eaxrb2fqpbn   redis.10  redis:3.0.6  manager1  Running        Running 8 seconds
-```
-
-#### name
-
-The `name` filter matches on task names.
-
-```bash
-$ docker service ps -f "name=redis.1" redis
-ID            NAME     IMAGE        NODE      DESIRED STATE  CURRENT STATE      ERROR  PORTS
-qihejybwf1x5  redis.1  redis:3.0.6  manager1  Running        Running 8 seconds
-```
-
-
-#### node
-
-The `node` filter matches on a node name or a node ID.
-
-```bash
-$ docker service ps -f "node=manager1" redis
-ID            NAME      IMAGE        NODE      DESIRED STATE  CURRENT STATE      ERROR  PORTS
-0qihejybwf1x  redis.1   redis:3.0.6  manager1  Running        Running 8 seconds
-1x0v8yomsncd  redis.5   redis:3.0.6  manager1  Running        Running 8 seconds
-3w1wu13yupln  redis.9   redis:3.0.6  manager1  Running        Running 8 seconds
-8eaxrb2fqpbn  redis.10  redis:3.0.6  manager1  Running        Running 8 seconds
-```
-
-#### desired-state
-
-The `desired-state` filter can take the values `running`, `shutdown`, or `accepted`.
-
-### Formatting
-
-The formatting options (`--format`) pretty-prints tasks output
-using a Go template.
-
-Valid placeholders for the Go template are listed below:
-
-Placeholder     | Description
-----------------|------------------------------------------------------------------------------------------
-`.ID`           | Task ID
-`.Name`         | Task name
-`.Image`        | Task image
-`.Node`         | Node ID
-`.DesiredState` | Desired state of the task (`running`, `shutdown`, or `accepted`)
-`.CurrentState` | Current state of the task
-`.Error`        | Error
-`.Ports`        | Task published ports
-
-When using the `--format` option, the `service ps` command will either
-output the data exactly as the template declares or, when using the
-`table` directive, includes column headers as well.
-
-The following example uses a template without headers and outputs the
-`Name` and `Image` entries separated by a colon for all tasks:
-
-```bash
-$ docker service ps --format "{{.Name}}: {{.Image}}" top
-top.1: busybox
-top.2: busybox
-top.3: busybox
-```
-
-## Related commands
-
-* [service create](service_create.md)
-* [service inspect](service_inspect.md)
-* [service logs](service_logs.md)
-* [service ls](service_ls.md)
-* [service rm](service_rm.md)
-* [service scale](service_scale.md)
-* [service update](service_update.md)
diff --git a/components/engine/docs/reference/commandline/service_rm.md b/components/engine/docs/reference/commandline/service_rm.md
deleted file mode 100644
index 448f2c3b24..0000000000
--- a/components/engine/docs/reference/commandline/service_rm.md
+++ /dev/null
@@ -1,60 +0,0 @@
----
-title: "service rm"
-description: "The service rm command description and usage"
-keywords: "service, rm"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# service rm
-
-```Markdown
-Usage:	docker service rm SERVICE [SERVICE...]
-
-Remove one or more services
-
-Aliases:
-  rm, remove
-
-Options:
-      --help   Print usage
-```
-
-## Description
-
-Removes the specified services from the swarm. This command has to be run
-targeting a manager node.
-
-## Examples
-
-Remove the `redis` service:
-
-```bash
-$ docker service rm redis
-
-redis
-
-$ docker service ls
-
-ID  NAME  MODE  REPLICAS  IMAGE
-```
-
-> **Warning**: Unlike `docker rm`, this command does not ask for confirmation
-> before removing a running service.
-
-## Related commands
-
-* [service create](service_create.md)
-* [service inspect](service_inspect.md)
-* [service logs](service_logs.md)
-* [service ls](service_ls.md)
-* [service scale](service_scale.md)
-* [service ps](service_ps.md)
-* [service update](service_update.md)
diff --git a/components/engine/docs/reference/commandline/service_scale.md b/components/engine/docs/reference/commandline/service_scale.md
deleted file mode 100644
index a3aef5fd34..0000000000
--- a/components/engine/docs/reference/commandline/service_scale.md
+++ /dev/null
@@ -1,104 +0,0 @@
----
-title: "service scale"
-description: "The service scale command description and usage"
-keywords: "service, scale"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# service scale
-
-```markdown
-Usage:  docker service scale SERVICE=REPLICAS [SERVICE=REPLICAS...]
-
-Scale one or multiple replicated services
-
-Options:
-      --help   Print usage
-```
-
-## Description
-
-The scale command enables you to scale one or more replicated services either up
-or down to the desired number of replicas. This command cannot be applied on
-services which are global mode. The command will return immediately, but the
-actual scaling of the service may take some time. To stop all replicas of a
-service while keeping the service active in the swarm you can set the scale to 0.
-
-## Examples
-
-### Scale a single service
-
-The following command scales the "frontend" service to 50 tasks.
-
-```bash
-$ docker service scale frontend=50
-
-frontend scaled to 50
-```
-
-The following command tries to scale a global service to 10 tasks and returns an error.
-
-```bash
-$ docker service create --mode global --name backend backend:latest
-
-b4g08uwuairexjub6ome6usqh
-
-$ docker service scale backend=10
-
-backend: scale can only be used with replicated mode
-```
-
-Directly afterwards, run `docker service ls`, to see the actual number of
-replicas.
-
-```bash
-$ docker service ls --filter name=frontend
-
-ID            NAME      MODE        REPLICAS  IMAGE
-3pr5mlvu3fh9  frontend  replicated  15/50     nginx:alpine
-```
-
-You can also scale a service using the [`docker service update`](service_update.md)
-command. The following commands are equivalent:
-
-```bash
-$ docker service scale frontend=50
-$ docker service update --replicas=50 frontend
-```
-
-### Scale multiple services
-
-The `docker service scale` command allows you to set the desired number of
-tasks for multiple services at once. The following example scales both the
-backend and frontend services:
-
-```bash
-$ docker service scale backend=3 frontend=5
-
-backend scaled to 3
-frontend scaled to 5
-
-$ docker service ls
-
-ID            NAME      MODE        REPLICAS  IMAGE
-3pr5mlvu3fh9  frontend  replicated  5/5       nginx:alpine
-74nzcxxjv6fq  backend   replicated  3/3       redis:3.0.6
-```
-
-## Related commands
-
-* [service create](service_create.md)
-* [service inspect](service_inspect.md)
-* [service logs](service_logs.md)
-* [service ls](service_ls.md)
-* [service rm](service_rm.md)
-* [service ps](service_ps.md)
-* [service update](service_update.md)
diff --git a/components/engine/docs/reference/commandline/service_update.md b/components/engine/docs/reference/commandline/service_update.md
deleted file mode 100644
index 93c5750eee..0000000000
--- a/components/engine/docs/reference/commandline/service_update.md
+++ /dev/null
@@ -1,265 +0,0 @@
----
-title: "service update"
-description: "The service update command description and usage"
-keywords: "service, update"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# service update
-
-```Markdown
-Usage:  docker service update [OPTIONS] SERVICE
-
-Update a service
-
-Options:
-      --args command                       Service command args
-      --constraint-add list                Add or update a placement constraint
-      --constraint-rm list                 Remove a constraint
-      --container-label-add list           Add or update a container label
-      --container-label-rm list            Remove a container label by its key
-  -d, --detach                             Exit immediately instead of waiting for the service to converge (default true)
-      --dns-add list                       Add or update a custom DNS server
-      --dns-option-add list                Add or update a DNS option
-      --dns-option-rm list                 Remove a DNS option
-      --dns-rm list                        Remove a custom DNS server
-      --dns-search-add list                Add or update a custom DNS search domain
-      --dns-search-rm list                 Remove a DNS search domain
-      --endpoint-mode string               Endpoint mode (vip or dnsrr)
-      --entrypoint command                 Overwrite the default ENTRYPOINT of the image
-      --env-add list                       Add or update an environment variable
-      --env-rm list                        Remove an environment variable
-      --force                              Force update even if no changes require it
-      --group-add list                     Add an additional supplementary user group to the container
-      --group-rm list                      Remove a previously added supplementary user group from the container
-      --health-cmd string                  Command to run to check health
-      --health-interval duration           Time between running the check (ms|s|m|h)
-      --health-retries int                 Consecutive failures needed to report unhealthy
-      --health-start-period duration       Start period for the container to initialize before counting retries towards unstable (ms|s|m|h)
-      --health-timeout duration            Maximum time to allow one check to run (ms|s|m|h)
-      --help                               Print usage
-      --host-add list                      Add or update a custom host-to-IP mapping (host:ip)
-      --host-rm list                       Remove a custom host-to-IP mapping (host:ip)
-      --hostname string                    Container hostname
-      --image string                       Service image tag
-      --label-add list                     Add or update a service label
-      --label-rm list                      Remove a label by its key
-      --limit-cpu decimal                  Limit CPUs
-      --limit-memory bytes                 Limit Memory
-      --log-driver string                  Logging driver for service
-      --log-opt list                       Logging driver options
-      --mount-add mount                    Add or update a mount on a service
-      --mount-rm list                      Remove a mount by its target path
-      --network-add list                   Add a network
-      --network-rm list                    Remove a network
-      --no-healthcheck                     Disable any container-specified HEALTHCHECK
-      --placement-pref-add pref            Add a placement preference
-      --placement-pref-rm pref             Remove a placement preference
-      --publish-add port                   Add or update a published port
-      --publish-rm port                    Remove a published port by its target port
-  -q, --quiet                              Suppress progress output
-      --read-only                          Mount the container's root filesystem as read only
-      --replicas uint                      Number of tasks
-      --reserve-cpu decimal                Reserve CPUs
-      --reserve-memory bytes               Reserve Memory
-      --restart-condition string           Restart when condition is met ("none"|"on-failure"|"any")
-      --restart-delay duration             Delay between restart attempts (ns|us|ms|s|m|h)
-      --restart-max-attempts uint          Maximum number of restarts before giving up
-      --restart-window duration            Window used to evaluate the restart policy (ns|us|ms|s|m|h)
-      --rollback                           Rollback to previous specification
-      --rollback-delay duration            Delay between task rollbacks (ns|us|ms|s|m|h)
-      --rollback-failure-action string     Action on rollback failure ("pause"|"continue")
-      --rollback-max-failure-ratio float   Failure rate to tolerate during a rollback
-      --rollback-monitor duration          Duration after each task rollback to monitor for failure (ns|us|ms|s|m|h)
-      --rollback-order string              Rollback order ("start-first"|"stop-first") (default "stop-first")
-      --rollback-parallelism uint          Maximum number of tasks rolled back simultaneously (0 to roll back all at once)
-      --secret-add secret                  Add or update a secret on a service
-      --secret-rm list                     Remove a secret
-      --stop-grace-period duration         Time to wait before force killing a container (ns|us|ms|s|m|h)
-      --stop-signal string                 Signal to stop the container
-  -t, --tty                                Allocate a pseudo-TTY
-      --update-delay duration              Delay between updates (ns|us|ms|s|m|h)
-      --update-failure-action string       Action on update failure ("pause"|"continue"|"rollback")
-      --update-max-failure-ratio float     Failure rate to tolerate during an update
-      --update-monitor duration            Duration after each task update to monitor for failure (ns|us|ms|s|m|h)
-      --update-order string                Update order ("start-first"|"stop-first")
-      --update-parallelism uint            Maximum number of tasks updated simultaneously (0 to update all at once)
-  -u, --user string                        Username or UID (format: <name|uid>[:<group|gid>])
-      --with-registry-auth                 Send registry authentication details to swarm agents
-  -w, --workdir string                     Working directory inside the container
-```
-
-## Description
-
-Updates a service as described by the specified parameters. This command has to be run targeting a manager node.
-The parameters are the same as [`docker service create`](service_create.md). Please look at the description there
-for further information.
-
-Normally, updating a service will only cause the service's tasks to be replaced with new ones if a change to the
-service requires recreating the tasks for it to take effect. For example, only changing the
-`--update-parallelism` setting will not recreate the tasks, because the individual tasks are not affected by this
-setting. However, the `--force` flag will cause the tasks to be recreated anyway. This can be used to perform a
-rolling restart without any changes to the service parameters.
-
-## Examples
-
-### Update a service
-
-```bash
-$ docker service update --limit-cpu 2 redis
-```
-
-### Perform a rolling restart with no parameter changes
-
-```bash
-$ docker service update --force --update-parallelism 1 --update-delay 30s redis
-```
-
-In this example, the `--force` flag causes the service's tasks to be shut down
-and replaced with new ones even though none of the other parameters would
-normally cause that to happen. The `--update-parallelism 1` setting ensures
-that only one task is replaced at a time (this is the default behavior). The
-`--update-delay 30s` setting introduces a 30 second delay between tasks, so
-that the rolling restart happens gradually.
-
-### Add or remove mounts
-
-Use the `--mount-add` or `--mount-rm` options add or remove a service's bind-mounts
-or volumes.
-
-The following example creates a service which mounts the `test-data` volume to
-`/somewhere`. The next step updates the service to also mount the `other-volume`
-volume to `/somewhere-else`volume, The last step unmounts the `/somewhere` mount
-point, effectively removing the `test-data` volume. Each command returns the
-service name.
-
-- The `--mount-add` flag takes the same parameters as the `--mount` flag on
-  `service create`. Refer to the [volumes and
-  bind-mounts](service_create.md#volumes-and-bind-mounts-mount) section in the
-  `service create` reference for details.
-
-- The `--mount-rm` flag takes the `target` path of the mount.
-
-```bash
-$ docker service create \
-    --name=myservice \
-    --mount \
-      type=volume,source=test-data,target=/somewhere \
-    nginx:alpine \
-    myservice
-
-myservice
-
-$ docker service update \
-    --mount-add \
-      type=volume,source=other-volume,target=/somewhere-else \
-    myservice
-
-myservice
-
-$ docker service update --mount-rm /somewhere myservice
-
-myservice
-```
-
-### Rolling back to the previous version of a service 
-
-Use the `--rollback` option to roll back to the previous version of the service. 
-
-This will revert the service to the configuration that was in place before the most recent `docker service update` command.
-
-The following example updates the number of replicas for the service from 4 to 5, and then rolls back to the previous configuration.
-
-```bash
-$ docker service update --replicas=5 web
-
-web
-
-$ docker service ls
-
-ID            NAME  MODE        REPLICAS  IMAGE
-80bvrzp6vxf3  web   replicated  0/5       nginx:alpine
-
-```
-Roll back the `web` service... 
-
-```bash
-$ docker service update --rollback web
-
-web
-
-$ docker service ls
-
-ID            NAME  MODE        REPLICAS  IMAGE
-80bvrzp6vxf3  web   replicated  0/4       nginx:alpine
-
-```
-
-Other options can be combined with `--rollback` as well, for example, `--update-delay 0s` to execute the rollback without a delay between tasks:
-
-```bash
-$ docker service update \
-  --rollback \
-  --update-delay 0s
-  web
-
-web
-
-```
-
-Services can also be set up to roll back to the previous version automatically
-when an update fails. To set up a service for automatic rollback, use
-`--update-failure-action=rollback`. A rollback will be triggered if the fraction
-of the tasks which failed to update successfully exceeds the value given with
-`--update-max-failure-ratio`.
-
-The rate, parallelism, and other parameters of a rollback operation are
-determined by the values passed with the following flags:
-
-- `--rollback-delay`
-- `--rollback-failure-action`
-- `--rollback-max-failure-ratio`
-- `--rollback-monitor`
-- `--rollback-parallelism`
-
-For example, a service set up with `--update-parallelism 1 --rollback-parallelism 3`
-will update one task at a time during a normal update, but during a rollback, 3
-tasks at a time will get rolled back. These rollback parameters are respected both
-during automatic rollbacks and for rollbacks initiated manually using `--rollback`.
-
-### Add or remove secrets
-
-Use the `--secret-add` or `--secret-rm` options add or remove a service's
-secrets.
-
-The following example adds a secret named `ssh-2` and removes `ssh-1`:
-
-```bash
-$ docker service update \
-    --secret-add source=ssh-2,target=ssh-2 \
-    --secret-rm ssh-1 \
-    myservice
-```
-
-### Update services using templates
-
-Some flags of `service update` support the use of templating.
-See [`service create`](./service_create.md#templating) for the reference.
-
-## Related commands
-
-* [service create](service_create.md)
-* [service inspect](service_inspect.md)
-* [service logs](service_logs.md)
-* [service ls](service_ls.md)
-* [service ps](service_ps.md)
-* [service rm](service_rm.md)
-* [service scale](service_scale.md)
diff --git a/components/engine/docs/reference/commandline/stack.md b/components/engine/docs/reference/commandline/stack.md
deleted file mode 100644
index 94e3e252f9..0000000000
--- a/components/engine/docs/reference/commandline/stack.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
-title: "stack"
-description: "The stack command description and usage"
-keywords: "stack"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# stack
-
-```markdown
-Usage:  docker stack COMMAND
-
-Manage Docker stacks
-
-Options:
-      --help   Print usage
-
-Commands:
-  deploy      Deploy a new stack or update an existing stack
-  ls          List stacks
-  ps          List the tasks in the stack
-  rm          Remove the stack
-  services    List the services in the stack
-
-Run 'docker stack COMMAND --help' for more information on a command.
-```
-
-## Description
-
-Manage stacks.
-
diff --git a/components/engine/docs/reference/commandline/stack_deploy.md b/components/engine/docs/reference/commandline/stack_deploy.md
deleted file mode 100644
index d57ef0f76c..0000000000
--- a/components/engine/docs/reference/commandline/stack_deploy.md
+++ /dev/null
@@ -1,107 +0,0 @@
----
-title: "stack deploy"
-description: "The stack deploy command description and usage"
-keywords: "stack, deploy, up"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# stack deploy
-
-```markdown
-Usage:  docker stack deploy [OPTIONS] STACK
-
-Deploy a new stack or update an existing stack
-
-Aliases:
-  deploy, up
-
-Options:
-      --bundle-file string    Path to a Distributed Application Bundle file
-  -c, --compose-file string   Path to a Compose file
-      --help                  Print usage
-      --prune                 Prune services that are no longer referenced
-      --with-registry-auth    Send registry authentication details to Swarm agents
-```
-
-## Description
-
-Create and update a stack from a `compose` or a `dab` file on the swarm. This command
-has to be run targeting a manager node.
-
-## Examples
-
-### Compose file
-
-The `deploy` command supports compose file version `3.0` and above."
-
-```bash
-$ docker stack deploy --compose-file docker-compose.yml vossibility
-
-Ignoring unsupported options: links
-
-Creating network vossibility_vossibility
-Creating network vossibility_default
-Creating service vossibility_nsqd
-Creating service vossibility_logstash
-Creating service vossibility_elasticsearch
-Creating service vossibility_kibana
-Creating service vossibility_ghollector
-Creating service vossibility_lookupd
-```
-
-You can verify that the services were correctly created
-
-```bash
-$ docker service ls
-
-ID            NAME                               MODE        REPLICAS  IMAGE
-29bv0vnlm903  vossibility_lookupd                replicated  1/1       nsqio/nsq@sha256:eeba05599f31eba418e96e71e0984c3dc96963ceb66924dd37a47bf7ce18a662
-4awt47624qwh  vossibility_nsqd                   replicated  1/1       nsqio/nsq@sha256:eeba05599f31eba418e96e71e0984c3dc96963ceb66924dd37a47bf7ce18a662
-4tjx9biia6fs  vossibility_elasticsearch          replicated  1/1       elasticsearch@sha256:12ac7c6af55d001f71800b83ba91a04f716e58d82e748fa6e5a7359eed2301aa
-7563uuzr9eys  vossibility_kibana                 replicated  1/1       kibana@sha256:6995a2d25709a62694a937b8a529ff36da92ebee74bafd7bf00e6caf6db2eb03
-9gc5m4met4he  vossibility_logstash               replicated  1/1       logstash@sha256:2dc8bddd1bb4a5a34e8ebaf73749f6413c101b2edef6617f2f7713926d2141fe
-axqh55ipl40h  vossibility_vossibility-collector  replicated  1/1       icecrime/vossibility-collector@sha256:f03f2977203ba6253988c18d04061c5ec7aab46bca9dfd89a9a1fa4500989fba
-```
-
-### DAB file
-
-```bash
-$ docker stack deploy --bundle-file vossibility-stack.dab vossibility
-
-Loading bundle from vossibility-stack.dab
-Creating service vossibility_elasticsearch
-Creating service vossibility_kibana
-Creating service vossibility_logstash
-Creating service vossibility_lookupd
-Creating service vossibility_nsqd
-Creating service vossibility_vossibility-collector
-```
-
-You can verify that the services were correctly created:
-
-```bash
-$ docker service ls
-
-ID            NAME                               MODE        REPLICAS  IMAGE
-29bv0vnlm903  vossibility_lookupd                replicated  1/1       nsqio/nsq@sha256:eeba05599f31eba418e96e71e0984c3dc96963ceb66924dd37a47bf7ce18a662
-4awt47624qwh  vossibility_nsqd                   replicated  1/1       nsqio/nsq@sha256:eeba05599f31eba418e96e71e0984c3dc96963ceb66924dd37a47bf7ce18a662
-4tjx9biia6fs  vossibility_elasticsearch          replicated  1/1       elasticsearch@sha256:12ac7c6af55d001f71800b83ba91a04f716e58d82e748fa6e5a7359eed2301aa
-7563uuzr9eys  vossibility_kibana                 replicated  1/1       kibana@sha256:6995a2d25709a62694a937b8a529ff36da92ebee74bafd7bf00e6caf6db2eb03
-9gc5m4met4he  vossibility_logstash               replicated  1/1       logstash@sha256:2dc8bddd1bb4a5a34e8ebaf73749f6413c101b2edef6617f2f7713926d2141fe
-axqh55ipl40h  vossibility_vossibility-collector  replicated  1/1       icecrime/vossibility-collector@sha256:f03f2977203ba6253988c18d04061c5ec7aab46bca9dfd89a9a1fa4500989fba
-```
-
-## Related commands
-
-* [stack ls](stack_ls.md)
-* [stack ps](stack_ps.md)
-* [stack rm](stack_rm.md)
-* [stack services](stack_services.md)
diff --git a/components/engine/docs/reference/commandline/stack_ls.md b/components/engine/docs/reference/commandline/stack_ls.md
deleted file mode 100644
index 91349b6947..0000000000
--- a/components/engine/docs/reference/commandline/stack_ls.md
+++ /dev/null
@@ -1,76 +0,0 @@
----
-title: "stack ls"
-description: "The stack ls command description and usage"
-keywords: "stack, ls"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# stack ls
-
-```markdown
-Usage:	docker stack ls
-
-List stacks
-
-Aliases:
-  ls, list
-
-Options:
-      --help            Print usage
-      --format string   Pretty-print stacks using a Go template
-```
-
-## Description
-
-Lists the stacks.
-
-## Examples
-
-The following command shows all stacks and some additional information:
-
-```bash
-$ docker stack ls
-
-ID                 SERVICES
-vossibility-stack  6
-myapp              2
-```
-
-### Formatting
-
-The formatting option (`--format`) pretty-prints stacks using a Go template.
-
-Valid placeholders for the Go template are listed below:
-
-| Placeholder | Description        |
-| ----------- | ------------------ |
-| `.Name`     | Stack name         |
-| `.Services` | Number of services |
-
-When using the `--format` option, the `stack ls` command either outputs
-the data exactly as the template declares or, when using the
-`table` directive, includes column headers as well.
-
-The following example uses a template without headers and outputs the
-`Name` and `Services` entries separated by a colon for all stacks:
-
-```bash
-$ docker stack ls --format "{{.Name}}: {{.Services}}"
-web-server: 1
-web-cache: 4
-```
-
-## Related commands
-
-* [stack deploy](stack_deploy.md)
-* [stack ps](stack_ps.md)
-* [stack rm](stack_rm.md)
-* [stack services](stack_services.md)
diff --git a/components/engine/docs/reference/commandline/stack_ps.md b/components/engine/docs/reference/commandline/stack_ps.md
deleted file mode 100644
index 901b46b22d..0000000000
--- a/components/engine/docs/reference/commandline/stack_ps.md
+++ /dev/null
@@ -1,230 +0,0 @@
----
-title: "stack ps"
-description: "The stack ps command description and usage"
-keywords: "stack, ps"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# stack ps
-
-```markdown
-Usage:  docker stack ps [OPTIONS] STACK
-
-List the tasks in the stack
-
-Options:
-  -f, --filter filter   Filter output based on conditions provided
-      --format string   Pretty-print tasks using a Go template
-      --help            Print usage
-      --no-resolve      Do not map IDs to Names
-      --no-trunc        Do not truncate output
-  -q, --quiet           Only display task IDs
-```
-
-## Description
-
-Lists the tasks that are running as part of the specified stack. This
-command has to be run targeting a manager node.
-
-## Examples
-
-### List the tasks that are part of a stack
-
-The following command shows all the tasks that are part of the `voting` stack:
-
-```bash
-$ docker stack ps voting
-ID                  NAME                  IMAGE                                          NODE   DESIRED STATE  CURRENT STATE          ERROR  PORTS
-xim5bcqtgk1b        voting_worker.1       dockersamples/examplevotingapp_worker:latest   node2  Running        Running 2 minutes ago
-q7yik0ks1in6        voting_result.1       dockersamples/examplevotingapp_result:before   node1  Running        Running 2 minutes ago
-rx5yo0866nfx        voting_vote.1         dockersamples/examplevotingapp_vote:before     node3  Running        Running 2 minutes ago
-tz6j82jnwrx7        voting_db.1           postgres:9.4                                   node1  Running        Running 2 minutes ago
-w48spazhbmxc        voting_redis.1        redis:alpine                                   node2  Running        Running 3 minutes ago
-6jj1m02freg1        voting_visualizer.1   dockersamples/visualizer:stable                node1  Running        Running 2 minutes ago
-kqgdmededccb        voting_vote.2         dockersamples/examplevotingapp_vote:before     node2  Running        Running 2 minutes ago
-t72q3z038jeh        voting_redis.2        redis:alpine                                   node3  Running        Running 3 minutes ago
-```
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is a `key=value` pair. If there
-is more than one filter, then pass multiple flags (e.g. `--filter "foo=bar" --filter "bif=baz"`).
-Multiple filter flags are combined as an `OR` filter. For example,
-`-f name=redis.1 -f name=redis.7` returns both `redis.1` and `redis.7` tasks.
-
-The currently supported filters are:
-
-* [id](#id)
-* [name](#name)
-* [node](#node)
-* [desired-state](#desired-state)
-
-#### id
-
-The `id` filter matches on all or a prefix of a task's ID.
-
-```bash
-$ docker stack ps -f "id=t" voting
-ID                  NAME                IMAGE               NODE         DESIRED STATE       CURRENTSTATE            ERROR  PORTS
-tz6j82jnwrx7        voting_db.1         postgres:9.4        node1        Running             Running 14 minutes ago
-t72q3z038jeh        voting_redis.2      redis:alpine        node3        Running             Running 14 minutes ago
-```
-
-#### name
-
-The `name` filter matches on task names.
-
-```bash
-$ docker stack ps -f "name=voting_redis" voting
-ID                  NAME                IMAGE               NODE         DESIRED STATE       CURRENTSTATE            ERROR  PORTS
-w48spazhbmxc        voting_redis.1      redis:alpine        node2        Running             Running 17 minutes ago
-t72q3z038jeh        voting_redis.2      redis:alpine        node3        Running             Running 17 minutes ago
-```
-
-#### node
-
-The `node` filter matches on a node name or a node ID.
-
-```bash
-$ docker stack ps -f "node=node1" voting
-ID                  NAME                  IMAGE                                          NODE   DESIRED STATE  CURRENT STATE          ERROR  PORTS
-q7yik0ks1in6        voting_result.1       dockersamples/examplevotingapp_result:before   node1  Running        Running 18 minutes ago
-tz6j82jnwrx7        voting_db.1           postgres:9.4                                   node1  Running        Running 18 minutes ago
-6jj1m02freg1        voting_visualizer.1   dockersamples/visualizer:stable                node1  Running        Running 18 minutes ago
-```
-
-#### desired-state
-
-The `desired-state` filter can take the values `running`, `shutdown`, or `accepted`.
-
-```bash
-$ docker stack ps -f "desired-state=running" voting
-ID                  NAME                  IMAGE                                          NODE   DESIRED STATE  CURRENT STATE           ERROR  PORTS
-xim5bcqtgk1b        voting_worker.1       dockersamples/examplevotingapp_worker:latest   node2  Running        Running 21 minutes ago
-q7yik0ks1in6        voting_result.1       dockersamples/examplevotingapp_result:before   node1  Running        Running 21 minutes ago
-rx5yo0866nfx        voting_vote.1         dockersamples/examplevotingapp_vote:before     node3  Running        Running 21 minutes ago
-tz6j82jnwrx7        voting_db.1           postgres:9.4                                   node1  Running        Running 21 minutes ago
-w48spazhbmxc        voting_redis.1        redis:alpine                                   node2  Running        Running 21 minutes ago
-6jj1m02freg1        voting_visualizer.1   dockersamples/visualizer:stable                node1  Running        Running 21 minutes ago
-kqgdmededccb        voting_vote.2         dockersamples/examplevotingapp_vote:before     node2  Running        Running 21 minutes ago
-t72q3z038jeh        voting_redis.2        redis:alpine                                   node3  Running        Running 21 minutes ago
-```
-
-### Formatting
-
-The formatting options (`--format`) pretty-prints tasks output using a Go template.
-
-Valid placeholders for the Go template are listed below:
-
-Placeholder     | Description
-----------------|------------------------------------------------------------------------------------------
-`.ID`           | Task ID
-`.Name`         | Task name
-`.Image`        | Task image
-`.Node`         | Node ID
-`.DesiredState` | Desired state of the task (`running`, `shutdown`, or `accepted`)
-`.CurrentState` | Current state of the task
-`.Error`        | Error
-`.Ports`        | Task published ports
-
-When using the `--format` option, the `stack ps` command will either
-output the data exactly as the template declares or, when using the
-`table` directive, includes column headers as well.
-
-The following example uses a template without headers and outputs the
-`Name` and `Image` entries separated by a colon for all tasks:
-
-```bash
-$ docker stack ps --format "{{.Name}}: {{.Image}}" voting
-voting_worker.1: dockersamples/examplevotingapp_worker:latest
-voting_result.1: dockersamples/examplevotingapp_result:before
-voting_vote.1: dockersamples/examplevotingapp_vote:before
-voting_db.1: postgres:9.4
-voting_redis.1: redis:alpine
-voting_visualizer.1: dockersamples/visualizer:stable
-voting_vote.2: dockersamples/examplevotingapp_vote:before
-voting_redis.2: redis:alpine
-```
-
-### Do not map IDs to Names
-
-The `--no-resolve` option shows IDs for task name, without mapping IDs to Names.
-
-```bash
-$ docker stack ps --no-resolve voting
-ID                  NAME                          IMAGE                                          NODE                        DESIRED STATE  CURRENT STATE            ERROR  PORTS
-xim5bcqtgk1b        10z9fjfqzsxnezo4hb81p8mqg.1   dockersamples/examplevotingapp_worker:latest   qaqt4nrzo775jrx6detglho01   Running        Running 30 minutes ago
-q7yik0ks1in6        hbxltua1na7mgqjnidldv5m65.1   dockersamples/examplevotingapp_result:before   mxpaef1tlh23s052erw88a4w5   Running        Running 30 minutes ago
-rx5yo0866nfx        qyprtqw1g5nrki557i974ou1d.1   dockersamples/examplevotingapp_vote:before     kanqcxfajd1r16wlnqcblobmm   Running        Running 31 minutes ago
-tz6j82jnwrx7        122f0xxngg17z52be7xspa72x.1   postgres:9.4                                   mxpaef1tlh23s052erw88a4w5   Running        Running 31 minutes ago
-w48spazhbmxc        tg61x8myx563ueo3urmn1ic6m.1   redis:alpine                                   qaqt4nrzo775jrx6detglho01   Running        Running 31 minutes ago
-6jj1m02freg1        8cqlyi444kzd3panjb7edh26v.1   dockersamples/visualizer:stable                mxpaef1tlh23s052erw88a4w5   Running        Running 31 minutes ago
-kqgdmededccb        qyprtqw1g5nrki557i974ou1d.2   dockersamples/examplevotingapp_vote:before     qaqt4nrzo775jrx6detglho01   Running        Running 31 minutes ago
-t72q3z038jeh        tg61x8myx563ueo3urmn1ic6m.2   redis:alpine                                   kanqcxfajd1r16wlnqcblobmm   Running        Running 31 minutes ago
-```
-
-### Do not truncate output
-
-When deploying a service, docker resolves the digest for the service's
-image, and pins the service to that digest. The digest is not shown by
-default, but is printed if `--no-trunc` is used. The `--no-trunc` option
-also shows the non-truncated task IDs, and error-messages, as can be seen below:
-
-```bash
-$ docker stack ps --no-trunc voting
-ID                          NAME                  IMAGE                                                                                                                 NODE   DESIRED STATE  CURREN STATE           ERROR  PORTS
-xim5bcqtgk1bxqz91jzo4a1s5   voting_worker.1       dockersamples/examplevotingapp_worker:latest@sha256:3e4ddf59c15f432280a2c0679c4fc5a2ee5a797023c8ef0d3baf7b1385e9fed   node2  Running        Runnin 32 minutes ago
-q7yik0ks1in6kv32gg6y6yjf7   voting_result.1       dockersamples/examplevotingapp_result:before@sha256:83b56996e930c292a6ae5187fda84dd6568a19d97cdb933720be15c757b7463   node1  Running        Runnin 32 minutes ago
-rx5yo0866nfxc58zf4irsss6n   voting_vote.1         dockersamples/examplevotingapp_vote:before@sha256:8e64b182c87de902f2b72321c89b4af4e2b942d76d0b772532ff27ec4c6ebf6     node3  Running        Runnin 32 minutes ago
-tz6j82jnwrx7n2offljp3mn03   voting_db.1           postgres:9.4@sha256:6046af499eae34d2074c0b53f9a8b404716d415e4a03e68bc1d2f8064f2b027                                   node1  Running        Runnin 32 minutes ago
-w48spazhbmxcmbjfi54gs7x90   voting_redis.1        redis:alpine@sha256:9cd405cd1ec1410eaab064a1383d0d8854d1ef74a54e1e4a92fb4ec7bdc3ee7                                   node2  Running        Runnin 32 minutes ago
-6jj1m02freg1n3z9n1evrzsbl   voting_visualizer.1   dockersamples/visualizer:stable@sha256:f924ad66c8e94b10baaf7bdb9cd491ef4e982a1d048a56a17e02bf5945401e5                node1  Running        Runnin 32 minutes ago
-kqgdmededccbhz2wuc0e9hx7g   voting_vote.2         dockersamples/examplevotingapp_vote:before@sha256:8e64b182c87de902f2b72321c89b4af4e2b942d76d0b772532ff27ec4c6ebf6     node2  Running        Runnin 32 minutes ago
-t72q3z038jehe1wbh9gdum076   voting_redis.2        redis:alpine@sha256:9cd405cd1ec1410eaab064a1383d0d8854d1ef74a54e1e4a92fb4ec7bdc3ee7                                   node3  Running        Runnin 32 minutes ago
-```
-
-### Only display task IDs
-
-The `-q ` or `--quiet` option only shows IDs of the tasks in the stack.
-This example outputs all task IDs of the "voting" stack;
-
-```bash
-$ docker stack ps -q voting
-xim5bcqtgk1b
-q7yik0ks1in6
-rx5yo0866nfx
-tz6j82jnwrx7
-w48spazhbmxc
-6jj1m02freg1
-kqgdmededccb
-t72q3z038jeh
-```
-
-This option can be used to perform batch operations. For example, you can use
-the task IDs as input for other commands, such as `docker inspect`. The
-following example inspects all tasks of the "voting" stack;
-
-```bash
-$ docker inspect $(docker stack ps -q voting)
-
-[
-    {
-        "ID": "xim5bcqtgk1b1gk0krq1",
-        "Version": {
-(...)
-```
-
-## Related commands
-
-* [stack deploy](stack_deploy.md)
-* [stack ls](stack_ls.md)
-* [stack rm](stack_rm.md)
-* [stack services](stack_services.md)
diff --git a/components/engine/docs/reference/commandline/stack_rm.md b/components/engine/docs/reference/commandline/stack_rm.md
deleted file mode 100644
index a1854ae6f0..0000000000
--- a/components/engine/docs/reference/commandline/stack_rm.md
+++ /dev/null
@@ -1,78 +0,0 @@
----
-title: "stack rm"
-description: "The stack rm command description and usage"
-keywords: "stack, rm, remove, down"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# stack rm
-
-```markdown
-Usage:  docker stack rm STACK [STACK...]
-
-Remove one or more stacks
-
-Aliases:
-  rm, remove, down
-
-Options:
-      --help   Print usage
-```
-
-## Description
-
-Remove the stack from the swarm. This command has to be run targeting
-a manager node.
-
-## Examples
-
-### Remove a stack
-
-This will remove the stack with the name `myapp`. Services, networks, and secrets associated with the stack will be removed.
-
-```bash
-$ docker stack rm myapp
-
-Removing service myapp_redis
-Removing service myapp_web
-Removing service myapp_lb
-Removing network myapp_default
-Removing network myapp_frontend
-```
-
-### Remove multiple stacks
-
-This will remove all the specified stacks, `myapp` and `vossibility`. Services, networks, and secrets associated with all the specified stacks will be removed.
-
-```bash
-$ docker stack rm myapp vossibility
-
-Removing service myapp_redis
-Removing service myapp_web
-Removing service myapp_lb
-Removing network myapp_default
-Removing network myapp_frontend
-Removing service vossibility_nsqd
-Removing service vossibility_logstash
-Removing service vossibility_elasticsearch
-Removing service vossibility_kibana
-Removing service vossibility_ghollector
-Removing service vossibility_lookupd
-Removing network vossibility_default
-Removing network vossibility_vossibility
-```
-
-## Related commands
-
-* [stack deploy](stack_deploy.md)
-* [stack ls](stack_ls.md)
-* [stack ps](stack_ps.md)
-* [stack services](stack_services.md)
diff --git a/components/engine/docs/reference/commandline/stack_services.md b/components/engine/docs/reference/commandline/stack_services.md
deleted file mode 100644
index b45047d409..0000000000
--- a/components/engine/docs/reference/commandline/stack_services.md
+++ /dev/null
@@ -1,105 +0,0 @@
----
-title: "stack services"
-description: "The stack services command description and usage"
-keywords: "stack, services"
-advisory: "experimental"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# stack services (experimental)
-
-```markdown
-Usage:	docker stack services [OPTIONS] STACK
-
-List the services in the stack
-
-Options:
-  -f, --filter filter   Filter output based on conditions provided
-      --format string   Pretty-print services using a Go template
-      --help            Print usage
-  -q, --quiet           Only display IDs
-```
-
-## Description
-
-Lists the services that are running as part of the specified stack. This
-command has to be run targeting a manager node.
-
-## Examples
-
-The following command shows all services in the `myapp` stack:
-
-```bash
-$ docker stack services myapp
-
-ID            NAME            REPLICAS  IMAGE                                                                          COMMAND
-7be5ei6sqeye  myapp_web       1/1       nginx@sha256:23f809e7fd5952e7d5be065b4d3643fbbceccd349d537b62a123ef2201bc886f
-dn7m7nhhfb9y  myapp_db        1/1       mysql@sha256:a9a5b559f8821fe73d58c3606c812d1c044868d42c63817fa5125fd9d8b7b539
-```
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is a `key=value` pair. If there
-is more than one filter, then pass multiple flags (e.g. `--filter "foo=bar" --filter "bif=baz"`).
-Multiple filter flags are combined as an `OR` filter.
-
-The following command shows both the `web` and `db` services:
-
-```bash
-$ docker stack services --filter name=myapp_web --filter name=myapp_db myapp
-
-ID            NAME            REPLICAS  IMAGE                                                                          COMMAND
-7be5ei6sqeye  myapp_web       1/1       nginx@sha256:23f809e7fd5952e7d5be065b4d3643fbbceccd349d537b62a123ef2201bc886f
-dn7m7nhhfb9y  myapp_db        1/1       mysql@sha256:a9a5b559f8821fe73d58c3606c812d1c044868d42c63817fa5125fd9d8b7b539
-```
-
-The currently supported filters are:
-
-* id / ID (`--filter id=7be5ei6sqeye`, or `--filter ID=7be5ei6sqeye`)
-* name (`--filter name=myapp_web`)
-* label (`--filter label=key=value`)
-
-### Formatting
-
-The formatting options (`--format`) pretty-prints services output
-using a Go template.
-
-Valid placeholders for the Go template are listed below:
-
-Placeholder | Description
-------------|------------------------------------------------------------------------------------------
-`.ID`       | Service ID
-`.Name`     | Service name
-`.Mode`     | Service mode (replicated, global)
-`.Replicas` | Service replicas
-`.Image`    | Service image
-
-When using the `--format` option, the `stack services` command will either
-output the data exactly as the template declares or, when using the
-`table` directive, includes column headers as well.
-
-The following example uses a template without headers and outputs the
-`ID`, `Mode`, and `Replicas` entries separated by a colon for all services:
-
-```bash
-$ docker stack services --format "{{.ID}}: {{.Mode}} {{.Replicas}}"
-
-0zmvwuiu3vue: replicated 10/10
-fm6uf97exkul: global 5/5
-```
-
-
-## Related commands
-
-* [stack deploy](stack_deploy.md)
-* [stack ls](stack_ls.md)
-* [stack ps](stack_ps.md)
-* [stack rm](stack_rm.md)
diff --git a/components/engine/docs/reference/commandline/start.md b/components/engine/docs/reference/commandline/start.md
deleted file mode 100644
index aa672289ec..0000000000
--- a/components/engine/docs/reference/commandline/start.md
+++ /dev/null
@@ -1,34 +0,0 @@
----
-title: "start"
-description: "The start command description and usage"
-keywords: "Start, container, stopped"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# start
-
-```markdown
-Usage:  docker start [OPTIONS] CONTAINER [CONTAINER...]
-
-Start one or more stopped containers
-
-Options:
-  -a, --attach               Attach STDOUT/STDERR and forward signals
-      --detach-keys string   Override the key sequence for detaching a container
-      --help                 Print usage
-  -i, --interactive          Attach container's STDIN
-```
-
-## Examples
-
-```bash
-$ docker start my_container
-```
diff --git a/components/engine/docs/reference/commandline/stats.md b/components/engine/docs/reference/commandline/stats.md
deleted file mode 100644
index f5c058524d..0000000000
--- a/components/engine/docs/reference/commandline/stats.md
+++ /dev/null
@@ -1,140 +0,0 @@
----
-title: "stats"
-description: "The stats command description and usage"
-keywords: "container, resource, statistics"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# stats
-
-```markdown
-Usage:  docker stats [OPTIONS] [CONTAINER...]
-
-Display a live stream of container(s) resource usage statistics
-
-Options:
-  -a, --all             Show all containers (default shows just running)
-      --format string   Pretty-print images using a Go template
-      --help            Print usage
-      --no-stream       Disable streaming stats and only pull the first result
-```
-
-## Description
-
-The `docker stats` command returns a live data stream for running containers. To limit data to one or more specific containers, specify a list of container names or ids separated by a space. You can specify a stopped container but stopped containers do not return any data.
-
-If you want more detailed information about a container's resource usage, use the `/containers/(id)/stats` API endpoint.
-
-## Examples
-
-Running `docker stats` on all running containers against a Linux daemon.
-
-```bash
-$ docker stats
-CONTAINER           CPU %               MEM USAGE / LIMIT     MEM %               NET I/O             BLOCK I/O
-1285939c1fd3        0.07%               796 KiB / 64 MiB        1.21%               788 B / 648 B       3.568 MB / 512 KB
-9c76f7834ae2        0.07%               2.746 MiB / 64 MiB      4.29%               1.266 KB / 648 B    12.4 MB / 0 B
-d1ea048f04e4        0.03%               4.583 MiB / 64 MiB      6.30%               2.854 KB / 648 B    27.7 MB / 0 B
-```
-
-Running `docker stats` on multiple containers by name and id against a Linux daemon.
-
-```bash
-$ docker stats fervent_panini 5acfcb1b4fd1
-CONTAINER           CPU %               MEM USAGE/LIMIT       MEM %               NET I/O
-5acfcb1b4fd1        0.00%               115.2 MiB/1.045 GiB   11.03%              1.422 kB/648 B
-fervent_panini      0.02%               11.08 MiB/1.045 GiB   1.06%               648 B/648 B
-```
-
-Running `docker stats` with customized format on all (Running and Stopped) containers.
-
-```bash
-$ docker stats --all --format "table {{.ID}}\t{{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}"
-CONTAINER ID                                                       NAME                     CPU %               MEM USAGE / LIMIT
-c9dfa83f0317f87637d5b7e67aa4223337d947215c5a9947e697e4f7d3e0f834   ecstatic_noether         0.00%               56KiB / 15.57GiB
-8f92d01cf3b29b4f5fca4cd33d907e05def7af5a3684711b20a2369d211ec67f   stoic_goodall            0.07%               32.86MiB / 15.57GiB
-38dd23dba00f307d53d040c1d18a91361bbdcccbf592315927d56cf13d8b7343   drunk_visvesvaraya       0.00%               0B / 0B
-5a8b07ec4cc52823f3cbfdb964018623c1ba307bce2c057ccdbde5f4f6990833   big_heisenberg           0.00%               0B / 0B
-```
-
-`drunk_visvesvaraya` and `big_heisenberg` are stopped containers in the above example.
-
-Running `docker stats` on all running containers against a Windows daemon.
-
-```powershell
-PS E:\> docker stats
-CONTAINER           CPU %               PRIV WORKING SET    NET I/O             BLOCK I/O
-09d3bb5b1604        6.61%               38.21 MiB           17.1 kB / 7.73 kB   10.7 MB / 3.57 MB
-9db7aa4d986d        9.19%               38.26 MiB           15.2 kB / 7.65 kB   10.6 MB / 3.3 MB
-3f214c61ad1d        0.00%               28.64 MiB           64 kB / 6.84 kB     4.42 MB / 6.93 MB
-```
-
-Running `docker stats` on multiple containers by name and id against a Windows daemon.
-
-```powershell
-PS E:\> docker ps -a
-CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
-3f214c61ad1d        nanoserver          "cmd"               2 minutes ago       Up 2 minutes                            big_minsky
-9db7aa4d986d        windowsservercore   "cmd"               2 minutes ago       Up 2 minutes                            mad_wilson
-09d3bb5b1604        windowsservercore   "cmd"               2 minutes ago       Up 2 minutes                            affectionate_easley
-
-PS E:\> docker stats 3f214c61ad1d mad_wilson
-CONTAINER           CPU %               PRIV WORKING SET    NET I/O             BLOCK I/O
-3f214c61ad1d        0.00%               46.25 MiB           76.3 kB / 7.92 kB   10.3 MB / 14.7 MB
-mad_wilson          9.59%               40.09 MiB           27.6 kB / 8.81 kB   17 MB / 20.1 MB
-```
-
-### Formatting
-
-The formatting option (`--format`) pretty prints container output
-using a Go template.
-
-Valid placeholders for the Go template are listed below:
-
-Placeholder  | Description
------------- | --------------------------------------------
-`.Container` | Container name or ID (user input)
-`.Name`      | Container name
-`.ID`        | Container ID
-`.CPUPerc`   | CPU percentage
-`.MemUsage`  | Memory usage
-`.NetIO`     | Network IO
-`.BlockIO`   | Block IO
-`.MemPerc`   | Memory percentage (Not available on Windows)
-`.PIDs`      | Number of PIDs (Not available on Windows)
-
-
-When using the `--format` option, the `stats` command either
-outputs the data exactly as the template declares or, when using the
-`table` directive, includes column headers as well.
-
-The following example uses a template without headers and outputs the
-`Container` and `CPUPerc` entries separated by a colon for all images:
-
-```bash
-$ docker stats --format "{{.Container}}: {{.CPUPerc}}"
-
-09d3bb5b1604: 6.61%
-9db7aa4d986d: 9.19%
-3f214c61ad1d: 0.00%
-```
-
-To list all containers statistics with their name, CPU percentage and memory
-usage in a table format you can use:
-
-```bash
-$ docker stats --format "table {{.Container}}\t{{.CPUPerc}}\t{{.MemUsage}}"
-
-CONTAINER           CPU %               PRIV WORKING SET
-1285939c1fd3        0.07%               796 KiB / 64 MiB
-9c76f7834ae2        0.07%               2.746 MiB / 64 MiB
-d1ea048f04e4        0.03%               4.583 MiB / 64 MiB
-```
diff --git a/components/engine/docs/reference/commandline/stop.md b/components/engine/docs/reference/commandline/stop.md
deleted file mode 100644
index dc00b38af5..0000000000
--- a/components/engine/docs/reference/commandline/stop.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-title: "stop"
-description: "The stop command description and usage"
-keywords: "stop, SIGKILL, SIGTERM"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# stop
-
-```markdown
-Usage:  docker stop [OPTIONS] CONTAINER [CONTAINER...]
-
-Stop one or more running containers
-
-Options:
-      --help       Print usage
-  -t, --time int   Seconds to wait for stop before killing it (default 10)
-```
-
-## Description
-
-The main process inside the container will receive `SIGTERM`, and after a grace
-period, `SIGKILL`.
-
-## Examples
-
-```bash
-$ docker stop my_container
-```
diff --git a/components/engine/docs/reference/commandline/swarm.md b/components/engine/docs/reference/commandline/swarm.md
deleted file mode 100644
index e8a8224f84..0000000000
--- a/components/engine/docs/reference/commandline/swarm.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-title: "swarm"
-description: "The swarm command description and usage"
-keywords: "swarm"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# swarm
-
-```markdown
-Usage:  docker swarm COMMAND
-
-Manage Swarm
-
-Options:
-      --help   Print usage
-
-Commands:
-  ca          Manage root CA
-  init        Initialize a swarm
-  join        Join a swarm as a node and/or manager
-  join-token  Manage join tokens
-  leave       Leave the swarm
-  unlock      Unlock swarm
-  unlock-key  Manage the unlock key
-  update      Update the swarm
-
-Run 'docker swarm COMMAND --help' for more information on a command.
-```
-
-## Description
-
-Manage the swarm.
diff --git a/components/engine/docs/reference/commandline/swarm_ca.md b/components/engine/docs/reference/commandline/swarm_ca.md
deleted file mode 100644
index 4a9010c896..0000000000
--- a/components/engine/docs/reference/commandline/swarm_ca.md
+++ /dev/null
@@ -1,122 +0,0 @@
----
-title: "swarm ca"
-description: "The swarm ca command description and usage"
-keywords: "swarm, ca"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# swarm ca
-
-```markdown
-Usage:	docker swarm ca [OPTIONS]
-
-Manage root CA
-
-Options:
-      --ca-cert pem-file          Path to the PEM-formatted root CA certificate to use for the new cluster
-      --ca-key pem-file           Path to the PEM-formatted root CA key to use for the new cluster
-      --cert-expiry duration      Validity period for node certificates (ns|us|ms|s|m|h) (default 2160h0m0s)
-  -d, --detach                    Exit immediately instead of waiting for the root rotation to converge
-      --external-ca external-ca   Specifications of one or more certificate signing endpoints
-      --help                      Print usage
-  -q, --quiet                     Suppress progress output
-      --rotate                    Rotate the swarm CA - if no certificate or key are provided, new ones will be generated
-```
-
-## Description
-
-View or rotate the current swarm CA certificate. This command must target a manager node.
-
-## Examples
-
-Run the `docker swarm ca` command without any options to view the current root CA certificate
-in PEM format.
-
-```bash
-$ docker swarm ca
------BEGIN CERTIFICATE-----
-MIIBazCCARCgAwIBAgIUJPzo67QC7g8Ebg2ansjkZ8CbmaswCgYIKoZIzj0EAwIw
-EzERMA8GA1UEAxMIc3dhcm0tY2EwHhcNMTcwNTAzMTcxMDAwWhcNMzcwNDI4MTcx
-MDAwWjATMREwDwYDVQQDEwhzd2FybS1jYTBZMBMGByqGSM49AgEGCCqGSM49AwEH
-A0IABKL6/C0sihYEb935wVPRA8MqzPLn3jzou0OJRXHsCLcVExigrMdgmLCC+Va4
-+sJ+SLVO1eQbvLHH8uuDdF/QOU6jQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB
-Af8EBTADAQH/MB0GA1UdDgQWBBSfUy5bjUnBAx/B0GkOBKp91XvxzjAKBggqhkjO
-PQQDAgNJADBGAiEAnbvh0puOS5R/qvy1PMHY1iksYKh2acsGLtL/jAIvO4ACIQCi
-lIwQqLkJ48SQqCjG1DBTSBsHmMSRT+6mE2My+Z3GKA==
------END CERTIFICATE-----
-```
-
-Pass the `--rotate` flag (and optionally a `--ca-cert`, along with a `--ca-key` or
-`--external-ca` parameter flag), in order to rotate the current swarm root CA.
-
-```
-$ docker swarm ca --rotate
-desired root digest: sha256:05da740cf2577a25224c53019e2cce99bcc5ba09664ad6bb2a9425d9ebd1b53e
-  rotated TLS certificates:  [=========================>                         ] 1/2 nodes
-  rotated CA certificates:   [>                                                  ] 0/2 nodes
-```
-
-Once the rotation os finished (all the progress bars have completed) the now-current
-CA certificate will be printed:
-
-```
-$ docker swarm ca --rotate
-desired root digest: sha256:05da740cf2577a25224c53019e2cce99bcc5ba09664ad6bb2a9425d9ebd1b53e
-  rotated TLS certificates:  [==================================================>] 2/2 nodes
-  rotated CA certificates:   [==================================================>] 2/2 nodes
------BEGIN CERTIFICATE-----
-MIIBazCCARCgAwIBAgIUFynG04h5Rrl4lKyA4/E65tYKg8IwCgYIKoZIzj0EAwIw
-EzERMA8GA1UEAxMIc3dhcm0tY2EwHhcNMTcwNTE2MDAxMDAwWhcNMzcwNTExMDAx
-MDAwWjATMREwDwYDVQQDEwhzd2FybS1jYTBZMBMGByqGSM49AgEGCCqGSM49AwEH
-A0IABC2DuNrIETP7C7lfiEPk39tWaaU0I2RumUP4fX4+3m+87j0DU0CsemUaaOG6
-+PxHhGu2VXQ4c9pctPHgf7vWeVajQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB
-Af8EBTADAQH/MB0GA1UdDgQWBBSEL02z6mCI3SmMDmITMr12qCRY2jAKBggqhkjO
-PQQDAgNJADBGAiEA263Eb52+825EeNQZM0AME+aoH1319Zp9/J5ijILW+6ACIQCg
-gyg5u9Iliel99l7SuMhNeLkrU7fXs+Of1nTyyM73ig==
------END CERTIFICATE-----
-```
-
-### `--rotate`
-
-Root CA Rotation is recommended if one or more of the swarm managers have been
-compromised, so that those managers can no longer connect to or be trusted by
-any other node in the cluster.
-
-Alternately, root CA rotation can be used to give control of the swarm CA
-to an external CA, or to take control back from an external CA.
-
-The `--rotate` flag does not require any parameters to do a rotation, but you can
-optionally specify a certificate and key, or a certificate and external CA URL,
-and those will be used instead of an automatically-generated certificate/key pair.
-
-Because the root CA key should be kept secret, if provided it will not be visible
-when viewing swarm any information via the CLI or API.
-
-The root CA rotation will not be completed until all registered nodes have
-rotated their TLS certificates.  If the rotation is not completing within a
-reasonable amount of time, try running
-`docker node ls --format {{.ID}} {{.Hostname}} {{.Status}} {{.TLSStatus}}` to
-see if any nodes are down or otherwise unable to rotate TLS certificates.
-
-
-### `--detach`
-
-Initiate the root CA rotation, but do not wait for the completion of or display the
-progress of the rotation.
-
-## Related commands
-
-* [swarm init](swarm_init.md)
-* [swarm join](swarm_join.md)
-* [swarm join-token](swarm_join_token.md)
-* [swarm leave](swarm_leave.md)
-* [swarm unlock](swarm_unlock.md)
-* [swarm unlock-key](swarm_unlock_key.md)
diff --git a/components/engine/docs/reference/commandline/swarm_init.md b/components/engine/docs/reference/commandline/swarm_init.md
deleted file mode 100644
index f011758a3a..0000000000
--- a/components/engine/docs/reference/commandline/swarm_init.md
+++ /dev/null
@@ -1,168 +0,0 @@
----
-title: "swarm init"
-description: "The swarm init command description and usage"
-keywords: "swarm, init"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# swarm init
-
-```markdown
-Usage:  docker swarm init [OPTIONS]
-
-Initialize a swarm
-
-Options:
-      --advertise-addr string           Advertised address (format: <ip|interface>[:port])
-      --autolock                        Enable manager autolocking (requiring an unlock key to start a stopped manager)
-      --availability string             Availability of the node ("active"|"pause"|"drain") (default "active")
-      --cert-expiry duration            Validity period for node certificates (ns|us|ms|s|m|h) (default 2160h0m0s)
-      --data-path-addr string           Address or interface to use for data path traffic (format: <ip|interface>)
-      --dispatcher-heartbeat duration   Dispatcher heartbeat period (ns|us|ms|s|m|h) (default 5s)
-      --external-ca external-ca         Specifications of one or more certificate signing endpoints
-      --force-new-cluster               Force create a new cluster from current state
-      --help                            Print usage
-      --listen-addr node-addr           Listen address (format: <ip|interface>[:port]) (default 0.0.0.0:2377)
-      --max-snapshots uint              Number of additional Raft snapshots to retain
-      --snapshot-interval uint          Number of log entries between Raft snapshots (default 10000)
-      --task-history-limit int          Task history retention limit (default 5)
-```
-
-## Description
-
-Initialize a swarm. The docker engine targeted by this command becomes a manager
-in the newly created single-node swarm.
-
-## Examples
-
-```bash
-$ docker swarm init --advertise-addr 192.168.99.121
-Swarm initialized: current node (bvz81updecsj6wjz393c09vti) is now a manager.
-
-To add a worker to this swarm, run the following command:
-
-    docker swarm join \
-    --token SWMTKN-1-3pu6hszjas19xyp7ghgosyx9k8atbfcr8p2is99znpy26u2lkl-1awxwuwd3z9j1z3puu7rcgdbx \
-    172.17.0.2:2377
-
-To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.
-```
-
-`docker swarm init` generates two random tokens, a worker token and a manager token. When you join
-a new node to the swarm, the node joins as a worker or manager node based upon the token you pass
-to [swarm join](swarm_join.md).
-
-After you create the swarm, you can display or rotate the token using
-[swarm join-token](swarm_join_token.md).
-
-### `--autolock`
-
-This flag enables automatic locking of managers with an encryption key. The
-private keys and data stored by all managers will be protected by the
-encryption key printed in the output, and will not be accessible without it.
-Thus, it is very important to store this key in order to activate a manager
-after it restarts. The key can be passed to `docker swarm unlock` to reactivate
-the manager. Autolock can be disabled by running
-`docker swarm update --autolock=false`. After disabling it, the encryption key
-is no longer required to start the manager, and it will start up on its own
-without user intervention.
-
-### `--cert-expiry`
-
-This flag sets the validity period for node certificates.
-
-### `--dispatcher-heartbeat`
-
-This flag sets the frequency with which nodes are told to use as a
-period to report their health.
-
-### `--external-ca`
-
-This flag sets up the swarm to use an external CA to issue node certificates. The value takes
-the form `protocol=X,url=Y`. The value for `protocol` specifies what protocol should be used
-to send signing requests to the external CA. Currently, the only supported value is `cfssl`.
-The URL specifies the endpoint where signing requests should be submitted.
-
-### `--force-new-cluster`
-
-This flag forces an existing node that was part of a quorum that was lost to restart as a single node Manager without losing its data.
-
-### `--listen-addr`
-
-The node listens for inbound swarm manager traffic on this address. The default is to listen on
-0.0.0.0:2377. It is also possible to specify a network interface to listen on that interface's
-address; for example `--listen-addr eth0:2377`.
-
-Specifying a port is optional. If the value is a bare IP address or interface
-name, the default port 2377 will be used.
-
-### `--advertise-addr`
-
-This flag specifies the address that will be advertised to other members of the
-swarm for API access and overlay networking. If unspecified, Docker will check
-if the system has a single IP address, and use that IP address with the
-listening port (see `--listen-addr`). If the system has multiple IP addresses,
-`--advertise-addr` must be specified so that the correct address is chosen for
-inter-manager communication and overlay networking.
-
-It is also possible to specify a network interface to advertise that interface's address;
-for example `--advertise-addr eth0:2377`.
-
-Specifying a port is optional. If the value is a bare IP address or interface
-name, the default port 2377 will be used.
-
-### `--data-path-addr`
-
-This flag specifies the address that global scope network drivers will publish towards
-other nodes in order to reach the containers running on this node.
-Using this parameter it is then possible to separate the container's data traffic from the
-management traffic of the cluster.
-If unspecified, Docker will use the same IP address or interface that is used for the
-advertise address.
-
-### `--task-history-limit`
-
-This flag sets up task history retention limit.
-
-### `--max-snapshots`
-
-This flag sets the number of old Raft snapshots to retain in addition to the
-current Raft snapshots. By default, no old snapshots are retained. This option
-may be used for debugging, or to store old snapshots of the swarm state for
-disaster recovery purposes.
-
-### `--snapshot-interval`
-
-This flag specifies how many log entries to allow in between Raft snapshots.
-Setting this to a higher number will trigger snapshots less frequently.
-Snapshots compact the Raft log and allow for more efficient transfer of the
-state to new managers. However, there is a performance cost to taking snapshots
-frequently.
-
-### `--availability`
-
-This flag specifies the availability of the node at the time the node joins a master.
-Possible availability values are `active`, `pause`, or `drain`.
-
-This flag is useful in certain situations. For example, a cluster may want to have
-dedicated manager nodes that are not served as worker nodes. This could be achieved
-by passing `--availability=drain` to `docker swarm init`.
-
-
-## Related commands
-
-* [swarm ca](swarm_ca.md)
-* [swarm join](swarm_join.md)
-* [swarm join-token](swarm_join_token.md)
-* [swarm leave](swarm_leave.md)
-* [swarm unlock](swarm_unlock.md)
-* [swarm unlock-key](swarm_unlock_key.md)
-* [swarm update](swarm_update.md)
diff --git a/components/engine/docs/reference/commandline/swarm_join.md b/components/engine/docs/reference/commandline/swarm_join.md
deleted file mode 100644
index 8d2dfe6d00..0000000000
--- a/components/engine/docs/reference/commandline/swarm_join.md
+++ /dev/null
@@ -1,130 +0,0 @@
----
-title: "swarm join"
-description: "The swarm join command description and usage"
-keywords: "swarm, join"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# swarm join
-
-```markdown
-Usage:  docker swarm join [OPTIONS] HOST:PORT
-
-Join a swarm as a node and/or manager
-
-Options:
-      --advertise-addr string   Advertised address (format: <ip|interface>[:port])
-      --availability string     Availability of the node ("active"|"pause"|"drain") (default "active")
-      --data-path-addr string   Address or interface to use for data path traffic (format: <ip|interface>)
-      --help                    Print usage
-      --listen-addr node-addr   Listen address (format: <ip|interface>[:port]) (default 0.0.0.0:2377)
-      --token string            Token for entry into the swarm
-```
-
-## Description
-
-Join a node to a swarm. The node joins as a manager node or worker node based upon the token you
-pass with the `--token` flag. If you pass a manager token, the node joins as a manager. If you
-pass a worker token, the node joins as a worker.
-
-## Examples
-
-### Join a node to swarm as a manager
-
-The example below demonstrates joining a manager node using a manager token.
-
-```bash
-$ docker swarm join --token SWMTKN-1-3pu6hszjas19xyp7ghgosyx9k8atbfcr8p2is99znpy26u2lkl-7p73s1dx5in4tatdymyhg9hu2 192.168.99.121:2377
-This node joined a swarm as a manager.
-$ docker node ls
-ID                           HOSTNAME  STATUS  AVAILABILITY  MANAGER STATUS
-dkp8vy1dq1kxleu9g4u78tlag *  manager2  Ready   Active        Reachable
-dvfxp4zseq4s0rih1selh0d20    manager1  Ready   Active        Leader
-```
-
-A cluster should only have 3-7 managers at most, because a majority of managers must be available
-for the cluster to function. Nodes that aren't meant to participate in this management quorum
-should join as workers instead. Managers should be stable hosts that have static IP addresses.
-
-### Join a node to swarm as a worker
-
-The example below demonstrates joining a worker node using a worker token.
-
-```bash
-$ docker swarm join --token SWMTKN-1-3pu6hszjas19xyp7ghgosyx9k8atbfcr8p2is99znpy26u2lkl-1awxwuwd3z9j1z3puu7rcgdbx 192.168.99.121:2377
-This node joined a swarm as a worker.
-$ docker node ls
-ID                           HOSTNAME  STATUS  AVAILABILITY  MANAGER STATUS
-7ln70fl22uw2dvjn2ft53m3q5    worker2   Ready   Active
-dkp8vy1dq1kxleu9g4u78tlag    worker1   Ready   Active        Reachable
-dvfxp4zseq4s0rih1selh0d20 *  manager1  Ready   Active        Leader
-```
-
-### `--listen-addr value`
-
-If the node is a manager, it will listen for inbound swarm manager traffic on this
-address. The default is to listen on 0.0.0.0:2377. It is also possible to specify a
-network interface to listen on that interface's address; for example `--listen-addr eth0:2377`.
-
-Specifying a port is optional. If the value is a bare IP address, or interface
-name, the default port 2377 will be used.
-
-This flag is generally not necessary when joining an existing swarm.
-
-### `--advertise-addr value`
-
-This flag specifies the address that will be advertised to other members of the
-swarm for API access. If unspecified, Docker will check if the system has a
-single IP address, and use that IP address with the listening port (see
-`--listen-addr`). If the system has multiple IP addresses, `--advertise-addr`
-must be specified so that the correct address is chosen for inter-manager
-communication and overlay networking.
-
-It is also possible to specify a network interface to advertise that interface's address;
-for example `--advertise-addr eth0:2377`.
-
-Specifying a port is optional. If the value is a bare IP address, or interface
-name, the default port 2377 will be used.
-
-This flag is generally not necessary when joining an existing swarm.
-
-### `--data-path-addr`
-
-This flag specifies the address that global scope network drivers will publish towards
-other nodes in order to reach the containers running on this node.
-Using this parameter it is then possible to separate the container's data traffic from the
-management traffic of the cluster.
-If unspecified, Docker will use the same IP address or interface that is used for the
-advertise address.
-
-### `--token string`
-
-Secret value required for nodes to join the swarm
-
-### `--availability`
-
-This flag specifies the availability of the node at the time the node joins a master.
-Possible availability values are `active`, `pause`, or `drain`.
-
-This flag is useful in certain situations. For example, a cluster may want to have
-dedicated manager nodes that are not served as worker nodes. This could be achieved
-by passing `--availability=drain` to `docker swarm join`.
-
-
-## Related commands
-
-* [swarm ca](swarm_ca.md)
-* [swarm init](swarm_init.md)
-* [swarm join-token](swarm_join_token.md)
-* [swarm leave](swarm_leave.md)
-* [swarm unlock](swarm_unlock.md)
-* [swarm unlock-key](swarm_unlock_key.md)
-* [swarm update](swarm_update.md)
diff --git a/components/engine/docs/reference/commandline/swarm_join_token.md b/components/engine/docs/reference/commandline/swarm_join_token.md
deleted file mode 100644
index 44d9cf3ec7..0000000000
--- a/components/engine/docs/reference/commandline/swarm_join_token.md
+++ /dev/null
@@ -1,115 +0,0 @@
----
-title: "swarm join-token"
-description: "The swarm join-token command description and usage"
-keywords: "swarm, join-token"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# swarm join-token
-
-```markdown
-Usage:	docker swarm join-token [OPTIONS] (worker|manager)
-
-Manage join tokens
-
-Options:
-      --help     Print usage
-  -q, --quiet    Only display token
-      --rotate   Rotate join token
-```
-
-## Description
-
-Join tokens are secrets that allow a node to join the swarm. There are two
-different join tokens available, one for the worker role and one for the manager
-role. You pass the token using the `--token` flag when you run
-[swarm join](swarm_join.md). Nodes use the join token only when they join the
-swarm.
-
-## Examples
-
-You can view or rotate the join tokens using `swarm join-token`.
-
-As a convenience, you can pass `worker` or `manager` as an argument to
-`join-token` to print the full `docker swarm join` command to join a new node to
-the swarm:
-
-```bash
-$ docker swarm join-token worker
-To add a worker to this swarm, run the following command:
-
-    docker swarm join \
-    --token SWMTKN-1-3pu6hszjas19xyp7ghgosyx9k8atbfcr8p2is99znpy26u2lkl-1awxwuwd3z9j1z3puu7rcgdbx \
-    172.17.0.2:2377
-
-$ docker swarm join-token manager
-To add a manager to this swarm, run the following command:
-
-    docker swarm join \
-    --token SWMTKN-1-3pu6hszjas19xyp7ghgosyx9k8atbfcr8p2is99znpy26u2lkl-7p73s1dx5in4tatdymyhg9hu2 \
-    172.17.0.2:2377
-```
-
-Use the `--rotate` flag to generate a new join token for the specified role:
-
-```bash
-$ docker swarm join-token --rotate worker
-Successfully rotated worker join token.
-
-To add a worker to this swarm, run the following command:
-
-    docker swarm join \
-    --token SWMTKN-1-3pu6hszjas19xyp7ghgosyx9k8atbfcr8p2is99znpy26u2lkl-b30ljddcqhef9b9v4rs7mel7t \
-    172.17.0.2:2377
-```
-
-After using `--rotate`, only the new token will be valid for joining with the specified role.
-
-The `-q` (or `--quiet`) flag only prints the token:
-
-```bash
-$ docker swarm join-token -q worker
-
-SWMTKN-1-3pu6hszjas19xyp7ghgosyx9k8atbfcr8p2is99znpy26u2lkl-b30ljddcqhef9b9v4rs7mel7t
-```
-
-### `--rotate`
-
-Because tokens allow new nodes to join the swarm, you should keep them secret.
-Be particularly careful with manager tokens since they allow new manager nodes
-to join the swarm. A rogue manager has the potential to disrupt the operation of
-your swarm.
-
-Rotate your swarm's join token if a token gets checked-in to version control,
-stolen, or a node is compromised. You may also want to periodically rotate the
-token to ensure any unknown token leaks do not allow a rogue node to join
-the swarm.
-
-To rotate the join token and print the newly generated token, run
-`docker swarm join-token --rotate` and pass the role: `manager` or `worker`.
-
-Rotating a join-token means that no new nodes will be able to join the swarm
-using the old token. Rotation does not affect existing nodes in the swarm
-because the join token is only used for authorizing new nodes joining the swarm.
-
-### `--quiet`
-
-Only print the token. Do not print a complete command for joining.
-
-## Related commands
-
-* [swarm ca](swarm_ca.md)
-* [swarm init](swarm_init.md)
-* [swarm join](swarm_join.md)
-* [swarm leave](swarm_leave.md)
-* [swarm unlock](swarm_unlock.md)
-* [swarm unlock-key](swarm_unlock_key.md)
-* [swarm update](swarm_update.md)
diff --git a/components/engine/docs/reference/commandline/swarm_leave.md b/components/engine/docs/reference/commandline/swarm_leave.md
deleted file mode 100644
index 1c898ea9a5..0000000000
--- a/components/engine/docs/reference/commandline/swarm_leave.md
+++ /dev/null
@@ -1,72 +0,0 @@
----
-title: "swarm leave"
-description: "The swarm leave command description and usage"
-keywords: "swarm, leave"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# swarm leave
-
-```markdown
-Usage:	docker swarm leave [OPTIONS]
-
-Leave the swarm
-
-Options:
-  -f, --force   Force this node to leave the swarm, ignoring warnings
-      --help    Print usage
-```
-
-## Description
-
-When you run this command on a worker, that worker leaves the swarm.
-
-You can use the `--force` option on a manager to remove it from the swarm.
-However, this does not reconfigure the swarm to ensure that there are enough
-managers to maintain a quorum in the swarm. The safe way to remove a manager
-from a swarm is to demote it to a worker and then direct it to leave the quorum
-without using `--force`. Only use `--force` in situations where the swarm will
-no longer be used after the manager leaves, such as in a single-node swarm.
-
-## Examples
-
-Consider the following swarm, as seen from the manager:
-
-```bash
-$ docker node ls
-ID                           HOSTNAME  STATUS  AVAILABILITY  MANAGER STATUS
-7ln70fl22uw2dvjn2ft53m3q5    worker2   Ready   Active
-dkp8vy1dq1kxleu9g4u78tlag    worker1   Ready   Active
-dvfxp4zseq4s0rih1selh0d20 *  manager1  Ready   Active        Leader
-```
-
-To remove `worker2`, issue the following command from `worker2` itself:
-
-```bash
-$ docker swarm leave
-Node left the default swarm.
-```
-
-The node will still appear in the node list, and marked as `down`. It no longer
-affects swarm operation, but a long list of `down` nodes can clutter the node
-list. To remove an inactive node from the list, use the [`node rm`](node_rm.md)
-command.
-
-## Related commands
-
-* [swarm ca](swarm_ca.md)
-* [node rm](node_rm.md)
-* [swarm init](swarm_init.md)
-* [swarm join](swarm_join.md)
-* [swarm join-token](swarm_join_token.md)
-* [swarm unlock](swarm_unlock.md)
-* [swarm unlock-key](swarm_unlock_key.md)
-* [swarm update](swarm_update.md)
diff --git a/components/engine/docs/reference/commandline/swarm_unlock.md b/components/engine/docs/reference/commandline/swarm_unlock.md
deleted file mode 100644
index d2f5fc4954..0000000000
--- a/components/engine/docs/reference/commandline/swarm_unlock.md
+++ /dev/null
@@ -1,49 +0,0 @@
----
-title: "swarm unlock"
-description: "The swarm unlock command description and usage"
-keywords: "swarm, unlock"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# swarm unlock
-
-```markdown
-Usage:	docker swarm unlock
-
-Unlock swarm
-
-Options:
-      --help   Print usage
-```
-
-## Description
-
-Unlocks a locked manager using a user-supplied unlock key. This command must be
-used to reactivate a manager after its Docker daemon restarts if the autolock
-setting is turned on. The unlock key is printed at the time when autolock is
-enabled, and is also available from the `docker swarm unlock-key` command.
-
-## Examples
-
-```bash
-$ docker swarm unlock
-Please enter unlock key:
-```
-
-## Related commands
-
-* [swarm ca](swarm_ca.md)
-* [swarm init](swarm_init.md)
-* [swarm join](swarm_join.md)
-* [swarm join-token](swarm_join_token.md)
-* [swarm leave](swarm_leave.md)
-* [swarm unlock-key](swarm_unlock_key.md)
-* [swarm update](swarm_update.md)
diff --git a/components/engine/docs/reference/commandline/swarm_unlock_key.md b/components/engine/docs/reference/commandline/swarm_unlock_key.md
deleted file mode 100644
index c0efd04922..0000000000
--- a/components/engine/docs/reference/commandline/swarm_unlock_key.md
+++ /dev/null
@@ -1,92 +0,0 @@
----
-title: "swarm unlock-key"
-description: "The swarm unlock-keycommand description and usage"
-keywords: "swarm, unlock-key"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# swarm unlock-key
-
-```markdown
-Usage:	docker swarm unlock-key [OPTIONS]
-
-Manage the unlock key
-
-Options:
-      --help     Print usage
-  -q, --quiet    Only display token
-      --rotate   Rotate unlock key
-```
-
-## Description
-
-An unlock key is a secret key needed to unlock a manager after its Docker daemon
-restarts. These keys are only used when the autolock feature is enabled for the
-swarm.
-
-You can view or rotate the unlock key using `swarm unlock-key`. To view the key,
-run the `docker swarm unlock-key` command without any arguments:
-
-## Examples
-
-```bash
-$ docker swarm unlock-key
-
-To unlock a swarm manager after it restarts, run the `docker swarm unlock`
-command and provide the following key:
-
-    SWMKEY-1-fySn8TY4w5lKcWcJPIpKufejh9hxx5KYwx6XZigx3Q4
-
-Please remember to store this key in a password manager, since without it you
-will not be able to restart the manager.
-```
-
-Use the `--rotate` flag to rotate the unlock key to a new, randomly-generated
-key:
-
-```bash
-$ docker swarm unlock-key --rotate
-Successfully rotated manager unlock key.
-
-To unlock a swarm manager after it restarts, run the `docker swarm unlock`
-command and provide the following key:
-
-    SWMKEY-1-7c37Cc8654o6p38HnroywCi19pllOnGtbdZEgtKxZu8
-
-Please remember to store this key in a password manager, since without it you
-will not be able to restart the manager.
-```
-
-The `-q` (or `--quiet`) flag only prints the key:
-
-```bash
-$ docker swarm unlock-key -q
-SWMKEY-1-7c37Cc8654o6p38HnroywCi19pllOnGtbdZEgtKxZu8
-```
-
-### `--rotate`
-
-This flag rotates the unlock key, replacing it with a new randomly-generated
-key. The old unlock key will no longer be accepted.
-
-### `--quiet`
-
-Only print the unlock key, without instructions.
-
-## Related commands
-
-* [swarm ca](swarm_ca.md)
-* [swarm init](swarm_init.md)
-* [swarm join](swarm_join.md)
-* [swarm join-token](swarm_join_token.md)
-* [swarm leave](swarm_leave.md)
-* [swarm unlock](swarm_unlock.md)
-* [swarm update](swarm_update.md)
diff --git a/components/engine/docs/reference/commandline/swarm_update.md b/components/engine/docs/reference/commandline/swarm_update.md
deleted file mode 100644
index 544ef381c0..0000000000
--- a/components/engine/docs/reference/commandline/swarm_update.md
+++ /dev/null
@@ -1,52 +0,0 @@
----
-title: "swarm update"
-description: "The swarm update command description and usage"
-keywords: "swarm, update"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# swarm update
-
-```markdown
-Usage:  docker swarm update [OPTIONS]
-
-Update the swarm
-
-Options:
-      --autolock                        Change manager autolocking setting (true|false)
-      --cert-expiry duration            Validity period for node certificates (ns|us|ms|s|m|h) (default 2160h0m0s)
-      --dispatcher-heartbeat duration   Dispatcher heartbeat period (ns|us|ms|s|m|h) (default 5s)
-      --external-ca external-ca         Specifications of one or more certificate signing endpoints
-      --help                            Print usage
-      --max-snapshots uint              Number of additional Raft snapshots to retain
-      --snapshot-interval uint          Number of log entries between Raft snapshots (default 10000)
-      --task-history-limit int          Task history retention limit (default 5)
-```
-
-## Description
-
-Updates a swarm with new parameter values. This command must target a manager node.
-
-## Examples
-
-```bash
-$ docker swarm update --cert-expiry 720h
-```
-
-## Related commands
-
-* [swarm ca](swarm_ca.md)
-* [swarm init](swarm_init.md)
-* [swarm join](swarm_join.md)
-* [swarm join-token](swarm_join_token.md)
-* [swarm leave](swarm_leave.md)
-* [swarm unlock](swarm_unlock.md)
-* [swarm unlock-key](swarm_unlock_key.md)
diff --git a/components/engine/docs/reference/commandline/system.md b/components/engine/docs/reference/commandline/system.md
deleted file mode 100644
index 2484a4a987..0000000000
--- a/components/engine/docs/reference/commandline/system.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-title: "system"
-description: "The system command description and usage"
-keywords: "system"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# system
-
-```markdown
-Usage:  docker system COMMAND
-
-Manage Docker
-
-Options:
-      --help   Print usage
-
-Commands:
-  df          Show docker disk usage
-  events      Get real time events from the server
-  info        Display system-wide information
-  prune       Remove unused data
-
-Run 'docker system COMMAND --help' for more information on a command.
-```
-
-## Description
-
-Manage Docker.
diff --git a/components/engine/docs/reference/commandline/system_df.md b/components/engine/docs/reference/commandline/system_df.md
deleted file mode 100644
index aedd9779e4..0000000000
--- a/components/engine/docs/reference/commandline/system_df.md
+++ /dev/null
@@ -1,140 +0,0 @@
----
-title: "system df"
-description: "The system df command description and usage"
-keywords: "system, data, usage, disk"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# system df
-
-```markdown
-Usage:	docker system df [OPTIONS]
-
-Show docker filesystem usage
-
-Options:
-      --format string   Pretty-print images using a Go template
-      --help            Print usage
-  -v, --verbose         Show detailed information on space usage
-```
-
-## Description
-
-The `docker system df` command displays information regarding the
-amount of disk space used by the docker daemon.
-
-## Examples
-
-By default the command will just show a summary of the data used:
-
-```bash
-$ docker system df
-
-TYPE                TOTAL               ACTIVE              SIZE                RECLAIMABLE
-Images              5                   2                   16.43 MB            11.63 MB (70%)
-Containers          2                   0                   212 B               212 B (100%)
-Local Volumes       2                   1                   36 B                0 B (0%)
-```
-
-A more detailed view can be requested using the `-v, --verbose` flag:
-
-```bash
-$ docker system df -v
-
-Images space usage:
-
-REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE                SHARED SIZE         UNIQUE SIZE         CONTAINERS
-my-curl             latest              b2789dd875bf        6 minutes ago       11 MB               11 MB               5 B                 0
-my-jq               latest              ae67841be6d0        6 minutes ago       9.623 MB            8.991 MB            632.1 kB            0
-<none>              <none>              a0971c4015c1        6 minutes ago       11 MB               11 MB               0 B                 0
-alpine              latest              4e38e38c8ce0        9 weeks ago         4.799 MB            0 B                 4.799 MB            1
-alpine              3.3                 47cf20d8c26c        9 weeks ago         4.797 MB            4.797 MB            0 B                 1
-
-Containers space usage:
-
-CONTAINER ID        IMAGE               COMMAND             LOCAL VOLUMES       SIZE                CREATED             STATUS                      NAMES
-4a7f7eebae0f        alpine:latest       "sh"                1                   0 B                 16 minutes ago      Exited (0) 5 minutes ago    hopeful_yalow
-f98f9c2aa1ea        alpine:3.3          "sh"                1                   212 B               16 minutes ago      Exited (0) 48 seconds ago   anon-vol
-
-Local Volumes space usage:
-
-NAME                                                               LINKS               SIZE
-07c7bdf3e34ab76d921894c2b834f073721fccfbbcba792aa7648e3a7a664c2e   2                   36 B
-my-named-vol                                                       0                   0 B
-```
-
-* `SHARED SIZE` is the amount of space that an image shares with another one (i.e. their common data)
-* `UNIQUE SIZE` is the amount of space that is only used by a given image
-* `SIZE` is the virtual size of the image, it is the sum of `SHARED SIZE` and `UNIQUE SIZE`
-
-> **Note**: Network information is not shown because it doesn't consume the disk
-> space.
-
-## Performance
-
-The `system df` command can be very resource-intensive. It traverses the
-filesystem of every image, container, and volume in the system. You should be
-careful running this command in systems with lots of images, containers, or
-volumes or in systems where some images, containers, or volumes have very large
-filesystems with many files. You should also be careful not to run this command
-in systems where performance is critical.
-
-## Format the output
-
-The formatting option (`--format`) pretty prints the disk usage output
-using a Go template.
-
-Valid placeholders for the Go template are listed below:
-
-| Placeholder    | Description                                |
-| -------------- | ------------------------------------------ |
-| `.Type`        | `Images`, `Containers` and `Local Volumes` |
-| `.TotalCount`  | Total number of items                      |
-| `.Active`      | Number of active items                     |
-| `.Size`        | Available size                             |
-| `.Reclaimable` | Reclaimable size                           |
-
-When using the `--format` option, the `system df` command outputs
-the data exactly as the template declares or, when using the
-`table` directive, will include column headers as well.
-
-The following example uses a template without headers and outputs the
-`Type` and `TotalCount` entries separated by a colon:
-
-```bash
-$ docker system df --format "{{.Type}}: {{.TotalCount}}"
-
-Images: 2
-Containers: 4
-Local Volumes: 1
-```
-
-To list the disk usage with size and reclaimable size in a table format you
-can use:
-
-```bash
-$ docker system df --format "table {{.Type}}\t{{.Size}}\t{{.Reclaimable}}"
-
-TYPE                SIZE                RECLAIMABLE
-Images              2.547 GB            2.342 GB (91%)
-Containers          0 B                 0 B
-Local Volumes       150.3 MB            150.3 MB (100%)
-<Paste>
-```
-
-**Note** the format option is meaningless when verbose is true.
-
-## Related commands
-* [system prune](system_prune.md)
-* [container prune](container_prune.md)
-* [volume prune](volume_prune.md)
-* [image prune](image_prune.md)
-* [network prune](network_prune.md)
diff --git a/components/engine/docs/reference/commandline/system_events.md b/components/engine/docs/reference/commandline/system_events.md
deleted file mode 100644
index 76ef4de8f6..0000000000
--- a/components/engine/docs/reference/commandline/system_events.md
+++ /dev/null
@@ -1,345 +0,0 @@
----
-title: "system events"
-description: "The system events command description and usage"
-keywords: "system, events, container, report"
----
-
-<!-- This file is maintained within the moby/moby Github
-     repository at https://github.com/moby/moby/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# system events
-
-```markdown
-Usage:  docker system events [OPTIONS]
-
-Get real time events from the server
-
-Options:
-  -f, --filter value   Filter output based on conditions provided (default [])
-      --format string  Format the output using the given Go template
-      --help           Print usage
-      --since string   Show all events created since timestamp
-      --until string   Stream events until this timestamp
-```
-
-## Description
-
-Use `docker system events` to get real-time events from the server. These
-events differ per Docker object type.
-
-### Object types
-
-#### Containers
-
-Docker containers report the following events:
-
-- `attach`
-- `commit`
-- `copy`
-- `create`
-- `destroy`
-- `detach`
-- `die`
-- `exec_create`
-- `exec_detach`
-- `exec_start`
-- `export`
-- `health_status`
-- `kill`
-- `oom`
-- `pause`
-- `rename`
-- `resize`
-- `restart`
-- `start`
-- `stop`
-- `top`
-- `unpause`
-- `update`
-
-#### Images
-
-Docker images report the following events:
-
-- `delete`
-- `import`
-- `load`
-- `pull`
-- `push`
-- `save`
-- `tag`
-- `untag`
-
-#### Plugins
-
-Docker plugins report the following events:
-
-- `install`
-- `enable`
-- `disable`
-- `remove`
-
-#### Volumes
-
-Docker volumes report the following events:
-
-- `create`
-- `mount`
-- `unmount`
-- `destroy`
-
-#### Networks
-
-Docker networks report the following events:
-
-- `create`
-- `connect`
-- `disconnect`
-- `destroy`
-
-#### Daemons
-
-Docker daemons report the following events:
-
-- `reload`
-
-### Limiting, filtering, and formatting the output
-
-#### Limit events by time
-
-The `--since` and `--until` parameters can be Unix timestamps, date formatted
-timestamps, or Go duration strings (e.g. `10m`, `1h30m`) computed
-relative to the client machine’s time. If you do not provide the `--since` option,
-the command returns only new and/or live events.  Supported formats for date
-formatted time stamps include RFC3339Nano, RFC3339, `2006-01-02T15:04:05`,
-`2006-01-02T15:04:05.999999999`, `2006-01-02Z07:00`, and `2006-01-02`. The local
-timezone on the client will be used if you do not provide either a `Z` or a
-`+-00:00` timezone offset at the end of the timestamp.  When providing Unix
-timestamps enter seconds[.nanoseconds], where seconds is the number of seconds
-that have elapsed since January 1, 1970 (midnight UTC/GMT), not counting leap
-seconds (aka Unix epoch or Unix time), and the optional .nanoseconds field is a
-fraction of a second no more than nine digits long.
-
-#### Filtering
-
-The filtering flag (`-f` or `--filter`) format is of "key=value". If you would
-like to use multiple filters, pass multiple flags (e.g.,
-`--filter "foo=bar" --filter "bif=baz"`)
-
-Using the same filter multiple times will be handled as a *OR*; for example
-`--filter container=588a23dac085 --filter container=a8f7720b8c22` will display
-events for container 588a23dac085 *OR* container a8f7720b8c22
-
-Using multiple filters will be handled as a *AND*; for example
-`--filter container=588a23dac085 --filter event=start` will display events for
-container container 588a23dac085 *AND* the event type is *start*
-
-The currently supported filters are:
-
-* container (`container=<name or id>`)
-* daemon (`daemon=<name or id>`)
-* event (`event=<event action>`)
-* image (`image=<tag or id>`)
-* label (`label=<key>` or `label=<key>=<value>`)
-* network (`network=<name or id>`)
-* plugin (`plugin=<name or id>`)
-* type (`type=<container or image or volume or network or daemon or plugin>`)
-* volume (`volume=<name or id>`)
-
-#### Format
-
-If a format (`--format`) is specified, the given template will be executed
-instead of the default
-format. Go's [text/template](http://golang.org/pkg/text/template/) package
-describes all the details of the format.
-
-If a format is set to `{{json .}}`, the events are streamed as valid JSON
-Lines. For information about JSON Lines, please refer to http://jsonlines.org/ .
-
-## Examples
-
-### Basic example
-
-You'll need two shells for this example.
-
-**Shell 1: Listening for events:**
-
-```bash
-$ docker system events
-```
-
-**Shell 2: Start and Stop containers:**
-
-```bash
-$ docker create --name test alpine:latest top
-$ docker start test
-$ docker stop test
-```
-
-**Shell 1: (Again .. now showing events):**
-
-```none
-2017-01-05T00:35:58.859401177+08:00 container create 0fdb48addc82871eb34eb23a847cfd033dedd1a0a37bef2e6d9eb3870fc7ff37 (image=alpine:latest, name=test)
-2017-01-05T00:36:04.703631903+08:00 network connect e2e1f5ceda09d4300f3a846f0acfaa9a8bb0d89e775eb744c5acecd60e0529e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:04.795031609+08:00 container start 0fdb...ff37 (image=alpine:latest, name=test)
-2017-01-05T00:36:09.830268747+08:00 container kill 0fdb...ff37 (image=alpine:latest, name=test, signal=15)
-2017-01-05T00:36:09.840186338+08:00 container die 0fdb...ff37 (exitCode=143, image=alpine:latest, name=test)
-2017-01-05T00:36:09.880113663+08:00 network disconnect e2e...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:09.890214053+08:00 container stop 0fdb...ff37 (image=alpine:latest, name=test)
-```
-
-To exit the `docker system events` command, use `CTRL+C`.
-
-### Filter events by time
-
-You can filter the output by an absolute timestamp or relative time on the host
-machine, using the following different time syntaxes:
-
-```bash
-$ docker system events --since 1483283804
-2017-01-05T00:35:41.241772953+08:00 volume create testVol (driver=local)
-2017-01-05T00:35:58.859401177+08:00 container create d9cd...4d70 (image=alpine:latest, name=test)
-2017-01-05T00:36:04.703631903+08:00 network connect e2e1...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:04.795031609+08:00 container start 0fdb...ff37 (image=alpine:latest, name=test)
-2017-01-05T00:36:09.830268747+08:00 container kill 0fdb...ff37 (image=alpine:latest, name=test, signal=15)
-2017-01-05T00:36:09.840186338+08:00 container die 0fdb...ff37 (exitCode=143, image=alpine:latest, name=test)
-2017-01-05T00:36:09.880113663+08:00 network disconnect e2e...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:09.890214053+08:00 container stop 0fdb...ff37 (image=alpine:latest, name=test)
-
-$ docker system events --since '2017-01-05'
-2017-01-05T00:35:41.241772953+08:00 volume create testVol (driver=local)
-2017-01-05T00:35:58.859401177+08:00 container create d9cd...4d70 (image=alpine:latest, name=test)
-2017-01-05T00:36:04.703631903+08:00 network connect e2e1...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:04.795031609+08:00 container start 0fdb...ff37 (image=alpine:latest, name=test)
-2017-01-05T00:36:09.830268747+08:00 container kill 0fdb...ff37 (image=alpine:latest, name=test, signal=15)
-2017-01-05T00:36:09.840186338+08:00 container die 0fdb...ff37 (exitCode=143, image=alpine:latest, name=test)
-2017-01-05T00:36:09.880113663+08:00 network disconnect e2e...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:09.890214053+08:00 container stop 0fdb...ff37 (image=alpine:latest, name=test)
-
-$ docker system events --since '2013-09-03T15:49:29'
-2017-01-05T00:35:41.241772953+08:00 volume create testVol (driver=local)
-2017-01-05T00:35:58.859401177+08:00 container create d9cd...4d70 (image=alpine:latest, name=test)
-2017-01-05T00:36:04.703631903+08:00 network connect e2e1...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:04.795031609+08:00 container start 0fdb...ff37 (image=alpine:latest, name=test)
-2017-01-05T00:36:09.830268747+08:00 container kill 0fdb...ff37 (image=alpine:latest, name=test, signal=15)
-2017-01-05T00:36:09.840186338+08:00 container die 0fdb...ff37 (exitCode=143, image=alpine:latest, name=test)
-2017-01-05T00:36:09.880113663+08:00 network disconnect e2e...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:09.890214053+08:00 container stop 0fdb...ff37 (image=alpine:latest, name=test)
-
-$ docker system events --since '10m'
-2017-01-05T00:35:41.241772953+08:00 volume create testVol (driver=local)
-2017-01-05T00:35:58.859401177+08:00 container create d9cd...4d70 (image=alpine:latest, name=test)
-2017-01-05T00:36:04.703631903+08:00 network connect e2e1...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:04.795031609+08:00 container start 0fdb...ff37 (image=alpine:latest, name=test)
-2017-01-05T00:36:09.830268747+08:00 container kill 0fdb...ff37 (image=alpine:latest, name=test, signal=15)
-2017-01-05T00:36:09.840186338+08:00 container die 0fdb...ff37 (exitCode=143, image=alpine:latest, name=test)
-2017-01-05T00:36:09.880113663+08:00 network disconnect e2e...29e2 (container=0fdb...ff37, name=bridge, type=bridge)
-2017-01-05T00:36:09.890214053+08:00 container stop 0fdb...ff37 (image=alpine:latest, name=test)
-```
-
-### Filter events by criteria
-
-The following commands show several different ways to filter the `docker event`
-output.
-
-```bash
-$ docker system events --filter 'event=stop'
-
-2017-01-05T00:40:22.880175420+08:00 container stop 0fdb...ff37 (image=alpine:latest, name=test)
-2017-01-05T00:41:17.888104182+08:00 container stop 2a8f...4e78 (image=alpine, name=kickass_brattain)
-
-$ docker system events --filter 'image=alpine'
-
-2017-01-05T00:41:55.784240236+08:00 container create d9cd...4d70 (image=alpine, name=happy_meitner)
-2017-01-05T00:41:55.913156783+08:00 container start d9cd...4d70 (image=alpine, name=happy_meitner)
-2017-01-05T00:42:01.106875249+08:00 container kill d9cd...4d70 (image=alpine, name=happy_meitner, signal=15)
-2017-01-05T00:42:11.111934041+08:00 container kill d9cd...4d70 (image=alpine, name=happy_meitner, signal=9)
-2017-01-05T00:42:11.119578204+08:00 container die d9cd...4d70 (exitCode=137, image=alpine, name=happy_meitner)
-2017-01-05T00:42:11.173276611+08:00 container stop d9cd...4d70 (image=alpine, name=happy_meitner)
-
-$ docker system events --filter 'container=test'
-
-2017-01-05T00:43:00.139719934+08:00 container start 0fdb...ff37 (image=alpine:latest, name=test)
-2017-01-05T00:43:09.259951086+08:00 container kill 0fdb...ff37 (image=alpine:latest, name=test, signal=15)
-2017-01-05T00:43:09.270102715+08:00 container die 0fdb...ff37 (exitCode=143, image=alpine:latest, name=test)
-2017-01-05T00:43:09.312556440+08:00 container stop 0fdb...ff37 (image=alpine:latest, name=test)
-
-$ docker system events --filter 'container=test' --filter 'container=d9cdb1525ea8'
-
-2017-01-05T00:44:11.517071981+08:00 container start 0fdb...ff37 (image=alpine:latest, name=test)
-2017-01-05T00:44:17.685870901+08:00 container start d9cd...4d70 (image=alpine, name=happy_meitner)
-2017-01-05T00:44:29.757658470+08:00 container kill 0fdb...ff37 (image=alpine:latest, name=test, signal=9)
-2017-01-05T00:44:29.767718510+08:00 container die 0fdb...ff37 (exitCode=137, image=alpine:latest, name=test)
-2017-01-05T00:44:29.815798344+08:00 container destroy 0fdb...ff37 (image=alpine:latest, name=test)
-
-$ docker system events --filter 'container=test' --filter 'event=stop'
-
-2017-01-05T00:46:13.664099505+08:00 container stop a9d1...e130 (image=alpine, name=test)
-
-$ docker system events --filter 'type=volume'
-
-2015-12-23T21:05:28.136212689Z volume create test-event-volume-local (driver=local)
-2015-12-23T21:05:28.383462717Z volume mount test-event-volume-local (read/write=true, container=562f...5025, destination=/foo, driver=local, propagation=rprivate)
-2015-12-23T21:05:28.650314265Z volume unmount test-event-volume-local (container=562f...5025, driver=local)
-2015-12-23T21:05:28.716218405Z volume destroy test-event-volume-local (driver=local)
-
-$ docker system events --filter 'type=network'
-
-2015-12-23T21:38:24.705709133Z network create 8b11...2c5b (name=test-event-network-local, type=bridge)
-2015-12-23T21:38:25.119625123Z network connect 8b11...2c5b (name=test-event-network-local, container=b4be...c54e, type=bridge)
-
-$ docker system events --filter 'container=container_1' --filter 'container=container_2'
-
-2014-09-03T15:49:29.999999999Z07:00 container die 4386fb97867d (image=ubuntu-1:14.04)
-2014-05-10T17:42:14.999999999Z07:00 container stop 4386fb97867d (image=ubuntu-1:14.04)
-2014-05-10T17:42:14.999999999Z07:00 container die 7805c1d35632 (imager=redis:2.8)
-2014-09-03T15:49:29.999999999Z07:00 container stop 7805c1d35632 (image=redis:2.8)
-
-$ docker system events --filter 'type=volume'
-
-2015-12-23T21:05:28.136212689Z volume create test-event-volume-local (driver=local)
-2015-12-23T21:05:28.383462717Z volume mount test-event-volume-local (read/write=true, container=562fe10671e9273da25eed36cdce26159085ac7ee6707105fd534866340a5025, destination=/foo, driver=local, propagation=rprivate)
-2015-12-23T21:05:28.650314265Z volume unmount test-event-volume-local (container=562fe10671e9273da25eed36cdce26159085ac7ee6707105fd534866340a5025, driver=local)
-2015-12-23T21:05:28.716218405Z volume destroy test-event-volume-local (driver=local)
-
-$ docker system events --filter 'type=network'
-
-2015-12-23T21:38:24.705709133Z network create 8b111217944ba0ba844a65b13efcd57dc494932ee2527577758f939315ba2c5b (name=test-event-network-local, type=bridge)
-2015-12-23T21:38:25.119625123Z network connect 8b111217944ba0ba844a65b13efcd57dc494932ee2527577758f939315ba2c5b (name=test-event-network-local, container=b4be644031a3d90b400f88ab3d4bdf4dc23adb250e696b6328b85441abe2c54e, type=bridge)
-
-$ docker system events --filter 'type=plugin'
-
-2016-07-25T17:30:14.825557616Z plugin pull ec7b87f2ce84330fe076e666f17dfc049d2d7ae0b8190763de94e1f2d105993f (name=tiborvass/sample-volume-plugin:latest)
-2016-07-25T17:30:14.888127370Z plugin enable ec7b87f2ce84330fe076e666f17dfc049d2d7ae0b8190763de94e1f2d105993f (name=tiborvass/sample-volume-plugin:latest)
-```
-
-### Format the output
-
-```bash
-$ docker system events --filter 'type=container' --format 'Type={{.Type}}  Status={{.Status}}  ID={{.ID}}'
-
-Type=container  Status=create  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-Type=container  Status=attach  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-Type=container  Status=start  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-Type=container  Status=resize  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-Type=container  Status=die  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-Type=container  Status=destroy  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-```
-
-#### Format as JSON
-
-```none
-    $ docker system events --format '{{json .}}'
-
-    {"status":"create","id":"196016a57679bf42424484918746a9474cd905dd993c4d0f4..
-    {"status":"attach","id":"196016a57679bf42424484918746a9474cd905dd993c4d0f4..
-    {"Type":"network","Action":"connect","Actor":{"ID":"1b50a5bf755f6021dfa78e..
-    {"status":"start","id":"196016a57679bf42424484918746a9474cd905dd993c4d0f42..
-    {"status":"resize","id":"196016a57679bf42424484918746a9474cd905dd993c4d0f4..
-```
diff --git a/components/engine/docs/reference/commandline/system_prune.md b/components/engine/docs/reference/commandline/system_prune.md
deleted file mode 100644
index e09fec4d7f..0000000000
--- a/components/engine/docs/reference/commandline/system_prune.md
+++ /dev/null
@@ -1,110 +0,0 @@
----
-title: "system prune"
-description: "Remove unused data"
-keywords: "system, prune, delete, remove"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# system prune
-
-```markdown
-Usage:	docker system prune [OPTIONS]
-
-Delete unused data
-
-Options:
-  -a, --all             Remove all unused images not just dangling ones
-      --filter filter   Provide filter values (e.g. 'until=<timestamp>')
-  -f, --force           Do not prompt for confirmation
-      --help            Print usage
-```
-
-## Description
-
-Remove all unused containers, volumes, networks and images (both dangling and unreferenced).
-
-## Examples
-
-```bash
-$ docker system prune -a
-
-WARNING! This will remove:
-	- all stopped containers
-	- all volumes not used by at least one container
-	- all networks not used by at least one container
-	- all images without at least one container associated to them
-Are you sure you want to continue? [y/N] y
-Deleted Containers:
-0998aa37185a1a7036b0e12cf1ac1b6442dcfa30a5c9650a42ed5010046f195b
-73958bfb884fa81fa4cc6baf61055667e940ea2357b4036acbbe25a60f442a4d
-
-Deleted Volumes:
-named-vol
-
-Deleted Images:
-untagged: my-curl:latest
-deleted: sha256:7d88582121f2a29031d92017754d62a0d1a215c97e8f0106c586546e7404447d
-deleted: sha256:dd14a93d83593d4024152f85d7c63f76aaa4e73e228377ba1d130ef5149f4d8b
-untagged: alpine:3.3
-deleted: sha256:695f3d04125db3266d4ab7bbb3c6b23aa4293923e762aa2562c54f49a28f009f
-untagged: alpine:latest
-deleted: sha256:ee4603260daafe1a8c2f3b78fd760922918ab2441cbb2853ed5c439e59c52f96
-deleted: sha256:9007f5987db353ec398a223bc5a135c5a9601798ba20a1abba537ea2f8ac765f
-deleted: sha256:71fa90c8f04769c9721459d5aa0936db640b92c8c91c9b589b54abd412d120ab
-deleted: sha256:bb1c3357b3c30ece26e6604aea7d2ec0ace4166ff34c3616701279c22444c0f3
-untagged: my-jq:latest
-deleted: sha256:6e66d724542af9bc4c4abf4a909791d7260b6d0110d8e220708b09e4ee1322e1
-deleted: sha256:07b3fa89d4b17009eb3988dfc592c7d30ab3ba52d2007832dffcf6d40e3eda7f
-deleted: sha256:3a88a5c81eb5c283e72db2dbc6d65cbfd8e80b6c89bb6e714cfaaa0eed99c548
-
-Total reclaimed space: 13.5 MB
-```
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is of "key=value". If there is more
-than one filter, then pass multiple flags (e.g., `--filter "foo=bar" --filter "bif=baz"`)
-
-The currently supported filters are:
-
-* until (`<timestamp>`) - only remove containers, images, and networks created before given timestamp
-* label (`label=<key>`, `label=<key>=<value>`, `label!=<key>`, or `label!=<key>=<value>`) - only remove containers, images, networks, and volumes with (or without, in case `label!=...` is used) the specified labels.
-
-The `until` filter can be Unix timestamps, date formatted
-timestamps, or Go duration strings (e.g. `10m`, `1h30m`) computed
-relative to the daemon machine’s time. Supported formats for date
-formatted time stamps include RFC3339Nano, RFC3339, `2006-01-02T15:04:05`,
-`2006-01-02T15:04:05.999999999`, `2006-01-02Z07:00`, and `2006-01-02`. The local
-timezone on the daemon will be used if you do not provide either a `Z` or a
-`+-00:00` timezone offset at the end of the timestamp.  When providing Unix
-timestamps enter seconds[.nanoseconds], where seconds is the number of seconds
-that have elapsed since January 1, 1970 (midnight UTC/GMT), not counting leap
-seconds (aka Unix epoch or Unix time), and the optional .nanoseconds field is a
-fraction of a second no more than nine digits long.
-
-The `label` filter accepts two formats. One is the `label=...` (`label=<key>` or `label=<key>=<value>`),
-which removes containers, images, networks, and volumes with the specified labels. The other
-format is the `label!=...` (`label!=<key>` or `label!=<key>=<value>`), which removes
-containers, images, networks, and volumes without the specified labels.
-
-## Related commands
-
-* [volume create](volume_create.md)
-* [volume ls](volume_ls.md)
-* [volume inspect](volume_inspect.md)
-* [volume rm](volume_rm.md)
-* [volume prune](volume_prune.md)
-* [Understand Data Volumes](https://docs.docker.com/engine/tutorials/dockervolumes/)
-* [system df](system_df.md)
-* [container prune](container_prune.md)
-* [image prune](image_prune.md)
-* [network prune](network_prune.md)
-* [system prune](system_prune.md)
diff --git a/components/engine/docs/reference/commandline/tag.md b/components/engine/docs/reference/commandline/tag.md
deleted file mode 100644
index 5f9defd8a9..0000000000
--- a/components/engine/docs/reference/commandline/tag.md
+++ /dev/null
@@ -1,84 +0,0 @@
----
-title: "tag"
-description: "The tag command description and usage"
-keywords: "tag, name, image"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# tag
-
-```markdown
-Usage:  docker tag SOURCE_IMAGE[:TAG] TARGET_IMAGE[:TAG]
-
-Create a tag TARGET_IMAGE that refers to SOURCE_IMAGE
-
-Options:
-      --help   Print usage
-```
-
-## Description
-
-An image name is made up of slash-separated name components, optionally prefixed
-by a registry hostname. The hostname must comply with standard DNS rules, but
-may not contain underscores. If a hostname is present, it may optionally be
-followed by a port number in the format `:8080`. If not present, the command
-uses Docker's public registry located at `registry-1.docker.io` by default. Name
-components may contain lowercase letters, digits and separators. A separator
-is defined as a period, one or two underscores, or one or more dashes. A name
-component may not start or end with a separator.
-
-A tag name must be valid ASCII and may contain lowercase and uppercase letters,
-digits, underscores, periods and dashes. A tag name may not start with a
-period or a dash and may contain a maximum of 128 characters.
-
-You can group your images together using names and tags, and then upload them
-to [*Share Images via Repositories*](https://docs.docker.com/engine/tutorials/dockerrepos/#/contributing-to-docker-hub).
-
-## Examples
-
-### Tag an image referenced by ID
-
-To tag a local image with ID "0e5574283393" into the "fedora" repository with
-"version1.0":
-
-```bash
-$ docker tag 0e5574283393 fedora/httpd:version1.0
-```
-
-### Tag an image referenced by Name
-
-To tag a local image with name "httpd" into the "fedora" repository with
-"version1.0":
-
-```bash
-$ docker tag httpd fedora/httpd:version1.0
-```
-
-Note that since the tag name is not specified, the alias is created for an
-existing local version `httpd:latest`.
-
-### Tag an image referenced by Name and Tag
-
-To tag a local image with name "httpd" and tag "test" into the "fedora"
-repository with "version1.0.test":
-
-```bash
-$ docker tag httpd:test fedora/httpd:version1.0.test
-```
-
-### Tag an image for a private repository
-
-To push an image to a private registry and not the central Docker
-registry you must tag it with the registry hostname and port (if needed).
-
-```bash
-$ docker tag 0e5574283393 myregistryhost:5000/fedora/httpd:version1.0
-```
diff --git a/components/engine/docs/reference/commandline/top.md b/components/engine/docs/reference/commandline/top.md
deleted file mode 100644
index 0a04828775..0000000000
--- a/components/engine/docs/reference/commandline/top.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-title: "top"
-description: "The top command description and usage"
-keywords: "container, running, processes"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# top
-
-```markdown
-Usage:  docker top CONTAINER [ps OPTIONS]
-
-Display the running processes of a container
-
-Options:
-      --help   Print usage
-```
diff --git a/components/engine/docs/reference/commandline/unpause.md b/components/engine/docs/reference/commandline/unpause.md
deleted file mode 100644
index 8915a43b40..0000000000
--- a/components/engine/docs/reference/commandline/unpause.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-title: "unpause"
-description: "The unpause command description and usage"
-keywords: "cgroups, suspend, container"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# unpause
-
-```markdown
-Usage:  docker unpause CONTAINER [CONTAINER...]
-
-Unpause all processes within one or more containers
-
-Options:
-      --help   Print usage
-```
-
-## Description
-
-The `docker unpause` command un-suspends all processes in the specified containers.
-On Linux, it does this using the cgroups freezer.
-
-See the
-[cgroups freezer documentation](https://www.kernel.org/doc/Documentation/cgroup-v1/freezer-subsystem.txt)
-for further details.
-
-## Examples
-
-```bash
-$ docker unpause my_container
-```
-
-## Related commands
-
-* [pause](pause.md)
diff --git a/components/engine/docs/reference/commandline/update.md b/components/engine/docs/reference/commandline/update.md
deleted file mode 100644
index 935dc9bf36..0000000000
--- a/components/engine/docs/reference/commandline/update.md
+++ /dev/null
@@ -1,123 +0,0 @@
----
-title: "update"
-description: "The update command description and usage"
-keywords: "resources, update, dynamically"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-## update
-
-```markdown
-Usage:  docker update [OPTIONS] CONTAINER [CONTAINER...]
-
-Update configuration of one or more containers
-
-Options:
-      --blkio-weight uint16         Block IO (relative weight), between 10 and 1000, or 0 to disable (default 0)
-      --cpu-period int              Limit CPU CFS (Completely Fair Scheduler) period
-      --cpu-quota int               Limit CPU CFS (Completely Fair Scheduler) quota
-      --cpu-rt-period int           Limit the CPU real-time period in microseconds
-      --cpu-rt-runtime int          Limit the CPU real-time runtime in microseconds
-  -c, --cpu-shares int              CPU shares (relative weight)
-      --cpus decimal                Number of CPUs (default 0.000)
-      --cpuset-cpus string          CPUs in which to allow execution (0-3, 0,1)
-      --cpuset-mems string          MEMs in which to allow execution (0-3, 0,1)
-      --help                        Print usage
-      --kernel-memory string        Kernel memory limit
-  -m, --memory string               Memory limit
-      --memory-reservation string   Memory soft limit
-      --memory-swap string          Swap limit equal to memory plus swap: '-1' to enable unlimited swap
-      --restart string              Restart policy to apply when a container exits
-```
-
-## Description
-
-The `docker update` command dynamically updates container configuration.
-You can use this command to prevent containers from consuming too many
-resources from their Docker host.  With a single command, you can place
-limits on a single container or on many. To specify more than one container,
-provide space-separated list of container names or IDs.
-
-With the exception of the `--kernel-memory` option, you can specify these
-options on a running or a stopped container. On kernel version older than
-4.6, you can only update `--kernel-memory` on a stopped container or on
-a running container with kernel memory initialized.
-
-## Examples
-
-The following sections illustrate ways to use this command.
-
-### Update a container's cpu-shares
-
-To limit a container's cpu-shares to 512, first identify the container
-name or ID. You can use `docker ps` to find these values. You can also
-use the ID returned from the `docker run` command.  Then, do the following:
-
-```bash
-$ docker update --cpu-shares 512 abebf7571666
-```
-
-### Update a container with cpu-shares and memory
-
-To update multiple resource configurations for multiple containers:
-
-```bash
-$ docker update --cpu-shares 512 -m 300M abebf7571666 hopeful_morse
-```
-
-### Update a container's kernel memory constraints
-
-You can update a container's kernel memory limit using the `--kernel-memory`
-option. On kernel version older than 4.6, this option can be updated on a
-running container only if the container was started with `--kernel-memory`.
-If the container was started *without* `--kernel-memory` you need to stop
-the container before updating kernel memory.
-
-For example, if you started a container with this command:
-
-```bash
-$ docker run -dit --name test --kernel-memory 50M ubuntu bash
-```
-
-You can update kernel memory while the container is running:
-
-```bash
-$ docker update --kernel-memory 80M test
-```
-
-If you started a container *without* kernel memory initialized:
-
-```bash
-$ docker run -dit --name test2 --memory 300M ubuntu bash
-```
-
-Update kernel memory of running container `test2` will fail. You need to stop
-the container before updating the `--kernel-memory` setting. The next time you
-start it, the container uses the new value.
-
-Kernel version newer than (include) 4.6 does not have this limitation, you
-can use `--kernel-memory` the same way as other options.
-
-### Update a container's restart policy
-
-You can change a container's restart policy on a running container. The new
-restart policy takes effect instantly after you run `docker update` on a
-container.
-
-To update restart policy for one or more containers:
-
-```bash
-$ docker update --restart=on-failure:3 abebf7571666 hopeful_morse
-```
-
-Note that if the container is started with "--rm" flag, you cannot update the restart
-policy for it. The `AutoRemove` and `RestartPolicy` are mutually exclusive for the
-container.
diff --git a/components/engine/docs/reference/commandline/version.md b/components/engine/docs/reference/commandline/version.md
deleted file mode 100644
index b15d13b97f..0000000000
--- a/components/engine/docs/reference/commandline/version.md
+++ /dev/null
@@ -1,74 +0,0 @@
----
-title: "version"
-description: "The version command description and usage"
-keywords: "version, architecture, api"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# version
-
-```markdown
-Usage:  docker version [OPTIONS]
-
-Show the Docker version information
-
-Options:
-  -f, --format string   Format the output using the given Go template
-      --help            Print usage
-```
-
-## Description
-
-By default, this will render all version information in an easy to read
-layout. If a format is specified, the given template will be executed instead.
-
-Go's [text/template](http://golang.org/pkg/text/template/) package
-describes all the details of the format.
-
-## Examples
-
-### Default output
-
-```bash
-$ docker version
-
-Client:
-Version:      1.8.0
-API version:  1.20
-Go version:   go1.4.2
-Git commit:   f5bae0a
-Built:        Tue Jun 23 17:56:00 UTC 2015
-OS/Arch:      linux/amd64
-
-Server:
-Version:      1.8.0
-API version:  1.20
-Go version:   go1.4.2
-Git commit:   f5bae0a
-Built:        Tue Jun 23 17:56:00 UTC 2015
-OS/Arch:      linux/amd64
-```
-
-### Get the server version
-
-```bash
-$ docker version --format '{{.Server.Version}}'
-
-1.8.0
-```
-
-### Dump raw JSON data
-
-```bash
-$ docker version --format '{{json .}}'
-
-{"Client":{"Version":"1.8.0","ApiVersion":"1.20","GitCommit":"f5bae0a","GoVersion":"go1.4.2","Os":"linux","Arch":"amd64","BuildTime":"Tue Jun 23 17:56:00 UTC 2015"},"ServerOK":true,"Server":{"Version":"1.8.0","ApiVersion":"1.20","GitCommit":"f5bae0a","GoVersion":"go1.4.2","Os":"linux","Arch":"amd64","KernelVersion":"3.13.2-gentoo","BuildTime":"Tue Jun 23 17:56:00 UTC 2015"}}
-```
diff --git a/components/engine/docs/reference/commandline/volume.md b/components/engine/docs/reference/commandline/volume.md
deleted file mode 100644
index d5dd9c592f..0000000000
--- a/components/engine/docs/reference/commandline/volume.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-title: "volume"
-description: "The volume command description and usage"
-keywords: "volume"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# volume
-
-```markdown
-Usage:  docker volume COMMAND
-
-Manage volumes
-
-Options:
-      --help   Print usage
-
-Commands:
-  create      Create a volume
-  inspect     Display detailed information on one or more volumes
-  ls          List volumes
-  prune       Remove all unused volumes
-  rm          Remove one or more volumes
-
-Run 'docker volume COMMAND --help' for more information on a command.
-```
-
-## Description
-
-Manage volumes. You can use subcommands to create, inspect, list, remove, or
-prune volumes.
-
-## Related commands
-
-* [volume create](volume_create.md)
-* [volume inspect](volume_inspect.md)
-* [volume list](volume_list.md)
-* [volume rm](volume_rm.md)
-* [volume prune](volume_prune.md)
-* [Understand Data Volumes](https://docs.docker.com/engine/tutorials/dockervolumes/)
diff --git a/components/engine/docs/reference/commandline/volume_create.md b/components/engine/docs/reference/commandline/volume_create.md
deleted file mode 100644
index b1eed37b5c..0000000000
--- a/components/engine/docs/reference/commandline/volume_create.md
+++ /dev/null
@@ -1,125 +0,0 @@
----
-title: "volume create"
-description: "The volume create command description and usage"
-keywords: "volume, create"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# volume create
-
-```markdown
-Usage:  docker volume create [OPTIONS] [VOLUME]
-
-Create a volume
-
-Options:
-  -d, --driver string   Specify volume driver name (default "local")
-      --help            Print usage
-      --label value     Set metadata for a volume (default [])
-  -o, --opt value       Set driver specific options (default map[])
-```
-
-## Description
-
-Creates a new volume that containers can consume and store data in. If a name is
-not specified, Docker generates a random name.
-
-## Examples
-
-Create a volume and then configure the container to use it:
-
-```bash
-$ docker volume create hello
-
-hello
-
-$ docker run -d -v hello:/world busybox ls /world
-```
-
-The mount is created inside the container's `/world` directory. Docker does not
-support relative paths for mount points inside the container.
-
-Multiple containers can use the same volume in the same time period. This is
-useful if two containers need access to shared data. For example, if one
-container writes and the other reads the data.
-
-Volume names must be unique among drivers. This means you cannot use the same
-volume name with two different drivers. If you attempt this `docker` returns an
-error:
-
-```none
-A volume named  "hello"  already exists with the "some-other" driver. Choose a different volume name.
-```
-
-If you specify a volume name already in use on the current driver, Docker
-assumes you want to re-use the existing volume and does not return an error.
-
-### Driver-specific options
-
-Some volume drivers may take options to customize the volume creation. Use the
-`-o` or `--opt` flags to pass driver options:
-
-```bash
-$ docker volume create --driver fake \
-    --opt tardis=blue \
-    --opt timey=wimey \
-    foo
-```
-
-These options are passed directly to the volume driver. Options for
-different volume drivers may do different things (or nothing at all).
-
-The built-in `local` driver on Windows does not support any options.
-
-The built-in `local` driver on Linux accepts options similar to the linux
-`mount` command. You can provide multiple options by passing the `--opt` flag
-multiple times. Some `mount` options (such as the `o` option) can take a
-comma-separated list of options. Complete list of available mount options can be
-found [here](http://man7.org/linux/man-pages/man8/mount.8.html).
-
-For example, the following creates a `tmpfs` volume called `foo` with a size of
-100 megabyte and `uid` of 1000.
-
-```bash
-$ docker volume create --driver local \
-    --opt type=tmpfs \
-    --opt device=tmpfs \
-    --opt o=size=100m,uid=1000 \
-    foo
-```
-
-Another example that uses `btrfs`:
-
-```bash
-$ docker volume create --driver local \
-    --opt type=btrfs \
-    --opt device=/dev/sda2 \
-    foo
-```
-
-Another example that uses `nfs` to mount the `/path/to/dir` in `rw` mode from
-`192.168.1.1`:
-
-```bash
-$ docker volume create --driver local \
-    --opt type=nfs \
-    --opt o=addr=192.168.1.1,rw \
-    --opt device=:/path/to/dir \
-    foo
-```
-
-## Related commands
-
-* [volume inspect](volume_inspect.md)
-* [volume ls](volume_ls.md)
-* [volume rm](volume_rm.md)
-* [volume prune](volume_prune.md)
-* [Understand Data Volumes](https://docs.docker.com/engine/tutorials/dockervolumes/)
diff --git a/components/engine/docs/reference/commandline/volume_inspect.md b/components/engine/docs/reference/commandline/volume_inspect.md
deleted file mode 100644
index bbdc6bd3ee..0000000000
--- a/components/engine/docs/reference/commandline/volume_inspect.md
+++ /dev/null
@@ -1,61 +0,0 @@
----
-title: "volume inspect"
-description: "The volume inspect command description and usage"
-keywords: "volume, inspect"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# volume inspect
-
-```markdown
-Usage:  docker volume inspect [OPTIONS] VOLUME [VOLUME...]
-
-Display detailed information on one or more volumes
-
-Options:
-  -f, --format string   Format the output using the given Go template
-      --help            Print usage
-```
-
-## Description
-
-Returns information about a volume. By default, this command renders all results
-in a JSON array. You can specify an alternate format to execute a
-given template for each result. Go's
-[text/template](http://golang.org/pkg/text/template/) package describes all the
-details of the format.
-
-## Examples
-
-```bash
-$ docker volume create
-85bffb0677236974f93955d8ecc4df55ef5070117b0e53333cc1b443777be24d
-$ docker volume inspect 85bffb0677236974f93955d8ecc4df55ef5070117b0e53333cc1b443777be24d
-[
-  {
-      "Name": "85bffb0677236974f93955d8ecc4df55ef5070117b0e53333cc1b443777be24d",
-      "Driver": "local",
-      "Mountpoint": "/var/lib/docker/volumes/85bffb0677236974f93955d8ecc4df55ef5070117b0e53333cc1b443777be24d/_data",
-      "Status": null
-  }
-]
-
-$ docker volume inspect --format '{{ .Mountpoint }}' 85bffb0677236974f93955d8ecc4df55ef5070117b0e53333cc1b443777be24d
-/var/lib/docker/volumes/85bffb0677236974f93955d8ecc4df55ef5070117b0e53333cc1b443777be24d/_data
-```
-
-## Related commands
-
-* [volume create](volume_create.md)
-* [volume ls](volume_ls.md)
-* [volume rm](volume_rm.md)
-* [volume prune](volume_prune.md)
-* [Understand Data Volumes](https://docs.docker.com/engine/tutorials/dockervolumes/)
diff --git a/components/engine/docs/reference/commandline/volume_ls.md b/components/engine/docs/reference/commandline/volume_ls.md
deleted file mode 100644
index 713922d60f..0000000000
--- a/components/engine/docs/reference/commandline/volume_ls.md
+++ /dev/null
@@ -1,199 +0,0 @@
----
-title: "volume ls"
-description: "The volume ls command description and usage"
-keywords: "volume, list"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# volume ls
-
-```markdown
-Usage:  docker volume ls [OPTIONS]
-
-List volumes
-
-Aliases:
-  ls, list
-
-Options:
-  -f, --filter value   Provide filter values (e.g. 'dangling=true') (default [])
-                       - dangling=<boolean> a volume if referenced or not
-                       - driver=<string> a volume's driver name
-                       - label=<key> or label=<key>=<value>
-                       - name=<string> a volume's name
-      --format string  Pretty-print volumes using a Go template
-      --help           Print usage
-  -q, --quiet          Only display volume names
-```
-
-## Description
-
-List all the volumes known to Docker. You can filter using the `-f` or
-`--filter` flag. Refer to the [filtering](#filtering) section for more
-information about available filter options.
-
-## Examples
-
-### Create a volume
-```bash
-$ docker volume create rosemary
-
-rosemary
-
-$ docker volume create tyler
-
-tyler
-
-$ docker volume ls
-
-DRIVER              VOLUME NAME
-local               rosemary
-local               tyler
-```
-
-### Filtering
-
-The filtering flag (`-f` or `--filter`) format is of "key=value". If there is more
-than one filter, then pass multiple flags (e.g., `--filter "foo=bar" --filter "bif=baz"`)
-
-The currently supported filters are:
-
-* dangling (boolean - true or false, 0 or 1)
-* driver (a volume driver's name)
-* label (`label=<key>` or `label=<key>=<value>`)
-* name (a volume's name)
-
-#### dangling
-
-The `dangling` filter matches on all volumes not referenced by any containers
-
-```bash
-$ docker run -d  -v tyler:/tmpwork  busybox
-
-f86a7dd02898067079c99ceacd810149060a70528eff3754d0b0f1a93bd0af18
-$ docker volume ls -f dangling=true
-DRIVER              VOLUME NAME
-local               rosemary
-```
-
-#### driver
-
-The `driver` filter matches volumes based on their driver.
-
-The following example matches volumes that are created with the `local` driver:
-
-```bash
-$ docker volume ls -f driver=local
-
-DRIVER              VOLUME NAME
-local               rosemary
-local               tyler
-```
-
-#### label
-
-The `label` filter matches volumes based on the presence of a `label` alone or
-a `label` and a value.
-
-First, let's create some volumes to illustrate this;
-
-```bash
-$ docker volume create the-doctor --label is-timelord=yes
-
-the-doctor
-$ docker volume create daleks --label is-timelord=no
-
-daleks
-```
-
-The following example filter matches volumes with the `is-timelord` label
-regardless of its value.
-
-```bash
-$ docker volume ls --filter label=is-timelord
-
-DRIVER              VOLUME NAME
-local               daleks
-local               the-doctor
-```
-
-As the above example demonstrates, both volumes with `is-timelord=yes`, and
-`is-timelord=no` are returned.
-
-Filtering on both `key` *and* `value` of the label, produces the expected result:
-
-```bash
-$ docker volume ls --filter label=is-timelord=yes
-
-DRIVER              VOLUME NAME
-local               the-doctor
-```
-
-Specifying multiple label filter produces an "and" search; all conditions
-should be met;
-
-```bash
-$ docker volume ls --filter label=is-timelord=yes --filter label=is-timelord=no
-
-DRIVER              VOLUME NAME
-```
-
-#### name
-
-The `name` filter matches on all or part of a volume's name.
-
-The following filter matches all volumes with a name containing the `rose` string.
-
-```bash
-$ docker volume ls -f name=rose
-
-DRIVER              VOLUME NAME
-local               rosemary
-```
-
-### Formatting
-
-The formatting options (`--format`) pretty-prints volumes output
-using a Go template.
-
-Valid placeholders for the Go template are listed below:
-
-Placeholder   | Description
---------------|------------------------------------------------------------------------------------------
-`.Name`       | Network name
-`.Driver`     | Network driver
-`.Scope`      | Network scope (local, global)
-`.Mountpoint` | Whether the network is internal or not.
-`.Labels`     | All labels assigned to the volume.
-`.Label`      | Value of a specific label for this volume. For example `{{.Label "project.version"}}`
-
-When using the `--format` option, the `volume ls` command will either
-output the data exactly as the template declares or, when using the
-`table` directive, includes column headers as well.
-
-The following example uses a template without headers and outputs the
-`Name` and `Driver` entries separated by a colon for all volumes:
-
-```bash
-$ docker volume ls --format "{{.Name}}: {{.Driver}}"
-
-vol1: local
-vol2: local
-vol3: local
-```
-
-## Related commands
-
-* [volume create](volume_create.md)
-* [volume inspect](volume_inspect.md)
-* [volume rm](volume_rm.md)
-* [volume prune](volume_prune.md)
-* [Understand Data Volumes](https://docs.docker.com/engine/tutorials/dockervolumes/)
diff --git a/components/engine/docs/reference/commandline/volume_prune.md b/components/engine/docs/reference/commandline/volume_prune.md
deleted file mode 100644
index 7a1ae76c69..0000000000
--- a/components/engine/docs/reference/commandline/volume_prune.md
+++ /dev/null
@@ -1,73 +0,0 @@
----
-title: "volume prune"
-description: "Remove unused volumes"
-keywords: "volume, prune, delete"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# volume prune
-
-```markdown
-Usage:	docker volume prune [OPTIONS]
-
-Remove all unused volumes
-
-Options:
-      --filter filter   Provide filter values (e.g. 'label=<label>')
-  -f, --force           Do not prompt for confirmation
-      --help            Print usage
-```
-
-## Description
-
-Remove all unused volumes. Unused volumes are those which are not referenced by any containers
-
-## Examples
-
-```bash
-$ docker volume prune
-
-WARNING! This will remove all volumes not used by at least one container.
-Are you sure you want to continue? [y/N] y
-Deleted Volumes:
-07c7bdf3e34ab76d921894c2b834f073721fccfbbcba792aa7648e3a7a664c2e
-my-named-vol
-
-Total reclaimed space: 36 B
-```
-
-## Filtering
-
-The filtering flag (`-f` or `--filter`) format is of "key=value". If there is more
-than one filter, then pass multiple flags (e.g., `--filter "foo=bar" --filter "bif=baz"`)
-
-The currently supported filters are:
-
-* label (`label=<key>`, `label=<key>=<value>`, `label!=<key>`, or `label!=<key>=<value>`) - only remove volumes with (or without, in case `label!=...` is used) the specified labels.
-
-The `label` filter accepts two formats. One is the `label=...` (`label=<key>` or `label=<key>=<value>`),
-which removes volumes with the specified labels. The other
-format is the `label!=...` (`label!=<key>` or `label!=<key>=<value>`), which removes
-volumes without the specified labels.
-
-
-## Related commands
-
-* [volume create](volume_create.md)
-* [volume ls](volume_ls.md)
-* [volume inspect](volume_inspect.md)
-* [volume rm](volume_rm.md)
-* [Understand Data Volumes](https://docs.docker.com/engine/tutorials/dockervolumes/)
-* [system df](system_df.md)
-* [container prune](container_prune.md)
-* [image prune](image_prune.md)
-* [network prune](network_prune.md)
-* [system prune](system_prune.md)
diff --git a/components/engine/docs/reference/commandline/volume_rm.md b/components/engine/docs/reference/commandline/volume_rm.md
deleted file mode 100644
index a1f2d3b9ff..0000000000
--- a/components/engine/docs/reference/commandline/volume_rm.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-title: "volume rm"
-description: "the volume rm command description and usage"
-keywords: "volume, rm"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# volume rm
-
-```markdown
-Usage:  docker volume rm [OPTIONS] VOLUME [VOLUME...]
-
-Remove one or more volumes
-
-Aliases:
-  rm, remove
-
-Options:
-  -f, --force  Force the removal of one or more volumes
-      --help   Print usage
-```
-
-## Description
-
-Remove one or more volumes. You cannot remove a volume that is in use by a container.
-
-## Examples
-
-```bash
-  $ docker volume rm hello
-  hello
-```
-
-## Related commands
-
-* [volume create](volume_create.md)
-* [volume inspect](volume_inspect.md)
-* [volume ls](volume_ls.md)
-* [volume prune](volume_prune.md)
-* [Understand Data Volumes](https://docs.docker.com/engine/tutorials/dockervolumes/)
diff --git a/components/engine/docs/reference/commandline/wait.md b/components/engine/docs/reference/commandline/wait.md
deleted file mode 100644
index a4a65415de..0000000000
--- a/components/engine/docs/reference/commandline/wait.md
+++ /dev/null
@@ -1,58 +0,0 @@
----
-title: "wait"
-description: "The wait command description and usage"
-keywords: "container, stop, wait"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# wait
-
-```markdown
-Usage:  docker wait CONTAINER [CONTAINER...]
-
-Block until one or more containers stop, then print their exit codes
-
-Options:
-      --help        Print usage
-```
-
-> **Note**: `docker wait` returns `0` when run against a container which had
-> already exited before the `docker wait` command was run.
-
-## Examples
-
-Start a container in the background.
-
-```bash
-$ docker run -dit --name=my_container ubuntu bash
-```
-
-Run `docker wait`, which should block until the container exits.
-
-```bash
-$ docker wait my_container
-```
-
-In another terminal, stop the first container. The `docker wait` command above
-returns the exit code.
-
-```bash
-$ docker stop my_container
-```
-
-This is the same `docker wait` command from above, but it now exits, returning
-`0`.
-
-```bash
-$ docker wait my_container
-
-0
-```
diff --git a/components/engine/docs/reference/glossary.md b/components/engine/docs/reference/glossary.md
deleted file mode 100644
index f829ad54c0..0000000000
--- a/components/engine/docs/reference/glossary.md
+++ /dev/null
@@ -1,374 +0,0 @@
----
-title: "Docker Glossary"
-description: "Glossary of terms used around Docker"
-keywords: "glossary, docker, terms, definitions"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# Glossary
-
-A list of terms used around the Docker project.
-
-## aufs
-
-aufs (advanced multi layered unification filesystem) is a Linux [filesystem](#filesystem) that
-Docker supports as a storage backend. It implements the
-[union mount](http://en.wikipedia.org/wiki/Union_mount) for Linux file systems.
-
-## base image
-
-An image that has no parent is a **base image**.
-
-## boot2docker
-
-[boot2docker](http://boot2docker.io/) is a lightweight Linux distribution made
-specifically to run Docker containers. The boot2docker management tool for Mac and Windows was deprecated and replaced by [`docker-machine`](#machine) which you can install with the Docker Toolbox.
-
-## bridge
-
-In terms of generic networking, a bridge is a Link Layer device which forwards
-traffic between network segments. A bridge can be a hardware device or a
-software device running within a host machine's kernel.
-
-In terms of Docker, a bridge network uses a software bridge which allows
-containers connected to the same bridge network to communicate, while providing
-isolation from containers which are not connected to that bridge network.
-The Docker bridge driver automatically installs rules in the host machine so
-that containers on different bridge networks cannot communicate directly with
-each other.
-
-The default bridge network, which is also named `bridge`, behaves differently
-from user-defined bridge networks. Containers connected to the default `bridge`
-network can communicate with each other across the bridge by IP address but
-cannot resolve each other's container name to an IP address unless they are
-explicitly linked using the `--link` flag to `docker run`.
-
-For more information about Docker networking, see
-[Understand container communication](https://docs.docker.com/engine/userguide/networking/default_network/container-communication/).
-
-## btrfs
-
-btrfs (B-tree file system) is a Linux [filesystem](#filesystem) that Docker
-supports as a storage backend. It is a [copy-on-write](http://en.wikipedia.org/wiki/Copy-on-write)
-filesystem.
-
-## build
-
-build is the process of building Docker images using a [Dockerfile](#dockerfile).
-The build uses a Dockerfile and a "context". The context is the set of files in the
-directory in which the image is built.
-
-## cgroups
-
-cgroups is a Linux kernel feature that limits, accounts for, and isolates
-the resource usage (CPU, memory, disk I/O, network, etc.) of a collection
-of processes. Docker relies on cgroups to control and isolate resource limits.
-
-*Also known as : control groups*
-
-## Compose
-
-[Compose](https://github.com/docker/compose) is a tool for defining and
-running complex applications with Docker. With compose, you define a
-multi-container application in a single file, then spin your
-application up in a single command which does everything that needs to
-be done to get it running.
-
-*Also known as : docker-compose, fig*
-
-## copy-on-write
-
-Docker uses a
-[copy-on-write](https://docs.docker.com/engine/userguide/storagedriver/imagesandcontainers/#/the-copy-on-write-strategy)
-technique and a [union file system](#union-file-system) for both images and
-containers to optimize resources and speed performance. Multiple copies of an
-entity share the same instance and each one makes only specific changes to its
-unique layer.
-
-Multiple containers can share access to the same image, and make
-container-specific changes on a writable layer which is deleted when
-the container is removed. This speeds up container start times and performance.
-
-Images are essentially layers of filesystems typically predicated on a base
-image under a writable layer, and built up with layers of differences from the
-base image. This minimizes the footprint of the image and enables shared
-development.
-
-For more about copy-on-write in the context of Docker, see [Understand images,
-containers, and storage
-drivers](https://docs.docker.com/engine/userguide/storagedriver/imagesandcontainers/).
-
-## container
-
-A container is a runtime instance of a [docker image](#image).
-
-A Docker container consists of
-
-- A Docker image
-- Execution environment
-- A standard set of instructions
-
-The concept is borrowed from Shipping Containers, which define a standard to ship
-goods globally. Docker defines a standard to ship software.
-
-## data volume
-
-A data volume is a specially-designated directory within one or more containers
-that bypasses the Union File System. Data volumes are designed to persist data,
-independent of the container's life cycle. Docker therefore never automatically
-delete volumes when you remove a container, nor will it "garbage collect"
-volumes that are no longer referenced by a container.
-
-
-## Docker
-
-The term Docker can refer to
-
-- The Docker project as a whole, which is a platform for developers and sysadmins to
-develop, ship, and run applications
-- The docker daemon process running on the host which manages images and containers
-
-
-## Docker for Mac
-
-[Docker for Mac](https://docs.docker.com/docker-for-mac/) is an easy-to-install,
-lightweight Docker development environment designed specifically for the Mac. A
-native Mac application, Docker for Mac uses the macOS Hypervisor framework,
-networking, and filesystem. It's the best solution if you want to build, debug,
-test, package, and ship Dockerized applications on a Mac. Docker for Mac
-supersedes [Docker Toolbox](#toolbox) as state-of-the-art Docker on macOS.
-
-
-## Docker for Windows
-
-[Docker for Windows](https://docs.docker.com/docker-for-windows/) is an
-easy-to-install, lightweight Docker development environment designed
-specifically for Windows 10 systems that support Microsoft Hyper-V
-(Professional, Enterprise and Education). Docker for Windows uses Hyper-V for
-virtualization, and runs as a native Windows app. It works with Windows Server
-2016, and gives you the ability to set up and run Windows containers as well as
-the standard Linux containers, with an option to switch between the two. Docker
-for Windows is the best solution if you want to build, debug, test, package, and
-ship Dockerized applications from Windows machines. Docker for Windows
-supersedes [Docker Toolbox](#toolbox) as state-of-the-art Docker on Windows.
-
-## Docker Hub
-
-The [Docker Hub](https://hub.docker.com/) is a centralized resource for working with
-Docker and its components. It provides the following services:
-
-- Docker image hosting
-- User authentication
-- Automated image builds and work-flow tools such as build triggers and web hooks
-- Integration with GitHub and Bitbucket
-
-
-## Dockerfile
-
-A Dockerfile is a text document that contains all the commands you would
-normally execute manually in order to build a Docker image. Docker can
-build images automatically by reading the instructions from a Dockerfile.
-
-## filesystem
-
-A file system is the method an operating system uses to name files
-and assign them locations for efficient storage and retrieval.
-
-Examples :
-
-- Linux : ext4, aufs, btrfs, zfs
-- Windows : NTFS
-- macOS : HFS+
-
-## image
-
-Docker images are the basis of [containers](#container). An Image is an
-ordered collection of root filesystem changes and the corresponding
-execution parameters for use within a container runtime. An image typically
-contains a union of layered filesystems stacked on top of each other. An image
-does not have state and it never changes.
-
-## libcontainer
-
-libcontainer provides a native Go implementation for creating containers with
-namespaces, cgroups, capabilities, and filesystem access controls. It allows
-you to manage the lifecycle of the container performing additional operations
-after the container is created.
-
-## libnetwork
-
-libnetwork provides a native Go implementation for creating and managing container
-network namespaces and other network resources. It manage the networking lifecycle
-of the container performing additional operations after the container is created.
-
-## link
-
-links provide a legacy interface to connect Docker containers running on the
-same host to each other without exposing the hosts' network ports. Use the
-Docker networks feature instead.
-
-## Machine
-
-[Machine](https://github.com/docker/machine) is a Docker tool which
-makes it really easy to create Docker hosts on  your computer, on
-cloud providers and inside your own data center. It creates servers,
-installs Docker on them, then configures the Docker client to talk to them.
-
-*Also known as : docker-machine*
-
-## node
-
-A [node](https://docs.docker.com/engine/swarm/how-swarm-mode-works/nodes/) is a physical or virtual
-machine running an instance of the Docker Engine in swarm mode.
-
-**Manager nodes** perform swarm management and orchestration duties. By default
-manager nodes are also worker nodes.
-
-**Worker nodes** execute tasks.
-
-## overlay network driver
-
-Overlay network driver provides out of the box multi-host network connectivity
-for docker containers in a cluster.
-
-## overlay storage driver
-
-OverlayFS is a [filesystem](#filesystem) service for Linux which implements a
-[union mount](http://en.wikipedia.org/wiki/Union_mount) for other file systems.
-It is supported by the Docker daemon as a storage driver.
-
-## registry
-
-A Registry is a hosted service containing [repositories](#repository) of [images](#image)
-which responds to the Registry API.
-
-The default registry can be accessed using a browser at [Docker Hub](#docker-hub)
-or using the `docker search` command.
-
-## repository
-
-A repository is a set of Docker images. A repository can be shared by pushing it
-to a [registry](#registry) server. The different images in the repository can be
-labeled using [tags](#tag).
-
-Here is an example of the shared [nginx repository](https://hub.docker.com/_/nginx/)
-and its [tags](https://hub.docker.com/r/library/nginx/tags/)
-
-
-## service
-
-A [service](https://docs.docker.com/engine/swarm/how-swarm-mode-works/services/) is the definition of how
-you want to run your application containers in a swarm. At the most basic level
-a service  defines which container image to run in the swarm and which commands
-to run in the container. For orchestration purposes, the service defines the
-"desired state", meaning how many containers to run as tasks and constraints for
-deploying the containers.
-
-Frequently a service is a microservice within the context of some larger
-application. Examples of services might include an HTTP server, a database, or
-any other type of executable program that you wish to run in a distributed
-environment.
-
-## service discovery
-
-Swarm mode [service discovery](https://docs.docker.com/engine/swarm/networking/#use-swarm-mode-service-discovery) is a DNS component
-internal to the swarm that automatically assigns each service on an overlay
-network in the swarm a VIP and DNS entry. Containers on the network share DNS
-mappings for the service via gossip so any container on the network can access
-the service via its service name.
-
-You don’t need to expose service-specific ports to make the service available to
-other services on the same overlay network. The swarm’s internal load balancer
-automatically distributes requests to the service VIP among the active tasks.
-
-## swarm
-
-A [swarm](https://docs.docker.com/engine/swarm/) is a cluster of one or more Docker Engines running in [swarm mode](#swarm-mode).
-
-## Docker Swarm
-
-Do not confuse [Docker Swarm](https://github.com/docker/swarm) with the [swarm mode](#swarm-mode) features in Docker Engine.
-
-Docker Swarm is the name of a standalone native clustering tool for Docker.
-Docker Swarm pools together several Docker hosts and exposes them as a single
-virtual Docker host. It serves the standard Docker API, so any tool that already
-works with Docker can now transparently scale up to multiple hosts.
-
-*Also known as : docker-swarm*
-
-## swarm mode
-
-[Swarm mode](https://docs.docker.com/engine/swarm/) refers to cluster management and orchestration
-features embedded in Docker Engine. When you initialize a new swarm (cluster) or
-join nodes to a swarm, the Docker Engine runs in swarm mode.
-
-## tag
-
-A tag is a label applied to a Docker image in a [repository](#repository).
-tags are how various images in a repository are distinguished from each other.
-
-*Note : This label is not related to the key=value labels set for docker daemon*
-
-## task
-
-A [task](https://docs.docker.com/engine/swarm/how-swarm-mode-works/services/#/tasks-and-scheduling) is the
-atomic unit of scheduling within a swarm. A task carries a Docker container and
-the commands to run inside the container. Manager nodes assign tasks to worker
-nodes according to the number of replicas set in the service scale.
-
-The diagram below illustrates the relationship of services to tasks and
-containers.
-
-![services diagram](https://docs.docker.com/engine/swarm/images/services-diagram.png)
-
-## Toolbox
-
-[Docker Toolbox](https://docs.docker.com/toolbox/overview/) is a legacy
-installer for Mac and Windows users. It uses Oracle VirtualBox for
-virtualization.
-
-For Macs running OS X El Capitan 10.11 and newer macOS releases, [Docker for
-Mac](https://docs.docker.com/docker-for-mac/) is the better solution.
-
-For Windows 10 systems that support Microsoft Hyper-V (Professional, Enterprise
-and Education), [Docker for
-Windows](https://docs.docker.com/docker-for-windows/) is the better solution.
-
-## Union file system
-
-Union file systems implement a [union
-mount](https://en.wikipedia.org/wiki/Union_mount) and operate by creating
-layers. Docker uses union file systems in conjunction with
-[copy-on-write](#copy-on-write) techniques to provide the building blocks for
-containers, making them very lightweight and fast.
-
-For more on Docker and union file systems, see [Docker and AUFS in
-practice](https://docs.docker.com/engine/userguide/storagedriver/aufs-driver/),
-[Docker and Btrfs in
-practice](https://docs.docker.com/engine/userguide/storagedriver/btrfs-driver/),
-and [Docker and OverlayFS in
-practice](https://docs.docker.com/engine/userguide/storagedriver/overlayfs-driver/)
-
-Example implementations of union file systems are
-[UnionFS](https://en.wikipedia.org/wiki/UnionFS),
-[AUFS](https://en.wikipedia.org/wiki/Aufs), and
-[Btrfs](https://btrfs.wiki.kernel.org/index.php/Main_Page).
-
-## virtual machine
-
-A virtual machine is a program that emulates a complete computer and imitates dedicated hardware.
-It shares physical hardware resources with other users but isolates the operating system. The
-end user has the same experience on a Virtual Machine as they would have on dedicated hardware.
-
-Compared to containers, a virtual machine is heavier to run, provides more isolation,
-gets its own set of resources and does minimal sharing.
-
-*Also known as : VM*
diff --git a/components/engine/docs/reference/index.md b/components/engine/docs/reference/index.md
deleted file mode 100644
index f24c342dfc..0000000000
--- a/components/engine/docs/reference/index.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-title: "Engine reference"
-description: "Docker Engine reference"
-keywords: "Engine"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# Engine reference
-
-* [Dockerfile reference](builder.md)
-* [Docker run reference](run.md)
-* [Command line reference](commandline/index.md)
-* [API Reference](https://docs.docker.com/engine/api/)
diff --git a/components/engine/docs/reference/run.md b/components/engine/docs/reference/run.md
deleted file mode 100644
index b209343b58..0000000000
--- a/components/engine/docs/reference/run.md
+++ /dev/null
@@ -1,1605 +0,0 @@
----
-title: "Docker run reference"
-description: "Configure containers at runtime"
-keywords: "docker, run, configure, runtime"
----
-
-<!-- This file is maintained within the docker/docker Github
-     repository at https://github.com/docker/docker/. Make all
-     pull requests against that repo. If you see this file in
-     another repository, consider it read-only there, as it will
-     periodically be overwritten by the definitive file. Pull
-     requests which include edits to this file in other repositories
-     will be rejected.
--->
-
-# Docker run reference
-
-Docker runs processes in isolated containers. A container is a process
-which runs on a host. The host may be local or remote. When an operator
-executes `docker run`, the container process that runs is isolated in
-that it has its own file system, its own networking, and its own
-isolated process tree separate from the host.
-
-This page details how to use the `docker run` command to define the
-container's resources at runtime.
-
-## General form
-
-The basic `docker run` command takes this form:
-
-    $ docker run [OPTIONS] IMAGE[:TAG|@DIGEST] [COMMAND] [ARG...]
-
-The `docker run` command must specify an [*IMAGE*](glossary.md#image)
-to derive the container from. An image developer can define image
-defaults related to:
-
- * detached or foreground running
- * container identification
- * network settings
- * runtime constraints on CPU and memory
-
-With the `docker run [OPTIONS]` an operator can add to or override the
-image defaults set by a developer. And, additionally, operators can
-override nearly all the defaults set by the Docker runtime itself. The
-operator's ability to override image and Docker runtime defaults is why
-[*run*](commandline/run.md) has more options than any
-other `docker` command.
-
-To learn how to interpret the types of `[OPTIONS]`, see [*Option
-types*](commandline/cli.md#option-types).
-
-> **Note**: Depending on your Docker system configuration, you may be
-> required to preface the `docker run` command with `sudo`. To avoid
-> having to use `sudo` with the `docker` command, your system
-> administrator can create a Unix group called `docker` and add users to
-> it. For more information about this configuration, refer to the Docker
-> installation documentation for your operating system.
-
-
-## Operator exclusive options
-
-Only the operator (the person executing `docker run`) can set the
-following options.
-
- - [Detached vs foreground](#detached-vs-foreground)
-     - [Detached (-d)](#detached--d)
-     - [Foreground](#foreground)
- - [Container identification](#container-identification)
-     - [Name (--name)](#name---name)
-     - [PID equivalent](#pid-equivalent)
- - [IPC settings (--ipc)](#ipc-settings---ipc)
- - [Network settings](#network-settings)
- - [Restart policies (--restart)](#restart-policies---restart)
- - [Clean up (--rm)](#clean-up---rm)
- - [Runtime constraints on resources](#runtime-constraints-on-resources)
- - [Runtime privilege and Linux capabilities](#runtime-privilege-and-linux-capabilities)
-
-## Detached vs foreground
-
-When starting a Docker container, you must first decide if you want to
-run the container in the background in a "detached" mode or in the
-default foreground mode:
-
-    -d=false: Detached mode: Run container in the background, print new container id
-
-### Detached (-d)
-
-To start a container in detached mode, you use `-d=true` or just `-d` option. By
-design, containers started in detached mode exit when the root process used to
-run the container exits. A container in detached mode cannot be automatically
-removed when it stops, this means you cannot use the `--rm` option with `-d` option.
-
-Do not pass a `service x start` command to a detached container. For example, this
-command attempts to start the `nginx` service.
-
-    $ docker run -d -p 80:80 my_image service nginx start
-
-This succeeds in starting the `nginx` service inside the container. However, it
-fails the detached container paradigm in that, the root process (`service nginx
-start`) returns and the detached container stops as designed. As a result, the
-`nginx` service is started but could not be used. Instead, to start a process
-such as the `nginx` web server do the following:
-
-    $ docker run -d -p 80:80 my_image nginx -g 'daemon off;'
-
-To do input/output with a detached container use network connections or shared
-volumes. These are required because the container is no longer listening to the
-command line where `docker run` was run.
-
-To reattach to a detached container, use `docker`
-[*attach*](commandline/attach.md) command.
-
-### Foreground
-
-In foreground mode (the default when `-d` is not specified), `docker
-run` can start the process in the container and attach the console to
-the process's standard input, output, and standard error. It can even
-pretend to be a TTY (this is what most command line executables expect)
-and pass along signals. All of that is configurable:
-
-    -a=[]           : Attach to `STDIN`, `STDOUT` and/or `STDERR`
-    -t              : Allocate a pseudo-tty
-    --sig-proxy=true: Proxy all received signals to the process (non-TTY mode only)
-    -i              : Keep STDIN open even if not attached
-
-If you do not specify `-a` then Docker will [attach to both stdout and stderr
-]( https://github.com/docker/docker/blob/4118e0c9eebda2412a09ae66e90c34b85fae3275/runconfig/opts/parse.go#L267).
-You can specify to which of the three standard streams (`STDIN`, `STDOUT`,
-`STDERR`) you'd like to connect instead, as in:
-
-    $ docker run -a stdin -a stdout -i -t ubuntu /bin/bash
-
-For interactive processes (like a shell), you must use `-i -t` together in
-order to allocate a tty for the container process. `-i -t` is often written `-it`
-as you'll see in later examples.  Specifying `-t` is forbidden when the client
-is receiving its standard input from a pipe, as in:
-
-    $ echo test | docker run -i busybox cat
-
->**Note**: A process running as PID 1 inside a container is treated
->specially by Linux: it ignores any signal with the default action.
->So, the process will not terminate on `SIGINT` or `SIGTERM` unless it is
->coded to do so.
-
-## Container identification
-
-### Name (--name)
-
-The operator can identify a container in three ways:
-
-| Identifier type       | Example value                                                      |
-| --------------------- | ------------------------------------------------------------------ |
-| UUID long identifier  | "f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778" |
-| UUID short identifier | "f78375b1c487"                                                     |
-| Name                  | "evil_ptolemy"                                                     |
-
-The UUID identifiers come from the Docker daemon. If you do not assign a
-container name with the `--name` option, then the daemon generates a random
-string name for you. Defining a `name` can be a handy way to add meaning to a
-container. If you specify a `name`, you can use it  when referencing the
-container within a Docker network. This works for both background and foreground
-Docker containers.
-
-> **Note**: Containers on the default bridge network must be linked to
-> communicate by name.
-
-### PID equivalent
-
-Finally, to help with automation, you can have Docker write the
-container ID out to a file of your choosing. This is similar to how some
-programs might write out their process ID to a file (you've seen them as
-PID files):
-
-    --cidfile="": Write the container ID to the file
-
-### Image[:tag]
-
-While not strictly a means of identifying a container, you can specify a version of an
-image you'd like to run the container with by adding `image[:tag]` to the command. For
-example, `docker run ubuntu:14.04`.
-
-### Image[@digest]
-
-Images using the v2 or later image format have a content-addressable identifier
-called a digest. As long as the input used to generate the image is unchanged,
-the digest value is predictable and referenceable.
-
-The following example runs a container from the `alpine` image with the
-`sha256:9cacb71397b640eca97488cf08582ae4e4068513101088e9f96c9814bfda95e0` digest:
-
-    $ docker run alpine@sha256:9cacb71397b640eca97488cf08582ae4e4068513101088e9f96c9814bfda95e0 date
-
-## PID settings (--pid)
-
-    --pid=""  : Set the PID (Process) Namespace mode for the container,
-                 'container:<name|id>': joins another container's PID namespace
-                 'host': use the host's PID namespace inside the container
-
-By default, all containers have the PID namespace enabled.
-
-PID namespace provides separation of processes. The PID Namespace removes the
-view of the system processes, and allows process ids to be reused including
-pid 1.
-
-In certain cases you want your container to share the host's process namespace,
-basically allowing processes within the container to see all of the processes
-on the system.  For example, you could build a container with debugging tools
-like `strace` or `gdb`, but want to use these tools when debugging processes
-within the container.
-
-### Example: run htop inside a container
-
-Create this Dockerfile:
-
-```
-FROM alpine:latest
-RUN apk add --update htop && rm -rf /var/cache/apk/*
-CMD ["htop"]
-```
-
-Build the Dockerfile and tag the image as `myhtop`:
-
-```bash
-$ docker build -t myhtop .
-```
-
-Use the following command to run `htop` inside a container:
-
-```
-$ docker run -it --rm --pid=host myhtop
-```
-
-Joining another container's pid namespace can be used for debugging that container.
-
-### Example
-
-Start a container running a redis server:
-
-```bash
-$ docker run --name my-redis -d redis
-```
-
-Debug the redis container by running another container that has strace in it:
-
-```bash
-$ docker run -it --pid=container:my-redis my_strace_docker_image bash
-$ strace -p 1
-```
-
-## UTS settings (--uts)
-
-    --uts=""  : Set the UTS namespace mode for the container,
-           'host': use the host's UTS namespace inside the container
-
-The UTS namespace is for setting the hostname and the domain that is visible
-to running processes in that namespace.  By default, all containers, including
-those with `--network=host`, have their own UTS namespace.  The `host` setting will
-result in the container using the same UTS namespace as the host.  Note that
-`--hostname` is invalid in `host` UTS mode.
-
-You may wish to share the UTS namespace with the host if you would like the
-hostname of the container to change as the hostname of the host changes.  A
-more advanced use case would be changing the host's hostname from a container.
-
-## IPC settings (--ipc)
-
-    --ipc=""  : Set the IPC mode for the container,
-                 'container:<name|id>': reuses another container's IPC namespace
-                 'host': use the host's IPC namespace inside the container
-
-By default, all containers have the IPC namespace enabled.
-
-IPC (POSIX/SysV IPC) namespace provides separation of named shared memory
-segments, semaphores and message queues.
-
-Shared memory segments are used to accelerate inter-process communication at
-memory speed, rather than through pipes or through the network stack. Shared
-memory is commonly used by databases and custom-built (typically C/OpenMPI,
-C++/using boost libraries) high performance applications for scientific
-computing and financial services industries. If these types of applications
-are broken into multiple containers, you might need to share the IPC mechanisms
-of the containers.
-
-## Network settings
-
-    --dns=[]           : Set custom dns servers for the container
-    --network="bridge" : Connect a container to a network
-                          'bridge': create a network stack on the default Docker bridge
-                          'none': no networking
-                          'container:<name|id>': reuse another container's network stack
-                          'host': use the Docker host network stack
-                          '<network-name>|<network-id>': connect to a user-defined network
-    --network-alias=[] : Add network-scoped alias for the container
-    --add-host=""      : Add a line to /etc/hosts (host:IP)
-    --mac-address=""   : Sets the container's Ethernet device's MAC address
-    --ip=""            : Sets the container's Ethernet device's IPv4 address
-    --ip6=""           : Sets the container's Ethernet device's IPv6 address
-    --link-local-ip=[] : Sets one or more container's Ethernet device's link local IPv4/IPv6 addresses
-
-By default, all containers have networking enabled and they can make any
-outgoing connections. The operator can completely disable networking
-with `docker run --network none` which disables all incoming and outgoing
-networking. In cases like this, you would perform I/O through files or
-`STDIN` and `STDOUT` only.
-
-Publishing ports and linking to other containers only works with the default (bridge). The linking feature is a legacy feature. You should always prefer using Docker network drivers over linking.
-
-Your container will use the same DNS servers as the host by default, but
-you can override this with `--dns`.
-
-By default, the MAC address is generated using the IP address allocated to the
-container. You can set the container's MAC address explicitly by providing a
-MAC address via the `--mac-address` parameter (format:`12:34:56:78:9a:bc`).Be
-aware that Docker does not check if manually specified MAC addresses are unique.
-
-Supported networks :
-
-<table>
-  <thead>
-    <tr>
-      <th class="no-wrap">Network</th>
-      <th>Description</th>
-    </tr>
-  </thead>
-  <tbody>
-    <tr>
-      <td class="no-wrap"><strong>none</strong></td>
-      <td>
-        No networking in the container.
-      </td>
-    </tr>
-    <tr>
-      <td class="no-wrap"><strong>bridge</strong> (default)</td>
-      <td>
-        Connect the container to the bridge via veth interfaces.
-      </td>
-    </tr>
-    <tr>
-      <td class="no-wrap"><strong>host</strong></td>
-      <td>
-        Use the host's network stack inside the container.
-      </td>
-    </tr>
-    <tr>
-      <td class="no-wrap"><strong>container</strong>:&lt;name|id&gt;</td>
-      <td>
-        Use the network stack of another container, specified via
-        its <i>name</i> or <i>id</i>.
-      </td>
-    </tr>
-    <tr>
-      <td class="no-wrap"><strong>NETWORK</strong></td>
-      <td>
-        Connects the container to a user created network (using <code>docker network create</code> command)
-      </td>
-    </tr>
-  </tbody>
-</table>
-
-#### Network: none
-
-With the network is `none` a container will not have
-access to any external routes.  The container will still have a
-`loopback` interface enabled in the container but it does not have any
-routes to external traffic.
-
-#### Network: bridge
-
-With the network set to `bridge` a container will use docker's
-default networking setup.  A bridge is setup on the host, commonly named
-`docker0`, and a pair of `veth` interfaces will be created for the
-container.  One side of the `veth` pair will remain on the host attached
-to the bridge while the other side of the pair will be placed inside the
-container's namespaces in addition to the `loopback` interface.  An IP
-address will be allocated for containers on the bridge's network and
-traffic will be routed though this bridge to the container.
-
-Containers can communicate via their IP addresses by default. To communicate by
-name, they must be linked.
-
-#### Network: host
-
-With the network set to `host` a container will share the host's
-network stack and all interfaces from the host will be available to the
-container.  The container's hostname will match the hostname on the host
-system. Note that `--mac-address` is invalid in `host` netmode. Even in `host`
-network mode a container has its own UTS namespace by default. As such
-`--hostname` is allowed in `host` network mode and will only change the
-hostname inside the container.
-Similar to `--hostname`, the `--add-host`, `--dns`, `--dns-search`, and
-`--dns-option` options can be used in `host` network mode. These options update
-`/etc/hosts` or `/etc/resolv.conf` inside the container. No change are made to
-`/etc/hosts` and `/etc/resolv.conf` on the host.
-
-Compared to the default `bridge` mode, the `host` mode gives *significantly*
-better networking performance since it uses the host's native networking stack
-whereas the bridge has to go through one level of virtualization through the
-docker daemon. It is recommended to run containers in this mode when their
-networking performance is critical, for example, a production Load Balancer
-or a High Performance Web Server.
-
-> **Note**: `--network="host"` gives the container full access to local system
-> services such as D-bus and is therefore considered insecure.
-
-#### Network: container
-
-With the network set to `container` a container will share the
-network stack of another container.  The other container's name must be
-provided in the format of `--network container:<name|id>`. Note that `--add-host`
-`--hostname` `--dns` `--dns-search` `--dns-option` and `--mac-address` are
-invalid in `container` netmode, and `--publish` `--publish-all` `--expose` are
-also invalid in `container` netmode.
-
-Example running a Redis container with Redis binding to `localhost` then
-running the `redis-cli` command and connecting to the Redis server over the
-`localhost` interface.
-
-    $ docker run -d --name redis example/redis --bind 127.0.0.1
-    $ # use the redis container's network stack to access localhost
-    $ docker run --rm -it --network container:redis example/redis-cli -h 127.0.0.1
-
-#### User-defined network
-
-You can create a network using a Docker network driver or an external network
-driver plugin. You can connect multiple containers to the same network. Once
-connected to a user-defined network, the containers can communicate easily using
-only another container's IP address or name.
-
-For `overlay` networks or custom plugins that support multi-host connectivity,
-containers connected to the same multi-host network but launched from different
-Engines can also communicate in this way.
-
-The following example creates a network using the built-in `bridge` network
-driver and running a container in the created network
-
-```
-$ docker network create -d bridge my-net
-$ docker run --network=my-net -itd --name=container3 busybox
-```
-
-### Managing /etc/hosts
-
-Your container will have lines in `/etc/hosts` which define the hostname of the
-container itself as well as `localhost` and a few other common things. The
-`--add-host` flag can be used to add additional lines to `/etc/hosts`.
-
-    $ docker run -it --add-host db-static:86.75.30.9 ubuntu cat /etc/hosts
-    172.17.0.22     09d03f76bf2c
-    fe00::0         ip6-localnet
-    ff00::0         ip6-mcastprefix
-    ff02::1         ip6-allnodes
-    ff02::2         ip6-allrouters
-    127.0.0.1       localhost
-    ::1	            localhost ip6-localhost ip6-loopback
-    86.75.30.9      db-static
-
-If a container is connected to the default bridge network and `linked`
-with other containers, then the container's `/etc/hosts` file is updated
-with the linked container's name.
-
-> **Note** Since Docker may live update the container’s `/etc/hosts` file, there
-may be situations when processes inside the container can end up reading an
-empty or incomplete `/etc/hosts` file. In most cases, retrying the read again
-should fix the problem.
-
-## Restart policies (--restart)
-
-Using the `--restart` flag on Docker run you can specify a restart policy for
-how a container should or should not be restarted on exit.
-
-When a restart policy is active on a container, it will be shown as either `Up`
-or `Restarting` in [`docker ps`](commandline/ps.md). It can also be
-useful to use [`docker events`](commandline/events.md) to see the
-restart policy in effect.
-
-Docker supports the following restart policies:
-
-<table>
-  <thead>
-    <tr>
-      <th>Policy</th>
-      <th>Result</th>
-    </tr>
-  </thead>
-  <tbody>
-    <tr>
-      <td><strong>no</strong></td>
-      <td>
-        Do not automatically restart the container when it exits. This is the
-        default.
-      </td>
-    </tr>
-    <tr>
-      <td>
-        <span style="white-space: nowrap">
-          <strong>on-failure</strong>[:max-retries]
-        </span>
-      </td>
-      <td>
-        Restart only if the container exits with a non-zero exit status.
-        Optionally, limit the number of restart retries the Docker
-        daemon attempts.
-      </td>
-    </tr>
-    <tr>
-      <td><strong>always</strong></td>
-      <td>
-        Always restart the container regardless of the exit status.
-        When you specify always, the Docker daemon will try to restart
-        the container indefinitely. The container will also always start
-        on daemon startup, regardless of the current state of the container.
-      </td>
-    </tr>
-    <tr>
-      <td><strong>unless-stopped</strong></td>
-      <td>
-        Always restart the container regardless of the exit status, but
-        do not start it on daemon startup if the container has been put
-        to a stopped state before.
-      </td>
-    </tr>
-  </tbody>
-</table>
-
-An ever increasing delay (double the previous delay, starting at 100
-milliseconds) is added before each restart to prevent flooding the server.
-This means the daemon will wait for 100 ms, then 200 ms, 400, 800, 1600,
-and so on until either the `on-failure` limit is hit, or when you `docker stop`
-or `docker rm -f` the container.
-
-If a container is successfully restarted (the container is started and runs
-for at least 10 seconds), the delay is reset to its default value of 100 ms.
-
-You can specify the maximum amount of times Docker will try to restart the
-container when using the **on-failure** policy.  The default is that Docker
-will try forever to restart the container. The number of (attempted) restarts
-for a container can be obtained via [`docker inspect`](commandline/inspect.md). For example, to get the number of restarts
-for container "my-container";
-
-    {% raw %}
-    $ docker inspect -f "{{ .RestartCount }}" my-container
-    # 2
-    {% endraw %}
-
-Or, to get the last time the container was (re)started;
-
-    {% raw %}
-    $ docker inspect -f "{{ .State.StartedAt }}" my-container
-    # 2015-03-04T23:47:07.691840179Z
-    {% endraw %}
-
-
-Combining `--restart` (restart policy) with the `--rm` (clean up) flag results
-in an error. On container restart, attached clients are disconnected. See the
-examples on using the [`--rm` (clean up)](#clean-up-rm) flag later in this page.
-
-### Examples
-
-    $ docker run --restart=always redis
-
-This will run the `redis` container with a restart policy of **always**
-so that if the container exits, Docker will restart it.
-
-    $ docker run --restart=on-failure:10 redis
-
-This will run the `redis` container with a restart policy of **on-failure**
-and a maximum restart count of 10.  If the `redis` container exits with a
-non-zero exit status more than 10 times in a row Docker will abort trying to
-restart the container. Providing a maximum restart limit is only valid for the
-**on-failure** policy.
-
-## Exit Status
-
-The exit code from `docker run` gives information about why the container
-failed to run or why it exited.  When `docker run` exits with a non-zero code,
-the exit codes follow the `chroot` standard, see below:
-
-**_125_** if the error is with Docker daemon **_itself_**
-
-    $ docker run --foo busybox; echo $?
-    # flag provided but not defined: --foo
-      See 'docker run --help'.
-      125
-
-**_126_** if the **_contained command_** cannot be invoked
-
-    $ docker run busybox /etc; echo $?
-    # docker: Error response from daemon: Container command '/etc' could not be invoked.
-      126
-
-**_127_** if the **_contained command_** cannot be found
-
-    $ docker run busybox foo; echo $?
-    # docker: Error response from daemon: Container command 'foo' not found or does not exist.
-      127
-
-**_Exit code_** of **_contained command_** otherwise
-
-    $ docker run busybox /bin/sh -c 'exit 3'; echo $?
-    # 3
-
-## Clean up (--rm)
-
-By default a container's file system persists even after the container
-exits. This makes debugging a lot easier (since you can inspect the
-final state) and you retain all your data by default. But if you are
-running short-term **foreground** processes, these container file
-systems can really pile up. If instead you'd like Docker to
-**automatically clean up the container and remove the file system when
-the container exits**, you can add the `--rm` flag:
-
-    --rm=false: Automatically remove the container when it exits (incompatible with -d)
-
-> **Note**: When you set the `--rm` flag, Docker also removes the volumes
-associated with the container when the container is removed. This is similar
-to running `docker rm -v my-container`. Only volumes that are specified without a
-name are removed. For example, with
-`docker run --rm -v /foo -v awesome:/bar busybox top`, the volume for `/foo` will be removed,
-but the volume for `/bar` will not. Volumes inherited via `--volumes-from` will be removed
-with the same logic -- if the original volume was specified with a name it will **not** be removed.
-
-## Security configuration
-    --security-opt="label=user:USER"     : Set the label user for the container
-    --security-opt="label=role:ROLE"     : Set the label role for the container
-    --security-opt="label=type:TYPE"     : Set the label type for the container
-    --security-opt="label=level:LEVEL"   : Set the label level for the container
-    --security-opt="label=disable"       : Turn off label confinement for the container
-    --security-opt="apparmor=PROFILE"    : Set the apparmor profile to be applied to the container
-    --security-opt="no-new-privileges:true|false"   : Disable/enable container processes from gaining new privileges
-    --security-opt="seccomp=unconfined"  : Turn off seccomp confinement for the container
-    --security-opt="seccomp=profile.json": White listed syscalls seccomp Json file to be used as a seccomp filter
-
-
-You can override the default labeling scheme for each container by specifying
-the `--security-opt` flag. Specifying the level in the following command
-allows you to share the same content between containers.
-
-    $ docker run --security-opt label=level:s0:c100,c200 -it fedora bash
-
-> **Note**: Automatic translation of MLS labels is not currently supported.
-
-To disable the security labeling for this container versus running with the
-`--privileged` flag, use the following command:
-
-    $ docker run --security-opt label=disable -it fedora bash
-
-If you want a tighter security policy on the processes within a container,
-you can specify an alternate type for the container. You could run a container
-that is only allowed to listen on Apache ports by executing the following
-command:
-
-    $ docker run --security-opt label=type:svirt_apache_t -it centos bash
-
-> **Note**: You would have to write policy defining a `svirt_apache_t` type.
-
-If you want to prevent your container processes from gaining additional
-privileges, you can execute the following command:
-
-    $ docker run --security-opt no-new-privileges -it centos bash
-
-This means that commands that raise privileges such as `su` or `sudo` will no longer work.
-It also causes any seccomp filters to be applied later, after privileges have been dropped
-which may mean you can have a more restrictive set of filters.
-For more details, see the [kernel documentation](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt).
-
-## Specify an init process
-
-You can use the `--init` flag to indicate that an init process should be used as
-the PID 1 in the container. Specifying an init process ensures the usual
-responsibilities of an init system, such as reaping zombie processes, are
-performed inside the created container.
-
-The default init process used is the first `docker-init` executable found in the
-system path of the Docker daemon process. This `docker-init` binary, included in
-the default installation, is backed by [tini](https://github.com/krallin/tini).
-
-## Specify custom cgroups
-
-Using the `--cgroup-parent` flag, you can pass a specific cgroup to run a
-container in. This allows you to create and manage cgroups on their own. You can
-define custom resources for those cgroups and put containers under a common
-parent group.
-
-## Runtime constraints on resources
-
-The operator can also adjust the performance parameters of the
-container:
-
-| Option                     |  Description                                                                                                                                    |
-| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
-| `-m`, `--memory=""`        | Memory limit (format: `<number>[<unit>]`). Number is a positive integer. Unit can be one of `b`, `k`, `m`, or `g`. Minimum is 4M.               |
-| `--memory-swap=""`         | Total memory limit (memory + swap, format: `<number>[<unit>]`). Number is a positive integer. Unit can be one of `b`, `k`, `m`, or `g`.         |
-| `--memory-reservation=""`  | Memory soft limit (format: `<number>[<unit>]`). Number is a positive integer. Unit can be one of `b`, `k`, `m`, or `g`.                         |
-| `--kernel-memory=""`       | Kernel memory limit (format: `<number>[<unit>]`). Number is a positive integer. Unit can be one of `b`, `k`, `m`, or `g`. Minimum is 4M.        |
-| `-c`, `--cpu-shares=0`     | CPU shares (relative weight)                                                                                                                    |
-| `--cpus=0.000`             | Number of CPUs. Number is a fractional number. 0.000 means no limit.                                                                            |
-| `--cpu-period=0`           | Limit the CPU CFS (Completely Fair Scheduler) period                                                                                            |
-| `--cpuset-cpus=""`         | CPUs in which to allow execution (0-3, 0,1)                                                                                                     |
-| `--cpuset-mems=""`         | Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on NUMA systems.                                                     |
-| `--cpu-quota=0`            | Limit the CPU CFS (Completely Fair Scheduler) quota                                                                                             |
-| `--cpu-rt-period=0`        | Limit the CPU real-time period. In microseconds. Requires parent cgroups be set and cannot be higher than parent. Also check rtprio ulimits.    |
-| `--cpu-rt-runtime=0`       | Limit the CPU real-time runtime. In microseconds. Requires parent cgroups be set and cannot be higher than parent. Also check rtprio ulimits.   |
-| `--blkio-weight=0`         | Block IO weight (relative weight) accepts a weight value between 10 and 1000.                                                                   |
-| `--blkio-weight-device=""` | Block IO weight (relative device weight, format: `DEVICE_NAME:WEIGHT`)                                                                          |
-| `--device-read-bps=""`     | Limit read rate from a device (format: `<device-path>:<number>[<unit>]`). Number is a positive integer. Unit can be one of `kb`, `mb`, or `gb`. |
-| `--device-write-bps=""`    | Limit write rate to a device (format: `<device-path>:<number>[<unit>]`). Number is a positive integer. Unit can be one of `kb`, `mb`, or `gb`.  |
-| `--device-read-iops="" `   | Limit read rate (IO per second) from a device (format: `<device-path>:<number>`). Number is a positive integer.                                 |
-| `--device-write-iops="" `  | Limit write rate (IO per second) to a device (format: `<device-path>:<number>`). Number is a positive integer.                                  |
-| `--oom-kill-disable=false` | Whether to disable OOM Killer for the container or not.                                                                                         |
-| `--oom-score-adj=0`        | Tune container's OOM preferences (-1000 to 1000)                                                                                                |
-| `--memory-swappiness=""`   | Tune a container's memory swappiness behavior. Accepts an integer between 0 and 100.                                                            |
-| `--shm-size=""`            | Size of `/dev/shm`. The format is `<number><unit>`. `number` must be greater than `0`. Unit is optional and can be `b` (bytes), `k` (kilobytes), `m` (megabytes), or `g` (gigabytes). If you omit the unit, the system uses bytes. If you omit the size entirely, the system uses `64m`. |
-
-### User memory constraints
-
-We have four ways to set user memory usage:
-
-<table>
-  <thead>
-    <tr>
-      <th>Option</th>
-      <th>Result</th>
-    </tr>
-  </thead>
-  <tbody>
-    <tr>
-      <td class="no-wrap">
-          <strong>memory=inf, memory-swap=inf</strong> (default)
-      </td>
-      <td>
-        There is no memory limit for the container. The container can use
-        as much memory as needed.
-      </td>
-    </tr>
-    <tr>
-      <td class="no-wrap"><strong>memory=L&lt;inf, memory-swap=inf</strong></td>
-      <td>
-        (specify memory and set memory-swap as <code>-1</code>) The container is
-        not allowed to use more than L bytes of memory, but can use as much swap
-        as is needed (if the host supports swap memory).
-      </td>
-    </tr>
-    <tr>
-      <td class="no-wrap"><strong>memory=L&lt;inf, memory-swap=2*L</strong></td>
-      <td>
-        (specify memory without memory-swap) The container is not allowed to
-        use more than L bytes of memory, swap <i>plus</i> memory usage is double
-        of that.
-      </td>
-    </tr>
-    <tr>
-      <td class="no-wrap">
-          <strong>memory=L&lt;inf, memory-swap=S&lt;inf, L&lt;=S</strong>
-      </td>
-      <td>
-        (specify both memory and memory-swap) The container is not allowed to
-        use more than L bytes of memory, swap <i>plus</i> memory usage is limited
-        by S.
-      </td>
-    </tr>
-  </tbody>
-</table>
-
-Examples:
-
-    $ docker run -it ubuntu:14.04 /bin/bash
-
-We set nothing about memory, this means the processes in the container can use
-as much memory and swap memory as they need.
-
-    $ docker run -it -m 300M --memory-swap -1 ubuntu:14.04 /bin/bash
-
-We set memory limit and disabled swap memory limit, this means the processes in
-the container can use 300M memory and as much swap memory as they need (if the
-host supports swap memory).
-
-    $ docker run -it -m 300M ubuntu:14.04 /bin/bash
-
-We set memory limit only, this means the processes in the container can use
-300M memory and 300M swap memory, by default, the total virtual memory size
-(--memory-swap) will be set as double of memory, in this case, memory + swap
-would be 2*300M, so processes can use 300M swap memory as well.
-
-    $ docker run -it -m 300M --memory-swap 1G ubuntu:14.04 /bin/bash
-
-We set both memory and swap memory, so the processes in the container can use
-300M memory and 700M swap memory.
-
-Memory reservation is a kind of memory soft limit that allows for greater
-sharing of memory. Under normal circumstances, containers can use as much of
-the memory as needed and are constrained only by the hard limits set with the
-`-m`/`--memory` option. When memory reservation is set, Docker detects memory
-contention or low memory and forces containers to restrict their consumption to
-a reservation limit.
-
-Always set the memory reservation value below the hard limit, otherwise the hard
-limit takes precedence. A reservation of 0 is the same as setting no
-reservation. By default (without reservation set), memory reservation is the
-same as the hard memory limit.
-
-Memory reservation is a soft-limit feature and does not guarantee the limit
-won't be exceeded. Instead, the feature attempts to ensure that, when memory is
-heavily contended for, memory is allocated based on the reservation hints/setup.
-
-The following example limits the memory (`-m`) to 500M and sets the memory
-reservation to 200M.
-
-```bash
-$ docker run -it -m 500M --memory-reservation 200M ubuntu:14.04 /bin/bash
-```
-
-Under this configuration, when the container consumes memory more than 200M and
-less than 500M, the next system memory reclaim attempts to shrink container
-memory below 200M.
-
-The following example set memory reservation to 1G without a hard memory limit.
-
-```bash
-$ docker run -it --memory-reservation 1G ubuntu:14.04 /bin/bash
-```
-
-The container can use as much memory as it needs. The memory reservation setting
-ensures the container doesn't consume too much memory for long time, because
-every memory reclaim shrinks the container's consumption to the reservation.
-
-By default, kernel kills processes in a container if an out-of-memory (OOM)
-error occurs. To change this behaviour, use the `--oom-kill-disable` option.
-Only disable the OOM killer on containers where you have also set the
-`-m/--memory` option. If the `-m` flag is not set, this can result in the host
-running out of memory and require killing the host's system processes to free
-memory.
-
-The following example limits the memory to 100M and disables the OOM killer for
-this container:
-
-    $ docker run -it -m 100M --oom-kill-disable ubuntu:14.04 /bin/bash
-
-The following example, illustrates a dangerous way to use the flag:
-
-    $ docker run -it --oom-kill-disable ubuntu:14.04 /bin/bash
-
-The container has unlimited memory which can cause the host to run out memory
-and require killing system processes to free memory. The `--oom-score-adj`
-parameter can be changed to select the priority of which containers will
-be killed when the system is out of memory, with negative scores making them
-less likely to be killed, and positive scores more likely.
-
-### Kernel memory constraints
-
-Kernel memory is fundamentally different than user memory as kernel memory can't
-be swapped out. The inability to swap makes it possible for the container to
-block system services by consuming too much kernel memory. Kernel memory includes：
-
- - stack pages
- - slab pages
- - sockets memory pressure
- - tcp memory pressure
-
-You can setup kernel memory limit to constrain these kinds of memory. For example,
-every process consumes some stack pages. By limiting kernel memory, you can
-prevent new processes from being created when the kernel memory usage is too high.
-
-Kernel memory is never completely independent of user memory. Instead, you limit
-kernel memory in the context of the user memory limit. Assume "U" is the user memory
-limit and "K" the kernel limit. There are three possible ways to set limits:
-
-<table>
-  <thead>
-    <tr>
-      <th>Option</th>
-      <th>Result</th>
-    </tr>
-  </thead>
-  <tbody>
-    <tr>
-      <td class="no-wrap"><strong>U != 0, K = inf</strong> (default)</td>
-      <td>
-        This is the standard memory limitation mechanism already present before using
-        kernel memory. Kernel memory is completely ignored.
-      </td>
-    </tr>
-    <tr>
-      <td class="no-wrap"><strong>U != 0, K &lt; U</strong></td>
-      <td>
-        Kernel memory is a subset of the user memory. This setup is useful in
-        deployments where the total amount of memory per-cgroup is overcommitted.
-        Overcommitting kernel memory limits is definitely not recommended, since the
-        box can still run out of non-reclaimable memory.
-        In this case, you can configure K so that the sum of all groups is
-        never greater than the total memory. Then, freely set U at the expense of
-        the system's service quality.
-      </td>
-    </tr>
-    <tr>
-      <td class="no-wrap"><strong>U != 0, K &gt; U</strong></td>
-      <td>
-        Since kernel memory charges are also fed to the user counter and reclamation
-        is triggered for the container for both kinds of memory. This configuration
-        gives the admin a unified view of memory. It is also useful for people
-        who just want to track kernel memory usage.
-      </td>
-    </tr>
-  </tbody>
-</table>
-
-Examples:
-
-    $ docker run -it -m 500M --kernel-memory 50M ubuntu:14.04 /bin/bash
-
-We set memory and kernel memory, so the processes in the container can use
-500M memory in total, in this 500M memory, it can be 50M kernel memory tops.
-
-    $ docker run -it --kernel-memory 50M ubuntu:14.04 /bin/bash
-
-We set kernel memory without **-m**, so the processes in the container can
-use as much memory as they want, but they can only use 50M kernel memory.
-
-### Swappiness constraint
-
-By default, a container's kernel can swap out a percentage of anonymous pages.
-To set this percentage for a container, specify a `--memory-swappiness` value
-between 0 and 100. A value of 0 turns off anonymous page swapping. A value of
-100 sets all anonymous pages as swappable. By default, if you are not using
-`--memory-swappiness`, memory swappiness value will be inherited from the parent.
-
-For example, you can set:
-
-    $ docker run -it --memory-swappiness=0 ubuntu:14.04 /bin/bash
-
-Setting the `--memory-swappiness` option is helpful when you want to retain the
-container's working set and to avoid swapping performance penalties.
-
-### CPU share constraint
-
-By default, all containers get the same proportion of CPU cycles. This proportion
-can be modified by changing the container's CPU share weighting relative
-to the weighting of all other running containers.
-
-To modify the proportion from the default of 1024, use the `-c` or `--cpu-shares`
-flag to set the weighting to 2 or higher. If 0 is set, the system will ignore the
-value and use the default of 1024.
-
-The proportion will only apply when CPU-intensive processes are running.
-When tasks in one container are idle, other containers can use the
-left-over CPU time. The actual amount of CPU time will vary depending on
-the number of containers running on the system.
-
-For example, consider three containers, one has a cpu-share of 1024 and
-two others have a cpu-share setting of 512. When processes in all three
-containers attempt to use 100% of CPU, the first container would receive
-50% of the total CPU time. If you add a fourth container with a cpu-share
-of 1024, the first container only gets 33% of the CPU. The remaining containers
-receive 16.5%, 16.5% and 33% of the CPU.
-
-On a multi-core system, the shares of CPU time are distributed over all CPU
-cores. Even if a container is limited to less than 100% of CPU time, it can
-use 100% of each individual CPU core.
-
-For example, consider a system with more than three cores. If you start one
-container `{C0}` with `-c=512` running one process, and another container
-`{C1}` with `-c=1024` running two processes, this can result in the following
-division of CPU shares:
-
-    PID    container	CPU	CPU share
-    100    {C0}		0	100% of CPU0
-    101    {C1}		1	100% of CPU1
-    102    {C1}		2	100% of CPU2
-
-### CPU period constraint
-
-The default CPU CFS (Completely Fair Scheduler) period is 100ms. We can use
-`--cpu-period` to set the period of CPUs to limit the container's CPU usage.
-And usually `--cpu-period` should work with `--cpu-quota`.
-
-Examples:
-
-    $ docker run -it --cpu-period=50000 --cpu-quota=25000 ubuntu:14.04 /bin/bash
-
-If there is 1 CPU, this means the container can get 50% CPU worth of run-time every 50ms.
-
-In addition to use `--cpu-period` and `--cpu-quota` for setting CPU period constraints,
-it is possible to specify `--cpus` with a float number to achieve the same purpose.
-For example, if there is 1 CPU, then `--cpus=0.5` will achieve the same result as
-setting `--cpu-period=50000` and `--cpu-quota=25000` (50% CPU).
-
-The default value for `--cpus` is `0.000`, which means there is no limit.
-
-For more information, see the [CFS documentation on bandwidth limiting](https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt).
-
-### Cpuset constraint
-
-We can set cpus in which to allow execution for containers.
-
-Examples:
-
-    $ docker run -it --cpuset-cpus="1,3" ubuntu:14.04 /bin/bash
-
-This means processes in container can be executed on cpu 1 and cpu 3.
-
-    $ docker run -it --cpuset-cpus="0-2" ubuntu:14.04 /bin/bash
-
-This means processes in container can be executed on cpu 0, cpu 1 and cpu 2.
-
-We can set mems in which to allow execution for containers. Only effective
-on NUMA systems.
-
-Examples:
-
-    $ docker run -it --cpuset-mems="1,3" ubuntu:14.04 /bin/bash
-
-This example restricts the processes in the container to only use memory from
-memory nodes 1 and 3.
-
-    $ docker run -it --cpuset-mems="0-2" ubuntu:14.04 /bin/bash
-
-This example restricts the processes in the container to only use memory from
-memory nodes 0, 1 and 2.
-
-### CPU quota constraint
-
-The `--cpu-quota` flag limits the container's CPU usage. The default 0 value
-allows the container to take 100% of a CPU resource (1 CPU). The CFS (Completely Fair
-Scheduler) handles resource allocation for executing processes and is default
-Linux Scheduler used by the kernel. Set this value to 50000 to limit the container
-to 50% of a CPU resource. For multiple CPUs, adjust the `--cpu-quota` as necessary.
-For more information, see the [CFS documentation on bandwidth limiting](https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt).
-
-### Block IO bandwidth (Blkio) constraint
-
-By default, all containers get the same proportion of block IO bandwidth
-(blkio). This proportion is 500. To modify this proportion, change the
-container's blkio weight relative to the weighting of all other running
-containers using the `--blkio-weight` flag.
-
-> **Note:** The blkio weight setting is only available for direct IO. Buffered IO
-> is not currently supported.
-
-The `--blkio-weight` flag can set the weighting to a value between 10 to 1000.
-For example, the commands below create two containers with different blkio
-weight:
-
-    $ docker run -it --name c1 --blkio-weight 300 ubuntu:14.04 /bin/bash
-    $ docker run -it --name c2 --blkio-weight 600 ubuntu:14.04 /bin/bash
-
-If you do block IO in the two containers at the same time, by, for example:
-
-    $ time dd if=/mnt/zerofile of=test.out bs=1M count=1024 oflag=direct
-
-You'll find that the proportion of time is the same as the proportion of blkio
-weights of the two containers.
-
-The `--blkio-weight-device="DEVICE_NAME:WEIGHT"` flag sets a specific device weight.
-The `DEVICE_NAME:WEIGHT` is a string containing a colon-separated device name and weight.
-For example, to set `/dev/sda` device weight to `200`:
-
-    $ docker run -it \
-        --blkio-weight-device "/dev/sda:200" \
-        ubuntu
-
-If you specify both the `--blkio-weight` and `--blkio-weight-device`, Docker
-uses the `--blkio-weight` as the default weight and uses `--blkio-weight-device`
-to override this default with a new value on a specific device.
-The following example uses a default weight of `300` and overrides this default
-on `/dev/sda` setting that weight to `200`:
-
-    $ docker run -it \
-        --blkio-weight 300 \
-        --blkio-weight-device "/dev/sda:200" \
-        ubuntu
-
-The `--device-read-bps` flag limits the read rate (bytes per second) from a device.
-For example, this command creates a container and limits the read rate to `1mb`
-per second from `/dev/sda`:
-
-    $ docker run -it --device-read-bps /dev/sda:1mb ubuntu
-
-The `--device-write-bps` flag limits the write rate (bytes per second)to a device.
-For example, this command creates a container and limits the write rate to `1mb`
-per second for `/dev/sda`:
-
-    $ docker run -it --device-write-bps /dev/sda:1mb ubuntu
-
-Both flags take limits in the `<device-path>:<limit>[unit]` format. Both read
-and write rates must be a positive integer. You can specify the rate in `kb`
-(kilobytes), `mb` (megabytes), or `gb` (gigabytes).
-
-The `--device-read-iops` flag limits read rate (IO per second) from a device.
-For example, this command creates a container and limits the read rate to
-`1000` IO per second from `/dev/sda`:
-
-    $ docker run -ti --device-read-iops /dev/sda:1000 ubuntu
-
-The `--device-write-iops` flag limits write rate (IO per second) to a device.
-For example, this command creates a container and limits the write rate to
-`1000` IO per second to `/dev/sda`:
-
-    $ docker run -ti --device-write-iops /dev/sda:1000 ubuntu
-
-Both flags take limits in the `<device-path>:<limit>` format. Both read and
-write rates must be a positive integer.
-
-## Additional groups
-    --group-add: Add additional groups to run as
-
-By default, the docker container process runs with the supplementary groups looked
-up for the specified user. If one wants to add more to that list of groups, then
-one can use this flag:
-
-    $ docker run --rm --group-add audio --group-add nogroup --group-add 777 busybox id
-    uid=0(root) gid=0(root) groups=10(wheel),29(audio),99(nogroup),777
-
-## Runtime privilege and Linux capabilities
-
-    --cap-add: Add Linux capabilities
-    --cap-drop: Drop Linux capabilities
-    --privileged=false: Give extended privileges to this container
-    --device=[]: Allows you to run devices inside the container without the --privileged flag.
-
-By default, Docker containers are "unprivileged" and cannot, for
-example, run a Docker daemon inside a Docker container. This is because
-by default a container is not allowed to access any devices, but a
-"privileged" container is given access to all devices (see
-the documentation on [cgroups devices](https://www.kernel.org/doc/Documentation/cgroup-v1/devices.txt)).
-
-When the operator executes `docker run --privileged`, Docker will enable
-to access to all devices on the host as well as set some configuration
-in AppArmor or SELinux to allow the container nearly all the same access to the
-host as processes running outside containers on the host. Additional
-information about running with `--privileged` is available on the
-[Docker Blog](http://blog.docker.com/2013/09/docker-can-now-run-within-docker/).
-
-If you want to limit access to a specific device or devices you can use
-the `--device` flag. It allows you to specify one or more devices that
-will be accessible within the container.
-
-    $ docker run --device=/dev/snd:/dev/snd ...
-
-By default, the container will be able to `read`, `write`, and `mknod` these devices.
-This can be overridden using a third `:rwm` set of options to each `--device` flag:
-
-    $ docker run --device=/dev/sda:/dev/xvdc --rm -it ubuntu fdisk  /dev/xvdc
-
-    Command (m for help): q
-    $ docker run --device=/dev/sda:/dev/xvdc:r --rm -it ubuntu fdisk  /dev/xvdc
-    You will not be able to write the partition table.
-
-    Command (m for help): q
-
-    $ docker run --device=/dev/sda:/dev/xvdc:w --rm -it ubuntu fdisk  /dev/xvdc
-        crash....
-
-    $ docker run --device=/dev/sda:/dev/xvdc:m --rm -it ubuntu fdisk  /dev/xvdc
-    fdisk: unable to open /dev/xvdc: Operation not permitted
-
-In addition to `--privileged`, the operator can have fine grain control over the
-capabilities using `--cap-add` and `--cap-drop`. By default, Docker has a default
-list of capabilities that are kept. The following table lists the Linux capability
-options which are allowed by default and can be dropped.
-
-| Capability Key   | Capability Description                                                                                                        |
-| ---------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| SETPCAP          | Modify process capabilities.                                                                                                  |
-| MKNOD            | Create special files using mknod(2).                                                                                          |
-| AUDIT_WRITE      | Write records to kernel auditing log.                                                                                         |
-| CHOWN            | Make arbitrary changes to file UIDs and GIDs (see chown(2)).                                                                  |
-| NET_RAW          | Use RAW and PACKET sockets.                                                                                                   |
-| DAC_OVERRIDE     | Bypass file read, write, and execute permission checks.                                                                       |
-| FOWNER           | Bypass permission checks on operations that normally require the file system UID of the process to match the UID of the file. |
-| FSETID           | Don't clear set-user-ID and set-group-ID permission bits when a file is modified.                                             |
-| KILL             | Bypass permission checks for sending signals.                                                                                 |
-| SETGID           | Make arbitrary manipulations of process GIDs and supplementary GID list.                                                      |
-| SETUID           | Make arbitrary manipulations of process UIDs.                                                                                 |
-| NET_BIND_SERVICE | Bind a socket to internet domain privileged ports (port numbers less than 1024).                                              |
-| SYS_CHROOT       | Use chroot(2), change root directory.                                                                                         |
-| SETFCAP          | Set file capabilities.                                                                                                        |
-
-The next table shows the capabilities which are not granted by default and may be added.
-
-| Capability Key   | Capability Description                                                                                                        |
-| ---------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| SYS_MODULE       | Load and unload kernel modules.                                                                                               |
-| SYS_RAWIO        | Perform I/O port operations (iopl(2) and ioperm(2)).                                                                          |
-| SYS_PACCT        | Use acct(2), switch process accounting on or off.                                                                             |
-| SYS_ADMIN        | Perform a range of system administration operations.                                                                          |
-| SYS_NICE         | Raise process nice value (nice(2), setpriority(2)) and change the nice value for arbitrary processes.                         |
-| SYS_RESOURCE     | Override resource Limits.                                                                                                     |
-| SYS_TIME         | Set system clock (settimeofday(2), stime(2), adjtimex(2)); set real-time (hardware) clock.                                    |
-| SYS_TTY_CONFIG   | Use vhangup(2); employ various privileged ioctl(2) operations on virtual terminals.                                           |
-| AUDIT_CONTROL    | Enable and disable kernel auditing; change auditing filter rules; retrieve auditing status and filtering rules.               |
-| MAC_OVERRIDE     | Allow MAC configuration or state changes. Implemented for the Smack LSM.                                                      |
-| MAC_ADMIN        | Override Mandatory Access Control (MAC). Implemented for the Smack Linux Security Module (LSM).                               |
-| NET_ADMIN        | Perform various network-related operations.                                                                                   |
-| SYSLOG           | Perform privileged syslog(2) operations.                                                                                      |
-| DAC_READ_SEARCH  | Bypass file read permission checks and directory read and execute permission checks.                                          |
-| LINUX_IMMUTABLE  | Set the FS_APPEND_FL and FS_IMMUTABLE_FL i-node flags.                                                                        |
-| NET_BROADCAST    | Make socket broadcasts, and listen to multicasts.                                                                             |
-| IPC_LOCK         | Lock memory (mlock(2), mlockall(2), mmap(2), shmctl(2)).                                                                      |
-| IPC_OWNER        | Bypass permission checks for operations on System V IPC objects.                                                              |
-| SYS_PTRACE       | Trace arbitrary processes using ptrace(2).                                                                                    |
-| SYS_BOOT         | Use reboot(2) and kexec_load(2), reboot and load a new kernel for later execution.                                            |
-| LEASE            | Establish leases on arbitrary files (see fcntl(2)).                                                                           |
-| WAKE_ALARM       | Trigger something that will wake up the system.                                                                               |
-| BLOCK_SUSPEND    | Employ features that can block system suspend.                                                                                |
-
-Further reference information is available on the [capabilities(7) - Linux man page](http://man7.org/linux/man-pages/man7/capabilities.7.html)
-
-Both flags support the value `ALL`, so if the
-operator wants to have all capabilities but `MKNOD` they could use:
-
-    $ docker run --cap-add=ALL --cap-drop=MKNOD ...
-
-For interacting with the network stack, instead of using `--privileged` they
-should use `--cap-add=NET_ADMIN` to modify the network interfaces.
-
-    $ docker run -it --rm  ubuntu:14.04 ip link add dummy0 type dummy
-    RTNETLINK answers: Operation not permitted
-    $ docker run -it --rm --cap-add=NET_ADMIN ubuntu:14.04 ip link add dummy0 type dummy
-
-To mount a FUSE based filesystem, you need to combine both `--cap-add` and
-`--device`:
-
-    $ docker run --rm -it --cap-add SYS_ADMIN sshfs sshfs sven@10.10.10.20:/home/sven /mnt
-    fuse: failed to open /dev/fuse: Operation not permitted
-    $ docker run --rm -it --device /dev/fuse sshfs sshfs sven@10.10.10.20:/home/sven /mnt
-    fusermount: mount failed: Operation not permitted
-    $ docker run --rm -it --cap-add SYS_ADMIN --device /dev/fuse sshfs
-    # sshfs sven@10.10.10.20:/home/sven /mnt
-    The authenticity of host '10.10.10.20 (10.10.10.20)' can't be established.
-    ECDSA key fingerprint is 25:34:85:75:25:b0:17:46:05:19:04:93:b5:dd:5f:c6.
-    Are you sure you want to continue connecting (yes/no)? yes
-    sven@10.10.10.20's password:
-    root@30aa0cfaf1b5:/# ls -la /mnt/src/docker
-    total 1516
-    drwxrwxr-x 1 1000 1000   4096 Dec  4 06:08 .
-    drwxrwxr-x 1 1000 1000   4096 Dec  4 11:46 ..
-    -rw-rw-r-- 1 1000 1000     16 Oct  8 00:09 .dockerignore
-    -rwxrwxr-x 1 1000 1000    464 Oct  8 00:09 .drone.yml
-    drwxrwxr-x 1 1000 1000   4096 Dec  4 06:11 .git
-    -rw-rw-r-- 1 1000 1000    461 Dec  4 06:08 .gitignore
-    ....
-
-The default seccomp profile will adjust to the selected capabilities, in order to allow
-use of facilities allowed by the capabilities, so you should not have to adjust this,
-since Docker 1.12. In Docker 1.10 and 1.11 this did not happen and it may be necessary
-to use a custom seccomp profile or use `--security-opt seccomp=unconfined` when adding
-capabilities.
-
-## Logging drivers (--log-driver)
-
-The container can have a different logging driver than the Docker daemon. Use
-the `--log-driver=VALUE` with the `docker run` command to configure the
-container's logging driver. The following options are supported:
-
-| Driver      | Description                                                                                                                   |
-| ----------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| `none`      | Disables any logging for the container. `docker logs` won't be available with this driver.                                    |
-| `json-file` | Default logging driver for Docker. Writes JSON messages to file.  No logging options are supported for this driver.           |
-| `syslog`    | Syslog logging driver for Docker. Writes log messages to syslog.                                                              |
-| `journald`  | Journald logging driver for Docker. Writes log messages to `journald`.                                                        |
-| `gelf`      | Graylog Extended Log Format (GELF) logging driver for Docker. Writes log messages to a GELF endpoint likeGraylog or Logstash. |
-| `fluentd`   | Fluentd logging driver for Docker. Writes log messages to `fluentd` (forward input).                                          |
-| `awslogs`   | Amazon CloudWatch Logs logging driver for Docker. Writes log messages to Amazon CloudWatch Logs                               |
-| `splunk`    | Splunk logging driver for Docker. Writes log messages to `splunk` using Event Http Collector.                                 |
-
-The `docker logs` command is available only for the `json-file` and `journald`
-logging drivers.  For detailed information on working with logging drivers, see
-[Configure a logging driver](https://docs.docker.com/engine/admin/logging/overview/).
-
-
-## Overriding Dockerfile image defaults
-
-When a developer builds an image from a [*Dockerfile*](builder.md)
-or when she commits it, the developer can set a number of default parameters
-that take effect when the image starts up as a container.
-
-Four of the Dockerfile commands cannot be overridden at runtime: `FROM`,
-`MAINTAINER`, `RUN`, and `ADD`. Everything else has a corresponding override
-in `docker run`. We'll go through what the developer might have set in each
-Dockerfile instruction and how the operator can override that setting.
-
- - [CMD (Default Command or Options)](#cmd-default-command-or-options)
- - [ENTRYPOINT (Default Command to Execute at Runtime)](
-    #entrypoint-default-command-to-execute-at-runtime)
- - [EXPOSE (Incoming Ports)](#expose-incoming-ports)
- - [ENV (Environment Variables)](#env-environment-variables)
- - [HEALTHCHECK](#healthcheck)
- - [VOLUME (Shared Filesystems)](#volume-shared-filesystems)
- - [USER](#user)
- - [WORKDIR](#workdir)
-
-### CMD (default command or options)
-
-Recall the optional `COMMAND` in the Docker
-commandline:
-
-    $ docker run [OPTIONS] IMAGE[:TAG|@DIGEST] [COMMAND] [ARG...]
-
-This command is optional because the person who created the `IMAGE` may
-have already provided a default `COMMAND` using the Dockerfile `CMD`
-instruction. As the operator (the person running a container from the
-image), you can override that `CMD` instruction just by specifying a new
-`COMMAND`.
-
-If the image also specifies an `ENTRYPOINT` then the `CMD` or `COMMAND`
-get appended as arguments to the `ENTRYPOINT`.
-
-### ENTRYPOINT (default command to execute at runtime)
-
-    --entrypoint="": Overwrite the default entrypoint set by the image
-
-The `ENTRYPOINT` of an image is similar to a `COMMAND` because it
-specifies what executable to run when the container starts, but it is
-(purposely) more difficult to override. The `ENTRYPOINT` gives a
-container its default nature or behavior, so that when you set an
-`ENTRYPOINT` you can run the container *as if it were that binary*,
-complete with default options, and you can pass in more options via the
-`COMMAND`. But, sometimes an operator may want to run something else
-inside the container, so you can override the default `ENTRYPOINT` at
-runtime by using a string to specify the new `ENTRYPOINT`. Here is an
-example of how to run a shell in a container that has been set up to
-automatically run something else (like `/usr/bin/redis-server`):
-
-    $ docker run -it --entrypoint /bin/bash example/redis
-
-or two examples of how to pass more parameters to that ENTRYPOINT:
-
-    $ docker run -it --entrypoint /bin/bash example/redis -c ls -l
-    $ docker run -it --entrypoint /usr/bin/redis-cli example/redis --help
-
-You can reset a containers entrypoint by passing an empty string, for example:
-
-    $ docker run -it --entrypoint="" mysql bash
-
-> **Note**: Passing `--entrypoint` will clear out any default command set on the
-> image (i.e. any `CMD` instruction in the Dockerfile used to build it).
-
-### EXPOSE (incoming ports)
-
-The following `run` command options work with container networking:
-
-    --expose=[]: Expose a port or a range of ports inside the container.
-                 These are additional to those exposed by the `EXPOSE` instruction
-    -P         : Publish all exposed ports to the host interfaces
-    -p=[]      : Publish a container᾿s port or a range of ports to the host
-                   format: ip:hostPort:containerPort | ip::containerPort | hostPort:containerPort | containerPort
-                   Both hostPort and containerPort can be specified as a
-                   range of ports. When specifying ranges for both, the
-                   number of container ports in the range must match the
-                   number of host ports in the range, for example:
-                       -p 1234-1236:1234-1236/tcp
-
-                   When specifying a range for hostPort only, the
-                   containerPort must not be a range.  In this case the
-                   container port is published somewhere within the
-                   specified hostPort range. (e.g., `-p 1234-1236:1234/tcp`)
-
-                   (use 'docker port' to see the actual mapping)
-
-    --link=""  : Add link to another container (<name or id>:alias or <name or id>)
-
-With the exception of the `EXPOSE` directive, an image developer hasn't
-got much control over networking. The `EXPOSE` instruction defines the
-initial incoming ports that provide services. These ports are available
-to processes inside the container. An operator can use the `--expose`
-option to add to the exposed ports.
-
-To expose a container's internal port, an operator can start the
-container with the `-P` or `-p` flag. The exposed port is accessible on
-the host and the ports are available to any client that can reach the
-host.
-
-The `-P` option publishes all the ports to the host interfaces. Docker
-binds each exposed port to a random port on the host. The range of
-ports are within an *ephemeral port range* defined by
-`/proc/sys/net/ipv4/ip_local_port_range`. Use the `-p` flag to
-explicitly map a single port or range of ports.
-
-The port number inside the container (where the service listens) does
-not need to match the port number exposed on the outside of the
-container (where clients connect). For example, inside the container an
-HTTP service is listening on port 80 (and so the image developer
-specifies `EXPOSE 80` in the Dockerfile). At runtime, the port might be
-bound to 42800 on the host. To find the mapping between the host ports
-and the exposed ports, use `docker port`.
-
-If the operator uses `--link` when starting a new client container in the
-default bridge network, then the client container can access the exposed
-port via a private networking interface.
-If `--link` is used when starting a container in a user-defined network as
-described in [*Docker network overview*](https://docs.docker.com/engine/userguide/networking/),
-it will provide a named alias for the container being linked to.
-
-### ENV (environment variables)
-
-Docker automatically sets some environment variables when creating a Linux
-container. Docker does not set any environment variables when creating a Windows
-container.
-
-The following environment variables are set for Linux containers:
-
-| Variable | Value |
-| -------- | ----- |
-| `HOME` | Set based on the value of `USER` |
-| `HOSTNAME` | The hostname associated with the container |
-| `PATH` | Includes popular directories, such as `/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin` |
-| `TERM` | `xterm` if the container is allocated a pseudo-TTY |
-
-
-Additionally, the operator can **set any environment variable** in the
-container by using one or more `-e` flags, even overriding those mentioned
-above, or already defined by the developer with a Dockerfile `ENV`. If the
-operator names an environment variable without specifying a value, then the
-current value of the named variable is propagated into the container's environment:
-
-```bash
-$ export today=Wednesday
-$ docker run -e "deep=purple" -e today --rm alpine env
-PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-HOSTNAME=d2219b854598
-deep=purple
-today=Wednesday
-HOME=/root
-```
-
-```PowerShell
-PS C:\> docker run --rm -e "foo=bar" microsoft/nanoserver cmd /s /c set
-ALLUSERSPROFILE=C:\ProgramData
-APPDATA=C:\Users\ContainerAdministrator\AppData\Roaming
-CommonProgramFiles=C:\Program Files\Common Files
-CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
-CommonProgramW6432=C:\Program Files\Common Files
-COMPUTERNAME=C2FAEFCC8253
-ComSpec=C:\Windows\system32\cmd.exe
-foo=bar
-LOCALAPPDATA=C:\Users\ContainerAdministrator\AppData\Local
-NUMBER_OF_PROCESSORS=8
-OS=Windows_NT
-Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Users\ContainerAdministrator\AppData\Local\Microsoft\WindowsApps
-PATHEXT=.COM;.EXE;.BAT;.CMD
-PROCESSOR_ARCHITECTURE=AMD64
-PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 62 Stepping 4, GenuineIntel
-PROCESSOR_LEVEL=6
-PROCESSOR_REVISION=3e04
-ProgramData=C:\ProgramData
-ProgramFiles=C:\Program Files
-ProgramFiles(x86)=C:\Program Files (x86)
-ProgramW6432=C:\Program Files
-PROMPT=$P$G
-PUBLIC=C:\Users\Public
-SystemDrive=C:
-SystemRoot=C:\Windows
-TEMP=C:\Users\ContainerAdministrator\AppData\Local\Temp
-TMP=C:\Users\ContainerAdministrator\AppData\Local\Temp
-USERDOMAIN=User Manager
-USERNAME=ContainerAdministrator
-USERPROFILE=C:\Users\ContainerAdministrator
-windir=C:\Windows
-```
-
-Similarly the operator can set the **HOSTNAME** (Linux) or **COMPUTERNAME** (Windows) with `-h`.
-
-### HEALTHCHECK
-
-```
-  --health-cmd            Command to run to check health
-  --health-interval       Time between running the check
-  --health-retries        Consecutive failures needed to report unhealthy
-  --health-timeout        Maximum time to allow one check to run
-  --health-start-period   Start period for the container to initialize before starting health-retries countdown
-  --no-healthcheck        Disable any container-specified HEALTHCHECK
-```
-
-Example:
-
-    {% raw %}
-    $ docker run --name=test -d \
-        --health-cmd='stat /etc/passwd || exit 1' \
-        --health-interval=2s \
-        busybox sleep 1d
-    $ sleep 2; docker inspect --format='{{.State.Health.Status}}' test
-    healthy
-    $ docker exec test rm /etc/passwd
-    $ sleep 2; docker inspect --format='{{json .State.Health}}' test
-    {
-      "Status": "unhealthy",
-      "FailingStreak": 3,
-      "Log": [
-        {
-          "Start": "2016-05-25T17:22:04.635478668Z",
-          "End": "2016-05-25T17:22:04.7272552Z",
-          "ExitCode": 0,
-          "Output": "  File: /etc/passwd\n  Size: 334       \tBlocks: 8          IO Block: 4096   regular file\nDevice: 32h/50d\tInode: 12          Links: 1\nAccess: (0664/-rw-rw-r--)  Uid: (    0/    root)   Gid: (    0/    root)\nAccess: 2015-12-05 22:05:32.000000000\nModify: 2015..."
-        },
-        {
-          "Start": "2016-05-25T17:22:06.732900633Z",
-          "End": "2016-05-25T17:22:06.822168935Z",
-          "ExitCode": 0,
-          "Output": "  File: /etc/passwd\n  Size: 334       \tBlocks: 8          IO Block: 4096   regular file\nDevice: 32h/50d\tInode: 12          Links: 1\nAccess: (0664/-rw-rw-r--)  Uid: (    0/    root)   Gid: (    0/    root)\nAccess: 2015-12-05 22:05:32.000000000\nModify: 2015..."
-        },
-        {
-          "Start": "2016-05-25T17:22:08.823956535Z",
-          "End": "2016-05-25T17:22:08.897359124Z",
-          "ExitCode": 1,
-          "Output": "stat: can't stat '/etc/passwd': No such file or directory\n"
-        },
-        {
-          "Start": "2016-05-25T17:22:10.898802931Z",
-          "End": "2016-05-25T17:22:10.969631866Z",
-          "ExitCode": 1,
-          "Output": "stat: can't stat '/etc/passwd': No such file or directory\n"
-        },
-        {
-          "Start": "2016-05-25T17:22:12.971033523Z",
-          "End": "2016-05-25T17:22:13.082015516Z",
-          "ExitCode": 1,
-          "Output": "stat: can't stat '/etc/passwd': No such file or directory\n"
-        }
-      ]
-    }
-    {% endraw %}
-
-The health status is also displayed in the `docker ps` output.
-
-### TMPFS (mount tmpfs filesystems)
-
-```bash
---tmpfs=[]: Create a tmpfs mount with: container-dir[:<options>],
-            where the options are identical to the Linux
-            'mount -t tmpfs -o' command.
-```
-
-The example below mounts an empty tmpfs into the container with the `rw`,
-`noexec`, `nosuid`, and `size=65536k` options.
-
-    $ docker run -d --tmpfs /run:rw,noexec,nosuid,size=65536k my_image
-
-### VOLUME (shared filesystems)
-
-    -v, --volume=[host-src:]container-dest[:<options>]: Bind mount a volume.
-    The comma-delimited `options` are [rw|ro], [z|Z],
-    [[r]shared|[r]slave|[r]private], and [nocopy].
-    The 'host-src' is an absolute path or a name value.
-
-    If neither 'rw' or 'ro' is specified then the volume is mounted in
-    read-write mode.
-
-    The `nocopy` modes is used to disable automatic copying requested volume
-    path in the container to the volume storage location.
-    For named volumes, `copy` is the default mode. Copy modes are not supported
-    for bind-mounted volumes.
-
-    --volumes-from="": Mount all volumes from the given container(s)
-
-> **Note**:
-> When using systemd to manage the Docker daemon's start and stop, in the systemd
-> unit file there is an option to control mount propagation for the Docker daemon
-> itself, called `MountFlags`. The value of this setting may cause Docker to not
-> see mount propagation changes made on the mount point. For example, if this value
-> is `slave`, you may not be able to use the `shared` or `rshared` propagation on
-> a volume.
-
-The volumes commands are complex enough to have their own documentation
-in section [*Manage data in
-containers*](https://docs.docker.com/engine/tutorials/dockervolumes/). A developer can define
-one or more `VOLUME`'s associated with an image, but only the operator
-can give access from one container to another (or from a container to a
-volume mounted on the host).
-
-The `container-dest` must always be an absolute path such as `/src/docs`.
-The `host-src` can either be an absolute path or a `name` value. If you
-supply an absolute path for the `host-dir`, Docker bind-mounts to the path
-you specify. If you supply a `name`, Docker creates a named volume by that `name`.
-
-A `name` value must start with an alphanumeric character,
-followed by `a-z0-9`, `_` (underscore), `.` (period) or `-` (hyphen).
-An absolute path starts with a `/` (forward slash).
-
-For example, you can specify either `/foo` or `foo` for a `host-src` value.
-If you supply the `/foo` value, Docker creates a bind-mount. If you supply
-the `foo` specification, Docker creates a named volume.
-
-### USER
-
-`root` (id = 0) is the default user within a container. The image developer can
-create additional users. Those users are accessible by name.  When passing a numeric
-ID, the user does not have to exist in the container.
-
-The developer can set a default user to run the first process with the
-Dockerfile `USER` instruction. When starting a container, the operator can override
-the `USER` instruction by passing the `-u` option.
-
-    -u="", --user="": Sets the username or UID used and optionally the groupname or GID for the specified command.
-
-    The followings examples are all valid:
-    --user=[ user | user:group | uid | uid:gid | user:gid | uid:group ]
-
-> **Note:** if you pass a numeric uid, it must be in the range of 0-2147483647.
-
-### WORKDIR
-
-The default working directory for running binaries within a container is the
-root directory (`/`), but the developer can set a different default with the
-Dockerfile `WORKDIR` command. The operator can override this with:
-
-    -w="": Working directory inside the container
diff --git a/components/engine/experimental/README.md b/components/engine/experimental/README.md
deleted file mode 100644
index 63e676e3f7..0000000000
--- a/components/engine/experimental/README.md
+++ /dev/null
@@ -1,53 +0,0 @@
-# Docker Experimental Features
-
-This page contains a list of features in the Docker engine which are
-experimental. Experimental features are **not** ready for production. They are
-provided for test and evaluation in your sandbox environments.
-
-The information below describes each feature and the GitHub pull requests and
-issues associated with it. If necessary, links are provided to additional
-documentation on an issue.  As an active Docker user and community member,
-please feel free to provide any feedback on these features you wish.
-
-## Use Docker experimental
-
-Experimental features are now included in the standard Docker binaries as of
-version 1.13.0.
-To enable experimental features, start the Docker daemon with the
-`--experimental` flag or enable the daemon flag in the
-`/etc/docker/daemon.json` configuration file:
-
-```json
-{
-    "experimental": true
-}
-```
-
-You can check to see if experimental features are enabled on a running daemon
-using the following command:
-
-```bash
-$ docker version -f '{{.Server.Experimental}}'
-true
-```
-
-## Current experimental features
-
-Docker service logs command to view logs for a Docker service. This is needed in Swarm mode.
-Option to squash image layers to the base image after successful builds.
-Checkpoint and restore support for Containers.
-Metrics (Prometheus) output for basic container, image, and daemon operations.
-
- * The top-level [docker deploy](../docs/reference/commandline/deploy.md) command. The
-   `docker stack deploy` command is **not** experimental.
- * [External graphdriver plugins](../docs/extend/plugins_graphdriver.md)
- * [Ipvlan Network Drivers](vlan-networks.md)
- * [Distributed Application Bundles](docker-stacks-and-bundles.md)
- * [Checkpoint & Restore](checkpoint-restore.md)
- * [Docker build with --squash argument](../docs/reference/commandline/build.md#squash-an-images-layers---squash-experimental-only)
-
-## How to comment on an experimental feature
-
-Each feature's documentation includes a list of proposal pull requests or PRs associated with the feature. If you want to comment on or suggest a change to a feature, please add it to the existing feature PR.
-
-Issues or problems with a feature? Inquire for help on the `#docker` IRC channel or on the [Docker Google group](https://groups.google.com/forum/#!forum/docker-user).
diff --git a/components/engine/experimental/checkpoint-restore.md b/components/engine/experimental/checkpoint-restore.md
deleted file mode 100644
index 7e609b60ec..0000000000
--- a/components/engine/experimental/checkpoint-restore.md
+++ /dev/null
@@ -1,88 +0,0 @@
-# Docker Checkpoint & Restore
-
-Checkpoint & Restore is a new feature that allows you to freeze a running
-container by checkpointing it, which turns its state into a collection of files
-on disk. Later, the container can be restored from the point it was frozen.
-
-This is accomplished using a tool called [CRIU](http://criu.org), which is an
-external dependency of this feature. A good overview of the history of
-checkpoint and restore in Docker is available in this
-[Kubernetes blog post](http://blog.kubernetes.io/2015/07/how-did-quake-demo-from-dockercon-work.html).
-
-## Installing CRIU
-
-If you use a Debian system, you can add the CRIU PPA and install with apt-get
-[from the criu launchpad](https://launchpad.net/~criu/+archive/ubuntu/ppa).
-
-Alternatively, you can [build CRIU from source](http://criu.org/Installation).
-
-You need at least version 2.0 of CRIU to run checkpoint/restore in Docker.
-
-## Use cases for checkpoint & restore
-
-This feature is currently focused on single-host use cases for checkpoint and
-restore. Here are a few:
-
-- Restarting the host machine without stopping/starting containers
-- Speeding up the start time of slow start applications
-- "Rewinding" processes to an earlier point in time
-- "Forensic debugging" of running processes
-
-Another primary use case of checkpoint & restore outside of Docker is the live
-migration of a server from one machine to another. This is possible with the
-current implementation, but not currently a priority (and so the workflow is
-not optimized for the task).
-
-## Using checkpoint & restore
-
-A new top level command `docker checkpoint` is introduced, with three subcommands:
-- `create` (creates a new checkpoint)
-- `ls` (lists existing checkpoints)
-- `rm` (deletes an existing checkpoint)
-
-Additionally, a `--checkpoint` flag is added to the container start command.
-
-The options for checkpoint create:
-
-    Usage:  docker checkpoint create [OPTIONS] CONTAINER CHECKPOINT
-
-    Create a checkpoint from a running container
-
-      --leave-running=false    Leave the container running after checkpoint
-      --checkpoint-dir         Use a custom checkpoint storage directory
-
-And to restore a container:
-
-    Usage:  docker start --checkpoint CHECKPOINT_ID [OTHER OPTIONS] CONTAINER
-
-
-A simple example of using checkpoint & restore on a container:
-
-    $ docker run --security-opt=seccomp:unconfined --name cr -d busybox /bin/sh -c 'i=0; while true; do echo $i; i=$(expr $i + 1); sleep 1; done'
-    > abc0123
-
-    $ docker checkpoint create cr checkpoint1
-
-    # <later>
-    $ docker start --checkpoint checkpoint1 cr
-    > abc0123
-
-This process just logs an incrementing counter to stdout. If you `docker logs`
-in between running/checkpoint/restoring you should see that the counter
-increases while the process is running, stops while it's checkpointed, and
-resumes from the point it left off once you restore.
-
-## Current limitation
-
-seccomp is only supported by CRIU in very up to date kernels.
-
-External terminal (i.e. `docker run -t ..`) is not supported at the moment.
-If you try to create a checkpoint for a container with an external terminal, 
-it would fail:
-
-    $ docker checkpoint create cr checkpoint1
-    Error response from daemon: Cannot checkpoint container c1: rpc error: code = 2 desc = exit status 1: "criu failed: type NOTIFY errno 0\nlog file: /var/lib/docker/containers/eb62ebdbf237ce1a8736d2ae3c7d88601fc0a50235b0ba767b559a1f3c5a600b/checkpoints/checkpoint1/criu.work/dump.log\n"
-    
-    $ cat /var/lib/docker/containers/eb62ebdbf237ce1a8736d2ae3c7d88601fc0a50235b0ba767b559a1f3c5a600b/checkpoints/checkpoint1/criu.work/dump.log
-    Error (mount.c:740): mnt: 126:./dev/console doesn't have a proper root mount
-
diff --git a/components/engine/experimental/docker-stacks-and-bundles.md b/components/engine/experimental/docker-stacks-and-bundles.md
deleted file mode 100644
index 8abfd76359..0000000000
--- a/components/engine/experimental/docker-stacks-and-bundles.md
+++ /dev/null
@@ -1,205 +0,0 @@
-# Docker Stacks and Distributed Application Bundles
-
-## Overview
-
-Docker Stacks and Distributed Application Bundles are experimental features
-introduced in Docker 1.12 and Docker Compose 1.8, alongside the concept of
-swarm mode, and Nodes and Services in the Engine API.
-
-A Dockerfile can be built into an image, and containers can be created from
-that image. Similarly, a docker-compose.yml can be built into a **distributed
-application bundle**, and **stacks** can be created from that bundle. In that
-sense, the bundle is a multi-services distributable image format.
-
-As of Docker 1.12 and Compose 1.8, the features are experimental. Neither
-Docker Engine nor the Docker Registry supports distribution of bundles.
-
-## Producing a bundle
-
-The easiest way to produce a bundle is to generate it using `docker-compose`
-from an existing `docker-compose.yml`. Of course, that's just *one* possible way
-to proceed, in the same way that `docker build` isn't the only way to produce a
-Docker image.
-
-From `docker-compose`:
-
-```bash
-$ docker-compose bundle
-WARNING: Unsupported key 'network_mode' in services.nsqd - ignoring
-WARNING: Unsupported key 'links' in services.nsqd - ignoring
-WARNING: Unsupported key 'volumes' in services.nsqd - ignoring
-[...]
-Wrote bundle to vossibility-stack.dab
-```
-
-## Creating a stack from a bundle
-
-A stack is created using the `docker deploy` command:
-
-```bash
-$ docker deploy --help
-Usage:  docker deploy [OPTIONS] STACK
-
-Deploy a new stack or update an existing stack
-
-Aliases:
-  deploy, up
-
-Options:
-      --bundle-file string    Path to a Distributed Application Bundle file
-  -c, --compose-file string   Path to a Compose file
-      --help                  Print usage
-      --with-registry-auth    Send registry authentication details to Swarm agents
-
-```
-
-Let's deploy the stack created before:
-
-```bash
-$ docker deploy --bundle-file vossibility-stack.dab vossibility-stack
-Loading bundle from vossibility-stack.dab
-Creating service vossibility-stack_elasticsearch
-Creating service vossibility-stack_kibana
-Creating service vossibility-stack_logstash
-Creating service vossibility-stack_lookupd
-Creating service vossibility-stack_nsqd
-Creating service vossibility-stack_vossibility-collector
-```
-
-We can verify that services were correctly created:
-
-```bash
-$ docker service ls
-ID            NAME                                     MODE         REPLICAS    IMAGE
-29bv0vnlm903  vossibility-stack_lookupd                replicated   1/1         nsqio/nsq@sha256:eeba05599f31eba418e96e71e0984c3dc96963ceb66924dd37a47bf7ce18a662
-4awt47624qwh  vossibility-stack_nsqd                   replicated   1/1         nsqio/nsq@sha256:eeba05599f31eba418e96e71e0984c3dc96963ceb66924dd37a47bf7ce18a662
-4tjx9biia6fs  vossibility-stack_elasticsearch          replicated   1/1         elasticsearch@sha256:12ac7c6af55d001f71800b83ba91a04f716e58d82e748fa6e5a7359eed2301aa
-7563uuzr9eys  vossibility-stack_kibana                 replicated   1/1         kibana@sha256:6995a2d25709a62694a937b8a529ff36da92ebee74bafd7bf00e6caf6db2eb03
-9gc5m4met4he  vossibility-stack_logstash               replicated   1/1         logstash@sha256:2dc8bddd1bb4a5a34e8ebaf73749f6413c101b2edef6617f2f7713926d2141fe
-axqh55ipl40h  vossibility-stack_vossibility-collector  replicated   1/1         icecrime/vossibility-collector@sha256:f03f2977203ba6253988c18d04061c5ec7aab46bca9dfd89a9a1fa4500989fba
-```
-
-## Managing stacks
-
-Stacks are managed using the `docker stack` command:
-
-```bash
-# docker stack --help
-
-Usage:  docker stack COMMAND
-
-Manage Docker stacks
-
-Options:
-      --help   Print usage
-
-Commands:
-  deploy      Deploy a new stack or update an existing stack
-  ls          List stacks
-  ps          List the tasks in the stack
-  rm          Remove the stack
-  services    List the services in the stack
-
-Run 'docker stack COMMAND --help' for more information on a command.
-```
-
-## Bundle file format
-
-Distributed application bundles are described in a JSON format. When bundles
-are persisted as files, the file extension is `.dab` (Docker 1.12RC2 tools use
-`.dsb` for the file extension—this will be updated in the next release client).
-
-A bundle has two top-level fields: `version` and `services`. The version used
-by Docker 1.12 and later tools is `0.1`.
-
-`services` in the bundle are the services that comprise the app. They
-correspond to the new `Service` object introduced in the 1.12 Docker Engine API.
-
-A service has the following fields:
-
-<dl>
-    <dt>
-        Image (required) <code>string</code>
-    </dt>
-    <dd>
-        The image that the service will run. Docker images should be referenced
-        with full content hash to fully specify the deployment artifact for the
-        service. Example:
-        <code>postgres@sha256:f76245b04ddbcebab5bb6c28e76947f49222c99fec4aadb0bb
-        1c24821a 9e83ef</code>
-    </dd>
-    <dt>
-        Command <code>[]string</code>
-    </dt>
-    <dd>
-        Command to run in service containers.
-    </dd>
-    <dt>
-        Args <code>[]string</code>
-    </dt>
-    <dd>
-        Arguments passed to the service containers.
-    </dd>
-    <dt>
-        Env <code>[]string</code>
-    </dt>
-    <dd>
-        Environment variables.
-    </dd>
-    <dt>
-        Labels <code>map[string]string</code>
-    </dt>
-    <dd>
-        Labels used for setting meta data on services.
-    </dd>
-    <dt>
-        Ports <code>[]Port</code>
-    </dt>
-    <dd>
-        Service ports (composed of <code>Port</code> (<code>int</code>) and
-        <code>Protocol</code> (<code>string</code>). A service description can
-        only specify the container port to be exposed. These ports can be
-        mapped on runtime hosts at the operator's discretion.
-    </dd>
-
-    <dt>
-        WorkingDir <code>string</code>
-    </dt>
-    <dd>
-        Working directory inside the service containers.
-    </dd>
-
-    <dt>
-        User <code>string</code>
-    </dt>
-    <dd>
-        Username or UID (format: <code>&lt;name|uid&gt;[:&lt;group|gid&gt;]</code>).
-    </dd>
-
-    <dt>
-        Networks <code>[]string</code>
-    </dt>
-    <dd>
-        Networks that the service containers should be connected to. An entity
-        deploying a bundle should create networks as needed.
-    </dd>
-</dl>
-
-The following is an example of bundlefile with two services:
-
-```json
-{
-	"Version": "0.1",
-	"Services": {
-		"redis": {
-			"Image": "redis@sha256:4b24131101fa0117bcaa18ac37055fffd9176aa1a240392bb8ea85e0be50f2ce",
-			"Networks": ["default"]
-		},
-		"web": {
-			"Image": "dockercloud/hello-world@sha256:fe79a2cfbd17eefc344fb8419420808df95a1e22d93b7f621a7399fd1e9dca1d",
-			"Networks": ["default"],
-			"User": "web"
-		}
-	}
-}
-```
diff --git a/components/engine/experimental/images/ipvlan-l3.gliffy b/components/engine/experimental/images/ipvlan-l3.gliffy
deleted file mode 100644
index bf0512af76..0000000000
--- a/components/engine/experimental/images/ipvlan-l3.gliffy
+++ /dev/null
@@ -1 +0,0 @@
-{"contentType":"application/gliffy+json","version":"1.3","stage":{"background":"#FFFFFF","width":447,"height":422,"nodeIndex":326,"autoFit":true,"exportBorder":false,"gridOn":true,"snapToGrid":false,"drawingGuidesOn":false,"pageBreaksOn":false,"printGridOn":false,"printPaper":"LETTER","printShrinkToFit":false,"printPortrait":true,"maxWidth":5000,"maxHeight":5000,"themeData":{"uid":"com.gliffy.theme.beach_day","name":"Beach Day","shape":{"primary":{"strokeWidth":2,"strokeColor":"#00A4DA","fillColor":"#AEE4F4","gradient":false,"dropShadow":false,"opacity":1,"text":{"color":"#004257"}},"secondary":{"strokeWidth":2,"strokeColor":"#CDB25E","fillColor":"#EACF81","gradient":false,"dropShadow":false,"opacity":1,"text":{"color":"#332D1A"}},"tertiary":{"strokeWidth":2,"strokeColor":"#FFBE00","fillColor":"#FFF1CB","gradient":false,"dropShadow":false,"opacity":1,"text":{"color":"#000000"}},"highlight":{"strokeWidth":2,"strokeColor":"#00A4DA","fillColor":"#00A4DA","gradient":false,"dropShadow":false,"opacity":1,"text":{"color":"#ffffff"}}},"line":{"strokeWidth":2,"strokeColor":"#00A4DA","fillColor":"none","arrowType":2,"interpolationType":"quadratic","cornerRadius":0,"text":{"color":"#002248"}},"text":{"color":"#002248"},"stage":{"color":"#FFFFFF"}},"viewportType":"default","fitBB":{"min":{"x":9,"y":10.461511948529278},"max":{"x":447,"y":421.5}},"printModel":{"pageSize":"a4","portrait":false,"fitToOnePage":false,"displayPageBreaks":false},"objects":[{"x":12.0,"y":200.0,"rotation":0.0,"id":276,"width":434.00000000000006,"height":197.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":10,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":2.0,"strokeColor":"#434343","fillColor":"#c5e4fc","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":0.93,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":275.0,"y":8.93295288085936,"rotation":0.0,"id":269,"width":100.0,"height":100.0,"uid":"com.gliffy.shape.uml.uml_v2.sequence.anchor_line","order":14,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":272,"py":0.5,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":290,"py":1.0,"px":0.7071067811865476}}},"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#000000","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[82.0,295.5670471191406],[-4.628896294384617,211.06704711914062]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":285.0,"y":18.93295288085936,"rotation":0.0,"id":268,"width":100.0,"height":100.0,"uid":"com.gliffy.shape.uml.uml_v2.sequence.anchor_line","order":15,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":316,"py":0.5,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":290,"py":0.9999999999999996,"px":0.29289321881345254}}},"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#000000","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[-204.0,285.5670471191406],[-100.37110370561533,201.06704711914062]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":8.0,"y":203.5,"rotation":0.0,"id":267,"width":116.0,"height":16.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":16,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:14px;font-family:Arial;\">Docker Host</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":10.0,"y":28.93295288085936,"rotation":0.0,"id":278,"width":100.0,"height":100.0,"uid":"com.gliffy.shape.uml.uml_v2.sequence.anchor_line","order":17,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":290,"py":0.5,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":246,"py":0.5,"px":0.5}}},"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#000000","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[217.5,167.06704711914062],[219.11774189711457,53.02855906766992]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":57.51435447730654,"y":10.461511948529278,"rotation":0.0,"id":246,"width":343.20677483961606,"height":143.0,"uid":"com.gliffy.shape.cisco.cisco_v1.storage.cloud","order":18,"lockAspectRatio":true,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.cisco.cisco_v1.storage.cloud","strokeWidth":2.0,"strokeColor":"#333333","fillColor":"#434343","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":106.0,"y":55.19999694824217,"rotation":0.0,"id":262,"width":262.0,"height":75.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":22,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:13px;\">Unless notified about the container networks, the physical network does not have a route to their subnets</span></p><p style=\"text-align:center;\"><span style=\"font-size:13px;font-weight:bold;\">Who has 10.16.20.0/24?</span></p><p style=\"text-align:center;\"><span style=\"font-size:13px;font-weight:bold;\">Who has 10.1.20.0/24?</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":7.0,"y":403.5,"rotation":0.0,"id":282,"width":442.0,"height":18.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":23,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:16px;font-style:italic;\">Containers can be on different subnets and reach each other</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":106.0,"y":252.5,"rotation":0.0,"id":288,"width":238.0,"height":22.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":24,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:20px;font-weight:bold;\">&nbsp;Ipvlan&nbsp;</span><span style=\"font-size:20px;font-weight:bold;\">L3 Mode</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":124.0,"y":172.0,"rotation":0.0,"id":290,"width":207.0,"height":48.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":25,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#cccccc","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":1.0,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[{"x":3.568965517241383,"y":0.0,"rotation":0.0,"id":291,"width":199.86206896551747,"height":42.0,"uid":null,"order":27,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":8,"paddingRight":8,"paddingBottom":8,"paddingLeft":8,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-weight:bold;\">Eth0</span></p><p style=\"text-align:center;\"><span style=\"font-weight:bold;\">192.168.50.10/24</span></p><p style=\"text-align:center;\"><span style=\"\">Parent interface acts as a <span style=\"font-weight:bold;\">Router</span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":29.0,"y":358.1999969482422,"rotation":0.0,"id":304,"width":390.99999999999994,"height":32.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":29,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:14px;\">All containers can ping each other <span style=\"font-weight:bold;\">without</span> a router if </span></p><p style=\"text-align:center;\"><span style=\"font-size:14px;\">they share the <span style=\"font-weight:bold;\">same</span> parent interface (<span style=\"font-style:italic;\">example eth0)</span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":24.0,"y":276.0,"rotation":0.0,"id":320,"width":134.0,"height":77.0,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":48,"lockAspectRatio":false,"lockShape":false,"children":[{"x":0.0,"y":0.0,"rotation":0.0,"id":316,"width":114.0,"height":57.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":44,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":0.97,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[{"x":2.279999999999999,"y":0.0,"rotation":0.0,"id":317,"width":109.44000000000001,"height":43.0,"uid":null,"order":47,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":8,"paddingRight":8,"paddingBottom":8,"paddingLeft":8,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"\">Container(s)</span></p><p style=\"text-align:center;\"><span style=\"font-size:13px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">Eth0&nbsp;</span></span></p><p style=\"text-align:center;\"><span style=\"font-weight:bold;\">172.16.20.x/24</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":10.0,"y":10.0,"rotation":0.0,"id":318,"width":114.0,"height":57.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":42,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":0.97,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":20.0,"y":20.0,"rotation":0.0,"id":319,"width":114.0,"height":57.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":40,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":0.97,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":300.0,"y":276.0,"rotation":0.0,"id":321,"width":134.0,"height":77.0,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":49,"lockAspectRatio":false,"lockShape":false,"children":[{"x":0.0,"y":0.0,"rotation":0.0,"id":272,"width":114.0,"height":57.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":35,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":0.97,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[{"x":2.279999999999999,"y":0.0,"rotation":0.0,"id":273,"width":109.44000000000001,"height":44.0,"uid":null,"order":38,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":8,"paddingRight":8,"paddingBottom":8,"paddingLeft":8,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"\">Container(s)</span></p><p style=\"text-align:center;\"><span style=\"font-size:13px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">Eth0 <span style=\"font-weight:bold;\">10.1.20.x/24</span></span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":10.0,"y":10.0,"rotation":0.0,"id":310,"width":114.0,"height":57.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":33,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":0.97,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":20.0,"y":20.0,"rotation":0.0,"id":312,"width":114.0,"height":57.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":31,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":0.97,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":368.0,"y":85.93295288085938,"rotation":0.0,"id":322,"width":100.0,"height":100.0,"uid":"com.gliffy.shape.uml.uml_v2.sequence.anchor_line","order":50,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#434343","fillColor":"none","dashStyle":"4.0,4.0","startArrow":2,"endArrow":2,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[-191.0,222.06704711914062],[-80.9272967534639,222.06704711914062]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":167.0,"y":25.499999999999986,"rotation":0.0,"id":323,"width":135.0,"height":32.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":51,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:14px;font-weight:bold;font-family:Arial;\">Physical Network</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"layers":[{"guid":"9wom3rMkTrb3","order":0,"name":"Layer 0","active":true,"locked":false,"visible":true,"nodeIndex":53}],"shapeStyles":{},"lineStyles":{"global":{"fill":"none","stroke":"#434343","strokeWidth":2,"dashStyle":"4.0,4.0","startArrow":2,"endArrow":2,"orthoMode":2}},"textStyles":{"global":{"face":"Arial","size":"13px","color":"#000000"}}},"metadata":{"title":"untitled","revision":0,"exportBorder":false,"loadPosition":"default","libraries":["com.gliffy.libraries.basic.basic_v1.default","com.gliffy.libraries.flowchart.flowchart_v1.default","com.gliffy.libraries.swimlanes.swimlanes_v1.default","com.gliffy.libraries.images","com.gliffy.libraries.network.network_v4.home","com.gliffy.libraries.network.network_v4.business","com.gliffy.libraries.network.network_v4.rack","com.gliffy.libraries.network.network_v3.home","com.gliffy.libraries.network.network_v3.business","com.gliffy.libraries.network.network_v3.rack"],"lastSerialized":1458117032939,"analyticsProduct":"Confluence"},"embeddedResources":{"index":0,"resources":[]}}
\ No newline at end of file
diff --git a/components/engine/experimental/images/ipvlan-l3.png b/components/engine/experimental/images/ipvlan-l3.png
deleted file mode 100644
index 3227a83ca1..0000000000
Binary files a/components/engine/experimental/images/ipvlan-l3.png and /dev/null differ
diff --git a/components/engine/experimental/images/ipvlan-l3.svg b/components/engine/experimental/images/ipvlan-l3.svg
deleted file mode 100644
index 6ed1430800..0000000000
--- a/components/engine/experimental/images/ipvlan-l3.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="467" height="441.5"><style xmlns="http://www.w3.org/1999/xhtml"></style><defs/><g transform="translate(0,0)"><g><rect fill="#FFFFFF" stroke="none" x="0" y="0" width="467" height="441.5"/></g><g transform="translate(0,0) matrix(1,0,0,1,12,200)"><g><g transform="translate(0,0) scale(4.340000000000001,1.97)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.23041474654377878,0.5076142131979695)"><path fill="#c5e4fc" stroke="none" d="M 10 0 L 424.00000000000006 0 Q 434.00000000000006 0 434.00000000000006 10 L 434.00000000000006 187 Q 434.00000000000006 197 424.00000000000006 197 L 10 197 Q 0 197 0 187 L 0 10 Q 0 0 10 0 Z" opacity="0.93"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 424.00000000000006 0 Q 434.00000000000006 0 434.00000000000006 10 L 434.00000000000006 187 Q 434.00000000000006 197 424.00000000000006 197 L 10 197 Q 0 197 0 187 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" stroke-width="2" opacity="0.93"/></g></g></g></g></g><g transform="matrix(1,0,0,1,265.8711037056154,215.5)"><g transform="translate(0,0)"><g transform="translate(-275,-8.93295288085936) translate(9.128896294384617,-206.56704711914062) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#000000" d="M 357 304.5 L 270.3711037056154 220" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,76.5,215.5)"><g transform="translate(0,0)"><g transform="translate(-285,-18.93295288085936) translate(208.5,-196.56704711914062) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#000000" d="M 81 304.5 L 184.62889629438467 220" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,10,204)"><g transform="translate(18,0) matrix(1,0,0,1,0,0) translate(-18,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="113" height="16" fill-opacity="0"/></g></g><g transform="translate(18,0) matrix(1,0,0,1,0,0) translate(-18,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="113" height="16" fill-opacity="0"/></g></g><g transform="translate(18,0) matrix(1,0,0,1,0,0) translate(-18,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="18" y="0" width="79" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="18" y="14">Docker</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="66" y="14">Host</text></g></g><g transform="matrix(1,0,0,1,223,77.46151194852928)"><g transform="translate(0,0)"><g transform="translate(-10,-28.93295288085936) translate(-213,-48.52855906766992) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#000000" d="M 227.5 196 L 229.11774189711457 81.96151194852928" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="translate(0,0) matrix(1,0,0,1,57.51435447730654,10.461511948529278)"><g><g transform="translate(0,0) scale(3.4320505881432197,2.464785030240155) translate(0.00001348378,-0.001498589)"><g><g><path fill="#FFFFFF" stroke="#434343" d="M 33.84 5.912 C 16.263 2.403 6.986 11.405 8.451 19.186 L 8.57 19.61 C -5.128 21.942 -1.537 38.106 5.033 38.106 L 5.679 38.085 C 4.026 45.68 20.032 53.41 28.958 49.548 L 29.531 48.92 C 32.713 55.752 44.02 56.893 55.201 57.177 C 64.89 57.425 70.546 56.658 74.702 52.411 L 75.341 52.599 C 90.852 53.845 97.915 43.133 94.526 35.442 L 95.36 35.207 C 100.648 33.808 101.258 21.602 92.187 19.797 L 92.361 19.325 C 96.299 11.385 87.011 3.896 74.124 5.303 L 73.23 4.837 C 64.003 -3.517 37.449 -2.157 34.373 6.108 L 33.84 5.912 Z" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g></g><g transform="matrix(1,0,0,1,108,55)"><g transform="translate(146,210) matrix(1,0,0,1,0,0) translate(-146,-210)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="259" height="75" fill-opacity="0"/></g></g><g transform="translate(146,210) matrix(1,0,0,1,0,0) translate(-146,-210)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="259" height="45" fill-opacity="0"/></g></g><g transform="translate(146,210) matrix(1,0,0,1,0,0) translate(-146,-210)"><g><rect fill="rgb(0,0,0)" stroke="none" x="29" y="0" width="231" height="45" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="29" y="13">Unless</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="73" y="13">notified</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="118" y="13">about</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="154" y="13">the</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="176" y="13">container</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="14" y="28">networks</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="66" y="28">,</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="73" y="28">the</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="95" y="28">physical</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="146" y="28">network</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="195" y="28">does</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="227" y="28">not</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="47" y="43">have</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="79" y="43">a</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="90" y="43">route</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="123" y="43">to</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="137" y="43">their</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="166" y="43">subnets</text></g><g transform="translate(146,210) matrix(1,0,0,1,0,0) translate(-146,-210)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="45" width="259" height="15" fill-opacity="0"/></g></g><g transform="translate(146,210) matrix(1,0,0,1,0,0) translate(-146,-210)"><g><rect fill="rgb(0,0,0)" stroke="none" x="57" y="45" width="147" height="15" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="57" y="58">Who</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="89" y="58">has</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="115" y="58">10</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="129" y="58">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="133" y="58">16</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="147" y="58">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="151" y="58">20</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="165" y="58">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="169" y="58">0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="176" y="58">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="180" y="58">24</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="194" y="58">?</text></g><g transform="translate(146,210) matrix(1,0,0,1,0,0) translate(-146,-210)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="60" width="259" height="15" fill-opacity="0"/></g></g><g transform="translate(146,210) matrix(1,0,0,1,0,0) translate(-146,-210)"><g><rect fill="rgb(0,0,0)" stroke="none" x="60" y="60" width="139" height="15" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="60" y="73">Who</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="92" y="73">has</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="118" y="73">10</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="133" y="73">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="136" y="73">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="144" y="73">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="147" y="73">20</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="162" y="73">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="165" y="73">0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="172" y="73">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="176" y="73">24</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="191" y="73">?</text></g></g><g transform="matrix(1,0,0,1,9,404)"><g transform="translate(4,0) matrix(1,0,0,1,0,0) translate(-4,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="439" height="18" fill-opacity="0"/></g></g><g transform="translate(4,0) matrix(1,0,0,1,0,0) translate(-4,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="439" height="18" fill-opacity="0"/></g></g><g transform="translate(4,0) matrix(1,0,0,1,0,0) translate(-4,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="4" y="0" width="431" height="17" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="4" y="15">Containers</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="86" y="15">can</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="116" y="15">be</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="139" y="15">on</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="161" y="15">different</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="223" y="15">subnets</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="284" y="15">and</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="315" y="15">reach</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="359" y="15">each</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="398" y="15">other</text></g></g><g transform="matrix(1,0,0,1,108,253)"><g transform="translate(153,0) matrix(1,0,0,1,0,0) translate(-153,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="235" height="22" fill-opacity="0"/></g></g><g transform="translate(153,0) matrix(1,0,0,1,0,0) translate(-153,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="235" height="22" fill-opacity="0"/></g></g><g transform="translate(153,0) matrix(1,0,0,1,0,0) translate(-153,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="42" y="0" width="70" height="22" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="20px" font-style="normal" font-weight="bold" text-decoration="" line-height="22.75px" x="48" y="19">Ipvlan</text></g><g transform="translate(153,0) matrix(1,0,0,1,0,0) translate(-153,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="111" y="0" width="82" height="22" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="20px" font-style="normal" font-weight="bold" text-decoration="" line-height="22.75px" x="111" y="19">L3</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="20px" font-style="normal" font-weight="bold" text-decoration="" line-height="22.75px" x="140" y="19">Mode</text></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,124,172)"><g transform="translate(4,4) scale(1.002415458937198,1.0104166666666667)"><g><g transform="translate(0,0) scale(2.07,0.48)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.48309178743961356,2.0833333333333335)"><path fill="#000000" stroke="none" d="M 10 0 L 196.99999999999997 0 Q 206.99999999999997 0 206.99999999999997 10 L 206.99999999999997 38 Q 206.99999999999997 48 196.99999999999997 48 L 10 48 Q 0 48 0 38 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 196.99999999999997 0 Q 206.99999999999997 0 206.99999999999997 10 L 206.99999999999997 38 Q 206.99999999999997 48 196.99999999999997 48 L 10 48 Q 0 48 0 38 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(2.07,0.48)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.48309178743961356,2.0833333333333335)"><path fill="#cccccc" stroke="none" d="M 10 0 L 196.99999999999997 0 Q 206.99999999999997 0 206.99999999999997 10 L 206.99999999999997 38 Q 206.99999999999997 48 196.99999999999997 48 L 10 48 Q 0 48 0 38 L 0 10 Q 0 0 10 0 Z"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 196.99999999999997 0 Q 206.99999999999997 0 206.99999999999997 10 L 206.99999999999997 38 Q 206.99999999999997 48 196.99999999999997 48 L 10 48 Q 0 48 0 38 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10"/></g></g></g></g></g><g transform="matrix(1,0,0,1,136,175)"><g transform="translate(271,112) matrix(1,0,0,1,0,0) translate(-271,-112)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="185" height="42" fill-opacity="0"/></g></g><g transform="translate(271,112) matrix(1,0,0,1,0,0) translate(-271,-112)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="185" height="14" fill-opacity="0"/></g></g><g transform="translate(271,112) matrix(1,0,0,1,0,0) translate(-271,-112)"><g><rect fill="rgb(0,0,0)" stroke="none" x="79" y="0" width="27" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="79" y="12">Eth0</text></g><g transform="translate(271,112) matrix(1,0,0,1,0,0) translate(-271,-112)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="185" height="14" fill-opacity="0"/></g></g><g transform="translate(271,112) matrix(1,0,0,1,0,0) translate(-271,-112)"><g><rect fill="rgb(0,0,0)" stroke="none" x="46" y="14" width="95" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="46" y="26">192</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="66" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="69" y="26">168</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="89" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="92" y="26">50</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="106" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="109" y="26">10</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="122" y="26">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="126" y="26">24</text></g><g transform="translate(271,112) matrix(1,0,0,1,0,0) translate(-271,-112)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="28" width="185" height="14" fill-opacity="0"/></g></g><g transform="translate(271,112) matrix(1,0,0,1,0,0) translate(-271,-112)"><g><rect fill="rgb(0,0,0)" stroke="none" x="3" y="28" width="179" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="3" y="40">Parent</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="42" y="40">interface</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="91" y="40">acts</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="117" y="40">as</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="133" y="40">a</text></g><g transform="translate(271,112) matrix(1,0,0,1,0,0) translate(-271,-112)"><g><rect fill="rgb(0,0,0)" stroke="none" x="143" y="28" width="40" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="143" y="40">Router</text></g></g><g transform="matrix(1,0,0,1,31,358)"><g transform="translate(698,64) matrix(1,0,0,1,0,0) translate(-698,-64)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="388" height="32" fill-opacity="0"/></g></g><g transform="translate(698,64) matrix(1,0,0,1,0,0) translate(-698,-64)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="388" height="16" fill-opacity="0"/></g></g><g transform="translate(698,64) matrix(1,0,0,1,0,0) translate(-698,-64)"><g><rect fill="rgb(0,0,0)" stroke="none" x="30" y="0" width="328" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="30" y="14">All</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="50" y="14">containers</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="118" y="14">can</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="145" y="14">ping</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="175" y="14">each</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="209" y="14">other</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="299" y="14">a</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="310" y="14">router</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="351" y="14">if</text></g><g transform="translate(698,64) matrix(1,0,0,1,0,0) translate(-698,-64)"><g><rect fill="rgb(0,0,0)" stroke="none" x="245" y="0" width="50" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="245" y="14">without</text></g><g transform="translate(698,64) matrix(1,0,0,1,0,0) translate(-698,-64)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="16" width="388" height="16" fill-opacity="0"/></g></g><g transform="translate(698,64) matrix(1,0,0,1,0,0) translate(-698,-64)"><g><rect fill="rgb(0,0,0)" stroke="none" x="31" y="16" width="328" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="31" y="30">they</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="61" y="30">share</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="100" y="30">the</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="163" y="30">parent</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="206" y="30">interface</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="260" y="30"> (</text></g><g transform="translate(698,64) matrix(1,0,0,1,0,0) translate(-698,-64)"><g><rect fill="rgb(0,0,0)" stroke="none" x="123" y="16" width="36" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="123" y="30">same</text></g><g transform="translate(698,64) matrix(1,0,0,1,0,0) translate(-698,-64)"><g><rect fill="rgb(0,0,0)" stroke="none" x="269" y="16" width="90" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="269" y="30">example</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="326" y="30">eth0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="353" y="30">)</text></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,320,296)"><g><g transform="translate(0,0) scale(1.14,0.57)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.8771929824561404,1.7543859649122808)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 103.99999999999999 0 Q 113.99999999999999 0 113.99999999999999 10 L 113.99999999999999 46.99999999999999 Q 113.99999999999999 56.99999999999999 103.99999999999999 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" opacity="0.97"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 103.99999999999999 0 Q 113.99999999999999 0 113.99999999999999 10 L 113.99999999999999 46.99999999999999 Q 113.99999999999999 56.99999999999999 103.99999999999999 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.97"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,310,286)"><g><g transform="translate(0,0) scale(1.14,0.57)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.8771929824561404,1.7543859649122808)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 103.99999999999999 0 Q 113.99999999999999 0 113.99999999999999 10 L 113.99999999999999 46.99999999999999 Q 113.99999999999999 56.99999999999999 103.99999999999999 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" opacity="0.97"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 103.99999999999999 0 Q 113.99999999999999 0 113.99999999999999 10 L 113.99999999999999 46.99999999999999 Q 113.99999999999999 56.99999999999999 103.99999999999999 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.97"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,300,276)"><g><g transform="translate(0,0) scale(1.14,0.57)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.8771929824561404,1.7543859649122808)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 103.99999999999999 0 Q 113.99999999999999 0 113.99999999999999 10 L 113.99999999999999 46.99999999999999 Q 113.99999999999999 56.99999999999999 103.99999999999999 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" opacity="0.97"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 103.99999999999999 0 Q 113.99999999999999 0 113.99999999999999 10 L 113.99999999999999 46.99999999999999 Q 113.99999999999999 56.99999999999999 103.99999999999999 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.97"/></g></g></g></g></g><g transform="matrix(1,0,0,1,310,283)"><g transform="translate(93,71) matrix(1,0,0,1,0,0) translate(-93,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="94" height="44" fill-opacity="0"/></g></g><g transform="translate(93,71) matrix(1,0,0,1,0,0) translate(-93,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="94" height="14" fill-opacity="0"/></g></g><g transform="translate(93,71) matrix(1,0,0,1,0,0) translate(-93,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="14" y="0" width="67" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="14" y="12">Container</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="66" y="12">(</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="70" y="12">s</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="76" y="12">)</text></g><g transform="translate(93,71) matrix(1,0,0,1,0,0) translate(-93,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="94" height="30" fill-opacity="0"/></g></g><g transform="translate(93,71) matrix(1,0,0,1,0,0) translate(-93,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="34" y="14" width="73" height="30" fill-opacity="0"/></g></g><g transform="translate(93,71) matrix(1,0,0,1,0,0) translate(-93,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="34" y="14" width="73" height="30" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="34" y="27">Eth0</text></g><g transform="translate(93,71) matrix(1,0,0,1,0,0) translate(-93,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="11" y="29" width="73" height="15" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="11" y="42">10</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="26" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="29" y="42">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="36" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="40" y="42">20</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="54" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="58" y="42">x</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="65" y="42">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="69" y="42">24</text></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,44,296)"><g><g transform="translate(0,0) scale(1.14,0.57)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.8771929824561404,1.7543859649122808)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 103.99999999999999 0 Q 113.99999999999999 0 113.99999999999999 10 L 113.99999999999999 46.99999999999999 Q 113.99999999999999 56.99999999999999 103.99999999999999 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" opacity="0.97"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 103.99999999999999 0 Q 113.99999999999999 0 113.99999999999999 10 L 113.99999999999999 46.99999999999999 Q 113.99999999999999 56.99999999999999 103.99999999999999 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.97"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,34,286)"><g><g transform="translate(0,0) scale(1.14,0.57)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.8771929824561404,1.7543859649122808)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 103.99999999999999 0 Q 113.99999999999999 0 113.99999999999999 10 L 113.99999999999999 46.99999999999999 Q 113.99999999999999 56.99999999999999 103.99999999999999 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" opacity="0.97"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 103.99999999999999 0 Q 113.99999999999999 0 113.99999999999999 10 L 113.99999999999999 46.99999999999999 Q 113.99999999999999 56.99999999999999 103.99999999999999 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.97"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,24,276)"><g><g transform="translate(0,0) scale(1.14,0.57)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.8771929824561404,1.7543859649122808)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 103.99999999999999 0 Q 113.99999999999999 0 113.99999999999999 10 L 113.99999999999999 46.99999999999999 Q 113.99999999999999 56.99999999999999 103.99999999999999 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" opacity="0.97"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 103.99999999999999 0 Q 113.99999999999999 0 113.99999999999999 10 L 113.99999999999999 46.99999999999999 Q 113.99999999999999 56.99999999999999 103.99999999999999 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.97"/></g></g></g></g></g><g transform="matrix(1,0,0,1,34,283)"><g transform="translate(85,100) matrix(1,0,0,1,0,0) translate(-85,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="94" height="43" fill-opacity="0"/></g></g><g transform="translate(85,100) matrix(1,0,0,1,0,0) translate(-85,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="94" height="14" fill-opacity="0"/></g></g><g transform="translate(85,100) matrix(1,0,0,1,0,0) translate(-85,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="14" y="0" width="67" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="14" y="12">Container</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="66" y="12">(</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="70" y="12">s</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="76" y="12">)</text></g><g transform="translate(85,100) matrix(1,0,0,1,0,0) translate(-85,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="94" height="15" fill-opacity="0"/></g></g><g transform="translate(85,100) matrix(1,0,0,1,0,0) translate(-85,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="32" y="14" width="31" height="15" fill-opacity="0"/></g></g><g transform="translate(85,100) matrix(1,0,0,1,0,0) translate(-85,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="32" y="14" width="31" height="15" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="32" y="27">Eth0</text></g><g transform="translate(85,100) matrix(1,0,0,1,0,0) translate(-85,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="29" width="94" height="14" fill-opacity="0"/></g></g><g transform="translate(85,100) matrix(1,0,0,1,0,0) translate(-85,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="7" y="29" width="81" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="7" y="41">172</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="27" y="41">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="31" y="41">16</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="44" y="41">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="47" y="41">20</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="61" y="41">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="64" y="41">x</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="71" y="41">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="74" y="41">24</text></g></g><g transform="matrix(1,0,0,1,147,278)"><image width="170" height="60" preserveAspectRatio="none" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAKoAAAA8CAYAAAD2SSHcAAADKElEQVR4Ae3ZPWgTYRzH8SYx4gu4CG5CDAkoOAkdsiYh6GwzqEMHB1FwUREaEU7roE5KwUm6uAihc8krMUtwc3QwAREUqRIXI2he/F0xEGgSr2fvTb6B48Jzz+vn+ee5uycLC3wQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEAi6QCjoA/BR/wNlGfER3MyuZDKZxXg8/iKZTL5ut9tfZmbkgmWBXC53LBaLVRKJxLtOp/PeckGPMu7zqF1LzQrz5GAweKDM5y0VINNuBVLD4bChhWAzHA4XKpXKm91W4FZ+XwaqAvS4AtTQsSyIQKz6bk2YQ+2cU8CezWazL3W+W6/X2w61Y7taXwWqftlHNZKCAvSazgdsj4qCdgRCo9HoQigUWkqn08+j0ehqqVT6ZKciJ8r4IlC1gh5WcN7QAG/pOOLEQKnTskBUwXq13+8va+F4qnl53Gg0vlku7VDGsEP1Wqo2n8/v1+3mujC2VOC+DoLUkpwrmQ6plZVIJLKlgL2dSqUOutLqjEY82aIwDCPcbDYv6Zd7T/06MaNvO5KFdqpcLr81LwhvtCPDREKtVps7NsrP95ugHH/9aM6XVtp1rbD9caJbZ09XVLcGSTvBF5i76jg9PPPW3+12r+gh/pHa+uutZXJFdbpv/3v95j6qHrk+WxinuXre6fV6a61W64eF/I5k8fRlqlgs/tSo1oS2zsuUI/P7L5X2VNg3L1OeBupYUc+d3/V9Vc+Nz3Qu6GB7aozj/vmX7nBsT81z1wvQV12/qRX2iVZYQ9/Z8J8HtrfXRnpZ8u2Gvy9fprTCflDQXtYz6WnNxcbezge1TREw/0I9U61WL/rxXymzv7649U+B2076sxW1pEeCRSU8nJWPdNsCLQXoiv7jf2W7BgpOFfB0l2Jqj4KbiGVw546eI4AAAggggAACCCCAAAIIIIAAAggggAACCCCAAAIIIIAAAggggAACCCCAAAIIIIAAAggggAACCCCAAAIIIIAAAggggAACCGwL/AYbB9txUIt6ngAAAABJRU5ErkJggg==" transform="translate(0,0)"/></g><g transform="matrix(1,0,0,1,169,33)"><g transform="translate(8,0) matrix(1,0,0,1,0,0) translate(-8,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="132" height="32" fill-opacity="0"/></g></g><g transform="translate(8,0) matrix(1,0,0,1,0,0) translate(-8,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="132" height="16" fill-opacity="0"/></g></g><g transform="translate(8,0) matrix(1,0,0,1,0,0) translate(-8,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="8" y="0" width="116" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="8" y="14">Physical</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="69" y="14">Network</text></g></g></g></svg>
\ No newline at end of file
diff --git a/components/engine/experimental/images/ipvlan_l2_simple.gliffy b/components/engine/experimental/images/ipvlan_l2_simple.gliffy
deleted file mode 100644
index 41b0475dfa..0000000000
--- a/components/engine/experimental/images/ipvlan_l2_simple.gliffy
+++ /dev/null
@@ -1 +0,0 @@
-{"contentType":"application/gliffy+json","version":"1.3","stage":{"background":"#ffffff","width":323,"height":292,"nodeIndex":211,"autoFit":true,"exportBorder":false,"gridOn":true,"snapToGrid":false,"drawingGuidesOn":false,"pageBreaksOn":false,"printGridOn":false,"printPaper":"LETTER","printShrinkToFit":false,"printPortrait":true,"maxWidth":5000,"maxHeight":5000,"themeData":null,"viewportType":"default","fitBB":{"min":{"x":16,"y":21.51999694824218},"max":{"x":323,"y":291.5}},"printModel":{"pageSize":"a4","portrait":false,"fitToOnePage":false,"displayPageBreaks":false},"objects":[{"x":241.0,"y":36.0,"rotation":0.0,"id":199,"width":73.00000000000003,"height":40.150000000000006,"uid":"com.gliffy.shape.network.network_v4.business.router","order":41,"lockAspectRatio":true,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.network.network_v4.business.router","strokeWidth":1.0,"strokeColor":"#000000","fillColor":"#3966A0","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":85.0,"y":50.0,"rotation":0.0,"id":150,"width":211.0,"height":31.0,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":37,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":6.0,"strokeColor":"#999999","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":10.0,"controlPath":[[3.1159999999999997,6.359996948242184],[85.55799999999999,6.359996948242184],[85.55799999999999,62.0],[84.0,62.0]],"lockSegments":{"1":true},"ortho":true}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":22.803646598905374,"y":21.51999694824218,"rotation":0.0,"id":134,"width":64.31235340109463,"height":90.0,"uid":"com.gliffy.shape.cisco.cisco_v1.servers.standard_host","order":43,"lockAspectRatio":true,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.cisco.cisco_v1.servers.standard_host","strokeWidth":2.0,"strokeColor":"#333333","fillColor":"#3d85c6","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":87.0,"y":24.199996948242188,"rotation":0.0,"id":187,"width":105.0,"height":28.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":39,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:left;\"><span style=\"\">eth0 192.168.1.0/24</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":147.0,"y":50.0,"rotation":0.0,"id":196,"width":211.0,"height":31.0,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":40,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":199,"py":0.5,"px":0.0}}},"graphic":{"type":"Line","Line":{"strokeWidth":6.0,"strokeColor":"#999999","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[-82.00001598011289,6.075000000000003],[94.0,6.075000000000003]],"lockSegments":{"1":true},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":220.0,"y":79.19999694824219,"rotation":0.0,"id":207,"width":105.0,"height":28.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":42,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"\">Network Router</span></p><p style=\"text-align:center;\"><span style=\"\">192.168.1.1/24</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":27.38636363636374,"y":108.14285409109937,"rotation":0.0,"id":129,"width":262.0,"height":124.0,"uid":"com.gliffy.shape.iphone.iphone_ios7.icons_glyphs.glyph_cloud","order":44,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.iphone.iphone_ios7.icons_glyphs.glyph_cloud","strokeWidth":1.0,"strokeColor":"#000000","fillColor":"#929292","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":33.0,"y":157.96785409109907,"rotation":0.0,"id":114,"width":150.0,"height":60.0,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":16,"lockAspectRatio":false,"lockShape":false,"children":[{"x":44.0,"y":2.9951060358893704,"rotation":0.0,"id":95,"width":62.0,"height":36.17618270799329,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":4,"lockAspectRatio":false,"lockShape":false,"children":[{"x":29.139999999999997,"y":3.2300163132136848,"rotation":0.0,"id":96,"width":3.719999999999998,"height":29.7161500815659,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":13,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":99,"py":0.0,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":99,"py":1.0,"px":0.5}}},"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#0b5394","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[1.8599999999999994,-1.2920065252854727],[1.8599999999999994,31.0081566068514]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":51.46,"y":3.2300163132136848,"rotation":0.0,"id":97,"width":1.2156862745098034,"height":31.008156606851365,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":10,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#0b5394","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[-1.4193795664340882,-1.292006525285804],[-1.4193795664340882,31.008156606851536]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":9.919999999999993,"y":1.5073409461663854,"rotation":0.0,"id":98,"width":1.239999999999999,"height":31.008156606851365,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":7,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#0b5394","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[2.0393795664339223,0.4306688417619762],[2.0393795664339223,32.73083197389853]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":0.0,"y":1.9380097879282103,"rotation":0.0,"id":99,"width":62.0,"height":32.300163132136866,"uid":"com.gliffy.shape.basic.basic_v1.default.rectangle","order":2,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.rectangle.basic_v1","strokeWidth":2.0,"strokeColor":"#6fa8dc","fillColor":"#3d85c6","gradient":true,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":0.0,"y":38.326264274062034,"rotation":0.0,"id":112,"width":150.0,"height":28.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":15,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-family:Arial;font-size:12px;\"><span style=\"\">container1</span></span></p><p style=\"text-align:center;\"><span style=\"font-family:Arial;font-size:12px;\"><span style=\"\">192.168.1.2/24</span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":124.0,"y":157.96785409109907,"rotation":0.0,"id":115,"width":150.0,"height":58.99999999999999,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":33,"lockAspectRatio":false,"lockShape":false,"children":[{"x":44.0,"y":2.94518760195788,"rotation":0.0,"id":116,"width":62.0,"height":35.573246329526725,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":21,"lockAspectRatio":false,"lockShape":false,"children":[{"x":29.139999999999997,"y":3.1761827079934557,"rotation":0.0,"id":117,"width":3.719999999999998,"height":29.220880913539798,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":30,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":120,"py":0.0,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":120,"py":1.0,"px":0.5}}},"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#0b5394","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[1.8600000000000136,-1.2704730831974018],[1.8600000000000136,30.49135399673719]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":51.46,"y":3.1761827079934557,"rotation":0.0,"id":118,"width":1.2156862745098034,"height":30.49135399673717,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":27,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#0b5394","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[-1.4193795664340882,-1.2704730831977067],[-1.4193795664340882,30.491353996737335]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":9.919999999999993,"y":1.482218597063612,"rotation":0.0,"id":119,"width":1.239999999999999,"height":30.49135399673717,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":24,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#0b5394","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[2.0393795664339223,0.42349102773260977],[2.0393795664339223,32.185318107666895]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":0.0,"y":1.9057096247960732,"rotation":0.0,"id":120,"width":62.0,"height":31.76182707993458,"uid":"com.gliffy.shape.basic.basic_v1.default.rectangle","order":19,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.rectangle.basic_v1","strokeWidth":2.0,"strokeColor":"#6fa8dc","fillColor":"#3d85c6","gradient":true,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":0.0,"y":36.36247960848299,"rotation":0.0,"id":121,"width":150.0,"height":30.183360522022674,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":32,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-family:Arial;font-size:12px;\"><span style=\"\">container2</span></span></p><p style=\"text-align:center;\"><span style=\"\">192.168.1.3/24</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":102.0,"y":130.1999969482422,"rotation":0.0,"id":130,"width":150.0,"height":14.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":34,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"\">pub_net (eth0)</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":93.0,"y":92.69999694824219,"rotation":0.0,"id":140,"width":150.0,"height":14.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":35,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"text-decoration:none;font-family:Arial;font-size:12px;\"><span style=\"text-decoration:none;\"><br /></span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":14.0,"y":114.19999694824219,"rotation":0.0,"id":142,"width":78.0,"height":14.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":36,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-family:Arial;font-size:12px;\"><span style=\"\">Docker Host</span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":71.0,"y":235.5,"rotation":0.0,"id":184,"width":196.0,"height":56.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":38,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:left;\"><span style=\"\">docker network create -d ipvlan \\</span></p><p style=\"text-align:left;\"><span style=\"\">&nbsp; &nbsp; --subnet&#61;192.168.1.0/24 \\</span></p><p style=\"text-align:left;\"><span style=\"\">&nbsp; &nbsp; --gateway&#61;192.168.1.1 \\</span></p><p style=\"text-align:left;\"><span style=\"\">&nbsp; &nbsp; -o parent&#61;eth0 pub_net</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"layers":[{"guid":"9wom3rMkTrb3","order":0,"name":"Layer 0","active":true,"locked":false,"visible":true,"nodeIndex":45}],"shapeStyles":{},"lineStyles":{"global":{"stroke":"#999999","strokeWidth":6,"orthoMode":1}},"textStyles":{"global":{"bold":true,"face":"Arial","size":"12px","color":"#000000"}}},"metadata":{"title":"untitled","revision":0,"exportBorder":false,"loadPosition":"default","libraries":["com.gliffy.libraries.network.network_v4.home","com.gliffy.libraries.network.network_v4.business","com.gliffy.libraries.network.network_v4.rack","com.gliffy.libraries.network.network_v3.home","com.gliffy.libraries.network.network_v3.business","com.gliffy.libraries.network.network_v3.rack"],"lastSerialized":1457584497063,"analyticsProduct":"Confluence"},"embeddedResources":{"index":0,"resources":[]}}
\ No newline at end of file
diff --git a/components/engine/experimental/images/ipvlan_l2_simple.png b/components/engine/experimental/images/ipvlan_l2_simple.png
deleted file mode 100644
index e489a446dd..0000000000
Binary files a/components/engine/experimental/images/ipvlan_l2_simple.png and /dev/null differ
diff --git a/components/engine/experimental/images/ipvlan_l2_simple.svg b/components/engine/experimental/images/ipvlan_l2_simple.svg
deleted file mode 100644
index 48097dc83b..0000000000
--- a/components/engine/experimental/images/ipvlan_l2_simple.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="343" height="311.5"><style xmlns="http://www.w3.org/1999/xhtml"></style><defs><linearGradient id="tFoWDamkeRwJ" x1="0px" x2="0px" y1="100px" y2="-50px" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#3d85c6"/><stop offset="1" stop-color="#FFFFFF"/></linearGradient><linearGradient id="rNGNyECMdeKI" x1="0px" x2="0px" y1="100px" y2="-50px" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#3d85c6"/><stop offset="1" stop-color="#FFFFFF"/></linearGradient></defs><g transform="translate(0,0)"><g><rect fill="#ffffff" stroke="none" x="0" y="0" width="343" height="311.5"/></g><g transform="translate(0,0) matrix(1,0,0,1,77,162.90096991491666)"><g><g transform="translate(0,0) scale(0.62,0.32300163132136867)"><g><path fill="url(#tFoWDamkeRwJ)" stroke="none" d="M 0 0 L 100 0 Q 100 0 100 0 L 100 100 Q 100 100 100 100 L 0 100 Q 0 100 0 100 L 0 0 Q 0 0 0 0 Z"/><g transform="scale(1.6129032258064517,3.0959595959596116)"><path fill="none" stroke="none" d="M 0 0 L 62 0 Q 62 0 62 0 L 62 32.300163132136866 Q 62 32.300163132136866 62 32.300163132136866 L 0 32.300163132136866 Q 0 32.300163132136866 0 32.300163132136866 L 0 0 Q 0 0 0 0 Z"/><path fill="url(#tFoWDamkeRwJ)" stroke="#6fa8dc" d="M 0 0 M 0 0 L 62 0 Q 62 0 62 0 L 62 32.300163132136866 Q 62 32.300163132136866 62 32.300163132136866 L 0 32.300163132136866 Q 0 32.300163132136866 0 32.300163132136866 L 0 0 Q 0 0 0 0 Z" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g></g><g transform="matrix(1,0,0,1,84.45937956643391,158.4009699149168)"><g transform="translate(0,0)"><g transform="translate(-86.91999999999999,-162.47030107315481) translate(2.4606204335660777,4.069331158238015) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#0b5394" d="M 88.95937956643391 162.9009699149168 L 88.95937956643391 195.20113304705336" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,122.54062043356592,158.40096991491632)"><g transform="translate(0,0)"><g transform="translate(-128.46,-164.19297644020213) translate(5.919379566434088,5.792006525285814) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#0b5394" d="M 127.04062043356592 162.90096991491632 L 127.04062043356592 195.20113304705367" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,103.5,158.40096991491666)"><g transform="translate(0,0)"><g transform="translate(-106.14,-164.19297644020213) translate(2.6400000000000006,5.792006525285473) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#0b5394" d="M 108 162.90096991491666 L 108 195.20113304705353" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,35,196)"><g transform="translate(156,42) matrix(1,0,0,1,0,0) translate(-156,-42)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="147" height="28" fill-opacity="0"/></g></g><g transform="translate(156,42) matrix(1,0,0,1,0,0) translate(-156,-42)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="147" height="14" fill-opacity="0"/></g></g><g transform="translate(156,42) matrix(1,0,0,1,0,0) translate(-156,-42)"><g><rect fill="rgb(0,0,0)" stroke="none" x="45" y="0" width="57" height="14" fill-opacity="0"/></g></g><g transform="translate(156,42) matrix(1,0,0,1,0,0) translate(-156,-42)"><g><rect fill="rgb(0,0,0)" stroke="none" x="45" y="0" width="57" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="45" y="12">container1</text></g><g transform="translate(156,42) matrix(1,0,0,1,0,0) translate(-156,-42)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="147" height="14" fill-opacity="0"/></g></g><g transform="translate(156,42) matrix(1,0,0,1,0,0) translate(-156,-42)"><g><rect fill="rgb(0,0,0)" stroke="none" x="33" y="14" width="81" height="14" fill-opacity="0"/></g></g><g transform="translate(156,42) matrix(1,0,0,1,0,0) translate(-156,-42)"><g><rect fill="rgb(0,0,0)" stroke="none" x="33" y="14" width="81" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="33" y="26">192</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="53" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="57" y="26">168</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="77" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="80" y="26">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="87" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="90" y="26">2</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="97" y="26">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="100" y="26">24</text></g></g><g transform="translate(0,0) matrix(1,0,0,1,168,162.818751317853)"><g><g transform="translate(0,0) scale(0.62,0.3176182707993458)"><g><path fill="url(#rNGNyECMdeKI)" stroke="none" d="M 0 0 L 100 0 Q 100 0 100 0 L 100 100 Q 100 100 100 100 L 0 100 Q 0 100 0 100 L 0 0 Q 0 0 0 0 Z"/><g transform="scale(1.6129032258064517,3.148433487416555)"><path fill="none" stroke="none" d="M 0 0 L 62 0 Q 62 0 62 0 L 62 31.76182707993458 Q 62 31.76182707993458 62 31.76182707993458 L 0 31.76182707993458 Q 0 31.76182707993458 0 31.76182707993458 L 0 0 Q 0 0 0 0 Z"/><path fill="url(#rNGNyECMdeKI)" stroke="#6fa8dc" d="M 0 0 M 0 0 L 62 0 Q 62 0 62 0 L 62 31.76182707993458 Q 62 31.76182707993458 62 31.76182707993458 L 0 31.76182707993458 Q 0 31.76182707993458 0 31.76182707993458 L 0 0 Q 0 0 0 0 Z" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g></g><g transform="matrix(1,0,0,1,175.4593795664339,158.31875131785318)"><g transform="translate(0,0)"><g transform="translate(-177.92,-162.39526029012058) translate(2.4606204335660777,4.076508972267391) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#0b5394" d="M 179.9593795664339 162.81875131785318 L 179.9593795664339 194.58057839778746" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,213.54062043356592,158.3187513178527)"><g transform="translate(0,0)"><g transform="translate(-219.46,-164.08922440105042) translate(5.919379566434088,5.7704730831977145) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#0b5394" d="M 218.04062043356592 162.8187513178527 L 218.04062043356592 194.58057839778775" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,194.5,158.318751317853)"><g transform="translate(0,0)"><g transform="translate(-197.14,-164.08922440105042) translate(2.6399999999999864,5.770473083197402) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#0b5394" d="M 199 162.818751317853 L 199 194.5805783977876" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,126,195)"><g transform="translate(123,28) matrix(1,0,0,1,0,0) translate(-123,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="147" height="30" fill-opacity="0"/></g></g><g transform="translate(123,28) matrix(1,0,0,1,0,0) translate(-123,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="147" height="14" fill-opacity="0"/></g></g><g transform="translate(123,28) matrix(1,0,0,1,0,0) translate(-123,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="45" y="0" width="57" height="14" fill-opacity="0"/></g></g><g transform="translate(123,28) matrix(1,0,0,1,0,0) translate(-123,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="45" y="0" width="57" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="45" y="12">container2</text></g><g transform="translate(123,28) matrix(1,0,0,1,0,0) translate(-123,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="147" height="14" fill-opacity="0"/></g></g><g transform="translate(123,28) matrix(1,0,0,1,0,0) translate(-123,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="33" y="14" width="81" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="33" y="26">192</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="53" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="57" y="26">168</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="77" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="80" y="26">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="87" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="90" y="26">3</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="97" y="26">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="100" y="26">24</text></g></g><g transform="matrix(1,0,0,1,104,130)"><g transform="translate(34,0) matrix(1,0,0,1,0,0) translate(-34,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="147" height="14" fill-opacity="0"/></g></g><g transform="translate(34,0) matrix(1,0,0,1,0,0) translate(-34,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="147" height="14" fill-opacity="0"/></g></g><g transform="translate(34,0) matrix(1,0,0,1,0,0) translate(-34,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="34" y="0" width="79" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="34" y="12">pub_net</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="78" y="12"> (</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="85" y="12">eth0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="109" y="12">)</text></g></g><g transform="matrix(1,0,0,1,95,100)"><g transform="translate(148,-14) matrix(1,0,0,1,0,0) translate(-148,14)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="147" height="14" fill-opacity="0"/></g></g><g transform="translate(148,-14) matrix(1,0,0,1,0,0) translate(-148,14)"><g/></g><g transform="translate(148,-14) matrix(1,0,0,1,0,0) translate(-148,14)"><g><rect fill="rgb(0,0,0)" stroke="none" x="74" y="-7" width="1" height="14" fill-opacity="0"/></g></g><g transform="translate(148,-14) matrix(1,0,0,1,0,0) translate(-148,14)"><g><rect fill="rgb(0,0,0)" stroke="none" x="74" y="-7" width="1" height="14" fill-opacity="0"/></g></g><g transform="translate(148,-14) matrix(1,0,0,1,0,0) translate(-148,14)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="1" height="14" fill-opacity="0"/></g></g></g><g transform="matrix(1,0,0,1,16,114)"><g transform="translate(8,0) matrix(1,0,0,1,0,0) translate(-8,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="75" height="14" fill-opacity="0"/></g></g><g transform="translate(8,0) matrix(1,0,0,1,0,0) translate(-8,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="75" height="14" fill-opacity="0"/></g></g><g transform="translate(8,0) matrix(1,0,0,1,0,0) translate(-8,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="4" y="0" width="67" height="14" fill-opacity="0"/></g></g><g transform="translate(8,0) matrix(1,0,0,1,0,0) translate(-8,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="4" y="0" width="67" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="4" y="12">Docker</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="46" y="12">Host</text></g></g><g transform="matrix(1,0,0,1,81.616,49.859996948242184)"><g transform="translate(0,0)"><g transform="translate(-85,-50) translate(3.3840000000000003,0.1400030517578159) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#999999" d="M 88.116 56.359996948242184 L 160.558 56.359996948242184 Q 170.558 56.359996948242184 170.558 66.35999694824218 L 170.558 102 Q 170.558 112 169.779 112 L 169 112" stroke-miterlimit="10" stroke-width="6"/></g></g></g></g><g transform="matrix(1,0,0,1,73,236)"><g transform="translate(0,168) matrix(1,0,0,1,0,0) translate(0,-168)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="193" height="56" fill-opacity="0"/></g></g><g transform="translate(0,168) matrix(1,0,0,1,0,0) translate(0,-168)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="193" height="14" fill-opacity="0"/></g></g><g transform="translate(0,168) matrix(1,0,0,1,0,0) translate(0,-168)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="174" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="0" y="12">docker</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="39" y="12">network</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="85" y="12">create</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="118" y="12"> -</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="125" y="12">d</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="135" y="12">ipvlan</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="167" y="12"> \</text></g><g transform="translate(0,168) matrix(1,0,0,1,0,0) translate(0,-168)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="193" height="14" fill-opacity="0"/></g></g><g transform="translate(0,168) matrix(1,0,0,1,0,0) translate(0,-168)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="152" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="13" y="26">--</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="21" y="26">subnet</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="57" y="26">=</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="64" y="26">192</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="84" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="88" y="26">168</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="108" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="111" y="26">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="118" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="121" y="26">0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="128" y="26">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="131" y="26">24</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="144" y="26"> \</text></g><g transform="translate(0,168) matrix(1,0,0,1,0,0) translate(0,-168)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="28" width="193" height="14" fill-opacity="0"/></g></g><g transform="translate(0,168) matrix(1,0,0,1,0,0) translate(0,-168)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="28" width="144" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="13" y="40">--</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="21" y="40">gateway</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="66" y="40">=</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="73" y="40">192</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="93" y="40">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="96" y="40">168</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="116" y="40">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="120" y="40">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="126" y="40">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="130" y="40">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="136" y="40"> \</text></g><g transform="translate(0,168) matrix(1,0,0,1,0,0) translate(0,-168)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="42" width="193" height="14" fill-opacity="0"/></g></g><g transform="translate(0,168) matrix(1,0,0,1,0,0) translate(0,-168)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="42" width="139" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="13" y="54">-</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="17" y="54">o</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="27" y="54">parent</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="61" y="54">=</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="68" y="54">eth0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="95" y="54">pub_net</text></g></g><g transform="matrix(1,0,0,1,89,24)"><g transform="translate(0,0) matrix(1,0,0,1,0,0) translate(0,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="102" height="28" fill-opacity="0"/></g></g><g transform="translate(0,0) matrix(1,0,0,1,0,0) translate(0,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="102" height="28" fill-opacity="0"/></g></g><g transform="translate(0,0) matrix(1,0,0,1,0,0) translate(0,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="81" height="28" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="0" y="12">eth0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="0" y="26">192</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="20" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="23" y="26">168</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="43" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="47" y="26">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="53" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="57" y="26">0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="63" y="26">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="67" y="26">24</text></g></g><g transform="matrix(1,0,0,1,58.49998401988711,49.575)"><g transform="translate(0,0)"><g transform="translate(-147,-50) translate(88.50001598011289,0.42499999999999716) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#999999" d="M 64.99998401988711 56.075 L 241 56.075" stroke-miterlimit="10" stroke-width="6"/></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,241,36)"><g><g transform="translate(0,0) scale(0.6083333333333336,0.6104050109462419)"><g><g><path fill="#3966A0" stroke="rgb(0,0,0)" d="M 102.635 0 C 93.815 0 86.371 6.797 85.395 15.43 L 4.554 15.43 C 2.043 15.431 0 17.473 0 19.984 L 0 53.338 C 0 55.849 2.043 57.892 4.554 57.892 L 8.016 57.892 L 8.016 65.776 L 96.471 65.776 L 96.471 57.892 L 99.672 57.892 C 102.184 57.892 104.227 55.849 104.227 53.338 L 104.227 34.655 C 107.211 34.382 109.971 33.334 112.331 31.735 L 112.331 31.735 C 112.785 31.428 113.223 31.1 113.643 30.753 C 113.655 30.744 113.665 30.734 113.676 30.725 C 114.093 30.38 114.492 30.017 114.875 29.635 C 114.875 29.635 114.887 29.623 114.893 29.617 C 118.039 26.471 120 22.143 120 17.365 C 120 7.79 112.21 0 102.635 0 Z" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 102.688 3.191 C 94.836 3.191 88.45 9.579 88.45 17.43 C 88.45 25.281 94.838 31.669 102.688 31.669 C 110.54 31.669 116.926 25.281 116.926 17.43 C 116.926 9.579 110.539 3.191 102.688 3.191 Z M 97.377 20.901 C 97.118 20.901 96.859 20.802 96.662 20.605 C 96.267 20.21 96.267 19.569 96.662 19.174 L 97.412 18.424 L 91.228 18.424 C 90.669 18.424 90.216 17.971 90.216 17.412 C 90.216 16.853 90.67 16.4 91.229 16.4 L 97.414 16.4 L 96.699 15.686 C 96.303 15.291 96.303 14.65 96.699 14.255 C 97.095 13.86 97.735 13.86 98.13 14.255 L 100.571 16.696 C 100.665 16.79 100.739 16.902 100.791 17.026 C 100.894 17.273 100.894 17.552 100.791 17.799 C 100.739 17.924 100.665 18.036 100.571 18.129 L 98.093 20.605 C 97.895 20.802 97.637 20.901 97.377 20.901 Z M 105.863 25.522 L 103.422 27.963 C 103.225 28.161 102.965 28.259 102.707 28.259 C 102.698 28.259 102.689 28.254 102.68 28.254 C 102.671 28.254 102.663 28.259 102.655 28.259 C 102.305 28.259 102.012 28.07 101.83 27.801 L 99.515 25.484 C 99.119 25.089 99.119 24.448 99.515 24.053 C 99.91 23.658 100.55 23.658 100.945 24.053 L 101.644 24.752 L 101.644 9.174 L 100.945 9.873 C 100.748 10.071 100.488 10.169 100.23 10.169 C 99.97 10.169 99.711 10.07 99.515 9.873 C 99.119 9.478 99.119 8.837 99.515 8.442 L 101.954 6 C 102.35 5.605 102.988 5.605 103.385 6 L 105.864 8.478 C 106.26 8.873 106.26 9.514 105.864 9.909 C 105.667 10.107 105.408 10.205 105.149 10.205 C 104.889 10.205 104.63 10.106 104.434 9.909 L 103.667 9.143 L 103.667 24.857 L 104.434 24.091 C 104.829 23.696 105.468 23.696 105.864 24.091 C 106.258 24.486 106.258 25.126 105.863 25.522 Z M 114.148 18.46 L 107.964 18.46 L 108.677 19.174 C 109.073 19.569 109.073 20.21 108.677 20.605 C 108.48 20.803 108.22 20.901 107.961 20.901 C 107.702 20.901 107.442 20.802 107.246 20.605 L 104.808 18.165 C 104.713 18.072 104.64 17.959 104.587 17.835 C 104.485 17.588 104.485 17.309 104.587 17.062 C 104.64 16.937 104.713 16.825 104.808 16.732 L 107.284 14.255 C 107.68 13.86 108.32 13.86 108.715 14.255 C 109.11 14.65 109.11 15.291 108.715 15.686 L 107.964 16.437 L 114.149 16.437 C 114.708 16.437 115.161 16.89 115.161 17.449 C 115.16 18.008 114.707 18.46 114.148 18.46 Z" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 80.533 36.476 A 3.247 3.247 0 1 0 80.53299837650013 36.47924699945883 Z" opacity="0.5" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 9.278 35.006 L 20.39 35.006 L 20.39 24 L 9.278 24 L 9.278 35.006 Z M 10.929 25.567 L 18.819 25.567 L 18.819 31.173 L 16.536 31.173 L 16.536 33.456 L 13.213 33.456 L 13.213 31.173 L 10.93 31.173 L 10.929 25.567 L 10.929 25.567 Z" opacity="0.65" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 24.253 35.015 L 35.365 35.015 L 35.365 24.009 L 24.253 24.009 L 24.253 35.015 Z M 25.904 25.576 L 33.794 25.576 L 33.794 31.182 L 31.51 31.182 L 31.51 33.465 L 28.187 33.465 L 28.187 31.182 L 25.904 31.182 L 25.904 25.576 Z" opacity="0.65" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 50.3 24.009 L 39.188 24.009 L 39.188 35.014 L 50.3 35.014 L 50.3 24.009 Z M 48.729 31.173 L 46.446 31.173 L 46.446 33.456 L 43.123 33.456 L 43.123 31.173 L 40.84 31.173 L 40.84 25.567 L 48.73 25.567 L 48.729 31.173 L 48.729 31.173 Z" opacity="0.65" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 54.123 35.023 L 65.234 35.023 L 65.234 24.018 L 54.123 24.018 L 54.123 35.023 Z M 55.774 25.567 L 63.664 25.567 L 63.664 31.173 L 61.38 31.173 L 61.38 33.456 L 58.057 33.456 L 58.057 31.173 L 55.774 31.173 L 55.774 25.567 Z" opacity="0.65" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 9.278 49.95 L 20.39 49.95 L 20.39 38.944 L 9.278 38.944 L 9.278 49.95 Z M 10.929 40.502 L 18.819 40.502 L 18.819 46.108 L 16.536 46.108 L 16.536 48.391 L 13.213 48.391 L 13.213 46.108 L 10.93 46.108 L 10.929 40.502 L 10.929 40.502 Z" opacity="0.65" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 24.253 49.958 L 35.365 49.958 L 35.365 38.953 L 24.253 38.953 L 24.253 49.958 Z M 25.904 40.52 L 33.794 40.52 L 33.794 46.126 L 31.51 46.126 L 31.51 48.408 L 28.187 48.408 L 28.187 46.126 L 25.904 46.126 L 25.904 40.52 Z" opacity="0.65" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 39.228 49.966 L 50.34 49.966 L 50.34 38.962 L 39.228 38.962 L 39.228 49.966 Z M 40.839 40.511 L 48.729 40.511 L 48.729 46.117 L 46.446 46.117 L 46.446 48.4 L 43.123 48.4 L 43.123 46.117 L 40.84 46.117 L 40.839 40.511 L 40.839 40.511 Z" opacity="0.65" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 54.123 49.966 L 65.234 49.966 L 65.234 38.962 L 54.123 38.962 L 54.123 49.966 Z M 55.774 40.511 L 63.664 40.511 L 63.664 46.117 L 61.38 46.117 L 61.38 48.4 L 58.057 48.4 L 58.057 46.117 L 55.774 46.117 L 55.774 40.511 Z" opacity="0.65" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 11.504 57.898 L 92.919 57.898 Q 92.919 57.898 92.919 57.898 L 92.919 62.69 Q 92.919 62.69 92.919 62.69 L 11.504 62.69 Q 11.504 62.69 11.504 62.69 L 11.504 57.898 Q 11.504 57.898 11.504 57.898 Z" opacity="0.7" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 85.525 18.936 L 5.082 18.936 C 4.255 18.936 3.582 19.609 3.582 20.436 L 3.582 53.397 C 3.582 54.224 4.255 54.897 5.082 54.897 L 11.504 54.897 L 92.919 54.897 L 99.082 54.897 C 99.909 54.897 100.582 54.224 100.582 53.397 L 100.582 34.526 C 92.561 33.543 86.232 27.039 85.525 18.936 Z M 20.389 49.95 L 9.278 49.95 L 9.278 38.944 L 20.39 38.944 L 20.389 49.95 L 20.389 49.95 Z M 20.389 35.006 L 9.278 35.006 L 9.278 24 L 20.39 24 L 20.389 35.006 L 20.389 35.006 Z M 35.365 49.958 L 24.253 49.958 L 24.253 38.953 L 35.365 38.953 L 35.365 49.958 Z M 35.365 35.015 L 24.253 35.015 L 24.253 24.009 L 35.365 24.009 L 35.365 35.015 Z M 39.188 24.009 L 50.3 24.009 L 50.3 35.014 L 39.188 35.014 L 39.188 24.009 Z M 50.34 49.966 L 39.228 49.966 L 39.228 38.962 L 50.34 38.962 L 50.34 49.966 Z M 65.234 49.966 L 54.123 49.966 L 54.123 38.962 L 65.234 38.962 L 65.234 49.966 Z M 65.234 35.023 L 54.123 35.023 L 54.123 24.018 L 65.234 24.018 L 65.234 35.023 Z M 77.286 39.723 C 75.493 39.723 74.039 38.269 74.039 36.476 C 74.039 34.683 75.493 33.229 77.286 33.229 C 79.079 33.229 80.533 34.683 80.533 36.476 C 80.533 38.269 79.08 39.723 77.286 39.723 Z M 89.541 39.723 C 87.748 39.723 86.294 38.269 86.294 36.476 C 86.294 34.683 87.748 33.229 89.541 33.229 C 91.334 33.229 92.788 34.683 92.788 36.476 C 92.787 38.269 91.334 39.723 89.541 39.723 Z" opacity="0.93" stroke-opacity="0" stroke-miterlimit="10"/></g></g></g></g></g><g transform="matrix(1,0,0,1,222,79)"><g transform="translate(20,28) matrix(1,0,0,1,0,0) translate(-20,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="102" height="28" fill-opacity="0"/></g></g><g transform="translate(20,28) matrix(1,0,0,1,0,0) translate(-20,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="102" height="14" fill-opacity="0"/></g></g><g transform="translate(20,28) matrix(1,0,0,1,0,0) translate(-20,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="9" y="0" width="84" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="9" y="12">Network</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="57" y="12">Router</text></g><g transform="translate(20,28) matrix(1,0,0,1,0,0) translate(-20,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="102" height="14" fill-opacity="0"/></g></g><g transform="translate(20,28) matrix(1,0,0,1,0,0) translate(-20,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="11" y="14" width="82" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="11" y="26">192</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="31" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="34" y="26">168</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="54" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="58" y="26">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="64" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="68" y="26">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="74" y="26">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="78" y="26">24</text></g></g><g transform="translate(0,0) matrix(1,0,0,1,22.803646598905374,21.51999694824218)"><g><g transform="translate(0,0) scale(0.9127109745695561,0.9)"><g><g><g><path fill="#3d85c6" stroke="#FFFFFF" d="M 52.371 16.22 L -1.393 16.22 L -1.393 99.52 L 52.371 99.52" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="#3d85c6" stroke="#FFFFFF" d="M 52.371 99.52 L 69.07 82.82 L 69.07 -0.48 L 19.98 -0.48 L -1.393 16.22 L 52.371 16.22 L 52.371 99.52 Z" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="rgb(0,0,0)" stroke="#FFFFFF" d="M 52.371 16.22 L 69.07 -0.48" fill-opacity="0" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="rgb(0,0,0)" stroke="#FFFFFF" d="M 25.3 16.22 L 25.3 99.52" fill-opacity="0" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="rgb(0,0,0)" stroke="#FFFFFF" d="M 26.149 16.22 L 44.316 -0.48" fill-opacity="0" stroke-miterlimit="10" stroke-width="1.3594"/></g></g><g><path fill="#3d85c6" stroke="#FFFFFF" d="M 3.263 23.823 L 21.317 23.823 Q 21.317 23.823 21.317 23.823 L 21.317 34.868 Q 21.317 34.868 21.317 34.868 L 3.263 34.868 Q 3.263 34.868 3.263 34.868 L 3.263 23.823 Q 3.263 23.823 3.263 23.823 Z" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="#3d85c6" stroke="#FFFFFF" d="M 29.156 23.823 L 47.207 23.823 Q 47.207 23.823 47.207 23.823 L 47.207 34.868 Q 47.207 34.868 47.207 34.868 L 29.156 34.868 Q 29.156 34.868 29.156 34.868 L 29.156 23.823 Q 29.156 23.823 29.156 23.823 Z" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="#3d85c6" stroke="#FFFFFF" d="M 3.263 64.604 L 21.317 64.604 Q 21.317 64.604 21.317 64.604 L 21.317 75.648 Q 21.317 75.648 21.317 75.648 L 3.263 75.648 Q 3.263 75.648 3.263 75.648 L 3.263 64.604 Q 3.263 64.604 3.263 64.604 Z" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="#3d85c6" stroke="#FFFFFF" d="M 29.156 64.604 L 47.207 64.604 Q 47.207 64.604 47.207 64.604 L 47.207 75.648 Q 47.207 75.648 47.207 75.648 L 29.156 75.648 Q 29.156 75.648 29.156 75.648 L 29.156 64.604 Q 29.156 64.604 29.156 64.604 Z" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="#3d85c6" stroke="#FFFFFF" d="M 3.263 82.445 L 21.317 82.445 Q 21.317 82.445 21.317 82.445 L 21.317 93.49 Q 21.317 93.49 21.317 93.49 L 3.263 93.49 Q 3.263 93.49 3.263 93.49 L 3.263 82.445 Q 3.263 82.445 3.263 82.445 Z" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="#3d85c6" stroke="#FFFFFF" d="M 29.156 82.445 L 47.207 82.445 Q 47.207 82.445 47.207 82.445 L 47.207 93.49 Q 47.207 93.49 47.207 93.49 L 29.156 93.49 Q 29.156 93.49 29.156 93.49 L 29.156 82.445 Q 29.156 82.445 29.156 82.445 Z" stroke-miterlimit="10" stroke-width="1.3594"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,27.38636363636374,108.14285409109937)"><g><g transform="translate(0,0) scale(3.742857142857143,2.8181818181818183)"><g><g><g><path fill="#929292" stroke="rgb(0,0,0)" d="M 58.97 19.094 C 58.977 18.895 59 18.7 59 18.5 C 59 8.283 50.717 0 40.5 0 C 33.11 0 26.751 4.344 23.787 10.607 C 22.275 9.593 20.458 9 18.5 9 C 13.5 9 9.41 12.866 9.037 17.771 C 3.778 19.616 0 24.61 0 30.5 C 0 37.787 5.778 43.71 13 43.975 L 13 44 L 58 44 L 58 43.975 C 64.671 43.71 70 38.235 70 31.5 C 70 25.095 65.18 19.822 58.97 19.094 Z M 58 41.975 L 58 42 L 13 42 L 13 41.975 C 6.883 41.711 2 36.683 2 30.5 C 2 24.994 5.872 20.398 11.039 19.271 C 11.013 19.017 11 18.76 11 18.5 C 11 14.357 14.358 11 18.5 11 C 21.017 11 23.239 12.244 24.6 14.146 C 26.512 7.15 32.897 2 40.5 2 C 49.613 2 57 9.388 57 18.5 C 57 19.353 56.914 20.183 56.79 21 L 58 21 L 58 21.025 C 63.565 21.288 68 25.87 68 31.5 C 68 37.13 63.565 41.712 58 41.975 Z" stroke-opacity="0" stroke-miterlimit="10"/></g></g></g></g></g></g></g></svg>
\ No newline at end of file
diff --git a/components/engine/experimental/images/macvlan-bridge-ipvlan-l2.gliffy b/components/engine/experimental/images/macvlan-bridge-ipvlan-l2.gliffy
deleted file mode 100644
index eceec778b7..0000000000
--- a/components/engine/experimental/images/macvlan-bridge-ipvlan-l2.gliffy
+++ /dev/null
@@ -1 +0,0 @@
-{"contentType":"application/gliffy+json","version":"1.3","stage":{"background":"#FFFFFF","width":541,"height":352,"nodeIndex":290,"autoFit":true,"exportBorder":false,"gridOn":true,"snapToGrid":false,"drawingGuidesOn":false,"pageBreaksOn":false,"printGridOn":false,"printPaper":"LETTER","printShrinkToFit":false,"printPortrait":true,"maxWidth":5000,"maxHeight":5000,"themeData":{"uid":"com.gliffy.theme.beach_day","name":"Beach Day","shape":{"primary":{"strokeWidth":2,"strokeColor":"#00A4DA","fillColor":"#AEE4F4","gradient":false,"dropShadow":false,"opacity":1,"text":{"color":"#004257"}},"secondary":{"strokeWidth":2,"strokeColor":"#CDB25E","fillColor":"#EACF81","gradient":false,"dropShadow":false,"opacity":1,"text":{"color":"#332D1A"}},"tertiary":{"strokeWidth":2,"strokeColor":"#FFBE00","fillColor":"#FFF1CB","gradient":false,"dropShadow":false,"opacity":1,"text":{"color":"#000000"}},"highlight":{"strokeWidth":2,"strokeColor":"#00A4DA","fillColor":"#00A4DA","gradient":false,"dropShadow":false,"opacity":1,"text":{"color":"#ffffff"}}},"line":{"strokeWidth":2,"strokeColor":"#00A4DA","fillColor":"none","arrowType":2,"interpolationType":"quadratic","cornerRadius":0,"text":{"color":"#002248"}},"text":{"color":"#002248"},"stage":{"color":"#FFFFFF"}},"viewportType":"default","fitBB":{"min":{"x":2,"y":6.5},"max":{"x":541,"y":334.5}},"printModel":{"pageSize":"a4","portrait":false,"fitToOnePage":false,"displayPageBreaks":false},"objects":[{"x":2.0,"y":6.5,"rotation":0.0,"id":288,"width":541.0,"height":22.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":31,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:20px;font-weight:bold;\">Macvlan Bridge Mode &amp; Ipvlan L2 Mode</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":8.0,"y":177.0,"rotation":0.0,"id":234,"width":252.0,"height":129.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":0,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":2.0,"strokeColor":"#434343","fillColor":"#c5e4fc","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":0.93,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":16.0,"y":240.0,"rotation":0.0,"id":225,"width":111.0,"height":57.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":1,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.73,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[{"x":2.2199999999999993,"y":0.0,"rotation":0.0,"id":235,"width":106.56,"height":45.0,"uid":null,"order":"auto","lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":8,"paddingRight":8,"paddingBottom":8,"paddingLeft":8,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:13px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">Container #1</span></span></p><p style=\"text-align:center;\"><span style=\"font-size:13px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">eth0</span></span></p><p style=\"text-align:center;\"><span style=\"font-size:13px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">172.16.1.10/24</span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":138.0,"y":240.0,"rotation":0.0,"id":237,"width":111.0,"height":57.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":4,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.73,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[{"x":2.2199999999999993,"y":0.0,"rotation":0.0,"id":238,"width":106.56,"height":44.0,"uid":null,"order":6,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":8,"paddingRight":8,"paddingBottom":8,"paddingLeft":8,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"\">Container #2</span></p><p style=\"text-align:center;\"><span style=\"font-size:13px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">eth0 172.16.1.11/24</span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":40.0,"y":-26.067047119140625,"rotation":0.0,"id":258,"width":100.0,"height":100.0,"uid":"com.gliffy.shape.uml.uml_v2.sequence.anchor_line","order":7,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":237,"py":0.0,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":241,"py":1.0,"px":0.7071067811865476}}},"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#000000","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[153.5,266.0670471191406],[117.36753236814712,224.06704711914062]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":50.0,"y":-16.067047119140625,"rotation":0.0,"id":259,"width":100.0,"height":100.0,"uid":"com.gliffy.shape.uml.uml_v2.sequence.anchor_line","order":8,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":225,"py":0.0,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":241,"py":0.9999999999999996,"px":0.29289321881345254}}},"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#000000","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[21.5,256.0670471191406],[62.632467631852876,214.0670471191406]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":60.0,"y":-6.067047119140625,"rotation":0.0,"id":260,"width":100.0,"height":100.0,"uid":"com.gliffy.shape.uml.uml_v2.sequence.anchor_line","order":9,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":241,"py":0.5,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":246,"py":0.5,"px":0.5}}},"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#000000","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[75.0,180.06704711914062],[215.32345076546227,90.06897143333742]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":3.0,"y":184.5,"rotation":0.0,"id":261,"width":79.0,"height":32.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":10,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:14px;font-family:Arial;\">Docker </span></p><p style=\"text-align:center;\"><span style=\"font-size:12px;font-family:Arial;\"><span style=\"font-size:14px;\">Host #1</span><span style=\"text-decoration:none;\"><br /></span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":283.0,"y":177.0,"rotation":0.0,"id":276,"width":252.0,"height":129.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":11,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":2.0,"strokeColor":"#434343","fillColor":"#c5e4fc","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":0.93,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":291.0,"y":240.0,"rotation":0.0,"id":274,"width":111.0,"height":57.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":12,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.73,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[{"x":2.2199999999999993,"y":0.0,"rotation":0.0,"id":275,"width":106.56,"height":45.0,"uid":null,"order":14,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":8,"paddingRight":8,"paddingBottom":8,"paddingLeft":8,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:13px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">Container #3</span></span></p><p style=\"text-align:center;\"><span style=\"font-size:13px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">eth0</span></span></p><p style=\"text-align:center;\"><span style=\"font-size:13px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">172.16.1.12/24</span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":413.0,"y":240.0,"rotation":0.0,"id":272,"width":111.0,"height":57.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":15,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.73,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[{"x":2.2199999999999993,"y":0.0,"rotation":0.0,"id":273,"width":106.56,"height":44.0,"uid":null,"order":17,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":8,"paddingRight":8,"paddingBottom":8,"paddingLeft":8,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"\">Container #4</span></p><p style=\"text-align:center;\"><span style=\"font-size:13px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">eth0 <span style=\"\">172.16.1.13/24</span></span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":315.0,"y":-26.067047119140625,"rotation":0.0,"id":269,"width":100.0,"height":100.0,"uid":"com.gliffy.shape.uml.uml_v2.sequence.anchor_line","order":18,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":272,"py":0.0,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":270,"py":1.0,"px":0.7071067811865476}}},"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#000000","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[153.5,266.0670471191406],[117.36753236814712,224.06704711914062]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":325.0,"y":-16.067047119140625,"rotation":0.0,"id":268,"width":100.0,"height":100.0,"uid":"com.gliffy.shape.uml.uml_v2.sequence.anchor_line","order":19,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":274,"py":0.0,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":270,"py":0.9999999999999996,"px":0.29289321881345254}}},"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#000000","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[21.5,256.0670471191406],[62.632467631852876,214.0670471191406]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":278.0,"y":184.5,"rotation":0.0,"id":267,"width":79.0,"height":32.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":20,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:14px;font-family:Arial;\">Docker </span></p><p style=\"text-align:center;\"><span style=\"font-size:12px;font-family:Arial;\"><span style=\"font-size:14px;\">Host #2</span><span style=\"text-decoration:none;\"><br /></span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":70.0,"y":3.932952880859375,"rotation":0.0,"id":278,"width":100.0,"height":100.0,"uid":"com.gliffy.shape.uml.uml_v2.sequence.anchor_line","order":21,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":270,"py":0.5,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":246,"py":0.5,"px":0.5}}},"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#000000","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[340.0,170.06704711914062],[205.32345076546227,80.06897143333742]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":167.32131882292583,"y":39.0019243141968,"rotation":0.0,"id":246,"width":216.0042638850729,"height":90.0,"uid":"com.gliffy.shape.cisco.cisco_v1.storage.cloud","order":22,"lockAspectRatio":true,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.cisco.cisco_v1.storage.cloud","strokeWidth":2.0,"strokeColor":"#333333","fillColor":"#434343","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":356.0,"y":150.0,"rotation":0.0,"id":270,"width":108.0,"height":48.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":23,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#cccccc","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":1.0,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[{"x":1.8620689655172418,"y":0.0,"rotation":0.0,"id":271,"width":104.27586206896557,"height":42.0,"uid":null,"order":25,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":8,"paddingRight":8,"paddingBottom":8,"paddingLeft":8,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:12px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\"><span style=\"font-style:italic;\">(Host)</span><span style=\"font-weight:bold;\"><span style=\"\"> eth0</span></span><br /></span></span></p><p style=\"text-align:center;\"><span style=\"font-size:12px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">172.16.1.253/24</span></span></p><p style=\"text-align:center;\"><span style=\"font-size:12px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">(IP Optional)</span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":81.0,"y":150.0,"rotation":0.0,"id":241,"width":108.0,"height":48.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":26,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#cccccc","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":1.0,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[{"x":1.8620689655172415,"y":0.0,"rotation":0.0,"id":242,"width":104.27586206896555,"height":42.0,"uid":null,"order":28,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":8,"paddingRight":8,"paddingBottom":8,"paddingLeft":8,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:12px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\"><span style=\"\"><span style=\"font-style:italic;\">(Host)</span></span><span style=\"font-weight:bold;\"> eth0</span><br /></span></span></p><p style=\"text-align:center;\"><span style=\"font-size:12px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">172.16.1.254/24</span></span></p><p style=\"text-align:center;\"><span style=\"font-size:12px;font-style:italic;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">(IP Optional)</span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":224.0,"y":64.19999694824219,"rotation":0.0,"id":262,"width":120.00000000000001,"height":32.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":29,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:14px;\">Network Gateway</span></p><p style=\"text-align:center;\"><span style=\"font-size:14px;\"><span style=\"\">172.16.1.1</span><span style=\"\">/24</span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":0.0,"y":307.5,"rotation":0.0,"id":282,"width":541.0,"height":36.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":30,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:16px;font-style:italic;\">Containers Attached Directly to Parent Interface. No Bridge Used (Docker0)</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"layers":[{"guid":"9wom3rMkTrb3","order":0,"name":"Layer 0","active":true,"locked":false,"visible":true,"nodeIndex":32}],"shapeStyles":{},"lineStyles":{"global":{"fill":"none","stroke":"#000000","strokeWidth":1,"orthoMode":2}},"textStyles":{"global":{"italic":true,"face":"Arial","size":"20px","color":"#000000","bold":false}}},"metadata":{"title":"untitled","revision":0,"exportBorder":false,"loadPosition":"default","libraries":["com.gliffy.libraries.basic.basic_v1.default","com.gliffy.libraries.flowchart.flowchart_v1.default","com.gliffy.libraries.swimlanes.swimlanes_v1.default","com.gliffy.libraries.images","com.gliffy.libraries.network.network_v4.home","com.gliffy.libraries.network.network_v4.business","com.gliffy.libraries.network.network_v4.rack","com.gliffy.libraries.network.network_v3.home","com.gliffy.libraries.network.network_v3.business","com.gliffy.libraries.network.network_v3.rack"],"lastSerialized":1458124258706,"analyticsProduct":"Confluence"},"embeddedResources":{"index":0,"resources":[]}}
\ No newline at end of file
diff --git a/components/engine/experimental/images/macvlan-bridge-ipvlan-l2.png b/components/engine/experimental/images/macvlan-bridge-ipvlan-l2.png
deleted file mode 100644
index 13aa4f212d..0000000000
Binary files a/components/engine/experimental/images/macvlan-bridge-ipvlan-l2.png and /dev/null differ
diff --git a/components/engine/experimental/images/macvlan-bridge-ipvlan-l2.svg b/components/engine/experimental/images/macvlan-bridge-ipvlan-l2.svg
deleted file mode 100644
index 757871e3d4..0000000000
--- a/components/engine/experimental/images/macvlan-bridge-ipvlan-l2.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="561" height="354.5"><style xmlns="http://www.w3.org/1999/xhtml"></style><defs/><g transform="translate(0,0)"><g><rect fill="#FFFFFF" stroke="none" x="0" y="0" width="561" height="354.5"/></g><g transform="translate(0,0) matrix(1,0,0,1,8,177)"><g><g transform="translate(0,0) scale(2.52,1.29)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.3968253968253968,0.7751937984496123)"><path fill="#c5e4fc" stroke="none" d="M 10 0 L 242 0 Q 252 0 252 10 L 252 119 Q 252 129 242 129 L 10 129 Q 0 129 0 119 L 0 10 Q 0 0 10 0 Z" opacity="0.93"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 242 0 Q 252 0 252 10 L 252 119 Q 252 129 242 129 L 10 129 Q 0 129 0 119 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" stroke-width="2" opacity="0.93"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,16,240)"><g transform="translate(4,4) scale(1.0045045045045045,1.0087719298245614)"><g><g transform="translate(0,0) scale(1.11,0.57)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9009009009009008,1.7543859649122808)"><path fill="#000000" stroke="none" d="M 10 0 L 101.00000000000001 0 Q 111.00000000000001 0 111.00000000000001 10 L 111.00000000000001 46.99999999999999 Q 111.00000000000001 56.99999999999999 101.00000000000001 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 101.00000000000001 0 Q 111.00000000000001 0 111.00000000000001 10 L 111.00000000000001 46.99999999999999 Q 111.00000000000001 56.99999999999999 101.00000000000001 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.11,0.57)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9009009009009008,1.7543859649122808)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 101.00000000000001 0 Q 111.00000000000001 0 111.00000000000001 10 L 111.00000000000001 46.99999999999999 Q 111.00000000000001 56.99999999999999 101.00000000000001 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" opacity="0.73"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 101.00000000000001 0 Q 111.00000000000001 0 111.00000000000001 10 L 111.00000000000001 46.99999999999999 Q 111.00000000000001 56.99999999999999 101.00000000000001 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.73"/></g></g></g></g></g><g transform="matrix(1,0,0,1,26,246)"><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="92" height="45" fill-opacity="0"/></g></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="92" height="15" fill-opacity="0"/></g></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="9" y="0" width="75" height="15" fill-opacity="0"/></g></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="9" y="0" width="75" height="15" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="9" y="13">Container</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="65" y="13"> #</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="76" y="13">1</text></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="15" width="92" height="15" fill-opacity="0"/></g></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="33" y="15" width="26" height="15" fill-opacity="0"/></g></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="33" y="15" width="26" height="15" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="33" y="28">eth0</text></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="30" width="92" height="15" fill-opacity="0"/></g></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="2" y="30" width="88" height="15" fill-opacity="0"/></g></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="2" y="30" width="88" height="15" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="2" y="43">172</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="24" y="43">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="28" y="43">16</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="42" y="43">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="46" y="43">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="53" y="43">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="57" y="43">10</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="71" y="43">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="75" y="43">24</text></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,138,240)"><g transform="translate(4,4) scale(1.0045045045045045,1.0087719298245614)"><g><g transform="translate(0,0) scale(1.11,0.57)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9009009009009008,1.7543859649122808)"><path fill="#000000" stroke="none" d="M 10 0 L 101.00000000000001 0 Q 111.00000000000001 0 111.00000000000001 10 L 111.00000000000001 46.99999999999999 Q 111.00000000000001 56.99999999999999 101.00000000000001 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 101.00000000000001 0 Q 111.00000000000001 0 111.00000000000001 10 L 111.00000000000001 46.99999999999999 Q 111.00000000000001 56.99999999999999 101.00000000000001 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.11,0.57)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9009009009009008,1.7543859649122808)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 101.00000000000001 0 Q 111.00000000000001 0 111.00000000000001 10 L 111.00000000000001 46.99999999999999 Q 111.00000000000001 56.99999999999999 101.00000000000001 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" opacity="0.73"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 101.00000000000001 0 Q 111.00000000000001 0 111.00000000000001 10 L 111.00000000000001 46.99999999999999 Q 111.00000000000001 56.99999999999999 101.00000000000001 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.73"/></g></g></g></g></g><g transform="matrix(1,0,0,1,148,247)"><g transform="translate(77,42) matrix(1,0,0,1,0,0) translate(-77,-42)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="92" height="44" fill-opacity="0"/></g></g><g transform="translate(77,42) matrix(1,0,0,1,0,0) translate(-77,-42)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="92" height="14" fill-opacity="0"/></g></g><g transform="translate(77,42) matrix(1,0,0,1,0,0) translate(-77,-42)"><g><rect fill="rgb(0,0,0)" stroke="none" x="11" y="0" width="70" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="11" y="12">Container</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="63" y="12"> #</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="73" y="12">2</text></g><g transform="translate(77,42) matrix(1,0,0,1,0,0) translate(-77,-42)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="92" height="30" fill-opacity="0"/></g></g><g transform="translate(77,42) matrix(1,0,0,1,0,0) translate(-77,-42)"><g><rect fill="rgb(0,0,0)" stroke="none" x="33" y="14" width="87" height="30" fill-opacity="0"/></g></g><g transform="translate(77,42) matrix(1,0,0,1,0,0) translate(-77,-42)"><g><rect fill="rgb(0,0,0)" stroke="none" x="33" y="14" width="87" height="30" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="33" y="27">eth0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="3" y="42">172</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="25" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="28" y="42">16</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="43" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="46" y="42">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="53" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="57" y="42">11</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="71" y="42">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="74" y="42">24</text></g></g><g transform="matrix(1,0,0,1,152.86753236814712,193.5)"><g transform="translate(0,0)"><g transform="translate(-40,26.067047119140625) translate(-112.86753236814712,-219.56704711914062) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#000000" d="M 193.5 240 L 157.36753236814712 198" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,67,193.49999999999997)"><g transform="translate(0,0)"><g transform="translate(-50,16.067047119140625) translate(-17,-209.5670471191406) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#000000" d="M 71.5 240 L 112.63246763185288 197.99999999999997" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,130.5,79.5019243141968)"><g transform="translate(0,0)"><g transform="translate(-60,6.067047119140625) translate(-70.5,-85.56897143333742) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#000000" d="M 135 174 L 275.32345076546227 84.0019243141968" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,5,185)"><g transform="translate(106,82) matrix(1,0,0,1,0,0) translate(-106,-82)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="76" height="32" fill-opacity="0"/></g></g><g transform="translate(106,82) matrix(1,0,0,1,0,0) translate(-106,-82)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="76" height="16" fill-opacity="0"/></g></g><g transform="translate(106,82) matrix(1,0,0,1,0,0) translate(-106,-82)"><g><rect fill="rgb(0,0,0)" stroke="none" x="16" y="0" width="46" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="16" y="14">Docker</text></g><g transform="translate(106,82) matrix(1,0,0,1,0,0) translate(-106,-82)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="16" width="76" height="16" fill-opacity="0"/></g></g><g transform="translate(106,82) matrix(1,0,0,1,0,0) translate(-106,-82)"><g><rect fill="rgb(0,0,0)" stroke="none" x="14" y="16" width="50" height="14" fill-opacity="0"/></g></g><g transform="translate(106,82) matrix(1,0,0,1,0,0) translate(-106,-82)"><g><rect fill="rgb(0,0,0)" stroke="none" x="14" y="16" width="50" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="14" y="30">Host</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="43" y="30"> #</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="54" y="30">1</text></g><g transform="translate(106,82) matrix(1,0,0,1,0,0) translate(-106,-82)"><g><rect fill="rgb(0,0,0)" stroke="none" x="62" y="18" width="1" height="14" fill-opacity="0"/></g></g><g transform="translate(106,82) matrix(1,0,0,1,0,0) translate(-106,-82)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="16" width="1" height="14" fill-opacity="0"/></g></g></g><g transform="translate(0,0) matrix(1,0,0,1,283,177)"><g><g transform="translate(0,0) scale(2.52,1.29)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.3968253968253968,0.7751937984496123)"><path fill="#c5e4fc" stroke="none" d="M 10 0 L 242 0 Q 252 0 252 10 L 252 119 Q 252 129 242 129 L 10 129 Q 0 129 0 119 L 0 10 Q 0 0 10 0 Z" opacity="0.93"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 242 0 Q 252 0 252 10 L 252 119 Q 252 129 242 129 L 10 129 Q 0 129 0 119 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" stroke-width="2" opacity="0.93"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,291,240)"><g transform="translate(4,4) scale(1.0045045045045045,1.0087719298245614)"><g><g transform="translate(0,0) scale(1.11,0.57)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9009009009009008,1.7543859649122808)"><path fill="#000000" stroke="none" d="M 10 0 L 101.00000000000001 0 Q 111.00000000000001 0 111.00000000000001 10 L 111.00000000000001 46.99999999999999 Q 111.00000000000001 56.99999999999999 101.00000000000001 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 101.00000000000001 0 Q 111.00000000000001 0 111.00000000000001 10 L 111.00000000000001 46.99999999999999 Q 111.00000000000001 56.99999999999999 101.00000000000001 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.11,0.57)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9009009009009008,1.7543859649122808)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 101.00000000000001 0 Q 111.00000000000001 0 111.00000000000001 10 L 111.00000000000001 46.99999999999999 Q 111.00000000000001 56.99999999999999 101.00000000000001 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" opacity="0.73"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 101.00000000000001 0 Q 111.00000000000001 0 111.00000000000001 10 L 111.00000000000001 46.99999999999999 Q 111.00000000000001 56.99999999999999 101.00000000000001 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.73"/></g></g></g></g></g><g transform="matrix(1,0,0,1,301,246)"><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="92" height="45" fill-opacity="0"/></g></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="92" height="15" fill-opacity="0"/></g></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="9" y="0" width="75" height="15" fill-opacity="0"/></g></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="9" y="0" width="75" height="15" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="9" y="13">Container</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="65" y="13"> #</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="76" y="13">3</text></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="15" width="92" height="15" fill-opacity="0"/></g></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="33" y="15" width="26" height="15" fill-opacity="0"/></g></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="33" y="15" width="26" height="15" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="33" y="28">eth0</text></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="30" width="92" height="15" fill-opacity="0"/></g></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="2" y="30" width="88" height="15" fill-opacity="0"/></g></g><g transform="translate(88,135) matrix(1,0,0,1,0,0) translate(-88,-135)"><g><rect fill="rgb(0,0,0)" stroke="none" x="2" y="30" width="88" height="15" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="2" y="43">172</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="24" y="43">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="28" y="43">16</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="42" y="43">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="46" y="43">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="53" y="43">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="57" y="43">12</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="71" y="43">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="75" y="43">24</text></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,413,240)"><g transform="translate(4,4) scale(1.0045045045045045,1.0087719298245614)"><g><g transform="translate(0,0) scale(1.11,0.57)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9009009009009008,1.7543859649122808)"><path fill="#000000" stroke="none" d="M 10 0 L 101.00000000000001 0 Q 111.00000000000001 0 111.00000000000001 10 L 111.00000000000001 46.99999999999999 Q 111.00000000000001 56.99999999999999 101.00000000000001 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 101.00000000000001 0 Q 111.00000000000001 0 111.00000000000001 10 L 111.00000000000001 46.99999999999999 Q 111.00000000000001 56.99999999999999 101.00000000000001 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.11,0.57)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9009009009009008,1.7543859649122808)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 101.00000000000001 0 Q 111.00000000000001 0 111.00000000000001 10 L 111.00000000000001 46.99999999999999 Q 111.00000000000001 56.99999999999999 101.00000000000001 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" opacity="0.73"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 101.00000000000001 0 Q 111.00000000000001 0 111.00000000000001 10 L 111.00000000000001 46.99999999999999 Q 111.00000000000001 56.99999999999999 101.00000000000001 56.99999999999999 L 10 56.99999999999999 Q 0 56.99999999999999 0 46.99999999999999 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.73"/></g></g></g></g></g><g transform="matrix(1,0,0,1,423,247)"><g transform="translate(79,71) matrix(1,0,0,1,0,0) translate(-79,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="92" height="44" fill-opacity="0"/></g></g><g transform="translate(79,71) matrix(1,0,0,1,0,0) translate(-79,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="92" height="14" fill-opacity="0"/></g></g><g transform="translate(79,71) matrix(1,0,0,1,0,0) translate(-79,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="11" y="0" width="70" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="11" y="12">Container</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="63" y="12"> #</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="73" y="12">4</text></g><g transform="translate(79,71) matrix(1,0,0,1,0,0) translate(-79,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="92" height="30" fill-opacity="0"/></g></g><g transform="translate(79,71) matrix(1,0,0,1,0,0) translate(-79,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="33" y="14" width="88" height="30" fill-opacity="0"/></g></g><g transform="translate(79,71) matrix(1,0,0,1,0,0) translate(-79,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="33" y="14" width="88" height="30" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="33" y="27">eth0</text></g><g transform="translate(79,71) matrix(1,0,0,1,0,0) translate(-79,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="2" y="29" width="88" height="15" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="2" y="42">172</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="24" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="28" y="42">16</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="42" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="46" y="42">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="53" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="57" y="42">13</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="71" y="42">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="75" y="42">24</text></g></g><g transform="matrix(1,0,0,1,427.8675323681471,193.5)"><g transform="translate(0,0)"><g transform="translate(-315,26.067047119140625) translate(-112.86753236814712,-219.56704711914062) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#000000" d="M 468.5 240 L 432.3675323681471 198" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,342,193.49999999999997)"><g transform="translate(0,0)"><g transform="translate(-325,16.067047119140625) translate(-17,-209.5670471191406) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#000000" d="M 346.5 240 L 387.6324676318529 197.99999999999997" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,280,185)"><g transform="translate(106,82) matrix(1,0,0,1,0,0) translate(-106,-82)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="76" height="32" fill-opacity="0"/></g></g><g transform="translate(106,82) matrix(1,0,0,1,0,0) translate(-106,-82)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="76" height="16" fill-opacity="0"/></g></g><g transform="translate(106,82) matrix(1,0,0,1,0,0) translate(-106,-82)"><g><rect fill="rgb(0,0,0)" stroke="none" x="16" y="0" width="46" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="16" y="14">Docker</text></g><g transform="translate(106,82) matrix(1,0,0,1,0,0) translate(-106,-82)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="16" width="76" height="16" fill-opacity="0"/></g></g><g transform="translate(106,82) matrix(1,0,0,1,0,0) translate(-106,-82)"><g><rect fill="rgb(0,0,0)" stroke="none" x="14" y="16" width="50" height="14" fill-opacity="0"/></g></g><g transform="translate(106,82) matrix(1,0,0,1,0,0) translate(-106,-82)"><g><rect fill="rgb(0,0,0)" stroke="none" x="14" y="16" width="50" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="14" y="30">Host</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="43" y="30"> #</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="54" y="30">2</text></g><g transform="translate(106,82) matrix(1,0,0,1,0,0) translate(-106,-82)"><g><rect fill="rgb(0,0,0)" stroke="none" x="62" y="18" width="1" height="14" fill-opacity="0"/></g></g><g transform="translate(106,82) matrix(1,0,0,1,0,0) translate(-106,-82)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="16" width="1" height="14" fill-opacity="0"/></g></g></g><g transform="matrix(1,0,0,1,270.82345076546227,79.5019243141968)"><g transform="translate(0,0)"><g transform="translate(-70,-3.932952880859375) translate(-200.82345076546227,-75.56897143333742) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#000000" d="M 410 174 L 275.32345076546227 84.0019243141968" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="translate(0,0) matrix(1,0,0,1,167.32131882292583,39.0019243141968)"><g><g transform="translate(0,0) scale(2.1600318386915354,1.5512633057455518) translate(0.00001348378,-0.001498589)"><g><g><path fill="#FFFFFF" stroke="#434343" d="M 33.84 5.912 C 16.263 2.403 6.986 11.405 8.451 19.186 L 8.57 19.61 C -5.128 21.942 -1.537 38.106 5.033 38.106 L 5.679 38.085 C 4.026 45.68 20.032 53.41 28.958 49.548 L 29.531 48.92 C 32.713 55.752 44.02 56.893 55.201 57.177 C 64.89 57.425 70.546 56.658 74.702 52.411 L 75.341 52.599 C 90.852 53.845 97.915 43.133 94.526 35.442 L 95.36 35.207 C 100.648 33.808 101.258 21.602 92.187 19.797 L 92.361 19.325 C 96.299 11.385 87.011 3.896 74.124 5.303 L 73.23 4.837 C 64.003 -3.517 37.449 -2.157 34.373 6.108 L 33.84 5.912 Z" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,356,150)"><g transform="translate(4,4) scale(1.0046296296296295,1.0104166666666667)"><g><g transform="translate(0,0) scale(1.08,0.48)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9259259259259258,2.0833333333333335)"><path fill="#000000" stroke="none" d="M 10 0 L 98 0 Q 108 0 108 10 L 108 38 Q 108 48 98 48 L 10 48 Q 0 48 0 38 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 98 0 Q 108 0 108 10 L 108 38 Q 108 48 98 48 L 10 48 Q 0 48 0 38 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.08,0.48)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9259259259259258,2.0833333333333335)"><path fill="#cccccc" stroke="none" d="M 10 0 L 98 0 Q 108 0 108 10 L 108 38 Q 108 48 98 48 L 10 48 Q 0 48 0 38 L 0 10 Q 0 0 10 0 Z"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 98 0 Q 108 0 108 10 L 108 38 Q 108 48 98 48 L 10 48 Q 0 48 0 38 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10"/></g></g></g></g></g><g transform="matrix(1,0,0,1,366,153)"><g transform="translate(160,126) matrix(1,0,0,1,0,0) translate(-160,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="89" height="42" fill-opacity="0"/></g></g><g transform="translate(160,126) matrix(1,0,0,1,0,0) translate(-160,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="89" height="14" fill-opacity="0"/></g></g><g transform="translate(160,126) matrix(1,0,0,1,0,0) translate(-160,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="14" y="0" width="61" height="14" fill-opacity="0"/></g></g><g transform="translate(160,126) matrix(1,0,0,1,0,0) translate(-160,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="14" y="0" width="61" height="14" fill-opacity="0"/></g></g><g transform="translate(160,126) matrix(1,0,0,1,0,0) translate(-160,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="14" y="0" width="33" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="italic" font-weight="normal" text-decoration="" line-height="14px" x="14" y="12">(</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="italic" font-weight="normal" text-decoration="" line-height="14px" x="18" y="12">Host</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="italic" font-weight="normal" text-decoration="" line-height="14px" x="43" y="12">)</text></g><g transform="translate(160,126) matrix(1,0,0,1,0,0) translate(-160,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="47" y="0" width="29" height="14" fill-opacity="0"/></g></g><g transform="translate(160,126) matrix(1,0,0,1,0,0) translate(-160,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="47" y="0" width="29" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="50" y="12">eth0</text></g><g transform="translate(160,126) matrix(1,0,0,1,0,0) translate(-160,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="1" height="14" fill-opacity="0"/></g></g><g transform="translate(160,126) matrix(1,0,0,1,0,0) translate(-160,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="89" height="14" fill-opacity="0"/></g></g><g transform="translate(160,126) matrix(1,0,0,1,0,0) translate(-160,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="1" y="14" width="88" height="14" fill-opacity="0"/></g></g><g transform="translate(160,126) matrix(1,0,0,1,0,0) translate(-160,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="1" y="14" width="88" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="1" y="26">172</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="21" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="25" y="26">16</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="38" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="41" y="26">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="48" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="51" y="26">253</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="71" y="26">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="75" y="26">24</text></g><g transform="translate(160,126) matrix(1,0,0,1,0,0) translate(-160,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="28" width="89" height="14" fill-opacity="0"/></g></g><g transform="translate(160,126) matrix(1,0,0,1,0,0) translate(-160,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="11" y="28" width="68" height="14" fill-opacity="0"/></g></g><g transform="translate(160,126) matrix(1,0,0,1,0,0) translate(-160,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="11" y="28" width="68" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="11" y="40">(</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="15" y="40">IP</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="30" y="40">Optional</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="74" y="40">)</text></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,81,150)"><g transform="translate(4,4) scale(1.0046296296296295,1.0104166666666667)"><g><g transform="translate(0,0) scale(1.08,0.48)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9259259259259258,2.0833333333333335)"><path fill="#000000" stroke="none" d="M 10 0 L 98 0 Q 108 0 108 10 L 108 38 Q 108 48 98 48 L 10 48 Q 0 48 0 38 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 98 0 Q 108 0 108 10 L 108 38 Q 108 48 98 48 L 10 48 Q 0 48 0 38 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.08,0.48)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9259259259259258,2.0833333333333335)"><path fill="#cccccc" stroke="none" d="M 10 0 L 98 0 Q 108 0 108 10 L 108 38 Q 108 48 98 48 L 10 48 Q 0 48 0 38 L 0 10 Q 0 0 10 0 Z"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 98 0 Q 108 0 108 10 L 108 38 Q 108 48 98 48 L 10 48 Q 0 48 0 38 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10"/></g></g></g></g></g><g transform="matrix(1,0,0,1,91,153)"><g transform="translate(127,126) matrix(1,0,0,1,0,0) translate(-127,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="89" height="42" fill-opacity="0"/></g></g><g transform="translate(127,126) matrix(1,0,0,1,0,0) translate(-127,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="89" height="14" fill-opacity="0"/></g></g><g transform="translate(127,126) matrix(1,0,0,1,0,0) translate(-127,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="14" y="0" width="61" height="14" fill-opacity="0"/></g></g><g transform="translate(127,126) matrix(1,0,0,1,0,0) translate(-127,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="14" y="0" width="61" height="14" fill-opacity="0"/></g></g><g transform="translate(127,126) matrix(1,0,0,1,0,0) translate(-127,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="14" y="0" width="33" height="14" fill-opacity="0"/></g></g><g transform="translate(127,126) matrix(1,0,0,1,0,0) translate(-127,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="14" y="0" width="33" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="italic" font-weight="normal" text-decoration="" line-height="14px" x="14" y="12">(</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="italic" font-weight="normal" text-decoration="" line-height="14px" x="18" y="12">Host</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="italic" font-weight="normal" text-decoration="" line-height="14px" x="43" y="12">)</text></g><g transform="translate(127,126) matrix(1,0,0,1,0,0) translate(-127,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="47" y="0" width="29" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="50" y="12">eth0</text></g><g transform="translate(127,126) matrix(1,0,0,1,0,0) translate(-127,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="1" height="14" fill-opacity="0"/></g></g><g transform="translate(127,126) matrix(1,0,0,1,0,0) translate(-127,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="89" height="14" fill-opacity="0"/></g></g><g transform="translate(127,126) matrix(1,0,0,1,0,0) translate(-127,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="1" y="14" width="88" height="14" fill-opacity="0"/></g></g><g transform="translate(127,126) matrix(1,0,0,1,0,0) translate(-127,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="1" y="14" width="88" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="1" y="26">172</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="21" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="25" y="26">16</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="38" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="41" y="26">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="48" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="51" y="26">254</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="71" y="26">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="75" y="26">24</text></g><g transform="translate(127,126) matrix(1,0,0,1,0,0) translate(-127,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="28" width="89" height="14" fill-opacity="0"/></g></g><g transform="translate(127,126) matrix(1,0,0,1,0,0) translate(-127,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="11" y="28" width="68" height="14" fill-opacity="0"/></g></g><g transform="translate(127,126) matrix(1,0,0,1,0,0) translate(-127,-126)"><g><rect fill="rgb(0,0,0)" stroke="none" x="11" y="28" width="68" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="italic" font-weight="normal" text-decoration="" line-height="14px" x="11" y="40">(</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="italic" font-weight="normal" text-decoration="" line-height="14px" x="15" y="40">IP</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="italic" font-weight="normal" text-decoration="" line-height="14px" x="30" y="40">Optional</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="italic" font-weight="normal" text-decoration="" line-height="14px" x="74" y="40">)</text></g></g><g transform="matrix(1,0,0,1,226,64)"><g transform="translate(117,64) matrix(1,0,0,1,0,0) translate(-117,-64)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="117" height="32" fill-opacity="0"/></g></g><g transform="translate(117,64) matrix(1,0,0,1,0,0) translate(-117,-64)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="117" height="16" fill-opacity="0"/></g></g><g transform="translate(117,64) matrix(1,0,0,1,0,0) translate(-117,-64)"><g><rect fill="rgb(0,0,0)" stroke="none" x="3" y="0" width="111" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="3" y="14">Network</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="58" y="14">Gateway</text></g><g transform="translate(117,64) matrix(1,0,0,1,0,0) translate(-117,-64)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="16" width="117" height="16" fill-opacity="0"/></g></g><g transform="translate(117,64) matrix(1,0,0,1,0,0) translate(-117,-64)"><g><rect fill="rgb(0,0,0)" stroke="none" x="16" y="16" width="87" height="16" fill-opacity="0"/></g></g><g transform="translate(117,64) matrix(1,0,0,1,0,0) translate(-117,-64)"><g><rect fill="rgb(0,0,0)" stroke="none" x="16" y="16" width="67" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="16" y="30">172</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="39" y="30">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="43" y="30">16</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="59" y="30">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="62" y="30">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="70" y="30">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="74" y="30">1</text></g><g transform="translate(117,64) matrix(1,0,0,1,0,0) translate(-117,-64)"><g><rect fill="rgb(0,0,0)" stroke="none" x="82" y="16" width="21" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="82" y="30">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="86" y="30">24</text></g></g><g transform="matrix(1,0,0,1,2,317)"><g transform="translate(1,0) matrix(1,0,0,1,0,0) translate(-1,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="538" height="36" fill-opacity="0"/></g></g><g transform="translate(1,0) matrix(1,0,0,1,0,0) translate(-1,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="538" height="18" fill-opacity="0"/></g></g><g transform="translate(1,0) matrix(1,0,0,1,0,0) translate(-1,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="1" y="0" width="536" height="17" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="1" y="15">Containers</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="83" y="15">Attached</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="151" y="15">Directly</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="209" y="15">to</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="226" y="15">Parent</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="278" y="15">Interface</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="340" y="15">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="349" y="15">No</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="374" y="15">Bridge</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="425" y="15">Used</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="462" y="15"> (</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="472" y="15">Docker0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="16px" font-style="italic" font-weight="normal" text-decoration="" line-height="18.5px" x="531" y="15">)</text></g></g><g transform="matrix(1,0,0,1,4,7)"><g transform="translate(81,0) matrix(1,0,0,1,0,0) translate(-81,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="538" height="22" fill-opacity="0"/></g></g><g transform="translate(81,0) matrix(1,0,0,1,0,0) translate(-81,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="538" height="22" fill-opacity="0"/></g></g><g transform="translate(81,0) matrix(1,0,0,1,0,0) translate(-81,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="81" y="0" width="376" height="22" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="20px" font-style="normal" font-weight="bold" text-decoration="" line-height="22.75px" x="81" y="19">Macvlan</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="20px" font-style="normal" font-weight="bold" text-decoration="" line-height="22.75px" x="166" y="19">Bridge</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="20px" font-style="normal" font-weight="bold" text-decoration="" line-height="22.75px" x="235" y="19">Mode</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="20px" font-style="normal" font-weight="bold" text-decoration="" line-height="22.75px" x="287" y="19"> &amp;</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="20px" font-style="normal" font-weight="bold" text-decoration="" line-height="22.75px" x="312" y="19">Ipvlan</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="20px" font-style="normal" font-weight="bold" text-decoration="" line-height="22.75px" x="376" y="19">L2</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="20px" font-style="normal" font-weight="bold" text-decoration="" line-height="22.75px" x="405" y="19">Mode</text></g></g></g></svg>
\ No newline at end of file
diff --git a/components/engine/experimental/images/multi_tenant_8021q_vlans.gliffy b/components/engine/experimental/images/multi_tenant_8021q_vlans.gliffy
deleted file mode 100644
index 40eed17270..0000000000
--- a/components/engine/experimental/images/multi_tenant_8021q_vlans.gliffy
+++ /dev/null
@@ -1 +0,0 @@
-{"contentType":"application/gliffy+json","version":"1.3","stage":{"background":"#ffffff","width":389,"height":213,"nodeIndex":276,"autoFit":true,"exportBorder":false,"gridOn":true,"snapToGrid":false,"drawingGuidesOn":false,"pageBreaksOn":false,"printGridOn":false,"printPaper":"LETTER","printShrinkToFit":false,"printPortrait":true,"maxWidth":5000,"maxHeight":5000,"themeData":null,"viewportType":"default","fitBB":{"min":{"x":5,"y":6.6999969482421875},"max":{"x":389,"y":212.14285409109937}},"printModel":{"pageSize":"a4","portrait":false,"fitToOnePage":false,"displayPageBreaks":false},"objects":[{"x":64.0,"y":36.0,"rotation":0.0,"id":216,"width":211.0,"height":31.0,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":10,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":5.0,"strokeColor":"#e69138","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":10.0,"controlPath":[[-12.0,33.0],[84.0,33.0],[84.0,86.0],[120.0,86.0]],"lockSegments":{"1":true},"ortho":true}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":190.0,"y":32.0,"rotation":0.0,"id":254,"width":211.0,"height":31.0,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":11,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":5.0,"strokeColor":"#f1c232","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":10.0,"controlPath":[[-142.0,16.0],[54.0,16.0],[54.0,115.0],[87.0,115.0]],"lockSegments":{"1":true},"ortho":true}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":133.38636363636374,"y":108.14285409109937,"rotation":0.0,"id":226,"width":123.00000000000001,"height":104.0,"uid":"com.gliffy.shape.iphone.iphone_ios7.icons_glyphs.glyph_cloud","order":12,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.iphone.iphone_ios7.icons_glyphs.glyph_cloud","strokeWidth":1.0,"strokeColor":"#000000","fillColor":"#999999","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":15.147567221510933,"y":139.96785409109907,"rotation":0.0,"id":115,"width":107.40845070422536,"height":49.0,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":29,"lockAspectRatio":false,"lockShape":false,"children":[{"x":31.506478873239438,"y":2.4460032626429853,"rotation":0.0,"id":116,"width":44.395492957746484,"height":29.54388254486117,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":17,"lockAspectRatio":false,"lockShape":false,"children":[{"x":20.86588169014084,"y":2.637846655791175,"rotation":0.0,"id":117,"width":2.663729577464789,"height":24.268189233278818,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":26,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":120,"py":0.0,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":120,"py":1.0,"px":0.5}}},"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#0b5394","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[1.3318647887324033,-1.055138662316466],[1.3318647887324033,25.3233278955953]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":36.84825915492961,"y":2.637846655791175,"rotation":0.0,"id":118,"width":1.0000000000000002,"height":25.323327895595277,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":23,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#0b5394","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[-0.8875219090985048,-1.0551386623167391],[-0.8875219090985048,25.323327895595412]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":7.103278873239435,"y":1.230995106035881,"rotation":0.0,"id":119,"width":1.0000000000000002,"height":25.323327895595277,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":20,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#0b5394","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[1.2752008616871728,0.3517128874389471],[1.2752008616871728,26.73017944535047]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":0.0,"y":1.5827079934747048,"rotation":0.0,"id":120,"width":44.395492957746484,"height":26.378466557911768,"uid":"com.gliffy.shape.basic.basic_v1.default.rectangle","order":15,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.rectangle.basic_v1","strokeWidth":2.0,"strokeColor":"#6fa8dc","fillColor":"#3d85c6","gradient":true,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":0.0,"y":37.199347471451986,"rotation":0.0,"id":121,"width":107.40845070422536,"height":28.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":28,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-family:Arial;font-size:12px;\"><span style=\"\">container1 - vlan10</span></span></p><p style=\"text-align:center;\"><span style=\"\">192.168.1.2/24</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":68.0,"y":82.69999694824219,"rotation":0.0,"id":140,"width":150.0,"height":14.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":30,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"text-decoration:none;font-family:Arial;font-size:12px;\"><span style=\"text-decoration:none;\"><br /></span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":71.0,"y":4.1999969482421875,"rotation":0.0,"id":187,"width":108.99999999999999,"height":19.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":31,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"\">eth0 - 802.1q trunk</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":282.0,"y":8.0,"rotation":0.0,"id":199,"width":73.00000000000003,"height":40.150000000000006,"uid":"com.gliffy.shape.network.network_v4.business.router","order":32,"lockAspectRatio":true,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.network.network_v4.business.router","strokeWidth":1.0,"strokeColor":"#000000","fillColor":"#3966A0","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":62.0,"y":55.0,"rotation":0.0,"id":210,"width":211.0,"height":31.0,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":34,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":5.0,"strokeColor":"#e06666","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":10.0,"controlPath":[[-8.0,11.0],[-8.0,34.0],[26.0,34.0],[26.0,57.0]],"lockSegments":{},"ortho":true}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":12.805718530101615,"y":11.940280333547719,"rotation":0.0,"id":134,"width":59.31028146989837,"height":83.0,"uid":"com.gliffy.shape.cisco.cisco_v1.servers.standard_host","order":35,"lockAspectRatio":true,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.cisco.cisco_v1.servers.standard_host","strokeWidth":2.0,"strokeColor":"#333333","fillColor":"#3d85c6","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":64.0,"y":73.19999694824219,"rotation":0.0,"id":211,"width":60.0,"height":14.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":36,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"\">eth0.10</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":65.0,"y":52.19999694824219,"rotation":0.0,"id":212,"width":60.0,"height":14.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":37,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"\">eth0.20</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":7.386363636363733,"y":108.14285409109937,"rotation":0.0,"id":219,"width":123.00000000000001,"height":104.0,"uid":"com.gliffy.shape.iphone.iphone_ios7.icons_glyphs.glyph_cloud","order":38,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.iphone.iphone_ios7.icons_glyphs.glyph_cloud","strokeWidth":1.0,"strokeColor":"#000000","fillColor":"#999999","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":139.1475672215109,"y":139.96785409109907,"rotation":0.0,"id":227,"width":107.40845070422536,"height":49.0,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":55,"lockAspectRatio":false,"lockShape":false,"children":[{"x":31.506478873239438,"y":2.4460032626429853,"rotation":0.0,"id":228,"width":44.395492957746484,"height":29.54388254486117,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":43,"lockAspectRatio":false,"lockShape":false,"children":[{"x":20.86588169014084,"y":2.637846655791175,"rotation":0.0,"id":229,"width":2.663729577464789,"height":24.268189233278818,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":52,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":232,"py":0.0,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":232,"py":1.0,"px":0.5}}},"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#0b5394","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[1.3318647887323891,-1.055138662316466],[1.3318647887323891,25.3233278955953]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":36.84825915492961,"y":2.637846655791175,"rotation":0.0,"id":230,"width":1.0000000000000002,"height":25.323327895595277,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":49,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#0b5394","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[-0.8875219090985048,-1.0551386623167391],[-0.8875219090985048,25.323327895595412]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":7.103278873239435,"y":1.230995106035881,"rotation":0.0,"id":231,"width":1.0000000000000002,"height":25.323327895595277,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":46,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#0b5394","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[1.2752008616871728,0.3517128874389471],[1.2752008616871728,26.73017944535047]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":0.0,"y":1.5827079934747048,"rotation":0.0,"id":232,"width":44.395492957746484,"height":26.378466557911768,"uid":"com.gliffy.shape.basic.basic_v1.default.rectangle","order":41,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.rectangle.basic_v1","strokeWidth":2.0,"strokeColor":"#6fa8dc","fillColor":"#3d85c6","gradient":true,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":0.0,"y":37.199347471451986,"rotation":0.0,"id":233,"width":107.40845070422536,"height":28.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":54,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-family:Arial;font-size:12px;\"><span style=\"\">container2 - vlan20</span></span></p><p style=\"text-align:center;\"><span style=\"\">172.16.1.2/24</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":259.38636363636374,"y":108.14285409109937,"rotation":0.0,"id":248,"width":123.00000000000001,"height":104.0,"uid":"com.gliffy.shape.iphone.iphone_ios7.icons_glyphs.glyph_cloud","order":56,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.iphone.iphone_ios7.icons_glyphs.glyph_cloud","strokeWidth":1.0,"strokeColor":"#000000","fillColor":"#999999","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":265.14756722151094,"y":139.96785409109907,"rotation":0.0,"id":241,"width":107.40845070422536,"height":49.0,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":73,"lockAspectRatio":false,"lockShape":false,"children":[{"x":31.506478873239438,"y":2.4460032626429853,"rotation":0.0,"id":242,"width":44.395492957746484,"height":29.54388254486117,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":61,"lockAspectRatio":false,"lockShape":false,"children":[{"x":20.86588169014084,"y":2.637846655791175,"rotation":0.0,"id":243,"width":2.663729577464789,"height":24.268189233278818,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":70,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":246,"py":0.0,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":246,"py":1.0,"px":0.5}}},"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#0b5394","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[1.3318647887323891,-1.055138662316466],[1.3318647887323891,25.3233278955953]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":36.84825915492961,"y":2.637846655791175,"rotation":0.0,"id":244,"width":1.0000000000000002,"height":25.323327895595277,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":67,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#0b5394","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[-0.8875219090985048,-1.0551386623167391],[-0.8875219090985048,25.323327895595412]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":7.103278873239435,"y":1.230995106035881,"rotation":0.0,"id":245,"width":1.0000000000000002,"height":25.323327895595277,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":64,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#0b5394","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[1.2752008616871728,0.3517128874389471],[1.2752008616871728,26.73017944535047]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":0.0,"y":1.5827079934747048,"rotation":0.0,"id":246,"width":44.395492957746484,"height":26.378466557911768,"uid":"com.gliffy.shape.basic.basic_v1.default.rectangle","order":59,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.rectangle.basic_v1","strokeWidth":2.0,"strokeColor":"#6fa8dc","fillColor":"#3d85c6","gradient":true,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":0.0,"y":37.199347471451986,"rotation":0.0,"id":247,"width":107.40845070422536,"height":28.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":72,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-family:Arial;font-size:12px;\"><span style=\"\">container3 - vlan30</span></span></p><p style=\"text-align:center;\"><span style=\"\">10.1.1.2/16</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":65.0,"y":31.199996948242188,"rotation":0.0,"id":253,"width":60.0,"height":14.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":74,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"\">eth0.30</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":44.49612211422149,"y":17.874999999999943,"rotation":0.0,"id":266,"width":275.00609168449375,"height":15.70000000000006,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":75,"lockAspectRatio":false,"lockShape":false,"children":[{"x":68.50387788577851,"y":43.12500000000006,"rotation":0.0,"id":258,"width":211.0,"height":31.0,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":9,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#999999","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[-64.00387788577851,-31.924999999999997],[197.00221379871527,-31.925000000000153]],"lockSegments":{"1":true},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":68.50387788577851,"y":38.55333333333314,"rotation":0.0,"id":262,"width":211.0,"height":33.06666666666631,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":7,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#999999","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[-64.00387788577851,-34.053333333332965],[197.00221379871527,-34.05333333333314]],"lockSegments":{"1":true},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":70.50387788577851,"y":40.7533333333331,"rotation":0.0,"id":261,"width":211.0,"height":33.06666666666631,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":5,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#e06666","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[-64.00387788577851,-34.053333333332965],[197.00221379871527,-34.05333333333314]],"lockSegments":{"1":true},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":70.50387788577851,"y":42.88666666666643,"rotation":0.0,"id":260,"width":211.0,"height":33.06666666666631,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":3,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#e69138","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[-64.00387788577851,-34.053333333332965],[197.00221379871527,-34.05333333333314]],"lockSegments":{"1":true},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":73.50387788577851,"y":43.95333333333309,"rotation":0.0,"id":259,"width":211.0,"height":33.06666666666631,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":1,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":2.0,"strokeColor":"#ffe599","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[-64.00387788577851,-34.053333333332965],[197.00221379871527,-34.05333333333314]],"lockSegments":{"1":true},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":248.0,"y":51.19999694824219,"rotation":0.0,"id":207,"width":143.0,"height":70.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":33,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:left;\"><span style=\"\">Network Router (gateway)</span></p><p style=\"text-align:left;\"><span style=\"\">vlan10 - 192.168.1.1/24</span></p><p style=\"text-align:left;\"><span style=\"\">vlan20 -&nbsp;</span><span style=\"\">172.16.1.1/24</span></p><p style=\"text-align:left;\"><span style=\"\">vlan30 -&nbsp;</span><span style=\"\">10.1.1.1/16</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":3.0,"y":88.19999694824219,"rotation":0.0,"id":272,"width":77.99999999999999,"height":28.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":76,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"\">Docker Host</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"layers":[{"guid":"9wom3rMkTrb3","order":0,"name":"Layer 0","active":true,"locked":false,"visible":true,"nodeIndex":80}],"shapeStyles":{},"lineStyles":{"global":{"stroke":"#e06666","strokeWidth":2,"orthoMode":1}},"textStyles":{"global":{"bold":true,"face":"Arial","size":"12px","color":"#000000"}}},"metadata":{"title":"untitled","revision":0,"exportBorder":false,"loadPosition":"default","libraries":["com.gliffy.libraries.network.network_v4.home","com.gliffy.libraries.network.network_v4.business","com.gliffy.libraries.network.network_v4.rack","com.gliffy.libraries.network.network_v3.home","com.gliffy.libraries.network.network_v3.business","com.gliffy.libraries.network.network_v3.rack"],"lastSerialized":1457586821719,"analyticsProduct":"Confluence"},"embeddedResources":{"index":0,"resources":[]}}
\ No newline at end of file
diff --git a/components/engine/experimental/images/multi_tenant_8021q_vlans.png b/components/engine/experimental/images/multi_tenant_8021q_vlans.png
deleted file mode 100644
index a38633cdbc..0000000000
Binary files a/components/engine/experimental/images/multi_tenant_8021q_vlans.png and /dev/null differ
diff --git a/components/engine/experimental/images/multi_tenant_8021q_vlans.svg b/components/engine/experimental/images/multi_tenant_8021q_vlans.svg
deleted file mode 100644
index 5c6c6070a6..0000000000
--- a/components/engine/experimental/images/multi_tenant_8021q_vlans.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="409" height="232.14285409109937"><style xmlns="http://www.w3.org/1999/xhtml"></style><defs><linearGradient id="RKkzpzQhZTCk" x1="0px" x2="0px" y1="100px" y2="-50px" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#3d85c6"/><stop offset="1" stop-color="#FFFFFF"/></linearGradient><linearGradient id="SeALyqvahCFZ" x1="0px" x2="0px" y1="100px" y2="-50px" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#3d85c6"/><stop offset="1" stop-color="#FFFFFF"/></linearGradient><linearGradient id="KIKSmddbxdCC" x1="0px" x2="0px" y1="100px" y2="-50px" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#3d85c6"/><stop offset="1" stop-color="#FFFFFF"/></linearGradient></defs><g transform="translate(0,0)"><g><rect fill="#ffffff" stroke="none" x="0" y="0" width="409" height="232.14285409109937"/></g><g transform="matrix(1,0,0,1,49.49612211422149,23.274999999999892)"><g transform="translate(0,0)"><g transform="translate(-118,-61.828333333333035) translate(68.50387788577851,38.55333333333314) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#ffe599" d="M 53.99612211422149 27.77500000000007 L 315.0022137987153 27.774999999999892" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,46.49612211422149,22.20833333333323)"><g transform="translate(0,0)"><g transform="translate(-115,-60.76166666666637) translate(68.50387788577851,38.55333333333314) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#e69138" d="M 50.99612211422149 26.708333333333407 L 312.0022137987153 26.70833333333323" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,46.49612211422149,20.074999999999903)"><g transform="translate(0,0)"><g transform="translate(-115,-58.628333333333046) translate(68.50387788577851,38.55333333333314) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#e06666" d="M 50.99612211422149 24.57500000000008 L 312.0022137987153 24.574999999999903" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,44.49612211422149,17.874999999999943)"><g transform="translate(0,0)"><g transform="translate(-113,-56.428333333333086) translate(68.50387788577851,38.55333333333314) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#999999" d="M 48.99612211422149 22.37500000000012 L 310.0022137987153 22.374999999999943" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,44.49612211422149,24.574999999999847)"><g transform="translate(0,0)"><g transform="translate(-113,-61) translate(68.50387788577851,36.42500000000015) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#999999" d="M 48.99612211422149 29.075000000000003 L 310.0022137987153 29.074999999999847" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,46,63)"><g transform="translate(0,0)"><g transform="translate(-64,-36) translate(18,-27) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#e69138" d="M 52 69 L 138 69 Q 148 69 148 79 L 148 112 Q 148 122 158 122 L 184 122" stroke-miterlimit="10" stroke-width="5"/></g></g></g></g><g transform="matrix(1,0,0,1,42,42)"><g transform="translate(0,0)"><g transform="translate(-190,-32) translate(148,-10) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#f1c232" d="M 48 48 L 234 48 Q 244 48 244 58 L 244 137 Q 244 147 254 147 L 277 147" stroke-miterlimit="10" stroke-width="5"/></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,133.38636363636374,108.14285409109937)"><g><g transform="translate(0,0) scale(1.7571428571428573,2.3636363636363638)"><g><g><g><path fill="#999999" stroke="rgb(0,0,0)" d="M 58.97 19.094 C 58.977 18.895 59 18.7 59 18.5 C 59 8.283 50.717 0 40.5 0 C 33.11 0 26.751 4.344 23.787 10.607 C 22.275 9.593 20.458 9 18.5 9 C 13.5 9 9.41 12.866 9.037 17.771 C 3.778 19.616 0 24.61 0 30.5 C 0 37.787 5.778 43.71 13 43.975 L 13 44 L 58 44 L 58 43.975 C 64.671 43.71 70 38.235 70 31.5 C 70 25.095 65.18 19.822 58.97 19.094 Z M 58 41.975 L 58 42 L 13 42 L 13 41.975 C 6.883 41.711 2 36.683 2 30.5 C 2 24.994 5.872 20.398 11.039 19.271 C 11.013 19.017 11 18.76 11 18.5 C 11 14.357 14.358 11 18.5 11 C 21.017 11 23.239 12.244 24.6 14.146 C 26.512 7.15 32.897 2 40.5 2 C 49.613 2 57 9.388 57 18.5 C 57 19.353 56.914 20.183 56.79 21 L 58 21 L 58 21.025 C 63.565 21.288 68 25.87 68 31.5 C 68 37.13 63.565 41.712 58 41.975 Z" stroke-opacity="0" stroke-miterlimit="10"/></g></g></g></g></g></g><g transform="translate(0,0) matrix(1,0,0,1,46.65404609475037,143.99656534721677)"><g><g transform="translate(0,0) scale(0.44395492957746485,0.26378466557911767)"><g><path fill="url(#RKkzpzQhZTCk)" stroke="none" d="M 0 0 L 100 0 Q 100 0 100 0 L 100 100 Q 100 100 100 100 L 0 100 Q 0 100 0 100 L 0 0 Q 0 0 0 0 Z"/><g transform="scale(2.2524809014999616,3.790970933828097)"><path fill="none" stroke="none" d="M 0 0 L 44.395492957746484 0 Q 44.395492957746484 0 44.395492957746484 0 L 44.395492957746484 26.378466557911768 Q 44.395492957746484 26.378466557911768 44.395492957746484 26.378466557911768 L 0 26.378466557911768 Q 0 26.378466557911768 0 26.378466557911768 L 0 0 Q 0 0 0 0 Z"/><path fill="url(#RKkzpzQhZTCk)" stroke="#6fa8dc" d="M 0 0 M 0 0 L 44.395492957746484 0 Q 44.395492957746484 0 44.395492957746484 0 L 44.395492957746484 26.378466557911768 Q 44.395492957746484 26.378466557911768 44.395492957746484 26.378466557911768 L 0 26.378466557911768 Q 0 26.378466557911768 0 26.378466557911768 L 0 0 Q 0 0 0 0 Z" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g></g><g transform="matrix(1,0,0,1,50.53252582967698,139.4965653472169)"><g transform="translate(0,0)"><g transform="translate(-53.7573249679898,-143.64485245977795) translate(3.224799138312825,4.148287112561064) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#0b5394" d="M 55.03252582967698 143.9965653472169 L 55.03252582967698 170.37503190512842" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,78.11478334058147,139.4965653472165)"><g transform="translate(0,0)"><g transform="translate(-83.50230524967998,-145.05170400953324) translate(5.38752190909851,5.55513866231675) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#0b5394" d="M 82.61478334058147 143.9965653472165 L 82.61478334058147 170.37503190512865" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,64.35179257362361,139.49656534721677)"><g transform="translate(0,0)"><g transform="translate(-67.51992778489121,-145.05170400953324) translate(3.1681352112675967,5.555138662316466) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#0b5394" d="M 68.85179257362361 143.99656534721677 L 68.85179257362361 170.37503190512854" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,17,177)"><g transform="translate(14,28) matrix(1,0,0,1,0,0) translate(-14,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="104" height="28" fill-opacity="0"/></g></g><g transform="translate(14,28) matrix(1,0,0,1,0,0) translate(-14,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="104" height="14" fill-opacity="0"/></g></g><g transform="translate(14,28) matrix(1,0,0,1,0,0) translate(-14,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="1" y="0" width="103" height="14" fill-opacity="0"/></g></g><g transform="translate(14,28) matrix(1,0,0,1,0,0) translate(-14,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="1" y="0" width="103" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="1" y="12">container1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="57" y="12"> -</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="68" y="12">vlan10</text></g><g transform="translate(14,28) matrix(1,0,0,1,0,0) translate(-14,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="104" height="14" fill-opacity="0"/></g></g><g transform="translate(14,28) matrix(1,0,0,1,0,0) translate(-14,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="12" y="14" width="81" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="12" y="26">192</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="32" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="36" y="26">168</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="56" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="59" y="26">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="66" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="69" y="26">2</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="76" y="26">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="79" y="26">24</text></g></g><g transform="matrix(1,0,0,1,70,90)"><g transform="translate(148,-14) matrix(1,0,0,1,0,0) translate(-148,14)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="147" height="14" fill-opacity="0"/></g></g><g transform="translate(148,-14) matrix(1,0,0,1,0,0) translate(-148,14)"><g/></g><g transform="translate(148,-14) matrix(1,0,0,1,0,0) translate(-148,14)"><g><rect fill="rgb(0,0,0)" stroke="none" x="74" y="-7" width="1" height="14" fill-opacity="0"/></g></g><g transform="translate(148,-14) matrix(1,0,0,1,0,0) translate(-148,14)"><g><rect fill="rgb(0,0,0)" stroke="none" x="74" y="-7" width="1" height="14" fill-opacity="0"/></g></g><g transform="translate(148,-14) matrix(1,0,0,1,0,0) translate(-148,14)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="1" height="14" fill-opacity="0"/></g></g></g><g transform="matrix(1,0,0,1,73,7)"><g transform="translate(3,0) matrix(1,0,0,1,0,0) translate(-3,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="106" height="19" fill-opacity="0"/></g></g><g transform="translate(3,0) matrix(1,0,0,1,0,0) translate(-3,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="106" height="14" fill-opacity="0"/></g></g><g transform="translate(3,0) matrix(1,0,0,1,0,0) translate(-3,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="3" y="0" width="102" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="3" y="12">eth0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="26" y="12"> -</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="37" y="12">802</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="57" y="12">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="60" y="12">1q</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="77" y="12">trunk</text></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,282,8)"><g><g transform="translate(0,0) scale(0.6083333333333336,0.6104050109462419)"><g><g><path fill="#3966A0" stroke="rgb(0,0,0)" d="M 102.635 0 C 93.815 0 86.371 6.797 85.395 15.43 L 4.554 15.43 C 2.043 15.431 0 17.473 0 19.984 L 0 53.338 C 0 55.849 2.043 57.892 4.554 57.892 L 8.016 57.892 L 8.016 65.776 L 96.471 65.776 L 96.471 57.892 L 99.672 57.892 C 102.184 57.892 104.227 55.849 104.227 53.338 L 104.227 34.655 C 107.211 34.382 109.971 33.334 112.331 31.735 L 112.331 31.735 C 112.785 31.428 113.223 31.1 113.643 30.753 C 113.655 30.744 113.665 30.734 113.676 30.725 C 114.093 30.38 114.492 30.017 114.875 29.635 C 114.875 29.635 114.887 29.623 114.893 29.617 C 118.039 26.471 120 22.143 120 17.365 C 120 7.79 112.21 0 102.635 0 Z" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 102.688 3.191 C 94.836 3.191 88.45 9.579 88.45 17.43 C 88.45 25.281 94.838 31.669 102.688 31.669 C 110.54 31.669 116.926 25.281 116.926 17.43 C 116.926 9.579 110.539 3.191 102.688 3.191 Z M 97.377 20.901 C 97.118 20.901 96.859 20.802 96.662 20.605 C 96.267 20.21 96.267 19.569 96.662 19.174 L 97.412 18.424 L 91.228 18.424 C 90.669 18.424 90.216 17.971 90.216 17.412 C 90.216 16.853 90.67 16.4 91.229 16.4 L 97.414 16.4 L 96.699 15.686 C 96.303 15.291 96.303 14.65 96.699 14.255 C 97.095 13.86 97.735 13.86 98.13 14.255 L 100.571 16.696 C 100.665 16.79 100.739 16.902 100.791 17.026 C 100.894 17.273 100.894 17.552 100.791 17.799 C 100.739 17.924 100.665 18.036 100.571 18.129 L 98.093 20.605 C 97.895 20.802 97.637 20.901 97.377 20.901 Z M 105.863 25.522 L 103.422 27.963 C 103.225 28.161 102.965 28.259 102.707 28.259 C 102.698 28.259 102.689 28.254 102.68 28.254 C 102.671 28.254 102.663 28.259 102.655 28.259 C 102.305 28.259 102.012 28.07 101.83 27.801 L 99.515 25.484 C 99.119 25.089 99.119 24.448 99.515 24.053 C 99.91 23.658 100.55 23.658 100.945 24.053 L 101.644 24.752 L 101.644 9.174 L 100.945 9.873 C 100.748 10.071 100.488 10.169 100.23 10.169 C 99.97 10.169 99.711 10.07 99.515 9.873 C 99.119 9.478 99.119 8.837 99.515 8.442 L 101.954 6 C 102.35 5.605 102.988 5.605 103.385 6 L 105.864 8.478 C 106.26 8.873 106.26 9.514 105.864 9.909 C 105.667 10.107 105.408 10.205 105.149 10.205 C 104.889 10.205 104.63 10.106 104.434 9.909 L 103.667 9.143 L 103.667 24.857 L 104.434 24.091 C 104.829 23.696 105.468 23.696 105.864 24.091 C 106.258 24.486 106.258 25.126 105.863 25.522 Z M 114.148 18.46 L 107.964 18.46 L 108.677 19.174 C 109.073 19.569 109.073 20.21 108.677 20.605 C 108.48 20.803 108.22 20.901 107.961 20.901 C 107.702 20.901 107.442 20.802 107.246 20.605 L 104.808 18.165 C 104.713 18.072 104.64 17.959 104.587 17.835 C 104.485 17.588 104.485 17.309 104.587 17.062 C 104.64 16.937 104.713 16.825 104.808 16.732 L 107.284 14.255 C 107.68 13.86 108.32 13.86 108.715 14.255 C 109.11 14.65 109.11 15.291 108.715 15.686 L 107.964 16.437 L 114.149 16.437 C 114.708 16.437 115.161 16.89 115.161 17.449 C 115.16 18.008 114.707 18.46 114.148 18.46 Z" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 80.533 36.476 A 3.247 3.247 0 1 0 80.53299837650013 36.47924699945883 Z" opacity="0.5" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 9.278 35.006 L 20.39 35.006 L 20.39 24 L 9.278 24 L 9.278 35.006 Z M 10.929 25.567 L 18.819 25.567 L 18.819 31.173 L 16.536 31.173 L 16.536 33.456 L 13.213 33.456 L 13.213 31.173 L 10.93 31.173 L 10.929 25.567 L 10.929 25.567 Z" opacity="0.65" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 24.253 35.015 L 35.365 35.015 L 35.365 24.009 L 24.253 24.009 L 24.253 35.015 Z M 25.904 25.576 L 33.794 25.576 L 33.794 31.182 L 31.51 31.182 L 31.51 33.465 L 28.187 33.465 L 28.187 31.182 L 25.904 31.182 L 25.904 25.576 Z" opacity="0.65" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 50.3 24.009 L 39.188 24.009 L 39.188 35.014 L 50.3 35.014 L 50.3 24.009 Z M 48.729 31.173 L 46.446 31.173 L 46.446 33.456 L 43.123 33.456 L 43.123 31.173 L 40.84 31.173 L 40.84 25.567 L 48.73 25.567 L 48.729 31.173 L 48.729 31.173 Z" opacity="0.65" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 54.123 35.023 L 65.234 35.023 L 65.234 24.018 L 54.123 24.018 L 54.123 35.023 Z M 55.774 25.567 L 63.664 25.567 L 63.664 31.173 L 61.38 31.173 L 61.38 33.456 L 58.057 33.456 L 58.057 31.173 L 55.774 31.173 L 55.774 25.567 Z" opacity="0.65" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 9.278 49.95 L 20.39 49.95 L 20.39 38.944 L 9.278 38.944 L 9.278 49.95 Z M 10.929 40.502 L 18.819 40.502 L 18.819 46.108 L 16.536 46.108 L 16.536 48.391 L 13.213 48.391 L 13.213 46.108 L 10.93 46.108 L 10.929 40.502 L 10.929 40.502 Z" opacity="0.65" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 24.253 49.958 L 35.365 49.958 L 35.365 38.953 L 24.253 38.953 L 24.253 49.958 Z M 25.904 40.52 L 33.794 40.52 L 33.794 46.126 L 31.51 46.126 L 31.51 48.408 L 28.187 48.408 L 28.187 46.126 L 25.904 46.126 L 25.904 40.52 Z" opacity="0.65" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 39.228 49.966 L 50.34 49.966 L 50.34 38.962 L 39.228 38.962 L 39.228 49.966 Z M 40.839 40.511 L 48.729 40.511 L 48.729 46.117 L 46.446 46.117 L 46.446 48.4 L 43.123 48.4 L 43.123 46.117 L 40.84 46.117 L 40.839 40.511 L 40.839 40.511 Z" opacity="0.65" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 54.123 49.966 L 65.234 49.966 L 65.234 38.962 L 54.123 38.962 L 54.123 49.966 Z M 55.774 40.511 L 63.664 40.511 L 63.664 46.117 L 61.38 46.117 L 61.38 48.4 L 58.057 48.4 L 58.057 46.117 L 55.774 46.117 L 55.774 40.511 Z" opacity="0.65" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 11.504 57.898 L 92.919 57.898 Q 92.919 57.898 92.919 57.898 L 92.919 62.69 Q 92.919 62.69 92.919 62.69 L 11.504 62.69 Q 11.504 62.69 11.504 62.69 L 11.504 57.898 Q 11.504 57.898 11.504 57.898 Z" opacity="0.7" stroke-opacity="0" stroke-miterlimit="10"/></g><g><path fill="#FFFFFF" stroke="rgb(0,0,0)" d="M 85.525 18.936 L 5.082 18.936 C 4.255 18.936 3.582 19.609 3.582 20.436 L 3.582 53.397 C 3.582 54.224 4.255 54.897 5.082 54.897 L 11.504 54.897 L 92.919 54.897 L 99.082 54.897 C 99.909 54.897 100.582 54.224 100.582 53.397 L 100.582 34.526 C 92.561 33.543 86.232 27.039 85.525 18.936 Z M 20.389 49.95 L 9.278 49.95 L 9.278 38.944 L 20.39 38.944 L 20.389 49.95 L 20.389 49.95 Z M 20.389 35.006 L 9.278 35.006 L 9.278 24 L 20.39 24 L 20.389 35.006 L 20.389 35.006 Z M 35.365 49.958 L 24.253 49.958 L 24.253 38.953 L 35.365 38.953 L 35.365 49.958 Z M 35.365 35.015 L 24.253 35.015 L 24.253 24.009 L 35.365 24.009 L 35.365 35.015 Z M 39.188 24.009 L 50.3 24.009 L 50.3 35.014 L 39.188 35.014 L 39.188 24.009 Z M 50.34 49.966 L 39.228 49.966 L 39.228 38.962 L 50.34 38.962 L 50.34 49.966 Z M 65.234 49.966 L 54.123 49.966 L 54.123 38.962 L 65.234 38.962 L 65.234 49.966 Z M 65.234 35.023 L 54.123 35.023 L 54.123 24.018 L 65.234 24.018 L 65.234 35.023 Z M 77.286 39.723 C 75.493 39.723 74.039 38.269 74.039 36.476 C 74.039 34.683 75.493 33.229 77.286 33.229 C 79.079 33.229 80.533 34.683 80.533 36.476 C 80.533 38.269 79.08 39.723 77.286 39.723 Z M 89.541 39.723 C 87.748 39.723 86.294 38.269 86.294 36.476 C 86.294 34.683 87.748 33.229 89.541 33.229 C 91.334 33.229 92.788 34.683 92.788 36.476 C 92.787 38.269 91.334 39.723 89.541 39.723 Z" opacity="0.93" stroke-opacity="0" stroke-miterlimit="10"/></g></g></g></g></g><g transform="matrix(1,0,0,1,250,51)"><g transform="translate(92,238) matrix(1,0,0,1,0,0) translate(-92,-238)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="140" height="70" fill-opacity="0"/></g></g><g transform="translate(92,238) matrix(1,0,0,1,0,0) translate(-92,-238)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="140" height="14" fill-opacity="0"/></g></g><g transform="translate(92,238) matrix(1,0,0,1,0,0) translate(-92,-238)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="140" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="0" y="12">Network</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="47" y="12">Router</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="83" y="12"> (</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="91" y="12">gateway</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="135" y="12">)</text></g><g transform="translate(92,238) matrix(1,0,0,1,0,0) translate(-92,-238)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="140" height="14" fill-opacity="0"/></g></g><g transform="translate(92,238) matrix(1,0,0,1,0,0) translate(-92,-238)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="127" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="0" y="26">vlan10</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="35" y="26"> -</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="46" y="26">192</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="66" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="69" y="26">168</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="89" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="93" y="26">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="99" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="103" y="26">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="109" y="26">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="113" y="26">24</text></g><g transform="translate(92,238) matrix(1,0,0,1,0,0) translate(-92,-238)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="28" width="140" height="14" fill-opacity="0"/></g></g><g transform="translate(92,238) matrix(1,0,0,1,0,0) translate(-92,-238)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="28" width="47" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="0" y="40">vlan20</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="35" y="40"> -&#160;</text></g><g transform="translate(92,238) matrix(1,0,0,1,0,0) translate(-92,-238)"><g><rect fill="rgb(0,0,0)" stroke="none" x="46" y="28" width="74" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="46" y="40">172</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="66" y="40">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="69" y="40">16</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="83" y="40">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="86" y="40">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="93" y="40">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="96" y="40">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="103" y="40">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="106" y="40">24</text></g><g transform="translate(92,238) matrix(1,0,0,1,0,0) translate(-92,-238)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="42" width="140" height="14" fill-opacity="0"/></g></g><g transform="translate(92,238) matrix(1,0,0,1,0,0) translate(-92,-238)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="42" width="47" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="0" y="54">vlan30</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="35" y="54"> -&#160;</text></g><g transform="translate(92,238) matrix(1,0,0,1,0,0) translate(-92,-238)"><g><rect fill="rgb(0,0,0)" stroke="none" x="46" y="42" width="61" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="46" y="54">10</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="59" y="54">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="63" y="54">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="69" y="54">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="73" y="54">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="79" y="54">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="83" y="54">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="89" y="54">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="93" y="54">16</text></g></g><g transform="matrix(1,0,0,1,48,60)"><g transform="translate(0,0)"><g transform="translate(-62,-55) translate(14,-5) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#e06666" d="M 54 66 L 54 79 Q 54 89 64 89 L 78 89 Q 88 89 88 99 L 88 112" stroke-miterlimit="10" stroke-width="5"/></g></g></g></g><g transform="translate(0,0) matrix(1,0,0,1,12.805718530101615,11.940280333547719)"><g><g transform="translate(0,0) scale(0.8417223432141461,0.83)"><g><g><g><path fill="#3d85c6" stroke="#FFFFFF" d="M 52.371 16.22 L -1.393 16.22 L -1.393 99.52 L 52.371 99.52" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="#3d85c6" stroke="#FFFFFF" d="M 52.371 99.52 L 69.07 82.82 L 69.07 -0.48 L 19.98 -0.48 L -1.393 16.22 L 52.371 16.22 L 52.371 99.52 Z" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="rgb(0,0,0)" stroke="#FFFFFF" d="M 52.371 16.22 L 69.07 -0.48" fill-opacity="0" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="rgb(0,0,0)" stroke="#FFFFFF" d="M 25.3 16.22 L 25.3 99.52" fill-opacity="0" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="rgb(0,0,0)" stroke="#FFFFFF" d="M 26.149 16.22 L 44.316 -0.48" fill-opacity="0" stroke-miterlimit="10" stroke-width="1.3594"/></g></g><g><path fill="#3d85c6" stroke="#FFFFFF" d="M 3.263 23.823 L 21.317 23.823 Q 21.317 23.823 21.317 23.823 L 21.317 34.868 Q 21.317 34.868 21.317 34.868 L 3.263 34.868 Q 3.263 34.868 3.263 34.868 L 3.263 23.823 Q 3.263 23.823 3.263 23.823 Z" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="#3d85c6" stroke="#FFFFFF" d="M 29.156 23.823 L 47.207 23.823 Q 47.207 23.823 47.207 23.823 L 47.207 34.868 Q 47.207 34.868 47.207 34.868 L 29.156 34.868 Q 29.156 34.868 29.156 34.868 L 29.156 23.823 Q 29.156 23.823 29.156 23.823 Z" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="#3d85c6" stroke="#FFFFFF" d="M 3.263 64.604 L 21.317 64.604 Q 21.317 64.604 21.317 64.604 L 21.317 75.648 Q 21.317 75.648 21.317 75.648 L 3.263 75.648 Q 3.263 75.648 3.263 75.648 L 3.263 64.604 Q 3.263 64.604 3.263 64.604 Z" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="#3d85c6" stroke="#FFFFFF" d="M 29.156 64.604 L 47.207 64.604 Q 47.207 64.604 47.207 64.604 L 47.207 75.648 Q 47.207 75.648 47.207 75.648 L 29.156 75.648 Q 29.156 75.648 29.156 75.648 L 29.156 64.604 Q 29.156 64.604 29.156 64.604 Z" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="#3d85c6" stroke="#FFFFFF" d="M 3.263 82.445 L 21.317 82.445 Q 21.317 82.445 21.317 82.445 L 21.317 93.49 Q 21.317 93.49 21.317 93.49 L 3.263 93.49 Q 3.263 93.49 3.263 93.49 L 3.263 82.445 Q 3.263 82.445 3.263 82.445 Z" stroke-miterlimit="10" stroke-width="1.3594"/></g><g><path fill="#3d85c6" stroke="#FFFFFF" d="M 29.156 82.445 L 47.207 82.445 Q 47.207 82.445 47.207 82.445 L 47.207 93.49 Q 47.207 93.49 47.207 93.49 L 29.156 93.49 Q 29.156 93.49 29.156 93.49 L 29.156 82.445 Q 29.156 82.445 29.156 82.445 Z" stroke-miterlimit="10" stroke-width="1.3594"/></g></g></g></g></g><g transform="matrix(1,0,0,1,66,73)"><g transform="translate(8,0) matrix(1,0,0,1,0,0) translate(-8,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="57" height="14" fill-opacity="0"/></g></g><g transform="translate(8,0) matrix(1,0,0,1,0,0) translate(-8,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="57" height="14" fill-opacity="0"/></g></g><g transform="translate(8,0) matrix(1,0,0,1,0,0) translate(-8,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="8" y="0" width="41" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="8" y="12">eth0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="32" y="12">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="35" y="12">10</text></g></g><g transform="matrix(1,0,0,1,67,52)"><g transform="translate(8,0) matrix(1,0,0,1,0,0) translate(-8,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="57" height="14" fill-opacity="0"/></g></g><g transform="translate(8,0) matrix(1,0,0,1,0,0) translate(-8,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="57" height="14" fill-opacity="0"/></g></g><g transform="translate(8,0) matrix(1,0,0,1,0,0) translate(-8,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="8" y="0" width="41" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="8" y="12">eth0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="32" y="12">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="35" y="12">20</text></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,7.386363636363733,108.14285409109937)"><g><g transform="translate(0,0) scale(1.7571428571428573,2.3636363636363638)"><g><g><g><path fill="#999999" stroke="rgb(0,0,0)" d="M 58.97 19.094 C 58.977 18.895 59 18.7 59 18.5 C 59 8.283 50.717 0 40.5 0 C 33.11 0 26.751 4.344 23.787 10.607 C 22.275 9.593 20.458 9 18.5 9 C 13.5 9 9.41 12.866 9.037 17.771 C 3.778 19.616 0 24.61 0 30.5 C 0 37.787 5.778 43.71 13 43.975 L 13 44 L 58 44 L 58 43.975 C 64.671 43.71 70 38.235 70 31.5 C 70 25.095 65.18 19.822 58.97 19.094 Z M 58 41.975 L 58 42 L 13 42 L 13 41.975 C 6.883 41.711 2 36.683 2 30.5 C 2 24.994 5.872 20.398 11.039 19.271 C 11.013 19.017 11 18.76 11 18.5 C 11 14.357 14.358 11 18.5 11 C 21.017 11 23.239 12.244 24.6 14.146 C 26.512 7.15 32.897 2 40.5 2 C 49.613 2 57 9.388 57 18.5 C 57 19.353 56.914 20.183 56.79 21 L 58 21 L 58 21.025 C 63.565 21.288 68 25.87 68 31.5 C 68 37.13 63.565 41.712 58 41.975 Z" stroke-opacity="0" stroke-miterlimit="10"/></g></g></g></g></g></g><g transform="translate(0,0) matrix(1,0,0,1,170.65404609475036,143.99656534721677)"><g><g transform="translate(0,0) scale(0.44395492957746485,0.26378466557911767)"><g><path fill="url(#SeALyqvahCFZ)" stroke="none" d="M 0 0 L 100 0 Q 100 0 100 0 L 100 100 Q 100 100 100 100 L 0 100 Q 0 100 0 100 L 0 0 Q 0 0 0 0 Z"/><g transform="scale(2.2524809014999616,3.790970933828097)"><path fill="none" stroke="none" d="M 0 0 L 44.395492957746484 0 Q 44.395492957746484 0 44.395492957746484 0 L 44.395492957746484 26.378466557911768 Q 44.395492957746484 26.378466557911768 44.395492957746484 26.378466557911768 L 0 26.378466557911768 Q 0 26.378466557911768 0 26.378466557911768 L 0 0 Q 0 0 0 0 Z"/><path fill="url(#SeALyqvahCFZ)" stroke="#6fa8dc" d="M 0 0 M 0 0 L 44.395492957746484 0 Q 44.395492957746484 0 44.395492957746484 0 L 44.395492957746484 26.378466557911768 Q 44.395492957746484 26.378466557911768 44.395492957746484 26.378466557911768 L 0 26.378466557911768 Q 0 26.378466557911768 0 26.378466557911768 L 0 0 Q 0 0 0 0 Z" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g></g><g transform="matrix(1,0,0,1,174.53252582967698,139.4965653472169)"><g transform="translate(0,0)"><g transform="translate(-177.7573249679898,-143.64485245977795) translate(3.224799138312818,4.148287112561064) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#0b5394" d="M 179.03252582967698 143.9965653472169 L 179.03252582967698 170.37503190512842" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,202.11478334058148,139.4965653472165)"><g transform="translate(0,0)"><g transform="translate(-207.50230524967998,-145.05170400953324) translate(5.387521909098496,5.55513866231675) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#0b5394" d="M 206.61478334058148 143.9965653472165 L 206.61478334058148 170.37503190512865" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,188.35179257362358,139.49656534721677)"><g transform="translate(0,0)"><g transform="translate(-191.5199277848912,-145.05170400953324) translate(3.168135211267611,5.555138662316466) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#0b5394" d="M 192.85179257362358 143.99656534721677 L 192.85179257362358 170.37503190512854" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,141,177)"><g transform="translate(18,28) matrix(1,0,0,1,0,0) translate(-18,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="104" height="28" fill-opacity="0"/></g></g><g transform="translate(18,28) matrix(1,0,0,1,0,0) translate(-18,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="104" height="14" fill-opacity="0"/></g></g><g transform="translate(18,28) matrix(1,0,0,1,0,0) translate(-18,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="1" y="0" width="103" height="14" fill-opacity="0"/></g></g><g transform="translate(18,28) matrix(1,0,0,1,0,0) translate(-18,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="1" y="0" width="103" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="1" y="12">container2</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="57" y="12"> -</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="68" y="12">vlan20</text></g><g transform="translate(18,28) matrix(1,0,0,1,0,0) translate(-18,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="104" height="14" fill-opacity="0"/></g></g><g transform="translate(18,28) matrix(1,0,0,1,0,0) translate(-18,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="16" y="14" width="74" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="16" y="26">172</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="36" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="39" y="26">16</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="52" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="56" y="26">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="62" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="66" y="26">2</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="72" y="26">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="76" y="26">24</text></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,259.38636363636374,108.14285409109937)"><g><g transform="translate(0,0) scale(1.7571428571428573,2.3636363636363638)"><g><g><g><path fill="#999999" stroke="rgb(0,0,0)" d="M 58.97 19.094 C 58.977 18.895 59 18.7 59 18.5 C 59 8.283 50.717 0 40.5 0 C 33.11 0 26.751 4.344 23.787 10.607 C 22.275 9.593 20.458 9 18.5 9 C 13.5 9 9.41 12.866 9.037 17.771 C 3.778 19.616 0 24.61 0 30.5 C 0 37.787 5.778 43.71 13 43.975 L 13 44 L 58 44 L 58 43.975 C 64.671 43.71 70 38.235 70 31.5 C 70 25.095 65.18 19.822 58.97 19.094 Z M 58 41.975 L 58 42 L 13 42 L 13 41.975 C 6.883 41.711 2 36.683 2 30.5 C 2 24.994 5.872 20.398 11.039 19.271 C 11.013 19.017 11 18.76 11 18.5 C 11 14.357 14.358 11 18.5 11 C 21.017 11 23.239 12.244 24.6 14.146 C 26.512 7.15 32.897 2 40.5 2 C 49.613 2 57 9.388 57 18.5 C 57 19.353 56.914 20.183 56.79 21 L 58 21 L 58 21.025 C 63.565 21.288 68 25.87 68 31.5 C 68 37.13 63.565 41.712 58 41.975 Z" stroke-opacity="0" stroke-miterlimit="10"/></g></g></g></g></g></g><g transform="translate(0,0) matrix(1,0,0,1,296.65404609475036,143.99656534721677)"><g><g transform="translate(0,0) scale(0.44395492957746485,0.26378466557911767)"><g><path fill="url(#KIKSmddbxdCC)" stroke="none" d="M 0 0 L 100 0 Q 100 0 100 0 L 100 100 Q 100 100 100 100 L 0 100 Q 0 100 0 100 L 0 0 Q 0 0 0 0 Z"/><g transform="scale(2.2524809014999616,3.790970933828097)"><path fill="none" stroke="none" d="M 0 0 L 44.395492957746484 0 Q 44.395492957746484 0 44.395492957746484 0 L 44.395492957746484 26.378466557911768 Q 44.395492957746484 26.378466557911768 44.395492957746484 26.378466557911768 L 0 26.378466557911768 Q 0 26.378466557911768 0 26.378466557911768 L 0 0 Q 0 0 0 0 Z"/><path fill="url(#KIKSmddbxdCC)" stroke="#6fa8dc" d="M 0 0 M 0 0 L 44.395492957746484 0 Q 44.395492957746484 0 44.395492957746484 0 L 44.395492957746484 26.378466557911768 Q 44.395492957746484 26.378466557911768 44.395492957746484 26.378466557911768 L 0 26.378466557911768 Q 0 26.378466557911768 0 26.378466557911768 L 0 0 Q 0 0 0 0 Z" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g></g><g transform="matrix(1,0,0,1,300.53252582967696,139.4965653472169)"><g transform="translate(0,0)"><g transform="translate(-303.7573249679898,-143.64485245977795) translate(3.2247991383128465,4.148287112561064) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#0b5394" d="M 305.03252582967696 143.9965653472169 L 305.03252582967696 170.37503190512842" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,328.1147833405815,139.4965653472165)"><g transform="translate(0,0)"><g transform="translate(-333.50230524968,-145.05170400953324) translate(5.387521909098496,5.55513866231675) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#0b5394" d="M 332.6147833405815 143.9965653472165 L 332.6147833405815 170.37503190512865" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,314.3517925736236,139.49656534721677)"><g transform="translate(0,0)"><g transform="translate(-317.5199277848912,-145.05170400953324) translate(3.168135211267611,5.555138662316466) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#0b5394" d="M 318.8517925736236 143.99656534721677 L 318.8517925736236 170.37503190512854" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g><g transform="matrix(1,0,0,1,267,177)"><g transform="translate(24,28) matrix(1,0,0,1,0,0) translate(-24,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="104" height="28" fill-opacity="0"/></g></g><g transform="translate(24,28) matrix(1,0,0,1,0,0) translate(-24,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="104" height="14" fill-opacity="0"/></g></g><g transform="translate(24,28) matrix(1,0,0,1,0,0) translate(-24,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="1" y="0" width="103" height="14" fill-opacity="0"/></g></g><g transform="translate(24,28) matrix(1,0,0,1,0,0) translate(-24,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="1" y="0" width="103" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="1" y="12">container3</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="57" y="12"> -</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="68" y="12">vlan30</text></g><g transform="translate(24,28) matrix(1,0,0,1,0,0) translate(-24,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="104" height="14" fill-opacity="0"/></g></g><g transform="translate(24,28) matrix(1,0,0,1,0,0) translate(-24,-28)"><g><rect fill="rgb(0,0,0)" stroke="none" x="22" y="14" width="61" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="22" y="26">10</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="36" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="39" y="26">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="46" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="49" y="26">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="56" y="26">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="59" y="26">2</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="66" y="26">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="69" y="26">16</text></g></g><g transform="matrix(1,0,0,1,67,31)"><g transform="translate(8,0) matrix(1,0,0,1,0,0) translate(-8,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="57" height="14" fill-opacity="0"/></g></g><g transform="translate(8,0) matrix(1,0,0,1,0,0) translate(-8,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="57" height="14" fill-opacity="0"/></g></g><g transform="translate(8,0) matrix(1,0,0,1,0,0) translate(-8,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="8" y="0" width="41" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="8" y="12">eth0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="32" y="12">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="35" y="12">30</text></g></g><g transform="matrix(1,0,0,1,5,95)"><g transform="translate(4,0) matrix(1,0,0,1,0,0) translate(-4,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="75" height="28" fill-opacity="0"/></g></g><g transform="translate(4,0) matrix(1,0,0,1,0,0) translate(-4,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="75" height="14" fill-opacity="0"/></g></g><g transform="translate(4,0) matrix(1,0,0,1,0,0) translate(-4,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="4" y="0" width="67" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="4" y="12">Docker</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="46" y="12">Host</text></g></g></g></svg>
\ No newline at end of file
diff --git a/components/engine/experimental/images/vlans-deeper-look.gliffy b/components/engine/experimental/images/vlans-deeper-look.gliffy
deleted file mode 100644
index 4d9f2761c4..0000000000
--- a/components/engine/experimental/images/vlans-deeper-look.gliffy
+++ /dev/null
@@ -1 +0,0 @@
-{"contentType":"application/gliffy+json","version":"1.3","stage":{"background":"#FFFFFF","width":566,"height":581,"nodeIndex":500,"autoFit":true,"exportBorder":false,"gridOn":true,"snapToGrid":false,"drawingGuidesOn":false,"pageBreaksOn":false,"printGridOn":false,"printPaper":"LETTER","printShrinkToFit":false,"printPortrait":true,"maxWidth":5000,"maxHeight":5000,"themeData":{"uid":"com.gliffy.theme.beach_day","name":"Beach Day","shape":{"primary":{"strokeWidth":2,"strokeColor":"#00A4DA","fillColor":"#AEE4F4","gradient":false,"dropShadow":false,"opacity":1,"text":{"color":"#004257"}},"secondary":{"strokeWidth":2,"strokeColor":"#CDB25E","fillColor":"#EACF81","gradient":false,"dropShadow":false,"opacity":1,"text":{"color":"#332D1A"}},"tertiary":{"strokeWidth":2,"strokeColor":"#FFBE00","fillColor":"#FFF1CB","gradient":false,"dropShadow":false,"opacity":1,"text":{"color":"#000000"}},"highlight":{"strokeWidth":2,"strokeColor":"#00A4DA","fillColor":"#00A4DA","gradient":false,"dropShadow":false,"opacity":1,"text":{"color":"#ffffff"}}},"line":{"strokeWidth":2,"strokeColor":"#00A4DA","fillColor":"none","arrowType":2,"interpolationType":"quadratic","cornerRadius":0,"text":{"color":"#002248"}},"text":{"color":"#002248"},"stage":{"color":"#FFFFFF"}},"viewportType":"default","fitBB":{"min":{"x":-3,"y":-1.0100878848684474},"max":{"x":566,"y":581}},"printModel":{"pageSize":"a4","portrait":false,"fitToOnePage":false,"displayPageBreaks":false},"objects":[{"x":-5.0,"y":-1.0100878848684474,"rotation":0.0,"id":499,"width":569.0,"height":582.0100878848684,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":103,"lockAspectRatio":false,"lockShape":false,"children":[{"x":374.0,"y":44.510087884868476,"rotation":0.0,"id":497,"width":145.0,"height":32.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":101,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:14px;\"><span style=\"font-weight:bold;\">Network &amp;&nbsp;</span></span><span style=\"font-size:14px;\"><span style=\"font-weight:bold;\">other </span></span></p><p style=\"text-align:center;\"><span style=\"font-size:14px;\"><span style=\"font-weight:bold;\">Docker Hosts</span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":157.40277777777783,"y":108.18042331083174,"rotation":0.0,"id":492,"width":121.19444444444446,"height":256.03113588084784,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":99,"lockAspectRatio":false,"lockShape":false,"children":[{"x":-126.13675213675185,"y":31.971494223140525,"rotation":180.0,"id":453,"width":11.1452323717951,"height":61.19357171974171,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":57,"lockAspectRatio":true,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":6.0,"strokeColor":"#38761d","fillColor":"#38761d","dashStyle":"1.0,1.0","startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":10.0,"controlPath":[[-121.4915197649562,-156.36606993796556],[-121.49151976495622,-99.52846483047983],[-229.68596420939843,-99.52846483047591],[-229.68596420939843,-34.22088765589871]],"lockSegments":{"1":true},"ortho":true}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":289.82598824786317,"y":137.23816896148608,"rotation":180.0,"id":454,"width":11.1452323717951,"height":61.19357171974171,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":55,"lockAspectRatio":true,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":6.0,"strokeColor":"#38761d","fillColor":"#38761d","dashStyle":"1.0,1.0","startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":10.0,"controlPath":[[291.05455395299924,191.93174068122784],[291.05455395299924,106.06051735724502],[186.27677617521402,106.06051735724502],[186.27677617521402,69.78655839914467]],"lockSegments":{},"ortho":true}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":372.0,"y":332.0100878848684,"rotation":0.0,"id":490,"width":144.0,"height":60.0,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":97,"lockAspectRatio":false,"lockShape":false,"children":[{"x":0.0,"y":9.5,"rotation":0.0,"id":365,"width":141.0,"height":40.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":98,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:18px;font-family:Arial;\">&nbsp;Parent: <span style=\"font-weight:bold;\">eth0.30</span></span></p><p style=\"text-align:center;\"><span style=\"font-size:18px;font-family:Arial;\">VLAN: <span style=\"font-weight:bold;\">30</span></span></p><p style=\"text-align:center;\"></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":0.0,"y":0.0,"rotation":0.0,"id":342,"width":144.0,"height":60.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":96,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#eb6c6c","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.99,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":52.0,"y":332.0100878848684,"rotation":0.0,"id":489,"width":144.0,"height":60.0,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":92,"lockAspectRatio":false,"lockShape":false,"children":[{"x":1.0,"y":10.5,"rotation":0.0,"id":367,"width":138.0,"height":40.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":93,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:18px;font-family:Arial;\"><span style=\"\">Parent</span>: <span style=\"font-weight:bold;\">eth0.10</span></span></p><p style=\"text-align:center;\"><span style=\"font-size:18px;font-family:Arial;\">VLAN ID</span><span style=\"font-size:18px;font-family:Arial;\">:</span><span style=\"font-size:18px;font-weight:bold;font-family:Arial;\"> <span style=\"\">10</span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":0.0,"y":0.0,"rotation":0.0,"id":340,"width":144.0,"height":60.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":91,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#5fcc5a","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.99,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":289.40277777777794,"y":126.43727235088903,"rotation":0.0,"id":486,"width":121.19444444444446,"height":250.0,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":88,"lockAspectRatio":false,"lockShape":false,"children":[{"x":236.18596420940128,"y":158.89044937932732,"rotation":0.0,"id":449,"width":11.1452323717951,"height":59.50782702798556,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":53,"lockAspectRatio":true,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":6.0,"strokeColor":"#cc0000","fillColor":"#cc0000","dashStyle":"1.0,1.0","startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":10.0,"controlPath":[[-121.49151976495682,-152.05853787273531],[-121.49151976495682,-81.64750068755309],[-229.68596420940125,-81.64750068755139],[-229.68596420940125,-33.27817949077674]],"lockSegments":{},"ortho":true}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":-179.77677617521388,"y":56.523633779319084,"rotation":0.0,"id":450,"width":11.1452323717951,"height":59.50782702798556,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":51,"lockAspectRatio":true,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":6.0,"strokeColor":"#cc0000","fillColor":"#cc0000","dashStyle":"1.0,1.0","startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":10.0,"controlPath":[[291.0545539529992,186.6444547140887],[291.0545539529992,117.79470574474337],[186.276776175214,117.79470574474337],[186.276776175214,67.8640963321146]],"lockSegments":{"1":true},"ortho":true}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":447.0,"y":150.01008788486848,"rotation":0.0,"id":472,"width":46.99999999999994,"height":27.0,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":87,"lockAspectRatio":false,"lockShape":false,"children":[{"x":0.0,"y":0.0,"rotation":0.0,"id":473,"width":37.09803921568625,"height":18.000000000000004,"uid":"com.gliffy.shape.basic.basic_v1.default.rectangle","order":86,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#666666","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":5.485490196078445,"y":5.153846153846132,"rotation":0.0,"id":474,"width":37.09803921568625,"height":18.000000000000004,"uid":"com.gliffy.shape.basic.basic_v1.default.rectangle","order":84,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#666666","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":9.901960784313701,"y":9.0,"rotation":0.0,"id":475,"width":37.09803921568625,"height":18.000000000000004,"uid":"com.gliffy.shape.basic.basic_v1.default.rectangle","order":82,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#666666","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":368.0,"y":101.71008483311067,"rotation":0.0,"id":477,"width":140.0,"height":56.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":80,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:12px;font-family:Arial;\">Gateway&nbsp;</span><span style=\"font-weight:bold;\">10.1.30.1</span></p><p style=\"text-align:center;\"><span style=\"text-decoration:none;font-weight:bold;\">&nbsp;</span><span style=\"\">&nbsp;and other&nbsp;</span><span style=\"\">containers on the same VLAN/</span><span style=\"\">subnet</span></p><p style=\"text-align:center;\"><span style=\"text-decoration:none;\">&nbsp;</span></p><p style=\"text-align:center;\"></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":350.51767083236393,"y":87.47159983339776,"rotation":0.0,"id":478,"width":175.20345848455912,"height":73.0,"uid":"com.gliffy.shape.cisco.cisco_v1.storage.cloud","order":79,"lockAspectRatio":true,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.cisco.cisco_v1.storage.cloud","strokeWidth":2.0,"strokeColor":"#333333","fillColor":"#cc0000","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":94.0,"y":155.01008788486848,"rotation":0.0,"id":463,"width":46.99999999999994,"height":27.0,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":78,"lockAspectRatio":false,"lockShape":false,"children":[{"x":0.0,"y":0.0,"rotation":0.0,"id":464,"width":37.09803921568625,"height":18.000000000000004,"uid":"com.gliffy.shape.basic.basic_v1.default.rectangle","order":77,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#666666","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":5.485490196078445,"y":5.153846153846132,"rotation":0.0,"id":465,"width":37.09803921568625,"height":18.000000000000004,"uid":"com.gliffy.shape.basic.basic_v1.default.rectangle","order":75,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#666666","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":9.901960784313701,"y":9.0,"rotation":0.0,"id":466,"width":37.09803921568625,"height":18.000000000000004,"uid":"com.gliffy.shape.basic.basic_v1.default.rectangle","order":73,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#666666","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":80.0,"y":109.71008483311067,"rotation":0.0,"id":468,"width":140.0,"height":56.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":71,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:12px;font-family:Arial;\">Gateway&nbsp;</span><span style=\"font-weight:bold;\">10.1.10.1</span></p><p style=\"text-align:center;\"><span style=\"text-decoration:none;font-weight:bold;\">&nbsp;</span><span style=\"\">&nbsp;and other&nbsp;</span><span style=\"\">containers on the same VLAN/</span><span style=\"\">subnet</span></p><p style=\"text-align:center;\"><span style=\"text-decoration:none;\">&nbsp;</span></p><p style=\"text-align:center;\"></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":62.51767083236396,"y":95.47159983339776,"rotation":0.0,"id":469,"width":175.20345848455912,"height":73.0,"uid":"com.gliffy.shape.cisco.cisco_v1.storage.cloud","order":70,"lockAspectRatio":true,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.cisco.cisco_v1.storage.cloud","strokeWidth":2.0,"strokeColor":"#333333","fillColor":"#38761d","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":341.0,"y":40.010087884868476,"rotation":0.0,"id":460,"width":46.99999999999994,"height":27.0,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":69,"lockAspectRatio":false,"lockShape":false,"children":[{"x":0.0,"y":0.0,"rotation":0.0,"id":417,"width":37.09803921568625,"height":18.000000000000004,"uid":"com.gliffy.shape.basic.basic_v1.default.rectangle","order":68,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#666666","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":5.485490196078445,"y":5.153846153846132,"rotation":0.0,"id":418,"width":37.09803921568625,"height":18.000000000000004,"uid":"com.gliffy.shape.basic.basic_v1.default.rectangle","order":66,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#666666","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":9.901960784313701,"y":9.0,"rotation":0.0,"id":419,"width":37.09803921568625,"height":18.000000000000004,"uid":"com.gliffy.shape.basic.basic_v1.default.rectangle","order":64,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#666666","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":198.51767083236396,"y":41.471599833397754,"rotation":0.0,"id":459,"width":175.20345848455912,"height":79.73848499971291,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":62,"lockAspectRatio":false,"lockShape":false,"children":[{"x":17.482329167636067,"y":14.23848499971291,"rotation":0.0,"id":458,"width":140.0,"height":56.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":61,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:12px;font-family:Arial;\">Gateway&nbsp;</span><span style=\"font-weight:bold;\">10.1.20.1</span></p><p style=\"text-align:center;\"><span style=\"text-decoration:none;font-weight:bold;\">&nbsp;</span><span style=\"\">&nbsp;and other&nbsp;</span><span style=\"\">containers on the same VLAN/</span><span style=\"\">subnet</span></p><p style=\"text-align:center;\"><span style=\"text-decoration:none;\">&nbsp;</span></p><p style=\"text-align:center;\"></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":0.0,"y":0.0,"rotation":0.0,"id":330,"width":175.20345848455912,"height":73.0,"uid":"com.gliffy.shape.cisco.cisco_v1.storage.cloud","order":59,"lockAspectRatio":true,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.cisco.cisco_v1.storage.cloud","strokeWidth":2.0,"strokeColor":"#333333","fillColor":"#ff9900","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":279.0,"y":129.01008788486848,"rotation":0.0,"id":440,"width":5.0,"height":227.0,"uid":"com.gliffy.shape.basic.basic_v1.default.line","order":49,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":6.0,"strokeColor":"#ff9900","fillColor":"#ff9900","dashStyle":"1.0,1.0","startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[4.000000000000057,-25.08952732449731],[4.000000000000114,176.01117206537933]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":56.0,"y":503.0913886978766,"rotation":0.0,"id":386,"width":135.0,"height":20.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":48,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:18px;font-family:Arial;\">Frontend</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":62.0,"y":420.0100878848684,"rotation":0.0,"id":381,"width":120.0,"height":74.18803418803415,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":41,"lockAspectRatio":false,"lockShape":false,"children":[{"x":0.0,"y":0.0,"rotation":0.0,"id":382,"width":102.08955223880598,"height":54.91841491841488,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":44,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.97,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[{"x":2.0417910447761187,"y":0.0,"rotation":0.0,"id":383,"width":98.00597014925374,"height":44.0,"uid":null,"order":47,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":8,"paddingRight":8,"paddingBottom":8,"paddingLeft":8,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"\">Container(s)</span></p><p style=\"text-align:center;\"><span style=\"font-size:13px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">Eth0 <span style=\"font-weight:bold;\">10.1.10.0/24</span></span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":8.955223880597016,"y":9.634809634809635,"rotation":0.0,"id":384,"width":102.08955223880598,"height":54.91841491841488,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":42,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.97,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":17.910447761194032,"y":19.26961926961927,"rotation":0.0,"id":385,"width":102.08955223880598,"height":54.91841491841488,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":40,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.97,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":382.0,"y":420.0100878848684,"rotation":0.0,"id":376,"width":120.0,"height":74.18803418803415,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":31,"lockAspectRatio":false,"lockShape":false,"children":[{"x":0.0,"y":0.0,"rotation":0.0,"id":377,"width":102.08955223880598,"height":54.91841491841488,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":34,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.97,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[{"x":2.0417910447761187,"y":0.0,"rotation":0.0,"id":378,"width":98.00597014925374,"height":44.0,"uid":null,"order":37,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":8,"paddingRight":8,"paddingBottom":8,"paddingLeft":8,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"\">Container(s)</span></p><p style=\"text-align:center;\"><span style=\"font-size:13px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">Eth0 <span style=\"font-weight:bold;\">10.1.30.0/24</span></span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":8.955223880597016,"y":9.634809634809635,"rotation":0.0,"id":379,"width":102.08955223880598,"height":54.91841491841488,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":32,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.97,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":17.910447761194032,"y":19.26961926961927,"rotation":0.0,"id":380,"width":102.08955223880598,"height":54.91841491841488,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":30,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.97,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":214.0,"y":503.0100878848685,"rotation":0.0,"id":374,"width":135.0,"height":20.162601626016258,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":27,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:18px;font-family:Arial;\">Backend</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":376.0,"y":502.0100878848684,"rotation":0.0,"id":373,"width":135.0,"height":20.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":26,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:18px;font-family:Arial;\">Credit Cards</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":627.0,"y":99.94304076572786,"rotation":0.0,"id":364,"width":100.0,"height":100.0,"uid":"com.gliffy.shape.uml.uml_v2.sequence.anchor_line","order":25,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":363,"py":0.0,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":342,"py":1.0,"px":0.5}}},"graphic":{"type":"Line","Line":{"strokeWidth":1.0,"strokeColor":"#000000","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[-183.0,310.0670471191406],[-183.0,292.0670471191406]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":372.0,"y":410.0100878848684,"rotation":0.0,"id":363,"width":144.0,"height":117.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":24,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#eb6c6c","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.99,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":218.0,"y":341.5100878848684,"rotation":0.0,"id":366,"width":132.0,"height":40.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":23,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:18px;font-family:Arial;\">Parent: <span style=\"font-weight:bold;\">eth0.20</span></span></p><p style=\"text-align:center;\"><span style=\"font-size:18px;font-family:Arial;\">VLAN ID: <span style=\"font-weight:bold;\">20</span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":297.0,"y":89.94304076572786,"rotation":0.0,"id":356,"width":100.0,"height":100.0,"uid":"com.gliffy.shape.uml.uml_v2.sequence.anchor_line","order":22,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":353,"py":0.0,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":343,"py":1.0,"px":0.5}}},"graphic":{"type":"Line","Line":{"strokeWidth":1.0,"strokeColor":"#000000","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[-13.0,320.0670471191406],[-13.0,302.0670471191406]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":222.0,"y":420.0100878848684,"rotation":0.0,"id":348,"width":120.0,"height":74.18803418803415,"uid":"com.gliffy.shape.basic.basic_v1.default.group","order":21,"lockAspectRatio":false,"lockShape":false,"children":[{"x":0.0,"y":0.0,"rotation":0.0,"id":349,"width":102.08955223880598,"height":54.91841491841488,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":17,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.97,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[{"x":2.0417910447761187,"y":0.0,"rotation":0.0,"id":350,"width":98.00597014925374,"height":44.0,"uid":null,"order":20,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":8,"paddingRight":8,"paddingBottom":8,"paddingLeft":8,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"\">Container(s)</span></p><p style=\"text-align:center;\"><span style=\"font-size:13px;text-decoration:none;font-family:Arial;\"><span style=\"text-decoration:none;\">Eth0 <span style=\"font-weight:bold;\">10.1.20.0/24</span></span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":8.955223880597016,"y":9.634809634809635,"rotation":0.0,"id":351,"width":102.08955223880598,"height":54.91841491841488,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":15,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.97,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":17.910447761194032,"y":19.26961926961927,"rotation":0.0,"id":352,"width":102.08955223880598,"height":54.91841491841488,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":13,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#4cacf5","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.97,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":212.0,"y":410.0100878848684,"rotation":0.0,"id":353,"width":144.0,"height":119.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":11,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#fca13f","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.99,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":212.0,"y":332.0100878848684,"rotation":0.0,"id":343,"width":144.0,"height":60.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":10,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#fca13f","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.99,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":203.0,"y":307.5100878848684,"rotation":0.0,"id":333,"width":160.0,"height":22.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":9,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:20px;font-family:Arial;\"><span style=\"font-weight:bold;\">eth0</span>&nbsp;Interface</span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":303.0,"y":240.51008788486845,"rotation":0.0,"id":323,"width":261.0,"height":48.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":8,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:14px;font-weight:bold;font-family:Arial;\">802.1Q Trunk - </span><span style=\"font-size:14px;font-family:Arial;\"><span style=\"font-style:italic;\">can be a single Ethernet link or Multiple Bonded Ethernet links</span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":36.0,"y":291.0100878848684,"rotation":0.0,"id":290,"width":497.0,"height":80.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":7,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#cccccc","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":1.0,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":0.0,"y":543.5100878848684,"rotation":0.0,"id":282,"width":569.0,"height":32.0,"uid":"com.gliffy.shape.basic.basic_v1.default.text","order":6,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Text","Text":{"overflow":"none","paddingTop":2,"paddingRight":2,"paddingBottom":2,"paddingLeft":2,"outerPaddingTop":6,"outerPaddingRight":6,"outerPaddingBottom":2,"outerPaddingLeft":6,"type":"fixed","lineTValue":null,"linePerpValue":null,"cardinalityType":null,"html":"<p style=\"text-align:center;\"><span style=\"font-size:14px;\"><span style=\"font-weight:bold;\">Docker Host</span></span><span style=\"font-size:14px;font-style:italic;\">: Frontend, Backend &amp; Credit Card App Tiers are&nbsp;<span style=\"font-weight:bold;\">Isolated</span></span><span style=\"font-size:14px;\">&nbsp;but can still communicate inside <span style=\"font-weight:bold;\">parent</span> interface or any other Docker hosts using the <span style=\"font-weight:bold;\">VLAN ID</span></span></p>","tid":null,"valign":"middle","vposition":"none","hposition":"none"}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":-33.0,"y":79.94304076572786,"rotation":0.0,"id":269,"width":100.0,"height":100.0,"uid":"com.gliffy.shape.uml.uml_v2.sequence.anchor_line","order":5,"lockAspectRatio":false,"lockShape":false,"constraints":{"constraints":[],"startConstraint":{"type":"StartPositionConstraint","StartPositionConstraint":{"nodeId":345,"py":0.0,"px":0.5}},"endConstraint":{"type":"EndPositionConstraint","EndPositionConstraint":{"nodeId":340,"py":1.0,"px":0.5}}},"graphic":{"type":"Line","Line":{"strokeWidth":1.0,"strokeColor":"#000000","fillColor":"none","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[157.0,330.0670471191406],[157.0,312.0670471191406]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":52.0,"y":410.0100878848684,"rotation":0.0,"id":345,"width":144.0,"height":119.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":4,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":1.0,"strokeColor":"#434343","fillColor":"#5fcc5a","gradient":false,"dashStyle":null,"dropShadow":true,"state":0,"opacity":0.99,"shadowX":4.0,"shadowY":4.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":20.0,"y":323.0100878848684,"rotation":0.0,"id":276,"width":531.0,"height":259.0,"uid":"com.gliffy.shape.basic.basic_v1.default.round_rectangle","order":3,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.round_rectangle.basic_v1","strokeWidth":2.0,"strokeColor":"#434343","fillColor":"#c5e4fc","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":0.93,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":19.609892022503004,"y":20.27621073737908,"rotation":355.62347411485274,"id":246,"width":540.0106597126834,"height":225.00000000000003,"uid":"com.gliffy.shape.cisco.cisco_v1.storage.cloud","order":2,"lockAspectRatio":true,"lockShape":false,"graphic":{"type":"Shape","Shape":{"tid":"com.gliffy.stencil.cisco.cisco_v1.storage.cloud","strokeWidth":2.0,"strokeColor":"#333333","fillColor":"#999999","gradient":false,"dashStyle":null,"dropShadow":false,"state":0,"opacity":1.0,"shadowX":0.0,"shadowY":0.0}},"linkMap":[],"children":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":1.0,"y":99.94304076572786,"rotation":0.0,"id":394,"width":100.0,"height":100.0,"uid":"com.gliffy.shape.uml.uml_v2.sequence.anchor_line","order":1,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":3.0,"strokeColor":"#666666","fillColor":"#999999","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[261.0,233.5670471191406],[261.0,108.05111187584177]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"},{"x":44.0,"y":90.94304076572786,"rotation":0.0,"id":481,"width":100.0,"height":100.0,"uid":"com.gliffy.shape.uml.uml_v2.sequence.anchor_line","order":0,"lockAspectRatio":false,"lockShape":false,"graphic":{"type":"Line","Line":{"strokeWidth":3.0,"strokeColor":"#666666","fillColor":"#999999","dashStyle":null,"startArrow":0,"endArrow":0,"startArrowRotation":"auto","endArrowRotation":"auto","interpolationType":"linear","cornerRadius":null,"controlPath":[[261.0,233.56704711914062],[261.0,108.05111187584174]],"lockSegments":{},"ortho":false}},"linkMap":[],"hidden":false,"layerId":"9wom3rMkTrb3"}],"hidden":false,"layerId":"9wom3rMkTrb3"}],"layers":[{"guid":"9wom3rMkTrb3","order":0,"name":"Layer 0","active":true,"locked":false,"visible":true,"nodeIndex":104}],"shapeStyles":{},"lineStyles":{"global":{"fill":"#999999","stroke":"#38761d","strokeWidth":3,"dashStyle":"1.0,1.0","orthoMode":2}},"textStyles":{"global":{"bold":true,"face":"Arial","size":"14px","color":"#000000"}}},"metadata":{"title":"untitled","revision":0,"exportBorder":false,"loadPosition":"default","libraries":["com.gliffy.libraries.basic.basic_v1.default","com.gliffy.libraries.flowchart.flowchart_v1.default","com.gliffy.libraries.swimlanes.swimlanes_v1.default","com.gliffy.libraries.images","com.gliffy.libraries.network.network_v4.home","com.gliffy.libraries.network.network_v4.business","com.gliffy.libraries.network.network_v4.rack","com.gliffy.libraries.network.network_v3.home","com.gliffy.libraries.network.network_v3.business","com.gliffy.libraries.network.network_v3.rack"],"lastSerialized":1458117295143,"analyticsProduct":"Confluence"},"embeddedResources":{"index":0,"resources":[]}}
\ No newline at end of file
diff --git a/components/engine/experimental/images/vlans-deeper-look.png b/components/engine/experimental/images/vlans-deeper-look.png
deleted file mode 100644
index 32d95f600e..0000000000
Binary files a/components/engine/experimental/images/vlans-deeper-look.png and /dev/null differ
diff --git a/components/engine/experimental/images/vlans-deeper-look.svg b/components/engine/experimental/images/vlans-deeper-look.svg
deleted file mode 100644
index 96cd21d52f..0000000000
--- a/components/engine/experimental/images/vlans-deeper-look.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="586" height="601"><style xmlns="http://www.w3.org/1999/xhtml"></style><defs/><g transform="translate(0,0)"><g><rect fill="#FFFFFF" stroke="none" x="0" y="0" width="586" height="601"/></g><g transform="matrix(1,0,0,1,295,192.98406475670114)"><g transform="translate(0,0)"><g transform="translate(-39,-89.9329528808594) translate(-256,-103.05111187584174) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#666666" d="M 300 323.5 L 300 197.98406475670114" stroke-miterlimit="10" stroke-width="3"/></g></g></g></g><g transform="matrix(1,0,0,1,295,192.98406475670114)"><g transform="translate(0,0)"><g transform="translate(-39,-89.9329528808594) translate(-256,-103.05111187584174) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#999999" d="M 300 323.5 L 300 197.98406475670114" stroke-miterlimit="10" stroke-width="3"/></g></g></g></g><g transform="matrix(1,0,0,1,252,201.98406475670117)"><g transform="translate(0,0)"><g transform="translate(4,-98.9329528808594) translate(-256,-103.05111187584177) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#666666" d="M 257 332.5 L 257 206.98406475670117" stroke-miterlimit="10" stroke-width="3"/></g></g></g></g><g transform="matrix(1,0,0,1,252,201.98406475670117)"><g transform="translate(0,0)"><g transform="translate(4,-98.9329528808594) translate(-256,-103.05111187584177) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#999999" d="M 257 332.5 L 257 206.98406475670117" stroke-miterlimit="10" stroke-width="3"/></g></g></g></g><g transform="translate(0,0) matrix(0.9970841003774397,-0.07631052859541608,0.07631052859541608,0.9970841003774397,6.812265994936054,40.19841100496578)"><g><g transform="translate(0,0) scale(5.40007959672885,3.87815826436388) translate(0.00001348378,-0.001498589)"><g><g><path fill="#FFFFFF" stroke="#999999" d="M 33.84 5.912 C 16.263 2.403 6.986 11.405 8.451 19.186 L 8.57 19.61 C -5.128 21.942 -1.537 38.106 5.033 38.106 L 5.679 38.085 C 4.026 45.68 20.032 53.41 28.958 49.548 L 29.531 48.92 C 32.713 55.752 44.02 56.893 55.201 57.177 C 64.89 57.425 70.546 56.658 74.702 52.411 L 75.341 52.599 C 90.852 53.845 97.915 43.133 94.526 35.442 L 95.36 35.207 C 100.648 33.808 101.258 21.602 92.187 19.797 L 92.361 19.325 C 96.299 11.385 87.011 3.896 74.124 5.303 L 73.23 4.837 C 64.003 -3.517 37.449 -2.157 34.373 6.108 L 33.84 5.912 Z" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g></g><g transform="translate(0,0) matrix(1,0,0,1,15,322)"><g><g transform="translate(0,0) scale(5.31,2.59)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.18832391713747648,0.3861003861003861)"><path fill="#c5e4fc" stroke="none" d="M 10 0 L 521 0 Q 531 0 531 10 L 531 249 Q 531 259 521 259 L 10 259 Q 0 259 0 249 L 0 10 Q 0 0 10 0 Z" opacity="0.93"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 521 0 Q 531 0 531 10 L 531 249 Q 531 259 521 259 L 10 259 Q 0 259 0 249 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" stroke-width="2" opacity="0.93"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,47,409)"><g transform="translate(4,4) scale(1.0034722222222223,1.004201680672269)"><g><g transform="translate(0,0) scale(1.44,1.19)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.6944444444444444,0.8403361344537815)"><path fill="#000000" stroke="none" d="M 10 0 L 134 0 Q 144 0 144 10 L 144 109 Q 144 119 134 119 L 10 119 Q 0 119 0 109 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 134 0 Q 144 0 144 10 L 144 109 Q 144 119 134 119 L 10 119 Q 0 119 0 109 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.44,1.19)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.6944444444444444,0.8403361344537815)"><path fill="#5fcc5a" stroke="none" d="M 10 0 L 134 0 Q 144 0 144 10 L 144 109 Q 144 119 134 119 L 10 119 Q 0 119 0 109 L 0 10 Q 0 0 10 0 Z" opacity="0.99"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 134 0 Q 144 0 144 10 L 144 109 Q 144 119 134 119 L 10 119 Q 0 119 0 109 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.99"/></g></g></g></g></g><g transform="matrix(1,0,0,1,115,387)"><g transform="translate(0,0)"><g transform="translate(38,-78.9329528808594) translate(-153,-308.0670471191406) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#000000" d="M 119 409 L 119 391" stroke-miterlimit="10"/></g></g></g></g><g transform="matrix(1,0,0,1,-3,543)"><g transform="translate(1676,32) matrix(1,0,0,1,0,0) translate(-1676,-32)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="566" height="32" fill-opacity="0"/></g></g><g transform="translate(1676,32) matrix(1,0,0,1,0,0) translate(-1676,-32)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="566" height="32" fill-opacity="0"/></g></g><g transform="translate(1676,32) matrix(1,0,0,1,0,0) translate(-1676,-32)"><g><rect fill="rgb(0,0,0)" stroke="none" x="25" y="0" width="83" height="16" fill-opacity="0"/></g></g><g transform="translate(1676,32) matrix(1,0,0,1,0,0) translate(-1676,-32)"><g><rect fill="rgb(0,0,0)" stroke="none" x="25" y="0" width="83" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="25" y="14">Docker</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="76" y="14">Host</text></g><g transform="translate(1676,32) matrix(1,0,0,1,0,0) translate(-1676,-32)"><g><rect fill="rgb(0,0,0)" stroke="none" x="108" y="0" width="360" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="108" y="14">:</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="115" y="14">Frontend</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="171" y="14">,</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="179" y="14">Backend</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="234" y="14"> &amp;</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="251" y="14">Credit</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="292" y="14">Card</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="326" y="14">App</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="355" y="14">Tiers</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="390" y="14">are</text></g><g transform="translate(1676,32) matrix(1,0,0,1,0,0) translate(-1676,-32)"><g><rect fill="rgb(0,0,0)" stroke="none" x="414" y="0" width="53" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="bold" text-decoration="" line-height="16.5px" x="414" y="14">Isolated</text></g><g transform="translate(1676,32) matrix(1,0,0,1,0,0) translate(-1676,-32)"><g><rect fill="rgb(0,0,0)" stroke="none" x="467" y="0" width="515" height="32" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="471" y="14">but</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="494" y="14">can</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="521" y="14">still</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="27" y="30">communicate</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="114" y="30">inside</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="201" y="30">interface</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="258" y="30">or</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="275" y="30">any</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="301" y="30">other</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="337" y="30">Docker</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="385" y="30">hosts</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="423" y="30">using</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="normal" text-decoration="" line-height="16.5px" x="460" y="30">the</text></g><g transform="translate(1676,32) matrix(1,0,0,1,0,0) translate(-1676,-32)"><g><rect fill="rgb(0,0,0)" stroke="none" x="154" y="16" width="44" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="154" y="30">parent</text></g><g transform="translate(1676,32) matrix(1,0,0,1,0,0) translate(-1676,-32)"><g><rect fill="rgb(0,0,0)" stroke="none" x="483" y="16" width="57" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="483" y="30">VLAN</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="525" y="30">ID</text></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,31,290)"><g transform="translate(4,4) scale(1.0010060362173039,1.00625)"><g><g transform="translate(0,0) scale(4.97,0.8)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.2012072434607646,1.25)"><path fill="#000000" stroke="none" d="M 10 0 L 487 0 Q 497 0 497 10 L 497 70 Q 497 80 487 80 L 10 80 Q 0 80 0 70 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 487 0 Q 497 0 497 10 L 497 70 Q 497 80 487 80 L 10 80 Q 0 80 0 70 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(4.97,0.8)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.2012072434607646,1.25)"><path fill="#cccccc" stroke="none" d="M 10 0 L 487 0 Q 497 0 497 10 L 497 70 Q 497 80 487 80 L 10 80 Q 0 80 0 70 L 0 10 Q 0 0 10 0 Z"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 487 0 Q 497 0 497 10 L 497 70 Q 497 80 487 80 L 10 80 Q 0 80 0 70 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10"/></g></g></g></g></g><g transform="matrix(1,0,0,1,300,248)"><g transform="translate(211,0) matrix(1,0,0,1,0,0) translate(-211,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="258" height="48" fill-opacity="0"/></g></g><g transform="translate(211,0) matrix(1,0,0,1,0,0) translate(-211,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="258" height="32" fill-opacity="0"/></g></g><g transform="translate(211,0) matrix(1,0,0,1,0,0) translate(-211,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="3" y="0" width="101" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="3" y="14">802</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="27" y="14">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="31" y="14">1Q</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="53" y="14">Trunk</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="91" y="14"> -</text></g><g transform="translate(211,0) matrix(1,0,0,1,0,0) translate(-211,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="104" y="0" width="242" height="32" fill-opacity="0"/></g></g><g transform="translate(211,0) matrix(1,0,0,1,0,0) translate(-211,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="104" y="0" width="242" height="32" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="104" y="14">can</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="130" y="14">be</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="150" y="14">a</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="161" y="14">single</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="202" y="14">Ethernet</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="14" y="30">link</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="39" y="30">or</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="55" y="30">Multiple</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="107" y="30">Bonded</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="159" y="30">Ethernet</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="italic" font-weight="normal" text-decoration="" line-height="16.5px" x="216" y="30">links</text></g></g><g transform="matrix(1,0,0,1,200,307)"><g transform="translate(32,0) matrix(1,0,0,1,0,0) translate(-32,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="157" height="22" fill-opacity="0"/></g></g><g transform="translate(32,0) matrix(1,0,0,1,0,0) translate(-32,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="157" height="22" fill-opacity="0"/></g></g><g transform="translate(32,0) matrix(1,0,0,1,0,0) translate(-32,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="16" y="0" width="125" height="22" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="20px" font-style="normal" font-weight="normal" text-decoration="" line-height="22.75px" x="63" y="19">Interface</text></g><g transform="translate(32,0) matrix(1,0,0,1,0,0) translate(-32,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="16" y="0" width="42" height="22" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="20px" font-style="normal" font-weight="bold" text-decoration="" line-height="22.75px" x="16" y="19">eth0</text></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,207,331)"><g transform="translate(4,4) scale(1.0034722222222223,1.0083333333333333)"><g><g transform="translate(0,0) scale(1.44,0.6)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.6944444444444444,1.6666666666666667)"><path fill="#000000" stroke="none" d="M 10 0 L 134 0 Q 144 0 144 10 L 144 50 Q 144 60 134 60 L 10 60 Q 0 60 0 50 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 134 0 Q 144 0 144 10 L 144 50 Q 144 60 134 60 L 10 60 Q 0 60 0 50 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.44,0.6)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.6944444444444444,1.6666666666666667)"><path fill="#fca13f" stroke="none" d="M 10 0 L 134 0 Q 144 0 144 10 L 144 50 Q 144 60 134 60 L 10 60 Q 0 60 0 50 L 0 10 Q 0 0 10 0 Z" opacity="0.99"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 134 0 Q 144 0 144 10 L 144 50 Q 144 60 134 60 L 10 60 Q 0 60 0 50 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.99"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,207,409)"><g transform="translate(4,4) scale(1.0034722222222223,1.004201680672269)"><g><g transform="translate(0,0) scale(1.44,1.19)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.6944444444444444,0.8403361344537815)"><path fill="#000000" stroke="none" d="M 10 0 L 134 0 Q 144 0 144 10 L 144 109 Q 144 119 134 119 L 10 119 Q 0 119 0 109 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 134 0 Q 144 0 144 10 L 144 109 Q 144 119 134 119 L 10 119 Q 0 119 0 109 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.44,1.19)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.6944444444444444,0.8403361344537815)"><path fill="#fca13f" stroke="none" d="M 10 0 L 134 0 Q 144 0 144 10 L 144 109 Q 144 119 134 119 L 10 119 Q 0 119 0 109 L 0 10 Q 0 0 10 0 Z" opacity="0.99"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 134 0 Q 144 0 144 10 L 144 109 Q 144 119 134 119 L 10 119 Q 0 119 0 109 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.99"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,234.91044776119404,438.2696192696193)"><g transform="translate(4,4) scale(1.0048976608187135,1.00910441426146)"><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#000000" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.97"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.97"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,225.955223880597,428.63480963480964)"><g transform="translate(4,4) scale(1.0048976608187135,1.00910441426146)"><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#000000" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.97"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.97"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,217,419)"><g transform="translate(4,4) scale(1.0048976608187135,1.00910441426146)"><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#000000" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.97"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.97"/></g></g></g></g></g><g transform="matrix(1,0,0,1,227,424)"><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="83" height="44" fill-opacity="0"/></g></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="83" height="14" fill-opacity="0"/></g></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="8" y="0" width="67" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="8" y="12">Container</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="61" y="12">(</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="65" y="12">s</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="71" y="12">)</text></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="83" height="30" fill-opacity="0"/></g></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="28" y="14" width="73" height="30" fill-opacity="0"/></g></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="28" y="14" width="73" height="30" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="28" y="27">Eth0</text></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="5" y="29" width="73" height="15" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="5" y="42">10</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="20" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="23" y="42">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="31" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="34" y="42">20</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="49" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="52" y="42">0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="60" y="42">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="63" y="42">24</text></g></g><g transform="matrix(1,0,0,1,275,387)"><g transform="translate(0,0)"><g transform="translate(-292,-88.9329528808594) translate(17,-298.0670471191406) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#000000" d="M 279 409 L 279 391" stroke-miterlimit="10"/></g></g></g></g><g transform="matrix(1,0,0,1,215,341)"><g transform="translate(176,60) matrix(1,0,0,1,0,0) translate(-176,-60)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="129" height="40" fill-opacity="0"/></g></g><g transform="translate(176,60) matrix(1,0,0,1,0,0) translate(-176,-60)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="129" height="20" fill-opacity="0"/></g></g><g transform="translate(176,60) matrix(1,0,0,1,0,0) translate(-176,-60)"><g><rect fill="rgb(0,0,0)" stroke="none" x="2" y="0" width="127" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="2" y="17">Parent</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="55" y="17">:</text></g><g transform="translate(176,60) matrix(1,0,0,1,0,0) translate(-176,-60)"><g><rect fill="rgb(0,0,0)" stroke="none" x="65" y="0" width="63" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="bold" text-decoration="" line-height="20.5px" x="65" y="17">eth0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="bold" text-decoration="" line-height="20.5px" x="102" y="17">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="bold" text-decoration="" line-height="20.5px" x="107" y="17">20</text></g><g transform="translate(176,60) matrix(1,0,0,1,0,0) translate(-176,-60)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="20" width="129" height="20" fill-opacity="0"/></g></g><g transform="translate(176,60) matrix(1,0,0,1,0,0) translate(-176,-60)"><g><rect fill="rgb(0,0,0)" stroke="none" x="14" y="20" width="101" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="14" y="37">VLAN</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="66" y="37">ID</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="84" y="37">:</text></g><g transform="translate(176,60) matrix(1,0,0,1,0,0) translate(-176,-60)"><g><rect fill="rgb(0,0,0)" stroke="none" x="95" y="20" width="21" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="bold" text-decoration="" line-height="20.5px" x="95" y="37">20</text></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,367,409)"><g transform="translate(4,4) scale(1.0034722222222223,1.0042735042735043)"><g><g transform="translate(0,0) scale(1.44,1.17)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.6944444444444444,0.8547008547008548)"><path fill="#000000" stroke="none" d="M 10 0 L 134 0 Q 144 0 144 10 L 144 107 Q 144 117 134 117 L 10 117 Q 0 117 0 107 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 134 0 Q 144 0 144 10 L 144 107 Q 144 117 134 117 L 10 117 Q 0 117 0 107 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.44,1.17)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.6944444444444444,0.8547008547008548)"><path fill="#eb6c6c" stroke="none" d="M 10 0 L 134 0 Q 144 0 144 10 L 144 107 Q 144 117 134 117 L 10 117 Q 0 117 0 107 L 0 10 Q 0 0 10 0 Z" opacity="0.99"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 134 0 Q 144 0 144 10 L 144 107 Q 144 117 134 117 L 10 117 Q 0 117 0 107 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.99"/></g></g></g></g></g><g transform="matrix(1,0,0,1,435,387)"><g transform="translate(0,0)"><g transform="translate(-622,-98.9329528808594) translate(187,-288.0670471191406) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#000000" d="M 439 409 L 439 391" stroke-miterlimit="10"/></g></g></g></g><g transform="matrix(1,0,0,1,373,501)"><g transform="translate(15,0) matrix(1,0,0,1,0,0) translate(-15,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="132" height="20" fill-opacity="0"/></g></g><g transform="translate(15,0) matrix(1,0,0,1,0,0) translate(-15,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="132" height="20" fill-opacity="0"/></g></g><g transform="translate(15,0) matrix(1,0,0,1,0,0) translate(-15,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="15" y="0" width="102" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="15" y="17">Credit</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="69" y="17">Cards</text></g></g><g transform="matrix(1,0,0,1,211,502)"><g transform="translate(31,0) matrix(1,0,0,1,0,0) translate(-31,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="132" height="20" fill-opacity="0"/></g></g><g transform="translate(31,0) matrix(1,0,0,1,0,0) translate(-31,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="132" height="20" fill-opacity="0"/></g></g><g transform="translate(31,0) matrix(1,0,0,1,0,0) translate(-31,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="31" y="0" width="72" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="31" y="17">Backend</text></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,394.910447761194,438.2696192696193)"><g transform="translate(4,4) scale(1.0048976608187135,1.00910441426146)"><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#000000" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.97"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.97"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,385.95522388059703,428.63480963480964)"><g transform="translate(4,4) scale(1.0048976608187135,1.00910441426146)"><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#000000" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.97"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.97"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,377,419)"><g transform="translate(4,4) scale(1.0048976608187135,1.00910441426146)"><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#000000" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.97"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.97"/></g></g></g></g></g><g transform="matrix(1,0,0,1,387,424)"><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="83" height="44" fill-opacity="0"/></g></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="83" height="14" fill-opacity="0"/></g></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="8" y="0" width="67" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="8" y="12">Container</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="61" y="12">(</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="65" y="12">s</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="71" y="12">)</text></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="83" height="30" fill-opacity="0"/></g></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="28" y="14" width="73" height="30" fill-opacity="0"/></g></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="28" y="14" width="73" height="30" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="28" y="27">Eth0</text></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="5" y="29" width="73" height="15" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="5" y="42">10</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="20" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="23" y="42">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="31" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="34" y="42">30</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="49" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="52" y="42">0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="60" y="42">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="63" y="42">24</text></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,74.91044776119404,438.2696192696193)"><g transform="translate(4,4) scale(1.0048976608187135,1.00910441426146)"><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#000000" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.97"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.97"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,65.95522388059702,428.63480963480964)"><g transform="translate(4,4) scale(1.0048976608187135,1.00910441426146)"><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#000000" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.97"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.97"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,57,419)"><g transform="translate(4,4) scale(1.0048976608187135,1.00910441426146)"><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#000000" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.0208955223880598,0.5491841491841488)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.9795321637426899,1.8208828522920215)"><path fill="#4cacf5" stroke="none" d="M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" opacity="0.97"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 92.08955223880598 0 Q 102.08955223880598 0 102.08955223880598 10 L 102.08955223880598 44.91841491841488 Q 102.08955223880598 54.91841491841488 92.08955223880598 54.91841491841488 L 10 54.91841491841488 Q 0 54.91841491841488 0 44.91841491841488 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.97"/></g></g></g></g></g><g transform="matrix(1,0,0,1,67,424)"><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="83" height="44" fill-opacity="0"/></g></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="83" height="14" fill-opacity="0"/></g></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="8" y="0" width="67" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="8" y="12">Container</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="61" y="12">(</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="65" y="12">s</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="71" y="12">)</text></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="83" height="30" fill-opacity="0"/></g></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="28" y="14" width="73" height="30" fill-opacity="0"/></g></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="28" y="14" width="73" height="30" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="normal" text-decoration="" line-height="15.5px" x="28" y="27">Eth0</text></g><g transform="translate(69,71) matrix(1,0,0,1,0,0) translate(-69,-71)"><g><rect fill="rgb(0,0,0)" stroke="none" x="5" y="29" width="73" height="15" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="5" y="42">10</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="20" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="23" y="42">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="31" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="34" y="42">10</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="49" y="42">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="52" y="42">0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="60" y="42">/</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="13px" font-style="normal" font-weight="bold" text-decoration="" line-height="15.5px" x="63" y="42">24</text></g></g><g transform="matrix(1,0,0,1,53,502)"><g transform="translate(30,0) matrix(1,0,0,1,0,0) translate(-30,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="132" height="20" fill-opacity="0"/></g></g><g transform="translate(30,0) matrix(1,0,0,1,0,0) translate(-30,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="132" height="20" fill-opacity="0"/></g></g><g transform="translate(30,0) matrix(1,0,0,1,0,0) translate(-30,0)"><g><rect fill="rgb(0,0,0)" stroke="none" x="30" y="0" width="74" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="30" y="17">Frontend</text></g></g><g transform="matrix(1,0,0,1,271.50000000000006,96.41047267550272)"><g transform="translate(0,0)"><g transform="translate(-274,-128.00000000000003) translate(2.499999999999943,31.58952732449731) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#ff9900" d="M 278.00000000000006 102.91047267550272 M 278.00000000000006 102.91047267550272 L 278.00000000000006 108.91047267550272 M 278.00000000000006 108.91047267550272 M 278.00000000000006 114.91047267550272 L 278.00000000000006 120.91047267550272 M 278.00000000000006 120.91047267550272 M 278.00000000000006 126.91047267550272 L 278.00000000000006 132.91047267550272 M 278.00000000000006 132.91047267550272 M 278.00000000000006 138.91047267550272 L 278.00000000000006 144.91047267550272 M 278.00000000000006 144.91047267550272 M 278.00000000000006 150.91047267550272 L 278.00000000000006 156.91047267550272 M 278.00000000000006 156.91047267550272 M 278.00000000000006 162.91047267550272 L 278.00000000000006 168.91047267550272 M 278.00000000000006 168.91047267550272 M 278.00000000000006 174.91047267550272 L 278.00000000000006 180.91047267550272 M 278.00000000000006 180.91047267550272 M 278.00000000000006 186.91047267550272 L 278.00000000000006 192.91047267550272 M 278.00000000000006 192.91047267550272 M 278.00000000000006 198.91047267550272 L 278.00000000000006 204.91047267550272 M 278.00000000000006 204.91047267550272 M 278.00000000000006 210.91047267550272 L 278.00000000000006 216.91047267550272 M 278.00000000000006 216.91047267550272 M 278.00000000000006 222.91047267550272 L 278.00000000000006 228.91047267550272 M 278.00000000000006 228.91047267550272 M 278.00000000000006 234.91047267550272 L 278.00000000000006 240.91047267550272 M 278.00000000000006 240.91047267550272 M 278.00000000000006 246.91047267550272 L 278.00000000000006 252.91047267550272 M 278.00000000000006 252.91047267550272 M 278.00000000000006 258.9104726755027 L 278.00000000000006 264.9104726755027 M 278.00000000000006 264.9104726755027 M 278.00000000000006 270.9104726755027 L 278.00000000000006 276.9104726755027 M 278.00000000000006 276.9104726755027 M 278.00000000000006 282.9104726755027 L 278.00000000000006 288.9104726755027 M 278.00000000000006 288.9104726755027 M 278.00000000000006 294.9104726755027 L 278.0000000000001 300.9104726755027 M 278.0000000000001 300.9104726755027" stroke-miterlimit="10" stroke-width="6"/></g></g></g></g><g transform="matrix(1,0,0,1,284.40277777777806,243.31491457745426)"><g transform="translate(0,0)"><g transform="translate(-104.62600160256406,-181.95081824533966) translate(-179.776776175214,-61.3640963321146) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#cc0000" d="M 395.6805555555633 368.59527295942837 M 395.6805555555633 368.59527295942837 L 395.6805555555633 362.59527295942837 M 395.6805555555633 362.59527295942837 M 395.6805555555633 356.59527295942837 L 395.6805555555633 350.59527295942837 M 395.6805555555633 350.59527295942837 M 395.6805555555633 344.59527295942837 L 395.6805555555633 338.59527295942837 M 395.6805555555633 338.59527295942837 M 395.6805555555633 332.59527295942837 L 395.6805555555633 326.59527295942837 M 395.6805555555633 326.59527295942837 M 395.6805555555633 320.59527295942837 L 395.6805555555633 314.59527295942837 M 395.6805555555633 314.59527295942837 M 395.6454730957975 308.5959974887863 Q 395.42473204507803 305.08992137071624 393.81507437340014 302.97276187360467 M 393.81507437340014 302.97276187360467 M 388.7448234749301 300.0250475217899 Q 387.3524512811001 299.74552399008303 385.6805555555633 299.74552399008303 L 382.7625569263178 299.74552399008303 M 382.7625569263178 299.74552399008303 M 376.7625569263178 299.74552399008303 L 370.7625569263178 299.74552399008303 M 370.7625569263178 299.74552399008303 M 364.7625569263178 299.74552399008303 L 358.7625569263178 299.74552399008303 M 358.7625569263178 299.74552399008303 M 352.7625569263178 299.74552399008303 L 346.7625569263178 299.74552399008303 M 346.7625569263178 299.74552399008303 M 340.7625569263178 299.74552399008303 L 334.7625569263178 299.74552399008303 M 334.7625569263178 299.74552399008303 M 328.7625569263178 299.74552399008303 L 322.7625569263178 299.74552399008303 M 322.7625569263178 299.74552399008303 M 316.7625569263178 299.74552399008303 L 310.7625569263178 299.74552399008303 M 310.7625569263178 299.74552399008303 M 304.7625569263178 299.74552399008303 L 300.90277777777806 299.74552399008303 Q 299.7712873305603 299.74552399008303 298.7678239465571 299.6174969268685 M 298.7678239465571 299.6174969268685 M 293.3857693473039 297.228457504614 Q 291.4531834876415 295.28265607285664 291.0247864262038 291.83266584287463 M 291.0247864262038 291.83266584287463 M 290.90277777777806 285.8375555400254 L 290.90277777777806 279.8375555400254 M 290.90277777777806 279.8375555400254 M 290.90277777777806 273.8375555400254 L 290.90277777777806 267.8375555400254 M 290.90277777777806 267.8375555400254 M 290.90277777777806 261.8375555400254 L 290.90277777777806 255.8375555400254 M 290.90277777777806 255.8375555400254 M 290.90277777777806 249.8375555400254 L 290.90277777777806 249.81491457745426" stroke-miterlimit="10" stroke-width="6"/></g></g></g></g><g transform="matrix(1,0,0,1,284.40277777777794,125.75909597261261)"><g transform="translate(0,0)"><g transform="translate(-520.5887419871792,-284.3176338453479) translate(236.18596420940128,158.55853787273531) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#cc0000" d="M 399.0972222222224 132.2590959726126 M 399.0972222222224 132.2590959726126 L 399.0972222222224 138.2590959726126 M 399.0972222222224 138.2590959726126 M 399.0972222222224 144.2590959726126 L 399.0972222222224 150.2590959726126 M 399.0972222222224 150.2590959726126 M 399.0972222222224 156.2590959726126 L 399.0972222222224 162.2590959726126 M 399.0972222222224 162.2590959726126 M 399.0972222222224 168.2590959726126 L 399.0972222222224 174.2590959726126 M 399.0972222222224 174.2590959726126 M 399.0972222222224 180.2590959726126 L 399.0972222222224 186.2590959726126 M 399.0972222222224 186.2590959726126 M 399.0972222222224 192.2590959726126 L 399.0972222222224 192.67013315779485 Q 399.0972222222224 195.91836389834842 398.0421219278347 198.11149434451426 M 398.0421219278347 198.11149434451426 M 393.6659405128273 201.97829744802294 Q 391.72749922241087 202.67013315779496 389.0972222222224 202.67013315779502 L 387.7405118088071 202.67013315779505 M 387.7405118088071 202.67013315779505 M 381.7405118088071 202.67013315779514 L 375.7405118088071 202.67013315779522 M 375.7405118088071 202.67013315779522 M 369.7405118088071 202.6701331577953 L 363.7405118088071 202.6701331577954 M 363.7405118088071 202.6701331577954 M 357.7405118088071 202.67013315779548 L 351.7405118088071 202.67013315779556 M 351.7405118088071 202.67013315779556 M 345.7405118088071 202.67013315779565 L 339.7405118088071 202.67013315779573 M 339.7405118088071 202.67013315779573 M 333.7405118088071 202.67013315779585 L 327.7405118088071 202.67013315779593 M 327.7405118088071 202.67013315779593 M 321.7405118088071 202.67013315779604 L 315.7405118088071 202.67013315779613 M 315.7405118088071 202.67013315779613 M 309.7405118088071 202.67013315779624 L 303.7405118088071 202.67013315779633 M 303.7405118088071 202.67013315779633 M 297.7598678856485 202.9657135423712 Q 294.4328042761472 203.65647640532174 292.72003362291935 205.9615322245457 M 292.72003362291935 205.9615322245457 M 290.93300792210687 211.60072437358687 Q 290.90277777777794 212.12031369352724 290.90277777777794 212.67013315779656 L 290.90277777777794 217.600146725365 M 290.90277777777794 217.600146725365 M 290.90277777777794 223.600146725365 L 290.90277777777794 229.600146725365 M 290.90277777777794 229.600146725365 M 290.90277777777794 235.600146725365 L 290.90277777777794 241.600146725365 M 290.90277777777794 241.600146725365 M 290.90277777777794 247.600146725365 L 290.90277777777794 251.03945435457118" stroke-miterlimit="10" stroke-width="6"/></g></g></g></g><g transform="matrix(1,0,0,1,155.81944444443684,107.17033542596326)"><g transform="translate(0,0)"><g transform="translate(-453.3739983974361,-305.60207610719107) translate(297.55455395299924,198.4317406812278) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#38761d" d="M 162.31944444443684 113.67033542596326 M 162.31944444443684 113.67033542596326 L 162.31944444443684 119.67033542596326 M 162.31944444443684 119.67033542596326 M 162.31944444443684 125.67033542596326 L 162.31944444443684 131.67033542596326 M 162.31944444443684 131.67033542596326 M 162.31944444443684 137.67033542596326 L 162.31944444443684 143.67033542596326 M 162.31944444443684 143.67033542596326 M 162.31944444443684 149.67033542596326 L 162.31944444443684 155.67033542596326 M 162.31944444443684 155.67033542596326 M 162.31944444443684 161.67033542596326 L 162.31944444443684 167.67033542596326 M 162.31944444443684 167.67033542596326 M 162.31944444443684 173.67033542596326 L 162.31944444443684 179.67033542596326 M 162.31944444443684 179.67033542596326 M 162.31944444443684 185.67033542596326 L 162.31944444443684 189.5415587499461 Q 162.31944444443684 190.66665091919444 162.44602768336722 191.66515984951238 M 162.44602768336722 191.66515984951238 M 164.82839767826374 197.05049598033753 Q 166.77191548654997 198.987072120429 170.22094619965992 199.41813535569676 M 170.22094619965992 199.41813535569676 M 176.2159687190514 199.5415587499461 L 182.2159687190514 199.5415587499461 M 182.2159687190514 199.5415587499461 M 188.2159687190514 199.5415587499461 L 194.2159687190514 199.5415587499461 M 194.2159687190514 199.5415587499461 M 200.2159687190514 199.5415587499461 L 206.2159687190514 199.5415587499461 M 206.2159687190514 199.5415587499461 M 212.2159687190514 199.5415587499461 L 218.2159687190514 199.5415587499461 M 218.2159687190514 199.5415587499461 M 224.2159687190514 199.5415587499461 L 230.2159687190514 199.5415587499461 M 230.2159687190514 199.5415587499461 M 236.2159687190514 199.5415587499461 L 242.2159687190514 199.5415587499461 M 242.2159687190514 199.5415587499461 M 248.2159687190514 199.5415587499461 L 254.2159687190514 199.5415587499461 M 254.2159687190514 199.5415587499461 M 260.1975055563821 199.82836878769723 Q 263.5309416038837 200.5080005580397 265.2539063203237 202.79810365944377 M 265.2539063203237 202.79810365944377 M 267.0644085030223 208.4287072615088 Q 267.09722222222206 208.96872614612755 267.09722222222206 209.5415587499461 L 267.09722222222206 214.4280528453731 M 267.09722222222206 214.4280528453731 M 267.09722222222206 220.4280528453731 L 267.09722222222206 226.4280528453731 M 267.09722222222206 226.4280528453731 M 267.09722222222206 232.4280528453731 L 267.09722222222206 235.81551770804643" stroke-miterlimit="10" stroke-width="6"/></g></g></g></g><g transform="matrix(1,0,0,1,152.4027777777773,228.0562890247442)"><g transform="translate(0,0)"><g transform="translate(-37.41125801282108,-200.3354013688455) translate(-114.99151976495621,-27.72088765589868) matrix(1,0,0,1,0,0)"><g><path fill="none" stroke="#38761d" d="M 158.9027777777773 356.7014713068111 M 158.9027777777773 356.7014713068111 L 158.9027777777773 350.7014713068111 M 158.9027777777773 350.7014713068111 M 158.9027777777773 344.7014713068111 L 158.9027777777773 338.7014713068111 M 158.9027777777773 338.7014713068111 M 158.9027777777773 332.7014713068111 L 158.9027777777773 326.7014713068111 M 158.9027777777773 326.7014713068111 M 158.9027777777773 320.7014713068111 L 158.90277777777732 314.7014713068111 M 158.90277777777732 314.7014713068111 M 158.9386276948351 308.7022201112491 Q 159.16189382506047 305.19660315095655 160.77561686556083 303.081443100939 M 160.77561686556083 303.081443100939 M 165.85041734767782 300.14100539293156 Q 167.23802796592435 299.86386619932506 168.90277777777732 299.863866199325 L 171.83292026888248 299.8638661993249 M 171.83292026888248 299.8638661993249 M 177.83292026888248 299.86386619932466 L 183.83292026888248 299.86386619932443 M 183.83292026888248 299.86386619932443 M 189.83292026888248 299.8638661993242 L 195.83292026888248 299.863866199324 M 195.83292026888248 299.863866199324 M 201.83292026888248 299.86386619932375 L 207.83292026888248 299.8638661993235 M 207.83292026888248 299.8638661993235 M 213.83292026888248 299.8638661993233 L 219.83292026888248 299.86386619932307 M 219.83292026888248 299.86386619932307 M 225.83292026888248 299.86386619932284 L 231.83292026888248 299.8638661993226 M 231.83292026888248 299.8638661993226 M 237.83292026888248 299.8638661993224 L 243.83292026888248 299.86386619932216 M 243.83292026888248 299.86386619932216 M 249.83292026888248 299.86386619932193 L 255.83292026888248 299.86386619932176 M 255.83292026888248 299.86386619932176 M 261.7528202251644 299.1405476054279 Q 264.7675844859315 298.0314529459795 266.0817275073145 295.22173704714703 M 266.0817275073145 295.22173704714703 M 267.0972222222195 289.3604205540609 L 267.0972222222195 283.3604205540609 M 267.0972222222195 283.3604205540609 M 267.0972222222195 277.3604205540609 L 267.0972222222195 271.3604205540609 M 267.0972222222195 271.3604205540609 M 267.0972222222195 265.3604205540609 L 267.0972222222195 259.3604205540609 M 267.0972222222195 259.3604205540609 M 267.0972222222195 253.3604205540609 L 267.0972222222195 247.3604205540609 M 267.0972222222195 247.3604205540609 M 267.0972222222195 241.3604205540609 L 267.0972222222195 235.3604205540609 M 267.0972222222195 235.3604205540609" stroke-miterlimit="10" stroke-width="6"/></g></g></g></g><g transform="translate(0,0) matrix(1,0,0,1,193.51767083236396,40.461511948529306)"><g><g transform="translate(0,0) scale(1.7520258247164675,1.25824690354917) translate(0.00001348378,-0.001498589)"><g><g><path fill="#FFFFFF" stroke="#ff9900" d="M 33.84 5.912 C 16.263 2.403 6.986 11.405 8.451 19.186 L 8.57 19.61 C -5.128 21.942 -1.537 38.106 5.033 38.106 L 5.679 38.085 C 4.026 45.68 20.032 53.41 28.958 49.548 L 29.531 48.92 C 32.713 55.752 44.02 56.893 55.201 57.177 C 64.89 57.425 70.546 56.658 74.702 52.411 L 75.341 52.599 C 90.852 53.845 97.915 43.133 94.526 35.442 L 95.36 35.207 C 100.648 33.808 101.258 21.602 92.187 19.797 L 92.361 19.325 C 96.299 11.385 87.011 3.896 74.124 5.303 L 73.23 4.837 C 64.003 -3.517 37.449 -2.157 34.373 6.108 L 33.84 5.912 Z" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g></g><g transform="matrix(1,0,0,1,213,55)"><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="137" height="56" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="137" height="14" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="18" y="0" width="51" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="18" y="12">Gateway</text></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="69" y="0" width="51" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="69" y="12">10</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="82" y="12">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="86" y="12">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="92" y="12">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="96" y="12">20</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="109" y="12">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="112" y="12">1</text></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="137" height="28" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="2" y="14" width="4" height="14" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="5" y="14" width="58" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="9" y="26">and</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="32" y="26">other</text></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="63" y="14" width="129" height="28" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="63" y="26">containers</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="122" y="26">on</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="7" y="40">the</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="27" y="40">same</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="59" y="40">VLAN</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="91" y="40">/</text></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="94" y="28" width="37" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="94" y="40">subnet</text></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="42" width="137" height="14" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="67" y="42" width="5" height="14" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g/></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,345.9019607843137,48.00000000000003)"><g><g transform="translate(0,0) scale(0.3709803921568625,0.18000000000000005)"><g><path fill="#4cacf5" stroke="none" d="M 0 0 L 100 0 Q 100 0 100 0 L 100 100 Q 100 100 100 100 L 0 100 Q 0 100 0 100 L 0 0 Q 0 0 0 0 Z"/><g transform="scale(2.6955602536997905,5.5555555555555545)"><path fill="none" stroke="none" d="M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z"/><path fill="none" stroke="#666666" d="M 0 0 M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z" stroke-miterlimit="10"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,341.48549019607844,44.15384615384616)"><g><g transform="translate(0,0) scale(0.3709803921568625,0.18000000000000005)"><g><path fill="#4cacf5" stroke="none" d="M 0 0 L 100 0 Q 100 0 100 0 L 100 100 Q 100 100 100 100 L 0 100 Q 0 100 0 100 L 0 0 Q 0 0 0 0 Z"/><g transform="scale(2.6955602536997905,5.5555555555555545)"><path fill="none" stroke="none" d="M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z"/><path fill="none" stroke="#666666" d="M 0 0 M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z" stroke-miterlimit="10"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,336,39.00000000000003)"><g><g transform="translate(0,0) scale(0.3709803921568625,0.18000000000000005)"><g><path fill="#4cacf5" stroke="none" d="M 0 0 L 100 0 Q 100 0 100 0 L 100 100 Q 100 100 100 100 L 0 100 Q 0 100 0 100 L 0 0 Q 0 0 0 0 Z"/><g transform="scale(2.6955602536997905,5.5555555555555545)"><path fill="none" stroke="none" d="M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z"/><path fill="none" stroke="#666666" d="M 0 0 M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z" stroke-miterlimit="10"/></g></g></g></g></g><g transform="translate(0,0) matrix(1,0,0,1,57.51767083236396,94.4615119485293)"><g><g transform="translate(0,0) scale(1.7520258247164675,1.25824690354917) translate(0.00001348378,-0.001498589)"><g><g><path fill="#FFFFFF" stroke="#38761d" d="M 33.84 5.912 C 16.263 2.403 6.986 11.405 8.451 19.186 L 8.57 19.61 C -5.128 21.942 -1.537 38.106 5.033 38.106 L 5.679 38.085 C 4.026 45.68 20.032 53.41 28.958 49.548 L 29.531 48.92 C 32.713 55.752 44.02 56.893 55.201 57.177 C 64.89 57.425 70.546 56.658 74.702 52.411 L 75.341 52.599 C 90.852 53.845 97.915 43.133 94.526 35.442 L 95.36 35.207 C 100.648 33.808 101.258 21.602 92.187 19.797 L 92.361 19.325 C 96.299 11.385 87.011 3.896 74.124 5.303 L 73.23 4.837 C 64.003 -3.517 37.449 -2.157 34.373 6.108 L 33.84 5.912 Z" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g></g><g transform="matrix(1,0,0,1,77,109)"><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="137" height="56" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="137" height="14" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="18" y="0" width="51" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="18" y="12">Gateway</text></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="69" y="0" width="51" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="69" y="12">10</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="82" y="12">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="86" y="12">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="92" y="12">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="96" y="12">10</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="109" y="12">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="112" y="12">1</text></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="137" height="28" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="2" y="14" width="4" height="14" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="5" y="14" width="58" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="9" y="26">and</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="32" y="26">other</text></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="63" y="14" width="129" height="28" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="63" y="26">containers</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="122" y="26">on</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="7" y="40">the</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="27" y="40">same</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="59" y="40">VLAN</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="91" y="40">/</text></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="94" y="28" width="37" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="94" y="40">subnet</text></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="42" width="137" height="14" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="67" y="42" width="5" height="14" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g/></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,98.9019607843137,163.00000000000003)"><g><g transform="translate(0,0) scale(0.3709803921568625,0.18000000000000005)"><g><path fill="#4cacf5" stroke="none" d="M 0 0 L 100 0 Q 100 0 100 0 L 100 100 Q 100 100 100 100 L 0 100 Q 0 100 0 100 L 0 0 Q 0 0 0 0 Z"/><g transform="scale(2.6955602536997905,5.5555555555555545)"><path fill="none" stroke="none" d="M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z"/><path fill="none" stroke="#666666" d="M 0 0 M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z" stroke-miterlimit="10"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,94.48549019607844,159.15384615384616)"><g><g transform="translate(0,0) scale(0.3709803921568625,0.18000000000000005)"><g><path fill="#4cacf5" stroke="none" d="M 0 0 L 100 0 Q 100 0 100 0 L 100 100 Q 100 100 100 100 L 0 100 Q 0 100 0 100 L 0 0 Q 0 0 0 0 Z"/><g transform="scale(2.6955602536997905,5.5555555555555545)"><path fill="none" stroke="none" d="M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z"/><path fill="none" stroke="#666666" d="M 0 0 M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z" stroke-miterlimit="10"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,89,154.00000000000003)"><g><g transform="translate(0,0) scale(0.3709803921568625,0.18000000000000005)"><g><path fill="#4cacf5" stroke="none" d="M 0 0 L 100 0 Q 100 0 100 0 L 100 100 Q 100 100 100 100 L 0 100 Q 0 100 0 100 L 0 0 Q 0 0 0 0 Z"/><g transform="scale(2.6955602536997905,5.5555555555555545)"><path fill="none" stroke="none" d="M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z"/><path fill="none" stroke="#666666" d="M 0 0 M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z" stroke-miterlimit="10"/></g></g></g></g></g><g transform="translate(0,0) matrix(1,0,0,1,345.51767083236393,86.4615119485293)"><g><g transform="translate(0,0) scale(1.7520258247164675,1.25824690354917) translate(0.00001348378,-0.001498589)"><g><g><path fill="#FFFFFF" stroke="#cc0000" d="M 33.84 5.912 C 16.263 2.403 6.986 11.405 8.451 19.186 L 8.57 19.61 C -5.128 21.942 -1.537 38.106 5.033 38.106 L 5.679 38.085 C 4.026 45.68 20.032 53.41 28.958 49.548 L 29.531 48.92 C 32.713 55.752 44.02 56.893 55.201 57.177 C 64.89 57.425 70.546 56.658 74.702 52.411 L 75.341 52.599 C 90.852 53.845 97.915 43.133 94.526 35.442 L 95.36 35.207 C 100.648 33.808 101.258 21.602 92.187 19.797 L 92.361 19.325 C 96.299 11.385 87.011 3.896 74.124 5.303 L 73.23 4.837 C 64.003 -3.517 37.449 -2.157 34.373 6.108 L 33.84 5.912 Z" stroke-miterlimit="10" stroke-width="2"/></g></g></g></g></g><g transform="matrix(1,0,0,1,365,101)"><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="137" height="56" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="137" height="14" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="18" y="0" width="51" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="18" y="12">Gateway</text></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="69" y="0" width="51" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="69" y="12">10</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="82" y="12">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="86" y="12">1</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="92" y="12">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="96" y="12">30</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="109" y="12">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="bold" text-decoration="" line-height="14px" x="112" y="12">1</text></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="14" width="137" height="28" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="2" y="14" width="4" height="14" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="5" y="14" width="58" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="9" y="26">and</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="32" y="26">other</text></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="63" y="14" width="129" height="28" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="63" y="26">containers</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="122" y="26">on</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="7" y="40">the</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="27" y="40">same</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="59" y="40">VLAN</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="91" y="40">/</text></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="94" y="28" width="37" height="14" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="12px" font-style="normal" font-weight="normal" text-decoration="" line-height="14px" x="94" y="40">subnet</text></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="42" width="137" height="14" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g><rect fill="rgb(0,0,0)" stroke="none" x="67" y="42" width="5" height="14" fill-opacity="0"/></g></g><g transform="translate(318,224) matrix(1,0,0,1,0,0) translate(-318,-224)"><g/></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,451.9019607843137,158.00000000000003)"><g><g transform="translate(0,0) scale(0.3709803921568625,0.18000000000000005)"><g><path fill="#4cacf5" stroke="none" d="M 0 0 L 100 0 Q 100 0 100 0 L 100 100 Q 100 100 100 100 L 0 100 Q 0 100 0 100 L 0 0 Q 0 0 0 0 Z"/><g transform="scale(2.6955602536997905,5.5555555555555545)"><path fill="none" stroke="none" d="M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z"/><path fill="none" stroke="#666666" d="M 0 0 M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z" stroke-miterlimit="10"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,447.48549019607844,154.15384615384616)"><g><g transform="translate(0,0) scale(0.3709803921568625,0.18000000000000005)"><g><path fill="#4cacf5" stroke="none" d="M 0 0 L 100 0 Q 100 0 100 0 L 100 100 Q 100 100 100 100 L 0 100 Q 0 100 0 100 L 0 0 Q 0 0 0 0 Z"/><g transform="scale(2.6955602536997905,5.5555555555555545)"><path fill="none" stroke="none" d="M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z"/><path fill="none" stroke="#666666" d="M 0 0 M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z" stroke-miterlimit="10"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,442,149.00000000000003)"><g><g transform="translate(0,0) scale(0.3709803921568625,0.18000000000000005)"><g><path fill="#4cacf5" stroke="none" d="M 0 0 L 100 0 Q 100 0 100 0 L 100 100 Q 100 100 100 100 L 0 100 Q 0 100 0 100 L 0 0 Q 0 0 0 0 Z"/><g transform="scale(2.6955602536997905,5.5555555555555545)"><path fill="none" stroke="none" d="M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z"/><path fill="none" stroke="#666666" d="M 0 0 M 0 0 L 37.09803921568625 0 Q 37.09803921568625 0 37.09803921568625 0 L 37.09803921568625 18.000000000000004 Q 37.09803921568625 18.000000000000004 37.09803921568625 18.000000000000004 L 0 18.000000000000004 Q 0 18.000000000000004 0 18.000000000000004 L 0 0 Q 0 0 0 0 Z" stroke-miterlimit="10"/></g></g></g></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,47,331)"><g transform="translate(4,4) scale(1.0034722222222223,1.0083333333333333)"><g><g transform="translate(0,0) scale(1.44,0.6)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.6944444444444444,1.6666666666666667)"><path fill="#000000" stroke="none" d="M 10 0 L 134 0 Q 144 0 144 10 L 144 50 Q 144 60 134 60 L 10 60 Q 0 60 0 50 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 134 0 Q 144 0 144 10 L 144 50 Q 144 60 134 60 L 10 60 Q 0 60 0 50 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.44,0.6)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.6944444444444444,1.6666666666666667)"><path fill="#5fcc5a" stroke="none" d="M 10 0 L 134 0 Q 144 0 144 10 L 144 50 Q 144 60 134 60 L 10 60 Q 0 60 0 50 L 0 10 Q 0 0 10 0 Z" opacity="0.99"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 134 0 Q 144 0 144 10 L 144 50 Q 144 60 134 60 L 10 60 Q 0 60 0 50 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.99"/></g></g></g></g></g><g transform="matrix(1,0,0,1,50,342)"><g transform="translate(373,100) matrix(1,0,0,1,0,0) translate(-373,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="135" height="40" fill-opacity="0"/></g></g><g transform="translate(373,100) matrix(1,0,0,1,0,0) translate(-373,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="135" height="20" fill-opacity="0"/></g></g><g transform="translate(373,100) matrix(1,0,0,1,0,0) translate(-373,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="5" y="0" width="127" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="58" y="17">:</text></g><g transform="translate(373,100) matrix(1,0,0,1,0,0) translate(-373,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="5" y="0" width="54" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="5" y="17">Parent</text></g><g transform="translate(373,100) matrix(1,0,0,1,0,0) translate(-373,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="68" y="0" width="63" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="bold" text-decoration="" line-height="20.5px" x="68" y="17">eth0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="bold" text-decoration="" line-height="20.5px" x="105" y="17">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="bold" text-decoration="" line-height="20.5px" x="110" y="17">10</text></g><g transform="translate(373,100) matrix(1,0,0,1,0,0) translate(-373,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="20" width="135" height="20" fill-opacity="0"/></g></g><g transform="translate(373,100) matrix(1,0,0,1,0,0) translate(-373,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="17" y="20" width="71" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="17" y="37">VLAN</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="69" y="37">ID</text></g><g transform="translate(373,100) matrix(1,0,0,1,0,0) translate(-373,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="87" y="20" width="6" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="87" y="37">:</text></g><g transform="translate(373,100) matrix(1,0,0,1,0,0) translate(-373,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="93" y="20" width="26" height="20" fill-opacity="0"/></g></g><g transform="translate(373,100) matrix(1,0,0,1,0,0) translate(-373,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="98" y="20" width="21" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="bold" text-decoration="" line-height="20.5px" x="98" y="37">10</text></g></g><g transform="translate(0.5,0.5) matrix(1,0,0,1,367,331)"><g transform="translate(4,4) scale(1.0034722222222223,1.0083333333333333)"><g><g transform="translate(0,0) scale(1.44,0.6)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.6944444444444444,1.6666666666666667)"><path fill="#000000" stroke="none" d="M 10 0 L 134 0 Q 144 0 144 10 L 144 50 Q 144 60 134 60 L 10 60 Q 0 60 0 50 L 0 10 Q 0 0 10 0 Z" opacity="0.294117647"/><path fill="none" stroke="rgb(0,0,0)" d="M 10 0 M 10 0 L 134 0 Q 144 0 144 10 L 144 50 Q 144 60 134 60 L 10 60 Q 0 60 0 50 L 0 10 Q 0 0 10 0 Z" stroke-opacity="0" stroke-miterlimit="10" opacity="0.294117647"/></g></g></g></g></g><g><g transform="translate(0,0) scale(1.44,0.6)"><g><path fill="none" stroke="none" d="M 10 0 L 90 0 Q 100 0 100 10 L 100 90 Q 100 100 90 100 L 10 100 Q 0 100 0 90 L 0 10 Q 0 0 10 0 Z"/><g transform="scale(0.6944444444444444,1.6666666666666667)"><path fill="#eb6c6c" stroke="none" d="M 10 0 L 134 0 Q 144 0 144 10 L 144 50 Q 144 60 134 60 L 10 60 Q 0 60 0 50 L 0 10 Q 0 0 10 0 Z" opacity="0.99"/><path fill="none" stroke="#434343" d="M 10 0 M 10 0 L 134 0 Q 144 0 144 10 L 144 50 Q 144 60 134 60 L 10 60 Q 0 60 0 50 L 0 10 Q 0 0 10 0 Z" stroke-miterlimit="10" opacity="0.99"/></g></g></g></g></g><g transform="matrix(1,0,0,1,369,341)"><g transform="translate(194,100) matrix(1,0,0,1,0,0) translate(-194,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="138" height="40" fill-opacity="0"/></g></g><g transform="translate(194,100) matrix(1,0,0,1,0,0) translate(-194,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="138" height="20" fill-opacity="0"/></g></g><g transform="translate(194,100) matrix(1,0,0,1,0,0) translate(-194,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="4" y="0" width="132" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="9" y="17">Parent</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="62" y="17">:</text></g><g transform="translate(194,100) matrix(1,0,0,1,0,0) translate(-194,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="72" y="0" width="63" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="bold" text-decoration="" line-height="20.5px" x="72" y="17">eth0</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="bold" text-decoration="" line-height="20.5px" x="109" y="17">.</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="bold" text-decoration="" line-height="20.5px" x="114" y="17">30</text></g><g transform="translate(194,100) matrix(1,0,0,1,0,0) translate(-194,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="20" width="138" height="20" fill-opacity="0"/></g></g><g transform="translate(194,100) matrix(1,0,0,1,0,0) translate(-194,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="30" y="20" width="78" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="30" y="37">VLAN</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="normal" text-decoration="" line-height="20.5px" x="77" y="37">:</text></g><g transform="translate(194,100) matrix(1,0,0,1,0,0) translate(-194,-100)"><g><rect fill="rgb(0,0,0)" stroke="none" x="88" y="20" width="21" height="20" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="18px" font-style="normal" font-weight="bold" text-decoration="" line-height="20.5px" x="88" y="37">30</text></g><g transform="translate(194,100) matrix(1,0,0,1,0,0) translate(-194,-100)"><g/></g></g><g transform="matrix(1,0,0,1,371,44)"><g transform="translate(266,48) matrix(1,0,0,1,0,0) translate(-266,-48)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="142" height="32" fill-opacity="0"/></g></g><g transform="translate(266,48) matrix(1,0,0,1,0,0) translate(-266,-48)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="0" width="142" height="16" fill-opacity="0"/></g></g><g transform="translate(266,48) matrix(1,0,0,1,0,0) translate(-266,-48)"><g><rect fill="rgb(0,0,0)" stroke="none" x="17" y="0" width="75" height="16" fill-opacity="0"/></g></g><g transform="translate(266,48) matrix(1,0,0,1,0,0) translate(-266,-48)"><g><rect fill="rgb(0,0,0)" stroke="none" x="17" y="0" width="75" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="17" y="14">Network</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="72" y="14"> &amp;&#160;</text></g><g transform="translate(266,48) matrix(1,0,0,1,0,0) translate(-266,-48)"><g><rect fill="rgb(0,0,0)" stroke="none" x="90" y="0" width="36" height="16" fill-opacity="0"/></g></g><g transform="translate(266,48) matrix(1,0,0,1,0,0) translate(-266,-48)"><g><rect fill="rgb(0,0,0)" stroke="none" x="90" y="0" width="36" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="90" y="14">other</text></g><g transform="translate(266,48) matrix(1,0,0,1,0,0) translate(-266,-48)"><g><rect fill="rgb(0,0,0)" stroke="none" x="0" y="16" width="142" height="16" fill-opacity="0"/></g></g><g transform="translate(266,48) matrix(1,0,0,1,0,0) translate(-266,-48)"><g><rect fill="rgb(0,0,0)" stroke="none" x="26" y="16" width="92" height="16" fill-opacity="0"/></g></g><g transform="translate(266,48) matrix(1,0,0,1,0,0) translate(-266,-48)"><g><rect fill="rgb(0,0,0)" stroke="none" x="26" y="16" width="92" height="16" fill-opacity="0"/></g><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="26" y="30">Docker</text><text fill="rgb(0, 0, 0)" stroke="none" font-family="Arial" font-size="14px" font-style="normal" font-weight="bold" text-decoration="" line-height="16.5px" x="77" y="30">Hosts</text></g></g></g></svg>
\ No newline at end of file
diff --git a/components/engine/experimental/vlan-networks.md b/components/engine/experimental/vlan-networks.md
deleted file mode 100644
index 13eb5981d1..0000000000
--- a/components/engine/experimental/vlan-networks.md
+++ /dev/null
@@ -1,475 +0,0 @@
-# Ipvlan Network Driver
-
-### Getting Started
-
-The Ipvlan driver is currently in experimental mode in order to incubate Docker users use cases and vet the implementation to ensure a hardened, production ready driver in a future release. Libnetwork now gives users total control over both IPv4 and IPv6 addressing. The VLAN driver builds on top of that in giving operators complete control of layer 2 VLAN tagging and even Ipvlan L3 routing for users interested in underlay network integration. For overlay deployments that abstract away physical constraints see the [multi-host overlay ](https://docs.docker.com/engine/userguide/networking/get-started-overlay/) driver.
-
-Ipvlan is a new twist on the tried and true network virtualization technique. The Linux implementations are extremely lightweight because rather than using the traditional Linux bridge for isolation, they are simply associated to a Linux Ethernet interface or sub-interface to enforce separation between networks and connectivity to the physical network.
-
-Ipvlan offers a number of unique features and plenty of room for further innovations with the various modes. Two high level advantages of these approaches are, the positive performance implications of bypassing the Linux bridge and the simplicity of having fewer moving parts. Removing the bridge that traditionally resides in between the Docker host NIC and container interface leaves a simple setup consisting of container interfaces, attached directly to the Docker host interface. This result is easy access for external facing services as there is no need for port mappings in these scenarios.
-
-### Pre-Requisites
-
-- The examples on this page are all single host and setup using Docker experimental builds that can be installed with the following instructions: [Install Docker experimental](https://github.com/docker/docker/tree/master/experimental)
-
-- All of the examples can be performed on a single host running Docker. Any examples using a sub-interface like `eth0.10` can be replaced with `eth0` or any other valid parent interface on the Docker host. Sub-interfaces with a `.` are created on the fly. `-o parent` interfaces can also be left out of the `docker network create` all together and the driver will create a `dummy` interface that will enable local host connectivity to perform the examples.
-
-- Kernel requirements:
- 
- - To check your current kernel version, use `uname -r` to display your kernel version
- - Ipvlan Linux kernel v4.2+ (support for earlier kernels exists but is buggy)
-
-### Ipvlan L2 Mode Example Usage
-
-An example of the ipvlan `L2` mode topology is shown in the following image. The driver is specified with `-d driver_name` option. In this case `-d ipvlan`.
-
-![Simple Ipvlan L2 Mode Example](images/ipvlan_l2_simple.png)
-
-The parent interface in the next example `-o parent=eth0` is configured as followed:
-
-```
-$ ip addr show eth0
-3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
-    inet 192.168.1.250/24 brd 192.168.1.255 scope global eth0
-```
-
-Use the network from the host's interface as the `--subnet` in the `docker network create`. The container will be attached to the same network as the host interface as set via the `-o parent=` option.
-
-Create the ipvlan network and run a container attaching to it:
-
-```
-# Ipvlan  (-o ipvlan_mode= Defaults to L2 mode if not specified)
-$ docker network  create -d ipvlan \
-    --subnet=192.168.1.0/24 \ 
-    --gateway=192.168.1.1 \
-    -o ipvlan_mode=l2 \
-    -o parent=eth0 db_net
-
-# Start a container on the db_net network
-$ docker  run --net=db_net -it --rm alpine /bin/sh
-
-# NOTE: the containers can NOT ping the underlying host interfaces as
-# they are intentionally filtered by Linux for additional isolation.
-```
-
-The default mode for Ipvlan is `l2`. If `-o ipvlan_mode=` are left unspecified, the default mode will be used. Similarly, if the `--gateway` is left empty, the first usable address on the network will be set as the gateway. For example, if the subnet provided in the network create is `--subnet=192.168.1.0/24` then the gateway the container receives is `192.168.1.1`.
-
-To help understand how this mode interacts with other hosts, the following figure shows the same layer 2 segment between two Docker hosts that applies to and Ipvlan L2 mode.
-
-![Multiple Ipvlan Hosts](images/macvlan-bridge-ipvlan-l2.png)
-
-The following will create the exact same network as the network `db_net` created prior, with the driver defaults for `--gateway=192.168.1.1` and `-o ipvlan_mode=l2`.
-
-```
-# Ipvlan  (-o ipvlan_mode= Defaults to L2 mode if not specified)
-$ docker network  create -d ipvlan \
-    --subnet=192.168.1.0/24 \ 
-    -o parent=eth0 db_net_ipv
-
-# Start a container with an explicit name in daemon mode
-$ docker  run --net=db_net_ipv --name=ipv1 -itd alpine /bin/sh
-
-# Start a second container and ping using the container name
-# to see the docker included name resolution functionality
-$ docker  run --net=db_net_ipv --name=ipv2 -it --rm alpine /bin/sh
-$ ping -c 4 ipv1
-
-# NOTE: the containers can NOT ping the underlying host interfaces as
-# they are intentionally filtered by Linux for additional isolation.
-```
-
-The drivers also support the `--internal` flag that will completely isolate containers on a network from any communications external to that network. Since network isolation is tightly coupled to the network's parent interface the result of leaving the `-o parent=` option off of a `docker network create` is the exact same as the `--internal` option. If the parent interface is not specified or the `--internal` flag is used, a netlink type `dummy` parent interface is created for the user and used as the parent interface effectively isolating the network completely.
-
-The following two `docker network create` examples result in identical networks that you can attach container to:
-
-```
-# Empty '-o parent=' creates an isolated network
-$ docker network  create -d ipvlan \
-    --subnet=192.168.10.0/24 isolated1
-
-# Explicit '--internal' flag is the same:
-$ docker network  create -d ipvlan \
-    --subnet=192.168.11.0/24 --internal isolated2
-
-# Even the '--subnet=' can be left empty and the default 
-# IPAM subnet of 172.18.0.0/16 will be assigned
-$ docker network  create -d ipvlan isolated3
-
-$ docker run --net=isolated1 --name=cid1 -it --rm alpine /bin/sh
-$ docker run --net=isolated2 --name=cid2 -it --rm alpine /bin/sh
-$ docker run --net=isolated3 --name=cid3 -it --rm alpine /bin/sh
-
-# To attach to any use `docker exec` and start a shell
-$ docker exec -it cid1 /bin/sh
-$ docker exec -it cid2 /bin/sh
-$ docker exec -it cid3 /bin/sh
-```
-
-### Ipvlan 802.1q Trunk L2 Mode Example Usage
-
-Architecturally, Ipvlan L2 mode trunking is the same as Macvlan with regard to gateways and L2 path isolation. There are nuances that can be advantageous for CAM table pressure in ToR switches, one MAC per port and MAC exhaustion on a host's parent NIC to name a few. The 802.1q trunk scenario looks the same. Both modes adhere to tagging standards and have seamless integration with the physical network for underlay integration and hardware vendor plugin integrations.
-
-Hosts on the same VLAN are typically on the same subnet and almost always are grouped together based on their security policy. In most scenarios, a multi-tier application is tiered into different subnets because the security profile of each process requires some form of isolation. For example, hosting your credit card processing on the same virtual network as the frontend webserver would be a regulatory compliance issue, along with circumventing the long standing best practice of layered defense in depth architectures. VLANs or the equivocal VNI (Virtual Network Identifier) when using the Overlay driver, are the first step in isolating tenant traffic.
-
-![Docker VLANs in Depth](images/vlans-deeper-look.png)
-
-The Linux sub-interface tagged with a vlan can either already exist or will be created when you call a `docker network create`. `docker network rm` will delete the sub-interface. Parent interfaces such as `eth0` are not deleted, only sub-interfaces with a netlink parent index > 0.
-
-For the driver to add/delete the vlan sub-interfaces the format needs to be `interface_name.vlan_tag`. Other sub-interface naming can be used as the specified parent, but the link will not be deleted automatically when `docker network rm` is invoked. 
-
-The option to use either existing parent vlan sub-interfaces or let Docker manage them enables the user to either completely manage the Linux interfaces and networking or let Docker create and delete the Vlan parent sub-interfaces (netlink `ip link`) with no effort from the user.
-
-For example: use `eth0.10` to denote a sub-interface of `eth0` tagged with the vlan id of `10`. The equivalent `ip link` command would be `ip link add link eth0 name eth0.10 type vlan id 10`.
-
-The example creates the vlan tagged networks and then start two containers to test connectivity between containers. Different Vlans cannot ping one another without a router routing between the two networks. The default namespace is not reachable per ipvlan design in order to isolate container namespaces from the underlying host.
-
-**Vlan ID 20**
-
-In the first network tagged and isolated by the Docker host, `eth0.20` is the parent interface tagged with vlan id `20` specified with `-o parent=eth0.20`. Other naming formats can be used, but the links need to be added and deleted manually using `ip link` or Linux configuration files. As long as the `-o parent` exists anything can be used if compliant with Linux netlink.
-
-```
-# now add networks and hosts as you would normally by attaching to the master (sub)interface that is tagged
-$ docker network  create  -d ipvlan \
-    --subnet=192.168.20.0/24 \
-    --gateway=192.168.20.1 \
-    -o parent=eth0.20 ipvlan20
-
-# in two separate terminals, start a Docker container and the containers can now ping one another.
-$ docker run --net=ipvlan20 -it --name ivlan_test1 --rm alpine /bin/sh
-$ docker run --net=ipvlan20 -it --name ivlan_test2 --rm alpine /bin/sh
-```
-
-**Vlan ID 30**
-
-In the second network, tagged and isolated by the Docker host, `eth0.30` is the parent interface tagged with vlan id `30` specified with `-o parent=eth0.30`. The `ipvlan_mode=` defaults to l2 mode `ipvlan_mode=l2`. It can also be explicitly set with the same result as shown in the next example.
-
-```
-# now add networks and hosts as you would normally by attaching to the master (sub)interface that is tagged.
-$ docker network  create  -d ipvlan \
-    --subnet=192.168.30.0/24 \
-    --gateway=192.168.30.1 \
-    -o parent=eth0.30 \
-    -o ipvlan_mode=l2 ipvlan30
-
-# in two separate terminals, start a Docker container and the containers can now ping one another.
-$ docker run --net=ipvlan30 -it --name ivlan_test3 --rm alpine /bin/sh
-$ docker run --net=ipvlan30 -it --name ivlan_test4 --rm alpine /bin/sh
-```
-
-The gateway is set inside of the container as the default gateway. That gateway would typically be an external router on the network.
-
-```
-$$ ip route
-  default via 192.168.30.1 dev eth0
-  192.168.30.0/24 dev eth0  src 192.168.30.2
-```
-
-Example: Multi-Subnet Ipvlan L2 Mode starting two containers on the same subnet and pinging one another. In order for the `192.168.114.0/24` to reach `192.168.116.0/24` it requires an external router in L2 mode. L3 mode can route between subnets that share a common `-o parent=`. 
-
-Secondary addresses on network routers are common as an address space becomes exhausted to add another secondary to an L3 vlan interface or commonly referred to as a "switched virtual interface" (SVI).
-
-```
-$ docker network  create  -d ipvlan \
-    --subnet=192.168.114.0/24 --subnet=192.168.116.0/24 \
-    --gateway=192.168.114.254  --gateway=192.168.116.254 \
-     -o parent=eth0.114 \
-     -o ipvlan_mode=l2 ipvlan114
-     
-$ docker run --net=ipvlan114 --ip=192.168.114.10 -it --rm alpine /bin/sh
-$ docker run --net=ipvlan114 --ip=192.168.114.11 -it --rm alpine /bin/sh
-```
-
-A key takeaway is, operators have the ability to map their physical network into their virtual network for integrating containers into their environment with no operational overhauls required. NetOps simply drops an 802.1q trunk into the Docker host. That virtual link would be the `-o parent=` passed in the network creation. For untagged (non-VLAN) links, it is as simple as `-o parent=eth0` or for 802.1q trunks with VLAN IDs each network gets mapped to the corresponding VLAN/Subnet from the network.
-
-An example being, NetOps provides VLAN ID and the associated subnets for VLANs being passed on the Ethernet link to the Docker host server. Those values are simply plugged into the `docker network create` commands when provisioning the Docker networks. These are persistent configurations that are applied every time the Docker engine starts which alleviates having to manage often complex configuration files. The network interfaces can also be managed manually by being pre-created and docker networking will never modify them, simply use them as parent interfaces. Example mappings from NetOps to Docker network commands are as follows:
-
-- VLAN: 10, Subnet: 172.16.80.0/24, Gateway: 172.16.80.1
-
-    - `--subnet=172.16.80.0/24 --gateway=172.16.80.1 -o parent=eth0.10` 
-
-- VLAN: 20, IP subnet: 172.16.50.0/22, Gateway: 172.16.50.1
-
-    - `--subnet=172.16.50.0/22 --gateway=172.16.50.1 -o parent=eth0.20 ` 
-
-- VLAN: 30, Subnet: 10.1.100.0/16, Gateway: 10.1.100.1
-
-    - `--subnet=10.1.100.0/16 --gateway=10.1.100.1 -o parent=eth0.30` 
-
-### IPVlan L3 Mode Example
-
-IPVlan will require routes to be distributed to each endpoint. The driver only builds the Ipvlan L3 mode port and attaches the container to the interface. Route distribution throughout a cluster is beyond the initial implementation of this single host scoped driver. In L3 mode, the Docker host is very similar to a router starting new networks in the container. They are on networks that the upstream network will not know about without route distribution. For those curious how Ipvlan L3 will fit into container networking see the following examples.
-
-![Docker Ipvlan L2 Mode](images/ipvlan-l3.png)
-
-Ipvlan L3 mode drops all broadcast and multicast traffic. This reason alone makes Ipvlan L3 mode a prime candidate for those looking for massive scale and predictable network integrations. It is predictable and in turn will lead to greater uptimes because there is no bridging involved. Bridging loops have been responsible for high profile outages that can be hard to pinpoint depending on the size of the failure domain. This is due to the cascading nature of BPDUs (Bridge Port Data Units) that are flooded throughout a broadcast domain (VLAN) to find and block topology loops. Eliminating bridging domains, or at the least, keeping them isolated to a pair of ToRs (top of rack switches) will reduce hard to troubleshoot bridging instabilities. Ipvlan L2 modes is well suited for isolated VLANs only trunked into a pair of ToRs that can provide a loop-free non-blocking fabric. The next step further is to route at the edge via Ipvlan L3 mode that reduces a failure domain to a local host only. 
-
-- L3 mode needs to be on a separate subnet as the default namespace since it requires a netlink route in the default namespace pointing to the Ipvlan parent interface.
-
-- The parent interface used in this example is `eth0` and it is on the subnet `192.168.1.0/24`. Notice the `docker network` is **not** on the same subnet as `eth0`.
-
-- Unlike ipvlan l2 modes, different subnets/networks can ping one another as long as they share the same parent interface `-o parent=`.
-
-```
-$$ ip a show eth0
-3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
-    link/ether 00:50:56:39:45:2e brd ff:ff:ff:ff:ff:ff
-    inet 192.168.1.250/24 brd 192.168.1.255 scope global eth0
-```
-
-- A traditional gateway doesn't mean much to an L3 mode Ipvlan interface since there is no broadcast traffic allowed. Because of that, the container default gateway simply points to the containers `eth0` device. See below for CLI output of `ip route` or `ip -6 route` from inside an L3 container for details.
-
-The mode ` -o ipvlan_mode=l3` must be explicitly specified since the default ipvlan mode is `l2`.
-
-The following example does not specify a parent interface. The network drivers will create a dummy type link for the user rather then rejecting the network creation and isolating containers from only communicating with one another.
-
-```
-# Create the Ipvlan L3 network
-$ docker network  create  -d ipvlan \
-    --subnet=192.168.214.0/24 \
-    --subnet=10.1.214.0/24 \
-     -o ipvlan_mode=l3 ipnet210
-
-# Test 192.168.214.0/24 connectivity
-$ docker run --net=ipnet210 --ip=192.168.214.10 -itd alpine /bin/sh
-$ docker run --net=ipnet210 --ip=10.1.214.10 -itd alpine /bin/sh
-
-# Test L3 connectivity from 10.1.214.0/24 to 192.168.212.0/24
-$ docker run --net=ipnet210 --ip=192.168.214.9 -it --rm alpine ping -c 2 10.1.214.10
-
-# Test L3 connectivity from 192.168.212.0/24 to 10.1.214.0/24
-$ docker run --net=ipnet210 --ip=10.1.214.9 -it --rm alpine ping -c 2 192.168.214.10
-
-```
-
-Notice there is no `--gateway=` option in the network create. The field is ignored if one is specified `l3` mode. Take a look at the container routing table from inside of the container:
-
-```
-# Inside an L3 mode container
-$$ ip route
-  default dev eth0
-  192.168.214.0/24 dev eth0  src 192.168.214.10
-```
-
-In order to ping the containers from a remote Docker host or the container be able to ping a remote host, the remote host or the physical network in between need to have a route pointing to the host IP address of the container's Docker host eth interface. More on this as we evolve the Ipvlan `L3` story.
-
-### Dual Stack IPv4 IPv6 Ipvlan L2 Mode
-
-- Not only does Libnetwork give you complete control over IPv4 addressing, but it also gives you total control over IPv6 addressing as well as feature parity between the two address families.
-
-- The next example will start with IPv6 only. Start two containers on the same VLAN `139` and ping one another. Since the IPv4 subnet is not specified, the default IPAM will provision a default IPv4 subnet. That subnet is isolated unless the upstream network is explicitly routing it on VLAN `139`.
-
-```
-# Create a v6 network
-$ docker network create -d ipvlan \
-    --subnet=2001:db8:abc2::/64 --gateway=2001:db8:abc2::22 \
-    -o parent=eth0.139 v6ipvlan139
-    
-# Start a container on the network
-$ docker run --net=v6ipvlan139 -it --rm alpine /bin/sh
-
-```
-
-View the container eth0 interface and v6 routing table:
-
-```
-# Inside the IPv6 container
-$$ ip a show eth0
-75: eth0@if55: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default
-    link/ether 00:50:56:2b:29:40 brd ff:ff:ff:ff:ff:ff
-    inet 172.18.0.2/16 scope global eth0
-       valid_lft forever preferred_lft forever
-    inet6 2001:db8:abc4::250:56ff:fe2b:2940/64 scope link
-       valid_lft forever preferred_lft forever
-    inet6 2001:db8:abc2::1/64 scope link nodad
-       valid_lft forever preferred_lft forever
-       
-$$ ip -6 route
-2001:db8:abc4::/64 dev eth0  proto kernel  metric 256
-2001:db8:abc2::/64 dev eth0  proto kernel  metric 256
-default via 2001:db8:abc2::22 dev eth0  metric 1024
-```
-
-Start a second container and ping the first container's v6 address. 
-
-```
-# Test L2 connectivity over IPv6
-$ docker run --net=v6ipvlan139 -it --rm alpine /bin/sh
-
-# Inside the second IPv6 container
-$$ ip a show eth0
-75: eth0@if55: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default
-    link/ether 00:50:56:2b:29:40 brd ff:ff:ff:ff:ff:ff
-    inet 172.18.0.3/16 scope global eth0
-       valid_lft forever preferred_lft forever
-    inet6 2001:db8:abc4::250:56ff:fe2b:2940/64 scope link tentative dadfailed
-       valid_lft forever preferred_lft forever
-    inet6 2001:db8:abc2::2/64 scope link nodad
-       valid_lft forever preferred_lft forever
-
-$$ ping6 2001:db8:abc2::1
-PING 2001:db8:abc2::1 (2001:db8:abc2::1): 56 data bytes
-64 bytes from 2001:db8:abc2::1%eth0: icmp_seq=0 ttl=64 time=0.044 ms
-64 bytes from 2001:db8:abc2::1%eth0: icmp_seq=1 ttl=64 time=0.058 ms
-
-2 packets transmitted, 2 packets received, 0% packet loss
-round-trip min/avg/max/stddev = 0.044/0.051/0.058/0.000 ms
-```
-
-The next example with setup a dual stack IPv4/IPv6 network with an example VLAN ID of `140`.
-
-Next create a network with two IPv4 subnets and one IPv6 subnets, all of which have explicit gateways:
-
-```
-$ docker network  create  -d ipvlan \
-    --subnet=192.168.140.0/24 --subnet=192.168.142.0/24 \
-    --gateway=192.168.140.1  --gateway=192.168.142.1 \
-    --subnet=2001:db8:abc9::/64 --gateway=2001:db8:abc9::22 \
-     -o parent=eth0.140 \
-     -o ipvlan_mode=l2 ipvlan140
-```
-
-Start a container and view eth0 and both v4 & v6 routing tables:
-
-```
-$ docker run --net=ipvlan140 --ip6=2001:db8:abc2::51 -it --rm alpine /bin/sh
-
-$ ip a show eth0
-78: eth0@if77: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default
-    link/ether 00:50:56:2b:29:40 brd ff:ff:ff:ff:ff:ff
-    inet 192.168.140.2/24 scope global eth0
-       valid_lft forever preferred_lft forever
-    inet6 2001:db8:abc4::250:56ff:fe2b:2940/64 scope link
-       valid_lft forever preferred_lft forever
-    inet6 2001:db8:abc9::1/64 scope link nodad
-       valid_lft forever preferred_lft forever
-
-$$ ip route
-default via 192.168.140.1 dev eth0
-192.168.140.0/24 dev eth0  proto kernel  scope link  src 192.168.140.2
-
-$$ ip -6 route
-2001:db8:abc4::/64 dev eth0  proto kernel  metric 256
-2001:db8:abc9::/64 dev eth0  proto kernel  metric 256
-default via 2001:db8:abc9::22 dev eth0  metric 1024
-```
-
-Start a second container with a specific `--ip4` address and ping the first host using IPv4 packets:
-
-```
-$ docker run --net=ipvlan140 --ip=192.168.140.10 -it --rm alpine /bin/sh
-```
-
-**Note**: Different subnets on the same parent interface in Ipvlan `L2` mode cannot ping one another. That requires a router to proxy-arp the requests with a secondary subnet. However, Ipvlan `L3` will route the unicast traffic between disparate subnets as long as they share the same `-o parent` parent link.
-
-### Dual Stack IPv4 IPv6 Ipvlan L3 Mode 
-
-**Example:** IpVlan L3 Mode Dual Stack IPv4/IPv6, Multi-Subnet w/ 802.1q Vlan Tag:118
-
-As in all of the examples, a tagged VLAN interface does not have to be used. The sub-interfaces can be swapped with `eth0`, `eth1`, `bond0` or any other valid interface on the host other then the `lo` loopback.
-
-The primary difference you will see is that L3 mode does not create a default route with a next-hop but rather sets a default route pointing to `dev eth` only since ARP/Broadcasts/Multicast are all filtered by Linux as per the design. Since the parent interface is essentially acting as a router, the parent interface IP and subnet needs to be different from the container networks. That is the opposite of bridge and L2 modes, which need to be on the same subnet (broadcast domain) in order to forward broadcast and multicast packets.
-
-```
-# Create an IPv6+IPv4 Dual Stack Ipvlan L3 network 
-# Gateways for both v4 and v6 are set to a dev e.g. 'default dev eth0'
-$ docker network  create  -d ipvlan \
-    --subnet=192.168.110.0/24 \
-    --subnet=192.168.112.0/24 \
-    --subnet=2001:db8:abc6::/64 \
-     -o parent=eth0 \
-     -o ipvlan_mode=l3 ipnet110
-
-
-# Start a few of containers on the network (ipnet110) 
-# in separate terminals and check connectivity
-$ docker run --net=ipnet110 -it --rm alpine /bin/sh
-# Start a second container specifying the v6 address
-$ docker run --net=ipnet110 --ip6=2001:db8:abc6::10 -it --rm alpine /bin/sh
-# Start a third specifying the IPv4 address
-$ docker run --net=ipnet110 --ip=192.168.112.30 -it --rm alpine /bin/sh
-# Start a 4th specifying both the IPv4 and IPv6 addresses
-$ docker run --net=ipnet110 --ip6=2001:db8:abc6::50 --ip=192.168.112.50 -it --rm alpine /bin/sh
-```
-
-Interface and routing table outputs are as follows:
-
-```
-$$ ip a show eth0
-63: eth0@if59: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default
-    link/ether 00:50:56:2b:29:40 brd ff:ff:ff:ff:ff:ff
-    inet 192.168.112.2/24 scope global eth0
-       valid_lft forever preferred_lft forever
-    inet6 2001:db8:abc4::250:56ff:fe2b:2940/64 scope link
-       valid_lft forever preferred_lft forever
-    inet6 2001:db8:abc6::10/64 scope link nodad
-       valid_lft forever preferred_lft forever
-     
-# Note the default route is simply the eth device because ARPs are filtered.
-$$ ip route
-  default dev eth0  scope link
-  192.168.112.0/24 dev eth0  proto kernel  scope link  src 192.168.112.2
-
-$$ ip -6 route
-2001:db8:abc4::/64 dev eth0  proto kernel  metric 256
-2001:db8:abc6::/64 dev eth0  proto kernel  metric 256
-default dev eth0  metric 1024
-```
-
-*Note:* There may be a bug when specifying `--ip6=` addresses when you delete a container with a specified v6 address and then start a new container with the same v6 address it throws the following like the address isn't properly being released to the v6 pool. It will fail to unmount the container and be left dead.
-
-```
-docker: Error response from daemon: Address already in use.
-```
-
-### Manually Creating 802.1q Links
-
-**Vlan ID 40**
-
-If a user does not want the driver to create the vlan sub-interface it simply needs to exist prior to the `docker network create`. If you have sub-interface naming that is not `interface.vlan_id` it is honored in the `-o parent=` option again as long as the interface exists and is up.
-
-Links, when manually created, can be named anything as long as they exist when the network is created. Manually created links do not get deleted regardless of the name when the network is deleted with `docker network rm`.
-
-```
-# create a new sub-interface tied to dot1q vlan 40
-$ ip link add link eth0 name eth0.40 type vlan id 40
-
-# enable the new sub-interface
-$ ip link set eth0.40 up
-
-# now add networks and hosts as you would normally by attaching to the master (sub)interface that is tagged
-$ docker network  create  -d ipvlan \
-   --subnet=192.168.40.0/24 \
-   --gateway=192.168.40.1 \
-   -o parent=eth0.40 ipvlan40
-
-# in two separate terminals, start a Docker container and the containers can now ping one another.
-$ docker run --net=ipvlan40 -it --name ivlan_test5 --rm alpine /bin/sh
-$ docker run --net=ipvlan40 -it --name ivlan_test6 --rm alpine /bin/sh
-```
-
-**Example:** Vlan sub-interface manually created with any name:
-
-```
-# create a new sub interface tied to dot1q vlan 40
-$ ip link add link eth0 name foo type vlan id 40
-
-# enable the new sub-interface
-$ ip link set foo up
-
-# now add networks and hosts as you would normally by attaching to the master (sub)interface that is tagged
-$ docker network  create  -d ipvlan \
-    --subnet=192.168.40.0/24 --gateway=192.168.40.1 \
-    -o parent=foo ipvlan40
-
-# in two separate terminals, start a Docker container and the containers can now ping one another.
-$ docker run --net=ipvlan40 -it --name ivlan_test5 --rm alpine /bin/sh
-$ docker run --net=ipvlan40 -it --name ivlan_test6 --rm alpine /bin/sh
-```
-
-Manually created links can be cleaned up with:
-
-```
-$ ip link del foo
-```
-
-As with all of the Libnetwork drivers, they can be mixed and matched, even as far as running 3rd party ecosystem drivers in parallel for maximum flexibility to the Docker user.
diff --git a/components/engine/hack/dockerfile/binaries-commits b/components/engine/hack/dockerfile/binaries-commits
index cec6ebbd35..98344bc2fa 100644
--- a/components/engine/hack/dockerfile/binaries-commits
+++ b/components/engine/hack/dockerfile/binaries-commits
@@ -3,12 +3,11 @@
 TOMLV_COMMIT=9baf8a8a9f2ed20a8e54160840c492f937eeaf9a
 
 # When updating RUNC_COMMIT, also update runc in vendor.conf accordingly
-RUNC_COMMIT=992a5be178a62e026f4069f443c6164912adbf09
+RUNC_COMMIT=2d41c047c83e09a6d61d464906feb2a2f3c52aa4
 CONTAINERD_COMMIT=3addd840653146c90a254301d6c3a663c7fd6429
 TINI_COMMIT=949e6facb77383876aeff8a6944dde66b3089574
 LIBNETWORK_COMMIT=7b2b1feb1de4817d522cc372af149ff48d25028e
 VNDR_COMMIT=c56e082291115e369f77601f9c071dd0b87c7120
-BINDATA_COMMIT=a0ff2567cfb70903282db057e799fd826784d41d
 
 # CLI
 DOCKERCLI_REPO=https://github.com/docker/cli
diff --git a/components/engine/hack/dockerfile/install-binaries.sh b/components/engine/hack/dockerfile/install-binaries.sh
index fd8f97f4f9..370ec7ce45 100755
--- a/components/engine/hack/dockerfile/install-binaries.sh
+++ b/components/engine/hack/dockerfile/install-binaries.sh
@@ -20,7 +20,7 @@ RUNC_BUILDTAGS="${RUNC_BUILDTAGS:-"seccomp apparmor selinux"}"
 
 install_runc() {
 	echo "Install runc version $RUNC_COMMIT"
-	git clone https://github.com/opencontainers/runc.git "$GOPATH/src/github.com/opencontainers/runc"
+	git clone https://github.com/docker/runc.git "$GOPATH/src/github.com/opencontainers/runc"
 	cd "$GOPATH/src/github.com/opencontainers/runc"
 	git checkout -q "$RUNC_COMMIT"
 	make BUILDTAGS="$RUNC_BUILDTAGS" $1
@@ -46,14 +46,6 @@ install_proxy() {
 	go build -ldflags="$PROXY_LDFLAGS" -o /usr/local/bin/docker-proxy github.com/docker/libnetwork/cmd/proxy
 }
 
-install_bindata() {
-    echo "Install go-bindata version $BINDATA_COMMIT"
-    git clone https://github.com/jteeuwen/go-bindata "$GOPATH/src/github.com/jteeuwen/go-bindata"
-    cd $GOPATH/src/github.com/jteeuwen/go-bindata
-    git checkout -q "$BINDATA_COMMIT"
-	go build -o /usr/local/bin/go-bindata github.com/jteeuwen/go-bindata/go-bindata
-}
-
 install_dockercli() {
 	echo "Install docker/cli version $DOCKERCLI_COMMIT"
 	git clone "$DOCKERCLI_REPO" "$GOPATH/src/github.com/docker/cli"
@@ -117,16 +109,12 @@ do
 			go build -v -o /usr/local/bin/vndr .
 			;;
 
-		bindata)
-			install_bindata
-			;;
-
 		dockercli)
 			install_dockercli
 			;;
 
 		*)
-			echo echo "Usage: $0 [tomlv|runc|runc-dynamic|containerd|containerd-dynamic|tini|proxy|proxy-dynamic|bindata|vndr|dockercli]"
+			echo echo "Usage: $0 [tomlv|runc|runc-dynamic|containerd|containerd-dynamic|tini|proxy|proxy-dynamic|vndr|dockercli]"
 			exit 1
 
 	esac
diff --git a/components/engine/hack/make.ps1 b/components/engine/hack/make.ps1
index 8ef9ab6ead..c1cdad37ee 100644
--- a/components/engine/hack/make.ps1
+++ b/components/engine/hack/make.ps1
@@ -280,7 +280,7 @@ Function Validate-GoFormat($headCommit, $upstreamCommit) {
 
     # Get a list of all go source-code files which have changed.  Ignore exit code on next call - always process regardless
     $files=@(); $files = Invoke-Expression "git diff $upstreamCommit...$headCommit --diff-filter=ACMR --name-only -- `'*.go`'"
-    $files = $files | Select-String -NotMatch "^vendor/" | Select-String -NotMatch "^cli/compose/schema/bindata.go"
+    $files = $files | Select-String -NotMatch "^vendor/"
     $badFiles=@(); $files | %{
         # Deliberately ignore error on next line - treat as failed
         $content=Invoke-Expression "git show $headCommit`:$_"
diff --git a/components/engine/hack/make.sh b/components/engine/hack/make.sh
index 9c6ed6e036..b7d59ba94a 100755
--- a/components/engine/hack/make.sh
+++ b/components/engine/hack/make.sh
@@ -112,7 +112,6 @@ if [ ! "$GOPATH" ]; then
 	exit 1
 fi
 
-DOCKER_BUILDTAGS+=" daemon"
 if ${PKG_CONFIG} 'libsystemd >= 209' 2> /dev/null ; then
 	DOCKER_BUILDTAGS+=" journald"
 elif ${PKG_CONFIG} 'libsystemd-journal' 2> /dev/null ; then
@@ -139,7 +138,6 @@ fi
 # Use these flags when compiling the tests and final binary
 
 IAMSTATIC='true'
-source "$SCRIPTDIR/make/.go-autogen"
 if [ -z "$DOCKER_DEBUG" ]; then
 	LDFLAGS='-w'
 fi
diff --git a/components/engine/hack/make/.binary b/components/engine/hack/make/.binary
index 01028c27e6..8d4265cb65 100644
--- a/components/engine/hack/make/.binary
+++ b/components/engine/hack/make/.binary
@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
 set -e
 
+GO_PACKAGE='github.com/docker/docker/cmd/dockerd'
+BINARY_SHORT_NAME='dockerd'
 BINARY_NAME="$BINARY_SHORT_NAME-$VERSION"
 BINARY_EXTENSION="$(binary_extension)"
 BINARY_FULLNAME="$BINARY_NAME$BINARY_EXTENSION"
@@ -20,17 +22,6 @@ if [ "$(go env GOOS)/$(go env GOARCH)" != "$(go env GOHOSTOS)/$(go env GOHOSTARC
 	esac
 fi
 
-if [ "$IAMSTATIC" == "true" ] && [ "$(go env GOHOSTOS)" == "linux" ]; then
-	if  [ "${GOOS}/${GOARCH}" == "darwin/amd64" ]; then
-		export CGO_ENABLED=1
-		export CC=o64-clang
-		export LDFLAGS='-linkmode external -s'
-		export LDFLAGS_STATIC_DOCKER='-extld='${CC}
-	else
-		export BUILDFLAGS=( "${BUILDFLAGS[@]/pkcs11 /}" ) # we cannot dlopen in pkcs11 in a static binary
-	fi
-fi
-
 echo "Building: $DEST/$BINARY_FULLNAME"
 go build \
 	-o "$DEST/$BINARY_FULLNAME" \
diff --git a/components/engine/hack/make/.binary-setup b/components/engine/hack/make/.binary-setup
index b4bd66872c..15de89fe10 100644
--- a/components/engine/hack/make/.binary-setup
+++ b/components/engine/hack/make/.binary-setup
@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
 
-DOCKER_CLIENT_BINARY_NAME='docker'
 DOCKER_DAEMON_BINARY_NAME='dockerd'
 DOCKER_RUNC_BINARY_NAME='docker-runc'
 DOCKER_CONTAINERD_BINARY_NAME='docker-containerd'
diff --git a/components/engine/hack/make/.integration-daemon-start b/components/engine/hack/make/.integration-daemon-start
index 57101ffad0..dafd0533d9 100644
--- a/components/engine/hack/make/.integration-daemon-start
+++ b/components/engine/hack/make/.integration-daemon-start
@@ -6,6 +6,10 @@ base="$ABS_DEST/.."
 export PATH="$base/binary-daemon:$base/dynbinary-daemon:$PATH"
 
 export TEST_CLIENT_BINARY=docker
+
+# Do not bump this version! Integration tests should no longer rely on the docker cli, they should be
+# API tests instead. For the existing tests the scripts will use a frozen version of the docker cli
+# with a DOCKER_API_VERSION frozen to 1.30, which should ensure that the CI remains green at all times.
 export DOCKER_API_VERSION=1.30
 if [ -n "$DOCKER_CLI_PATH" ]; then
 	export TEST_CLIENT_BINARY=/usr/local/cli/$(basename "$DOCKER_CLI_PATH")
@@ -17,6 +21,8 @@ if ! command -v "$TEST_CLIENT_BINARY" &> /dev/null; then
 	false
 fi
 
+export DOCKER_CLI_VERSION=$(${TEST_CLIENT_BINARY} --version | awk '{ gsub(",", " "); print $3 }')
+
 # This is a temporary hack for split-binary mode. It can be removed once
 # https://github.com/docker/docker/pull/22134 is merged into docker master
 if [ "$(go env GOOS)" = 'windows' ]; then
diff --git a/components/engine/hack/make/.integration-test-helpers b/components/engine/hack/make/.integration-test-helpers
index 6c099e4c72..4ff9677c79 100644
--- a/components/engine/hack/make/.integration-test-helpers
+++ b/components/engine/hack/make/.integration-test-helpers
@@ -60,6 +60,7 @@ test_env() {
 		# use "env -i" to tightly control the environment variables that bleed into the tests
 		env -i \
 			DEST="$DEST" \
+			DOCKER_CLI_VERSION="$DOCKER_CLI_VERSION" \
 			DOCKER_API_VERSION="$DOCKER_API_VERSION" \
 			DOCKER_INTEGRATION_DAEMON_DEST="$DOCKER_INTEGRATION_DAEMON_DEST" \
 			DOCKER_TLS_VERIFY="$DOCKER_TEST_TLS_VERIFY" \
diff --git a/components/engine/hack/make/binary-daemon b/components/engine/hack/make/binary-daemon
index a6b322b554..736f308a83 100644
--- a/components/engine/hack/make/binary-daemon
+++ b/components/engine/hack/make/binary-daemon
@@ -1,13 +1,9 @@
 #!/usr/bin/env bash
 set -e
 
-[ -z "$KEEPDEST" ] && \
-	rm -rf "$DEST"
+[ -z "$KEEPDEST" ] && rm -rf "$DEST"
 
 (
-	source "${MAKEDIR}/.binary-setup"
-	export BINARY_SHORT_NAME="$DOCKER_DAEMON_BINARY_NAME"
-	export GO_PACKAGE='github.com/docker/docker/cmd/dockerd'
 	source "${MAKEDIR}/.binary"
 	copy_binaries "$DEST" 'hash'
 )
diff --git a/components/engine/hack/make/build-integration-test-binary b/components/engine/hack/make/build-integration-test-binary
index 29da577f61..a842e8cce8 100644
--- a/components/engine/hack/make/build-integration-test-binary
+++ b/components/engine/hack/make/build-integration-test-binary
@@ -4,6 +4,8 @@ set -e
 rm -rf "$DEST"
 DEST="$ABS_DEST/../test-integration-cli"
 
+source "$SCRIPTDIR/make/.go-autogen"
+
 if [ -z $DOCKER_INTEGRATION_TESTS_VERIFIED ]; then
 	source ${MAKEDIR}/.integration-test-helpers
 	ensure_test_dir integration-cli "$DEST/test.main"
diff --git a/components/engine/hack/make/cross b/components/engine/hack/make/cross
index 9711a3cabb..85dd3c637f 100644
--- a/components/engine/hack/make/cross
+++ b/components/engine/hack/make/cross
@@ -1,24 +1,19 @@
 #!/usr/bin/env bash
 set -e
 
-# explicit list of os/arch combos that support being a daemon
-declare -A daemonSupporting
-daemonSupporting=(
-	[linux/amd64]=1
-	[windows/amd64]=1
-)
-
 # if we have our linux/amd64 version compiled, let's symlink it in
 if [ -x "$DEST/../binary-daemon/dockerd-$VERSION" ]; then
 	arch=$(go env GOHOSTARCH)
 	mkdir -p "$DEST/linux/${arch}"
 	(
 		cd "$DEST/linux/${arch}"
-		ln -s ../../../binary-daemon/* ./
+		ln -sf ../../../binary-daemon/* ./
 	)
 	echo "Created symlinks:" "$DEST/linux/${arch}/"*
 fi
 
+DOCKER_CROSSPLATFORMS=${DOCKER_CROSSPLATFORMS:-"linux/amd64 windows/amd64"}
+
 for platform in $DOCKER_CROSSPLATFORMS; do
 	(
 		export KEEPDEST=1
@@ -26,21 +21,9 @@ for platform in $DOCKER_CROSSPLATFORMS; do
 		export GOOS=${platform%/*}
 		export GOARCH=${platform##*/}
 
-		if [ "$GOOS" != "solaris" ]; then
-			# TODO. Solaris cannot be cross build because of CGO calls.
-
-			# go install docker/docker/pkg packages to ensure that
-			# they build cross platform.
-			go install github.com/docker/docker/pkg/...
-
-			if [ -n "${daemonSupporting[$platform]}" ]; then
-				# Since tgz relies on the paths created by mkdir
-				# and we removed the clients, we don't want to mkdir
-				# for all the platforms, only the ones supported by the daemon.
-				mkdir -p "$DEST"
-				ABS_DEST="$(cd "$DEST" && pwd -P)"
-				source "${MAKEDIR}/binary-daemon"
-			fi
-		fi
+		echo "Cross building: $DEST"
+		mkdir -p "$DEST"
+		ABS_DEST="$(cd "$DEST" && pwd -P)"
+		source "${MAKEDIR}/binary-daemon"
 	)
 done
diff --git a/components/engine/hack/make/dynbinary-daemon b/components/engine/hack/make/dynbinary-daemon
index 1b7dbb45a8..d1c0070e62 100644
--- a/components/engine/hack/make/dynbinary-daemon
+++ b/components/engine/hack/make/dynbinary-daemon
@@ -2,8 +2,6 @@
 set -e
 
 (
-	export BINARY_SHORT_NAME='dockerd'
-	export GO_PACKAGE='github.com/docker/docker/cmd/dockerd'
 	export IAMSTATIC='false'
 	export LDFLAGS_STATIC_DOCKER=''
 	export BUILDFLAGS=( "${BUILDFLAGS[@]/netgo /}" ) # disable netgo, since we don't need it for a dynamic binary
diff --git a/components/engine/hack/make/test-unit b/components/engine/hack/make/test-unit
index 1c2ba3ff3b..d3f182c094 100644
--- a/components/engine/hack/make/test-unit
+++ b/components/engine/hack/make/test-unit
@@ -50,6 +50,7 @@ bundle_test_unit() {
 	fi
 
 	go test -cover -ldflags "$LDFLAGS" "${BUILDFLAGS[@]}" $TESTFLAGS $pkg_list
+	go test -cover -ldflags "$LDFLAGS" "${BUILDFLAGS[@]}" $TESTFLAGS github.com/docker/docker/pkg/term -test.root
 }
 
 bundle_test_unit 2>&1 | tee -a "$DEST/test.log"
diff --git a/components/engine/hack/make/yaml-docs-generator b/components/engine/hack/make/yaml-docs-generator
deleted file mode 100644
index 8548deebb3..0000000000
--- a/components/engine/hack/make/yaml-docs-generator
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-[ -z "$KEEPDEST" ] && \
-	rm -rf "$DEST"
-
-(
-	source "${MAKEDIR}/.binary-setup"
-	export BINARY_SHORT_NAME="yaml-docs-generator"
-	export GO_PACKAGE='github.com/docker/docker/docs/yaml'
-	source "${MAKEDIR}/.binary"
-)
diff --git a/components/engine/hack/validate/gofmt b/components/engine/hack/validate/gofmt
index 42ba052b74..38027a9f77 100755
--- a/components/engine/hack/validate/gofmt
+++ b/components/engine/hack/validate/gofmt
@@ -5,8 +5,8 @@ source "${SCRIPTDIR}/.validate"
 
 IFS=$'\n'
 files=( $(validate_diff --diff-filter=ACMR --name-only -- '*.go' |
-    grep -v '^vendor/' |
-    grep -v '^cli/compose/schema/bindata.go' || true) )
+	grep -v '^vendor/' |
+	grep -v '\.pb\.go$' || true) )
 unset IFS
 
 badFiles=()
diff --git a/components/engine/hack/validate/lint b/components/engine/hack/validate/lint
index d362f46243..341490a042 100755
--- a/components/engine/hack/validate/lint
+++ b/components/engine/hack/validate/lint
@@ -4,7 +4,7 @@ export SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 source "${SCRIPTDIR}/.validate"
 
 IFS=$'\n'
-files=( $(validate_diff --diff-filter=ACMR --name-only -- '*.go' | grep -v '^vendor/' | grep -v '^api/types/container/' | grep -v '^cli/compose/schema/bindata.go' | grep -v '^api/types/plugins/logdriver/entry.pb.go' || true) )
+files=( $(validate_diff --diff-filter=ACMR --name-only -- '*.go' | grep -v '^vendor/' | grep -v '^api/types/container/' | grep -v '\.pb\.go$'  || true) )
 unset IFS
 
 errors=()
diff --git a/components/engine/image/image.go b/components/engine/image/image.go
index 17935ac234..ab95d93dab 100644
--- a/components/engine/image/image.go
+++ b/components/engine/image/image.go
@@ -4,9 +4,13 @@ import (
 	"encoding/json"
 	"errors"
 	"io"
+	"runtime"
+	"strings"
 	"time"
 
 	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/dockerversion"
+	"github.com/docker/docker/layer"
 	"github.com/opencontainers/go-digest"
 )
 
@@ -92,6 +96,15 @@ func (img *Image) RunConfig() *container.Config {
 	return img.Config
 }
 
+// Platform returns the image's operating system. If not populated, defaults to the host runtime OS.
+func (img *Image) Platform() string {
+	os := img.OS
+	if os == "" {
+		os = runtime.GOOS
+	}
+	return os
+}
+
 // MarshalJSON serializes the image to JSON. It sorts the top-level keys so
 // that JSON that's been manipulated by a push/pull cycle with a legacy
 // registry won't end up with a different key order.
@@ -110,6 +123,51 @@ func (img *Image) MarshalJSON() ([]byte, error) {
 	return json.Marshal(c)
 }
 
+// ChildConfig is the configuration to apply to an Image to create a new
+// Child image. Other properties of the image are copied from the parent.
+type ChildConfig struct {
+	ContainerID     string
+	Author          string
+	Comment         string
+	DiffID          layer.DiffID
+	ContainerConfig *container.Config
+	Config          *container.Config
+}
+
+// NewChildImage creates a new Image as a child of this image.
+func NewChildImage(img *Image, child ChildConfig, platform string) *Image {
+	isEmptyLayer := layer.IsEmpty(child.DiffID)
+	rootFS := img.RootFS
+	if rootFS == nil {
+		rootFS = NewRootFS()
+	}
+	if !isEmptyLayer {
+		rootFS.Append(child.DiffID)
+	}
+	imgHistory := NewHistory(
+		child.Author,
+		child.Comment,
+		strings.Join(child.ContainerConfig.Cmd, " "),
+		isEmptyLayer)
+
+	return &Image{
+		V1Image: V1Image{
+			DockerVersion:   dockerversion.Version,
+			Config:          child.Config,
+			Architecture:    runtime.GOARCH,
+			OS:              platform,
+			Container:       child.ContainerID,
+			ContainerConfig: *child.ContainerConfig,
+			Author:          child.Author,
+			Created:         imgHistory.Created,
+		},
+		RootFS:     rootFS,
+		History:    append(img.History, imgHistory),
+		OSFeatures: img.OSFeatures,
+		OSVersion:  img.OSVersion,
+	}
+}
+
 // History stores build commands that were used to create an image
 type History struct {
 	// Created is the timestamp at which the image was created
@@ -126,6 +184,18 @@ type History struct {
 	EmptyLayer bool `json:"empty_layer,omitempty"`
 }
 
+// NewHistory creates a new history struct from arguments, and sets the created
+// time to the current time in UTC
+func NewHistory(author, comment, createdBy string, isEmptyLayer bool) History {
+	return History{
+		Author:     author,
+		Created:    time.Now().UTC(),
+		CreatedBy:  createdBy,
+		Comment:    comment,
+		EmptyLayer: isEmptyLayer,
+	}
+}
+
 // Exporter provides interface for loading and saving images
 type Exporter interface {
 	Load(io.ReadCloser, io.Writer, bool) error
diff --git a/components/engine/image/store.go b/components/engine/image/store.go
index 26ae109a06..541b07bba1 100644
--- a/components/engine/image/store.go
+++ b/components/engine/image/store.go
@@ -2,14 +2,17 @@ package image
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
+	"runtime"
+	"strings"
 	"sync"
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/distribution/digestset"
 	"github.com/docker/docker/layer"
+	"github.com/docker/docker/pkg/system"
 	"github.com/opencontainers/go-digest"
+	"github.com/pkg/errors"
 )
 
 // Store is an interface for creating and accessing images
@@ -37,20 +40,22 @@ type imageMeta struct {
 }
 
 type store struct {
-	sync.Mutex
+	sync.RWMutex
 	ls        LayerGetReleaser
 	images    map[ID]*imageMeta
 	fs        StoreBackend
 	digestSet *digestset.Set
+	platform  string
 }
 
 // NewImageStore returns new store object for given layer store
-func NewImageStore(fs StoreBackend, ls LayerGetReleaser) (Store, error) {
+func NewImageStore(fs StoreBackend, platform string, ls LayerGetReleaser) (Store, error) {
 	is := &store{
 		ls:        ls,
 		images:    make(map[ID]*imageMeta),
 		fs:        fs,
 		digestSet: digestset.NewSet(),
+		platform:  platform,
 	}
 
 	// load all current images and retain layers
@@ -111,6 +116,13 @@ func (is *store) Create(config []byte) (ID, error) {
 		return "", err
 	}
 
+	// Integrity check - ensure we are creating something for the correct platform
+	if runtime.GOOS == "windows" && system.LCOWSupported() {
+		if strings.ToLower(img.Platform()) != strings.ToLower(is.platform) {
+			return "", fmt.Errorf("cannot create entry for platform %q in image store for platform %q", img.Platform(), is.platform)
+		}
+	}
+
 	// Must reject any config that references diffIDs from the history
 	// which aren't among the rootfs layers.
 	rootFSLayers := make(map[layer.DiffID]struct{})
@@ -147,7 +159,7 @@ func (is *store) Create(config []byte) (ID, error) {
 	if layerID != "" {
 		l, err = is.ls.Get(layerID)
 		if err != nil {
-			return "", err
+			return "", errors.Wrapf(err, "failed to get layer %s", layerID)
 		}
 	}
 
@@ -166,9 +178,6 @@ func (is *store) Create(config []byte) (ID, error) {
 }
 
 func (is *store) Search(term string) (ID, error) {
-	is.Lock()
-	defer is.Unlock()
-
 	dgst, err := is.digestSet.Lookup(term)
 	if err != nil {
 		if err == digestset.ErrDigestNotFound {
@@ -251,8 +260,8 @@ func (is *store) GetParent(id ID) (ID, error) {
 }
 
 func (is *store) Children(id ID) []ID {
-	is.Lock()
-	defer is.Unlock()
+	is.RLock()
+	defer is.RUnlock()
 
 	return is.children(id)
 }
@@ -276,8 +285,8 @@ func (is *store) Map() map[ID]*Image {
 }
 
 func (is *store) imagesMap(all bool) map[ID]*Image {
-	is.Lock()
-	defer is.Unlock()
+	is.RLock()
+	defer is.RUnlock()
 
 	images := make(map[ID]*Image)
 
diff --git a/components/engine/image/store_test.go b/components/engine/image/store_test.go
index 21a9b0b41b..13318cf221 100644
--- a/components/engine/image/store_test.go
+++ b/components/engine/image/store_test.go
@@ -1,6 +1,7 @@
 package image
 
 import (
+	"runtime"
 	"testing"
 
 	"github.com/docker/docker/layer"
@@ -25,7 +26,7 @@ func TestRestore(t *testing.T) {
 	err = fs.SetMetadata(id2, "parent", []byte(id1))
 	assert.NoError(t, err)
 
-	is, err := NewImageStore(fs, &mockLayerGetReleaser{})
+	is, err := NewImageStore(fs, runtime.GOOS, &mockLayerGetReleaser{})
 	assert.NoError(t, err)
 
 	assert.Len(t, is.Map(), 2)
@@ -142,7 +143,7 @@ func TestParentReset(t *testing.T) {
 func defaultImageStore(t *testing.T) (Store, func()) {
 	fsBackend, cleanup := defaultFSStoreBackend(t)
 
-	store, err := NewImageStore(fsBackend, &mockLayerGetReleaser{})
+	store, err := NewImageStore(fsBackend, runtime.GOOS, &mockLayerGetReleaser{})
 	assert.NoError(t, err)
 
 	return store, cleanup
diff --git a/components/engine/image/tarexport/load.go b/components/engine/image/tarexport/load.go
index 14b7c1af0b..adf4574da8 100644
--- a/components/engine/image/tarexport/load.go
+++ b/components/engine/image/tarexport/load.go
@@ -2,12 +2,14 @@ package tarexport
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"io/ioutil"
 	"os"
 	"path/filepath"
 	"reflect"
+	"runtime"
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/distribution"
@@ -85,6 +87,17 @@ func (l *tarexporter) Load(inTar io.ReadCloser, outStream io.Writer, quiet bool)
 			return fmt.Errorf("invalid manifest, layers length mismatch: expected %d, got %d", expected, actual)
 		}
 
+		// On Windows, validate the platform, defaulting to windows if not present.
+		platform := layer.Platform(img.OS)
+		if runtime.GOOS == "windows" {
+			if platform == "" {
+				platform = "windows"
+			}
+			if (platform != "windows") && (platform != "linux") {
+				return fmt.Errorf("configuration for this image has an unsupported platform: %s", platform)
+			}
+		}
+
 		for i, diffID := range img.RootFS.DiffIDs {
 			layerPath, err := safePath(tmpDir, m.Layers[i])
 			if err != nil {
@@ -94,7 +107,7 @@ func (l *tarexporter) Load(inTar io.ReadCloser, outStream io.Writer, quiet bool)
 			r.Append(diffID)
 			newLayer, err := l.ls.Get(r.ChainID())
 			if err != nil {
-				newLayer, err = l.loadLayer(layerPath, rootFS, diffID.String(), m.LayerSources[diffID], progressOutput)
+				newLayer, err = l.loadLayer(layerPath, rootFS, diffID.String(), platform, m.LayerSources[diffID], progressOutput)
 				if err != nil {
 					return err
 				}
@@ -161,7 +174,7 @@ func (l *tarexporter) setParentID(id, parentID image.ID) error {
 	return l.is.SetParent(id, parentID)
 }
 
-func (l *tarexporter) loadLayer(filename string, rootFS image.RootFS, id string, foreignSrc distribution.Descriptor, progressOutput progress.Output) (layer.Layer, error) {
+func (l *tarexporter) loadLayer(filename string, rootFS image.RootFS, id string, platform layer.Platform, foreignSrc distribution.Descriptor, progressOutput progress.Output) (layer.Layer, error) {
 	// We use system.OpenSequential to use sequential file access on Windows, avoiding
 	// depleting the standby list. On Linux, this equates to a regular os.Open.
 	rawTar, err := system.OpenSequential(filename)
@@ -191,9 +204,9 @@ func (l *tarexporter) loadLayer(filename string, rootFS image.RootFS, id string,
 	defer inflatedLayerData.Close()
 
 	if ds, ok := l.ls.(layer.DescribableStore); ok {
-		return ds.RegisterWithDescriptor(inflatedLayerData, rootFS.ChainID(), foreignSrc)
+		return ds.RegisterWithDescriptor(inflatedLayerData, rootFS.ChainID(), platform, foreignSrc)
 	}
-	return l.ls.Register(inflatedLayerData, rootFS.ChainID())
+	return l.ls.Register(inflatedLayerData, rootFS.ChainID(), platform)
 }
 
 func (l *tarexporter) setLoadedTag(ref reference.NamedTagged, imgID digest.Digest, outStream io.Writer) error {
@@ -208,6 +221,10 @@ func (l *tarexporter) setLoadedTag(ref reference.NamedTagged, imgID digest.Diges
 }
 
 func (l *tarexporter) legacyLoad(tmpDir string, outStream io.Writer, progressOutput progress.Output) error {
+	if runtime.GOOS == "windows" {
+		return errors.New("Windows does not support legacy loading of images")
+	}
+
 	legacyLoadedMap := make(map[string]image.ID)
 
 	dirs, err := ioutil.ReadDir(tmpDir)
@@ -312,7 +329,7 @@ func (l *tarexporter) legacyLoadImage(oldID, sourceDir string, loadedMap map[str
 	if err != nil {
 		return err
 	}
-	newLayer, err := l.loadLayer(layerPath, *rootFS, oldID, distribution.Descriptor{}, progressOutput)
+	newLayer, err := l.loadLayer(layerPath, *rootFS, oldID, "", distribution.Descriptor{}, progressOutput)
 	if err != nil {
 		return err
 	}
diff --git a/components/engine/image/tarexport/save.go b/components/engine/image/tarexport/save.go
index 8d33a58724..d304a54c34 100644
--- a/components/engine/image/tarexport/save.go
+++ b/components/engine/image/tarexport/save.go
@@ -21,8 +21,10 @@ import (
 )
 
 type imageDescriptor struct {
-	refs   []reference.NamedTagged
-	layers []string
+	refs     []reference.NamedTagged
+	layers   []string
+	image    *image.Image
+	layerRef layer.Layer
 }
 
 type saveSession struct {
@@ -39,33 +41,47 @@ func (l *tarexporter) Save(names []string, outStream io.Writer) error {
 		return err
 	}
 
+	// Release all the image top layer references
+	defer l.releaseLayerReferences(images)
 	return (&saveSession{tarexporter: l, images: images}).save(outStream)
 }
 
-func (l *tarexporter) parseNames(names []string) (map[image.ID]*imageDescriptor, error) {
+// parseNames will parse the image names to a map which contains image.ID to *imageDescriptor.
+// Each imageDescriptor holds an image top layer reference named 'layerRef'. It is taken here, should be released later.
+func (l *tarexporter) parseNames(names []string) (desc map[image.ID]*imageDescriptor, rErr error) {
 	imgDescr := make(map[image.ID]*imageDescriptor)
+	defer func() {
+		if rErr != nil {
+			l.releaseLayerReferences(imgDescr)
+		}
+	}()
 
-	addAssoc := func(id image.ID, ref reference.Named) {
+	addAssoc := func(id image.ID, ref reference.Named) error {
 		if _, ok := imgDescr[id]; !ok {
-			imgDescr[id] = &imageDescriptor{}
+			descr := &imageDescriptor{}
+			if err := l.takeLayerReference(id, descr); err != nil {
+				return err
+			}
+			imgDescr[id] = descr
 		}
 
 		if ref != nil {
 			if _, ok := ref.(reference.Canonical); ok {
-				return
+				return nil
 			}
 			tagged, ok := reference.TagNameOnly(ref).(reference.NamedTagged)
 			if !ok {
-				return
+				return nil
 			}
 
 			for _, t := range imgDescr[id].refs {
 				if tagged.String() == t.String() {
-					return
+					return nil
 				}
 			}
 			imgDescr[id].refs = append(imgDescr[id].refs, tagged)
 		}
+		return nil
 	}
 
 	for _, name := range names {
@@ -78,11 +94,9 @@ func (l *tarexporter) parseNames(names []string) (map[image.ID]*imageDescriptor,
 			// Check if digest ID reference
 			if digested, ok := ref.(reference.Digested); ok {
 				id := image.IDFromDigest(digested.Digest())
-				_, err := l.is.Get(id)
-				if err != nil {
+				if err := addAssoc(id, nil); err != nil {
 					return nil, err
 				}
-				addAssoc(id, nil)
 				continue
 			}
 			return nil, errors.Errorf("invalid reference: %v", name)
@@ -93,20 +107,26 @@ func (l *tarexporter) parseNames(names []string) (map[image.ID]*imageDescriptor,
 			if err != nil {
 				return nil, err
 			}
-			addAssoc(imgID, nil)
+			if err := addAssoc(imgID, nil); err != nil {
+				return nil, err
+			}
 			continue
 		}
 		if reference.IsNameOnly(namedRef) {
 			assocs := l.rs.ReferencesByName(namedRef)
 			for _, assoc := range assocs {
-				addAssoc(image.IDFromDigest(assoc.ID), assoc.Ref)
+				if err := addAssoc(image.IDFromDigest(assoc.ID), assoc.Ref); err != nil {
+					return nil, err
+				}
 			}
 			if len(assocs) == 0 {
 				imgID, err := l.is.Search(name)
 				if err != nil {
 					return nil, err
 				}
-				addAssoc(imgID, nil)
+				if err := addAssoc(imgID, nil); err != nil {
+					return nil, err
+				}
 			}
 			continue
 		}
@@ -114,12 +134,43 @@ func (l *tarexporter) parseNames(names []string) (map[image.ID]*imageDescriptor,
 		if err != nil {
 			return nil, err
 		}
-		addAssoc(image.IDFromDigest(id), namedRef)
+		if err := addAssoc(image.IDFromDigest(id), namedRef); err != nil {
+			return nil, err
+		}
 
 	}
 	return imgDescr, nil
 }
 
+// takeLayerReference will take/Get the image top layer reference
+func (l *tarexporter) takeLayerReference(id image.ID, imgDescr *imageDescriptor) error {
+	img, err := l.is.Get(id)
+	if err != nil {
+		return err
+	}
+	imgDescr.image = img
+	topLayerID := img.RootFS.ChainID()
+	if topLayerID == "" {
+		return nil
+	}
+	layer, err := l.ls.Get(topLayerID)
+	if err != nil {
+		return err
+	}
+	imgDescr.layerRef = layer
+	return nil
+}
+
+// releaseLayerReferences will release all the image top layer references
+func (l *tarexporter) releaseLayerReferences(imgDescr map[image.ID]*imageDescriptor) error {
+	for _, descr := range imgDescr {
+		if descr.layerRef != nil {
+			l.ls.Release(descr.layerRef)
+		}
+	}
+	return nil
+}
+
 func (s *saveSession) save(outStream io.Writer) error {
 	s.savedLayers = make(map[string]struct{})
 	s.diffIDPaths = make(map[layer.DiffID]string)
@@ -224,11 +275,7 @@ func (s *saveSession) save(outStream io.Writer) error {
 }
 
 func (s *saveSession) saveImage(id image.ID) (map[layer.DiffID]distribution.Descriptor, error) {
-	img, err := s.is.Get(id)
-	if err != nil {
-		return nil, err
-	}
-
+	img := s.images[id].image
 	if len(img.RootFS.DiffIDs) == 0 {
 		return nil, fmt.Errorf("empty export - not implemented")
 	}
diff --git a/components/engine/integration-cli/check_test.go b/components/engine/integration-cli/check_test.go
index a1927e4c9a..cc3b80c94f 100644
--- a/components/engine/integration-cli/check_test.go
+++ b/components/engine/integration-cli/check_test.go
@@ -12,7 +12,7 @@ import (
 	"testing"
 
 	"github.com/docker/docker/api/types/swarm"
-	"github.com/docker/docker/cli/flags"
+	"github.com/docker/docker/cli/config"
 	"github.com/docker/docker/integration-cli/cli"
 	"github.com/docker/docker/integration-cli/cli/build/fakestorage"
 	"github.com/docker/docker/integration-cli/daemon"
@@ -406,7 +406,7 @@ func (s *DockerTrustSuite) TearDownTest(c *check.C) {
 	}
 
 	// Remove trusted keys and metadata after test
-	os.RemoveAll(filepath.Join(flags.ConfigurationDir(), "trust"))
+	os.RemoveAll(filepath.Join(config.Dir(), "trust"))
 	s.ds.TearDownTest(c)
 }
 
diff --git a/components/engine/integration-cli/cli/build/fakecontext/context.go b/components/engine/integration-cli/cli/build/fakecontext/context.go
index 94f05c3623..8ecf4e3c63 100644
--- a/components/engine/integration-cli/cli/build/fakecontext/context.go
+++ b/components/engine/integration-cli/cli/build/fakecontext/context.go
@@ -2,9 +2,12 @@ package fakecontext
 
 import (
 	"bytes"
+	"io"
 	"io/ioutil"
 	"os"
 	"path/filepath"
+
+	"github.com/docker/docker/pkg/archive"
 )
 
 type testingT interface {
@@ -110,3 +113,12 @@ func (f *Fake) Delete(file string) error {
 func (f *Fake) Close() error {
 	return os.RemoveAll(f.Dir)
 }
+
+// AsTarReader returns a ReadCloser with the contents of Dir as a tar archive.
+func (f *Fake) AsTarReader(t testingT) io.ReadCloser {
+	reader, err := archive.TarWithOptions(f.Dir, &archive.TarOptions{})
+	if err != nil {
+		t.Fatalf("Failed to create tar from %s: %s", f.Dir, err)
+	}
+	return reader
+}
diff --git a/components/engine/integration-cli/docker_api_attach_test.go b/components/engine/integration-cli/docker_api_attach_test.go
index 88dba3e974..11f7340c1f 100644
--- a/components/engine/integration-cli/docker_api_attach_test.go
+++ b/components/engine/integration-cli/docker_api_attach_test.go
@@ -74,7 +74,7 @@ func (s *DockerSuite) TestGetContainersAttachWebsocket(c *check.C) {
 
 // regression gh14320
 func (s *DockerSuite) TestPostContainersAttachContainerNotFound(c *check.C) {
-	client, err := request.NewClient(daemonHost())
+	client, err := request.NewHTTPClient(daemonHost())
 	c.Assert(err, checker.IsNil)
 	req, err := request.New(daemonHost(), "/containers/doesnotexist/attach", request.Method(http.MethodPost))
 	resp, err := client.Do(req)
diff --git a/components/engine/integration-cli/docker_api_build_test.go b/components/engine/integration-cli/docker_api_build_test.go
index feb20ee724..a5e19f658b 100644
--- a/components/engine/integration-cli/docker_api_build_test.go
+++ b/components/engine/integration-cli/docker_api_build_test.go
@@ -3,11 +3,17 @@ package main
 import (
 	"archive/tar"
 	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
 	"io/ioutil"
 	"net/http"
 	"regexp"
 	"strings"
 
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/client/session"
+	"github.com/docker/docker/client/session/filesync"
 	"github.com/docker/docker/integration-cli/checker"
 	"github.com/docker/docker/integration-cli/cli/build/fakecontext"
 	"github.com/docker/docker/integration-cli/cli/build/fakegit"
@@ -15,6 +21,10 @@ import (
 	"github.com/docker/docker/integration-cli/request"
 	"github.com/docker/docker/pkg/testutil"
 	"github.com/go-check/check"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/net/context"
+	"golang.org/x/sync/errgroup"
 )
 
 func (s *DockerSuite) TestBuildAPIDockerFileRemote(c *check.C) {
@@ -249,3 +259,233 @@ func (s *DockerSuite) TestBuildAPIUnnormalizedTarPaths(c *check.C) {
 
 	c.Assert(imageA, checker.Not(checker.Equals), imageB)
 }
+
+func (s *DockerSuite) TestBuildOnBuildWithCopy(c *check.C) {
+	dockerfile := `
+		FROM ` + minimalBaseImage() + ` as onbuildbase
+		ONBUILD COPY file /file
+
+		FROM onbuildbase
+	`
+	ctx := fakecontext.New(c, "",
+		fakecontext.WithDockerfile(dockerfile),
+		fakecontext.WithFile("file", "some content"),
+	)
+	defer ctx.Close()
+
+	res, body, err := request.Post(
+		"/build",
+		request.RawContent(ctx.AsTarReader(c)),
+		request.ContentType("application/x-tar"))
+	c.Assert(err, checker.IsNil)
+	c.Assert(res.StatusCode, checker.Equals, http.StatusOK)
+
+	out, err := testutil.ReadBody(body)
+	c.Assert(err, checker.IsNil)
+	c.Assert(string(out), checker.Contains, "Successfully built")
+}
+
+func (s *DockerSuite) TestBuildOnBuildCache(c *check.C) {
+	build := func(dockerfile string) []byte {
+		ctx := fakecontext.New(c, "",
+			fakecontext.WithDockerfile(dockerfile),
+		)
+		defer ctx.Close()
+
+		res, body, err := request.Post(
+			"/build",
+			request.RawContent(ctx.AsTarReader(c)),
+			request.ContentType("application/x-tar"))
+		require.NoError(c, err)
+		assert.Equal(c, http.StatusOK, res.StatusCode)
+
+		out, err := testutil.ReadBody(body)
+		require.NoError(c, err)
+		assert.Contains(c, string(out), "Successfully built")
+		return out
+	}
+
+	dockerfile := `
+		FROM ` + minimalBaseImage() + ` as onbuildbase
+		ENV something=bar
+		ONBUILD ENV foo=bar
+	`
+	build(dockerfile)
+
+	dockerfile += "FROM onbuildbase"
+	out := build(dockerfile)
+
+	imageIDs := getImageIDsFromBuild(c, out)
+	assert.Len(c, imageIDs, 2)
+	parentID, childID := imageIDs[0], imageIDs[1]
+
+	client, err := request.NewClient()
+	require.NoError(c, err)
+
+	// check parentID is correct
+	image, _, err := client.ImageInspectWithRaw(context.Background(), childID)
+	require.NoError(c, err)
+	assert.Equal(c, parentID, image.Parent)
+}
+
+func (s *DockerRegistrySuite) TestBuildCopyFromForcePull(c *check.C) {
+	client, err := request.NewClient()
+	require.NoError(c, err)
+
+	repoName := fmt.Sprintf("%v/dockercli/busybox", privateRegistryURL)
+	// tag the image to upload it to the private registry
+	err = client.ImageTag(context.TODO(), "busybox", repoName)
+	assert.Nil(c, err)
+	// push the image to the registry
+	rc, err := client.ImagePush(context.TODO(), repoName, types.ImagePushOptions{RegistryAuth: "{}"})
+	assert.Nil(c, err)
+	_, err = io.Copy(ioutil.Discard, rc)
+	assert.Nil(c, err)
+
+	dockerfile := fmt.Sprintf(`
+		FROM %s AS foo
+		RUN touch abc
+		FROM %s
+		COPY --from=foo /abc /
+		`, repoName, repoName)
+
+	ctx := fakecontext.New(c, "",
+		fakecontext.WithDockerfile(dockerfile),
+	)
+	defer ctx.Close()
+
+	res, body, err := request.Post(
+		"/build?pull=1",
+		request.RawContent(ctx.AsTarReader(c)),
+		request.ContentType("application/x-tar"))
+	require.NoError(c, err)
+	assert.Equal(c, http.StatusOK, res.StatusCode)
+
+	out, err := testutil.ReadBody(body)
+	require.NoError(c, err)
+	assert.Contains(c, string(out), "Successfully built")
+}
+
+func (s *DockerSuite) TestBuildWithSession(c *check.C) {
+	testRequires(c, ExperimentalDaemon)
+
+	dockerfile := `
+		FROM busybox
+		COPY file /
+		RUN cat /file
+	`
+
+	fctx := fakecontext.New(c, "",
+		fakecontext.WithFile("file", "some content"),
+	)
+	defer fctx.Close()
+
+	out := testBuildWithSession(c, fctx.Dir, dockerfile)
+	assert.Contains(c, out, "some content")
+
+	fctx.Add("second", "contentcontent")
+
+	dockerfile += `
+	COPY second /
+	RUN cat /second
+	`
+
+	out = testBuildWithSession(c, fctx.Dir, dockerfile)
+	assert.Equal(c, strings.Count(out, "Using cache"), 2)
+	assert.Contains(c, out, "contentcontent")
+
+	client, err := request.NewClient()
+	require.NoError(c, err)
+
+	du, err := client.DiskUsage(context.TODO())
+	assert.Nil(c, err)
+	assert.True(c, du.BuilderSize > 10)
+
+	out = testBuildWithSession(c, fctx.Dir, dockerfile)
+	assert.Equal(c, strings.Count(out, "Using cache"), 4)
+
+	du2, err := client.DiskUsage(context.TODO())
+	assert.Nil(c, err)
+	assert.Equal(c, du.BuilderSize, du2.BuilderSize)
+
+	// rebuild with regular tar, confirm cache still applies
+	fctx.Add("Dockerfile", dockerfile)
+	res, body, err := request.Post(
+		"/build",
+		request.RawContent(fctx.AsTarReader(c)),
+		request.ContentType("application/x-tar"))
+	require.NoError(c, err)
+	assert.Equal(c, http.StatusOK, res.StatusCode)
+
+	outBytes, err := testutil.ReadBody(body)
+	require.NoError(c, err)
+	assert.Contains(c, string(outBytes), "Successfully built")
+	assert.Equal(c, strings.Count(string(outBytes), "Using cache"), 4)
+
+	_, err = client.BuildCachePrune(context.TODO())
+	assert.Nil(c, err)
+
+	du, err = client.DiskUsage(context.TODO())
+	assert.Nil(c, err)
+	assert.Equal(c, du.BuilderSize, int64(0))
+}
+
+func testBuildWithSession(c *check.C, dir, dockerfile string) (outStr string) {
+	client, err := request.NewClient()
+	require.NoError(c, err)
+
+	sess, err := session.NewSession("foo1", "foo")
+	assert.Nil(c, err)
+
+	fsProvider := filesync.NewFSSyncProvider(dir, nil)
+	sess.Allow(fsProvider)
+
+	g, ctx := errgroup.WithContext(context.Background())
+
+	g.Go(func() error {
+		return sess.Run(ctx, client.DialSession)
+	})
+
+	g.Go(func() error {
+		res, body, err := request.Post("/build?remote=client-session&session="+sess.UUID(), func(req *http.Request) error {
+			req.Body = ioutil.NopCloser(strings.NewReader(dockerfile))
+			return nil
+		})
+		if err != nil {
+			return err
+		}
+		assert.Equal(c, res.StatusCode, http.StatusOK)
+		out, err := testutil.ReadBody(body)
+		require.NoError(c, err)
+		assert.Contains(c, string(out), "Successfully built")
+		sess.Close()
+		outStr = string(out)
+		return nil
+	})
+
+	err = g.Wait()
+	assert.Nil(c, err)
+	return
+}
+
+type buildLine struct {
+	Stream string
+	Aux    struct {
+		ID string
+	}
+}
+
+func getImageIDsFromBuild(c *check.C, output []byte) []string {
+	ids := []string{}
+	for _, line := range bytes.Split(output, []byte("\n")) {
+		if len(line) == 0 {
+			continue
+		}
+		entry := buildLine{}
+		require.NoError(c, json.Unmarshal(line, &entry))
+		if entry.Aux.ID != "" {
+			ids = append(ids, entry.Aux.ID)
+		}
+	}
+	return ids
+}
diff --git a/components/engine/integration-cli/docker_api_containers_test.go b/components/engine/integration-cli/docker_api_containers_test.go
index e2b20b746b..84e009207a 100644
--- a/components/engine/integration-cli/docker_api_containers_test.go
+++ b/components/engine/integration-cli/docker_api_containers_test.go
@@ -1933,3 +1933,18 @@ func (s *DockerSuite) TestContainersAPICreateMountsTmpfs(c *check.C) {
 		}
 	}
 }
+
+// Regression test for #33334
+// Makes sure that when a container which has a custom stop signal + restart=always
+// gets killed (with SIGKILL) by the kill API, that the restart policy is cancelled.
+func (s *DockerSuite) TestContainerKillCustomStopSignal(c *check.C) {
+	id := strings.TrimSpace(runSleepingContainer(c, "--stop-signal=SIGTERM", "--restart=always"))
+	res, _, err := request.Post("/containers/" + id + "/kill")
+	c.Assert(err, checker.IsNil)
+	defer res.Body.Close()
+
+	b, err := ioutil.ReadAll(res.Body)
+	c.Assert(res.StatusCode, checker.Equals, http.StatusNoContent, check.Commentf(string(b)))
+	err = waitInspect(id, "{{.State.Running}} {{.State.Restarting}}", "false false", 30*time.Second)
+	c.Assert(err, checker.IsNil)
+}
diff --git a/components/engine/integration-cli/docker_api_info_test.go b/components/engine/integration-cli/docker_api_info_test.go
index 57dac36e18..9cb873d608 100644
--- a/components/engine/integration-cli/docker_api_info_test.go
+++ b/components/engine/integration-cli/docker_api_info_test.go
@@ -3,8 +3,11 @@ package main
 import (
 	"net/http"
 
+	"encoding/json"
+	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/integration-cli/checker"
 	"github.com/docker/docker/integration-cli/request"
+	"github.com/docker/docker/pkg/testutil"
 	"github.com/go-check/check"
 )
 
@@ -40,6 +43,25 @@ func (s *DockerSuite) TestInfoAPI(c *check.C) {
 	}
 }
 
+// TestInfoAPIRuncCommit tests that dockerd is able to obtain RunC version
+// information, and that the version matches the expected version
+func (s *DockerSuite) TestInfoAPIRuncCommit(c *check.C) {
+	testRequires(c, DaemonIsLinux) // Windows does not have RunC version information
+
+	res, body, err := request.Get("/v1.30/info")
+	c.Assert(res.StatusCode, checker.Equals, http.StatusOK)
+	c.Assert(err, checker.IsNil)
+
+	b, err := testutil.ReadBody(body)
+	c.Assert(err, checker.IsNil)
+
+	var i types.Info
+
+	c.Assert(json.Unmarshal(b, &i), checker.IsNil)
+	c.Assert(i.RuncCommit.ID, checker.Not(checker.Equals), "N/A")
+	c.Assert(i.RuncCommit.ID, checker.Equals, i.RuncCommit.Expected)
+}
+
 func (s *DockerSuite) TestInfoAPIVersioned(c *check.C) {
 	testRequires(c, DaemonIsLinux) // Windows only supports 1.25 or later
 	endpoint := "/v1.20/info"
diff --git a/components/engine/integration-cli/docker_api_logs_test.go b/components/engine/integration-cli/docker_api_logs_test.go
index 535b210a3b..5e953b79de 100644
--- a/components/engine/integration-cli/docker_api_logs_test.go
+++ b/components/engine/integration-cli/docker_api_logs_test.go
@@ -19,34 +19,31 @@ func (s *DockerSuite) TestLogsAPIWithStdout(c *check.C) {
 
 	type logOut struct {
 		out string
-		res *http.Response
 		err error
 	}
+
 	chLog := make(chan logOut)
+	res, body, err := request.Get(fmt.Sprintf("/containers/%s/logs?follow=1&stdout=1&timestamps=1", id))
+	c.Assert(err, checker.IsNil)
+	c.Assert(res.StatusCode, checker.Equals, http.StatusOK)
 
 	go func() {
-		res, body, err := request.Get(fmt.Sprintf("/containers/%s/logs?follow=1&stdout=1&timestamps=1", id))
-		if err != nil {
-			chLog <- logOut{"", nil, err}
-			return
-		}
 		defer body.Close()
 		out, err := bufio.NewReader(body).ReadString('\n')
 		if err != nil {
-			chLog <- logOut{"", nil, err}
+			chLog <- logOut{"", err}
 			return
 		}
-		chLog <- logOut{strings.TrimSpace(out), res, err}
+		chLog <- logOut{strings.TrimSpace(out), err}
 	}()
 
 	select {
 	case l := <-chLog:
 		c.Assert(l.err, checker.IsNil)
-		c.Assert(l.res.StatusCode, checker.Equals, http.StatusOK)
 		if !strings.HasSuffix(l.out, "hello") {
 			c.Fatalf("expected log output to container 'hello', but it does not")
 		}
-	case <-time.After(20 * time.Second):
+	case <-time.After(30 * time.Second):
 		c.Fatal("timeout waiting for logs to exit")
 	}
 }
diff --git a/components/engine/integration-cli/docker_api_session_test.go b/components/engine/integration-cli/docker_api_session_test.go
new file mode 100644
index 0000000000..e1ad880ea7
--- /dev/null
+++ b/components/engine/integration-cli/docker_api_session_test.go
@@ -0,0 +1,49 @@
+package main
+
+import (
+	"net/http"
+
+	"github.com/docker/docker/integration-cli/checker"
+	"github.com/docker/docker/integration-cli/request"
+	"github.com/docker/docker/pkg/testutil"
+	"github.com/go-check/check"
+)
+
+func (s *DockerSuite) TestSessionCreate(c *check.C) {
+	testRequires(c, ExperimentalDaemon)
+
+	res, body, err := request.Post("/session", func(r *http.Request) error {
+		r.Header.Set("X-Docker-Expose-Session-Uuid", "testsessioncreate") // so we don't block default name if something else is using it
+		r.Header.Set("Upgrade", "h2c")
+		return nil
+	})
+	c.Assert(err, checker.IsNil)
+	c.Assert(res.StatusCode, checker.Equals, http.StatusSwitchingProtocols)
+	c.Assert(res.Header.Get("Upgrade"), checker.Equals, "h2c")
+	c.Assert(body.Close(), checker.IsNil)
+}
+
+func (s *DockerSuite) TestSessionCreateWithBadUpgrade(c *check.C) {
+	testRequires(c, ExperimentalDaemon)
+
+	res, body, err := request.Post("/session")
+	c.Assert(err, checker.IsNil)
+	c.Assert(res.StatusCode, checker.Equals, http.StatusBadRequest)
+	buf, err := testutil.ReadBody(body)
+	c.Assert(err, checker.IsNil)
+
+	out := string(buf)
+	c.Assert(out, checker.Contains, "no upgrade")
+
+	res, body, err = request.Post("/session", func(r *http.Request) error {
+		r.Header.Set("Upgrade", "foo")
+		return nil
+	})
+	c.Assert(err, checker.IsNil)
+	c.Assert(res.StatusCode, checker.Equals, http.StatusBadRequest)
+	buf, err = testutil.ReadBody(body)
+	c.Assert(err, checker.IsNil)
+
+	out = string(buf)
+	c.Assert(out, checker.Contains, "not supported")
+}
diff --git a/components/engine/integration-cli/docker_api_swarm_config_test.go b/components/engine/integration-cli/docker_api_swarm_config_test.go
index 5d80ad0661..fab65ccbd0 100644
--- a/components/engine/integration-cli/docker_api_swarm_config_test.go
+++ b/components/engine/integration-cli/docker_api_swarm_config_test.go
@@ -114,5 +114,5 @@ func (s *DockerSwarmSuite) TestAPISwarmConfigsUpdate(c *check.C) {
 	status, out, err := d.SockRequest("POST", url, config.Spec)
 
 	c.Assert(err, checker.IsNil, check.Commentf(string(out)))
-	c.Assert(status, checker.Equals, http.StatusInternalServerError, check.Commentf("output: %q", string(out)))
+	c.Assert(status, checker.Equals, http.StatusBadRequest, check.Commentf("output: %q", string(out)))
 }
diff --git a/components/engine/integration-cli/docker_api_swarm_secret_test.go b/components/engine/integration-cli/docker_api_swarm_secret_test.go
index 64a1fc8d87..cb82af8e2e 100644
--- a/components/engine/integration-cli/docker_api_swarm_secret_test.go
+++ b/components/engine/integration-cli/docker_api_swarm_secret_test.go
@@ -23,18 +23,25 @@ func (s *DockerSwarmSuite) TestAPISwarmSecretsCreate(c *check.C) {
 	d := s.AddDaemon(c, true, true)
 
 	testName := "test_secret"
-	id := d.CreateSecret(c, swarm.SecretSpec{
+	secretSpec := swarm.SecretSpec{
 		Annotations: swarm.Annotations{
 			Name: testName,
 		},
 		Data: []byte("TESTINGDATA"),
-	})
+	}
+
+	id := d.CreateSecret(c, secretSpec)
 	c.Assert(id, checker.Not(checker.Equals), "", check.Commentf("secrets: %s", id))
 
 	secrets := d.ListSecrets(c)
 	c.Assert(len(secrets), checker.Equals, 1, check.Commentf("secrets: %#v", secrets))
 	name := secrets[0].Spec.Annotations.Name
 	c.Assert(name, checker.Equals, testName, check.Commentf("secret: %s", name))
+
+	// create an already existing secret, daemon should return a status code of 409
+	status, out, err := d.SockRequest("POST", "/secrets/create", secretSpec)
+	c.Assert(err, checker.IsNil)
+	c.Assert(status, checker.Equals, http.StatusConflict, check.Commentf("secret create: %s", string(out)))
 }
 
 func (s *DockerSwarmSuite) TestAPISwarmSecretsDelete(c *check.C) {
@@ -55,6 +62,13 @@ func (s *DockerSwarmSuite) TestAPISwarmSecretsDelete(c *check.C) {
 	status, out, err := d.SockRequest("GET", "/secrets/"+id, nil)
 	c.Assert(err, checker.IsNil)
 	c.Assert(status, checker.Equals, http.StatusNotFound, check.Commentf("secret delete: %s", string(out)))
+
+	// delete non-existing secret, daemon should return a status code of 404
+	id = "non-existing"
+	status, out, err = d.SockRequest("DELETE", "/secrets/"+id, nil)
+	c.Assert(err, checker.IsNil)
+	c.Assert(status, checker.Equals, http.StatusNotFound, check.Commentf("secret delete: %s", string(out)))
+
 }
 
 func (s *DockerSwarmSuite) TestAPISwarmSecretsUpdate(c *check.C) {
@@ -114,5 +128,5 @@ func (s *DockerSwarmSuite) TestAPISwarmSecretsUpdate(c *check.C) {
 	status, out, err := d.SockRequest("POST", url, secret.Spec)
 
 	c.Assert(err, checker.IsNil, check.Commentf(string(out)))
-	c.Assert(status, checker.Equals, http.StatusInternalServerError, check.Commentf("output: %q", string(out)))
+	c.Assert(status, checker.Equals, http.StatusBadRequest, check.Commentf("output: %q", string(out)))
 }
diff --git a/components/engine/integration-cli/docker_api_swarm_test.go b/components/engine/integration-cli/docker_api_swarm_test.go
index 9f3f3e53ca..03cf899d71 100644
--- a/components/engine/integration-cli/docker_api_swarm_test.go
+++ b/components/engine/integration-cli/docker_api_swarm_test.go
@@ -8,6 +8,7 @@ import (
 	"io/ioutil"
 	"net"
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
@@ -229,7 +230,7 @@ func (s *DockerSwarmSuite) TestAPISwarmPromoteDemote(c *check.C) {
 	url := fmt.Sprintf("/nodes/%s/update?version=%d", node.ID, node.Version.Index)
 	status, out, err := d1.SockRequest("POST", url, node.Spec)
 	c.Assert(err, checker.IsNil)
-	c.Assert(status, checker.Equals, http.StatusInternalServerError, check.Commentf("output: %q", string(out)))
+	c.Assert(status, checker.Equals, http.StatusBadRequest, check.Commentf("output: %q", string(out)))
 	// The warning specific to demoting the last manager is best-effort and
 	// won't appear until the Role field of the demoted manager has been
 	// updated.
@@ -966,20 +967,21 @@ func (s *DockerSwarmSuite) TestSwarmRepeatedRootRotation(c *check.C) {
 		for j := 0; j < 18; j++ {
 			info, err := m.SwarmInfo()
 			c.Assert(err, checker.IsNil)
-			c.Assert(info.Cluster.Spec.CAConfig.SigningCACert, checker.Equals, expectedCert)
-			// the desired CA key is always redacted
+
+			// the desired CA cert and key is always redacted
 			c.Assert(info.Cluster.Spec.CAConfig.SigningCAKey, checker.Equals, "")
+			c.Assert(info.Cluster.Spec.CAConfig.SigningCACert, checker.Equals, "")
 
 			clusterTLSInfo = info.Cluster.TLSInfo
 
-			if !info.Cluster.RootRotationInProgress {
+			// if root rotation is done and the trust root has changed, we don't have to poll anymore
+			if !info.Cluster.RootRotationInProgress && clusterTLSInfo.TrustRoot != currentTrustRoot {
 				break
 			}
 
 			// root rotation not done
 			time.Sleep(250 * time.Millisecond)
 		}
-		c.Assert(clusterTLSInfo.TrustRoot, checker.Not(checker.Equals), currentTrustRoot)
 		if cert != nil {
 			c.Assert(clusterTLSInfo.TrustRoot, checker.Equals, expectedCert)
 		}
@@ -1002,3 +1004,36 @@ func (s *DockerSwarmSuite) TestSwarmRepeatedRootRotation(c *check.C) {
 		currentTrustRoot = clusterTLSInfo.TrustRoot
 	}
 }
+
+func (s *DockerSwarmSuite) TestAPINetworkInspectWithScope(c *check.C) {
+	d := s.AddDaemon(c, true, true)
+
+	name := "foo"
+	networkCreateRequest := types.NetworkCreateRequest{
+		Name: name,
+	}
+
+	var n types.NetworkCreateResponse
+	networkCreateRequest.NetworkCreate.Driver = "overlay"
+
+	status, out, err := d.SockRequest("POST", "/networks/create", networkCreateRequest)
+	c.Assert(err, checker.IsNil, check.Commentf(string(out)))
+	c.Assert(status, checker.Equals, http.StatusCreated, check.Commentf(string(out)))
+	c.Assert(json.Unmarshal(out, &n), checker.IsNil)
+
+	var r types.NetworkResource
+
+	status, body, err := d.SockRequest("GET", "/networks/"+name, nil)
+	c.Assert(err, checker.IsNil, check.Commentf(string(out)))
+	c.Assert(status, checker.Equals, http.StatusOK, check.Commentf(string(out)))
+	c.Assert(json.Unmarshal(body, &r), checker.IsNil)
+	c.Assert(r.Scope, checker.Equals, "swarm")
+	c.Assert(r.ID, checker.Equals, n.ID)
+
+	v := url.Values{}
+	v.Set("scope", "local")
+
+	status, body, err = d.SockRequest("GET", "/networks/"+name+"?"+v.Encode(), nil)
+	c.Assert(err, checker.IsNil, check.Commentf(string(out)))
+	c.Assert(status, checker.Equals, http.StatusNotFound, check.Commentf(string(out)))
+}
diff --git a/components/engine/integration-cli/docker_cli_build_test.go b/components/engine/integration-cli/docker_cli_build_test.go
index 482de38b6c..b9a5dff789 100644
--- a/components/engine/integration-cli/docker_cli_build_test.go
+++ b/components/engine/integration-cli/docker_cli_build_test.go
@@ -5870,15 +5870,17 @@ func (s *DockerSuite) TestBuildCopyFromPreviousRootFS(c *check.C) {
 	dockerfile := `
 		FROM busybox AS first
 		COPY foo bar
+
 		FROM busybox
-    %s
-    COPY baz baz
-    RUN echo mno > baz/cc
+		%s
+		COPY baz baz
+		RUN echo mno > baz/cc
+
 		FROM busybox
-    COPY bar /
-    COPY --from=1 baz sub/
-    COPY --from=0 bar baz
-    COPY --from=first bar bay`
+		COPY bar /
+		COPY --from=1 baz sub/
+		COPY --from=0 bar baz
+		COPY --from=first bar bay`
 
 	ctx := fakecontext.New(c, "",
 		fakecontext.WithDockerfile(fmt.Sprintf(dockerfile, "")),
@@ -5892,32 +5894,25 @@ func (s *DockerSuite) TestBuildCopyFromPreviousRootFS(c *check.C) {
 
 	cli.BuildCmd(c, "build1", build.WithExternalBuildContext(ctx))
 
-	out := cli.DockerCmd(c, "run", "build1", "cat", "bar").Combined()
-	c.Assert(strings.TrimSpace(out), check.Equals, "def")
-	out = cli.DockerCmd(c, "run", "build1", "cat", "sub/aa").Combined()
-	c.Assert(strings.TrimSpace(out), check.Equals, "ghi")
-	out = cli.DockerCmd(c, "run", "build1", "cat", "sub/cc").Combined()
-	c.Assert(strings.TrimSpace(out), check.Equals, "mno")
-	out = cli.DockerCmd(c, "run", "build1", "cat", "baz").Combined()
-	c.Assert(strings.TrimSpace(out), check.Equals, "abc")
-	out = cli.DockerCmd(c, "run", "build1", "cat", "bay").Combined()
-	c.Assert(strings.TrimSpace(out), check.Equals, "abc")
+	cli.DockerCmd(c, "run", "build1", "cat", "bar").Assert(c, icmd.Expected{Out: "def"})
+	cli.DockerCmd(c, "run", "build1", "cat", "sub/aa").Assert(c, icmd.Expected{Out: "ghi"})
+	cli.DockerCmd(c, "run", "build1", "cat", "sub/cc").Assert(c, icmd.Expected{Out: "mno"})
+	cli.DockerCmd(c, "run", "build1", "cat", "baz").Assert(c, icmd.Expected{Out: "abc"})
+	cli.DockerCmd(c, "run", "build1", "cat", "bay").Assert(c, icmd.Expected{Out: "abc"})
 
 	result := cli.BuildCmd(c, "build2", build.WithExternalBuildContext(ctx))
 
 	// all commands should be cached
 	c.Assert(strings.Count(result.Combined(), "Using cache"), checker.Equals, 7)
+	c.Assert(getIDByName(c, "build1"), checker.Equals, getIDByName(c, "build2"))
 
 	err := ioutil.WriteFile(filepath.Join(ctx.Dir, "Dockerfile"), []byte(fmt.Sprintf(dockerfile, "COPY baz/aa foo")), 0644)
 	c.Assert(err, checker.IsNil)
 
 	// changing file in parent block should not affect last block
 	result = cli.BuildCmd(c, "build3", build.WithExternalBuildContext(ctx))
-
 	c.Assert(strings.Count(result.Combined(), "Using cache"), checker.Equals, 5)
 
-	c.Assert(getIDByName(c, "build1"), checker.Equals, getIDByName(c, "build2"))
-
 	err = ioutil.WriteFile(filepath.Join(ctx.Dir, "foo"), []byte("pqr"), 0644)
 	c.Assert(err, checker.IsNil)
 
@@ -5925,10 +5920,8 @@ func (s *DockerSuite) TestBuildCopyFromPreviousRootFS(c *check.C) {
 	result = cli.BuildCmd(c, "build4", build.WithExternalBuildContext(ctx))
 	c.Assert(strings.Count(result.Combined(), "Using cache"), checker.Equals, 5)
 
-	out = cli.DockerCmd(c, "run", "build4", "cat", "bay").Combined()
-	c.Assert(strings.TrimSpace(out), check.Equals, "pqr")
-	out = cli.DockerCmd(c, "run", "build4", "cat", "baz").Combined()
-	c.Assert(strings.TrimSpace(out), check.Equals, "pqr")
+	cli.DockerCmd(c, "run", "build4", "cat", "bay").Assert(c, icmd.Expected{Out: "pqr"})
+	cli.DockerCmd(c, "run", "build4", "cat", "baz").Assert(c, icmd.Expected{Out: "pqr"})
 }
 
 func (s *DockerSuite) TestBuildCopyFromPreviousRootFSErrors(c *check.C) {
diff --git a/components/engine/integration-cli/docker_cli_config_test.go b/components/engine/integration-cli/docker_cli_config_test.go
index 08521c171d..46fe456bd5 100644
--- a/components/engine/integration-cli/docker_cli_config_test.go
+++ b/components/engine/integration-cli/docker_cli_config_test.go
@@ -58,8 +58,7 @@ func (s *DockerSuite) TestConfigHTTPHeader(c *check.C) {
 
 	c.Assert(headers["User-Agent"], checker.NotNil, check.Commentf("Missing User-Agent"))
 
-	//TODO(tiborvass): restore dockerversion.Version instead of library-import
-	c.Assert(headers["User-Agent"][0], checker.Equals, "Docker-Client/unknown-version ("+runtime.GOOS+")", check.Commentf("Badly formatted User-Agent,out:%v", result.Combined()))
+	c.Assert(headers["User-Agent"][0], checker.Equals, "Docker-Client/"+os.Getenv("DOCKER_CLI_VERSION")+" ("+runtime.GOOS+")", check.Commentf("Badly formatted User-Agent,out:%v", result.Combined()))
 
 	c.Assert(headers["Myheader"], checker.NotNil)
 	c.Assert(headers["Myheader"][0], checker.Equals, "MyValue", check.Commentf("Missing/bad header,out:%v", result.Combined()))
diff --git a/components/engine/integration-cli/docker_cli_daemon_test.go b/components/engine/integration-cli/docker_cli_daemon_test.go
index 4ec5ac230d..9046fe6ea6 100644
--- a/components/engine/integration-cli/docker_cli_daemon_test.go
+++ b/components/engine/integration-cli/docker_cli_daemon_test.go
@@ -1789,7 +1789,7 @@ func (s *DockerDaemonSuite) TestDaemonNoSpaceLeftOnDeviceError(c *check.C) {
 
 	// create a 2MiB image and mount it as graph root
 	// Why in a container? Because `mount` sometimes behaves weirdly and often fails outright on this test in debian:jessie (which is what the test suite runs under if run from the Makefile)
-	dockerCmd(c, "run", "--rm", "-v", testDir+":/test", "busybox", "sh", "-c", "dd of=/test/testfs.img bs=1M seek=2 count=0")
+	dockerCmd(c, "run", "--rm", "-v", testDir+":/test", "busybox", "sh", "-c", "dd of=/test/testfs.img bs=1M seek=3 count=0")
 	icmd.RunCommand("mkfs.ext4", "-F", filepath.Join(testDir, "testfs.img")).Assert(c, icmd.Success)
 
 	result := icmd.RunCommand("losetup", "-f", "--show", filepath.Join(testDir, "testfs.img"))
@@ -2684,7 +2684,7 @@ func (s *DockerDaemonSuite) TestDaemonBackcompatPre17Volumes(c *check.C) {
 	`)
 
 	configPath := filepath.Join(d.Root, "containers", id, "config.v2.json")
-	err = ioutil.WriteFile(configPath, config, 600)
+	c.Assert(ioutil.WriteFile(configPath, config, 600), checker.IsNil)
 	d.Start(c)
 
 	out, err = d.Cmd("inspect", "--type=container", "--format={{ json .Mounts }}", id)
diff --git a/components/engine/integration-cli/docker_cli_login_test.go b/components/engine/integration-cli/docker_cli_login_test.go
index f805035769..94dc03778f 100644
--- a/components/engine/integration-cli/docker_cli_login_test.go
+++ b/components/engine/integration-cli/docker_cli_login_test.go
@@ -28,17 +28,3 @@ func (s *DockerRegistryAuthHtpasswdSuite) TestLoginToPrivateRegistry(c *check.C)
 	// now it's fine
 	dockerCmd(c, "login", "-u", s.reg.Username(), "-p", s.reg.Password(), privateRegistryURL)
 }
-
-func (s *DockerRegistryAuthHtpasswdSuite) TestLoginToPrivateRegistryDeprecatedEmailFlag(c *check.C) {
-	// Test to make sure login still works with the deprecated -e and --email flags
-	// wrong credentials
-	out, _, err := dockerCmdWithError("login", "-u", s.reg.Username(), "-p", "WRONGPASSWORD", "-e", s.reg.Email(), privateRegistryURL)
-	c.Assert(err, checker.NotNil, check.Commentf(out))
-	c.Assert(out, checker.Contains, "401 Unauthorized")
-
-	// now it's fine
-	// -e flag
-	dockerCmd(c, "login", "-u", s.reg.Username(), "-p", s.reg.Password(), "-e", s.reg.Email(), privateRegistryURL)
-	// --email flag
-	dockerCmd(c, "login", "-u", s.reg.Username(), "-p", s.reg.Password(), "--email", s.reg.Email(), privateRegistryURL)
-}
diff --git a/components/engine/integration-cli/docker_cli_logout_test.go b/components/engine/integration-cli/docker_cli_logout_test.go
index 49ee1f7866..5076ceba09 100644
--- a/components/engine/integration-cli/docker_cli_logout_test.go
+++ b/components/engine/integration-cli/docker_cli_logout_test.go
@@ -13,6 +13,10 @@ import (
 )
 
 func (s *DockerRegistryAuthHtpasswdSuite) TestLogoutWithExternalAuth(c *check.C) {
+
+	// @TODO TestLogoutWithExternalAuth expects docker to fall back to a v1 registry, so has to be updated for v17.12, when v1 registries are no longer supported
+	s.d.StartWithBusybox(c, "--disable-legacy-registry=false")
+
 	osPath := os.Getenv("PATH")
 	defer os.Setenv("PATH", osPath)
 
@@ -28,6 +32,7 @@ func (s *DockerRegistryAuthHtpasswdSuite) TestLogoutWithExternalAuth(c *check.C)
 
 	tmp, err := ioutil.TempDir("", "integration-cli-")
 	c.Assert(err, checker.IsNil)
+	defer os.RemoveAll(tmp)
 
 	externalAuthConfig := `{ "credsStore": "shell-test" }`
 
@@ -35,24 +40,27 @@ func (s *DockerRegistryAuthHtpasswdSuite) TestLogoutWithExternalAuth(c *check.C)
 	err = ioutil.WriteFile(configPath, []byte(externalAuthConfig), 0644)
 	c.Assert(err, checker.IsNil)
 
-	dockerCmd(c, "--config", tmp, "login", "-u", s.reg.Username(), "-p", s.reg.Password(), privateRegistryURL)
+	_, err = s.d.Cmd("--config", tmp, "login", "-u", s.reg.Username(), "-p", s.reg.Password(), privateRegistryURL)
+	c.Assert(err, checker.IsNil)
 
 	b, err := ioutil.ReadFile(configPath)
 	c.Assert(err, checker.IsNil)
 	c.Assert(string(b), checker.Not(checker.Contains), "\"auth\":")
 	c.Assert(string(b), checker.Contains, privateRegistryURL)
 
-	dockerCmd(c, "--config", tmp, "tag", "busybox", repoName)
-	dockerCmd(c, "--config", tmp, "push", repoName)
-
-	dockerCmd(c, "--config", tmp, "logout", privateRegistryURL)
+	_, err = s.d.Cmd("--config", tmp, "tag", "busybox", repoName)
+	c.Assert(err, checker.IsNil)
+	_, err = s.d.Cmd("--config", tmp, "push", repoName)
+	c.Assert(err, checker.IsNil)
+	_, err = s.d.Cmd("--config", tmp, "logout", privateRegistryURL)
+	c.Assert(err, checker.IsNil)
 
 	b, err = ioutil.ReadFile(configPath)
 	c.Assert(err, checker.IsNil)
 	c.Assert(string(b), checker.Not(checker.Contains), privateRegistryURL)
 
 	// check I cannot pull anymore
-	out, _, err := dockerCmdWithError("--config", tmp, "pull", repoName)
+	out, err := s.d.Cmd("--config", tmp, "pull", repoName)
 	c.Assert(err, check.NotNil, check.Commentf(out))
 	c.Assert(out, checker.Contains, "Error: image dockercli/busybox:authtest not found")
 }
diff --git a/components/engine/integration-cli/docker_cli_pull_test.go b/components/engine/integration-cli/docker_cli_pull_test.go
index 0b1be6cd97..fd91edb81e 100644
--- a/components/engine/integration-cli/docker_cli_pull_test.go
+++ b/components/engine/integration-cli/docker_cli_pull_test.go
@@ -98,11 +98,11 @@ func (s *DockerHubPullSuite) TestPullNonExistingImage(c *check.C) {
 	for record := range recordChan {
 		if len(record.option) == 0 {
 			c.Assert(record.err, checker.NotNil, check.Commentf("expected non-zero exit status when pulling non-existing image: %s", record.out))
-			c.Assert(record.out, checker.Contains, fmt.Sprintf("repository %s not found: does not exist or no pull access", record.e.repo), check.Commentf("expected image not found error messages"))
+			c.Assert(record.out, checker.Contains, fmt.Sprintf("pull access denied for %s, repository does not exist or may require 'docker login'", record.e.repo), check.Commentf("expected image not found error messages"))
 		} else {
 			// pull -a on a nonexistent registry should fall back as well
 			c.Assert(record.err, checker.NotNil, check.Commentf("expected non-zero exit status when pulling non-existing image: %s", record.out))
-			c.Assert(record.out, checker.Contains, fmt.Sprintf("repository %s not found", record.e.repo), check.Commentf("expected image not found error messages"))
+			c.Assert(record.out, checker.Contains, fmt.Sprintf("pull access denied for %s, repository does not exist or may require 'docker login'", record.e.repo), check.Commentf("expected image not found error messages"))
 			c.Assert(record.out, checker.Not(checker.Contains), "unauthorized", check.Commentf(`message should not contain "unauthorized"`))
 		}
 	}
@@ -258,10 +258,13 @@ func (s *DockerHubPullSuite) TestPullClientDisconnect(c *check.C) {
 }
 
 func (s *DockerRegistryAuthHtpasswdSuite) TestPullNoCredentialsNotFound(c *check.C) {
+	// @TODO TestPullNoCredentialsNotFound expects docker to fall back to a v1 registry, so has to be updated for v17.12, when v1 registries are no longer supported
+	s.d.StartWithBusybox(c, "--disable-legacy-registry=false")
+
 	// we don't care about the actual image, we just want to see image not found
 	// because that means v2 call returned 401 and we fell back to v1 which usually
 	// gives a 404 (in this case the test registry doesn't handle v1 at all)
-	out, _, err := dockerCmdWithError("pull", privateRegistryURL+"/busybox")
+	out, err := s.d.Cmd("pull", privateRegistryURL+"/busybox")
 	c.Assert(err, check.NotNil, check.Commentf(out))
 	c.Assert(out, checker.Contains, "Error: image busybox:latest not found")
 }
diff --git a/components/engine/integration-cli/docker_cli_push_test.go b/components/engine/integration-cli/docker_cli_push_test.go
index f0548e6907..2ae206df7d 100644
--- a/components/engine/integration-cli/docker_cli_push_test.go
+++ b/components/engine/integration-cli/docker_cli_push_test.go
@@ -12,7 +12,7 @@ import (
 	"sync"
 
 	"github.com/docker/distribution/reference"
-	"github.com/docker/docker/cli/flags"
+	"github.com/docker/docker/cli/config"
 	"github.com/docker/docker/integration-cli/checker"
 	"github.com/docker/docker/integration-cli/cli"
 	"github.com/docker/docker/integration-cli/cli/build"
@@ -294,7 +294,7 @@ func (s *DockerTrustSuite) TestTrustedPush(c *check.C) {
 	})
 
 	// Assert that we rotated the snapshot key to the server by checking our local keystore
-	contents, err := ioutil.ReadDir(filepath.Join(flags.ConfigurationDir(), "trust/private/tuf_keys", privateRegistryURL, "dockerclitrusted/pushtest"))
+	contents, err := ioutil.ReadDir(filepath.Join(config.Dir(), "trust/private/tuf_keys", privateRegistryURL, "dockerclitrusted/pushtest"))
 	c.Assert(err, check.IsNil, check.Commentf("Unable to read local tuf key files"))
 	// Check that we only have 1 key (targets key)
 	c.Assert(contents, checker.HasLen, 1)
@@ -399,7 +399,7 @@ func (s *DockerTrustSuite) TestTrustedPushWithReleasesDelegationOnly(c *check.C)
 	s.assertTargetNotInRoles(c, repoName, "latest", "targets")
 
 	// Try pull after push
-	os.RemoveAll(filepath.Join(flags.ConfigurationDir(), "trust"))
+	os.RemoveAll(filepath.Join(config.Dir(), "trust"))
 
 	cli.Docker(cli.Args("pull", targetName), trustedCmd).Assert(c, icmd.Expected{
 		Out: "Status: Image is up to date",
@@ -436,7 +436,7 @@ func (s *DockerTrustSuite) TestTrustedPushSignsAllFirstLevelRolesWeHaveKeysFor(c
 	s.assertTargetNotInRoles(c, repoName, "latest", "targets")
 
 	// Try pull after push
-	os.RemoveAll(filepath.Join(flags.ConfigurationDir(), "trust"))
+	os.RemoveAll(filepath.Join(config.Dir(), "trust"))
 
 	// pull should fail because none of these are the releases role
 	cli.Docker(cli.Args("pull", targetName), trustedCmd).Assert(c, icmd.Expected{
@@ -472,7 +472,7 @@ func (s *DockerTrustSuite) TestTrustedPushSignsForRolesWithKeysAndValidPaths(c *
 	s.assertTargetNotInRoles(c, repoName, "latest", "targets")
 
 	// Try pull after push
-	os.RemoveAll(filepath.Join(flags.ConfigurationDir(), "trust"))
+	os.RemoveAll(filepath.Join(config.Dir(), "trust"))
 
 	// pull should fail because none of these are the releases role
 	cli.Docker(cli.Args("pull", targetName), trustedCmd).Assert(c, icmd.Expected{
diff --git a/components/engine/integration-cli/docker_cli_registry_user_agent_test.go b/components/engine/integration-cli/docker_cli_registry_user_agent_test.go
index 5e1c00aa8a..6cbe6e7e66 100644
--- a/components/engine/integration-cli/docker_cli_registry_user_agent_test.go
+++ b/components/engine/integration-cli/docker_cli_registry_user_agent_test.go
@@ -2,7 +2,9 @@ package main
 
 import (
 	"fmt"
+	"io/ioutil"
 	"net/http"
+	"os"
 	"regexp"
 
 	"github.com/docker/docker/integration-cli/registry"
@@ -47,9 +49,14 @@ func regexpCheckUA(c *check.C, ua string) {
 	c.Assert(bMatchUpstreamUA, check.Equals, true, check.Commentf("(Upstream) Docker Client User-Agent malformed"))
 }
 
+// registerUserAgentHandler registers a handler for the `/v2/*` endpoint.
+// Note that a 404 is returned to prevent the client to proceed.
+// We are only checking if the client sent a valid User Agent string along
+// with the request.
 func registerUserAgentHandler(reg *registry.Mock, result *string) {
 	reg.RegisterHandler("/v2/", func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(404)
+		w.Write([]byte(`{"errors":[{"code": "UNSUPPORTED","message": "this is a mock registry"}]}`))
 		var ua string
 		for k, v := range r.Header {
 			if k == "User-Agent" {
@@ -64,61 +71,33 @@ func registerUserAgentHandler(reg *registry.Mock, result *string) {
 // a registry, the registry should see a User-Agent string of the form
 // [docker engine UA] UpstreamClientSTREAM-CLIENT([client UA])
 func (s *DockerRegistrySuite) TestUserAgentPassThrough(c *check.C) {
-	var (
-		buildUA string
-		pullUA  string
-		pushUA  string
-		loginUA string
-	)
+	var ua string
 
-	buildReg, err := registry.NewMock(c)
-	defer buildReg.Close()
+	reg, err := registry.NewMock(c)
+	defer reg.Close()
 	c.Assert(err, check.IsNil)
-	registerUserAgentHandler(buildReg, &buildUA)
-	buildRepoName := fmt.Sprintf("%s/busybox", buildReg.URL())
+	registerUserAgentHandler(reg, &ua)
+	repoName := fmt.Sprintf("%s/busybox", reg.URL())
 
-	pullReg, err := registry.NewMock(c)
-	defer pullReg.Close()
+	s.d.StartWithBusybox(c, "--insecure-registry", reg.URL())
+
+	tmp, err := ioutil.TempDir("", "integration-cli-")
 	c.Assert(err, check.IsNil)
-	registerUserAgentHandler(pullReg, &pullUA)
-	pullRepoName := fmt.Sprintf("%s/busybox", pullReg.URL())
+	defer os.RemoveAll(tmp)
 
-	pushReg, err := registry.NewMock(c)
-	defer pushReg.Close()
-	c.Assert(err, check.IsNil)
-	registerUserAgentHandler(pushReg, &pushUA)
-	pushRepoName := fmt.Sprintf("%s/busybox", pushReg.URL())
-
-	loginReg, err := registry.NewMock(c)
-	defer loginReg.Close()
-	c.Assert(err, check.IsNil)
-	registerUserAgentHandler(loginReg, &loginUA)
-
-	s.d.Start(c,
-		"--insecure-registry", buildReg.URL(),
-		"--insecure-registry", pullReg.URL(),
-		"--insecure-registry", pushReg.URL(),
-		"--insecure-registry", loginReg.URL(),
-		"--disable-legacy-registry=true")
-
-	dockerfileName, cleanup1, err := makefile(fmt.Sprintf("FROM %s", buildRepoName))
+	dockerfile, err := makefile(tmp, fmt.Sprintf("FROM %s", repoName))
 	c.Assert(err, check.IsNil, check.Commentf("Unable to create test dockerfile"))
-	defer cleanup1()
-	s.d.Cmd("build", "--file", dockerfileName, ".")
-	regexpCheckUA(c, buildUA)
 
-	s.d.Cmd("login", "-u", "richard", "-p", "testtest", "-e", "testuser@testdomain.com", loginReg.URL())
-	regexpCheckUA(c, loginUA)
+	s.d.Cmd("build", "--file", dockerfile, tmp)
+	regexpCheckUA(c, ua)
 
-	s.d.Cmd("pull", pullRepoName)
-	regexpCheckUA(c, pullUA)
+	s.d.Cmd("login", "-u", "richard", "-p", "testtest", reg.URL())
+	regexpCheckUA(c, ua)
 
-	dockerfileName, cleanup2, err := makefile(`FROM scratch
-	ENV foo bar`)
-	c.Assert(err, check.IsNil, check.Commentf("Unable to create test dockerfile"))
-	defer cleanup2()
-	s.d.Cmd("build", "-t", pushRepoName, "--file", dockerfileName, ".")
+	s.d.Cmd("pull", repoName)
+	regexpCheckUA(c, ua)
 
-	s.d.Cmd("push", pushRepoName)
-	regexpCheckUA(c, pushUA)
+	s.d.Cmd("tag", "busybox", repoName)
+	s.d.Cmd("push", repoName)
+	regexpCheckUA(c, ua)
 }
diff --git a/components/engine/integration-cli/docker_cli_service_create_test.go b/components/engine/integration-cli/docker_cli_service_create_test.go
index 85a8cba576..6fc92c237d 100644
--- a/components/engine/integration-cli/docker_cli_service_create_test.go
+++ b/components/engine/integration-cli/docker_cli_service_create_test.go
@@ -410,3 +410,38 @@ func (s *DockerSwarmSuite) TestServiceCreateMountTmpfs(c *check.C) {
 	c.Assert(strings.TrimSpace(out), checker.HasPrefix, "tmpfs on /foo type tmpfs")
 	c.Assert(strings.TrimSpace(out), checker.Contains, "size=1024k")
 }
+
+func (s *DockerSwarmSuite) TestServiceCreateWithNetworkAlias(c *check.C) {
+	d := s.AddDaemon(c, true, true)
+	out, err := d.Cmd("network", "create", "--scope=swarm", "test_swarm_br")
+	c.Assert(err, checker.IsNil, check.Commentf(out))
+
+	out, err = d.Cmd("service", "create", "--no-resolve-image", "--detach=true", "--network=name=test_swarm_br,alias=srv_alias", "--name=alias_tst_container", "busybox", "top")
+	c.Assert(err, checker.IsNil, check.Commentf(out))
+	id := strings.TrimSpace(out)
+
+	var tasks []swarm.Task
+	waitAndAssert(c, defaultReconciliationTimeout, func(c *check.C) (interface{}, check.CommentInterface) {
+		tasks = d.GetServiceTasks(c, id)
+		return len(tasks) > 0, nil
+	}, checker.Equals, true)
+
+	task := tasks[0]
+	waitAndAssert(c, defaultReconciliationTimeout, func(c *check.C) (interface{}, check.CommentInterface) {
+		if task.NodeID == "" || task.Status.ContainerStatus.ContainerID == "" {
+			task = d.GetTask(c, task.ID)
+		}
+		return task.NodeID != "" && task.Status.ContainerStatus.ContainerID != "", nil
+	}, checker.Equals, true)
+
+	// check container alias config
+	out, err = s.nodeCmd(c, task.NodeID, "inspect", "--format", "{{json .NetworkSettings.Networks.test_swarm_br.Aliases}}", task.Status.ContainerStatus.ContainerID)
+	c.Assert(err, checker.IsNil, check.Commentf(out))
+
+	// Make sure the only alias seen is the container-id
+	var aliases []string
+	c.Assert(json.Unmarshal([]byte(out), &aliases), checker.IsNil)
+	c.Assert(aliases, checker.HasLen, 1)
+
+	c.Assert(task.Status.ContainerStatus.ContainerID, checker.Contains, aliases[0])
+}
diff --git a/components/engine/integration-cli/docker_cli_service_logs_test.go b/components/engine/integration-cli/docker_cli_service_logs_test.go
index c9af7fc6f7..d38cdefea8 100644
--- a/components/engine/integration-cli/docker_cli_service_logs_test.go
+++ b/components/engine/integration-cli/docker_cli_service_logs_test.go
@@ -287,7 +287,7 @@ func (s *DockerSwarmSuite) TestServiceLogsTTY(c *check.C) {
 	result = icmd.RunCmd(cmd)
 	// for some reason there is carriage return in the output. i think this is
 	// just expected.
-	c.Assert(result, icmd.Matches, icmd.Expected{Out: "out\nerr\n"})
+	c.Assert(result, icmd.Matches, icmd.Expected{Out: "out\r\nerr\r\n"})
 }
 
 func (s *DockerSwarmSuite) TestServiceLogsNoHangDeletedContainer(c *check.C) {
diff --git a/components/engine/integration-cli/docker_cli_v2_only_test.go b/components/engine/integration-cli/docker_cli_v2_only_test.go
index 77974c4ef4..b82cdbde1f 100644
--- a/components/engine/integration-cli/docker_cli_v2_only_test.go
+++ b/components/engine/integration-cli/docker_cli_v2_only_test.go
@@ -10,31 +10,19 @@ import (
 	"github.com/go-check/check"
 )
 
-func makefile(contents string) (string, func(), error) {
-	cleanup := func() {
-
-	}
-
-	f, err := ioutil.TempFile(".", "tmp")
+func makefile(path string, contents string) (string, error) {
+	f, err := ioutil.TempFile(path, "tmp")
 	if err != nil {
-		return "", cleanup, err
+		return "", err
 	}
 	err = ioutil.WriteFile(f.Name(), []byte(contents), os.ModePerm)
 	if err != nil {
-		return "", cleanup, err
+		return "", err
 	}
-
-	cleanup = func() {
-		err := os.Remove(f.Name())
-		if err != nil {
-			fmt.Println("Error removing tmpfile")
-		}
-	}
-	return f.Name(), cleanup, nil
-
+	return f.Name(), nil
 }
 
-// TestV2Only ensures that a daemon in v2-only mode does not
+// TestV2Only ensures that a daemon by default does not
 // attempt to contact any v1 registry endpoints.
 func (s *DockerRegistrySuite) TestV2Only(c *check.C) {
 	reg, err := registry.NewMock(c)
@@ -51,22 +39,25 @@ func (s *DockerRegistrySuite) TestV2Only(c *check.C) {
 
 	repoName := fmt.Sprintf("%s/busybox", reg.URL())
 
-	s.d.Start(c, "--insecure-registry", reg.URL(), "--disable-legacy-registry=true")
+	s.d.Start(c, "--insecure-registry", reg.URL())
 
-	dockerfileName, cleanup, err := makefile(fmt.Sprintf("FROM %s/busybox", reg.URL()))
+	tmp, err := ioutil.TempDir("", "integration-cli-")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmp)
+
+	dockerfileName, err := makefile(tmp, fmt.Sprintf("FROM %s/busybox", reg.URL()))
 	c.Assert(err, check.IsNil, check.Commentf("Unable to create test dockerfile"))
-	defer cleanup()
 
-	s.d.Cmd("build", "--file", dockerfileName, ".")
+	s.d.Cmd("build", "--file", dockerfileName, tmp)
 
 	s.d.Cmd("run", repoName)
-	s.d.Cmd("login", "-u", "richard", "-p", "testtest", "-e", "testuser@testdomain.com", reg.URL())
+	s.d.Cmd("login", "-u", "richard", "-p", "testtest", reg.URL())
 	s.d.Cmd("tag", "busybox", repoName)
 	s.d.Cmd("push", repoName)
 	s.d.Cmd("pull", repoName)
 }
 
-// TestV1 starts a daemon in 'normal' mode
+// TestV1 starts a daemon with legacy registries enabled
 // and ensure v1 endpoints are hit for the following operations:
 // login, push, pull, build & run
 func (s *DockerRegistrySuite) TestV1(c *check.C) {
@@ -102,11 +93,14 @@ func (s *DockerRegistrySuite) TestV1(c *check.C) {
 
 	s.d.Start(c, "--insecure-registry", reg.URL(), "--disable-legacy-registry=false")
 
-	dockerfileName, cleanup, err := makefile(fmt.Sprintf("FROM %s/busybox", reg.URL()))
-	c.Assert(err, check.IsNil, check.Commentf("Unable to create test dockerfile"))
-	defer cleanup()
+	tmp, err := ioutil.TempDir("", "integration-cli-")
+	c.Assert(err, check.IsNil)
+	defer os.RemoveAll(tmp)
 
-	s.d.Cmd("build", "--file", dockerfileName, ".")
+	dockerfileName, err := makefile(tmp, fmt.Sprintf("FROM %s/busybox", reg.URL()))
+	c.Assert(err, check.IsNil, check.Commentf("Unable to create test dockerfile"))
+
+	s.d.Cmd("build", "--file", dockerfileName, tmp)
 	c.Assert(v1Repo, check.Equals, 1, check.Commentf("Expected v1 repository access after build"))
 
 	repoName := fmt.Sprintf("%s/busybox", reg.URL())
diff --git a/components/engine/integration-cli/environment/clean.go b/components/engine/integration-cli/environment/clean.go
index b27838337e..809baa7b52 100644
--- a/components/engine/integration-cli/environment/clean.go
+++ b/components/engine/integration-cli/environment/clean.go
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"regexp"
 	"strings"
 
 	"github.com/docker/docker/api/types"
@@ -50,14 +51,17 @@ func getPausedContainers(t testingT, dockerBinary string) []string {
 	return strings.Fields(result.Combined())
 }
 
+var alreadyExists = regexp.MustCompile(`Error response from daemon: removal of container (\w+) is already in progress`)
+
 func deleteAllContainers(t testingT, dockerBinary string) {
 	containers := getAllContainers(t, dockerBinary)
 	if len(containers) > 0 {
 		result := icmd.RunCommand(dockerBinary, append([]string{"rm", "-fv"}, containers...)...)
 		if result.Error != nil {
 			// If the error is "No such container: ..." this means the container doesn't exists anymore,
-			// we can safely ignore that one.
-			if strings.Contains(result.Stderr(), "No such container") {
+			// or if it is "... removal of container ... is already in progress" it will be removed eventually.
+			// We can safely ignore those.
+			if strings.Contains(result.Stderr(), "No such container") || alreadyExists.MatchString(result.Stderr()) {
 				return
 			}
 			t.Fatalf("error removing containers %v : %v (%s)", containers, result.Error, result.Combined())
diff --git a/components/engine/integration-cli/request/request.go b/components/engine/integration-cli/request/request.go
index be3628b9b2..6f2bf650d4 100644
--- a/components/engine/integration-cli/request/request.go
+++ b/components/engine/integration-cli/request/request.go
@@ -17,6 +17,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/docker/docker/api"
 	dclient "github.com/docker/docker/client"
 	"github.com/docker/docker/opts"
 	"github.com/docker/docker/pkg/ioutils"
@@ -100,7 +101,7 @@ func DoOnHost(host, endpoint string, modifiers ...func(*http.Request) error) (*h
 	if err != nil {
 		return nil, nil, err
 	}
-	client, err := NewClient(host)
+	client, err := NewHTTPClient(host)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -140,8 +141,8 @@ func New(host, endpoint string, modifiers ...func(*http.Request) error) (*http.R
 	return req, nil
 }
 
-// NewClient creates an http client for the specific host
-func NewClient(host string) (*http.Client, error) {
+// NewHTTPClient creates an http client for the specific host
+func NewHTTPClient(host string) (*http.Client, error) {
 	// FIXME(vdemeester) 10*time.Second timeout of SockRequest… ?
 	proto, addr, _, err := dclient.ParseHost(host)
 	if err != nil {
@@ -163,6 +164,16 @@ func NewClient(host string) (*http.Client, error) {
 	}, err
 }
 
+// NewClient returns a new Docker API client
+func NewClient() (dclient.APIClient, error) {
+	host := DaemonHost()
+	httpClient, err := NewHTTPClient(host)
+	if err != nil {
+		return nil, err
+	}
+	return dclient.NewClient(host, api.DefaultVersion, httpClient, nil)
+}
+
 // FIXME(vdemeester) httputil.ClientConn is deprecated, use http.Client instead (closer to actual client)
 // Deprecated: Use New instead of NewRequestClient
 // Deprecated: use request.Do (or Get, Delete, Post) instead
diff --git a/components/engine/integration-cli/trust_server_test.go b/components/engine/integration-cli/trust_server_test.go
index d1eb62e794..e3f0674cf3 100644
--- a/components/engine/integration-cli/trust_server_test.go
+++ b/components/engine/integration-cli/trust_server_test.go
@@ -11,7 +11,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/docker/docker/cli/flags"
+	cliconfig "github.com/docker/docker/cli/config"
 	"github.com/docker/docker/integration-cli/checker"
 	"github.com/docker/docker/integration-cli/cli"
 	icmd "github.com/docker/docker/pkg/testutil/cmd"
@@ -108,7 +108,7 @@ func newTestNotary(c *check.C) (*testNotary, error) {
 		"skipTLSVerify": true
 	}
 }`
-	if _, err = fmt.Fprintf(clientConfig, template, filepath.Join(flags.ConfigurationDir(), "trust"), notaryURL); err != nil {
+	if _, err = fmt.Fprintf(clientConfig, template, filepath.Join(cliconfig.Dir(), "trust"), notaryURL); err != nil {
 		os.RemoveAll(tmp)
 		return nil, err
 	}
diff --git a/components/engine/layer/empty.go b/components/engine/layer/empty.go
index 3b6ffc82f7..cf04aa12fe 100644
--- a/components/engine/layer/empty.go
+++ b/components/engine/layer/empty.go
@@ -54,3 +54,12 @@ func (el *emptyLayer) DiffSize() (size int64, err error) {
 func (el *emptyLayer) Metadata() (map[string]string, error) {
 	return make(map[string]string), nil
 }
+
+func (el *emptyLayer) Platform() Platform {
+	return ""
+}
+
+// IsEmpty returns true if the layer is an EmptyLayer
+func IsEmpty(diffID DiffID) bool {
+	return diffID == DigestSHA256EmptyTar
+}
diff --git a/components/engine/layer/filestore_unix.go b/components/engine/layer/filestore_unix.go
new file mode 100644
index 0000000000..fe8a4f8b2a
--- /dev/null
+++ b/components/engine/layer/filestore_unix.go
@@ -0,0 +1,13 @@
+// +build !windows
+
+package layer
+
+// SetPlatform writes the "platform" file to the layer filestore
+func (fm *fileMetadataTransaction) SetPlatform(platform Platform) error {
+	return nil
+}
+
+// GetPlatform reads the "platform" file from the layer filestore
+func (fms *fileMetadataStore) GetPlatform(layer ChainID) (Platform, error) {
+	return "", nil
+}
diff --git a/components/engine/layer/filestore_windows.go b/components/engine/layer/filestore_windows.go
new file mode 100644
index 0000000000..066456d8d2
--- /dev/null
+++ b/components/engine/layer/filestore_windows.go
@@ -0,0 +1,35 @@
+package layer
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"strings"
+)
+
+// SetPlatform writes the "platform" file to the layer filestore
+func (fm *fileMetadataTransaction) SetPlatform(platform Platform) error {
+	if platform == "" {
+		return nil
+	}
+	return fm.ws.WriteFile("platform", []byte(platform), 0644)
+}
+
+// GetPlatform reads the "platform" file from the layer filestore
+func (fms *fileMetadataStore) GetPlatform(layer ChainID) (Platform, error) {
+	contentBytes, err := ioutil.ReadFile(fms.getLayerFilename(layer, "platform"))
+	if err != nil {
+		// For backwards compatibility, the platform file may not exist. Default to "windows" if missing.
+		if os.IsNotExist(err) {
+			return "windows", nil
+		}
+		return "", err
+	}
+	content := strings.TrimSpace(string(contentBytes))
+
+	if content != "windows" && content != "linux" {
+		return "", fmt.Errorf("invalid platform value: %s", content)
+	}
+
+	return Platform(content), nil
+}
diff --git a/components/engine/layer/layer.go b/components/engine/layer/layer.go
index 7b993ee4ad..b3480a0cc1 100644
--- a/components/engine/layer/layer.go
+++ b/components/engine/layer/layer.go
@@ -64,6 +64,14 @@ func (id ChainID) String() string {
 	return string(id)
 }
 
+// Platform is the platform of a layer
+type Platform string
+
+// String returns a string rendition of layers target platform
+func (id Platform) String() string {
+	return string(id)
+}
+
 // DiffID is the hash of an individual layer tar.
 type DiffID digest.Digest
 
@@ -99,6 +107,9 @@ type Layer interface {
 	// Parent returns the next layer in the layer chain.
 	Parent() Layer
 
+	// Platform returns the platform of the layer
+	Platform() Platform
+
 	// Size returns the size of the entire layer chain. The size
 	// is calculated from the total size of all files in the layers.
 	Size() (int64, error)
@@ -179,7 +190,7 @@ type CreateRWLayerOpts struct {
 // Store represents a backend for managing both
 // read-only and read-write layers.
 type Store interface {
-	Register(io.Reader, ChainID) (Layer, error)
+	Register(io.Reader, ChainID, Platform) (Layer, error)
 	Get(ChainID) (Layer, error)
 	Map() map[ChainID]Layer
 	Release(Layer) ([]Metadata, error)
@@ -197,7 +208,7 @@ type Store interface {
 // DescribableStore represents a layer store capable of storing
 // descriptors for layers.
 type DescribableStore interface {
-	RegisterWithDescriptor(io.Reader, ChainID, distribution.Descriptor) (Layer, error)
+	RegisterWithDescriptor(io.Reader, ChainID, Platform, distribution.Descriptor) (Layer, error)
 }
 
 // MetadataTransaction represents functions for setting layer metadata
@@ -208,6 +219,7 @@ type MetadataTransaction interface {
 	SetDiffID(DiffID) error
 	SetCacheID(string) error
 	SetDescriptor(distribution.Descriptor) error
+	SetPlatform(Platform) error
 	TarSplitWriter(compressInput bool) (io.WriteCloser, error)
 
 	Commit(ChainID) error
@@ -228,6 +240,7 @@ type MetadataStore interface {
 	GetDiffID(ChainID) (DiffID, error)
 	GetCacheID(ChainID) (string, error)
 	GetDescriptor(ChainID) (distribution.Descriptor, error)
+	GetPlatform(ChainID) (Platform, error)
 	TarSplitReader(ChainID) (io.ReadCloser, error)
 
 	SetMountID(string, string) error
diff --git a/components/engine/layer/layer_store.go b/components/engine/layer/layer_store.go
index 5caa5d41f2..e7c424aa92 100644
--- a/components/engine/layer/layer_store.go
+++ b/components/engine/layer/layer_store.go
@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"io"
 	"io/ioutil"
+	"runtime"
+	"strings"
 	"sync"
 
 	"github.com/Sirupsen/logrus"
@@ -13,6 +15,7 @@ import (
 	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/plugingetter"
 	"github.com/docker/docker/pkg/stringid"
+	"github.com/docker/docker/pkg/system"
 	"github.com/opencontainers/go-digest"
 	"github.com/vbatts/tar-split/tar/asm"
 	"github.com/vbatts/tar-split/tar/storage"
@@ -36,6 +39,8 @@ type layerStore struct {
 	mountL sync.Mutex
 
 	useTarSplit bool
+
+	platform string
 }
 
 // StoreOptions are the options used to create a new Store instance
@@ -44,10 +49,10 @@ type StoreOptions struct {
 	MetadataStorePathTemplate string
 	GraphDriver               string
 	GraphDriverOptions        []string
-	UIDMaps                   []idtools.IDMap
-	GIDMaps                   []idtools.IDMap
+	IDMappings                *idtools.IDMappings
 	PluginGetter              plugingetter.PluginGetter
 	ExperimentalEnabled       bool
+	Platform                  string
 }
 
 // NewStoreFromOptions creates a new Store instance
@@ -55,8 +60,8 @@ func NewStoreFromOptions(options StoreOptions) (Store, error) {
 	driver, err := graphdriver.New(options.GraphDriver, options.PluginGetter, graphdriver.Options{
 		Root:                options.StorePath,
 		DriverOptions:       options.GraphDriverOptions,
-		UIDMaps:             options.UIDMaps,
-		GIDMaps:             options.GIDMaps,
+		UIDMaps:             options.IDMappings.UIDs(),
+		GIDMaps:             options.IDMappings.GIDs(),
 		ExperimentalEnabled: options.ExperimentalEnabled,
 	})
 	if err != nil {
@@ -69,13 +74,13 @@ func NewStoreFromOptions(options StoreOptions) (Store, error) {
 		return nil, err
 	}
 
-	return NewStoreFromGraphDriver(fms, driver)
+	return NewStoreFromGraphDriver(fms, driver, options.Platform)
 }
 
 // NewStoreFromGraphDriver creates a new Store instance using the provided
 // metadata store and graph driver. The metadata store will be used to restore
 // the Store.
-func NewStoreFromGraphDriver(store MetadataStore, driver graphdriver.Driver) (Store, error) {
+func NewStoreFromGraphDriver(store MetadataStore, driver graphdriver.Driver, platform string) (Store, error) {
 	caps := graphdriver.Capabilities{}
 	if capDriver, ok := driver.(graphdriver.CapabilityDriver); ok {
 		caps = capDriver.Capabilities()
@@ -87,6 +92,7 @@ func NewStoreFromGraphDriver(store MetadataStore, driver graphdriver.Driver) (St
 		layerMap:    map[ChainID]*roLayer{},
 		mounts:      map[string]*mountedLayer{},
 		useTarSplit: !caps.ReproducesExactDiffs,
+		platform:    platform,
 	}
 
 	ids, mounts, err := store.List()
@@ -145,6 +151,11 @@ func (ls *layerStore) loadLayer(layer ChainID) (*roLayer, error) {
 		return nil, fmt.Errorf("failed to get descriptor for %s: %s", layer, err)
 	}
 
+	platform, err := ls.store.GetPlatform(layer)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get platform for %s: %s", layer, err)
+	}
+
 	cl = &roLayer{
 		chainID:    layer,
 		diffID:     diff,
@@ -153,6 +164,7 @@ func (ls *layerStore) loadLayer(layer ChainID) (*roLayer, error) {
 		layerStore: ls,
 		references: map[Layer]struct{}{},
 		descriptor: descriptor,
+		platform:   platform,
 	}
 
 	if parent != "" {
@@ -248,17 +260,25 @@ func (ls *layerStore) applyTar(tx MetadataTransaction, ts io.Reader, parent stri
 	return nil
 }
 
-func (ls *layerStore) Register(ts io.Reader, parent ChainID) (Layer, error) {
-	return ls.registerWithDescriptor(ts, parent, distribution.Descriptor{})
+func (ls *layerStore) Register(ts io.Reader, parent ChainID, platform Platform) (Layer, error) {
+	return ls.registerWithDescriptor(ts, parent, platform, distribution.Descriptor{})
 }
 
-func (ls *layerStore) registerWithDescriptor(ts io.Reader, parent ChainID, descriptor distribution.Descriptor) (Layer, error) {
+func (ls *layerStore) registerWithDescriptor(ts io.Reader, parent ChainID, platform Platform, descriptor distribution.Descriptor) (Layer, error) {
 	// err is used to hold the error which will always trigger
 	// cleanup of creates sources but may not be an error returned
 	// to the caller (already exists).
 	var err error
 	var pid string
 	var p *roLayer
+
+	// Integrity check - ensure we are creating something for the correct platform
+	if runtime.GOOS == "windows" && system.LCOWSupported() {
+		if strings.ToLower(ls.platform) != strings.ToLower(string(platform)) {
+			return nil, fmt.Errorf("cannot create entry for platform %q in layer store for platform %q", platform, ls.platform)
+		}
+	}
+
 	if string(parent) != "" {
 		p = ls.get(parent)
 		if p == nil {
@@ -287,6 +307,7 @@ func (ls *layerStore) registerWithDescriptor(ts io.Reader, parent ChainID, descr
 		layerStore:     ls,
 		references:     map[Layer]struct{}{},
 		descriptor:     descriptor,
+		platform:       platform,
 	}
 
 	if err = ls.driver.Create(layer.cacheID, pid, nil); err != nil {
@@ -389,7 +410,6 @@ func (ls *layerStore) deleteLayer(layer *roLayer, metadata *Metadata) error {
 	if err != nil {
 		return err
 	}
-
 	err = ls.store.Remove(layer.chainID)
 	if err != nil {
 		return err
@@ -519,7 +539,6 @@ func (ls *layerStore) CreateRWLayer(name string, parent ChainID, opts *CreateRWL
 	if err = ls.driver.CreateReadWrite(m.mountID, pid, createOpts); err != nil {
 		return nil, err
 	}
-
 	if err = ls.saveMount(m); err != nil {
 		return nil, err
 	}
diff --git a/components/engine/layer/layer_store_windows.go b/components/engine/layer/layer_store_windows.go
index 1276a912cc..ccbf6dd52a 100644
--- a/components/engine/layer/layer_store_windows.go
+++ b/components/engine/layer/layer_store_windows.go
@@ -6,6 +6,6 @@ import (
 	"github.com/docker/distribution"
 )
 
-func (ls *layerStore) RegisterWithDescriptor(ts io.Reader, parent ChainID, descriptor distribution.Descriptor) (Layer, error) {
-	return ls.registerWithDescriptor(ts, parent, descriptor)
+func (ls *layerStore) RegisterWithDescriptor(ts io.Reader, parent ChainID, platform Platform, descriptor distribution.Descriptor) (Layer, error) {
+	return ls.registerWithDescriptor(ts, parent, platform, descriptor)
 }
diff --git a/components/engine/layer/layer_test.go b/components/engine/layer/layer_test.go
index 5c4da4f9a9..8ec5b4df54 100644
--- a/components/engine/layer/layer_test.go
+++ b/components/engine/layer/layer_test.go
@@ -20,7 +20,8 @@ import (
 
 func init() {
 	graphdriver.ApplyUncompressedLayer = archive.UnpackLayer
-	vfs.CopyWithTar = archive.CopyWithTar
+	defaultArchiver := archive.NewDefaultArchiver()
+	vfs.CopyWithTar = defaultArchiver.CopyWithTar
 }
 
 func newVFSGraphDriver(td string) (graphdriver.Driver, error) {
@@ -70,7 +71,7 @@ func newTestStore(t *testing.T) (Store, string, func()) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	ls, err := NewStoreFromGraphDriver(fms, graph)
+	ls, err := NewStoreFromGraphDriver(fms, graph, runtime.GOOS)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -105,7 +106,7 @@ func createLayer(ls Store, parent ChainID, layerFunc layerInit) (Layer, error) {
 	}
 	defer ts.Close()
 
-	layer, err := ls.Register(ts, parent)
+	layer, err := ls.Register(ts, parent, Platform(runtime.GOOS))
 	if err != nil {
 		return nil, err
 	}
@@ -403,7 +404,7 @@ func TestStoreRestore(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	ls2, err := NewStoreFromGraphDriver(ls.(*layerStore).store, ls.(*layerStore).driver)
+	ls2, err := NewStoreFromGraphDriver(ls.(*layerStore).store, ls.(*layerStore).driver, runtime.GOOS)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -498,7 +499,7 @@ func TestTarStreamStability(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	layer1, err := ls.Register(bytes.NewReader(tar1), "")
+	layer1, err := ls.Register(bytes.NewReader(tar1), "", Platform(runtime.GOOS))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -517,7 +518,7 @@ func TestTarStreamStability(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	layer2, err := ls.Register(bytes.NewReader(tar2), layer1.ChainID())
+	layer2, err := ls.Register(bytes.NewReader(tar2), layer1.ChainID(), Platform(runtime.GOOS))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -685,12 +686,12 @@ func TestRegisterExistingLayer(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	layer2a, err := ls.Register(bytes.NewReader(tar1), layer1.ChainID())
+	layer2a, err := ls.Register(bytes.NewReader(tar1), layer1.ChainID(), Platform(runtime.GOOS))
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	layer2b, err := ls.Register(bytes.NewReader(tar1), layer1.ChainID())
+	layer2b, err := ls.Register(bytes.NewReader(tar1), layer1.ChainID(), Platform(runtime.GOOS))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -725,12 +726,12 @@ func TestTarStreamVerification(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	layer1, err := ls.Register(bytes.NewReader(tar1), "")
+	layer1, err := ls.Register(bytes.NewReader(tar1), "", Platform(runtime.GOOS))
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	layer2, err := ls.Register(bytes.NewReader(tar2), "")
+	layer2, err := ls.Register(bytes.NewReader(tar2), "", Platform(runtime.GOOS))
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/components/engine/layer/migration_test.go b/components/engine/layer/migration_test.go
index fe3b40c20b..7364e6cdc8 100644
--- a/components/engine/layer/migration_test.go
+++ b/components/engine/layer/migration_test.go
@@ -94,7 +94,7 @@ func TestLayerMigration(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	ls, err := NewStoreFromGraphDriver(fms, graph)
+	ls, err := NewStoreFromGraphDriver(fms, graph, runtime.GOOS)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -110,14 +110,14 @@ func TestLayerMigration(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	layer1b, err := ls.Register(bytes.NewReader(tar1), "")
+	layer1b, err := ls.Register(bytes.NewReader(tar1), "", Platform(runtime.GOOS))
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	assertReferences(t, layer1a, layer1b)
 	// Attempt register, should be same
-	layer2a, err := ls.Register(bytes.NewReader(tar2), layer1a.ChainID())
+	layer2a, err := ls.Register(bytes.NewReader(tar2), layer1a.ChainID(), Platform(runtime.GOOS))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -222,7 +222,7 @@ func TestLayerMigrationNoTarsplit(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	ls, err := NewStoreFromGraphDriver(fms, graph)
+	ls, err := NewStoreFromGraphDriver(fms, graph, runtime.GOOS)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -238,7 +238,7 @@ func TestLayerMigrationNoTarsplit(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	layer1b, err := ls.Register(bytes.NewReader(tar1), "")
+	layer1b, err := ls.Register(bytes.NewReader(tar1), "", Platform(runtime.GOOS))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -246,7 +246,7 @@ func TestLayerMigrationNoTarsplit(t *testing.T) {
 	assertReferences(t, layer1a, layer1b)
 
 	// Attempt register, should be same
-	layer2a, err := ls.Register(bytes.NewReader(tar2), layer1a.ChainID())
+	layer2a, err := ls.Register(bytes.NewReader(tar2), layer1a.ChainID(), Platform(runtime.GOOS))
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/components/engine/layer/ro_layer.go b/components/engine/layer/ro_layer.go
index 8b4cf8f0de..e03d78b4db 100644
--- a/components/engine/layer/ro_layer.go
+++ b/components/engine/layer/ro_layer.go
@@ -16,6 +16,7 @@ type roLayer struct {
 	size       int64
 	layerStore *layerStore
 	descriptor distribution.Descriptor
+	platform   Platform
 
 	referenceCount int
 	references     map[Layer]struct{}
@@ -142,6 +143,9 @@ func storeLayer(tx MetadataTransaction, layer *roLayer) error {
 			return err
 		}
 	}
+	if err := tx.SetPlatform(layer.platform); err != nil {
+		return err
+	}
 
 	return nil
 }
diff --git a/components/engine/layer/ro_layer_unix.go b/components/engine/layer/ro_layer_unix.go
new file mode 100644
index 0000000000..1b36856f9e
--- /dev/null
+++ b/components/engine/layer/ro_layer_unix.go
@@ -0,0 +1,7 @@
+// +build !windows
+
+package layer
+
+func (rl *roLayer) Platform() Platform {
+	return ""
+}
diff --git a/components/engine/layer/ro_layer_windows.go b/components/engine/layer/ro_layer_windows.go
index 32bd7182a3..6679bdfe8f 100644
--- a/components/engine/layer/ro_layer_windows.go
+++ b/components/engine/layer/ro_layer_windows.go
@@ -7,3 +7,10 @@ var _ distribution.Describable = &roLayer{}
 func (rl *roLayer) Descriptor() distribution.Descriptor {
 	return rl.descriptor
 }
+
+func (rl *roLayer) Platform() Platform {
+	if rl.platform == "" {
+		return "windows"
+	}
+	return rl.platform
+}
diff --git a/components/engine/libcontainerd/client_unix.go b/components/engine/libcontainerd/client_unix.go
index 906026024d..6dbf3af06e 100644
--- a/components/engine/libcontainerd/client_unix.go
+++ b/components/engine/libcontainerd/client_unix.go
@@ -34,7 +34,7 @@ func (clnt *client) prepareBundleDir(uid, gid int) (string, error) {
 		}
 		if os.IsNotExist(err) || fi.Mode()&1 == 0 {
 			p = fmt.Sprintf("%s.%d.%d", p, uid, gid)
-			if err := idtools.MkdirAs(p, 0700, uid, gid); err != nil && !os.IsExist(err) {
+			if err := idtools.MkdirAndChown(p, 0700, idtools.IDPair{uid, gid}); err != nil && !os.IsExist(err) {
 				return "", err
 			}
 		}
@@ -71,7 +71,7 @@ func (clnt *client) Create(containerID string, checkpoint string, checkpointDir
 		}
 	}()
 
-	if err := idtools.MkdirAllAs(container.dir, 0700, uid, gid); err != nil && !os.IsExist(err) {
+	if err := idtools.MkdirAllAndChown(container.dir, 0700, idtools.IDPair{uid, gid}); err != nil && !os.IsExist(err) {
 		return err
 	}
 
@@ -83,8 +83,7 @@ func (clnt *client) Create(containerID string, checkpoint string, checkpointDir
 	if err := json.NewEncoder(f).Encode(spec); err != nil {
 		return err
 	}
-
-	return container.start(checkpoint, checkpointDir, attachStdio)
+	return container.start(&spec, checkpoint, checkpointDir, attachStdio)
 }
 
 func (clnt *client) Signal(containerID string, sig int) error {
diff --git a/components/engine/libcontainerd/client_windows.go b/components/engine/libcontainerd/client_windows.go
index b04bdbde9b..d7f312e6e4 100644
--- a/components/engine/libcontainerd/client_windows.go
+++ b/components/engine/libcontainerd/client_windows.go
@@ -1,6 +1,7 @@
 package libcontainerd
 
 import (
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -58,7 +59,6 @@ const defaultOwner = "docker"
 //	"SystemType": "Container",
 //	"Name": "5e0055c814a6005b8e57ac59f9a522066e0af12b48b3c26a9416e23907698776",
 //	"Owner": "docker",
-//	"IsDummy": false,
 //	"VolumePath": "\\\\\\\\?\\\\Volume{66d1ef4c-7a00-11e6-8948-00155ddbef9d}",
 //	"IgnoreFlushesDuringBoot": true,
 //	"LayerFolderPath": "C:\\\\control\\\\windowsfilter\\\\5e0055c814a6005b8e57ac59f9a522066e0af12b48b3c26a9416e23907698776",
@@ -79,7 +79,6 @@ const defaultOwner = "docker"
 //	"SystemType": "Container",
 //	"Name": "475c2c58933b72687a88a441e7e0ca4bd72d76413c5f9d5031fee83b98f6045d",
 //	"Owner": "docker",
-//	"IsDummy": false,
 //	"IgnoreFlushesDuringBoot": true,
 //	"Layers": [{
 //		"ID": "18955d65-d45a-557b-bf1c-49d6dfefc526",
@@ -98,8 +97,17 @@ const defaultOwner = "docker"
 func (clnt *client) Create(containerID string, checkpoint string, checkpointDir string, spec specs.Spec, attachStdio StdioCallback, options ...CreateOption) error {
 	clnt.lock(containerID)
 	defer clnt.unlock(containerID)
-	logrus.Debugln("libcontainerd: client.Create() with spec", spec)
+	if b, err := json.Marshal(spec); err == nil {
+		logrus.Debugln("libcontainerd: client.Create() with spec", string(b))
+	}
+	osName := spec.Platform.OS
+	if osName == "windows" {
+		return clnt.createWindows(containerID, checkpoint, checkpointDir, spec, attachStdio, options...)
+	}
+	return clnt.createLinux(containerID, checkpoint, checkpointDir, spec, attachStdio, options...)
+}
 
+func (clnt *client) createWindows(containerID string, checkpoint string, checkpointDir string, spec specs.Spec, attachStdio StdioCallback, options ...CreateOption) error {
 	configuration := &hcsshim.ContainerConfig{
 		SystemType: "Container",
 		Name:       containerID,
@@ -267,17 +275,115 @@ func (clnt *client) Create(containerID string, checkpoint string, checkpointDir
 	// Call start, and if it fails, delete the container from our
 	// internal structure, start will keep HCS in sync by deleting the
 	// container there.
-	logrus.Debugf("libcontainerd: Create() id=%s, Calling start()", containerID)
+	logrus.Debugf("libcontainerd: createWindows() id=%s, Calling start()", containerID)
 	if err := container.start(attachStdio); err != nil {
 		clnt.deleteContainer(containerID)
 		return err
 	}
 
-	logrus.Debugf("libcontainerd: Create() id=%s completed successfully", containerID)
+	logrus.Debugf("libcontainerd: createWindows() id=%s completed successfully", containerID)
 	return nil
 
 }
 
+func (clnt *client) createLinux(containerID string, checkpoint string, checkpointDir string, spec specs.Spec, attachStdio StdioCallback, options ...CreateOption) error {
+	logrus.Debugf("libcontainerd: createLinux(): containerId %s ", containerID)
+
+	// TODO @jhowardmsft LCOW Support: This needs to be configurable, not hard-coded.
+	// However, good-enough for the LCOW bring-up.
+	configuration := &hcsshim.ContainerConfig{
+		HvPartition:   true,
+		Name:          containerID,
+		SystemType:    "container",
+		ContainerType: "linux",
+		Owner:         defaultOwner,
+		TerminateOnLastHandleClosed: true,
+		HvRuntime: &hcsshim.HvRuntime{
+			ImagePath:       `c:\program files\lcow`,
+			LinuxKernelFile: `bootx64.efi`,
+			LinuxInitrdFile: `initrd.img`,
+		},
+	}
+
+	var layerOpt *LayerOption
+	for _, option := range options {
+		if l, ok := option.(*LayerOption); ok {
+			layerOpt = l
+		}
+	}
+
+	// We must have a layer option with at least one path
+	if layerOpt == nil || layerOpt.LayerPaths == nil {
+		return fmt.Errorf("no layer option or paths were supplied to the runtime")
+	}
+
+	// LayerFolderPath (writeable layer) + Layers (Guid + path)
+	configuration.LayerFolderPath = layerOpt.LayerFolderPath
+	for _, layerPath := range layerOpt.LayerPaths {
+		_, filename := filepath.Split(layerPath)
+		g, err := hcsshim.NameToGuid(filename)
+		if err != nil {
+			return err
+		}
+		configuration.Layers = append(configuration.Layers, hcsshim.Layer{
+			ID:   g.ToString(),
+			Path: filepath.Join(layerPath, "layer.vhd"),
+		})
+	}
+
+	for _, option := range options {
+		if n, ok := option.(*NetworkEndpointsOption); ok {
+			configuration.EndpointList = n.Endpoints
+			configuration.AllowUnqualifiedDNSQuery = n.AllowUnqualifiedDNSQuery
+			if n.DNSSearchList != nil {
+				configuration.DNSSearchList = strings.Join(n.DNSSearchList, ",")
+			}
+			configuration.NetworkSharedContainerName = n.NetworkSharedContainerID
+			break
+		}
+	}
+
+	hcsContainer, err := hcsshim.CreateContainer(containerID, configuration)
+	if err != nil {
+		return err
+	}
+
+	// Construct a container object for calling start on it.
+	container := &container{
+		containerCommon: containerCommon{
+			process: process{
+				processCommon: processCommon{
+					containerID:  containerID,
+					client:       clnt,
+					friendlyName: InitFriendlyName,
+				},
+			},
+			processes: make(map[string]*process),
+		},
+		ociSpec:      spec,
+		hcsContainer: hcsContainer,
+	}
+
+	container.options = options
+	for _, option := range options {
+		if err := option.Apply(container); err != nil {
+			logrus.Errorf("libcontainerd: createLinux() %v", err)
+		}
+	}
+
+	// Call start, and if it fails, delete the container from our
+	// internal structure, start will keep HCS in sync by deleting the
+	// container there.
+	logrus.Debugf("libcontainerd: createLinux() id=%s, Calling start()", containerID)
+	if err := container.start(attachStdio); err != nil {
+		clnt.deleteContainer(containerID)
+		return err
+	}
+
+	logrus.Debugf("libcontainerd: createLinux() id=%s completed successfully", containerID)
+	return nil
+}
+
 // AddProcess is the handler for adding a process to an already running
 // container. It's called through docker exec. It returns the system pid of the
 // exec'd process.
@@ -294,13 +400,15 @@ func (clnt *client) AddProcess(ctx context.Context, containerID, processFriendly
 	// create stdin, even if it's not used - it will be closed shortly. Stderr
 	// is only created if it we're not -t.
 	createProcessParms := hcsshim.ProcessConfig{
-		EmulateConsole:   procToAdd.Terminal,
 		CreateStdInPipe:  true,
 		CreateStdOutPipe: true,
 		CreateStdErrPipe: !procToAdd.Terminal,
 	}
-	createProcessParms.ConsoleSize[0] = uint(procToAdd.ConsoleSize.Height)
-	createProcessParms.ConsoleSize[1] = uint(procToAdd.ConsoleSize.Width)
+	if procToAdd.Terminal {
+		createProcessParms.EmulateConsole = true
+		createProcessParms.ConsoleSize[0] = uint(procToAdd.ConsoleSize.Height)
+		createProcessParms.ConsoleSize[1] = uint(procToAdd.ConsoleSize.Width)
+	}
 
 	// Take working directory from the process to add if it is defined,
 	// otherwise take from the first process.
diff --git a/components/engine/libcontainerd/container_unix.go b/components/engine/libcontainerd/container_unix.go
index f2413b2e3f..be1699943e 100644
--- a/components/engine/libcontainerd/container_unix.go
+++ b/components/engine/libcontainerd/container_unix.go
@@ -90,12 +90,7 @@ func (ctr *container) spec() (*specs.Spec, error) {
 	return &spec, nil
 }
 
-func (ctr *container) start(checkpoint string, checkpointDir string, attachStdio StdioCallback) (err error) {
-	spec, err := ctr.spec()
-	if err != nil {
-		return nil
-	}
-
+func (ctr *container) start(spec *specs.Spec, checkpoint, checkpointDir string, attachStdio StdioCallback) (err error) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 	ready := make(chan struct{})
@@ -172,6 +167,7 @@ func (ctr *container) start(checkpoint string, checkpointDir string, attachStdio
 			State: StateStart,
 			Pid:   ctr.systemPid,
 		}})
+
 }
 
 func (ctr *container) newProcess(friendlyName string) *process {
diff --git a/components/engine/libcontainerd/container_windows.go b/components/engine/libcontainerd/container_windows.go
index 753d2f2f92..3fd8b6793d 100644
--- a/components/engine/libcontainerd/container_windows.go
+++ b/components/engine/libcontainerd/container_windows.go
@@ -1,6 +1,7 @@
 package libcontainerd
 
 import (
+	"encoding/json"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -10,6 +11,7 @@ import (
 
 	"github.com/Microsoft/hcsshim"
 	"github.com/Sirupsen/logrus"
+	"github.com/docker/docker/pkg/system"
 	"github.com/opencontainers/runtime-spec/specs-go"
 )
 
@@ -83,6 +85,16 @@ func (ctr *container) start(attachStdio StdioCallback) error {
 	createProcessParms.CommandLine = strings.Join(ctr.ociSpec.Process.Args, " ")
 	createProcessParms.User = ctr.ociSpec.Process.User.Username
 
+	// LCOW requires the raw OCI spec passed through HCS and onwards to GCS for the utility VM.
+	if system.LCOWSupported() && ctr.ociSpec.Platform.OS == "linux" {
+		ociBuf, err := json.Marshal(ctr.ociSpec)
+		if err != nil {
+			return err
+		}
+		ociRaw := json.RawMessage(ociBuf)
+		createProcessParms.OCISpecification = &ociRaw
+	}
+
 	// Start the command running in the container.
 	newProcess, err := ctr.hcsContainer.CreateProcess(createProcessParms)
 	if err != nil {
@@ -228,11 +240,14 @@ func (ctr *container) waitExit(process *process, isFirstProcessToStart bool) err
 	if !isFirstProcessToStart {
 		si.State = StateExitProcess
 	} else {
-		updatePending, err := ctr.hcsContainer.HasPendingUpdates()
-		if err != nil {
-			logrus.Warnf("libcontainerd: HasPendingUpdates() failed (container may have been killed): %s", err)
-		} else {
-			si.UpdatePending = updatePending
+		// Pending updates is only applicable for WCOW
+		if ctr.ociSpec.Platform.OS == "windows" {
+			updatePending, err := ctr.hcsContainer.HasPendingUpdates()
+			if err != nil {
+				logrus.Warnf("libcontainerd: HasPendingUpdates() failed (container may have been killed): %s", err)
+			} else {
+				si.UpdatePending = updatePending
+			}
 		}
 
 		logrus.Debugf("libcontainerd: shutting down container %s", ctr.containerID)
diff --git a/components/engine/libcontainerd/queue_unix.go b/components/engine/libcontainerd/queue_unix.go
index b848b9872b..66765f75ec 100644
--- a/components/engine/libcontainerd/queue_unix.go
+++ b/components/engine/libcontainerd/queue_unix.go
@@ -27,5 +27,11 @@ func (q *queue) append(id string, f func()) {
 		}
 		f()
 		close(done)
+
+		q.Lock()
+		if q.fns[id] == done {
+			delete(q.fns, id)
+		}
+		q.Unlock()
 	}()
 }
diff --git a/components/engine/libcontainerd/queue_unix_test.go b/components/engine/libcontainerd/queue_unix_test.go
new file mode 100644
index 0000000000..bb49a5d4c2
--- /dev/null
+++ b/components/engine/libcontainerd/queue_unix_test.go
@@ -0,0 +1,33 @@
+// +build linux solaris
+
+package libcontainerd
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSerialization(t *testing.T) {
+	var (
+		q             queue
+		serialization = 1
+	)
+
+	q.append("aaa", func() {
+		//simulate a long time task
+		time.Sleep(10 * time.Millisecond)
+		require.EqualValues(t, serialization, 1)
+		serialization = 2
+	})
+	q.append("aaa", func() {
+		require.EqualValues(t, serialization, 2)
+		serialization = 3
+	})
+	q.append("aaa", func() {
+		require.EqualValues(t, serialization, 3)
+		serialization = 4
+	})
+	time.Sleep(20 * time.Millisecond)
+}
diff --git a/components/engine/libcontainerd/remote_unix.go b/components/engine/libcontainerd/remote_unix.go
index e09c9822d0..a81a93cbda 100644
--- a/components/engine/libcontainerd/remote_unix.go
+++ b/components/engine/libcontainerd/remote_unix.go
@@ -80,7 +80,7 @@ func New(stateDir string, options ...RemoteOption) (_ Remote, err error) {
 		}
 	}
 
-	if err := system.MkdirAll(stateDir, 0700); err != nil {
+	if err := system.MkdirAll(stateDir, 0700, ""); err != nil {
 		return nil, err
 	}
 
@@ -96,11 +96,13 @@ func New(stateDir string, options ...RemoteOption) (_ Remote, err error) {
 
 	// don't output the grpc reconnect logging
 	grpclog.SetLogger(log.New(ioutil.Discard, "", log.LstdFlags))
-	dialOpts := append([]grpc.DialOption{grpc.WithInsecure()},
+	dialOpts := []grpc.DialOption{
+		grpc.WithInsecure(),
+		grpc.WithBackoffMaxDelay(2 * time.Second),
 		grpc.WithDialer(func(addr string, timeout time.Duration) (net.Conn, error) {
 			return net.DialTimeout("unix", addr, timeout)
 		}),
-	)
+	}
 	conn, err := grpc.Dial(r.rpcAddr, dialOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("error connecting to containerd: %v", err)
diff --git a/components/engine/man/Dockerfile b/components/engine/man/Dockerfile
deleted file mode 100644
index 01a9fc0151..0000000000
--- a/components/engine/man/Dockerfile
+++ /dev/null
@@ -1,24 +0,0 @@
-FROM    golang:1.8.3-alpine
-
-RUN     apk add -U git bash curl gcc musl-dev make
-
-RUN     mkdir -p /go/src /go/bin /go/pkg
-RUN     export GLIDE=v0.11.1; \
-        export TARGET=/go/src/github.com/Masterminds; \
-        mkdir -p ${TARGET} && \
-        git clone https://github.com/Masterminds/glide.git ${TARGET}/glide && \
-        cd ${TARGET}/glide && \
-        git checkout $GLIDE && \
-        make build && \
-        cp ./glide /usr/bin/glide && \
-        cd / && rm -rf /go/src/* /go/bin/* /go/pkg/*
-
-COPY    glide.yaml /manvendor/
-COPY    glide.lock /manvendor/
-WORKDIR /manvendor/
-RUN     glide install && mv vendor src
-ENV     GOPATH=$GOPATH:/manvendor
-RUN     go build -o /usr/bin/go-md2man github.com/cpuguy83/go-md2man
-
-WORKDIR /go/src/github.com/docker/docker/
-ENTRYPOINT ["man/generate.sh"]
diff --git a/components/engine/man/Dockerfile.5.md b/components/engine/man/Dockerfile.5.md
deleted file mode 100644
index 5191b1930a..0000000000
--- a/components/engine/man/Dockerfile.5.md
+++ /dev/null
@@ -1,474 +0,0 @@
-% DOCKERFILE(5) Docker User Manuals
-% Zac Dover
-% May 2014
-# NAME
-
-Dockerfile - automate the steps of creating a Docker image
-
-# INTRODUCTION
-
-The **Dockerfile** is a configuration file that automates the steps of creating
-a Docker image. It is similar to a Makefile. Docker reads instructions from the
-**Dockerfile** to automate the steps otherwise performed manually to create an
-image. To build an image, create a file called **Dockerfile**.
-
-The **Dockerfile** describes the steps taken to assemble the image. When the
-**Dockerfile** has been created, call the `docker build` command, using the
-path of directory that contains **Dockerfile** as the argument.
-
-# SYNOPSIS
-
-INSTRUCTION arguments
-
-For example:
-
-  FROM image
-
-# DESCRIPTION
-
-A Dockerfile is a file that automates the steps of creating a Docker image.
-A Dockerfile is similar to a Makefile.
-
-# USAGE
-
-  docker build .
-
-  -- Runs the steps and commits them, building a final image.
-  The path to the source repository defines where to find the context of the
-  build. The build is run by the Docker daemon, not the CLI. The whole
-  context must be transferred to the daemon. The Docker CLI reports
-  `"Sending build context to Docker daemon"` when the context is sent to the
-  daemon.
-
-  ```
-  docker build -t repository/tag .
-  ```
-
-  -- specifies a repository and tag at which to save the new image if the build
-  succeeds. The Docker daemon runs the steps one-by-one, committing the result
-  to a new image if necessary, before finally outputting the ID of the new
-  image. The Docker daemon automatically cleans up the context it is given.
-
-  Docker re-uses intermediate images whenever possible. This significantly
-  accelerates the *docker build* process.
-
-# FORMAT
-
-  `FROM image`
-
-  `FROM image:tag`
-
-  `FROM image@digest`
-
-  -- The **FROM** instruction sets the base image for subsequent instructions. A
-  valid Dockerfile must have **FROM** as its first instruction. The image can be any
-  valid image. It is easy to start by pulling an image from the public
-  repositories.
-
-  -- **FROM** must be the first non-comment instruction in Dockerfile.
-
-  -- **FROM** may appear multiple times within a single Dockerfile in order to create
-  multiple images. Make a note of the last image ID output by the commit before
-  each new **FROM** command.
-
-  -- If no tag is given to the **FROM** instruction, Docker applies the
-  `latest` tag. If the used tag does not exist, an error is returned.
-
-  -- If no digest is given to the **FROM** instruction, Docker applies the
-  `latest` tag. If the used tag does not exist, an error is returned.
-
-**MAINTAINER**
-  -- **MAINTAINER** sets the Author field for the generated images.
-  Useful for providing users with an email or url for support.
-
-**RUN**
-  -- **RUN** has two forms:
-
-  ```
-  # the command is run in a shell - /bin/sh -c
-  RUN <command>
-
-  # Executable form
-  RUN ["executable", "param1", "param2"]
-  ```
-
-
-  -- The **RUN** instruction executes any commands in a new layer on top of the current
-  image and commits the results. The committed image is used for the next step in
-  Dockerfile.
-
-  -- Layering **RUN** instructions and generating commits conforms to the core
-  concepts of Docker where commits are cheap and containers can be created from
-  any point in the history of an image. This is similar to source control.  The
-  exec form makes it possible to avoid shell string munging. The exec form makes
-  it possible to **RUN** commands using a base image that does not contain `/bin/sh`.
-
-  Note that the exec form is parsed as a JSON array, which means that you must
-  use double-quotes (") around words not single-quotes (').
-
-**CMD**
-  -- **CMD** has three forms:
-
-  ```
-  # Executable form
-  CMD ["executable", "param1", "param2"]`
-
-  # Provide default arguments to ENTRYPOINT
-  CMD ["param1", "param2"]`
-
-  # the command is run in a shell - /bin/sh -c
-  CMD command param1 param2
-  ```
-
-  -- There should be only one **CMD** in a Dockerfile. If more than one **CMD** is listed, only
-  the last **CMD** takes effect.
-  The main purpose of a **CMD** is to provide defaults for an executing container.
-  These defaults may include an executable, or they can omit the executable. If
-  they omit the executable, an **ENTRYPOINT** must be specified.
-  When used in the shell or exec formats, the **CMD** instruction sets the command to
-  be executed when running the image.
-  If you use the shell form of the **CMD**, the `<command>` executes in `/bin/sh -c`:
-
-  Note that the exec form is parsed as a JSON array, which means that you must
-  use double-quotes (") around words not single-quotes (').
-
-  ```
-  FROM ubuntu
-  CMD echo "This is a test." | wc -
-  ```
-
-  -- If you run **command** without a shell, then you must express the command as a
-  JSON array and give the full path to the executable. This array form is the
-  preferred form of **CMD**. All additional parameters must be individually expressed
-  as strings in the array:
-
-  ```
-  FROM ubuntu
-  CMD ["/usr/bin/wc","--help"]
-  ```
-
-  -- To make the container run the same executable every time, use **ENTRYPOINT** in
-  combination with **CMD**.
-  If the user specifies arguments to `docker run`, the specified commands
-  override the default in **CMD**.
-  Do not confuse **RUN** with **CMD**. **RUN** runs a command and commits the result.
-  **CMD** executes nothing at build time, but specifies the intended command for
-  the image.
-
-**LABEL**
-  -- `LABEL <key>=<value> [<key>=<value> ...]`or
-  ```
-  LABEL <key>[ <value>]
-  LABEL <key>[ <value>]
-  ...
-  ```
-  The **LABEL** instruction adds metadata to an image. A **LABEL** is a
-  key-value pair. To specify a **LABEL** without a value, simply use an empty
-  string. To include spaces within a **LABEL** value, use quotes and
-  backslashes as you would in command-line parsing.
-
-  ```
-  LABEL com.example.vendor="ACME Incorporated"
-  LABEL com.example.vendor "ACME Incorporated"
-  LABEL com.example.vendor.is-beta ""
-  LABEL com.example.vendor.is-beta=
-  LABEL com.example.vendor.is-beta=""
-  ```
-
-  An image can have more than one label. To specify multiple labels, separate
-  each key-value pair by a space.
-
-  Labels are additive including `LABEL`s in `FROM` images. As the system
-  encounters and then applies a new label, new `key`s override any previous
-  labels with identical keys.
-
-  To display an image's labels, use the `docker inspect` command.
-
-**EXPOSE**
-  -- `EXPOSE <port> [<port>...]`
-  The **EXPOSE** instruction informs Docker that the container listens on the
-  specified network ports at runtime. Docker uses this information to
-  interconnect containers using links and to set up port redirection on the host
-  system.
-
-**ENV**
-  -- `ENV <key> <value>`
-  The **ENV** instruction sets the environment variable <key> to
-  the value `<value>`. This value is passed to all future
-  **RUN**, **ENTRYPOINT**, and **CMD** instructions. This is
-  functionally equivalent to prefixing the command with `<key>=<value>`.  The
-  environment variables that are set with **ENV** persist when a container is run
-  from the resulting image. Use `docker inspect` to inspect these values, and
-  change them using `docker run --env <key>=<value>`.
-
-  Note that setting "`ENV DEBIAN_FRONTEND noninteractive`" may cause
-  unintended consequences, because it will persist when the container is run
-  interactively, as with the following command: `docker run -t -i image bash`
-
-**ADD**
-  -- **ADD** has two forms:
-
-  ```
-  ADD <src> <dest>
-
-  # Required for paths with whitespace
-  ADD ["<src>",... "<dest>"]
-  ```
-
-  The **ADD** instruction copies new files, directories
-  or remote file URLs to the filesystem of the container at path `<dest>`.
-  Multiple `<src>` resources may be specified but if they are files or directories
-  then they must be relative to the source directory that is being built
-  (the context of the build). The `<dest>` is the absolute path, or path relative
-  to **WORKDIR**, into which the source is copied inside the target container.
-  If the `<src>` argument is a local file in a recognized compression format
-  (tar, gzip, bzip2, etc) then it is unpacked at the specified `<dest>` in the
-  container's filesystem.  Note that only local compressed files will be unpacked,
-  i.e., the URL download and archive unpacking features cannot be used together.
-  All new directories are created with mode 0755 and with the uid and gid of **0**.
-
-**COPY**
-  -- **COPY** has two forms:
-
-  ```
-  COPY <src> <dest>
-
-  # Required for paths with whitespace
-  COPY ["<src>",... "<dest>"]
-  ```
-
-  The **COPY** instruction copies new files from `<src>` and
-  adds them to the filesystem of the container at path <dest>. The `<src>` must be
-  the path to a file or directory relative to the source directory that is
-  being built (the context of the build) or a remote file URL. The `<dest>` is an
-  absolute path, or a path relative to **WORKDIR**, into which the source will
-  be copied inside the target container. If you **COPY** an archive file it will
-  land in the container exactly as it appears in the build context without any
-  attempt to unpack it.  All new files and directories are created with mode **0755**
-  and with the uid and gid of **0**.
-
-**ENTRYPOINT**
-  -- **ENTRYPOINT** has two forms:
-
-  ```
-  # executable form
-  ENTRYPOINT ["executable", "param1", "param2"]`
-
-  # run command in a shell - /bin/sh -c
-  ENTRYPOINT command param1 param2
-  ```
-
-  -- An **ENTRYPOINT** helps you configure a
-  container that can be run as an executable. When you specify an **ENTRYPOINT**,
-  the whole container runs as if it was only that executable.  The **ENTRYPOINT**
-  instruction adds an entry command that is not overwritten when arguments are
-  passed to docker run. This is different from the behavior of **CMD**. This allows
-  arguments to be passed to the entrypoint, for instance `docker run <image> -d`
-  passes the -d argument to the **ENTRYPOINT**.  Specify parameters either in the
-  **ENTRYPOINT** JSON array (as in the preferred exec form above), or by using a **CMD**
-  statement.  Parameters in the **ENTRYPOINT** are not overwritten by the docker run
-  arguments.  Parameters specified via **CMD** are overwritten by docker run
-  arguments.  Specify a plain string for the **ENTRYPOINT**, and it will execute in
-  `/bin/sh -c`, like a **CMD** instruction:
-
-  ```
-  FROM ubuntu
-  ENTRYPOINT wc -l -
-  ```
-
-  This means that the Dockerfile's image always takes stdin as input (that's
-  what "-" means), and prints the number of lines (that's what "-l" means). To
-  make this optional but default, use a **CMD**:
-
-  ```
-  FROM ubuntu
-  CMD ["-l", "-"]
-  ENTRYPOINT ["/usr/bin/wc"]
-  ```
-
-**VOLUME**
-  -- `VOLUME ["/data"]`
-  The **VOLUME** instruction creates a mount point with the specified name and marks
-  it as holding externally-mounted volumes from the native host or from other
-  containers.
-
-**USER**
-  -- `USER daemon`
-  Sets the username or UID used for running subsequent commands.
-
-  The **USER** instruction can optionally be used to set the group or GID. The
-  followings examples are all valid:
-  USER [user | user:group | uid | uid:gid | user:gid | uid:group ]
-
-  Until the **USER** instruction is set, instructions will be run as root. The USER
-  instruction can be used any number of times in a Dockerfile, and will only affect
-  subsequent commands.
-
-**WORKDIR**
-  -- `WORKDIR /path/to/workdir`
-  The **WORKDIR** instruction sets the working directory for the **RUN**, **CMD**,
-  **ENTRYPOINT**, **COPY** and **ADD** Dockerfile commands that follow it. It can
-  be used multiple times in a single Dockerfile. Relative paths are defined
-  relative to the path of the previous **WORKDIR** instruction. For example:
-
-  ```
-  WORKDIR /a
-  WORKDIR b
-  WORKDIR c
-  RUN pwd
-  ```
-
-  In the above example, the output of the **pwd** command is **a/b/c**.
-
-**ARG**
-   -- ARG <name>[=<default value>]
-
-  The `ARG` instruction defines a variable that users can pass at build-time to
-  the builder with the `docker build` command using the `--build-arg
-  <varname>=<value>` flag. If a user specifies a build argument that was not
-  defined in the Dockerfile, the build outputs a warning.
-
-  ```
-  [Warning] One or more build-args [foo] were not consumed
-  ```
-
-  The Dockerfile author can define a single variable by specifying `ARG` once or many
-  variables by specifying `ARG` more than once. For example, a valid Dockerfile:
-
-  ```
-  FROM busybox
-  ARG user1
-  ARG buildno
-  ...
-  ```
-
-  A Dockerfile author may optionally specify a default value for an `ARG` instruction:
-
-  ```
-  FROM busybox
-  ARG user1=someuser
-  ARG buildno=1
-  ...
-  ```
-
-  If an `ARG` value has a default and if there is no value passed at build-time, the
-  builder uses the default.
-
-  An `ARG` variable definition comes into effect from the line on which it is
-  defined in the `Dockerfile` not from the argument's use on the command-line or
-  elsewhere.  For example, consider this Dockerfile:
-
-  ```
-  1 FROM busybox
-  2 USER ${user:-some_user}
-  3 ARG user
-  4 USER $user
-  ...
-  ```
-  A user builds this file by calling:
-
-  ```
-  $ docker build --build-arg user=what_user Dockerfile
-  ```
-
-  The `USER` at line 2 evaluates to `some_user` as the `user` variable is defined on the
-  subsequent line 3. The `USER` at line 4 evaluates to `what_user` as `user` is
-  defined and the `what_user` value was passed on the command line. Prior to its definition by an
-  `ARG` instruction, any use of a variable results in an empty string.
-
-  > **Warning:** It is not recommended to use build-time variables for
-  >  passing secrets like github keys, user credentials etc. Build-time variable
-  >  values are visible to any user of the image with the `docker history` command.
-
-  You can use an `ARG` or an `ENV` instruction to specify variables that are
-  available to the `RUN` instruction. Environment variables defined using the
-  `ENV` instruction always override an `ARG` instruction of the same name. Consider
-  this Dockerfile with an `ENV` and `ARG` instruction.
-
-  ```
-  1 FROM ubuntu
-  2 ARG CONT_IMG_VER
-  3 ENV CONT_IMG_VER v1.0.0
-  4 RUN echo $CONT_IMG_VER
-  ```
-  Then, assume this image is built with this command:
-
-  ```
-  $ docker build --build-arg CONT_IMG_VER=v2.0.1 Dockerfile
-  ```
-
-  In this case, the `RUN` instruction uses `v1.0.0` instead of the `ARG` setting
-  passed by the user:`v2.0.1` This behavior is similar to a shell
-  script where a locally scoped variable overrides the variables passed as
-  arguments or inherited from environment, from its point of definition.
-
-  Using the example above but a different `ENV` specification you can create more
-  useful interactions between `ARG` and `ENV` instructions:
-
-  ```
-  1 FROM ubuntu
-  2 ARG CONT_IMG_VER
-  3 ENV CONT_IMG_VER ${CONT_IMG_VER:-v1.0.0}
-  4 RUN echo $CONT_IMG_VER
-  ```
-
-  Unlike an `ARG` instruction, `ENV` values are always persisted in the built
-  image. Consider a docker build without the --build-arg flag:
-
-  ```
-  $ docker build Dockerfile
-  ```
-
-  Using this Dockerfile example, `CONT_IMG_VER` is still persisted in the image but
-  its value would be `v1.0.0` as it is the default set in line 3 by the `ENV` instruction.
-
-  The variable expansion technique in this example allows you to pass arguments
-  from the command line and persist them in the final image by leveraging the
-  `ENV` instruction. Variable expansion is only supported for [a limited set of
-  Dockerfile instructions.](#environment-replacement)
-
-  Docker has a set of predefined `ARG` variables that you can use without a
-  corresponding `ARG` instruction in the Dockerfile.
-
-  * `HTTP_PROXY`
-  * `http_proxy`
-  * `HTTPS_PROXY`
-  * `https_proxy`
-  * `FTP_PROXY`
-  * `ftp_proxy`
-  * `NO_PROXY`
-  * `no_proxy`
-
-  To use these, simply pass them on the command line using the `--build-arg
-  <varname>=<value>` flag.
-
-**ONBUILD**
-  -- `ONBUILD [INSTRUCTION]`
-  The **ONBUILD** instruction adds a trigger instruction to an image. The
-  trigger is executed at a later time, when the image is used as the base for
-  another build. Docker executes the trigger in the context of the downstream
-  build, as if the trigger existed immediately after the **FROM** instruction in
-  the downstream Dockerfile.
-
-  You can register any build instruction as a trigger. A trigger is useful if
-  you are defining an image to use as a base for building other images. For
-  example, if you are defining an application build environment or a daemon that
-  is customized with a user-specific configuration.  
-
-  Consider an image intended as a reusable python application builder. It must
-  add application source code to a particular directory, and might need a build
-  script called after that. You can't just call **ADD** and **RUN** now, because
-  you don't yet have access to the application source code, and it is different
-  for each application build.
-
-  -- Providing application developers with a boilerplate Dockerfile to copy-paste
-  into their application is inefficient, error-prone, and
-  difficult to update because it mixes with application-specific code.
-  The solution is to use **ONBUILD** to register instructions in advance, to
-  run later, during the next build stage.
-
-# HISTORY
-*May 2014, Compiled by Zac Dover (zdover at redhat dot com) based on docker.com Dockerfile documentation.
-*Feb 2015, updated by Brian Goff (cpuguy83@gmail.com) for readability
-*Sept 2015, updated by Sally O'Malley (somalley@redhat.com)
-*Oct 2016, updated by Addam Hardy (addam.hardy@gmail.com)
diff --git a/components/engine/man/Dockerfile.aarch64 b/components/engine/man/Dockerfile.aarch64
deleted file mode 100644
index 80e9feb2d6..0000000000
--- a/components/engine/man/Dockerfile.aarch64
+++ /dev/null
@@ -1,34 +0,0 @@
-FROM    aarch64/ubuntu:xenial
-
-RUN     apt-get update && apt-get install -y git golang-go curl
-
-ENV     GO_VERSION 1.8.3
-ENV     GOARCH arm64
-ENV     PATH /go/bin:/usr/src/go/bin:$PATH
-
-RUN     mkdir /usr/src/go && \
-        curl -fsSL https://golang.org/dl/go${GO_VERSION}.src.tar.gz | tar -v -C /usr/src/go -xz --strip-components=1 && \
-        cd /usr/src/go/src && \
-        GOOS=linux GOARCH=arm64 GOROOT_BOOTSTRAP="$(go env GOROOT)" ./make.bash
-
-RUN     mkdir -p /go/src /go/bin /go/pkg
-ENV     GOPATH=/go
-RUN     export GLIDE=v0.11.1; \
-        export TARGET=/go/src/github.com/Masterminds; \
-        mkdir -p ${TARGET} && \
-        git clone https://github.com/Masterminds/glide.git ${TARGET}/glide && \
-        cd ${TARGET}/glide && \
-        git checkout $GLIDE && \
-        make build && \
-        cp ./glide /usr/bin/glide && \
-        cd / && rm -rf /go/src/* /go/bin/* /go/pkg/*
-
-COPY    glide.yaml /manvendor/
-COPY    glide.lock /manvendor/
-WORKDIR /manvendor/
-RUN     glide install && mv vendor src
-ENV     GOPATH=$GOPATH:/manvendor
-RUN     go build -o /usr/bin/go-md2man github.com/cpuguy83/go-md2man
-
-WORKDIR /go/src/github.com/docker/docker/
-ENTRYPOINT ["man/generate.sh"]
diff --git a/components/engine/man/Dockerfile.armhf b/components/engine/man/Dockerfile.armhf
deleted file mode 100644
index 3f05d99c32..0000000000
--- a/components/engine/man/Dockerfile.armhf
+++ /dev/null
@@ -1,43 +0,0 @@
-FROM armhf/debian:jessie
-
-# allow replacing httpredir or deb mirror
-ARG APT_MIRROR=deb.debian.org
-RUN sed -ri "s/(httpredir|deb).debian.org/$APT_MIRROR/g" /etc/apt/sources.list
-
-RUN apt-get update && apt-get install -y \
-  git \
-  bash \
-  curl \
-  gcc \
-  make
-
-ENV GO_VERSION 1.8.3
-RUN curl -fsSL "https://golang.org/dl/go${GO_VERSION}.linux-armv6l.tar.gz" \
-  | tar -xzC /usr/local
-ENV PATH /go/bin:/usr/local/go/bin:$PATH
-ENV GOPATH /go
-
-# We're building for armhf, which is ARMv7, so let's be explicit about that
-ENV GOARCH arm
-ENV GOARM 7
-
-RUN     mkdir -p /go/src /go/bin /go/pkg
-RUN     export GLIDE=v0.11.1; \
-        export TARGET=/go/src/github.com/Masterminds; \
-        mkdir -p ${TARGET} && \
-        git clone https://github.com/Masterminds/glide.git ${TARGET}/glide && \
-        cd ${TARGET}/glide && \
-        git checkout $GLIDE && \
-        make build && \
-        cp ./glide /usr/bin/glide && \
-        cd / && rm -rf /go/src/* /go/bin/* /go/pkg/*
-
-COPY    glide.yaml /manvendor/
-COPY    glide.lock /manvendor/
-WORKDIR /manvendor/
-RUN     glide install && mv vendor src
-ENV     GOPATH=$GOPATH:/manvendor
-RUN     go build -o /usr/bin/go-md2man github.com/cpuguy83/go-md2man
-
-WORKDIR /go/src/github.com/docker/docker/
-ENTRYPOINT ["man/generate.sh"]
diff --git a/components/engine/man/Dockerfile.ppc64le b/components/engine/man/Dockerfile.ppc64le
deleted file mode 100644
index a170ea4f28..0000000000
--- a/components/engine/man/Dockerfile.ppc64le
+++ /dev/null
@@ -1,35 +0,0 @@
-FROM    ppc64le/ubuntu:xenial
-
-RUN     apt-get update && apt-get install -y \
-        curl \
-        gcc \
-        git \
-        make \
-        tar
-
-ENV     GO_VERSION 1.8.3
-RUN     curl -fsSL "https://golang.org/dl/go${GO_VERSION}.linux-ppc64le.tar.gz" \
-        | tar -xzC /usr/local
-ENV     PATH /usr/local/go/bin:$PATH
-ENV     GOPATH=/go
-
-RUN     mkdir -p /go/src /go/bin /go/pkg
-RUN     export GLIDE=v0.11.1; \
-        export TARGET=/go/src/github.com/Masterminds; \
-        mkdir -p ${TARGET} && \
-        git clone https://github.com/Masterminds/glide.git ${TARGET}/glide && \
-        cd ${TARGET}/glide && \
-        git checkout $GLIDE && \
-        make build && \
-        cp ./glide /usr/bin/glide && \
-        cd / && rm -rf /go/src/* /go/bin/* /go/pkg/*
-
-COPY    glide.yaml /manvendor/
-COPY    glide.lock /manvendor/
-WORKDIR /manvendor/
-RUN     glide install && mv vendor src
-ENV     GOPATH=$GOPATH:/manvendor
-RUN     go build -o /usr/bin/go-md2man github.com/cpuguy83/go-md2man
-
-WORKDIR /go/src/github.com/docker/docker/
-ENTRYPOINT ["man/generate.sh"]
diff --git a/components/engine/man/Dockerfile.s390x b/components/engine/man/Dockerfile.s390x
deleted file mode 100644
index e2a783f698..0000000000
--- a/components/engine/man/Dockerfile.s390x
+++ /dev/null
@@ -1,35 +0,0 @@
-FROM    s390x/ubuntu:xenial
-
-RUN     apt-get update && apt-get install -y \
-        curl \
-        gcc \
-        git \
-        make \
-        tar
-
-ENV     GO_VERSION 1.8.3
-RUN     curl -fsSL "https://golang.org/dl/go${GO_VERSION}.linux-s390x.tar.gz" \
-        | tar -xzC /usr/local
-ENV     PATH /usr/local/go/bin:$PATH
-ENV     GOPATH=/go
-
-RUN     mkdir -p /go/src /go/bin /go/pkg
-RUN     export GLIDE=v0.11.1; \
-        export TARGET=/go/src/github.com/Masterminds; \
-        mkdir -p ${TARGET} && \
-        git clone https://github.com/Masterminds/glide.git ${TARGET}/glide && \
-        cd ${TARGET}/glide && \
-        git checkout $GLIDE && \
-        make build && \
-        cp ./glide /usr/bin/glide && \
-        cd / && rm -rf /go/src/* /go/bin/* /go/pkg/*
-
-COPY    glide.yaml /manvendor/
-COPY    glide.lock /manvendor/
-WORKDIR /manvendor/
-RUN     glide install && mv vendor src
-ENV     GOPATH=$GOPATH:/manvendor
-RUN     go build -o /usr/bin/go-md2man github.com/cpuguy83/go-md2man
-
-WORKDIR /go/src/github.com/docker/docker/
-ENTRYPOINT ["man/generate.sh"]
diff --git a/components/engine/man/README.md b/components/engine/man/README.md
deleted file mode 100644
index 82dac650f9..0000000000
--- a/components/engine/man/README.md
+++ /dev/null
@@ -1,15 +0,0 @@
-Docker Documentation
-====================
-
-This directory contains scripts for generating the man pages. Many of the man
-pages are generated directly from the `spf13/cobra` `Command` definition. Some
-legacy pages are still generated from the markdown files in this directory.
-Do *not* edit the man pages in the man1 directory. Instead, update the
-Cobra command or amend the Markdown files for legacy pages.
-
-
-## Generate the man pages
-
-From within the project root directory run:
-
-    make manpages
diff --git a/components/engine/man/docker-build.1.md b/components/engine/man/docker-build.1.md
deleted file mode 100644
index 3ac9f81f0f..0000000000
--- a/components/engine/man/docker-build.1.md
+++ /dev/null
@@ -1,359 +0,0 @@
-% DOCKER(1) Docker User Manuals
-% Docker Community
-% JUNE 2014
-# NAME
-docker-build - Build an image from a Dockerfile
-
-# SYNOPSIS
-**docker build**
-[**--add-host**[=*[]*]]
-[**--build-arg**[=*[]*]]
-[**--cache-from**[=*[]*]]
-[**--cpu-shares**[=*0*]]
-[**--cgroup-parent**[=*CGROUP-PARENT*]]
-[**--help**]
-[**--iidfile**[=*CIDFILE*]]
-[**-f**|**--file**[=*PATH/Dockerfile*]]
-[**-squash**] *Experimental*
-[**--force-rm**]
-[**--isolation**[=*default*]]
-[**--label**[=*[]*]]
-[**--no-cache**]
-[**--pull**]
-[**--compress**]
-[**-q**|**--quiet**]
-[**--rm**[=*true*]]
-[**-t**|**--tag**[=*[]*]]
-[**-m**|**--memory**[=*MEMORY*]]
-[**--memory-swap**[=*LIMIT*]]
-[**--network**[=*"default"*]]
-[**--shm-size**[=*SHM-SIZE*]]
-[**--cpu-period**[=*0*]]
-[**--cpu-quota**[=*0*]]
-[**--cpuset-cpus**[=*CPUSET-CPUS*]]
-[**--cpuset-mems**[=*CPUSET-MEMS*]]
-[**--target**[=*[]*]]
-[**--ulimit**[=*[]*]]
-PATH | URL | -
-
-# DESCRIPTION
-This will read the Dockerfile from the directory specified in **PATH**.
-It also sends any other files and directories found in the current
-directory to the Docker daemon. The contents of this directory would
-be used by **ADD** commands found within the Dockerfile.
-
-Warning, this will send a lot of data to the Docker daemon depending
-on the contents of the current directory. The build is run by the Docker
-daemon, not by the CLI, so the whole context must be transferred to the daemon. 
-The Docker CLI reports "Sending build context to Docker daemon" when the context is sent to
-the daemon.
-
-When the URL to a tarball archive or to a single Dockerfile is given, no context is sent from
-the client to the Docker daemon. In this case, the Dockerfile at the root of the archive and
-the rest of the archive will get used as the context of the build.  When a Git repository is
-set as the **URL**, the repository is cloned locally and then sent as the context.
-
-# OPTIONS
-**-f**, **--file**=*PATH/Dockerfile*
-   Path to the Dockerfile to use. If the path is a relative path and you are
-   building from a local directory, then the path must be relative to that
-   directory. If you are building from a remote URL pointing to either a
-   tarball or a Git repository, then the path must be relative to the root of
-   the remote context. In all cases, the file must be within the build context.
-   The default is *Dockerfile*.
-
-**--squash**=*true*|*false*
-   **Experimental Only**
-   Once the image is built, squash the new layers into a new image with a single
-   new layer. Squashing does not destroy any existing image, rather it creates a new
-   image with the content of the squashed layers. This effectively makes it look
-   like all `Dockerfile` commands were created with a single layer. The build
-   cache is preserved with this method.
-
-   **Note**: using this option means the new image will not be able to take
-   advantage of layer sharing with other images and may use significantly more
-   space.
-
-   **Note**: using this option you may see significantly more space used due to
-   storing two copies of the image, one for the build cache with all the cache
-   layers in tact, and one for the squashed version.
-
-**--add-host**=[]
-   Add a custom host-to-IP mapping (host:ip)
-
-   Add a line to /etc/hosts. The format is hostname:ip.  The **--add-host**
-option can be set multiple times.
-
-**--build-arg**=*variable*
-   name and value of a **buildarg**.
-
-   For example, if you want to pass a value for `http_proxy`, use
-   `--build-arg=http_proxy="http://some.proxy.url"`
-
-   Users pass these values at build-time. Docker uses the `buildargs` as the
-   environment context for command(s) run via the Dockerfile's `RUN` instruction
-   or for variable expansion in other Dockerfile instructions. This is not meant
-   for passing secret values. [Read more about the buildargs instruction](https://docs.docker.com/engine/reference/builder/#arg)
-
-**--cache-from**=""
-   Set image that will be used as a build cache source.
-
-**--force-rm**=*true*|*false*
-   Always remove intermediate containers, even after unsuccessful builds. The default is *false*.
-
-**--isolation**="*default*"
-   Isolation specifies the type of isolation technology used by containers. 
-
-**--label**=*label*
-   Set metadata for an image
-
-**--no-cache**=*true*|*false*
-   Do not use cache when building the image. The default is *false*.
-
-**--iidfile**=""
-   Write the image ID to the file
-
-**--help**
-  Print usage statement
-
-**--pull**=*true*|*false*
-   Always attempt to pull a newer version of the image. The default is *false*.
-
-**--compress**=*true*|*false*
-    Compress the build context using gzip. The default is *false*.
-
-**-q**, **--quiet**=*true*|*false*
-   Suppress the build output and print image ID on success. The default is *false*.
-
-**--rm**=*true*|*false*
-   Remove intermediate containers after a successful build. The default is *true*.
-
-**-t**, **--tag**=""
-   Repository names (and optionally with tags) to be applied to the resulting 
-   image in case of success. Refer to **docker-tag(1)** for more information
-   about valid tag names.
-
-**-m**, **--memory**=*MEMORY*
-  Memory limit
-
-**--memory-swap**=*LIMIT*
-   A limit value equal to memory plus swap. Must be used with the  **-m**
-(**--memory**) flag. The swap `LIMIT` should always be larger than **-m**
-(**--memory**) value.
-
-   The format of `LIMIT` is `<number>[<unit>]`. Unit can be `b` (bytes),
-`k` (kilobytes), `m` (megabytes), or `g` (gigabytes). If you don't specify a
-unit, `b` is used. Set LIMIT to `-1` to enable unlimited swap.
-
-**--network**=*bridge*
-  Set the networking mode for the RUN instructions during build. Supported standard
-  values are: `bridge`, `host`, `none` and `container:<name|id>`. Any other value
-  is taken as a custom network's name or ID which this container should connect to.
-
-**--shm-size**=*SHM-SIZE*
-  Size of `/dev/shm`. The format is `<number><unit>`. `number` must be greater than `0`.
-  Unit is optional and can be `b` (bytes), `k` (kilobytes), `m` (megabytes), or `g` (gigabytes). If you omit the unit, the system uses bytes.
-  If you omit the size entirely, the system uses `64m`.
-
-**--cpu-shares**=*0*
-  CPU shares (relative weight).
-
-  By default, all containers get the same proportion of CPU cycles.
-  CPU shares is a 'relative weight', relative to the default setting of 1024.
-  This default value is defined here: 
-  ```
-   cat /sys/fs/cgroup/cpu/cpu.shares
-   1024
-  ```
-  You can change this proportion by adjusting the container's CPU share 
-  weighting relative to the weighting of all other running containers.
-
-  To modify the proportion from the default of 1024, use the **--cpu-shares**
-  flag to set the weighting to 2 or higher.
-
-      Container   CPU share    Flag             
-      {C0}        60% of CPU  --cpu-shares=614 (614 is 60% of 1024)
-      {C1}        40% of CPU  --cpu-shares=410 (410 is 40% of 1024)
-
-  The proportion is only applied when CPU-intensive processes are running.
-  When tasks in one container are idle, the other containers can use the
-  left-over CPU time. The actual amount of CPU time used varies depending on
-  the number of containers running on the system.
-
-  For example, consider three containers, where one has **--cpu-shares=1024** and
-  two others have **--cpu-shares=512**. When processes in all three
-  containers attempt to use 100% of CPU, the first container would receive
-  50% of the total CPU time. If you add a fourth container with **--cpu-shares=1024**,
-  the first container only gets 33% of the CPU. The remaining containers
-  receive 16.5%, 16.5% and 33% of the CPU.
-
-
-      Container   CPU share   Flag                CPU time            
-      {C0}        100%        --cpu-shares=1024   33%
-      {C1}        50%         --cpu-shares=512    16.5%
-      {C2}        50%         --cpu-shares=512    16.5%
-      {C4}        100%        --cpu-shares=1024   33%
-
-
-  On a multi-core system, the shares of CPU time are distributed across the CPU
-  cores. Even if a container is limited to less than 100% of CPU time, it can
-  use 100% of each individual CPU core.
-
-  For example, consider a system with more than three cores. If you start one
-  container **{C0}** with **--cpu-shares=512** running one process, and another container
-  **{C1}** with **--cpu-shares=1024** running two processes, this can result in the following
-  division of CPU shares:
-
-      PID    container    CPU    CPU share
-      100    {C0}         0      100% of CPU0
-      101    {C1}         1      100% of CPU1
-      102    {C1}         2      100% of CPU2
-
-**--cpu-period**=*0*
-  Limit the CPU CFS (Completely Fair Scheduler) period.
-
-  Limit the container's CPU usage. This flag causes the kernel to restrict the
-  container's CPU usage to the period you specify.
-
-**--cpu-quota**=*0*
-  Limit the CPU CFS (Completely Fair Scheduler) quota. 
-
-  By default, containers run with the full CPU resource. This flag causes the
-kernel to restrict the container's CPU usage to the quota you specify.
-
-**--cpuset-cpus**=*CPUSET-CPUS*
-  CPUs in which to allow execution (0-3, 0,1).
-
-**--cpuset-mems**=*CPUSET-MEMS*
-  Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on
-  NUMA systems.
-
-  For example, if you have four memory nodes on your system (0-3), use `--cpuset-mems=0,1`
-to ensure the processes in your Docker container only use memory from the first
-two memory nodes.
-
-**--cgroup-parent**=*CGROUP-PARENT*
-  Path to `cgroups` under which the container's `cgroup` are created.
-
-  If the path is not absolute, the path is considered relative to the `cgroups` path of the init process.
-Cgroups are created if they do not already exist.
-
-**--target**=""
-   Set the target build stage name.
-
-**--ulimit**=[]
-  Ulimit options
-
-  For more information about `ulimit` see [Setting ulimits in a 
-container](https://docs.docker.com/engine/reference/commandline/run/#set-ulimits-in-container---ulimit)
-
-# EXAMPLES
-
-## Building an image using a Dockerfile located inside the current directory
-
-Docker images can be built using the build command and a Dockerfile:
-
-    docker build .
-
-During the build process Docker creates intermediate images. In order to
-keep them, you must explicitly set `--rm=false`.
-
-    docker build --rm=false .
-
-A good practice is to make a sub-directory with a related name and create
-the Dockerfile in that directory. For example, a directory called mongo may
-contain a Dockerfile to create a Docker MongoDB image. Likewise, another
-directory called httpd may be used to store Dockerfiles for Apache web
-server images.
-
-It is also a good practice to add the files required for the image to the
-sub-directory. These files will then be specified with the `COPY` or `ADD`
-instructions in the `Dockerfile`.
-
-Note: If you include a tar file (a good practice), then Docker will
-automatically extract the contents of the tar file specified within the `ADD`
-instruction into the specified target.
-
-## Building an image and naming that image
-
-A good practice is to give a name to the image you are building. Note that 
-only a-z0-9-_. should be used for consistency.  There are no hard rules here but it is best to give the names consideration. 
-
-The **-t**/**--tag** flag is used to rename an image. Here are some examples:
-
-Though it is not a good practice, image names can be arbitrary:
-
-    docker build -t myimage .
-
-A better approach is to provide a fully qualified and meaningful repository,
-name, and tag (where the tag in this context means the qualifier after 
-the ":"). In this example we build a JBoss image for the Fedora repository 
-and give it the version 1.0:
-
-    docker build -t fedora/jboss:1.0 .
-
-The next example is for the "whenry" user repository and uses Fedora and
-JBoss and gives it the version 2.1 :
-
-    docker build -t whenry/fedora-jboss:v2.1 .
-
-If you do not provide a version tag then Docker will assign `latest`:
-
-    docker build -t whenry/fedora-jboss .
-
-When you list the images, the image above will have the tag `latest`.
-
-You can apply multiple tags to an image. For example, you can apply the `latest`
-tag to a newly built image and add another tag that references a specific
-version.
-For example, to tag an image both as `whenry/fedora-jboss:latest` and
-`whenry/fedora-jboss:v2.1`, use the following:
-
-    docker build -t whenry/fedora-jboss:latest -t whenry/fedora-jboss:v2.1 .
-
-So renaming an image is arbitrary but consideration should be given to 
-a useful convention that makes sense for consumers and should also take
-into account Docker community conventions.
-
-
-## Building an image using a URL
-
-This will clone the specified GitHub repository from the URL and use it
-as context. The Dockerfile at the root of the repository is used as
-Dockerfile. This only works if the GitHub repository is a dedicated
-repository.
-
-    docker build github.com/scollier/purpletest
-
-Note: You can set an arbitrary Git repository via the `git://` scheme.
-
-## Building an image using a URL to a tarball'ed context
-
-This will send the URL itself to the Docker daemon. The daemon will fetch the
-tarball archive, decompress it and use its contents as the build context.  The 
-Dockerfile at the root of the archive and the rest of the archive will get used
-as the context of the build. If you pass an **-f PATH/Dockerfile** option as well,
-the system will look for that file inside the contents of the tarball.
-
-    docker build -f dev/Dockerfile https://10.10.10.1/docker/context.tar.gz
-
-Note: supported compression formats are 'xz', 'bzip2', 'gzip' and 'identity' (no compression).
-
-## Specify isolation technology for container (--isolation)
-
-This option is useful in situations where you are running Docker containers on
-Windows. The `--isolation=<value>` option sets a container's isolation
-technology. On Linux, the only supported is the `default` option which uses
-Linux namespaces. On Microsoft Windows, you can specify these values:
-
-* `default`: Use the value specified by the Docker daemon's `--exec-opt` . If the `daemon` does not specify an isolation technology, Microsoft Windows uses `process` as its default value.
-* `process`: Namespace isolation only.
-* `hyperv`: Hyper-V hypervisor partition-based isolation.
-
-Specifying the `--isolation` flag without a value is the same as setting `--isolation="default"`.
-
-# HISTORY
-March 2014, Originally compiled by William Henry (whenry at redhat dot com)
-based on docker.com source material and internal work.
-June 2014, updated by Sven Dowideit <SvenDowideit@home.org.au>
-June 2015, updated by Sally O'Malley <somalley@redhat.com>
diff --git a/components/engine/man/docker-config-json.5.md b/components/engine/man/docker-config-json.5.md
deleted file mode 100644
index 49987f08b8..0000000000
--- a/components/engine/man/docker-config-json.5.md
+++ /dev/null
@@ -1,72 +0,0 @@
-% CONFIG.JSON(5) Docker User Manuals
-% Docker Community
-% JANUARY 2016
-# NAME
-HOME/.docker/config.json - Default Docker configuration file
-
-# INTRODUCTION
-
-By default, the Docker command line stores its configuration files in a
-directory called `.docker` within your `$HOME` directory.  Docker manages most of
-the files in the configuration directory and you should not modify them.
-However, you *can modify* the `config.json` file to control certain aspects of
-how the `docker` command behaves.
-
-Currently, you can modify the `docker` command behavior using environment
-variables or command-line options. You can also use options within
-`config.json` to modify some of the same behavior. When using these
-mechanisms, you must keep in mind the order of precedence among them. Command
-line options override environment variables and environment variables override
-properties you specify in a `config.json` file.
-
-The `config.json` file stores a JSON encoding of several properties:
-
-* The `HttpHeaders` property specifies a set of headers to include in all messages
-sent from the Docker client to the daemon. Docker does not try to interpret or
-understand these header; it simply puts them into the messages. Docker does not
-allow these headers to change any headers it sets for itself.
-
-* The `psFormat` property specifies the default format for `docker ps` output.
-When the `--format` flag is not provided with the `docker ps` command,
-Docker's client uses this property. If this property is not set, the client
-falls back to the default table format. For a list of supported formatting
-directives, see **docker-ps(1)**.
-
-* The `detachKeys` property specifies the default key sequence which
-detaches the container. When the `--detach-keys` flag is not provide
-with the `docker attach`, `docker exec`, `docker run` or `docker
-start`, Docker's client uses this property. If this property is not
-set, the client falls back to the default sequence `ctrl-p,ctrl-q`.
-
-
-* The `imagesFormat` property  specifies the default format for `docker images`
-output. When the `--format` flag is not provided with the `docker images`
-command, Docker's client uses this property. If this property is not set, the
-client falls back to the default table format. For a list of supported
-formatting directives, see **docker-images(1)**.
-
-You can specify a different location for the configuration files via the
-`DOCKER_CONFIG` environment variable or the `--config` command line option. If
-both are specified, then the `--config` option overrides the `DOCKER_CONFIG`
-environment variable:
-
-    docker --config ~/testconfigs/ ps
-
-This command instructs Docker to use the configuration files in the
-`~/testconfigs/` directory when running the `ps` command.
-
-## Examples
-
-Following is a sample `config.json` file:
-
-    {
-      "HttpHeaders": {
-        "MyHeader": "MyValue"
-      },
-      "psFormat": "table {{.ID}}\\t{{.Image}}\\t{{.Command}}\\t{{.Labels}}",
-      "imagesFormat": "table {{.ID}}\\t{{.Repository}}\\t{{.Tag}}\\t{{.CreatedAt}}",
-      "detachKeys": "ctrl-e,e"
-    }
-
-# HISTORY
-January 2016, created by Moxiegirl <mary@docker.com>
diff --git a/components/engine/man/docker-run.1.md b/components/engine/man/docker-run.1.md
deleted file mode 100644
index 2a743c134e..0000000000
--- a/components/engine/man/docker-run.1.md
+++ /dev/null
@@ -1,1108 +0,0 @@
-% DOCKER(1) Docker User Manuals
-% Docker Community
-% JUNE 2014
-# NAME
-docker-run - Run a command in a new container
-
-# SYNOPSIS
-**docker run**
-[**-a**|**--attach**[=*[]*]]
-[**--add-host**[=*[]*]]
-[**--blkio-weight**[=*[BLKIO-WEIGHT]*]]
-[**--blkio-weight-device**[=*[]*]]
-[**--cpu-shares**[=*0*]]
-[**--cap-add**[=*[]*]]
-[**--cap-drop**[=*[]*]]
-[**--cgroup-parent**[=*CGROUP-PATH*]]
-[**--cidfile**[=*CIDFILE*]]
-[**--cpu-count**[=*0*]]
-[**--cpu-percent**[=*0*]]
-[**--cpu-period**[=*0*]]
-[**--cpu-quota**[=*0*]]
-[**--cpu-rt-period**[=*0*]]
-[**--cpu-rt-runtime**[=*0*]]
-[**--cpus**[=*0.0*]]
-[**--cpuset-cpus**[=*CPUSET-CPUS*]]
-[**--cpuset-mems**[=*CPUSET-MEMS*]]
-[**-d**|**--detach**]
-[**--detach-keys**[=*[]*]]
-[**--device**[=*[]*]]
-[**--device-cgroup-rule**[=*[]*]]
-[**--device-read-bps**[=*[]*]]
-[**--device-read-iops**[=*[]*]]
-[**--device-write-bps**[=*[]*]]
-[**--device-write-iops**[=*[]*]]
-[**--dns**[=*[]*]]
-[**--dns-option**[=*[]*]]
-[**--dns-search**[=*[]*]]
-[**-e**|**--env**[=*[]*]]
-[**--entrypoint**[=*ENTRYPOINT*]]
-[**--env-file**[=*[]*]]
-[**--expose**[=*[]*]]
-[**--group-add**[=*[]*]]
-[**-h**|**--hostname**[=*HOSTNAME*]]
-[**--help**]
-[**--init**]
-[**-i**|**--interactive**]
-[**--ip**[=*IPv4-ADDRESS*]]
-[**--ip6**[=*IPv6-ADDRESS*]]
-[**--ipc**[=*IPC*]]
-[**--isolation**[=*default*]]
-[**--kernel-memory**[=*KERNEL-MEMORY*]]
-[**-l**|**--label**[=*[]*]]
-[**--label-file**[=*[]*]]
-[**--link**[=*[]*]]
-[**--link-local-ip**[=*[]*]]
-[**--log-driver**[=*[]*]]
-[**--log-opt**[=*[]*]]
-[**-m**|**--memory**[=*MEMORY*]]
-[**--mac-address**[=*MAC-ADDRESS*]]
-[**--memory-reservation**[=*MEMORY-RESERVATION*]]
-[**--memory-swap**[=*LIMIT*]]
-[**--memory-swappiness**[=*MEMORY-SWAPPINESS*]]
-[**--mount**[=*[MOUNT]*]]
-[**--name**[=*NAME*]]
-[**--network-alias**[=*[]*]]
-[**--network**[=*"bridge"*]]
-[**--oom-kill-disable**]
-[**--oom-score-adj**[=*0*]]
-[**-P**|**--publish-all**]
-[**-p**|**--publish**[=*[]*]]
-[**--pid**[=*[PID]*]]
-[**--userns**[=*[]*]]
-[**--pids-limit**[=*PIDS_LIMIT*]]
-[**--privileged**]
-[**--read-only**]
-[**--restart**[=*RESTART*]]
-[**--rm**]
-[**--security-opt**[=*[]*]]
-[**--storage-opt**[=*[]*]]
-[**--stop-signal**[=*SIGNAL*]]
-[**--stop-timeout**[=*TIMEOUT*]]
-[**--shm-size**[=*[]*]]
-[**--sig-proxy**[=*true*]]
-[**--sysctl**[=*[]*]]
-[**-t**|**--tty**]
-[**--tmpfs**[=*[CONTAINER-DIR[:<OPTIONS>]*]]
-[**-u**|**--user**[=*USER*]]
-[**--ulimit**[=*[]*]]
-[**--uts**[=*[]*]]
-[**-v**|**--volume**[=*[[HOST-DIR:]CONTAINER-DIR[:OPTIONS]]*]]
-[**--volume-driver**[=*DRIVER*]]
-[**--volumes-from**[=*[]*]]
-[**-w**|**--workdir**[=*WORKDIR*]]
-IMAGE [COMMAND] [ARG...]
-
-# DESCRIPTION
-
-Run a process in a new container. **docker run** starts a process with its own
-file system, its own networking, and its own isolated process tree. The IMAGE
-which starts the process may define defaults related to the process that will be
-run in the container, the networking to expose, and more, but **docker run**
-gives final control to the operator or administrator who starts the container
-from the image. For that reason **docker run** has more options than any other
-Docker command.
-
-If the IMAGE is not already loaded then **docker run** will pull the IMAGE, and
-all image dependencies, from the repository in the same way running **docker
-pull** IMAGE, before it starts the container from that image.
-
-# OPTIONS
-**-a**, **--attach**=[]
-   Attach to STDIN, STDOUT or STDERR.
-
-   In foreground mode (the default when **-d**
-is not specified), **docker run** can start the process in the container
-and attach the console to the process's standard input, output, and standard
-error. It can even pretend to be a TTY (this is what most commandline
-executables expect) and pass along signals. The **-a** option can be set for
-each of stdin, stdout, and stderr.
-
-**--add-host**=[]
-   Add a custom host-to-IP mapping (host:ip)
-
-   Add a line to /etc/hosts. The format is hostname:ip.  The **--add-host**
-option can be set multiple times.
-
-**--blkio-weight**=*0*
-   Block IO weight (relative weight) accepts a weight value between 10 and 1000.
-
-**--blkio-weight-device**=[]
-   Block IO weight (relative device weight, format: `DEVICE_NAME:WEIGHT`).
-
-**--cpu-shares**=*0*
-   CPU shares (relative weight)
-
-   By default, all containers get the same proportion of CPU cycles. This proportion
-can be modified by changing the container's CPU share weighting relative
-to the weighting of all other running containers.
-
-To modify the proportion from the default of 1024, use the **--cpu-shares**
-flag to set the weighting to 2 or higher.
-
-The proportion will only apply when CPU-intensive processes are running.
-When tasks in one container are idle, other containers can use the
-left-over CPU time. The actual amount of CPU time will vary depending on
-the number of containers running on the system.
-
-For example, consider three containers, one has a cpu-share of 1024 and
-two others have a cpu-share setting of 512. When processes in all three
-containers attempt to use 100% of CPU, the first container would receive
-50% of the total CPU time. If you add a fourth container with a cpu-share
-of 1024, the first container only gets 33% of the CPU. The remaining containers
-receive 16.5%, 16.5% and 33% of the CPU.
-
-On a multi-core system, the shares of CPU time are distributed over all CPU
-cores. Even if a container is limited to less than 100% of CPU time, it can
-use 100% of each individual CPU core.
-
-For example, consider a system with more than three cores. If you start one
-container **{C0}** with **-c=512** running one process, and another container
-**{C1}** with **-c=1024** running two processes, this can result in the following
-division of CPU shares:
-
-    PID    container	CPU	CPU share
-    100    {C0}		0	100% of CPU0
-    101    {C1}		1	100% of CPU1
-    102    {C1}		2	100% of CPU2
-
-**--cap-add**=[]
-   Add Linux capabilities
-
-**--cap-drop**=[]
-   Drop Linux capabilities
-
-**--cgroup-parent**=""
-   Path to cgroups under which the cgroup for the container will be created. If the path is not absolute, the path is considered to be relative to the cgroups path of the init process. Cgroups will be created if they do not already exist.
-
-**--cidfile**=""
-   Write the container ID to the file
-
-**--cpu-count**=*0*
-    Limit the number of CPUs available for execution by the container.
-    
-    On Windows Server containers, this is approximated as a percentage of total CPU usage.
-
-    On Windows Server containers, the processor resource controls are mutually exclusive, the order of precedence is CPUCount first, then CPUShares, and CPUPercent last.
-
-**--cpu-percent**=*0*
-    Limit the percentage of CPU available for execution by a container running on a Windows daemon.
-
-    On Windows Server containers, the processor resource controls are mutually exclusive, the order of precedence is CPUCount first, then CPUShares, and CPUPercent last.
-
-**--cpu-period**=*0*
-   Limit the CPU CFS (Completely Fair Scheduler) period
-
-   Limit the container's CPU usage. This flag tell the kernel to restrict the container's CPU usage to the period you specify.
-
-**--cpuset-cpus**=""
-   CPUs in which to allow execution (0-3, 0,1)
-
-**--cpuset-mems**=""
-   Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on NUMA systems.
-
-   If you have four memory nodes on your system (0-3), use `--cpuset-mems=0,1`
-then processes in your Docker container will only use memory from the first
-two memory nodes.
-
-**--cpu-quota**=*0*
-   Limit the CPU CFS (Completely Fair Scheduler) quota
-
-   Limit the container's CPU usage. By default, containers run with the full
-CPU resource. This flag tell the kernel to restrict the container's CPU usage
-to the quota you specify.
-
-**--cpu-rt-period**=0
-   Limit the CPU real-time period in microseconds
-
-   Limit the container's Real Time CPU usage. This flag tell the kernel to restrict the container's Real Time CPU usage to the period you specify.
-
-**--cpu-rt-runtime**=0
-   Limit the CPU real-time runtime in microseconds
-
-   Limit the containers Real Time CPU usage. This flag tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume. Ex:
-   Period of 1,000,000us and Runtime of 950,000us means that this container could consume 95% of available CPU and leave the remaining 5% to normal priority tasks.
-
-   The sum of all runtimes across containers cannot exceed the amount allotted to the parent cgroup.
-
-**--cpus**=0.0
-   Number of CPUs. The default is *0.0* which means no limit.
-
-**-d**, **--detach**=*true*|*false*
-   Detached mode: run the container in the background and print the new container ID. The default is *false*.
-
-   At any time you can run **docker ps** in
-the other shell to view a list of the running containers. You can reattach to a
-detached container with **docker attach**.
-
-   When attached in the tty mode, you can detach from the container (and leave it
-running) using a configurable key sequence. The default sequence is `CTRL-p CTRL-q`.
-You configure the key sequence using the **--detach-keys** option or a configuration file.
-See **config-json(5)** for documentation on using a configuration file.
-
-**--detach-keys**=""
-   Override the key sequence for detaching a container. Format is a single character `[a-Z]` or `ctrl-<value>` where `<value>` is one of: `a-z`, `@`, `^`, `[`, `,` or `_`.
-
-**--device**=[]
-   Add a host device to the container (e.g. --device=/dev/sdc:/dev/xvdc:rwm)
-
-**--device-cgroup-rule**=[]
-   Add a rule to the cgroup allowed devices list.
-   
-   The rule is expected to be in the format specified in the Linux kernel documentation (Documentation/cgroup-v1/devices.txt):
-     - type: `a` (all), `c` (char) or `b` (block)
-     - major and minor: either a number or `*` for all
-     - permission: a composition of `r` (read), `w` (write) and `m` (mknod)
-
-   Example: `c 1:3 mr`: allow for character device with major `1` and minor `3` to be created (`m`) and read (`r`)
-
-**--device-read-bps**=[]
-   Limit read rate from a device (e.g. --device-read-bps=/dev/sda:1mb)
-
-**--device-read-iops**=[]
-   Limit read rate from a device (e.g. --device-read-iops=/dev/sda:1000)
-
-**--device-write-bps**=[]
-   Limit write rate to a device (e.g. --device-write-bps=/dev/sda:1mb)
-
-**--device-write-iops**=[]
-   Limit write rate to a device (e.g. --device-write-iops=/dev/sda:1000)
-
-**--dns-search**=[]
-   Set custom DNS search domains (Use --dns-search=. if you don't wish to set the search domain)
-
-**--dns-option**=[]
-   Set custom DNS options
-
-**--dns**=[]
-   Set custom DNS servers
-
-   This option can be used to override the DNS
-configuration passed to the container. Typically this is necessary when the
-host DNS configuration is invalid for the container (e.g., 127.0.0.1). When this
-is the case the **--dns** flags is necessary for every run.
-
-**-e**, **--env**=[]
-   Set environment variables
-
-   This option allows you to specify arbitrary
-environment variables that are available for the process that will be launched
-inside of the container.
-
-**--entrypoint**=""
-   Overwrite the default ENTRYPOINT of the image
-
-   This option allows you to overwrite the default entrypoint of the image that
-is set in the Dockerfile. The ENTRYPOINT of an image is similar to a COMMAND
-because it specifies what executable to run when the container starts, but it is
-(purposely) more difficult to override. The ENTRYPOINT gives a container its
-default nature or behavior, so that when you set an ENTRYPOINT you can run the
-container as if it were that binary, complete with default options, and you can
-pass in more options via the COMMAND. But, sometimes an operator may want to run
-something else inside the container, so you can override the default ENTRYPOINT
-at runtime by using a **--entrypoint** and a string to specify the new
-ENTRYPOINT.
-
-**--env-file**=[]
-   Read in a line delimited file of environment variables
-
-**--expose**=[]
-   Expose a port, or a range of ports (e.g. --expose=3300-3310) informs Docker
-that the container listens on the specified network ports at runtime. Docker
-uses this information to interconnect containers using links and to set up port
-redirection on the host system.
-
-**--group-add**=[]
-   Add additional groups to run as
-
-**-h**, **--hostname**=""
-   Container host name
-
-   Sets the container host name that is available inside the container.
-
-**--help**
-   Print usage statement
-
-**--init**
-   Run an init inside the container that forwards signals and reaps processes
-
-**-i**, **--interactive**=*true*|*false*
-   Keep STDIN open even if not attached. The default is *false*.
-
-   When set to true, keep stdin open even if not attached. The default is false.
-
-**--ip**=""
-   Sets the container's interface IPv4 address (e.g., 172.23.0.9)
-
-   It can only be used in conjunction with **--network** for user-defined networks
-
-**--ip6**=""
-   Sets the container's interface IPv6 address (e.g., 2001:db8::1b99)
-
-   It can only be used in conjunction with **--network** for user-defined networks
-
-**--ipc**=""
-   Default is to create a private IPC namespace (POSIX SysV IPC) for the container
-                               'container:<name|id>': reuses another container shared memory, semaphores and message queues
-                               'host': use the host shared memory,semaphores and message queues inside the container.  Note: the host mode gives the container full access to local shared memory and is therefore considered insecure.
-
-**--isolation**="*default*"
-   Isolation specifies the type of isolation technology used by containers. Note
-that the default on Windows server is `process`, and the default on Windows client
-is `hyperv`. Linux only supports `default`.
-
-**-l**, **--label**=[]
-   Set metadata on the container (e.g., --label com.example.key=value)
-
-**--kernel-memory**=""
-   Kernel memory limit (format: `<number>[<unit>]`, where unit = b, k, m or g)
-
-   Constrains the kernel memory available to a container. If a limit of 0
-is specified (not using `--kernel-memory`), the container's kernel memory
-is not limited. If you specify a limit, it may be rounded up to a multiple
-of the operating system's page size and the value can be very large,
-millions of trillions.
-
-**--label-file**=[]
-   Read in a line delimited file of labels
-
-**--link**=[]
-   Add link to another container in the form of <name or id>:alias or just <name or id>
-in which case the alias will match the name
-
-   If the operator
-uses **--link** when starting the new client container, then the client
-container can access the exposed port via a private networking interface. Docker
-will set some environment variables in the client container to help indicate
-which interface and port to use.
-
-**--link-local-ip**=[]
-   Add one or more link-local IPv4/IPv6 addresses to the container's interface
-
-**--log-driver**="*json-file*|*syslog*|*journald*|*gelf*|*fluentd*|*awslogs*|*splunk*|*etwlogs*|*gcplogs*|*none*"
-  Logging driver for the container. Default is defined by daemon `--log-driver` flag.
-  **Warning**: the `docker logs` command works only for the `json-file` and
-  `journald` logging drivers.
-
-**--log-opt**=[]
-  Logging driver specific options.
-
-**-m**, **--memory**=""
-   Memory limit (format: <number>[<unit>], where unit = b, k, m or g)
-
-   Allows you to constrain the memory available to a container. If the host
-supports swap memory, then the **-m** memory setting can be larger than physical
-RAM. If a limit of 0 is specified (not using **-m**), the container's memory is
-not limited. The actual limit may be rounded up to a multiple of the operating
-system's page size (the value would be very large, that's millions of trillions).
-
-**--memory-reservation**=""
-   Memory soft limit (format: <number>[<unit>], where unit = b, k, m or g)
-
-   After setting memory reservation, when the system detects memory contention
-or low memory, containers are forced to restrict their consumption to their
-reservation. So you should always set the value below **--memory**, otherwise the
-hard limit will take precedence. By default, memory reservation will be the same
-as memory limit.
-
-**--memory-swap**="LIMIT"
-   A limit value equal to memory plus swap. Must be used with the  **-m**
-(**--memory**) flag. The swap `LIMIT` should always be larger than **-m**
-(**--memory**) value.  By default, the swap `LIMIT` will be set to double
-the value of --memory.
-
-   The format of `LIMIT` is `<number>[<unit>]`. Unit can be `b` (bytes),
-`k` (kilobytes), `m` (megabytes), or `g` (gigabytes). If you don't specify a
-unit, `b` is used. Set LIMIT to `-1` to enable unlimited swap.
-
-**--mac-address**=""
-   Container MAC address (e.g., 92:d0:c6:0a:29:33)
-
-   Remember that the MAC address in an Ethernet network must be unique.
-The IPv6 link-local address will be based on the device's MAC address
-according to RFC4862.
-
-**--mount**=[*[type=TYPE[,TYPE-SPECIFIC-OPTIONS]]*]
-   Attach a filesystem mount to the container
-
-   Current supported mount `TYPES` are `bind`, `volume`, and `tmpfs`.
-
-   e.g.
-
-   `type=bind,source=/path/on/host,destination=/path/in/container`
-
-   `type=volume,source=my-volume,destination=/path/in/container,volume-label="color=red",volume-label="shape=round"`
-
-   `type=tmpfs,tmpfs-size=512M,destination=/path/in/container`
-
-   Common Options:
-
-   * `src`, `source`: mount source spec for `bind` and `volume`. Mandatory for `bind`.
-   * `dst`, `destination`, `target`: mount destination spec.
-   * `ro`, `read-only`: `true` or `false` (default).
-
-   Options specific to `bind`:
-
-   * `bind-propagation`: `shared`, `slave`, `private`, `rshared`, `rslave`, or `rprivate`(default). See also `mount(2)`.
-   * `consistency`: `consistent`(default), `cached`, or `delegated`. Currently, only effective for Docker for Mac.
-
-   Options specific to `volume`:
-
-   * `volume-driver`: Name of the volume-driver plugin.
-   * `volume-label`: Custom metadata.
-   * `volume-nocopy`: `true`(default) or `false`. If set to `false`, the Engine copies existing files and directories under the mount-path into the volume, allowing the host to access them.
-   * `volume-opt`: specific to a given volume driver.
-
-   Options specific to `tmpfs`:
-
-   * `tmpfs-size`: Size of the tmpfs mount in bytes. Unlimited by default in Linux.
-   * `tmpfs-mode`: File mode of the tmpfs in octal. (e.g. `700` or `0700`.) Defaults to `1777` in Linux.
-
-**--name**=""
-   Assign a name to the container
-
-   The operator can identify a container in three ways:
-    UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”)
-    UUID short identifier (“f78375b1c487”)
-    Name (“jonah”)
-
-   The UUID identifiers come from the Docker daemon, and if a name is not assigned
-to the container with **--name** then the daemon will also generate a random
-string name. The name is useful when defining links (see **--link**) (or any
-other place you need to identify a container). This works for both background
-and foreground Docker containers.
-
-**--network**="*bridge*"
-   Set the Network mode for the container
-                               'bridge': create a network stack on the default Docker bridge
-                               'none': no networking
-                               'container:<name|id>': reuse another container's network stack
-                               'host': use the Docker host network stack. Note: the host mode gives the container full access to local system services such as D-bus and is therefore considered insecure.
-                               '<network-name>|<network-id>': connect to a user-defined network
-
-**--network-alias**=[]
-   Add network-scoped alias for the container
-
-**--oom-kill-disable**=*true*|*false*
-   Whether to disable OOM Killer for the container or not.
-
-**--oom-score-adj**=""
-   Tune the host's OOM preferences for containers (accepts -1000 to 1000)
-
-**-P**, **--publish-all**=*true*|*false*
-   Publish all exposed ports to random ports on the host interfaces. The default is *false*.
-
-   When set to true publish all exposed ports to the host interfaces. The
-default is false. If the operator uses -P (or -p) then Docker will make the
-exposed port accessible on the host and the ports will be available to any
-client that can reach the host. When using -P, Docker will bind any exposed
-port to a random port on the host within an *ephemeral port range* defined by
-`/proc/sys/net/ipv4/ip_local_port_range`. To find the mapping between the host
-ports and the exposed ports, use `docker port`.
-
-**-p**, **--publish**=[]
-   Publish a container's port, or range of ports, to the host.
-
-   Format: `ip:hostPort:containerPort | ip::containerPort | hostPort:containerPort | containerPort`
-Both hostPort and containerPort can be specified as a range of ports.
-When specifying ranges for both, the number of container ports in the range must match the number of host ports in the range.
-(e.g., `docker run -p 1234-1236:1222-1224 --name thisWorks -t busybox`
-but not `docker run -p 1230-1236:1230-1240 --name RangeContainerPortsBiggerThanRangeHostPorts -t busybox`)
-With ip: `docker run -p 127.0.0.1:$HOSTPORT:$CONTAINERPORT --name CONTAINER -t someimage`
-Use `docker port` to see the actual mapping: `docker port CONTAINER $CONTAINERPORT`
-
-**--pid**=""
-   Set the PID mode for the container
-   Default is to create a private PID namespace for the container
-                               'container:<name|id>': join another container's PID namespace
-                               'host': use the host's PID namespace for the container. Note: the host mode gives the container full access to local PID and is therefore considered insecure.
-
-**--userns**=""
-   Set the usernamespace mode for the container when `userns-remap` option is enabled.
-     **host**: use the host usernamespace and enable all privileged options (e.g., `pid=host` or `--privileged`).
-
-**--pids-limit**=""
-   Tune the container's pids limit. Set `-1` to have unlimited pids for the container.
-
-**--uts**=*host*
-   Set the UTS mode for the container
-     **host**: use the host's UTS namespace inside the container.
-     Note: the host mode gives the container access to changing the host's hostname and is therefore considered insecure.
-
-**--privileged**=*true*|*false*
-   Give extended privileges to this container. The default is *false*.
-
-   By default, Docker containers are
-“unprivileged” (=false) and cannot, for example, run a Docker daemon inside the
-Docker container. This is because by default a container is not allowed to
-access any devices. A “privileged” container is given access to all devices.
-
-   When the operator executes **docker run --privileged**, Docker will enable access
-to all devices on the host as well as set some configuration in AppArmor to
-allow the container nearly all the same access to the host as processes running
-outside of a container on the host.
-
-**--read-only**=*true*|*false*
-   Mount the container's root filesystem as read only.
-
-   By default a container will have its root filesystem writable allowing processes
-to write files anywhere.  By specifying the `--read-only` flag the container will have
-its root filesystem mounted as read only prohibiting any writes.
-
-**--restart**="*no*"
-   Restart policy to apply when a container exits (no, on-failure[:max-retry], always, unless-stopped).
-
-**--rm**=*true*|*false*
-   Automatically remove the container when it exits. The default is *false*.
-   `--rm` flag can work together with `-d`, and auto-removal will be done on daemon side. Note that it's
-incompatible with any restart policy other than `none`.
-
-**--security-opt**=[]
-   Security Options
-
-    "label=user:USER"   : Set the label user for the container
-    "label=role:ROLE"   : Set the label role for the container
-    "label=type:TYPE"   : Set the label type for the container
-    "label=level:LEVEL" : Set the label level for the container
-    "label=disable"     : Turn off label confinement for the container
-    "no-new-privileges" : Disable container processes from gaining additional privileges
-
-    "seccomp=unconfined" : Turn off seccomp confinement for the container
-    "seccomp=profile.json :  White listed syscalls seccomp Json file to be used as a seccomp filter
-
-    "apparmor=unconfined" : Turn off apparmor confinement for the container
-    "apparmor=your-profile" : Set the apparmor confinement profile for the container
-
-**--storage-opt**=[]
-   Storage driver options per container
-
-   $ docker run -it --storage-opt size=120G fedora /bin/bash
-
-   This (size) will allow to set the container rootfs size to 120G at creation time.
-   This option is only available for the `devicemapper`, `btrfs`, `overlay2`  and `zfs` graph drivers.
-   For the `devicemapper`, `btrfs` and `zfs` storage drivers, user cannot pass a size less than the Default BaseFS Size.
-   For the `overlay2` storage driver, the size option is only available if the backing fs is `xfs` and mounted with the `pquota` mount option.
-   Under these conditions, user can pass any size less then the backing fs size.
-
-**--stop-signal**=*SIGTERM*
-  Signal to stop a container. Default is SIGTERM.
-
-**--stop-timeout**=*10*
-  Timeout (in seconds) to stop a container. Default is 10.
-
-**--shm-size**=""
-   Size of `/dev/shm`. The format is `<number><unit>`.
-   `number` must be greater than `0`.  Unit is optional and can be `b` (bytes), `k` (kilobytes), `m`(megabytes), or `g` (gigabytes).
-   If you omit the unit, the system uses bytes. If you omit the size entirely, the system uses `64m`.
-
-**--sysctl**=SYSCTL
-  Configure namespaced kernel parameters at runtime
-
-  IPC Namespace - current sysctls allowed:
-
-  kernel.msgmax, kernel.msgmnb, kernel.msgmni, kernel.sem, kernel.shmall, kernel.shmmax, kernel.shmmni, kernel.shm_rmid_forced
-  Sysctls beginning with fs.mqueue.*
-
-  If you use the `--ipc=host` option these sysctls will not be allowed.
-
-  Network Namespace - current sysctls allowed:
-      Sysctls beginning with net.*
-
-  If you use the `--network=host` option these sysctls will not be allowed.
-
-**--sig-proxy**=*true*|*false*
-   Proxy received signals to the process (non-TTY mode only). SIGCHLD, SIGSTOP, and SIGKILL are not proxied. The default is *true*.
-
-**--memory-swappiness**=""
-   Tune a container's memory swappiness behavior. Accepts an integer between 0 and 100.
-
-**-t**, **--tty**=*true*|*false*
-   Allocate a pseudo-TTY. The default is *false*.
-
-   When set to true Docker can allocate a pseudo-tty and attach to the standard
-input of any container. This can be used, for example, to run a throwaway
-interactive shell. The default is false.
-
-The **-t** option is incompatible with a redirection of the docker client
-standard input.
-
-**--tmpfs**=[] Create a tmpfs mount
-
-   Mount a temporary filesystem (`tmpfs`) mount into a container, for example:
-
-   $ docker run -d --tmpfs /tmp:rw,size=787448k,mode=1777 my_image
-
-   This command mounts a `tmpfs` at `/tmp` within the container.  The supported mount
-options are the same as the Linux default `mount` flags. If you do not specify
-any options, the systems uses the following options:
-`rw,noexec,nosuid,nodev,size=65536k`.
-
-   See also `--mount`, which is the successor of `--tmpfs` and `--volume`.
-   Even though there is no plan to deprecate `--tmpfs`, usage of `--mount` is recommended.
-
-**-u**, **--user**=""
-   Sets the username or UID used and optionally the groupname or GID for the specified command.
-
-   The followings examples are all valid:
-   --user [user | user:group | uid | uid:gid | user:gid | uid:group ]
-
-   Without this argument the command will be run as root in the container.
-
-**--ulimit**=[]
-    Ulimit options
-
-**-v**|**--volume**[=*[[HOST-DIR:]CONTAINER-DIR[:OPTIONS]]*]
-   Create a bind mount. If you specify, ` -v /HOST-DIR:/CONTAINER-DIR`, Docker
-   bind mounts `/HOST-DIR` in the host to `/CONTAINER-DIR` in the Docker
-   container. If 'HOST-DIR' is omitted,  Docker automatically creates the new
-   volume on the host.  The `OPTIONS` are a comma delimited list and can be:
-
-   * [rw|ro]
-   * [z|Z]
-   * [`[r]shared`|`[r]slave`|`[r]private`]
-   * [`delegated`|`cached`|`consistent`]
-   * [nocopy]
-
-The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR`
-can be an absolute path or a `name` value. A `name` value must start with an
-alphanumeric character, followed by `a-z0-9`, `_` (underscore), `.` (period) or
-`-` (hyphen). An absolute path starts with a `/` (forward slash).
-
-If you supply a `HOST-DIR` that is an absolute path,  Docker bind-mounts to the
-path you specify. If you supply a `name`, Docker creates a named volume by that
-`name`. For example, you can specify either `/foo` or `foo` for a `HOST-DIR`
-value. If you supply the `/foo` value, Docker creates a bind-mount. If you
-supply the `foo` specification, Docker creates a named volume.
-
-You can specify multiple  **-v** options to mount one or more mounts to a
-container. To use these same mounts in other containers, specify the
-**--volumes-from** option also.
-
-You can supply additional options for each bind-mount following an additional
-colon.  A `:ro` or `:rw` suffix mounts a volume in read-only or read-write
-mode, respectively. By default, volumes are mounted in read-write mode.
-You can also specify the consistency requirement for the mount, either
-`:consistent` (the default), `:cached`, or `:delegated`.  Multiple options are
-separated by commas, e.g. `:ro,cached`.
-
-Labeling systems like SELinux require that proper labels are placed on volume
-content mounted into a container. Without a label, the security system might
-prevent the processes running inside the container from using the content. By
-default, Docker does not change the labels set by the OS.
-
-To change a label in the container context, you can add either of two suffixes
-`:z` or `:Z` to the volume mount. These suffixes tell Docker to relabel file
-objects on the shared volumes. The `z` option tells Docker that two containers
-share the volume content. As a result, Docker labels the content with a shared
-content label. Shared volume labels allow all containers to read/write content.
-The `Z` option tells Docker to label the content with a private unshared label.
-Only the current container can use a private volume.
-
-By default bind mounted volumes are `private`. That means any mounts done
-inside container will not be visible on host and vice-a-versa. One can change
-this behavior by specifying a volume mount propagation property. Making a
-volume `shared` mounts done under that volume inside container will be
-visible on host and vice-a-versa. Making a volume `slave` enables only one
-way mount propagation and that is mounts done on host under that volume
-will be visible inside container but not the other way around.
-
-To control mount propagation property of volume one can use `:[r]shared`,
-`:[r]slave` or `:[r]private` propagation flag. Propagation property can
-be specified only for bind mounted volumes and not for internal volumes or
-named volumes. For mount propagation to work source mount point (mount point
-where source dir is mounted on) has to have right propagation properties. For
-shared volumes, source mount point has to be shared. And for slave volumes,
-source mount has to be either shared or slave.
-
-Use `df <source-dir>` to figure out the source mount and then use
-`findmnt -o TARGET,PROPAGATION <source-mount-dir>` to figure out propagation
-properties of source mount. If `findmnt` utility is not available, then one
-can look at mount entry for source mount point in `/proc/self/mountinfo`. Look
-at `optional fields` and see if any propagation properties are specified.
-`shared:X` means mount is `shared`, `master:X` means mount is `slave` and if
-nothing is there that means mount is `private`.
-
-To change propagation properties of a mount point use `mount` command. For
-example, if one wants to bind mount source directory `/foo` one can do
-`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This
-will convert /foo into a `shared` mount point. Alternatively one can directly
-change propagation properties of source mount. Say `/` is source mount for
-`/foo`, then use `mount --make-shared /` to convert `/` into a `shared` mount.
-
-> **Note**:
-> When using systemd to manage the Docker daemon's start and stop, in the systemd
-> unit file there is an option to control mount propagation for the Docker daemon
-> itself, called `MountFlags`. The value of this setting may cause Docker to not
-> see mount propagation changes made on the mount point. For example, if this value
-> is `slave`, you may not be able to use the `shared` or `rshared` propagation on
-> a volume.
-
-To disable automatic copying of data from the container path to the volume, use
-the `nocopy` flag. The `nocopy` flag can be set on bind mounts and named volumes.
-
-See also `--mount`, which is the successor of `--tmpfs` and `--volume`.
-Even though there is no plan to deprecate `--volume`, usage of `--mount` is recommended.
-
-**--volume-driver**=""
-   Container's volume driver. This driver creates volumes specified either from
-   a Dockerfile's `VOLUME` instruction or from the `docker run -v` flag.
-   See **docker-volume-create(1)** for full details.
-
-**--volumes-from**=[]
-   Mount volumes from the specified container(s)
-
-   Mounts already mounted volumes from a source container onto another
-   container. You must supply the source's container-id. To share
-   a volume, use the **--volumes-from** option when running
-   the target container. You can share volumes even if the source container
-   is not running.
-
-   By default, Docker mounts the volumes in the same mode (read-write or
-   read-only) as it is mounted in the source container. Optionally, you
-   can change this by suffixing the container-id with either the `:ro` or
-   `:rw ` keyword.
-
-   If the location of the volume from the source container overlaps with
-   data residing on a target container, then the volume hides
-   that data on the target.
-
-**-w**, **--workdir**=""
-   Working directory inside the container
-
-   The default working directory for
-running binaries within a container is the root directory (/). The developer can
-set a different default with the Dockerfile WORKDIR instruction. The operator
-can override the working directory by using the **-w** option.
-
-# Exit Status
-
-The exit code from `docker run` gives information about why the container
-failed to run or why it exited.  When `docker run` exits with a non-zero code,
-the exit codes follow the `chroot` standard, see below:
-
-**_125_** if the error is with Docker daemon **_itself_** 
-
-    $ docker run --foo busybox; echo $?
-    # flag provided but not defined: --foo
-      See 'docker run --help'.
-      125
-
-**_126_** if the **_contained command_** cannot be invoked
-
-    $ docker run busybox /etc; echo $?
-    # exec: "/etc": permission denied
-      docker: Error response from daemon: Contained command could not be invoked
-      126
-
-**_127_** if the **_contained command_** cannot be found
-
-    $ docker run busybox foo; echo $?
-    # exec: "foo": executable file not found in $PATH
-      docker: Error response from daemon: Contained command not found or does not exist
-      127
-
-**_Exit code_** of **_contained command_** otherwise 
-    
-    $ docker run busybox /bin/sh -c 'exit 3' 
-    # 3
-
-# EXAMPLES
-
-## Running container in read-only mode
-
-During container image development, containers often need to write to the image
-content.  Installing packages into /usr, for example.  In production,
-applications seldom need to write to the image.  Container applications write
-to volumes if they need to write to file systems at all.  Applications can be
-made more secure by running them in read-only mode using the --read-only switch.
-This protects the containers image from modification. Read only containers may
-still need to write temporary data.  The best way to handle this is to mount
-tmpfs directories on /run and /tmp.
-
-    # docker run --read-only --tmpfs /run --tmpfs /tmp -i -t fedora /bin/bash
-
-## Exposing log messages from the container to the host's log
-
-If you want messages that are logged in your container to show up in the host's
-syslog/journal then you should bind mount the /dev/log directory as follows.
-
-    # docker run -v /dev/log:/dev/log -i -t fedora /bin/bash
-
-From inside the container you can test this by sending a message to the log.
-
-    (bash)# logger "Hello from my container"
-
-Then exit and check the journal.
-
-    # exit
-
-    # journalctl -b | grep Hello
-
-This should list the message sent to logger.
-
-## Attaching to one or more from STDIN, STDOUT, STDERR
-
-If you do not specify -a then Docker will attach everything (stdin,stdout,stderr)
-. You can specify to which of the three standard streams (stdin, stdout, stderr)
-you'd like to connect instead, as in:
-
-    # docker run -a stdin -a stdout -i -t fedora /bin/bash
-
-## Sharing IPC between containers
-
-Using shm_server.c available here: https://www.cs.cf.ac.uk/Dave/C/node27.html
-
-Testing `--ipc=host` mode:
-
-Host shows a shared memory segment with 7 pids attached, happens to be from httpd:
-
-```
- $ sudo ipcs -m
-
- ------ Shared Memory Segments --------
- key        shmid      owner      perms      bytes      nattch     status      
- 0x01128e25 0          root       600        1000       7                       
-```
-
-Now run a regular container, and it correctly does NOT see the shared memory segment from the host:
-
-```
- $ docker run -it shm ipcs -m
-
- ------ Shared Memory Segments --------
- key        shmid      owner      perms      bytes      nattch     status      
-```
-
-Run a container with the new `--ipc=host` option, and it now sees the shared memory segment from the host httpd:
-
- ```
- $ docker run -it --ipc=host shm ipcs -m
-
- ------ Shared Memory Segments --------
- key        shmid      owner      perms      bytes      nattch     status      
- 0x01128e25 0          root       600        1000       7                   
-```
-Testing `--ipc=container:CONTAINERID` mode:
-
-Start a container with a program to create a shared memory segment:
-```
- $ docker run -it shm bash
- $ sudo shm/shm_server &
- $ sudo ipcs -m
-
- ------ Shared Memory Segments --------
- key        shmid      owner      perms      bytes      nattch     status      
- 0x0000162e 0          root       666        27         1                       
-```
-Create a 2nd container correctly shows no shared memory segment from 1st container:
-```
- $ docker run shm ipcs -m
-
- ------ Shared Memory Segments --------
- key        shmid      owner      perms      bytes      nattch     status      
-```
-
-Create a 3rd container using the new --ipc=container:CONTAINERID option, now it shows the shared memory segment from the first:
-
-```
- $ docker run -it --ipc=container:ed735b2264ac shm ipcs -m
- $ sudo ipcs -m
-
- ------ Shared Memory Segments --------
- key        shmid      owner      perms      bytes      nattch     status      
- 0x0000162e 0          root       666        27         1
-```
-
-## Linking Containers
-
-> **Note**: This section describes linking between containers on the
-> default (bridge) network, also known as "legacy links". Using `--link`
-> on user-defined networks uses the DNS-based discovery, which does not add
-> entries to `/etc/hosts`, and does not set environment variables for
-> discovery.
-
-The link feature allows multiple containers to communicate with each other. For
-example, a container whose Dockerfile has exposed port 80 can be run and named
-as follows:
-
-    # docker run --name=link-test -d -i -t fedora/httpd
-
-A second container, in this case called linker, can communicate with the httpd
-container, named link-test, by running with the **--link=<name>:<alias>**
-
-    # docker run -t -i --link=link-test:lt --name=linker fedora /bin/bash
-
-Now the container linker is linked to container link-test with the alias lt.
-Running the **env** command in the linker container shows environment variables
- with the LT (alias) context (**LT_**)
-
-    # env
-    HOSTNAME=668231cb0978
-    TERM=xterm
-    LT_PORT_80_TCP=tcp://172.17.0.3:80
-    LT_PORT_80_TCP_PORT=80
-    LT_PORT_80_TCP_PROTO=tcp
-    LT_PORT=tcp://172.17.0.3:80
-    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-    PWD=/
-    LT_NAME=/linker/lt
-    SHLVL=1
-    HOME=/
-    LT_PORT_80_TCP_ADDR=172.17.0.3
-    _=/usr/bin/env
-
-When linking two containers Docker will use the exposed ports of the container
-to create a secure tunnel for the parent to access.
-
-If a container is connected to the default bridge network and `linked`
-with other containers, then the container's `/etc/hosts` file is updated
-with the linked container's name.
-
-> **Note** Since Docker may live update the container's `/etc/hosts` file, there
-may be situations when processes inside the container can end up reading an
-empty or incomplete `/etc/hosts` file. In most cases, retrying the read again
-should fix the problem.
-
-
-## Mapping Ports for External Usage
-
-The exposed port of an application can be mapped to a host port using the **-p**
-flag. For example, an httpd port 80 can be mapped to the host port 8080 using the
-following:
-
-    # docker run -p 8080:80 -d -i -t fedora/httpd
-
-## Creating and Mounting a Data Volume Container
-
-Many applications require the sharing of persistent data across several
-containers. Docker allows you to create a Data Volume Container that other
-containers can mount from. For example, create a named container that contains
-directories /var/volume1 and /tmp/volume2. The image will need to contain these
-directories so a couple of RUN mkdir instructions might be required for you
-fedora-data image:
-
-    # docker run --name=data -v /var/volume1 -v /tmp/volume2 -i -t fedora-data true
-    # docker run --volumes-from=data --name=fedora-container1 -i -t fedora bash
-
-Multiple --volumes-from parameters will bring together multiple data volumes from
-multiple containers. And it's possible to mount the volumes that came from the
-DATA container in yet another container via the fedora-container1 intermediary
-container, allowing to abstract the actual data source from users of that data:
-
-    # docker run --volumes-from=fedora-container1 --name=fedora-container2 -i -t fedora bash
-
-## Mounting External Volumes
-
-To mount a host directory as a container volume, specify the absolute path to
-the directory and the absolute path for the container directory separated by a
-colon:
-
-    # docker run -v /var/db:/data1 -i -t fedora bash
-
-When using SELinux, be aware that the host has no knowledge of container SELinux
-policy. Therefore, in the above example, if SELinux policy is enforced, the
-`/var/db` directory is not writable to the container. A "Permission Denied"
-message will occur and an avc: message in the host's syslog.
-
-
-To work around this, at time of writing this man page, the following command
-needs to be run in order for the proper SELinux policy type label to be attached
-to the host directory:
-
-    # chcon -Rt svirt_sandbox_file_t /var/db
-
-
-Now, writing to the /data1 volume in the container will be allowed and the
-changes will also be reflected on the host in /var/db.
-
-## Using alternative security labeling
-
-You can override the default labeling scheme for each container by specifying
-the `--security-opt` flag. For example, you can specify the MCS/MLS level, a
-requirement for MLS systems. Specifying the level in the following command
-allows you to share the same content between containers.
-
-    # docker run --security-opt label=level:s0:c100,c200 -i -t fedora bash
-
-An MLS example might be:
-
-    # docker run --security-opt label=level:TopSecret -i -t rhel7 bash
-
-To disable the security labeling for this container versus running with the
-`--permissive` flag, use the following command:
-
-    # docker run --security-opt label=disable -i -t fedora bash
-
-If you want a tighter security policy on the processes within a container,
-you can specify an alternate type for the container. You could run a container
-that is only allowed to listen on Apache ports by executing the following
-command:
-
-    # docker run --security-opt label=type:svirt_apache_t -i -t centos bash
-
-Note:
-
-You would have to write policy defining a `svirt_apache_t` type.
-
-## Setting device weight
-
-If you want to set `/dev/sda` device weight to `200`, you can specify the device
-weight by `--blkio-weight-device` flag. Use the following command:
-
-    # docker run -it --blkio-weight-device "/dev/sda:200" ubuntu
-
-## Specify isolation technology for container (--isolation)
-
-This option is useful in situations where you are running Docker containers on
-Microsoft Windows. The `--isolation <value>` option sets a container's isolation
-technology. On Linux, the only supported is the `default` option which uses
-Linux namespaces. These two commands are equivalent on Linux:
-
-```
-$ docker run -d busybox top
-$ docker run -d --isolation default busybox top
-```
-
-On Microsoft Windows, can take any of these values:
-
-* `default`: Use the value specified by the Docker daemon's `--exec-opt` . If the `daemon` does not specify an isolation technology, Microsoft Windows uses `process` as its default value.
-* `process`: Namespace isolation only.
-* `hyperv`: Hyper-V hypervisor partition-based isolation.
-
-In practice, when running on Microsoft Windows without a `daemon` option set,  these two commands are equivalent:
-
-```
-$ docker run -d --isolation default busybox top
-$ docker run -d --isolation process busybox top
-```
-
-If you have set the `--exec-opt isolation=hyperv` option on the Docker `daemon`, any of these commands also result in `hyperv` isolation:
-
-```
-$ docker run -d --isolation default busybox top
-$ docker run -d --isolation hyperv busybox top
-```
-
-## Setting Namespaced Kernel Parameters (Sysctls)
-
-The `--sysctl` sets namespaced kernel parameters (sysctls) in the
-container. For example, to turn on IP forwarding in the containers
-network namespace, run this command:
-
-    $ docker run --sysctl net.ipv4.ip_forward=1 someimage
-
-Note:
-
-Not all sysctls are namespaced. Docker does not support changing sysctls
-inside of a container that also modify the host system. As the kernel 
-evolves we expect to see more sysctls become namespaced.
-
-See the definition of the `--sysctl` option above for the current list of 
-supported sysctls.
-
-# HISTORY
-April 2014, Originally compiled by William Henry (whenry at redhat dot com)
-based on docker.com source material and internal work.
-June 2014, updated by Sven Dowideit <SvenDowideit@home.org.au>
-July 2014, updated by Sven Dowideit <SvenDowideit@home.org.au>
-November 2015, updated by Sally O'Malley <somalley@redhat.com>
diff --git a/components/engine/man/docker.1.md b/components/engine/man/docker.1.md
deleted file mode 100644
index abedb45ca9..0000000000
--- a/components/engine/man/docker.1.md
+++ /dev/null
@@ -1,70 +0,0 @@
-% DOCKER(1) Docker User Manuals
-% William Henry
-% APRIL 2014
-# NAME
-docker \- Docker image and container command line interface
-
-# SYNOPSIS
-**docker** [OPTIONS] COMMAND [ARG...]
-
-**docker** [--help|-v|--version]
-
-# DESCRIPTION
-**docker** is a client for interacting with the daemon (see **dockerd(8)**) through the CLI.
-
-The Docker CLI has over 30 commands. The commands are listed below and each has
-its own man page which explain usage and arguments.
-
-To see the man page for a command run **man docker <command>**.
-
-# OPTIONS
-**--help**
-  Print usage statement
-
-**--config**=""
-  Specifies the location of the Docker client configuration files. The default is '~/.docker'.
-
-**-D**, **--debug**=*true*|*false*
-  Enable debug mode. Default is false.
-
-**-H**, **--host**=[*unix:///var/run/docker.sock*]: tcp://[host]:[port][path] to bind or
-unix://[/path/to/socket] to use.
-  The socket(s) to bind to in daemon mode specified using one or more
-  tcp://host:port/path, unix:///path/to/socket, fd://* or fd://socketfd.
-  If the tcp port is not specified, then it will default to either `2375` when
-  `--tls` is off, or `2376` when `--tls` is on, or `--tlsverify` is specified.
-
-**-l**, **--log-level**="*debug*|*info*|*warn*|*error*|*fatal*"
-  Set the logging level. Default is `info`.
-
-**--tls**=*true*|*false*
-  Use TLS; implied by --tlsverify. Default is false.
-
-**--tlscacert**=*~/.docker/ca.pem*
-  Trust certs signed only by this CA.
-
-**--tlscert**=*~/.docker/cert.pem*
-  Path to TLS certificate file.
-
-**--tlskey**=*~/.docker/key.pem*
-  Path to TLS key file.
-
-**--tlsverify**=*true*|*false*
-  Use TLS and verify the remote (daemon: verify client, client: verify daemon).
-  Default is false.
-
-**-v**, **--version**=*true*|*false*
-  Print version information and quit. Default is false.
-
-# COMMANDS
-
-Use "docker help" or "docker --help" to get an overview of available commands.
-
-# EXAMPLES
-For specific client examples please see the man page for the specific Docker
-command. For example:
-
-    man docker-run
-
-# HISTORY
-April 2014, Originally compiled by William Henry (whenry at redhat dot com) based on docker.com source material and internal work.
diff --git a/components/engine/man/dockerd.8.md b/components/engine/man/dockerd.8.md
deleted file mode 100644
index a4e079074f..0000000000
--- a/components/engine/man/dockerd.8.md
+++ /dev/null
@@ -1,797 +0,0 @@
-% DOCKER(8) Docker User Manuals
-% Shishir Mahajan
-% SEPTEMBER 2015
-# NAME
-dockerd - Enable daemon mode
-
-# SYNOPSIS
-**dockerd**
-[**--add-runtime**[=*[]*]]
-[**--allow-nondistributable-artifacts**[=*[]*]]
-[**--api-cors-header**=[=*API-CORS-HEADER*]]
-[**--authorization-plugin**[=*[]*]]
-[**-b**|**--bridge**[=*BRIDGE*]]
-[**--bip**[=*BIP*]]
-[**--cgroup-parent**[=*[]*]]
-[**--cluster-store**[=*[]*]]
-[**--cluster-advertise**[=*[]*]]
-[**--cluster-store-opt**[=*map[]*]]
-[**--config-file**[=*/etc/docker/daemon.json*]]
-[**--containerd**[=*SOCKET-PATH*]]
-[**--data-root**[=*/var/lib/docker*]]
-[**-D**|**--debug**]
-[**--default-gateway**[=*DEFAULT-GATEWAY*]]
-[**--default-gateway-v6**[=*DEFAULT-GATEWAY-V6*]]
-[**--default-runtime**[=*runc*]]
-[**--default-shm-size**[=*64MiB*]]
-[**--default-ulimit**[=*[]*]]
-[**--disable-legacy-registry**]
-[**--dns**[=*[]*]]
-[**--dns-opt**[=*[]*]]
-[**--dns-search**[=*[]*]]
-[**--exec-opt**[=*[]*]]
-[**--exec-root**[=*/var/run/docker*]]
-[**--experimental**[=*false*]]
-[**--fixed-cidr**[=*FIXED-CIDR*]]
-[**--fixed-cidr-v6**[=*FIXED-CIDR-V6*]]
-[**-G**|**--group**[=*docker*]]
-[**-H**|**--host**[=*[]*]]
-[**--help**]
-[**--icc**[=*true*]]
-[**--init**[=*false*]]
-[**--init-path**[=*""*]]
-[**--insecure-registry**[=*[]*]]
-[**--ip**[=*0.0.0.0*]]
-[**--ip-forward**[=*true*]]
-[**--ip-masq**[=*true*]]
-[**--iptables**[=*true*]]
-[**--ipv6**]
-[**--isolation**[=*default*]]
-[**-l**|**--log-level**[=*info*]]
-[**--label**[=*[]*]]
-[**--live-restore**[=*false*]]
-[**--log-driver**[=*json-file*]]
-[**--log-opt**[=*map[]*]]
-[**--mtu**[=*0*]]
-[**--max-concurrent-downloads**[=*3*]]
-[**--max-concurrent-uploads**[=*5*]]
-[**-p**|**--pidfile**[=*/var/run/docker.pid*]]
-[**--raw-logs**]
-[**--registry-mirror**[=*[]*]]
-[**-s**|**--storage-driver**[=*STORAGE-DRIVER*]]
-[**--seccomp-profile**[=*SECCOMP-PROFILE-PATH*]]
-[**--selinux-enabled**]
-[**--shutdown-timeout**[=*15*]]
-[**--storage-opt**[=*[]*]]
-[**--swarm-default-advertise-addr**[=*IP|INTERFACE*]]
-[**--tls**]
-[**--tlscacert**[=*~/.docker/ca.pem*]]
-[**--tlscert**[=*~/.docker/cert.pem*]]
-[**--tlskey**[=*~/.docker/key.pem*]]
-[**--tlsverify**]
-[**--userland-proxy**[=*true*]]
-[**--userland-proxy-path**[=*""*]]
-[**--userns-remap**[=*default*]]
-
-# DESCRIPTION
-**dockerd** is used for starting the Docker daemon (i.e., to command the daemon
-to manage images, containers etc).  So **dockerd** is a server, as a daemon.
-
-To run the Docker daemon you can specify **dockerd**.
-You can check the daemon options using **dockerd --help**.
-Daemon options should be specified after the **dockerd** keyword in the
-following format.
-
-**dockerd [OPTIONS]**
-
-# OPTIONS
-
-**--add-runtime**=[]
-  Runtimes can be registered with the daemon either via the
-configuration file or using the `--add-runtime` command line argument.
-
-  The following is an example adding 2 runtimes via the configuration:
-
-```json
-{
-	"default-runtime": "runc",
-	"runtimes": {
-		"runc": {
-			"path": "runc"
-		},
-		"custom": {
-			"path": "/usr/local/bin/my-runc-replacement",
-			"runtimeArgs": [
-				"--debug"
-			]
-		}
-	}
-}
-```
-
-  This is the same example via the command line:
-
-```bash
-$ sudo dockerd --add-runtime runc=runc --add-runtime custom=/usr/local/bin/my-runc-replacement
-```
-
-  **Note**: defining runtime arguments via the command line is not supported.
-
-**--allow-nondistributable-artifacts**=[]
-  Push nondistributable artifacts to the specified registries.
-
-  List can contain elements with CIDR notation to specify a whole subnet.
-
-  This option is useful when pushing images containing nondistributable
-  artifacts to a registry on an air-gapped network so hosts on that network can
-  pull the images without connecting to another server.
-
-  **Warning**: Nondistributable artifacts typically have restrictions on how
-  and where they can be distributed and shared. Only use this feature to push
-  artifacts to private registries and ensure that you are in compliance with
-  any terms that cover redistributing nondistributable artifacts.
-
-**--api-cors-header**=""
-  Set CORS headers in the Engine API. Default is cors disabled. Give urls like
-  "http://foo, http://bar, ...". Give "*" to allow all.
-
-**--authorization-plugin**=""
-  Set authorization plugins to load
-
-**-b**, **--bridge**=""
-  Attach containers to a pre\-existing network bridge; use 'none' to disable
-  container networking
-
-**--bip**=""
-  Use the provided CIDR notation address for the dynamically created bridge
-  (docker0); Mutually exclusive of \-b
-
-**--cgroup-parent**=""
-  Set parent cgroup for all containers. Default is "/docker" for fs cgroup
-  driver and "system.slice" for systemd cgroup driver.
-
-**--cluster-store**=""
-  URL of the distributed storage backend
-
-**--cluster-advertise**=""
-  Specifies the 'host:port' or `interface:port` combination that this
-  particular daemon instance should use when advertising itself to the cluster.
-  The daemon is reached through this value.
-
-**--cluster-store-opt**=""
-  Specifies options for the Key/Value store.
-
-**--config-file**="/etc/docker/daemon.json"
-  Specifies the JSON file path to load the configuration from.
-
-**--containerd**=""
-  Path to containerd socket.
-
-**--data-root**=""
-  Path to the directory used to store persisted Docker data such as
-  configuration for resources, swarm cluster state, and filesystem data for
-  images, containers, and local volumes. Default is `/var/lib/docker`.
-
-**-D**, **--debug**=*true*|*false*
-  Enable debug mode. Default is false.
-
-**--default-gateway**=""
-  IPv4 address of the container default gateway; this address must be part of
-  the bridge subnet (which is defined by \-b or \--bip)
-
-**--default-gateway-v6**=""
-  IPv6 address of the container default gateway
-
-**--default-runtime**="runc"
-  Set default runtime if there're more than one specified by `--add-runtime`.
-
-**--default-shm-size**=*64MiB*
-  Set the daemon-wide default shm size for containers. Default is `64MiB`.
-
-**--default-ulimit**=[]
-  Default ulimits for containers.
-
-**--disable-legacy-registry**=*true*|*false*
-  Disable contacting legacy registries
-
-**--dns**=""
-  Force Docker to use specific DNS servers
-
-**--dns-opt**=""
-  DNS options to use.
-
-**--dns-search**=[]
-  DNS search domains to use.
-
-**--exec-opt**=[]
-  Set runtime execution options. See RUNTIME EXECUTION OPTIONS.
-
-**--exec-root**=""
-  Path to use as the root of the Docker execution state files. Default is
-  `/var/run/docker`.
-
-**--experimental**=""
-  Enable the daemon experimental features.
-
-**--fixed-cidr**=""
-  IPv4 subnet for fixed IPs (e.g., 10.20.0.0/16); this subnet must be nested in
-  the bridge subnet (which is defined by \-b or \-\-bip).
-
-**--fixed-cidr-v6**=""
-  IPv6 subnet for global IPv6 addresses (e.g., 2a00:1450::/64)
-
-**-G**, **--group**=""
-  Group to assign the unix socket specified by -H when running in daemon mode.
-  use '' (the empty string) to disable setting of a group. Default is `docker`.
-
-**-H**, **--host**=[*unix:///var/run/docker.sock*]: tcp://[host:port] to bind or
-unix://[/path/to/socket] to use.
-  The socket(s) to bind to in daemon mode specified using one or more
-  tcp://host:port, unix:///path/to/socket, fd://* or fd://socketfd.
-
-**--help**
-  Print usage statement
-
-**--icc**=*true*|*false*
-  Allow unrestricted inter\-container and Docker daemon host communication. If
-  disabled, containers can still be linked together using the **--link** option
-  (see **docker-run(1)**). Default is true.
-
-**--init**
-  Run an init process inside containers for signal forwarding and process
-  reaping.
-
-**--init-path**
-  Path to the docker-init binary.
-
-**--insecure-registry**=[]
-  Enable insecure registry communication, i.e., enable un-encrypted and/or
-  untrusted communication.
-
-  List of insecure registries can contain an element with CIDR notation to
-  specify a whole subnet. Insecure registries accept HTTP and/or accept HTTPS
-  with certificates from unknown CAs.
-
-  Enabling `--insecure-registry` is useful when running a local registry.
-  However, because its use creates security vulnerabilities it should ONLY be
-  enabled for testing purposes.  For increased security, users should add their
-  CA to their system's list of trusted CAs instead of using
-  `--insecure-registry`.
-
-**--ip**=""
-  Default IP address to use when binding container ports. Default is `0.0.0.0`.
-
-**--ip-forward**=*true*|*false*
-  Enables IP forwarding on the Docker host. The default is `true`. This flag
-  interacts with the IP forwarding setting on your host system's kernel. If
-  your system has IP forwarding disabled, this setting enables it. If your
-  system has IP forwarding enabled, setting this flag to `--ip-forward=false`
-  has no effect.
-
-  This setting will also enable IPv6 forwarding if you have both
-  `--ip-forward=true` and `--fixed-cidr-v6` set. Note that this may reject
-  Router Advertisements and interfere with the host's existing IPv6
-  configuration. For more information, please consult the documentation about
-  "Advanced Networking - IPv6".
-
-**--ip-masq**=*true*|*false*
-  Enable IP masquerading for bridge's IP range. Default is true.
-
-**--iptables**=*true*|*false*
-  Enable Docker's addition of iptables rules. Default is true.
-
-**--ipv6**=*true*|*false*
-  Enable IPv6 support. Default is false. Docker will create an IPv6-enabled
-  bridge with address fe80::1 which will allow you to create IPv6-enabled
-  containers. Use together with `--fixed-cidr-v6` to provide globally routable
-  IPv6 addresses. IPv6 forwarding will be enabled if not used with
-  `--ip-forward=false`. This may collide with your host's current IPv6
-  settings. For more information please consult the documentation about
-  "Advanced Networking - IPv6".
-
-**--isolation**="*default*"
-   Isolation specifies the type of isolation technology used by containers.
-   Note that the default on Windows server is `process`, and the default on
-   Windows client is `hyperv`. Linux only supports `default`.
-
-**-l**, **--log-level**="*debug*|*info*|*warn*|*error*|*fatal*"
-  Set the logging level. Default is `info`.
-
-**--label**="[]"
-  Set key=value labels to the daemon (displayed in `docker info`)
-
-**--live-restore**=*false*
-  Enable live restore of running containers when the daemon starts so that they
-  are not restarted. This option is applicable only for docker daemon running
-  on Linux host.
-
-**--log-driver**="*json-file*|*syslog*|*journald*|*gelf*|*fluentd*|*awslogs*|*splunk*|*etwlogs*|*gcplogs*|*none*"
-  Default driver for container logs. Default is `json-file`.
-  **Warning**: `docker logs` command works only for `json-file` logging driver.
-
-**--log-opt**=[]
-  Logging driver specific options.
-
-**--mtu**=*0*
-  Set the containers network mtu. Default is `0`.
-
-**--max-concurrent-downloads**=*3*
-  Set the max concurrent downloads for each pull. Default is `3`.
-
-**--max-concurrent-uploads**=*5*
-  Set the max concurrent uploads for each push. Default is `5`.
-
-**-p**, **--pidfile**=""
-  Path to use for daemon PID file. Default is `/var/run/docker.pid`
-
-**--raw-logs**
-  Output daemon logs in full timestamp format without ANSI coloring. If this
-  flag is not set, the daemon outputs condensed, colorized logs if a terminal
-  is detected, or full ("raw") output otherwise.
-
-**--registry-mirror**=*<scheme>://<host>*
-  Prepend a registry mirror to be used for image pulls. May be specified
-  multiple times.
-
-**-s**, **--storage-driver**=""
-  Force the Docker runtime to use a specific storage driver.
-
-**--seccomp-profile**=""
-  Path to seccomp profile.
-
-**--selinux-enabled**=*true*|*false*
-  Enable selinux support. Default is false.
-
-**--shutdown-timeout**=*15*
-  Set the shutdown timeout value in seconds. Default is `15`.
-
-**--storage-opt**=[]
-  Set storage driver options. See STORAGE DRIVER OPTIONS.
-
-**--swarm-default-advertise-addr**=*IP|INTERFACE*
-  Set default address or interface for swarm to advertise as its
-  externally-reachable address to other cluster members. This can be a
-  hostname, an IP address, or an interface such as `eth0`. A port cannot be
-  specified with this option.
-
-**--tls**=*true*|*false*
-  Use TLS; implied by --tlsverify. Default is false.
-
-**--tlscacert**=*~/.docker/ca.pem*
-  Trust certs signed only by this CA.
-
-**--tlscert**=*~/.docker/cert.pem*
-  Path to TLS certificate file.
-
-**--tlskey**=*~/.docker/key.pem*
-  Path to TLS key file.
-
-**--tlsverify**=*true*|*false*
-  Use TLS and verify the remote (daemon: verify client, client: verify daemon).
-  Default is false.
-
-**--userland-proxy**=*true*|*false*
-  Rely on a userland proxy implementation for inter-container and
-  outside-to-container loopback communications. Default is true.
-
-**--userland-proxy-path**=""
-  Path to the userland proxy binary.
-
-**--userns-remap**=*default*|*uid:gid*|*user:group*|*user*|*uid*
-  Enable user namespaces for containers on the daemon. Specifying "default"
-  will cause a new user and group to be created to handle UID and GID range
-  remapping for the user namespace mappings used for contained processes.
-  Specifying a user (or uid) and optionally a group (or gid) will cause the
-  daemon to lookup the user and group's subordinate ID ranges for use as the
-  user namespace mappings for contained processes.
-
-# STORAGE DRIVER OPTIONS
-
-Docker uses storage backends (known as "graphdrivers" in the Docker
-internals) to create writable containers from images.  Many of these
-backends use operating system level technologies and can be
-configured.
-
-Specify options to the storage backend with **--storage-opt** flags. The
-backends that currently take options are *devicemapper*, *zfs* and *btrfs*.
-Options for *devicemapper* are prefixed with *dm*, options for *zfs*
-start with *zfs* and options for *btrfs* start with *btrfs*.
-
-Specifically for devicemapper, the default is a "loopback" model which
-requires no pre-configuration, but is extremely inefficient.  Do not
-use it in production.
-
-To make the best use of Docker with the devicemapper backend, you must
-have a recent version of LVM.  Use `lvm` to create a thin pool; for
-more information see `man lvmthin`.  Then, use `--storage-opt
-dm.thinpooldev` to tell the Docker engine to use that pool for
-allocating images and container snapshots.
-
-## Devicemapper options
-
-#### dm.thinpooldev
-
-Specifies a custom block storage device to use for the thin pool.
-
-If using a block device for device mapper storage, it is best to use `lvm`
-to create and manage the thin-pool volume. This volume is then handed to Docker
-to exclusively create snapshot volumes needed for images and containers.
-
-Managing the thin-pool outside of Engine makes for the most feature-rich
-method of having Docker utilize device mapper thin provisioning as the
-backing storage for Docker containers. The highlights of the lvm-based
-thin-pool management feature include: automatic or interactive thin-pool
-resize support, dynamically changing thin-pool features, automatic thinp
-metadata checking when lvm activates the thin-pool, etc.
-
-As a fallback if no thin pool is provided, loopback files are
-created. Loopback is very slow, but can be used without any
-pre-configuration of storage. It is strongly recommended that you do
-not use loopback in production. Ensure your Engine daemon has a
-`--storage-opt dm.thinpooldev` argument provided.
-
-Example use:
-
-   $ dockerd \
-         --storage-opt dm.thinpooldev=/dev/mapper/thin-pool
-
-#### dm.directlvm_device
-
-As an alternative to manually creating a thin pool as above, Docker can
-automatically configure a block device for you.
-
-Example use:
-
-   $ dockerd \
-         --storage-opt dm.directlvm_device=/dev/xvdf
-
-##### dm.thinp_percent
-
-Sets the percentage of passed in block device to use for storage.
-
-###### Example:
-
-   $ sudo dockerd \
-        --storage-opt dm.thinp_percent=95
-
-##### `dm.thinp_metapercent`
-
-Sets the percentage of the passed in block device to use for metadata storage.
-
-###### Example:
-
-   $ sudo dockerd \
-         --storage-opt dm.thinp_metapercent=1
-
-##### dm.thinp_autoextend_threshold
-
-Sets the value of the percentage of space used before `lvm` attempts to
-autoextend the available space [100 = disabled]
-
-###### Example:
-
-   $ sudo dockerd \
-         --storage-opt dm.thinp_autoextend_threshold=80
-
-##### dm.thinp_autoextend_percent
-
-Sets the value percentage value to increase the thin pool by when when `lvm`
-attempts to autoextend the available space [100 = disabled]
-
-###### Example:
-
-   $ sudo dockerd \
-         --storage-opt dm.thinp_autoextend_percent=20
-
-#### dm.basesize
-
-Specifies the size to use when creating the base device, which limits
-the size of images and containers. The default value is 10G. Note,
-thin devices are inherently "sparse", so a 10G device which is mostly
-empty doesn't use 10 GB of space on the pool. However, the filesystem
-will use more space for base images the larger the device
-is.
-
-The base device size can be increased at daemon restart which will allow
-all future images and containers (based on those new images) to be of the
-new base device size.
-
-Example use: `dockerd --storage-opt dm.basesize=50G`
-
-This will increase the base device size to 50G. The Docker daemon will throw an
-error if existing base device size is larger than 50G. A user can use
-this option to expand the base device size however shrinking is not permitted.
-
-This value affects the system-wide "base" empty filesystem that may already
-be initialized and inherited by pulled images. Typically, a change to this
-value requires additional steps to take effect:
-
-        $ sudo service docker stop
-        $ sudo rm -rf /var/lib/docker
-        $ sudo service docker start
-
-Example use: `dockerd --storage-opt dm.basesize=20G`
-
-#### dm.fs
-
-Specifies the filesystem type to use for the base device. The
-supported options are `ext4` and `xfs`. The default is `ext4`.
-
-Example use: `dockerd --storage-opt dm.fs=xfs`
-
-#### dm.mkfsarg
-
-Specifies extra mkfs arguments to be used when creating the base device.
-
-Example use: `dockerd --storage-opt "dm.mkfsarg=-O ^has_journal"`
-
-#### dm.mountopt
-
-Specifies extra mount options used when mounting the thin devices.
-
-Example use: `dockerd --storage-opt dm.mountopt=nodiscard`
-
-#### dm.use_deferred_removal
-
-Enables use of deferred device removal if `libdm` and the kernel driver
-support the mechanism.
-
-Deferred device removal means that if device is busy when devices are
-being removed/deactivated, then a deferred removal is scheduled on
-device. And devices automatically go away when last user of the device
-exits.
-
-For example, when a container exits, its associated thin device is removed. If
-that device has leaked into some other mount namespace and can't be removed,
-the container exit still succeeds and this option causes the system to schedule
-the device for deferred removal. It does not wait in a loop trying to remove a
-busy device.
-
-Example use: `dockerd --storage-opt dm.use_deferred_removal=true`
-
-#### dm.use_deferred_deletion
-
-Enables use of deferred device deletion for thin pool devices. By default,
-thin pool device deletion is synchronous. Before a container is deleted, the
-Docker daemon removes any associated devices. If the storage driver can not
-remove a device, the container deletion fails and daemon returns.
-
-`Error deleting container: Error response from daemon: Cannot destroy container`
-
-To avoid this failure, enable both deferred device deletion and deferred
-device removal on the daemon.
-
-`dockerd --storage-opt dm.use_deferred_deletion=true --storage-opt dm.use_deferred_removal=true`
-
-With these two options enabled, if a device is busy when the driver is
-deleting a container, the driver marks the device as deleted. Later, when the
-device isn't in use, the driver deletes it.
-
-In general it should be safe to enable this option by default. It will help
-when unintentional leaking of mount point happens across multiple mount
-namespaces.
-
-#### dm.loopdatasize
-
-**Note**: This option configures devicemapper loopback, which should not be
-used in production.
-
-Specifies the size to use when creating the loopback file for the "data" device
-which is used for the thin pool. The default size is 100G. The file is sparse,
-so it will not initially take up this much space.
-
-Example use: `dockerd --storage-opt dm.loopdatasize=200G`
-
-#### dm.loopmetadatasize
-
-**Note**: This option configures devicemapper loopback, which should not be
-used in production.
-
-Specifies the size to use when creating the loopback file for the "metadata"
-device which is used for the thin pool. The default size is 2G. The file is
-sparse, so it will not initially take up this much space.
-
-Example use: `dockerd --storage-opt dm.loopmetadatasize=4G`
-
-#### dm.datadev
-
-(Deprecated, use `dm.thinpooldev`)
-
-Specifies a custom blockdevice to use for data for a Docker-managed thin pool.
-It is better to use `dm.thinpooldev` - see the documentation for it above for
-discussion of the advantages.
-
-#### dm.metadatadev
-
-(Deprecated, use `dm.thinpooldev`)
-
-Specifies a custom blockdevice to use for metadata for a Docker-managed thin
-pool.  See `dm.datadev` for why this is deprecated.
-
-#### dm.blocksize
-
-Specifies a custom blocksize to use for the thin pool.  The default
-blocksize is 64K.
-
-Example use: `dockerd --storage-opt dm.blocksize=512K`
-
-#### dm.blkdiscard
-
-Enables or disables the use of `blkdiscard` when removing devicemapper devices.
-This is disabled by default due to the additional latency, but as a special
-case with loopback devices it will be enabled, in order to re-sparsify the
-loopback file on image/container removal.
-
-Disabling this on loopback can lead to *much* faster container removal times,
-but it also prevents the space used in `/var/lib/docker` directory from being
-returned to the system for other use when containers are removed.
-
-Example use: `dockerd --storage-opt dm.blkdiscard=false`
-
-#### dm.override_udev_sync_check
-
-By default, the devicemapper backend attempts to synchronize with the `udev`
-device manager for the Linux kernel.  This option allows disabling that
-synchronization, to continue even though the configuration may be buggy.
-
-To view the `udev` sync support of a Docker daemon that is using the
-`devicemapper` driver, run:
-
-        $ docker info
-        [...]
-         Udev Sync Supported: true
-        [...]
-
-When `udev` sync support is `true`, then `devicemapper` and `udev` can
-coordinate the activation and deactivation of devices for containers.
-
-When `udev` sync support is `false`, a race condition occurs between the
-`devicemapper` and `udev` during create and cleanup. The race condition results
-in errors and failures. (For information on these failures, see
-[docker#4036](https://github.com/docker/docker/issues/4036))
-
-To allow the `docker` daemon to start, regardless of whether `udev` sync is
-`false`, set `dm.override_udev_sync_check` to true:
-
-        $ dockerd --storage-opt dm.override_udev_sync_check=true
-
-When this value is `true`, the driver continues and simply warns you the errors
-are happening.
-
-**Note**: The ideal is to pursue a `docker` daemon and environment that does
-support synchronizing with `udev`. For further discussion on this topic, see
-[docker#4036](https://github.com/docker/docker/issues/4036).
-Otherwise, set this flag for migrating existing Docker daemons to a daemon with
-a supported environment.
-
-#### dm.min_free_space
-
-Specifies the min free space percent in a thin pool require for new device
-creation to succeed. This check applies to both free data space as well
-as free metadata space. Valid values are from 0% - 99%. Value 0% disables
-free space checking logic. If user does not specify a value for this option,
-the Engine uses a default value of 10%.
-
-Whenever a new a thin pool device is created (during `docker pull` or during
-container creation), the Engine checks if the minimum free space is available.
-If the space is unavailable, then device creation fails and any relevant
-`docker` operation fails.
-
-To recover from this error, you must create more free space in the thin pool to
-recover from the error. You can create free space by deleting some images and
-containers from tge thin pool. You can also add more storage to the thin pool.
-
-To add more space to an LVM (logical volume management) thin pool, just add
-more storage to the  group container thin pool; this should automatically
-resolve any errors. If your configuration uses loop devices, then stop the
-Engine daemon, grow the size of loop files and restart the daemon to resolve
-the issue.
-
-Example use:: `dockerd --storage-opt dm.min_free_space=10%`
-
-#### dm.xfs_nospace_max_retries
-
-Specifies the maximum number of retries XFS should attempt to complete IO when
-ENOSPC (no space) error is returned by underlying storage device.
-
-By default XFS retries infinitely for IO to finish and this can result in
-unkillable process. To change this behavior one can set xfs_nospace_max_retries
-to say 0 and XFS will not retry IO after getting ENOSPC and will shutdown
-filesystem.
-
-Example use:
-
-    $ sudo dockerd --storage-opt dm.xfs_nospace_max_retries=0
-
-
-## ZFS options
-
-#### zfs.fsname
-
-Set zfs filesystem under which docker will create its own datasets.  By default
-docker will pick up the zfs filesystem where docker graph (`/var/lib/docker`)
-is located.
-
-Example use: `dockerd -s zfs --storage-opt zfs.fsname=zroot/docker`
-
-## Btrfs options
-
-#### btrfs.min_space
-
-Specifies the minimum size to use when creating the subvolume which is used for
-containers. If user uses disk quota for btrfs when creating or running a
-container with **--storage-opt size** option, docker should ensure the **size**
-cannot be smaller than **btrfs.min_space**.
-
-Example use: `docker daemon -s btrfs --storage-opt btrfs.min_space=10G`
-
-# CLUSTER STORE OPTIONS
-
-The daemon uses libkv to advertise the node within the cluster.  Some Key/Value
-backends support mutual TLS, and the client TLS settings used by the daemon can
-be configured using the **--cluster-store-opt** flag, specifying the paths to
-PEM encoded files.
-
-#### kv.cacertfile
-
-Specifies the path to a local file with PEM encoded CA certificates to trust
-
-#### kv.certfile
-
-Specifies the path to a local file with a PEM encoded certificate.  This
-certificate is used as the client cert for communication with the Key/Value
-store.
-
-#### kv.keyfile
-
-Specifies the path to a local file with a PEM encoded private key.  This
-private key is used as the client key for communication with the Key/Value
-store.
-
-# Access authorization
-
-Docker's access authorization can be extended by authorization plugins that
-your organization can purchase or build themselves. You can install one or more
-authorization plugins when you start the Docker `daemon` using the
-`--authorization-plugin=PLUGIN_ID` option.
-
-```bash
-dockerd --authorization-plugin=plugin1 --authorization-plugin=plugin2,...
-```
-
-The `PLUGIN_ID` value is either the plugin's name or a path to its
-specification file. The plugin's implementation determines whether you can
-specify a name or path. Consult with your Docker administrator to get
-information about the plugins available to you.
-
-Once a plugin is installed, requests made to the `daemon` through the
-command line or Docker's Engine API are allowed or denied by the plugin.
-If you have multiple plugins installed, each plugin, in order, must
-allow the request for it to complete.
-
-For information about how to create an authorization plugin, see [authorization
-plugin](https://docs.docker.com/engine/extend/authorization/) section in the
-Docker extend section of this documentation.
-
-# RUNTIME EXECUTION OPTIONS
-
-You can configure the runtime using options specified with the `--exec-opt` flag.
-All the flag's options have the `native` prefix. A single `native.cgroupdriver`
-option is available.
-
-The `native.cgroupdriver` option specifies the management of the container's
-cgroups. You can only specify `cgroupfs` or `systemd`. If you specify
-`systemd` and it is not available, the system errors out. If you omit the
-`native.cgroupdriver` option,` cgroupfs` is used.
-
-This example sets the `cgroupdriver` to `systemd`:
-
-```bash
-$ sudo dockerd --exec-opt native.cgroupdriver=systemd
-```
-
-Setting this option applies to all containers the daemon launches.
-
-# HISTORY
-Sept 2015, Originally compiled by Shishir Mahajan <shishir.mahajan@redhat.com>
-based on docker.com source material and internal work.
diff --git a/components/engine/man/generate.go b/components/engine/man/generate.go
deleted file mode 100644
index 964d692775..0000000000
--- a/components/engine/man/generate.go
+++ /dev/null
@@ -1,106 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"io/ioutil"
-	"log"
-	"os"
-	"path/filepath"
-
-	"github.com/docker/docker/cli/command"
-	"github.com/docker/docker/cli/command/commands"
-	"github.com/docker/docker/pkg/term"
-	"github.com/spf13/cobra"
-	"github.com/spf13/cobra/doc"
-	"github.com/spf13/pflag"
-)
-
-const descriptionSourcePath = "man/src/"
-
-func generateManPages(opts *options) error {
-	header := &doc.GenManHeader{
-		Title:   "DOCKER",
-		Section: "1",
-		Source:  "Docker Community",
-	}
-
-	stdin, stdout, stderr := term.StdStreams()
-	dockerCli := command.NewDockerCli(stdin, stdout, stderr)
-	cmd := &cobra.Command{Use: "docker"}
-	commands.AddCommands(cmd, dockerCli)
-	source := filepath.Join(opts.source, descriptionSourcePath)
-	if err := loadLongDescription(cmd, source); err != nil {
-		return err
-	}
-
-	cmd.DisableAutoGenTag = true
-	return doc.GenManTreeFromOpts(cmd, doc.GenManTreeOptions{
-		Header:           header,
-		Path:             opts.target,
-		CommandSeparator: "-",
-	})
-}
-
-func loadLongDescription(cmd *cobra.Command, path string) error {
-	for _, cmd := range cmd.Commands() {
-		if cmd.Name() == "" {
-			continue
-		}
-		fullpath := filepath.Join(path, cmd.Name()+".md")
-
-		if cmd.HasSubCommands() {
-			loadLongDescription(cmd, filepath.Join(path, cmd.Name()))
-		}
-
-		if _, err := os.Stat(fullpath); err != nil {
-			log.Printf("WARN: %s does not exist, skipping\n", fullpath)
-			continue
-		}
-
-		content, err := ioutil.ReadFile(fullpath)
-		if err != nil {
-			return err
-		}
-		cmd.Long = string(content)
-
-		fullpath = filepath.Join(path, cmd.Name()+"-example.md")
-		if _, err := os.Stat(fullpath); err != nil {
-			continue
-		}
-
-		content, err = ioutil.ReadFile(fullpath)
-		if err != nil {
-			return err
-		}
-		cmd.Example = string(content)
-
-	}
-	return nil
-}
-
-type options struct {
-	source string
-	target string
-}
-
-func parseArgs() (*options, error) {
-	opts := &options{}
-	cwd, _ := os.Getwd()
-	flags := pflag.NewFlagSet(os.Args[0], pflag.ContinueOnError)
-	flags.StringVar(&opts.source, "root", cwd, "Path to project root")
-	flags.StringVar(&opts.target, "target", "/tmp", "Target path for generated man pages")
-	err := flags.Parse(os.Args[1:])
-	return opts, err
-}
-
-func main() {
-	opts, err := parseArgs()
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err.Error())
-	}
-	fmt.Printf("Project root: %s\n", opts.source)
-	fmt.Printf("Generating man pages into %s\n", opts.target)
-	if err := generateManPages(opts); err != nil {
-		fmt.Fprintf(os.Stderr, "Failed to generate man pages: %s\n", err.Error())
-	}
-}
diff --git a/components/engine/man/generate.sh b/components/engine/man/generate.sh
deleted file mode 100755
index 905b2d7baf..0000000000
--- a/components/engine/man/generate.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-#
-# Generate man pages for docker/docker
-#
-
-set -eu
-
-mkdir -p ./man/man1
-
-# Generate man pages from cobra commands
-go build -o /tmp/gen-manpages ./man
-/tmp/gen-manpages --root . --target ./man/man1
-
-# Generate legacy pages from markdown
-./man/md2man-all.sh -q
diff --git a/components/engine/man/glide.lock b/components/engine/man/glide.lock
deleted file mode 100644
index 5ec765a4c6..0000000000
--- a/components/engine/man/glide.lock
+++ /dev/null
@@ -1,52 +0,0 @@
-hash: ead3ea293a6143fe41069ebec814bf197d8c43a92cc7666b1f7e21a419b46feb
-updated: 2016-06-20T21:53:35.420817456Z
-imports:
-- name: github.com/BurntSushi/toml
-  version: f0aeabca5a127c4078abb8c8d64298b147264b55
-- name: github.com/cpuguy83/go-md2man
-  version: a65d4d2de4d5f7c74868dfa9b202a3c8be315aaa
-  subpackages:
-  - md2man
-- name: github.com/fsnotify/fsnotify
-  version: 30411dbcefb7a1da7e84f75530ad3abe4011b4f8
-- name: github.com/hashicorp/hcl
-  version: da486364306ed66c218be9b7953e19173447c18b
-  subpackages:
-  - hcl/ast
-  - hcl/parser
-  - hcl/token
-  - json/parser
-  - hcl/scanner
-  - hcl/strconv
-  - json/scanner
-  - json/token
-- name: github.com/inconshreveable/mousetrap
-  version: 76626ae9c91c4f2a10f34cad8ce83ea42c93bb75
-- name: github.com/magiconair/properties
-  version: c265cfa48dda6474e208715ca93e987829f572f8
-- name: github.com/mitchellh/mapstructure
-  version: d2dd0262208475919e1a362f675cfc0e7c10e905
-- name: github.com/russross/blackfriday
-  version: 1d6b8e9301e720b08a8938b8c25c018285885438
-- name: github.com/shurcooL/sanitized_anchor_name
-  version: 10ef21a441db47d8b13ebcc5fd2310f636973c77
-- name: github.com/spf13/cast
-  version: 27b586b42e29bec072fe7379259cc719e1289da6
-- name: github.com/spf13/jwalterweatherman
-  version: 33c24e77fb80341fe7130ee7c594256ff08ccc46
-- name: github.com/spf13/pflag
-  version: dabebe21bf790f782ea4c7bbd2efc430de182afd
-- name: github.com/spf13/viper
-  version: c1ccc378a054ea8d4e38d8c67f6938d4760b53dd
-- name: golang.org/x/sys
-  version: 62bee037599929a6e9146f29d10dd5208c43507d
-  subpackages:
-  - unix
-- name: gopkg.in/yaml.v2
-  version: a83829b6f1293c91addabc89d0571c246397bbf4
-- name: github.com/spf13/cobra
-  repo: https://github.com/dnephin/cobra
-  subpackages:
-  - doc
-  version: v1.3
-devImports: []
diff --git a/components/engine/man/glide.yaml b/components/engine/man/glide.yaml
deleted file mode 100644
index e99b2670d8..0000000000
--- a/components/engine/man/glide.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-package: github.com/docker/docker/man
-import:
-- package: github.com/cpuguy83/go-md2man
-  subpackages:
-  - md2man
-- package: github.com/inconshreveable/mousetrap
-- package: github.com/spf13/pflag
-- package: github.com/spf13/viper
-- package: github.com/spf13/cobra
-  repo: https://github.com/dnephin/cobra
-  subpackages:
-  - doc
diff --git a/components/engine/man/md2man-all.sh b/components/engine/man/md2man-all.sh
deleted file mode 100755
index 46c7b8f08e..0000000000
--- a/components/engine/man/md2man-all.sh
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-# get into this script's directory
-cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
-
-[ "$1" = '-q' ] || {
-	set -x
-	pwd
-}
-
-for FILE in *.md; do
-	base="$(basename "$FILE")"
-	name="${base%.md}"
-	num="${name##*.}"
-	if [ -z "$num" -o "$name" = "$num" ]; then
-		# skip files that aren't of the format xxxx.N.md (like README.md)
-		continue
-	fi
-	mkdir -p "./man${num}"
-	go-md2man -in "$FILE" -out "./man${num}/${name}"
-done
diff --git a/components/engine/man/src/attach.md b/components/engine/man/src/attach.md
deleted file mode 100644
index ff1102e104..0000000000
--- a/components/engine/man/src/attach.md
+++ /dev/null
@@ -1,2 +0,0 @@
-
-Alias for `docker container attach`.
diff --git a/components/engine/man/src/commit.md b/components/engine/man/src/commit.md
deleted file mode 100644
index 3deb25bb55..0000000000
--- a/components/engine/man/src/commit.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container commit`.
diff --git a/components/engine/man/src/container/attach.md b/components/engine/man/src/container/attach.md
deleted file mode 100644
index e2fa4f8af1..0000000000
--- a/components/engine/man/src/container/attach.md
+++ /dev/null
@@ -1,66 +0,0 @@
-The **docker attach** command allows you to attach to a running container using
-the container's ID or name, either to view its ongoing output or to control it
-interactively.  You can attach to the same contained process multiple times
-simultaneously, screen sharing style, or quickly view the progress of your
-detached process.
-
-To stop a container, use `CTRL-c`. This key sequence sends `SIGKILL` to the
-container. You can detach from the container (and leave it running) using a
-configurable key sequence. The default sequence is `CTRL-p CTRL-q`. You
-configure the key sequence using the **--detach-keys** option or a configuration
-file. See **config-json(5)** for documentation on using a configuration file.
-
-It is forbidden to redirect the standard input of a `docker attach` command while
-attaching to a tty-enabled container (i.e.: launched with `-t`).
-
-# Override the detach sequence
-
-If you want, you can configure an override the Docker key sequence for detach.
-This is useful if the Docker default sequence conflicts with key sequence you
-use for other applications. There are two ways to define your own detach key
-sequence, as a per-container override or as a configuration property on  your
-entire configuration.
-
-To override the sequence for an individual container, use the
-`--detach-keys="<sequence>"` flag with the `docker attach` command. The format of
-the `<sequence>` is either a letter [a-Z], or the `ctrl-` combined with any of
-the following:
-
-* `a-z` (a single lowercase alpha character )
-* `@` (at sign)
-* `[` (left bracket)
-* `\\` (two backward slashes)
-*  `_` (underscore)
-* `^` (caret)
-
-These `a`, `ctrl-a`, `X`, or `ctrl-\\` values are all examples of valid key
-sequences. To configure a different configuration default key sequence for all
-containers, see **docker(1)**.
-
-# EXAMPLES
-
-## Attaching to a container
-
-In this example the top command is run inside a container, from an image called
-fedora, in detached mode. The ID from the container is passed into the **docker
-attach** command:
-
-    $ ID=$(sudo docker run -d fedora /usr/bin/top -b)
-    $ sudo docker attach $ID
-    top - 02:05:52 up  3:05,  0 users,  load average: 0.01, 0.02, 0.05
-    Tasks:   1 total,   1 running,   0 sleeping,   0 stopped,   0 zombie
-    Cpu(s):  0.1%us,  0.2%sy,  0.0%ni, 99.7%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
-    Mem:    373572k total,   355560k used,    18012k free,    27872k buffers
-    Swap:   786428k total,        0k used,   786428k free,   221740k cached
-
-    PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
-    1 root      20   0 17200 1116  912 R    0  0.3   0:00.03 top
-
-    top - 02:05:55 up  3:05,  0 users,  load average: 0.01, 0.02, 0.05
-    Tasks:   1 total,   1 running,   0 sleeping,   0 stopped,   0 zombie
-    Cpu(s):  0.0%us,  0.2%sy,  0.0%ni, 99.8%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
-    Mem:    373572k total,   355244k used,    18328k free,    27872k buffers
-    Swap:   786428k total,        0k used,   786428k free,   221776k cached
-
-    PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
-    1 root      20   0 17208 1144  932 R    0  0.3   0:00.03 top
diff --git a/components/engine/man/src/container/commit.md b/components/engine/man/src/container/commit.md
deleted file mode 100644
index 43d2e9c25d..0000000000
--- a/components/engine/man/src/container/commit.md
+++ /dev/null
@@ -1,30 +0,0 @@
-Create a new image from an existing container specified by name or
-container ID.  The new image will contain the contents of the
-container filesystem, *excluding* any data volumes. Refer to **docker-tag(1)**
-for more information about valid image and tag names.
-
-While the `docker commit` command is a convenient way of extending an
-existing image, you should prefer the use of a Dockerfile and `docker
-build` for generating images that you intend to share with other
-people.
-
-# EXAMPLES
-
-## Creating a new image from an existing container
-An existing Fedora based container has had Apache installed while running
-in interactive mode with the bash shell. Apache is also running. To
-create a new image run `docker ps` to find the container's ID and then run:
-
-    $ docker commit -m="Added Apache to Fedora base image" \
-      -a="A D Ministrator" 98bd7fc99854 fedora/fedora_httpd:20
-
-Note that only a-z0-9-_. are allowed when naming images from an 
-existing container.
-
-## Apply specified Dockerfile instructions while committing the image
-If an existing container was created without the DEBUG environment
-variable set to "true", you can create a new image based on that
-container by first getting the container's ID with `docker ps` and
-then running:
-
-    $ docker container commit -c="ENV DEBUG true" 98bd7fc99854 debug-image
diff --git a/components/engine/man/src/container/cp.md b/components/engine/man/src/container/cp.md
deleted file mode 100644
index 557e76de95..0000000000
--- a/components/engine/man/src/container/cp.md
+++ /dev/null
@@ -1,145 +0,0 @@
-The `docker container cp` utility copies the contents of `SRC_PATH` to the `DEST_PATH`.
-You can copy from the container's file system to the local machine or the
-reverse, from the local filesystem to the container. If `-` is specified for
-either the `SRC_PATH` or `DEST_PATH`, you can also stream a tar archive from
-`STDIN` or to `STDOUT`. The `CONTAINER` can be a running or stopped container.
-The `SRC_PATH` or `DEST_PATH` can be a file or directory.
-
-The `docker container cp` command assumes container paths are relative to the container's 
-`/` (root) directory. This means supplying the initial forward slash is optional; 
-The command sees `compassionate_darwin:/tmp/foo/myfile.txt` and
-`compassionate_darwin:tmp/foo/myfile.txt` as identical. Local machine paths can
-be an absolute or relative value. The command interprets a local machine's
-relative paths as relative to the current working directory where `docker container cp` is
-run.
-
-The `cp` command behaves like the Unix `cp -a` command in that directories are
-copied recursively with permissions preserved if possible. Ownership is set to
-the user and primary group at the destination. For example, files copied to a
-container are created with `UID:GID` of the root user. Files copied to the local
-machine are created with the `UID:GID` of the user which invoked the `docker container cp`
-command.  If you specify the `-L` option, `docker container cp` follows any symbolic link
-in the `SRC_PATH`. `docker container cp` does *not* create parent directories for
-`DEST_PATH` if they do not exist.
-
-Assuming a path separator of `/`, a first argument of `SRC_PATH` and second
-argument of `DEST_PATH`, the behavior is as follows:
-
-- `SRC_PATH` specifies a file
-    - `DEST_PATH` does not exist
-        - the file is saved to a file created at `DEST_PATH`
-    - `DEST_PATH` does not exist and ends with `/`
-        - Error condition: the destination directory must exist.
-    - `DEST_PATH` exists and is a file
-        - the destination is overwritten with the source file's contents
-    - `DEST_PATH` exists and is a directory
-        - the file is copied into this directory using the basename from
-          `SRC_PATH`
-- `SRC_PATH` specifies a directory
-    - `DEST_PATH` does not exist
-        - `DEST_PATH` is created as a directory and the *contents* of the source
-           directory are copied into this directory
-    - `DEST_PATH` exists and is a file
-        - Error condition: cannot copy a directory to a file
-    - `DEST_PATH` exists and is a directory
-        - `SRC_PATH` does not end with `/.` (that is: _slash_ followed by _dot_)
-            - the source directory is copied into this directory
-        - `SRC_PATH` does end with `/.` (that is: _slash_ followed by _dot_)
-            - the *content* of the source directory is copied into this
-              directory
-
-The command requires `SRC_PATH` and `DEST_PATH` to exist according to the above
-rules. If `SRC_PATH` is local and is a symbolic link, the symbolic link, not
-the target, is copied by default. To copy the link target and not the link, 
-specify the `-L` option.
-
-A colon (`:`) is used as a delimiter between `CONTAINER` and its path. You can
-also use `:` when specifying paths to a `SRC_PATH` or `DEST_PATH` on a local
-machine, for example  `file:name.txt`. If you use a `:` in a local machine path,
-you must be explicit with a relative or absolute path, for example:
-
-    `/path/to/file:name.txt` or `./file:name.txt`
-
-It is not possible to copy certain system files such as resources under
-`/proc`, `/sys`, `/dev`, tmpfs, and mounts created by the user in the container.
-However, you can still copy such files by manually running `tar` in `docker exec`.
-For example (consider `SRC_PATH` and `DEST_PATH` are directories):
-
-    $ docker exec foo tar Ccf $(dirname SRC_PATH) - $(basename SRC_PATH) | tar Cxf DEST_PATH -
-
-or
-
-    $ tar Ccf $(dirname SRC_PATH) - $(basename SRC_PATH) | docker exec -i foo tar Cxf DEST_PATH -
-
-
-Using `-` as the `SRC_PATH` streams the contents of `STDIN` as a tar archive.
-The command extracts the content of the tar to the `DEST_PATH` in container's
-filesystem. In this case, `DEST_PATH` must specify a directory. Using `-` as
-the `DEST_PATH` streams the contents of the resource as a tar archive to `STDOUT`.
-
-# EXAMPLES
-
-Suppose a container has finished producing some output as a file it saves
-to somewhere in its filesystem. This could be the output of a build job or
-some other computation. You can copy these outputs from the container to a
-location on your local host.
-
-If you want to copy the `/tmp/foo` directory from a container to the
-existing `/tmp` directory on your host. If you run `docker container cp` in your `~`
-(home) directory on the local host:
-
-    $ docker container cp compassionate_darwin:tmp/foo /tmp
-
-Docker creates a `/tmp/foo` directory on your host. Alternatively, you can omit
-the leading slash in the command. If you execute this command from your home
-directory:
-
-    $ docker container cp compassionate_darwin:tmp/foo tmp
-
-If `~/tmp` does not exist, Docker will create it and copy the contents of
-`/tmp/foo` from the container into this new directory. If `~/tmp` already
-exists as a directory, then Docker will copy the contents of `/tmp/foo` from
-the container into a directory at `~/tmp/foo`.
-
-When copying a single file to an existing `LOCALPATH`, the `docker container cp` command
-will either overwrite the contents of `LOCALPATH` if it is a file or place it
-into `LOCALPATH` if it is a directory, overwriting an existing file of the same
-name if one exists. For example, this command:
-
-    $ docker container cp sharp_ptolemy:/tmp/foo/myfile.txt /test
-
-If `/test` does not exist on the local machine, it will be created as a file
-with the contents of `/tmp/foo/myfile.txt` from the container. If `/test`
-exists as a file, it will be overwritten. Lastly, if `/test` exists as a
-directory, the file will be copied to `/test/myfile.txt`.
-
-Next, suppose you want to copy a file or folder into a container. For example,
-this could be a configuration file or some other input to a long running
-computation that you would like to place into a created container before it
-starts. This is useful because it does not require the configuration file or
-other input to exist in the container image.
-
-If you have a file, `config.yml`, in the current directory on your local host
-and wish to copy it to an existing directory at `/etc/my-app.d` in a container,
-this command can be used:
-
-    $ docker container cp config.yml myappcontainer:/etc/my-app.d
-
-If you have several files in a local directory `/config` which you need to copy
-to a directory `/etc/my-app.d` in a container:
-
-    $ docker container cp /config/. myappcontainer:/etc/my-app.d
-
-The above command will copy the contents of the local `/config` directory into
-the directory `/etc/my-app.d` in the container.
-
-Finally, if you want to copy a symbolic link into a container, you typically
-want to  copy the linked target and not the link itself. To copy the target, use
-the `-L` option, for example:
-
-    $ ln -s /tmp/somefile /tmp/somefile.ln
-    $ docker container cp -L /tmp/somefile.ln myappcontainer:/tmp/
-
-This command copies content of the local `/tmp/somefile` into the file
-`/tmp/somefile.ln` in the container. Without `-L` option, the `/tmp/somefile.ln`
-preserves its symbolic link but not its content.
diff --git a/components/engine/man/src/container/create-example.md b/components/engine/man/src/container/create-example.md
deleted file mode 100644
index bd83293667..0000000000
--- a/components/engine/man/src/container/create-example.md
+++ /dev/null
@@ -1,35 +0,0 @@
-### Specify isolation technology for container (--isolation)
-
-This option is useful in situations where you are running Docker containers on
-Windows. The `--isolation=<value>` option sets a container's isolation
-technology. On Linux, the only supported is the `default` option which uses
-Linux namespaces. On Microsoft Windows, you can specify these values:
-
-* `default`: Use the value specified by the Docker daemon's `--exec-opt` . If the `daemon` does not specify an isolation technology, Microsoft Windows uses `process` as its default value.
-* `process`: Namespace isolation only.
-* `hyperv`: Hyper-V hypervisor partition-based isolation.
-
-Specifying the `--isolation` flag without a value is the same as setting `--isolation="default"`.
-
-### Dealing with dynamically created devices (--device-cgroup-rule)
-
-Devices available to a container are assigned at creation time. The
-assigned devices will both be added to the cgroup.allow file and
-created into the container once it is run. This poses a problem when
-a new device needs to be added to running container.
-
-One of the solution is to add a more permissive rule to a container
-allowing it access to a wider range of devices. For example, supposing
-our container needs access to a character device with major `42` and
-any number of minor number (added as new devices appear), the
-following rule would be added:
-
-```
-docker create --device-cgroup-rule='c 42:* rmw' -name my-container my-image
-```
-
-Then, a user could ask `udev` to execute a script that would `docker exec my-container mknod newDevX c 42 <minor>`
-the required device when it is added.
-
-NOTE: initially present devices still need to be explicitly added to
-the create/run command
diff --git a/components/engine/man/src/container/create.md b/components/engine/man/src/container/create.md
deleted file mode 100644
index e47bb38db1..0000000000
--- a/components/engine/man/src/container/create.md
+++ /dev/null
@@ -1,87 +0,0 @@
-Creates a writeable container layer over the specified image and prepares it for
-running the specified command. The container ID is then printed to STDOUT. This
-is similar to **docker run -d** except the container is never started. You can 
-then use the **docker start <container_id>** command to start the container at
-any point.
-
-The initial status of the container created with **docker create** is 'created'.
-
-### OPTIONS 
-
-The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR`
-can be an absolute path or a `name` value. A `name` value must start with an
-alphanumeric character, followed by `a-z0-9`, `_` (underscore), `.` (period) or
-`-` (hyphen). An absolute path starts with a `/` (forward slash).
-
-If you supply a `HOST-DIR` that is an absolute path,  Docker bind-mounts to the
-path you specify. If you supply a `name`, Docker creates a named volume by that
-`name`. For example, you can specify either `/foo` or `foo` for a `HOST-DIR`
-value. If you supply the `/foo` value, Docker creates a bind-mount. If you
-supply the `foo` specification, Docker creates a named volume.
-
-You can specify multiple  **-v** options to mount one or more mounts to a
-container. To use these same mounts in other containers, specify the
-**--volumes-from** option also.
-
-You can supply additional options for each bind-mount following an additional
-colon.  A `:ro` or `:rw` suffix mounts a volume in read-only or read-write
-mode, respectively. By default, volumes are mounted in read-write mode.  
-You can also specify the consistency requirement for the mount, either
-`:consistent` (the default), `:cached`, or `:delegated`.  Multiple options are
-separated by commas, e.g. `:ro,cached`.
-
-Labeling systems like SELinux require that proper labels are placed on volume
-content mounted into a container. Without a label, the security system might
-prevent the processes running inside the container from using the content. By
-default, Docker does not change the labels set by the OS.
-
-To change a label in the container context, you can add either of two suffixes
-`:z` or `:Z` to the volume mount. These suffixes tell Docker to relabel file
-objects on the shared volumes. The `z` option tells Docker that two containers
-share the volume content. As a result, Docker labels the content with a shared
-content label. Shared volume labels allow all containers to read/write content.
-The `Z` option tells Docker to label the content with a private unshared label.
-Only the current container can use a private volume.
-
-By default bind mounted volumes are `private`. That means any mounts done
-inside container will not be visible on host and vice-a-versa. One can change
-this behavior by specifying a volume mount propagation property. Making a
-volume `shared` mounts done under that volume inside container will be
-visible on host and vice-a-versa. Making a volume `slave` enables only one
-way mount propagation and that is mounts done on host under that volume
-will be visible inside container but not the other way around.
-
-To control mount propagation property of volume one can use `:[r]shared`,
-`:[r]slave` or `:[r]private` propagation flag. Propagation property can
-be specified only for bind mounted volumes and not for internal volumes or
-named volumes. For mount propagation to work source mount point (mount point
-where source dir is mounted on) has to have right propagation properties. For
-shared volumes, source mount point has to be shared. And for slave volumes,
-source mount has to be either shared or slave.
-
-Use `df <source-dir>` to figure out the source mount and then use
-`findmnt -o TARGET,PROPAGATION <source-mount-dir>` to figure out propagation
-properties of source mount. If `findmnt` utility is not available, then one
-can look at mount entry for source mount point in `/proc/self/mountinfo`. Look
-at `optional fields` and see if any propagation properties are specified.
-`shared:X` means mount is `shared`, `master:X` means mount is `slave` and if
-nothing is there that means mount is `private`.
-
-To change propagation properties of a mount point use `mount` command. For
-example, if one wants to bind mount source directory `/foo` one can do
-`mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This
-will convert /foo into a `shared` mount point. Alternatively one can directly
-change propagation properties of source mount. Say `/` is source mount for
-`/foo`, then use `mount --make-shared /` to convert `/` into a `shared` mount.
-
-> **Note**:
-> When using systemd to manage the Docker daemon's start and stop, in the systemd
-> unit file there is an option to control mount propagation for the Docker daemon
-> itself, called `MountFlags`. The value of this setting may cause Docker to not
-> see mount propagation changes made on the mount point. For example, if this value
-> is `slave`, you may not be able to use the `shared` or `rshared` propagation on
-> a volume.
-
-
-To disable automatic copying of data from the container path to the volume, use
-the `nocopy` flag. The `nocopy` flag can be set on bind mounts and named volumes.
diff --git a/components/engine/man/src/container/diff.md b/components/engine/man/src/container/diff.md
deleted file mode 100644
index eb485e364e..0000000000
--- a/components/engine/man/src/container/diff.md
+++ /dev/null
@@ -1,39 +0,0 @@
-List the changed files and directories in a container᾿s filesystem since the
-container was created. Three different types of change are tracked:
-
-| Symbol | Description                     |
-|--------|---------------------------------|
-| `A`    | A file or directory was added   |
-| `D`    | A file or directory was deleted |
-| `C`    | A file or directory was changed |
-
-You can use the full or shortened container ID or the container name set using
-**docker run --name** option.
-
-# EXAMPLES
-
-Inspect the changes to an `nginx` container:
-
-```bash
-$ docker diff 1fdfd1f54c1b
-
-C /dev
-C /dev/console
-C /dev/core
-C /dev/stdout
-C /dev/fd
-C /dev/ptmx
-C /dev/stderr
-C /dev/stdin
-C /run
-A /run/nginx.pid
-C /var/lib/nginx/tmp
-A /var/lib/nginx/tmp/client_body
-A /var/lib/nginx/tmp/fastcgi
-A /var/lib/nginx/tmp/proxy
-A /var/lib/nginx/tmp/scgi
-A /var/lib/nginx/tmp/uwsgi
-C /var/log/nginx
-A /var/log/nginx/access.log
-A /var/log/nginx/error.log
-```
diff --git a/components/engine/man/src/container/exec.md b/components/engine/man/src/container/exec.md
deleted file mode 100644
index 033db426b8..0000000000
--- a/components/engine/man/src/container/exec.md
+++ /dev/null
@@ -1,25 +0,0 @@
-Run a process in a running container.
-
-The command started using `docker exec` will only run while the container's primary
-process (`PID 1`) is running, and will not be restarted if the container is restarted.
-
-If the container is paused, then the `docker exec` command will wait until the
-container is unpaused, and then run
-
-# CAPABILITIES
-
-`privileged` gives the process extended
-[Linux capabilities](http://man7.org/linux/man-pages/man7/capabilities.7.html)
-when running in a container. 
-
-Without this flag, the process run by `docker exec` in a running container has
-the same capabilities as the container, which may be limited. Set
-`--privileged` to give all capabilities to the process.
-
-# USER
-`user` sets the username or UID used and optionally the groupname or GID for the specified command.
-
-   The followings examples are all valid:
-   --user [user | user:group | uid | uid:gid | user:gid | uid:group ]
-
-   Without this argument the command will be run as root in the container.
diff --git a/components/engine/man/src/container/export.md b/components/engine/man/src/container/export.md
deleted file mode 100644
index ac07d96309..0000000000
--- a/components/engine/man/src/container/export.md
+++ /dev/null
@@ -1,20 +0,0 @@
-Export the contents of a container's filesystem using the full or shortened
-container ID or container name. The output is exported to STDOUT and can be
-redirected to a tar file.
-
-Stream to a file instead of STDOUT by using **-o**.
-
-# EXAMPLES
-Export the contents of the container called angry_bell to a tar file
-called angry_bell.tar:
-
-    $ docker export angry_bell > angry_bell.tar
-    $ docker export --output=angry_bell-latest.tar angry_bell
-    $ ls -sh angry_bell.tar
-    321M angry_bell.tar
-    $ ls -sh angry_bell-latest.tar
-    321M angry_bell-latest.tar
-
-# See also
-**docker-import(1)** to create an empty filesystem image
-and import the contents of the tarball into it, then optionally tag it.
diff --git a/components/engine/man/src/container/kill.md b/components/engine/man/src/container/kill.md
deleted file mode 100644
index b8b94e528c..0000000000
--- a/components/engine/man/src/container/kill.md
+++ /dev/null
@@ -1,2 +0,0 @@
-The main process inside each container specified will be sent SIGKILL,
- or any signal specified with option --signal.
diff --git a/components/engine/man/src/container/logs.md b/components/engine/man/src/container/logs.md
deleted file mode 100644
index c053f85758..0000000000
--- a/components/engine/man/src/container/logs.md
+++ /dev/null
@@ -1,28 +0,0 @@
-The **docker container logs** command batch-retrieves whatever logs are present for
-a container at the time of execution. This does not guarantee execution
-order when combined with a docker run (i.e., your run may not have generated
-any logs at the time you execute docker container logs).
-
-The **docker container logs --follow** command combines commands **docker container logs** and
-**docker attach**. It will first return all logs from the beginning and
-then continue streaming new output from the container's stdout and stderr.
-
-**Warning**: This command works only for the **json-file** or **journald**
-logging drivers.
-
-The `--since` option can be Unix timestamps, date formatted timestamps, or Go
-duration strings (e.g. `10m`, `1h30m`) computed relative to the client machine's
-time. Supported formats for date formatted time stamps include RFC3339Nano,
-RFC3339, `2006-01-02T15:04:05`, `2006-01-02T15:04:05.999999999`,
-`2006-01-02Z07:00`, and `2006-01-02`. The local timezone on the client will be
-used if you do not provide either a `Z` or a `+-00:00` timezone offset at the
-end of the timestamp.  When providing Unix timestamps enter
-seconds[.nanoseconds], where seconds is the number of seconds that have elapsed
-since January 1, 1970 (midnight UTC/GMT), not counting leap  seconds (aka Unix
-epoch or Unix time), and the optional .nanoseconds field is a fraction of a
-second no more than nine digits long. You can combine the `--since` option with
-either or both of the `--follow` or `--tail` options.
-
-The `docker container logs --details` command will add on extra attributes, such as
-environment variables and labels, provided to `--log-opt` when creating the
-container.
diff --git a/components/engine/man/src/container/ls.md b/components/engine/man/src/container/ls.md
deleted file mode 100644
index 5cb63079ec..0000000000
--- a/components/engine/man/src/container/ls.md
+++ /dev/null
@@ -1,110 +0,0 @@
-List the containers in the local repository. By default this shows only
-the running containers.
-
-## Filters
-
-Filter output based on these conditions:
-   - exited=<int> an exit code of <int>
-   - label=<key> or label=<key>=<value>
-   - status=(created|restarting|running|paused|exited|dead)
-   - name=<string> a container's name
-   - id=<ID> a container's ID
-   - is-task=(true|false) - containers that are a task (part of a service managed by swarm)
-   - before=(<container-name>|<container-id>)
-   - since=(<container-name>|<container-id>)
-   - ancestor=(<image-name>[:tag]|<image-id>|<image@digest>) - containers created from an image or a descendant.
-   - volume=(<volume-name>|<mount-point-destination>)
-   - network=(<network-name>|<network-id>) - containers connected to the provided network
-   - health=(starting|healthy|unhealthy|none) - filters containers based on healthcheck status
-   - publish=(<port>[/<proto>]|<startport-endport>/[<proto>]) - filters containers based on published ports
-   - expose=(<port>[/<proto>]|<startport-endport>/[<proto>]) - filters containers based on exposed ports
-
-## Format
-
-   Pretty-print containers using a Go template.
-   Valid placeholders:
-      .ID - Container ID
-      .Image - Image ID
-      .Command - Quoted command
-      .CreatedAt - Time when the container was created.
-      .RunningFor - Elapsed time since the container was started.
-      .Ports - Exposed ports.
-      .Status - Container status.
-      .Size - Container disk size.
-      .Names - Container names.
-      .Labels - All labels assigned to the container.
-      .Label - Value of a specific label for this container. For example `{{.Label "com.docker.swarm.cpu"}}`
-      .Mounts - Names of the volumes mounted in this container.
-
-# EXAMPLES
-## Display all containers, including non-running
-
-    $ docker container ls -a
-    CONTAINER ID        IMAGE                 COMMAND                CREATED             STATUS      PORTS    NAMES
-    a87ecb4f327c        fedora:20             /bin/sh -c #(nop) MA   20 minutes ago      Exit 0               desperate_brattain
-    01946d9d34d8        vpavlin/rhel7:latest  /bin/sh -c #(nop) MA   33 minutes ago      Exit 0               thirsty_bell
-    c1d3b0166030        acffc0358b9e          /bin/sh -c yum -y up   2 weeks ago         Exit 1               determined_torvalds
-    41d50ecd2f57        fedora:20             /bin/sh -c #(nop) MA   2 weeks ago         Exit 0               drunk_pike
-
-## Display only IDs of all containers, including non-running
-
-    $ docker container ls -a -q
-    a87ecb4f327c
-    01946d9d34d8
-    c1d3b0166030
-    41d50ecd2f57
-
-## Display only IDs of all containers that have the name `determined_torvalds`
-
-    $ docker container ls -a -q --filter=name=determined_torvalds
-    c1d3b0166030
-
-## Display containers with their commands
-
-    $ docker container ls --format "{{.ID}}: {{.Command}}"
-    a87ecb4f327c: /bin/sh -c #(nop) MA
-    01946d9d34d8: /bin/sh -c #(nop) MA
-    c1d3b0166030: /bin/sh -c yum -y up
-    41d50ecd2f57: /bin/sh -c #(nop) MA
-
-## Display containers with their labels in a table
-
-    $ docker container ls --format "table {{.ID}}\t{{.Labels}}"
-    CONTAINER ID        LABELS
-    a87ecb4f327c        com.docker.swarm.node=ubuntu,com.docker.swarm.storage=ssd
-    01946d9d34d8
-    c1d3b0166030        com.docker.swarm.node=debian,com.docker.swarm.cpu=6
-    41d50ecd2f57        com.docker.swarm.node=fedora,com.docker.swarm.cpu=3,com.docker.swarm.storage=ssd
-
-## Display containers with their node label in a table
-
-    $ docker container ls --format 'table {{.ID}}\t{{(.Label "com.docker.swarm.node")}}'
-    CONTAINER ID        NODE
-    a87ecb4f327c        ubuntu
-    01946d9d34d8
-    c1d3b0166030        debian
-    41d50ecd2f57        fedora
-
-## Display containers with `remote-volume` mounted
-
-    $ docker container ls --filter volume=remote-volume --format "table {{.ID}}\t{{.Mounts}}"
-    CONTAINER ID        MOUNTS
-    9c3527ed70ce        remote-volume
-
-## Display containers with a volume mounted in `/data`
-
-    $ docker container ls --filter volume=/data --format "table {{.ID}}\t{{.Mounts}}"
-    CONTAINER ID        MOUNTS
-    9c3527ed70ce        remote-volume
-
-## Display containers that have published port of 80:
-
-    $ docker ps --filter publish=80
-    CONTAINER ID        IMAGE               COMMAND             CREATED              STATUS              PORTS                   NAMES
-    fc7e477723b7        busybox             "top"               About a minute ago   Up About a minute   0.0.0.0:32768->80/tcp   admiring_roentgen
-
-## Display containers that have exposed TCP port in the range of `8000-8080`:
-
-    $ docker ps --filter expose=8000-8080/tcp
-    CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
-    9833437217a5        busybox             "top"               21 seconds ago      Up 19 seconds       8080/tcp            dreamy_mccarthy
diff --git a/components/engine/man/src/container/pause.md b/components/engine/man/src/container/pause.md
deleted file mode 100644
index 09ea5b93d2..0000000000
--- a/components/engine/man/src/container/pause.md
+++ /dev/null
@@ -1,12 +0,0 @@
-The `docker container pause` command suspends all processes in the specified containers.
-On Linux, this uses the cgroups freezer. Traditionally, when suspending a process
-the `SIGSTOP` signal is used, which is observable by the process being suspended.
-With the cgroups freezer the process is unaware, and unable to capture,
-that it is being suspended, and subsequently resumed. On Windows, only Hyper-V
-containers can be paused.
-
-See the [cgroups freezer documentation]
-(https://www.kernel.org/doc/Documentation/cgroup-v1/freezer-subsystem.txt) for
-further details.
-
-**docker-container-unpause(1)** to unpause all processes within a container.
diff --git a/components/engine/man/src/container/port.md b/components/engine/man/src/container/port.md
deleted file mode 100644
index a1c8cc6ee4..0000000000
--- a/components/engine/man/src/container/port.md
+++ /dev/null
@@ -1,26 +0,0 @@
-List port mappings for the CONTAINER, or lookup the public-facing port that is NAT-ed to the PRIVATE_PORT
-
-# EXAMPLES
-
-    $ docker ps
-    CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS                                            NAMES
-    b650456536c7        busybox:latest      top                 54 minutes ago      Up 54 minutes       0.0.0.0:1234->9876/tcp, 0.0.0.0:4321->7890/tcp   test
-
-## Find out all the ports mapped
-
-    $ docker container port test
-    7890/tcp -> 0.0.0.0:4321
-    9876/tcp -> 0.0.0.0:1234
-
-## Find out a specific mapping
-
-    $ docker container port test 7890/tcp
-    0.0.0.0:4321
-
-    $ docker container port test 7890
-    0.0.0.0:4321
-
-## An example showing error for non-existent mapping
-
-    $ docker container port test 7890/udp
-    2014/06/24 11:53:36 Error: No public port '7890/udp' published for test
diff --git a/components/engine/man/src/container/rename.md b/components/engine/man/src/container/rename.md
deleted file mode 100644
index e6f49a0ebd..0000000000
--- a/components/engine/man/src/container/rename.md
+++ /dev/null
@@ -1 +0,0 @@
-Rename a container.  Container may be running, paused or stopped.
diff --git a/components/engine/man/src/container/restart.md b/components/engine/man/src/container/restart.md
deleted file mode 100644
index 66ef6688ea..0000000000
--- a/components/engine/man/src/container/restart.md
+++ /dev/null
@@ -1 +0,0 @@
-Restart each container listed.
diff --git a/components/engine/man/src/container/rm.md b/components/engine/man/src/container/rm.md
deleted file mode 100644
index 561f0e9135..0000000000
--- a/components/engine/man/src/container/rm.md
+++ /dev/null
@@ -1,37 +0,0 @@
-**docker container rm** will remove one or more containers from the host node. The
-container name or ID can be used. This does not remove images. You cannot
-remove a running container unless you use the **-f** option. To see all
-containers on a host use the **docker container ls -a** command.
-
-# EXAMPLES
-
-## Removing a container using its ID
-
-To remove a container using its ID, find either from a **docker ps -a**
-command, or use the ID returned from the **docker run** command, or retrieve
-it from a file used to store it using the **docker run --cidfile**:
-
-    docker container rm abebf7571666
-
-## Removing a container using the container name
-
-The name of the container can be found using the **docker ps -a**
-command. The use that name as follows:
-
-    docker container rm hopeful_morse
-
-## Removing a container and all associated volumes
-
-    $ docker container rm -v redis
-    redis
-
-This command will remove the container and any volumes associated with it.
-Note that if a volume was specified with a name, it will not be removed.
-
-    $ docker create -v awesome:/foo -v /bar --name hello redis
-    hello
-    $ docker container rm -v hello
-
-In this example, the volume for `/foo` will remain in tact, but the volume for
-`/bar` will be removed. The same behavior holds for volumes inherited with
-`--volumes-from`.
diff --git a/components/engine/man/src/container/run.md b/components/engine/man/src/container/run.md
deleted file mode 100644
index 5e20273e68..0000000000
--- a/components/engine/man/src/container/run.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker run`.
diff --git a/components/engine/man/src/container/start.md b/components/engine/man/src/container/start.md
deleted file mode 100644
index 48d8592c61..0000000000
--- a/components/engine/man/src/container/start.md
+++ /dev/null
@@ -1 +0,0 @@
-Start one or more containers.
diff --git a/components/engine/man/src/container/stats.md b/components/engine/man/src/container/stats.md
deleted file mode 100644
index 2de672ee2e..0000000000
--- a/components/engine/man/src/container/stats.md
+++ /dev/null
@@ -1,43 +0,0 @@
-Display a live stream of one or more containers' resource usage statistics
-
-# Format
-
-   Pretty-print containers statistics using a Go template.
-   Valid placeholders:
-      .Container - Container name or ID.
-      .Name - Container name.
-      .ID - Container ID.
-      .CPUPerc - CPU percentage.
-      .MemUsage - Memory usage.
-      .NetIO - Network IO.
-      .BlockIO - Block IO.
-      .MemPerc - Memory percentage (Not available on Windows).
-      .PIDs - Number of PIDs (Not available on Windows).
-
-# EXAMPLES
-
-Running `docker container stats` on all running containers.
-
-    $ docker container stats
-    CONTAINER           CPU %               MEM USAGE / LIMIT     MEM %               NET I/O             BLOCK I/O
-    1285939c1fd3        0.07%               796 KiB / 64 MiB        1.21%               788 B / 648 B       3.568 MB / 512 KB
-    9c76f7834ae2        0.07%               2.746 MiB / 64 MiB      4.29%               1.266 KB / 648 B    12.4 MB / 0 B
-    d1ea048f04e4        0.03%               4.583 MiB / 64 MiB      6.30%               2.854 KB / 648 B    27.7 MB / 0 B
-
-Running `docker container stats` on multiple containers by name and id.
-
-    $ docker container stats fervent_panini 5acfcb1b4fd1
-    CONTAINER           CPU %               MEM USAGE/LIMIT     MEM %               NET I/O
-    5acfcb1b4fd1        0.00%               115.2 MiB/1.045 GiB   11.03%              1.422 kB/648 B
-    fervent_panini      0.02%               11.08 MiB/1.045 GiB   1.06%               648 B/648 B
-
-Running `docker container stats` with customized format on all (Running and Stopped) containers.
-
-    $ docker container stats --all --format "table {{.ID}}\t{{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}"
-    CONTAINER ID                                                       NAME                     CPU %               MEM USAGE / LIMIT
-    c9dfa83f0317f87637d5b7e67aa4223337d947215c5a9947e697e4f7d3e0f834   ecstatic_noether         0.00%               56KiB / 15.57GiB
-    8f92d01cf3b29b4f5fca4cd33d907e05def7af5a3684711b20a2369d211ec67f   stoic_goodall            0.07%               32.86MiB / 15.57GiB
-    38dd23dba00f307d53d040c1d18a91361bbdcccbf592315927d56cf13d8b7343   drunk_visvesvaraya       0.00%               0B / 0B
-    5a8b07ec4cc52823f3cbfdb964018623c1ba307bce2c057ccdbde5f4f6990833   big_heisenberg           0.00%               0B / 0B
-
-`drunk_visvesvaraya` and `big_heisenberg` are stopped containers in the above example.
diff --git a/components/engine/man/src/container/stop.md b/components/engine/man/src/container/stop.md
deleted file mode 100644
index e3142481b8..0000000000
--- a/components/engine/man/src/container/stop.md
+++ /dev/null
@@ -1 +0,0 @@
-Stop a container (Send SIGTERM, and then SIGKILL after grace period)
diff --git a/components/engine/man/src/container/top.md b/components/engine/man/src/container/top.md
deleted file mode 100644
index 5e243569ac..0000000000
--- a/components/engine/man/src/container/top.md
+++ /dev/null
@@ -1,11 +0,0 @@
-Display the running process of the container. ps-OPTION can be any of the options you would pass to a Linux ps command.
-
-All displayed information is from host's point of view.
-
-# EXAMPLES
-
-Run **docker container top** with the ps option of -x:
-
-    $ docker container top 8601afda2b -x
-    PID      TTY       STAT       TIME         COMMAND
-    16623    ?         Ss         0:00         sleep 99999
diff --git a/components/engine/man/src/container/unpause.md b/components/engine/man/src/container/unpause.md
deleted file mode 100644
index 0e77ceed6b..0000000000
--- a/components/engine/man/src/container/unpause.md
+++ /dev/null
@@ -1,6 +0,0 @@
-The `docker container unpause` command un-suspends all processes in a container.
-On Linux, it does this using the cgroups freezer.
-
-See the [cgroups freezer documentation]
-(https://www.kernel.org/doc/Documentation/cgroup-v1/freezer-subsystem.txt) for
-further details.
diff --git a/components/engine/man/src/container/update.md b/components/engine/man/src/container/update.md
deleted file mode 100644
index 26ee4e3216..0000000000
--- a/components/engine/man/src/container/update.md
+++ /dev/null
@@ -1,102 +0,0 @@
-The **docker container update** command dynamically updates container configuration.
-You can use this command to prevent containers from consuming too many 
-resources from their Docker host.  With a single command, you can place 
-limits on a single container or on many. To specify more than one container,
-provide space-separated list of container names or IDs.
-
-With the exception of the **--kernel-memory** option, you can specify these
-options on a running or a stopped container. On kernel version older than
-4.6, You can only update **--kernel-memory** on a stopped container or on
-a running container with kernel memory initialized.
-
-# OPTIONS
-
-## kernel-memory
-
-Kernel memory limit (format: `<number>[<unit>]`, where unit = b, k, m or g)
-
-Note that on kernel version older than 4.6, you can not update kernel memory on
-a running container if the container is started without kernel memory initialized,
-in this case, it can only be updated after it's stopped. The new setting takes
-effect when the container is started.
-
-## memory
-
-Memory limit (format: <number><optional unit>, where unit = b, k, m or g)
-
-Note that the memory should be smaller than the already set swap memory limit.
-If you want update a memory limit bigger than the already set swap memory limit,
-you should update swap memory limit at the same time. If you don't set swap memory 
-limit on docker create/run but only memory limit, the swap memory is double
-the memory limit.
-
-# EXAMPLES
-
-The following sections illustrate ways to use this command.
-
-### Update a container's cpu-shares
-
-To limit a container's cpu-shares to 512, first identify the container
-name or ID. You can use **docker ps** to find these values. You can also
-use the ID returned from the **docker run** command.  Then, do the following:
-
-```bash
-$ docker container update --cpu-shares 512 abebf7571666
-```
-
-### Update a container with cpu-shares and memory
-
-To update multiple resource configurations for multiple containers:
-
-```bash
-$ docker container update --cpu-shares 512 -m 300M abebf7571666 hopeful_morse
-```
-
-### Update a container's kernel memory constraints
-
-You can update a container's kernel memory limit using the **--kernel-memory**
-option. On kernel version older than 4.6, this option can be updated on a
-running container only if the container was started with **--kernel-memory**.
-If the container was started *without* **--kernel-memory** you need to stop
-the container before updating kernel memory.
-
-For example, if you started a container with this command:
-
-```bash
-$ docker run -dit --name test --kernel-memory 50M ubuntu bash
-```
-
-You can update kernel memory while the container is running:
-
-```bash
-$ docker container update --kernel-memory 80M test
-```
-
-If you started a container *without* kernel memory initialized:
-
-```bash
-$ docker run -dit --name test2 --memory 300M ubuntu bash
-```
-
-Update kernel memory of running container `test2` will fail. You need to stop
-the container before updating the **--kernel-memory** setting. The next time you
-start it, the container uses the new value.
-
-Kernel version newer than (include) 4.6 does not have this limitation, you
-can use `--kernel-memory` the same way as other options.
-
-### Update a container's restart policy
-
-You can change a container's restart policy on a running container. The new
-restart policy takes effect instantly after you run `docker container update` on a
-container.
-
-To update restart policy for one or more containers:
-
-```bash
-$ docker container update --restart=on-failure:3 abebf7571666 hopeful_morse
-```
-
-Note that if the container is started with "--rm" flag, you cannot update the restart
-policy for it. The `AutoRemove` and `RestartPolicy` are mutually exclusive for the
-container.
diff --git a/components/engine/man/src/container/wait.md b/components/engine/man/src/container/wait.md
deleted file mode 100644
index 63dcc5a48d..0000000000
--- a/components/engine/man/src/container/wait.md
+++ /dev/null
@@ -1,8 +0,0 @@
-Block until a container stops, then print its exit code.
-
-# EXAMPLES
-
-    $ docker run -d fedora sleep 99
-    079b83f558a2bc52ecad6b2a5de13622d584e6bb1aea058c11b36511e85e7622
-    $ docker container wait 079b83f558a2bc
-    0
diff --git a/components/engine/man/src/cp.md b/components/engine/man/src/cp.md
deleted file mode 100644
index b1898ffc7c..0000000000
--- a/components/engine/man/src/cp.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container cp`.
diff --git a/components/engine/man/src/create.md b/components/engine/man/src/create.md
deleted file mode 100644
index f600d7d535..0000000000
--- a/components/engine/man/src/create.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container create`.
diff --git a/components/engine/man/src/diff.md b/components/engine/man/src/diff.md
deleted file mode 100644
index 29a639efa5..0000000000
--- a/components/engine/man/src/diff.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container diff`.
diff --git a/components/engine/man/src/events.md b/components/engine/man/src/events.md
deleted file mode 100644
index 05fa614b7d..0000000000
--- a/components/engine/man/src/events.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker system events`.
diff --git a/components/engine/man/src/exec.md b/components/engine/man/src/exec.md
deleted file mode 100644
index 21d2ce31ee..0000000000
--- a/components/engine/man/src/exec.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container exec`.
diff --git a/components/engine/man/src/export.md b/components/engine/man/src/export.md
deleted file mode 100644
index 1cc9799799..0000000000
--- a/components/engine/man/src/export.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container export`.
diff --git a/components/engine/man/src/history.md b/components/engine/man/src/history.md
deleted file mode 100644
index 8b5f3e871a..0000000000
--- a/components/engine/man/src/history.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker image history`.
diff --git a/components/engine/man/src/image/build.md b/components/engine/man/src/image/build.md
deleted file mode 100644
index 9dc897584a..0000000000
--- a/components/engine/man/src/image/build.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker build`.
diff --git a/components/engine/man/src/image/history.md b/components/engine/man/src/image/history.md
deleted file mode 100644
index cef058e50e..0000000000
--- a/components/engine/man/src/image/history.md
+++ /dev/null
@@ -1,54 +0,0 @@
-Show the history of when and how an image was created.
-
-# EXAMPLES
-    $ docker history fedora
-    IMAGE          CREATED          CREATED BY                                      SIZE                COMMENT
-    105182bb5e8b   5 days ago       /bin/sh -c #(nop) ADD file:71356d2ad59aa3119d   372.7 MB
-    73bd853d2ea5   13 days ago      /bin/sh -c #(nop) MAINTAINER Lokesh Mandvekar   0 B
-    511136ea3c5a   10 months ago                                                    0 B                 Imported from -
-
-## Display comments in the image history
-The `docker commit` command has a **-m** flag for adding comments to the image. These comments will be displayed in the image history.
-
-    $ sudo docker history docker:scm
-    IMAGE               CREATED             CREATED BY                                      SIZE                COMMENT
-    2ac9d1098bf1        3 months ago        /bin/bash                                       241.4 MB            Added Apache to Fedora base image
-    88b42ffd1f7c        5 months ago        /bin/sh -c #(nop) ADD file:1fd8d7f9f6557cafc7   373.7 MB            
-    c69cab00d6ef        5 months ago        /bin/sh -c #(nop) MAINTAINER Lokesh Mandvekar   0 B                 
-    511136ea3c5a        19 months ago                                                       0 B                 Imported from -
-
-### Format the output
-
-The formatting option (`--format`) will pretty-prints history output
-using a Go template.
-
-Valid placeholders for the Go template are listed below:
-
-| Placeholder     | Description |
-| --------------- | ----------- |
-| `.ID`           | Image ID    |
-| `.CreatedSince` | Elapsed time since the image was created if `--human=true`, otherwise timestamp of when image was created |
-| `.CreatedAt`    | Timestamp of when image was created |
-| `.CreatedBy`    | Command that was used to create the image |
-| `.Size`         | Image disk size |
-| `.Comment`      | Comment for image |
-
-When using the `--format` option, the `history` command will either
-output the data exactly as the template declares or, when using the
-`table` directive, will include column headers as well.
-
-The following example uses a template without headers and outputs the
-`ID` and `CreatedSince` entries separated by a colon for all images:
-
-```bash
-$ docker images --format "{{.ID}}: {{.Created}} ago"
-
-cc1b61406712: 2 weeks ago
-<missing>: 2 weeks ago
-<missing>: 2 weeks ago
-<missing>: 2 weeks ago
-<missing>: 2 weeks ago
-<missing>: 3 weeks ago
-<missing>: 3 weeks ago
-<missing>: 3 weeks ago
-```
diff --git a/components/engine/man/src/image/import.md b/components/engine/man/src/image/import.md
deleted file mode 100644
index 2814a71e43..0000000000
--- a/components/engine/man/src/image/import.md
+++ /dev/null
@@ -1,42 +0,0 @@
-Create a new filesystem image from the contents of a tarball (`.tar`,
-`.tar.gz`, `.tgz`, `.bzip`, `.tar.xz`, `.txz`) into it, then optionally tag it.
-
-
-# EXAMPLES
-
-## Import from a remote location
-
-    # docker image import http://example.com/exampleimage.tgz example/imagerepo
-
-## Import from a local file
-
-Import to docker via pipe and stdin:
-
-    # cat exampleimage.tgz | docker image import - example/imagelocal
-
-Import with a commit message. 
-
-    # cat exampleimage.tgz | docker image import --message "New image imported from tarball" - exampleimagelocal:new
-
-Import to a Docker image from a local file.
-
-    # docker image import /path/to/exampleimage.tgz 
-
-
-## Import from a local file and tag
-
-Import to docker via pipe and stdin:
-
-    # cat exampleimageV2.tgz | docker image import - example/imagelocal:V-2.0
-
-## Import from a local directory
-
-    # tar -c . | docker image import - exampleimagedir
-
-## Apply specified Dockerfile instructions while importing the image
-This example sets the docker image ENV variable DEBUG to true by default.
-
-    # tar -c . | docker image import -c="ENV DEBUG true" - exampleimagedir
-
-# See also
-**docker-export(1)** to export the contents of a filesystem as a tar archive to STDOUT.
diff --git a/components/engine/man/src/image/load.md b/components/engine/man/src/image/load.md
deleted file mode 100644
index 81f126fdfc..0000000000
--- a/components/engine/man/src/image/load.md
+++ /dev/null
@@ -1,25 +0,0 @@
-Loads a tarred repository from a file or the standard input stream.
-Restores both images and tags. Write image names or IDs imported it
-standard output stream.
-
-# EXAMPLES
-
-    $ docker images
-    REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
-    busybox             latest              769b9341d937        7 weeks ago         2.489 MB
-    $ docker load --input fedora.tar
-    # […]
-    Loaded image: fedora:rawhide
-    # […]
-    Loaded image: fedora:20
-    # […]
-    $ docker images
-    REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
-    busybox             latest              769b9341d937        7 weeks ago         2.489 MB
-    fedora              rawhide             0d20aec6529d        7 weeks ago         387 MB
-    fedora              20                  58394af37342        7 weeks ago         385.5 MB
-    fedora              heisenbug           58394af37342        7 weeks ago         385.5 MB
-    fedora              latest              58394af37342        7 weeks ago         385.5 MB
-
-# See also
-**docker-image-save(1)** to save one or more images to a tar archive (streamed to STDOUT by default).
diff --git a/components/engine/man/src/image/ls.md b/components/engine/man/src/image/ls.md
deleted file mode 100644
index 7e32749911..0000000000
--- a/components/engine/man/src/image/ls.md
+++ /dev/null
@@ -1,118 +0,0 @@
-This command lists the images stored in the local Docker repository.
-
-By default, intermediate images, used during builds, are not listed. Some of the
-output, e.g., image ID, is truncated, for space reasons. However the truncated
-image ID, and often the first few characters, are enough to be used in other
-Docker commands that use the image ID. The output includes repository, tag, image
-ID, date created and the virtual size.
-
-The title REPOSITORY for the first title may seem confusing. It is essentially
-the image name. However, because you can tag a specific image, and multiple tags
-(image instances) can be associated with a single name, the name is really a
-repository for all tagged images of the same name. For example consider an image
-called fedora. It may be tagged with 18, 19, or 20, etc. to manage different
-versions.
-
-## Filters
-
-Filters the output based on these conditions:
-
-   - dangling=(true|false) - find unused images
-   - label=<key> or label=<key>=<value>
-   - before=(<image-name>[:tag]|<image-id>|<image@digest>)
-   - since=(<image-name>[:tag]|<image-id>|<image@digest>)
-   - reference=(pattern of an image reference)
-
-## Format
-
-   Pretty-print images using a Go template.
-   Valid placeholders:
-      .ID - Image ID
-      .Repository - Image repository
-      .Tag - Image tag
-      .Digest - Image digest
-      .CreatedSince - Elapsed time since the image was created
-      .CreatedAt - Time when the image was created
-      .Size - Image disk size
-
-# EXAMPLES
-
-## Listing the images
-
-To list the images in a local repository (not the registry) run:
-
-    docker image ls
-
-The list will contain the image repository name, a tag for the image, and an
-image ID, when it was created and its virtual size. Columns: REPOSITORY, TAG,
-IMAGE ID, CREATED, and SIZE.
-
-The `docker image ls` command takes an optional `[REPOSITORY[:TAG]]` argument
-that restricts the list to images that match the argument. If you specify
-`REPOSITORY` but no `TAG`, the `docker image ls` command lists all images in the
-given repository.
-
-    docker image ls java
-
-The `[REPOSITORY[:TAG]]` value must be an "exact match". This means that, for example,
-`docker image ls jav` does not match the image `java`.
-
-If both `REPOSITORY` and `TAG` are provided, only images matching that
-repository and tag are listed.  To find all local images in the "java"
-repository with tag "8" you can use:
-
-    docker image ls java:8
-
-To get a verbose list of images which contains all the intermediate images
-used in builds use **-a**:
-
-    docker image ls -a
-
-Previously, the docker image ls command supported the --tree and --dot arguments,
-which displayed different visualizations of the image data. Docker core removed
-this functionality in the 1.7 version. If you liked this functionality, you can
-still find it in the third-party dockviz tool: https://github.com/justone/dockviz.
-
-## Listing images in a desired format
-
-When using the --format option, the image command will either output the data 
-exactly as the template declares or, when using the `table` directive, will 
-include column headers as well. You can use special characters like `\t` for
-inserting tab spacing between columns. 
-
-The following example uses a template without headers and outputs the ID and 
-Repository entries separated by a colon for all images:
-
-    docker images --format "{{.ID}}: {{.Repository}}"
-    77af4d6b9913: <none>
-    b6fa739cedf5: committ
-    78a85c484bad: ipbabble
-    30557a29d5ab: docker
-    5ed6274db6ce: <none>
-    746b819f315e: postgres
-    746b819f315e: postgres
-    746b819f315e: postgres
-    746b819f315e: postgres
-
-To list all images with their repository and tag in a table format you can use:
-
-    docker images --format "table {{.ID}}\t{{.Repository}}\t{{.Tag}}"
-    IMAGE ID            REPOSITORY                TAG
-    77af4d6b9913        <none>                    <none>
-    b6fa739cedf5        committ                   latest
-    78a85c484bad        ipbabble                  <none>
-    30557a29d5ab        docker                    latest
-    5ed6274db6ce        <none>                    <none>
-    746b819f315e        postgres                  9
-    746b819f315e        postgres                  9.3
-    746b819f315e        postgres                  9.3.5
-    746b819f315e        postgres                  latest
-
-Valid template placeholders are listed above.
-
-## Listing only the shortened image IDs
-
-Listing just the shortened image IDs. This can be useful for some automated
-tools.
-
-    docker image ls -q
diff --git a/components/engine/man/src/image/pull.md b/components/engine/man/src/image/pull.md
deleted file mode 100644
index 0286ef1502..0000000000
--- a/components/engine/man/src/image/pull.md
+++ /dev/null
@@ -1,189 +0,0 @@
-This command pulls down an image or a repository from a registry. If
-there is more than one image for a repository (e.g., fedora) then all
-images for that repository name can be pulled down including any tags
-(see the option **-a** or **--all-tags**).
-
-If you do not specify a `REGISTRY_HOST`, the command uses Docker's public
-registry located at `registry-1.docker.io` by default. 
-
-# EXAMPLES
-
-### Pull an image from Docker Hub
-
-To download a particular image, or set of images (i.e., a repository), use
-`docker image pull`. If no tag is provided, Docker Engine uses the `:latest` tag as a
-default. This command pulls the `debian:latest` image:
-
-    $ docker image pull debian
-
-    Using default tag: latest
-    latest: Pulling from library/debian
-    fdd5d7827f33: Pull complete
-    a3ed95caeb02: Pull complete
-    Digest: sha256:e7d38b3517548a1c71e41bffe9c8ae6d6d29546ce46bf62159837aad072c90aa
-    Status: Downloaded newer image for debian:latest
-
-Docker images can consist of multiple layers. In the example above, the image
-consists of two layers; `fdd5d7827f33` and `a3ed95caeb02`.
-
-Layers can be reused by images. For example, the `debian:jessie` image shares
-both layers with `debian:latest`. Pulling the `debian:jessie` image therefore
-only pulls its metadata, but not its layers, because all layers are already
-present locally:
-
-    $ docker image pull debian:jessie
-
-    jessie: Pulling from library/debian
-    fdd5d7827f33: Already exists
-    a3ed95caeb02: Already exists
-    Digest: sha256:a9c958be96d7d40df920e7041608f2f017af81800ca5ad23e327bc402626b58e
-    Status: Downloaded newer image for debian:jessie
-
-To see which images are present locally, use the **docker-images(1)**
-command:
-
-    $ docker images
-
-    REPOSITORY   TAG      IMAGE ID        CREATED      SIZE
-    debian       jessie   f50f9524513f    5 days ago   125.1 MB
-    debian       latest   f50f9524513f    5 days ago   125.1 MB
-
-Docker uses a content-addressable image store, and the image ID is a SHA256
-digest covering the image's configuration and layers. In the example above,
-`debian:jessie` and `debian:latest` have the same image ID because they are
-actually the *same* image tagged with different names. Because they are the
-same image, their layers are stored only once and do not consume extra disk
-space.
-
-For more information about images, layers, and the content-addressable store,
-refer to [understand images, containers, and storage drivers](https://docs.docker.com/engine/userguide/storagedriver/imagesandcontainers/)
-in the online documentation.
-
-
-## Pull an image by digest (immutable identifier)
-
-So far, you've pulled images by their name (and "tag"). Using names and tags is
-a convenient way to work with images. When using tags, you can `docker image pull` an
-image again to make sure you have the most up-to-date version of that image.
-For example, `docker image pull ubuntu:14.04` pulls the latest version of the Ubuntu
-14.04 image.
-
-In some cases you don't want images to be updated to newer versions, but prefer
-to use a fixed version of an image. Docker enables you to pull an image by its
-*digest*. When pulling an image by digest, you specify *exactly* which version
-of an image to pull. Doing so, allows you to "pin" an image to that version,
-and guarantee that the image you're using is always the same.
-
-To know the digest of an image, pull the image first. Let's pull the latest
-`ubuntu:14.04` image from Docker Hub:
-
-    $ docker image pull ubuntu:14.04
-
-    14.04: Pulling from library/ubuntu
-    5a132a7e7af1: Pull complete
-    fd2731e4c50c: Pull complete
-    28a2f68d1120: Pull complete
-    a3ed95caeb02: Pull complete
-    Digest: sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
-    Status: Downloaded newer image for ubuntu:14.04
-
-Docker prints the digest of the image after the pull has finished. In the example
-above, the digest of the image is:
-
-    sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
-
-Docker also prints the digest of an image when *pushing* to a registry. This
-may be useful if you want to pin to a version of the image you just pushed.
-
-A digest takes the place of the tag when pulling an image, for example, to 
-pull the above image by digest, run the following command:
-
-    $ docker image pull ubuntu@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
-
-    sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2: Pulling from library/ubuntu
-    5a132a7e7af1: Already exists
-    fd2731e4c50c: Already exists
-    28a2f68d1120: Already exists
-    a3ed95caeb02: Already exists
-    Digest: sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
-    Status: Downloaded newer image for ubuntu@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
-
-Digest can also be used in the `FROM` of a Dockerfile, for example:
-
-    FROM ubuntu@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
-    MAINTAINER some maintainer <maintainer@example.com>
-
-> **Note**: Using this feature "pins" an image to a specific version in time.
-> Docker will therefore not pull updated versions of an image, which may include 
-> security updates. If you want to pull an updated image, you need to change the
-> digest accordingly.
-
-## Pulling from a different registry
-
-By default, `docker image pull` pulls images from Docker Hub. It is also possible to
-manually specify the path of a registry to pull from. For example, if you have
-set up a local registry, you can specify its path to pull from it. A registry
-path is similar to a URL, but does not contain a protocol specifier (`https://`).
-
-The following command pulls the `testing/test-image` image from a local registry
-listening on port 5000 (`myregistry.local:5000`):
-
-    $ docker image pull myregistry.local:5000/testing/test-image
-
-Registry credentials are managed by **docker-login(1)**.
-
-Docker uses the `https://` protocol to communicate with a registry, unless the
-registry is allowed to be accessed over an insecure connection. Refer to the
-[insecure registries](https://docs.docker.com/engine/reference/commandline/daemon/#insecure-registries)
-section in the online documentation for more information.
-
-
-## Pull a repository with multiple images
-
-By default, `docker image pull` pulls a *single* image from the registry. A repository
-can contain multiple images. To pull all images from a repository, provide the
-`-a` (or `--all-tags`) option when using `docker image pull`.
-
-This command pulls all images from the `fedora` repository:
-
-    $ docker image pull --all-tags fedora
-
-    Pulling repository fedora
-    ad57ef8d78d7: Download complete
-    105182bb5e8b: Download complete
-    511136ea3c5a: Download complete
-    73bd853d2ea5: Download complete
-    ....
-
-    Status: Downloaded newer image for fedora
-
-After the pull has completed use the `docker images` command to see the
-images that were pulled. The example below shows all the `fedora` images
-that are present locally:
-
-    $ docker images fedora
-
-    REPOSITORY   TAG         IMAGE ID        CREATED      SIZE
-    fedora       rawhide     ad57ef8d78d7    5 days ago   359.3 MB
-    fedora       20          105182bb5e8b    5 days ago   372.7 MB
-    fedora       heisenbug   105182bb5e8b    5 days ago   372.7 MB
-    fedora       latest      105182bb5e8b    5 days ago   372.7 MB
-
-
-## Canceling a pull
-
-Killing the `docker image pull` process, for example by pressing `CTRL-c` while it is
-running in a terminal, will terminate the pull operation.
-
-    $ docker image pull fedora
-
-    Using default tag: latest
-    latest: Pulling from library/fedora
-    a3ed95caeb02: Pulling fs layer
-    236608c7b546: Pulling fs layer
-    ^C
-
-> **Note**: Technically, the Engine terminates a pull operation when the
-> connection between the Docker Engine daemon and the Docker Engine client
-> initiating the pull is lost. If the connection with the Engine daemon is
-> lost for other reasons than a manual interaction, the pull is also aborted.
diff --git a/components/engine/man/src/image/push.md b/components/engine/man/src/image/push.md
deleted file mode 100644
index 8b4334d273..0000000000
--- a/components/engine/man/src/image/push.md
+++ /dev/null
@@ -1,34 +0,0 @@
-Use `docker image push` to share your images to the [Docker Hub](https://hub.docker.com)
-registry or to a self-hosted one.
-
-Refer to **docker-image-tag(1)** for more information about valid image and tag names.
-
-Killing the **docker image push** process, for example by pressing **CTRL-c** while it
-is running in a terminal, terminates the push operation.
-
-Registry credentials are managed by **docker-login(1)**.
-
-# EXAMPLES
-
-## Pushing a new image to a registry
-
-First save the new image by finding the container ID (using **docker container ls**)
-and then committing it to a new image name.  Note that only a-z0-9-_. are
-allowed when naming images:
-
-    # docker container commit c16378f943fe rhel-httpd
-
-Now, push the image to the registry using the image ID. In this example the
-registry is on host named `registry-host` and listening on port `5000`. To do
-this, tag the image with the host name or IP address, and the port of the
-registry:
-
-    # docker image tag rhel-httpd registry-host:5000/myadmin/rhel-httpd
-    # docker image push registry-host:5000/myadmin/rhel-httpd
-
-Check that this worked by running:
-
-    # docker image ls
-
-You should see both `rhel-httpd` and `registry-host:5000/myadmin/rhel-httpd`
-listed.
diff --git a/components/engine/man/src/image/rm.md b/components/engine/man/src/image/rm.md
deleted file mode 100644
index 348d45402e..0000000000
--- a/components/engine/man/src/image/rm.md
+++ /dev/null
@@ -1,11 +0,0 @@
-Removes one or more images from the host node. This does not remove images from
-a registry. You cannot remove an image of a running container unless you use the
-**-f** option. To see all images on a host use the **docker image ls** command.
-
-# EXAMPLES
-
-## Removing an image
-
-Here is an example of removing an image:
-
-    docker image rm fedora/httpd
diff --git a/components/engine/man/src/image/save.md b/components/engine/man/src/image/save.md
deleted file mode 100644
index 19d885ec61..0000000000
--- a/components/engine/man/src/image/save.md
+++ /dev/null
@@ -1,19 +0,0 @@
-Produces a tarred repository to the standard output stream. Contains all
-parent layers, and all tags + versions, or specified repo:tag.
-
-Stream to a file instead of STDOUT by using **-o**.
-
-# EXAMPLES
-
-Save all fedora repository images to a fedora-all.tar and save the latest
-fedora image to a fedora-latest.tar:
-
-    $ docker image save fedora > fedora-all.tar
-    $ docker image save --output=fedora-latest.tar fedora:latest
-    $ ls -sh fedora-all.tar
-    721M fedora-all.tar
-    $ ls -sh fedora-latest.tar
-    367M fedora-latest.tar
-
-# See also
-**docker-image-load(1)** to load an image from a tar archive on STDIN.
diff --git a/components/engine/man/src/image/tag.md b/components/engine/man/src/image/tag.md
deleted file mode 100644
index 16abd75290..0000000000
--- a/components/engine/man/src/image/tag.md
+++ /dev/null
@@ -1,54 +0,0 @@
-Assigns a new alias to an image in a registry. An alias refers to the
-entire image name including the optional `TAG` after the ':'. 
-
-# OPTIONS
-**NAME**
-   The image name which is made up of slash-separated name components, 
-   optionally prefixed by a registry hostname. The hostname must comply with 
-   standard DNS rules, but may not contain underscores. If a hostname is 
-   present, it may optionally be followed by a port number in the format 
-   `:8080`. If not present, the command uses Docker's public registry located at
-   `registry-1.docker.io` by default. Name components may contain lowercase 
-   letters, digits and separators. A separator is defined as a period, one or
-   two underscores, or one or more dashes. A name component may not start or end 
-   with a separator.
-
-**TAG**
-   The tag assigned to the image to version and distinguish images with the same
-   name. The tag name must be valid ASCII and may contain lowercase and
-   uppercase letters, digits, underscores, periods and hyphens. A tag name
-   may not start with a period or a hyphen and may contain a maximum of 128
-   characters.
-
-# EXAMPLES
-
-## Tagging an image referenced by ID
-
-To tag a local image with ID "0e5574283393" into the "fedora" repository with 
-"version1.0":
-
-    docker image tag 0e5574283393 fedora/httpd:version1.0
-
-## Tagging an image referenced by Name
-
-To tag a local image with name "httpd" into the "fedora" repository with 
-"version1.0":
-
-    docker image tag httpd fedora/httpd:version1.0
-
-Note that since the tag name is not specified, the alias is created for an
-existing local version `httpd:latest`.
-
-## Tagging an image referenced by Name and Tag
-
-To tag a local image with name "httpd" and tag "test" into the "fedora"
-repository with "version1.0.test":
-
-    docker image tag httpd:test fedora/httpd:version1.0.test
-
-## Tagging an image for a private repository
-
-To push an image to a private registry and not the central Docker
-registry you must tag it with the registry hostname and port (if needed).
-
-    docker image tag 0e5574283393 myregistryhost:5000/fedora/httpd:version1.0
diff --git a/components/engine/man/src/images.md b/components/engine/man/src/images.md
deleted file mode 100644
index ae6a3875ee..0000000000
--- a/components/engine/man/src/images.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker image ls`.
diff --git a/components/engine/man/src/import.md b/components/engine/man/src/import.md
deleted file mode 100644
index 826c71b1b3..0000000000
--- a/components/engine/man/src/import.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker image import`.
diff --git a/components/engine/man/src/info.md b/components/engine/man/src/info.md
deleted file mode 100644
index 35e62f86e9..0000000000
--- a/components/engine/man/src/info.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker system info`.
diff --git a/components/engine/man/src/inspect.md b/components/engine/man/src/inspect.md
deleted file mode 100644
index d0a2a68378..0000000000
--- a/components/engine/man/src/inspect.md
+++ /dev/null
@@ -1,286 +0,0 @@
-This displays the low-level information on Docker object(s) (e.g. container, 
-image, volume,network, node, service, or task) identified by name or ID. By default,
-this will render all results in a JSON array. If the container and image have
-the same name, this will return container JSON for unspecified type. If a format
-is specified, the given template will be executed for each result.
-
-# EXAMPLES
-
-Get information about an image when image name conflicts with the container name,
-e.g. both image and container are named rhel7:
-
-    $ docker inspect --type=image rhel7
-    [
-    {
-     "Id": "fe01a428b9d9de35d29531e9994157978e8c48fa693e1bf1d221dffbbb67b170",
-     "Parent": "10acc31def5d6f249b548e01e8ffbaccfd61af0240c17315a7ad393d022c5ca2",
-     ....
-    }
-    ]
-
-## Getting information on a container
-
-To get information on a container use its ID or instance name:
-
-    $ docker inspect d2cc496561d6
-    [{
-    "Id": "d2cc496561d6d520cbc0236b4ba88c362c446a7619992123f11c809cded25b47",
-    "Created": "2015-06-08T16:18:02.505155285Z",
-    "Path": "bash",
-    "Args": [],
-    "State": {
-        "Running": false,
-        "Paused": false,
-        "Restarting": false,
-        "OOMKilled": false,
-        "Dead": false,
-        "Pid": 0,
-        "ExitCode": 0,
-        "Error": "",
-        "StartedAt": "2015-06-08T16:18:03.643865954Z",
-        "FinishedAt": "2015-06-08T16:57:06.448552862Z"
-    },
-    "Image": "ded7cd95e059788f2586a51c275a4f151653779d6a7f4dad77c2bd34601d94e4",
-    "NetworkSettings": {
-        "Bridge": "",
-        "SandboxID": "6b4851d1903e16dd6a567bd526553a86664361f31036eaaa2f8454d6f4611f6f",
-        "HairpinMode": false,
-        "LinkLocalIPv6Address": "",
-        "LinkLocalIPv6PrefixLen": 0,
-        "Ports": {},
-        "SandboxKey": "/var/run/docker/netns/6b4851d1903e",
-        "SecondaryIPAddresses": null,
-        "SecondaryIPv6Addresses": null,
-        "EndpointID": "7587b82f0dada3656fda26588aee72630c6fab1536d36e394b2bfbcf898c971d",
-        "Gateway": "172.17.0.1",
-        "GlobalIPv6Address": "",
-        "GlobalIPv6PrefixLen": 0,
-        "IPAddress": "172.17.0.2",
-        "IPPrefixLen": 16,
-        "IPv6Gateway": "",
-        "MacAddress": "02:42:ac:12:00:02",
-        "Networks": {
-            "bridge": {
-                "NetworkID": "7ea29fc1412292a2d7bba362f9253545fecdfa8ce9a6e37dd10ba8bee7129812",
-                "EndpointID": "7587b82f0dada3656fda26588aee72630c6fab1536d36e394b2bfbcf898c971d",
-                "Gateway": "172.17.0.1",
-                "IPAddress": "172.17.0.2",
-                "IPPrefixLen": 16,
-                "IPv6Gateway": "",
-                "GlobalIPv6Address": "",
-                "GlobalIPv6PrefixLen": 0,
-                "MacAddress": "02:42:ac:12:00:02"
-            }
-        }
-
-    },
-    "ResolvConfPath": "/var/lib/docker/containers/d2cc496561d6d520cbc0236b4ba88c362c446a7619992123f11c809cded25b47/resolv.conf",
-    "HostnamePath": "/var/lib/docker/containers/d2cc496561d6d520cbc0236b4ba88c362c446a7619992123f11c809cded25b47/hostname",
-    "HostsPath": "/var/lib/docker/containers/d2cc496561d6d520cbc0236b4ba88c362c446a7619992123f11c809cded25b47/hosts",
-    "LogPath": "/var/lib/docker/containers/d2cc496561d6d520cbc0236b4ba88c362c446a7619992123f11c809cded25b47/d2cc496561d6d520cbc0236b4ba88c362c446a7619992123f11c809cded25b47-json.log",
-    "Name": "/adoring_wozniak",
-    "RestartCount": 0,
-    "Driver": "devicemapper",
-    "MountLabel": "",
-    "ProcessLabel": "",
-    "Mounts": [
-      {
-        "Source": "/data",
-        "Destination": "/data",
-        "Mode": "ro,Z",
-        "RW": false
-	"Propagation": ""
-      }
-    ],
-    "AppArmorProfile": "",
-    "ExecIDs": null,
-    "HostConfig": {
-        "Binds": null,
-        "ContainerIDFile": "",
-        "Memory": 0,
-        "MemorySwap": 0,
-        "CpuShares": 0,
-        "CpuPeriod": 0,
-        "CpusetCpus": "",
-        "CpusetMems": "",
-        "CpuQuota": 0,
-        "BlkioWeight": 0,
-        "OomKillDisable": false,
-        "Privileged": false,
-        "PortBindings": {},
-        "Links": null,
-        "PublishAllPorts": false,
-        "Dns": null,
-        "DnsSearch": null,
-        "DnsOptions": null,
-        "ExtraHosts": null,
-        "VolumesFrom": null,
-        "Devices": [],
-        "NetworkMode": "bridge",
-        "IpcMode": "",
-        "PidMode": "",
-        "UTSMode": "",
-        "CapAdd": null,
-        "CapDrop": null,
-        "RestartPolicy": {
-            "Name": "no",
-            "MaximumRetryCount": 0
-        },
-        "SecurityOpt": null,
-        "ReadonlyRootfs": false,
-        "Ulimits": null,
-        "LogConfig": {
-            "Type": "json-file",
-            "Config": {}
-        },
-        "CgroupParent": ""
-    },
-    "GraphDriver": {
-        "Name": "devicemapper",
-        "Data": {
-            "DeviceId": "5",
-            "DeviceName": "docker-253:1-2763198-d2cc496561d6d520cbc0236b4ba88c362c446a7619992123f11c809cded25b47",
-            "DeviceSize": "171798691840"
-        }
-    },
-    "Config": {
-        "Hostname": "d2cc496561d6",
-        "Domainname": "",
-        "User": "",
-        "AttachStdin": true,
-        "AttachStdout": true,
-        "AttachStderr": true,
-        "ExposedPorts": null,
-        "Tty": true,
-        "OpenStdin": true,
-        "StdinOnce": true,
-        "Env": null,
-        "Cmd": [
-            "bash"
-        ],
-        "Image": "fedora",
-        "Volumes": null,
-        "VolumeDriver": "",
-        "WorkingDir": "",
-        "Entrypoint": null,
-        "NetworkDisabled": false,
-        "MacAddress": "",
-        "OnBuild": null,
-        "Labels": {},
-        "Memory": 0,
-        "MemorySwap": 0,
-        "CpuShares": 0,
-        "Cpuset": "",
-        "StopSignal": "SIGTERM"
-    }
-    }
-    ]
-## Getting the IP address of a container instance
-
-To get the IP address of a container use:
-
-    $ docker inspect --format='{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' d2cc496561d6
-    172.17.0.2
-
-## Listing all port bindings
-
-One can loop over arrays and maps in the results to produce simple text
-output:
-
-    $ docker inspect --format='{{range $p, $conf := .NetworkSettings.Ports}} \
-      {{$p}} -> {{(index $conf 0).HostPort}} {{end}}' d2cc496561d6
-      80/tcp -> 80
-
-You can get more information about how to write a Go template from:
-https://golang.org/pkg/text/template/.
-
-## Getting size information on a container
-
-    $ docker inspect -s d2cc496561d6
-    [
-    {
-    ....
-    "SizeRw": 0,
-    "SizeRootFs": 972,
-    ....
-    }
-    ]
-
-## Getting information on an image
-
-Use an image's ID or name (e.g., repository/name[:tag]) to get information
-about the image:
-
-    $ docker inspect ded7cd95e059
-    [{
-    "Id": "ded7cd95e059788f2586a51c275a4f151653779d6a7f4dad77c2bd34601d94e4",
-    "Parent": "48ecf305d2cf7046c1f5f8fcbcd4994403173441d4a7f125b1bb0ceead9de731",
-    "Comment": "",
-    "Created": "2015-05-27T16:58:22.937503085Z",
-    "Container": "76cf7f67d83a7a047454b33007d03e32a8f474ad332c3a03c94537edd22b312b",
-    "ContainerConfig": {
-        "Hostname": "76cf7f67d83a",
-        "Domainname": "",
-        "User": "",
-        "AttachStdin": false,
-        "AttachStdout": false,
-        "AttachStderr": false,
-        "ExposedPorts": null,
-        "Tty": false,
-        "OpenStdin": false,
-        "StdinOnce": false,
-        "Env": null,
-        "Cmd": [
-            "/bin/sh",
-            "-c",
-            "#(nop) ADD file:4be46382bcf2b095fcb9fe8334206b584eff60bb3fad8178cbd97697fcb2ea83 in /"
-        ],
-        "Image": "48ecf305d2cf7046c1f5f8fcbcd4994403173441d4a7f125b1bb0ceead9de731",
-        "Volumes": null,
-        "VolumeDriver": "",
-        "WorkingDir": "",
-        "Entrypoint": null,
-        "NetworkDisabled": false,
-        "MacAddress": "",
-        "OnBuild": null,
-        "Labels": {}
-    },
-    "DockerVersion": "1.6.0",
-    "Author": "Lokesh Mandvekar \u003clsm5@fedoraproject.org\u003e",
-    "Config": {
-        "Hostname": "76cf7f67d83a",
-        "Domainname": "",
-        "User": "",
-        "AttachStdin": false,
-        "AttachStdout": false,
-        "AttachStderr": false,
-        "ExposedPorts": null,
-        "Tty": false,
-        "OpenStdin": false,
-        "StdinOnce": false,
-        "Env": null,
-        "Cmd": null,
-        "Image": "48ecf305d2cf7046c1f5f8fcbcd4994403173441d4a7f125b1bb0ceead9de731",
-        "Volumes": null,
-        "VolumeDriver": "",
-        "WorkingDir": "",
-        "Entrypoint": null,
-        "NetworkDisabled": false,
-        "MacAddress": "",
-        "OnBuild": null,
-        "Labels": {}
-    },
-    "Architecture": "amd64",
-    "Os": "linux",
-    "Size": 186507296,
-    "VirtualSize": 186507296,
-    "GraphDriver": {
-        "Name": "devicemapper",
-        "Data": {
-            "DeviceId": "3",
-            "DeviceName": "docker-253:1-2763198-ded7cd95e059788f2586a51c275a4f151653779d6a7f4dad77c2bd34601d94e4",
-            "DeviceSize": "171798691840"
-        }
-    }
-    }
-    ]
diff --git a/components/engine/man/src/kill.md b/components/engine/man/src/kill.md
deleted file mode 100644
index 50efbcf030..0000000000
--- a/components/engine/man/src/kill.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container kill`.
diff --git a/components/engine/man/src/load.md b/components/engine/man/src/load.md
deleted file mode 100644
index 60e77d7a0e..0000000000
--- a/components/engine/man/src/load.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker image load`.
diff --git a/components/engine/man/src/login.md b/components/engine/man/src/login.md
deleted file mode 100644
index 4d60882f5f..0000000000
--- a/components/engine/man/src/login.md
+++ /dev/null
@@ -1,22 +0,0 @@
-Log in to a Docker Registry located on the specified
-`SERVER`.  You can specify a URL or a `hostname` for the `SERVER` value. If you
-do not specify a `SERVER`, the command uses Docker's public registry located at
-`https://registry-1.docker.io/` by default.  To get a username/password for Docker's public registry, create an account on Docker Hub.
-
-`docker login` requires user to use `sudo` or be `root`, except when:
-
-1.  connecting to  a remote daemon, such as a `docker-machine` provisioned `docker engine`.
-2.  user is added to the `docker` group.  This will impact the security of your system; the `docker` group is `root` equivalent.  See [Docker Daemon Attack Surface](https://docs.docker.com/engine/security/security/#/docker-daemon-attack-surface) for details.
-
-You can log into any public or private repository for which you have
-credentials.  When you log in, the command stores encoded credentials in
-`$HOME/.docker/config.json` on Linux or `%USERPROFILE%/.docker/config.json` on Windows.
-
-# EXAMPLES
-
-## Login to a registry on your localhost
-
-    # docker login localhost:8080
-
-# See also
-**docker-logout(1)** to log out from a Docker registry.
diff --git a/components/engine/man/src/logout.md b/components/engine/man/src/logout.md
deleted file mode 100644
index 8262018038..0000000000
--- a/components/engine/man/src/logout.md
+++ /dev/null
@@ -1,13 +0,0 @@
-Log out of a Docker Registry located on the specified `SERVER`. You can
-specify a URL or a `hostname` for the `SERVER` value. If you do not specify a
-`SERVER`, the command attempts to log you out of Docker's public registry
-located at `https://registry-1.docker.io/` by default.  
-
-# EXAMPLES
-
-## Log out from a registry on your localhost
-
-    # docker logout localhost:8080
-
-# See also
-**docker-login(1)** to log in to a Docker registry server.
diff --git a/components/engine/man/src/logs.md b/components/engine/man/src/logs.md
deleted file mode 100644
index e528150e29..0000000000
--- a/components/engine/man/src/logs.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container logs`.
diff --git a/components/engine/man/src/network/connect.md b/components/engine/man/src/network/connect.md
deleted file mode 100644
index 59bcc0302b..0000000000
--- a/components/engine/man/src/network/connect.md
+++ /dev/null
@@ -1,39 +0,0 @@
-Connects a container to a network. You can connect a container by name
-or by ID. Once connected, the container can communicate with other containers in
-the same network.
-
-```bash
-$ docker network connect multi-host-network container1
-```
-
-You can also use the `docker run --network=<network-name>` option to start a container and immediately connect it to a network.
-
-```bash
-$ docker run -itd --network=multi-host-network --ip 172.20.88.22 --ip6 2001:db8::8822 busybox
-```
-You can pause, restart, and stop containers that are connected to a network.
-A container connects to its configured networks when it runs.
-
-If specified, the container's IP address(es) is reapplied when a stopped
-container is restarted. If the IP address is no longer available, the container
-fails to start. One way to guarantee that the IP address is available is
-to specify an `--ip-range` when creating the network, and choose the static IP
-address(es) from outside that range. This ensures that the IP address is not
-given to another container while this container is not on the network.
-
-```bash
-$ docker network create --subnet 172.20.0.0/16 --ip-range 172.20.240.0/20 multi-host-network
-```
-
-```bash
-$ docker network connect --ip 172.20.128.2 multi-host-network container2
-```
-
-To verify the container is connected, use the `docker network inspect` command. Use `docker network disconnect` to remove a container from the network.
-
-Once connected in network, containers can communicate using only another
-container's IP address or name. For `overlay` networks or custom plugins that
-support multi-host connectivity, containers connected to the same multi-host
-network but launched from different Engines can also communicate in this way.
-
-You can connect a container to one or more networks. The networks need not be the same type. For example, you can connect a single container bridge and overlay networks.
diff --git a/components/engine/man/src/network/create.md b/components/engine/man/src/network/create.md
deleted file mode 100644
index 6915cdd354..0000000000
--- a/components/engine/man/src/network/create.md
+++ /dev/null
@@ -1,177 +0,0 @@
-Creates a new network. The `DRIVER` accepts `bridge` or `overlay` which are the
-built-in network drivers. If you have installed a third party or your own custom
-network driver you can specify that `DRIVER` here also. If you don't specify the
-`--driver` option, the command automatically creates a `bridge` network for you.
-When you install Docker Engine it creates a `bridge` network automatically. This
-network corresponds to the `docker0` bridge that Engine has traditionally relied
-on. When launch a new container with  `docker run` it automatically connects to
-this bridge network. You cannot remove this default bridge network but you can
-create new ones using the `network create` command.
-
-```bash
-$ docker network create -d bridge my-bridge-network
-```
-
-Bridge networks are isolated networks on a single Engine installation. If you
-want to create a network that spans multiple Docker hosts each running an
-Engine, you must create an `overlay` network. Unlike `bridge` networks overlay
-networks require some pre-existing conditions before you can create one. These
-conditions are:
-
-* Access to a key-value store. Engine supports Consul, Etcd, and Zookeeper (Distributed store) key-value stores.
-* A cluster of hosts with connectivity to the key-value store.
-* A properly configured Engine `daemon` on each host in the cluster.
-
-The `dockerd` options that support the `overlay` network are:
-
-* `--cluster-store`
-* `--cluster-store-opt`
-* `--cluster-advertise`
-
-To read more about these options and how to configure them, see ["*Get started
-with multi-host
-network*"](https://docs.docker.com/engine/userguide/networking/get-started-overlay/).
-
-It is also a good idea, though not required, that you install Docker Swarm on to
-manage the cluster that makes up your network. Swarm provides sophisticated
-discovery and server management that can assist your implementation.
-
-Once you have prepared the `overlay` network prerequisites you simply choose a
-Docker host in the cluster and issue the following to create the network:
-
-```bash
-$ docker network create -d overlay my-multihost-network
-```
-
-Network names must be unique. The Docker daemon attempts to identify naming
-conflicts but this is not guaranteed. It is the user's responsibility to avoid
-name conflicts.
-
-## Connect containers
-
-When you start a container use the `--network` flag to connect it to a network.
-This adds the `busybox` container to the `mynet` network.
-
-```bash
-$ docker run -itd --network=mynet busybox
-```
-
-If you want to add a container to a network after the container is already
-running use the `docker network connect` subcommand.
-
-You can connect multiple containers to the same network. Once connected, the
-containers can communicate using only another container's IP address or name.
-For `overlay` networks or custom plugins that support multi-host connectivity,
-containers connected to the same multi-host network but launched from different
-Engines can also communicate in this way.
-
-You can disconnect a container from a network using the `docker network
-disconnect` command.
-
-## Specifying advanced options
-
-When you create a network, Engine creates a non-overlapping subnetwork for the
-network by default. This subnetwork is not a subdivision of an existing network.
-It is purely for ip-addressing purposes. You can override this default and
-specify subnetwork values directly using the `--subnet` option. On a
-`bridge` network you can only create a single subnet:
-
-```bash
-$ docker network create -d bridge --subnet=192.168.0.0/16 br0
-```
-
-Additionally, you also specify the `--gateway` `--ip-range` and `--aux-address`
-options.
-
-```bash
-$ docker network create \
-  --driver=bridge \
-  --subnet=172.28.0.0/16 \
-  --ip-range=172.28.5.0/24 \
-  --gateway=172.28.5.254 \
-  br0
-```
-
-If you omit the `--gateway` flag the Engine selects one for you from inside a
-preferred pool. For `overlay` networks and for network driver plugins that
-support it you can create multiple subnetworks.
-
-```bash
-$ docker network create -d overlay \
-  --subnet=192.168.0.0/16 \
-  --subnet=192.170.0.0/16 \
-  --gateway=192.168.0.100 \ 
-  --gateway=192.170.0.100 \
-  --ip-range=192.168.1.0/24 \
-  --aux-address="my-router=192.168.1.5" --aux-address="my-switch=192.168.1.6" \
-  --aux-address="my-printer=192.170.1.5" --aux-address="my-nas=192.170.1.6" \
-  my-multihost-network
-```
-
-Be sure that your subnetworks do not overlap. If they do, the network create
-fails and Engine returns an error.
-
-### Network internal mode
-
-By default, when you connect a container to an `overlay` network, Docker also
-connects a bridge network to it to provide external connectivity. If you want
-to create an externally isolated `overlay` network, you can specify the
-`--internal` option.
-
-### Network ingress mode
-
-You can create the network which will be used to provide the routing-mesh in the
-swarm cluster. You do so by specifying `--ingress` when creating the network. Only
-one ingress network can be created at the time. The network can be removed only
-if no services depend on it. Any option available when creating a overlay network
-is also available when creating the ingress network, besides the `--attachable` option.
-
-```bash
-$ docker network create -d overlay \
-  --subnet=10.11.0.0/16 \
-  --ingress \
-  --opt com.docker.network.mtu=9216 \
-  --opt encrypted=true \
-  my-ingress-network
-```
-
-### Run services on predefined networks
-
-You can create services on the predefined docker networks `bridge` and `host`.
-
-```bash
-$ docker service create --name my-service \
-  --network host \
-  --replicas 2 \
-  busybox top
-```
-
-### Swarm networks with local scope drivers
-
-You can create a swarm network with local scope network drivers. You do so
-by promoting the network scope to `swarm` during the creation of the network. 
-You will then be able to use this network when creating services. 
-
-```bash
-$ docker network create -d bridge \
-  --scope swarm \
-  --attachable \
-  swarm-network
-```
-
-For network drivers which provide connectivity across hosts (ex. macvlan), if
-node specific configurations are needed in order to plumb the network on each
-host, you will supply that configuration via a configuration only network.
-When you create the swarm scoped network, you will then specify the name of the 
-network which contains the configuration.
-
-
-```bash
-node1$ docker network create --config-only --subnet 192.168.100.0/24 --gateway 192.168.100.115 mv-config
-node2$ docker network create --config-only --subnet 192.168.200.0/24 --gateway 192.168.200.202 mv-config
-node1$ docker network create -d macvlan --scope swarm --config-from mv-config --attachable swarm-network
-```
-
-
-
-
diff --git a/components/engine/man/src/network/disconnect.md b/components/engine/man/src/network/disconnect.md
deleted file mode 100644
index 13943f3f8f..0000000000
--- a/components/engine/man/src/network/disconnect.md
+++ /dev/null
@@ -1,5 +0,0 @@
-Disconnects a container from a network.
-
-```bash
-$ docker network disconnect multi-host-network container1
-```
diff --git a/components/engine/man/src/network/inspect.md b/components/engine/man/src/network/inspect.md
deleted file mode 100644
index 91cb2dae32..0000000000
--- a/components/engine/man/src/network/inspect.md
+++ /dev/null
@@ -1,183 +0,0 @@
-Returns information about one or more networks. By default, this command renders all results in a JSON object. For example, if you connect two containers to the default `bridge` network:
-
-```bash
-$ sudo docker run -itd --name=container1 busybox
-f2870c98fd504370fb86e59f32cd0753b1ac9b69b7d80566ffc7192a82b3ed27
-
-$ sudo docker run -itd --name=container2 busybox
-bda12f8922785d1f160be70736f26c1e331ab8aaf8ed8d56728508f2e2fd4727
-```
-
-The `network inspect` command shows the containers, by id, in its
-results. You can specify an alternate format to execute a given
-template for each result. Go's
-[text/template](http://golang.org/pkg/text/template/) package
-describes all the details of the format.
-
-```bash
-$ sudo docker network inspect bridge
-[
-    {
-        "Name": "bridge",
-        "Id": "b2b1a2cba717161d984383fd68218cf70bbbd17d328496885f7c921333228b0f",
-        "Scope": "local",
-        "Driver": "bridge",
-        "IPAM": {
-            "Driver": "default",
-            "Config": [
-                {
-                    "Subnet": "172.17.42.1/16",
-                    "Gateway": "172.17.42.1"
-                }
-            ]
-        },
-        "Internal": false,
-        "Ingress": false,
-        "Containers": {
-            "bda12f8922785d1f160be70736f26c1e331ab8aaf8ed8d56728508f2e2fd4727": {
-                "Name": "container2",
-                "EndpointID": "0aebb8fcd2b282abe1365979536f21ee4ceaf3ed56177c628eae9f706e00e019",
-                "MacAddress": "02:42:ac:11:00:02",
-                "IPv4Address": "172.17.0.2/16",
-                "IPv6Address": ""
-            },
-            "f2870c98fd504370fb86e59f32cd0753b1ac9b69b7d80566ffc7192a82b3ed27": {
-                "Name": "container1",
-                "EndpointID": "a00676d9c91a96bbe5bcfb34f705387a33d7cc365bac1a29e4e9728df92d10ad",
-                "MacAddress": "02:42:ac:11:00:01",
-                "IPv4Address": "172.17.0.1/16",
-                "IPv6Address": ""
-            }
-        },
-        "Options": {
-            "com.docker.network.bridge.default_bridge": "true",
-            "com.docker.network.bridge.enable_icc": "true",
-            "com.docker.network.bridge.enable_ip_masquerade": "true",
-            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
-            "com.docker.network.bridge.name": "docker0",
-            "com.docker.network.driver.mtu": "1500"
-        }
-    }
-]
-```
-
-Returns the information about the user-defined network:
-
-```bash
-$ docker network create simple-network
-69568e6336d8c96bbf57869030919f7c69524f71183b44d80948bd3927c87f6a
-$ docker network inspect simple-network
-[
-    {
-        "Name": "simple-network",
-        "Id": "69568e6336d8c96bbf57869030919f7c69524f71183b44d80948bd3927c87f6a",
-        "Scope": "local",
-        "Driver": "bridge",
-        "IPAM": {
-            "Driver": "default",
-            "Config": [
-                {
-                    "Subnet": "172.22.0.0/16",
-                    "Gateway": "172.22.0.1"
-                }
-            ]
-        },
-        "Containers": {},
-        "Options": {}
-    }
-]
-```
-
-`docker network inspect --verbose` for swarm mode overlay networks shows service-specific
-details such as the service's VIP and port mappings. It also shows IPs of service tasks,
-and the IPs of the nodes where the tasks are running.
-
-Following is an example output for a overlay network `ov1` that has one service `s1`
-attached to. service `s1` in this case has three replicas.
-
-```bash
-$ docker network inspect --verbose ov1
-[
-    {
-        "Name": "ov1",
-        "Id": "ybmyjvao9vtzy3oorxbssj13b",
-        "Created": "2017-03-13T17:04:39.776106792Z",
-        "Scope": "swarm",
-        "Driver": "overlay",
-        "EnableIPv6": false,
-        "IPAM": {
-            "Driver": "default",
-            "Options": null,
-            "Config": [
-                {
-                    "Subnet": "10.0.0.0/24",
-                    "Gateway": "10.0.0.1"
-                }
-            ]
-        },
-        "Internal": false,
-        "Attachable": false,
-        "Ingress": false,
-        "Containers": {
-            "020403bd88a15f60747fd25d1ad5fa1272eb740e8a97fc547d8ad07b2f721c5e": {
-                "Name": "s1.1.pjn2ik0sfgkfzed3h0s00gs9o",
-                "EndpointID": "ad16946f416562d658f3bb30b9830d73ad91ccf6feae44411269cd0ff674714e",
-                "MacAddress": "02:42:0a:00:00:04",
-                "IPv4Address": "10.0.0.4/24",
-                "IPv6Address": ""
-            }
-        },
-        "Options": {
-            "com.docker.network.driver.overlay.vxlanid_list": "4097"
-        },
-        "Labels": {},
-        "Peers": [
-            {
-                "Name": "net-3-5d3cfd30a58c",
-                "IP": "192.168.33.13"
-            },
-            {
-                "Name": "net-1-6ecbc0040a73",
-                "IP": "192.168.33.11"
-            },
-            {
-                "Name": "net-2-fb80208efd75",
-                "IP": "192.168.33.12"
-            }
-        ],
-        "Services": {
-            "s1": {
-                "VIP": "10.0.0.2",
-                "Ports": [],
-                "LocalLBIndex": 257,
-                "Tasks": [
-                    {
-                        "Name": "s1.2.q4hcq2aiiml25ubtrtg4q1txt",
-                        "EndpointID": "040879b027e55fb658e8b60ae3b87c6cdac7d291e86a190a3b5ac6567b26511a",
-                        "EndpointIP": "10.0.0.5",
-                        "Info": {
-                            "Host IP": "192.168.33.11"
-                        }
-                    },
-                    {
-                        "Name": "s1.3.yawl4cgkp7imkfx469kn9j6lm",
-                        "EndpointID": "106edff9f120efe44068b834e1cddb5b39dd4a3af70211378b2f7a9e562bbad8",
-                        "EndpointIP": "10.0.0.3",
-                        "Info": {
-                            "Host IP": "192.168.33.12"
-                        }
-                    },
-                    {
-                        "Name": "s1.1.pjn2ik0sfgkfzed3h0s00gs9o",
-                        "EndpointID": "ad16946f416562d658f3bb30b9830d73ad91ccf6feae44411269cd0ff674714e",
-                        "EndpointIP": "10.0.0.4",
-                        "Info": {
-                            "Host IP": "192.168.33.13"
-                        }
-                    }
-                ]
-            }
-        }
-    }
-]
-```
diff --git a/components/engine/man/src/network/ls.md b/components/engine/man/src/network/ls.md
deleted file mode 100644
index 417344951a..0000000000
--- a/components/engine/man/src/network/ls.md
+++ /dev/null
@@ -1,182 +0,0 @@
-Lists all the networks the Engine `daemon` knows about. This includes the
-networks that span across multiple hosts in a cluster, for example:
-
-```bash
-    $ docker network ls
-    NETWORK ID          NAME                DRIVER          SCOPE
-    7fca4eb8c647        bridge              bridge          local
-    9f904ee27bf5        none                null            local
-    cf03ee007fb4        host                host            local
-    78b03ee04fc4        multi-host          overlay         swarm
-```
-
-Use the `--no-trunc` option to display the full network id:
-
-```bash
-$ docker network ls --no-trunc
-NETWORK ID                                                         NAME                DRIVER
-18a2866682b85619a026c81b98a5e375bd33e1b0936a26cc497c283d27bae9b3   none                null                
-c288470c46f6c8949c5f7e5099b5b7947b07eabe8d9a27d79a9cbf111adcbf47   host                host                
-7b369448dccbf865d397c8d2be0cda7cf7edc6b0945f77d2529912ae917a0185   bridge              bridge              
-95e74588f40db048e86320c6526440c504650a1ff3e9f7d60a497c4d2163e5bd   foo                 bridge    
-63d1ff1f77b07ca51070a8c227e962238358bd310bde1529cf62e6c307ade161   dev                 bridge
-```
-
-## Filtering
-
-The filtering flag (`-f` or `--filter`) format is a `key=value` pair. If there
-is more than one filter, then pass multiple flags (e.g. `--filter "foo=bar" --filter "bif=baz"`).
-Multiple filter flags are combined as an `OR` filter. For example, 
-`-f type=custom -f type=builtin` returns both `custom` and `builtin` networks.
-
-The currently supported filters are:
-
-* driver
-* id (network's id)
-* label (`label=<key>` or `label=<key>=<value>`)
-* name (network's name)
-* scope (`swarm|global|local`)
-* type (custom|builtin)
-
-#### Driver
-
-The `driver` filter matches networks based on their driver.
-
-The following example matches networks with the `bridge` driver:
-
-```bash
-$ docker network ls --filter driver=bridge
-NETWORK ID          NAME                DRIVER
-db9db329f835        test1               bridge
-f6e212da9dfd        test2               bridge
-```
-
-#### ID
-
-The `id` filter matches on all or part of a network's ID.
-
-The following filter matches all networks with an ID containing the
-`63d1ff1f77b0...` string.
-
-```bash
-$ docker network ls --filter id=63d1ff1f77b07ca51070a8c227e962238358bd310bde1529cf62e6c307ade161
-NETWORK ID          NAME                DRIVER
-63d1ff1f77b0        dev                 bridge
-```
-
-You can also filter for a substring in an ID as this shows:
-
-```bash
-$ docker network ls --filter id=95e74588f40d
-NETWORK ID          NAME                DRIVER
-95e74588f40d        foo                 bridge
-
-$ docker network ls --filter id=95e
-NETWORK ID          NAME                DRIVER
-95e74588f40d        foo                 bridge
-```
-
-#### Label
-
-The `label` filter matches networks based on the presence of a `label` alone or a `label` and a
-value.
-
-The following filter matches networks with the `usage` label regardless of its value.
-
-```bash
-$ docker network ls -f "label=usage"
-NETWORK ID          NAME                DRIVER
-db9db329f835        test1               bridge              
-f6e212da9dfd        test2               bridge
-```
-
-The following filter matches networks with the `usage` label with the `prod` value.
-
-```bash
-$ docker network ls -f "label=usage=prod"
-NETWORK ID          NAME                DRIVER
-f6e212da9dfd        test2               bridge
-```
-
-#### Name
-
-The `name` filter matches on all or part of a network's name.
-
-The following filter matches all networks with a name containing the `foobar` string.
-
-```bash
-$ docker network ls --filter name=foobar
-NETWORK ID          NAME                DRIVER
-06e7eef0a170        foobar              bridge
-```
-
-You can also filter for a substring in a name as this shows:
-
-```bash
-$ docker network ls --filter name=foo
-NETWORK ID          NAME                DRIVER
-95e74588f40d        foo                 bridge
-06e7eef0a170        foobar              bridge
-```
-
-#### Scope
-
-The `scope` filter matches networks based on their scope.
-
-The following example matches networks with the `swarm` scope:
-
-```bash
-$ docker network ls --filter scope=swarm
-NETWORK ID          NAME                DRIVER              SCOPE
-xbtm0v4f1lfh        ingress             overlay             swarm
-ic6r88twuu92        swarmnet            overlay             swarm
-```
-
-The following example matches networks with the `local` scope:
-
-```bash
-$ docker network ls --filter scope=local
-NETWORK ID          NAME                DRIVER              SCOPE
-e85227439ac7        bridge              bridge              local
-0ca0e19443ed        host                host                local
-ca13cc149a36        localnet            bridge              local
-f9e115d2de35        none                null                local
-```
-
-#### Type
-
-The `type` filter supports two values; `builtin` displays predefined networks
-(`bridge`, `none`, `host`), whereas `custom` displays user defined networks.
-
-The following filter matches all user defined networks:
-
-```bash
-$ docker network ls --filter type=custom
-NETWORK ID          NAME                DRIVER
-95e74588f40d        foo                 bridge
-63d1ff1f77b0        dev                 bridge
-```
-
-By having this flag it allows for batch cleanup. For example, use this filter
-to delete all user defined networks:
-
-```bash
-$ docker network rm `docker network ls --filter type=custom -q`
-```
-
-A warning will be issued when trying to remove a network that has containers
-attached.
-
-## Format
-
-Format uses a Go template to print the output. The following variables are 
-supported: 
-
-* .ID - Network ID
-* .Name - Network name
-* .Driver - Network driver
-* .Scope - Network scope (local, global)
-* .IPv6 - Whether IPv6 is enabled on the network or not
-* .Internal - Whether the network is internal or not
-* .Labels - All labels assigned to the network
-* .Label - Value of a specific label for this network. For example `{{.Label "project.version"}}`
diff --git a/components/engine/man/src/network/rm.md b/components/engine/man/src/network/rm.md
deleted file mode 100644
index 815b6a487b..0000000000
--- a/components/engine/man/src/network/rm.md
+++ /dev/null
@@ -1,20 +0,0 @@
-Removes one or more networks by name or identifier. To remove a network,
-you must first disconnect any containers connected to it.
-To remove the network named 'my-network':
-
-```bash
-  $ docker network rm my-network
-```
-
-To delete multiple networks in a single `docker network rm` command, provide
-multiple network names or ids. The following example deletes a network with id
-`3695c422697f` and a network named `my-network`:
-
-```bash
-  $ docker network rm 3695c422697f my-network
-```
-
-When you specify multiple networks, the command attempts to delete each in turn.
-If the deletion of one network fails, the command continues to the next on the
-list and tries to delete that. The command reports success or failure for each
-deletion.
diff --git a/components/engine/man/src/pause.md b/components/engine/man/src/pause.md
deleted file mode 100644
index 8779d0601b..0000000000
--- a/components/engine/man/src/pause.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container pause`.
diff --git a/components/engine/man/src/plugin/ls.md b/components/engine/man/src/plugin/ls.md
deleted file mode 100644
index f9f3945244..0000000000
--- a/components/engine/man/src/plugin/ls.md
+++ /dev/null
@@ -1,43 +0,0 @@
-Lists all the plugins that are currently installed. You can install plugins
-using the `docker plugin install` command.
-You can also filter using the `-f` or `--filter` flag.
-
-## Filters
-
-Filter output based on these conditions:
-   - enabled=(true|false) - plugins that are enabled or not
-   - capability=<string> - filters plugins based on capabilities (currently `volumedriver`, `networkdriver`, `ipamdriver`, or `authz`)
-
-## Format
-
-   Pretty-print plugins using a Go template.
-   Valid placeholders:
-      .ID - Plugin ID.
-      .Name - Plugin Name.
-      .Description - Plugin description.
-      .Enabled - Whether plugin is enabled or not.
-
-# EXAMPLES
-## Display all plugins
-
-    $ docker plugin ls
-    ID                  NAME                                    DESCRIPTION                         ENABLED
-    869080b57404        tiborvass/sample-volume-plugin:latest   A sample volume plugin for Docker   true
-    141bf6c02ddd        vieux/sshfs:latest                      sshFS plugin for Docker             false
-
-## Display plugins with their ID and names
-
-    $ docker plugin ls --format "{{.ID}}: {{.Name}}"
-    869080b57404: tiborvass/sample-volume-plugin:latest
-
-## Display enabled plugins
-
-    $ docker plugin ls --filter enabled=true
-    ID                  NAME                                    DESCRIPTION                         ENABLED
-    869080b57404        tiborvass/sample-volume-plugin:latest   A sample volume plugin for Docker   true
-
-## Display plugins with `volumedriver` capability
-
-    $ docker plugin ls --filter capability=volumedriver --format "table {{.ID}}\t{{.Name}}"
-    ID                  Name
-    869080b57404        tiborvass/sample-volume-plugin:latest
diff --git a/components/engine/man/src/port.md b/components/engine/man/src/port.md
deleted file mode 100644
index b540ce1776..0000000000
--- a/components/engine/man/src/port.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container port`.
diff --git a/components/engine/man/src/ps.md b/components/engine/man/src/ps.md
deleted file mode 100644
index 83f289e888..0000000000
--- a/components/engine/man/src/ps.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container ls`.
diff --git a/components/engine/man/src/pull.md b/components/engine/man/src/pull.md
deleted file mode 100644
index 78b0ab87c8..0000000000
--- a/components/engine/man/src/pull.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker image pull`.
diff --git a/components/engine/man/src/push.md b/components/engine/man/src/push.md
deleted file mode 100644
index 84f721e0b5..0000000000
--- a/components/engine/man/src/push.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker image push`.
diff --git a/components/engine/man/src/rename.md b/components/engine/man/src/rename.md
deleted file mode 100644
index 7a237f42ff..0000000000
--- a/components/engine/man/src/rename.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container rename`.
diff --git a/components/engine/man/src/restart.md b/components/engine/man/src/restart.md
deleted file mode 100644
index eddad06b69..0000000000
--- a/components/engine/man/src/restart.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container restart`.
diff --git a/components/engine/man/src/rm.md b/components/engine/man/src/rm.md
deleted file mode 100644
index 8b0cbd658e..0000000000
--- a/components/engine/man/src/rm.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container rm`.
diff --git a/components/engine/man/src/rmi.md b/components/engine/man/src/rmi.md
deleted file mode 100644
index b77750493d..0000000000
--- a/components/engine/man/src/rmi.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker image rm`.
diff --git a/components/engine/man/src/save.md b/components/engine/man/src/save.md
deleted file mode 100644
index 95127f5a45..0000000000
--- a/components/engine/man/src/save.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker image save`.
diff --git a/components/engine/man/src/search.md b/components/engine/man/src/search.md
deleted file mode 100644
index cf2ac4f1a9..0000000000
--- a/components/engine/man/src/search.md
+++ /dev/null
@@ -1,36 +0,0 @@
-Search Docker Hub for images that match the specified `TERM`. The table
-of images returned displays the name, description (truncated by default), number
-of stars awarded, whether the image is official, and whether it is automated.
-
-*Note* - Search queries will only return up to 25 results
-
-## Filter
-
-   Filter output based on these conditions:
-   - stars=<numberOfStar>
-   - is-automated=(true|false)
-   - is-official=(true|false)
-
-# EXAMPLES
-
-## Search Docker Hub for ranked images
-
-Search a registry for the term 'fedora' and only display those images
-ranked 3 or higher:
-
-    $ docker search --filter=stars=3 fedora
-    NAME                  DESCRIPTION                                    STARS OFFICIAL  AUTOMATED
-    mattdm/fedora         A basic Fedora image corresponding roughly...  50
-    fedora                (Semi) Official Fedora base image.             38
-    mattdm/fedora-small   A small Fedora image on which to build. Co...  8
-    goldmann/wildfly      A WildFly application server running on a ...  3               [OK]
-
-## Search Docker Hub for automated images
-
-Search Docker Hub for the term 'fedora' and only display automated images
-ranked 1 or higher:
-
-    $ docker search --filter=is-automated=true --filter=stars=1 fedora
-    NAME               DESCRIPTION                                     STARS OFFICIAL  AUTOMATED
-    goldmann/wildfly   A WildFly application server running on a ...   3               [OK]
-    tutum/fedora-20    Fedora 20 image with SSH access. For the r...   1               [OK]
diff --git a/components/engine/man/src/start.md b/components/engine/man/src/start.md
deleted file mode 100644
index 9bab867704..0000000000
--- a/components/engine/man/src/start.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container start`.
diff --git a/components/engine/man/src/stats.md b/components/engine/man/src/stats.md
deleted file mode 100644
index f709ce4f18..0000000000
--- a/components/engine/man/src/stats.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container stats`.
diff --git a/components/engine/man/src/stop.md b/components/engine/man/src/stop.md
deleted file mode 100644
index 35fd07b62e..0000000000
--- a/components/engine/man/src/stop.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container stop`.
diff --git a/components/engine/man/src/system/events.md b/components/engine/man/src/system/events.md
deleted file mode 100644
index 44adc6c397..0000000000
--- a/components/engine/man/src/system/events.md
+++ /dev/null
@@ -1,134 +0,0 @@
-Get event information from the Docker daemon. Information can include historical
-information and real-time information.
-
-Docker containers will report the following events:
-
-    attach, commit, copy, create, destroy, detach, die, exec_create, exec_detach, exec_start, export, kill, oom, pause, rename, resize, restart, start, stop, top, unpause, update
-
-Docker images report the following events:
-
-    delete, import, load, pull, push, save, tag, untag
-
-Docker volumes report the following events:
-
-    create, mount, unmount, destroy
-
-Docker networks report the following events:
-
-    create, connect, disconnect, destroy
-
-# OPTIONS
-
-The `--since` and `--until` parameters can be Unix timestamps, date formatted
-timestamps, or Go duration strings (e.g. `10m`, `1h30m`) computed
-relative to the client machine's time. If you do not provide the `--since` option,
-the command returns only new and/or live events.  Supported formats for date
-formatted time stamps include RFC3339Nano, RFC3339, `2006-01-02T15:04:05`,
-`2006-01-02T15:04:05.999999999`, `2006-01-02Z07:00`, and `2006-01-02`. The local
-timezone on the client will be used if you do not provide either a `Z` or a
-`+-00:00` timezone offset at the end of the timestamp.  When providing Unix
-timestamps enter seconds[.nanoseconds], where seconds is the number of seconds
-that have elapsed since January 1, 1970 (midnight UTC/GMT), not counting leap
-seconds (aka Unix epoch or Unix time), and the optional .nanoseconds field is a
-fraction of a second no more than nine digits long.
-
-# EXAMPLES
-
-## Listening for Docker events
-
-After running docker events a container 786d698004576 is started and stopped
-(The container name has been shortened in the output below):
-
-    # docker events
-    2015-01-28T20:21:31.000000000-08:00 59211849bc10: (from whenry/testimage:latest) start
-    2015-01-28T20:21:31.000000000-08:00 59211849bc10: (from whenry/testimage:latest) die
-    2015-01-28T20:21:32.000000000-08:00 59211849bc10: (from whenry/testimage:latest) stop
-
-## Listening for events since a given date
-Again the output container IDs have been shortened for the purposes of this document:
-
-    # docker events --since '2015-01-28'
-    2015-01-28T20:25:38.000000000-08:00 c21f6c22ba27: (from whenry/testimage:latest) create
-    2015-01-28T20:25:38.000000000-08:00 c21f6c22ba27: (from whenry/testimage:latest) start
-    2015-01-28T20:25:39.000000000-08:00 c21f6c22ba27: (from whenry/testimage:latest) create
-    2015-01-28T20:25:39.000000000-08:00 c21f6c22ba27: (from whenry/testimage:latest) start
-    2015-01-28T20:25:40.000000000-08:00 c21f6c22ba27: (from whenry/testimage:latest) die
-    2015-01-28T20:25:42.000000000-08:00 c21f6c22ba27: (from whenry/testimage:latest) stop
-    2015-01-28T20:25:45.000000000-08:00 c21f6c22ba27: (from whenry/testimage:latest) start
-    2015-01-28T20:25:45.000000000-08:00 c21f6c22ba27: (from whenry/testimage:latest) die
-    2015-01-28T20:25:46.000000000-08:00 c21f6c22ba27: (from whenry/testimage:latest) stop
-
-The following example outputs all events that were generated in the last 3 minutes,
-relative to the current time on the client machine:
-
-    # docker events --since '3m'
-    2015-05-12T11:51:30.999999999Z07:00  4386fb97867d: (from ubuntu-1:14.04) die
-    2015-05-12T15:52:12.999999999Z07:00  4386fb97867d: (from ubuntu-1:14.04) stop
-    2015-05-12T15:53:45.999999999Z07:00  7805c1d35632: (from redis:2.8) die
-    2015-05-12T15:54:03.999999999Z07:00  7805c1d35632: (from redis:2.8) stop
-
-If you do not provide the --since option, the command returns only new and/or
-live events.
-
-## Format
-
-If a format (`--format`) is specified, the given template will be executed
-instead of the default format. Go's **text/template** package describes all the
-details of the format.
-
-    # docker events --filter 'type=container' --format 'Type={{.Type}}  Status={{.Status}}  ID={{.ID}}'
-    Type=container  Status=create  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-    Type=container  Status=attach  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-    Type=container  Status=start  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-    Type=container  Status=resize  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-    Type=container  Status=die  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-    Type=container  Status=destroy  ID=2ee349dac409e97974ce8d01b70d250b85e0ba8189299c126a87812311951e26
-
-If a format is set to `{{json .}}`, the events are streamed as valid JSON
-Lines. For information about JSON Lines, please refer to http://jsonlines.org/ .
-
-    # docker events --format '{{json .}}'
-    {"status":"create","id":"196016a57679bf42424484918746a9474cd905dd993c4d0f4..
-    {"status":"attach","id":"196016a57679bf42424484918746a9474cd905dd993c4d0f4..
-    {"Type":"network","Action":"connect","Actor":{"ID":"1b50a5bf755f6021dfa78e..
-    {"status":"start","id":"196016a57679bf42424484918746a9474cd905dd993c4d0f42..
-    {"status":"resize","id":"196016a57679bf42424484918746a9474cd905dd993c4d0f4..
-
-## Filters
-
-    $ docker events --filter 'event=stop'
-    2014-05-10T17:42:14.999999999Z07:00 container stop 4386fb97867d (image=ubuntu-1:14.04)
-    2014-09-03T17:42:14.999999999Z07:00 container stop 7805c1d35632 (image=redis:2.8)
-
-    $ docker events --filter 'image=ubuntu-1:14.04'
-    2014-05-10T17:42:14.999999999Z07:00 container start 4386fb97867d (image=ubuntu-1:14.04)
-    2014-05-10T17:42:14.999999999Z07:00 container die 4386fb97867d (image=ubuntu-1:14.04)
-    2014-05-10T17:42:14.999999999Z07:00 container stop 4386fb97867d (image=ubuntu-1:14.04)
-
-    $ docker events --filter 'container=7805c1d35632'
-    2014-05-10T17:42:14.999999999Z07:00 container die 7805c1d35632 (image=redis:2.8)
-    2014-09-03T15:49:29.999999999Z07:00 container stop 7805c1d35632 (image= redis:2.8)
-
-    $ docker events --filter 'container=7805c1d35632' --filter 'container=4386fb97867d'
-    2014-09-03T15:49:29.999999999Z07:00 container die 4386fb97867d (image=ubuntu-1:14.04)
-    2014-05-10T17:42:14.999999999Z07:00 container stop 4386fb97867d (image=ubuntu-1:14.04)
-    2014-05-10T17:42:14.999999999Z07:00 container die 7805c1d35632 (image=redis:2.8)
-    2014-09-03T15:49:29.999999999Z07:00 container stop 7805c1d35632 (image=redis:2.8)
-
-    $ docker events --filter 'container=7805c1d35632' --filter 'event=stop'
-    2014-09-03T15:49:29.999999999Z07:00 container stop 7805c1d35632 (image=redis:2.8)
-
-    $ docker events --filter 'type=volume'
-    2015-12-23T21:05:28.136212689Z volume create test-event-volume-local (driver=local)
-    2015-12-23T21:05:28.383462717Z volume mount test-event-volume-local (read/write=true, container=562fe10671e9273da25eed36cdce26159085ac7ee6707105fd534866340a5025, destination=/foo, driver=local, propagation=rprivate)
-    2015-12-23T21:05:28.650314265Z volume unmount test-event-volume-local (container=562fe10671e9273da25eed36cdce26159085ac7ee6707105fd534866340a5025, driver=local)
-    2015-12-23T21:05:28.716218405Z volume destroy test-event-volume-local (driver=local)
-
-    $ docker events --filter 'type=network'
-    2015-12-23T21:38:24.705709133Z network create 8b111217944ba0ba844a65b13efcd57dc494932ee2527577758f939315ba2c5b (name=test-event-network-local, type=bridge)
-    2015-12-23T21:38:25.119625123Z network connect 8b111217944ba0ba844a65b13efcd57dc494932ee2527577758f939315ba2c5b (name=test-event-network-local, container=b4be644031a3d90b400f88ab3d4bdf4dc23adb250e696b6328b85441abe2c54e, type=bridge)
-
-    $ docker events --filter 'type=plugin' (experimental)
-    2016-07-25T17:30:14.825557616Z plugin pull ec7b87f2ce84330fe076e666f17dfc049d2d7ae0b8190763de94e1f2d105993f (name=tiborvass/sample-volume-plugin:latest)
-    2016-07-25T17:30:14.888127370Z plugin enable ec7b87f2ce84330fe076e666f17dfc049d2d7ae0b8190763de94e1f2d105993f (name=tiborvass/sample-volume-plugin:latest)
-
diff --git a/components/engine/man/src/system/info.md b/components/engine/man/src/system/info.md
deleted file mode 100644
index 9a87e985ed..0000000000
--- a/components/engine/man/src/system/info.md
+++ /dev/null
@@ -1,163 +0,0 @@
-This command displays system wide information regarding the Docker installation.
-Information displayed includes the kernel version, number of containers and images.
-The number of images shown is the number of unique images. The same image tagged
-under different names is counted only once.
-
-If a format is specified, the given template will be executed instead of the
-default format. Go's **text/template** package
-describes all the details of the format.
-
-Depending on the storage driver in use, additional information can be shown, such
-as pool name, data file, metadata file, data space used, total data space, metadata
-space used, and total metadata space.
-
-The data file is where the images are stored and the metadata file is where the
-meta data regarding those images are stored. When run for the first time Docker
-allocates a certain amount of data space and meta data space from the space
-available on the volume where `/var/lib/docker` is mounted.
-
-# EXAMPLES
-
-## Display Docker system information
-
-Here is a sample output for a daemon running on Ubuntu, using the overlay2
-storage driver:
-
-    $ docker -D info
-    Containers: 14
-     Running: 3
-     Paused: 1
-     Stopped: 10
-    Images: 52
-    Server Version: 1.13.0
-    Storage Driver: overlay2
-     Backing Filesystem: extfs
-     Supports d_type: true
-     Native Overlay Diff: false
-    Logging Driver: json-file
-    Cgroup Driver: cgroupfs
-    Plugins:
-     Volume: local
-     Network: bridge host macvlan null overlay
-    Swarm: active
-     NodeID: rdjq45w1op418waxlairloqbm
-     Is Manager: true
-     ClusterID: te8kdyw33n36fqiz74bfjeixd
-     Managers: 1
-     Nodes: 2
-     Orchestration:
-      Task History Retention Limit: 5
-     Raft:
-      Snapshot Interval: 10000
-      Number of Old Snapshots to Retain: 0
-      Heartbeat Tick: 1
-      Election Tick: 3
-     Dispatcher:
-      Heartbeat Period: 5 seconds
-     CA Configuration:
-      Expiry Duration: 3 months
-     Node Address: 172.16.66.128 172.16.66.129
-     Manager Addresses:
-      172.16.66.128:2477
-    Runtimes: runc
-    Default Runtime: runc
-    Init Binary: docker-init
-    containerd version: 8517738ba4b82aff5662c97ca4627e7e4d03b531
-    runc version: ac031b5bf1cc92239461125f4c1ffb760522bbf2
-    init version: N/A (expected: v0.13.0)
-    Security Options:
-     apparmor
-     seccomp
-      Profile: default
-    Kernel Version: 4.4.0-31-generic
-    Operating System: Ubuntu 16.04.1 LTS
-    OSType: linux
-    Architecture: x86_64
-    CPUs: 2
-    Total Memory: 1.937 GiB
-    Name: ubuntu
-    ID: H52R:7ZR6:EIIA:76JG:ORIY:BVKF:GSFU:HNPG:B5MK:APSC:SZ3Q:N326
-    Docker Root Dir: /var/lib/docker
-    Debug Mode (client): true
-    Debug Mode (server): true
-     File Descriptors: 30
-     Goroutines: 123
-     System Time: 2016-11-12T17:24:37.955404361-08:00
-     EventsListeners: 0
-    Http Proxy: http://test:test@proxy.example.com:8080
-    Https Proxy: https://test:test@proxy.example.com:8080
-    No Proxy: localhost,127.0.0.1,docker-registry.somecorporation.com
-    Registry: https://index.docker.io/v1/
-    WARNING: No swap limit support
-    Labels:
-     storage=ssd
-     staging=true
-    Experimental: false
-    Insecure Registries:
-     127.0.0.0/8
-    Registry Mirrors:
-      http://192.168.1.2/
-      http://registry-mirror.example.com:5000/
-    Live Restore Enabled: false
-
-
-
-The global `-D` option tells all `docker` commands to output debug information.
-
-The example below shows the output for a daemon running on Red Hat Enterprise Linux,
-using the devicemapper storage driver. As can be seen in the output, additional
-information about the devicemapper storage driver is shown:
-
-    $ docker info
-    Containers: 14
-     Running: 3
-     Paused: 1
-     Stopped: 10
-    Untagged Images: 52
-    Server Version: 1.10.3
-    Storage Driver: devicemapper
-     Pool Name: docker-202:2-25583803-pool
-     Pool Blocksize: 65.54 kB
-     Base Device Size: 10.74 GB
-     Backing Filesystem: xfs
-     Data file: /dev/loop0
-     Metadata file: /dev/loop1
-     Data Space Used: 1.68 GB
-     Data Space Total: 107.4 GB
-     Data Space Available: 7.548 GB
-     Metadata Space Used: 2.322 MB
-     Metadata Space Total: 2.147 GB
-     Metadata Space Available: 2.145 GB
-     Udev Sync Supported: true
-     Deferred Removal Enabled: false
-     Deferred Deletion Enabled: false
-     Deferred Deleted Device Count: 0
-     Data loop file: /var/lib/docker/devicemapper/devicemapper/data
-     Metadata loop file: /var/lib/docker/devicemapper/devicemapper/metadata
-     Library Version: 1.02.107-RHEL7 (2015-12-01)
-    Execution Driver: native-0.2
-    Logging Driver: json-file
-    Plugins:
-     Volume: local
-     Network: null host bridge
-    Kernel Version: 3.10.0-327.el7.x86_64
-    Operating System: Red Hat Enterprise Linux Server 7.2 (Maipo)
-    OSType: linux
-    Architecture: x86_64
-    CPUs: 1
-    Total Memory: 991.7 MiB
-    Name: ip-172-30-0-91.ec2.internal
-    ID: I54V:OLXT:HVMM:TPKO:JPHQ:CQCD:JNLC:O3BZ:4ZVJ:43XJ:PFHZ:6N2S
-    Docker Root Dir: /var/lib/docker
-    Debug mode (client): false
-    Debug mode (server): false
-    Username: gordontheturtle
-    Registry: https://index.docker.io/v1/
-    Insecure registries:
-     myinsecurehost:5000
-     127.0.0.0/8
-
-You can also specify the output format:
-
-    $ docker info --format '{{json .}}'
-	{"ID":"I54V:OLXT:HVMM:TPKO:JPHQ:CQCD:JNLC:O3BZ:4ZVJ:43XJ:PFHZ:6N2S","Containers":14, ...}
diff --git a/components/engine/man/src/tag.md b/components/engine/man/src/tag.md
deleted file mode 100644
index 55c4ef1a79..0000000000
--- a/components/engine/man/src/tag.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker image tag`.
diff --git a/components/engine/man/src/top.md b/components/engine/man/src/top.md
deleted file mode 100644
index ac0f0845f4..0000000000
--- a/components/engine/man/src/top.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container top`.
diff --git a/components/engine/man/src/unpause.md b/components/engine/man/src/unpause.md
deleted file mode 100644
index df538e135b..0000000000
--- a/components/engine/man/src/unpause.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container unpause`.
diff --git a/components/engine/man/src/update.md b/components/engine/man/src/update.md
deleted file mode 100644
index 162022ab29..0000000000
--- a/components/engine/man/src/update.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container update`.
diff --git a/components/engine/man/src/version.md b/components/engine/man/src/version.md
deleted file mode 100644
index 5dea4a297c..0000000000
--- a/components/engine/man/src/version.md
+++ /dev/null
@@ -1,37 +0,0 @@
-This command displays version information for both the Docker client and 
-daemon. 
-
-# EXAMPLES
-
-## Display Docker version information
-
-The default output:
-
-    $ docker version
-	Client:
-	 Version:      1.8.0
-	 API version:  1.20
-	 Go version:   go1.4.2
-	 Git commit:   f5bae0a
-	 Built:        Tue Jun 23 17:56:00 UTC 2015
-	 OS/Arch:      linux/amd64
-
-	Server:
-	 Version:      1.8.0
-	 API version:  1.20
-	 Go version:   go1.4.2
-	 Git commit:   f5bae0a
-	 Built:        Tue Jun 23 17:56:00 UTC 2015
-	 OS/Arch:      linux/amd64
-
-Get server version:
-
-    $ docker version --format '{{.Server.Version}}'
-	1.8.0
-
-Dump raw data:
-
-To view all available fields, you can use the format `{{json .}}`.
-
-    $ docker version --format '{{json .}}'
-    {"Client":{"Version":"1.8.0","ApiVersion":"1.20","GitCommit":"f5bae0a","GoVersion":"go1.4.2","Os":"linux","Arch":"amd64","BuildTime":"Tue Jun 23 17:56:00 UTC 2015"},"ServerOK":true,"Server":{"Version":"1.8.0","ApiVersion":"1.20","GitCommit":"f5bae0a","GoVersion":"go1.4.2","Os":"linux","Arch":"amd64","KernelVersion":"3.13.2-gentoo","BuildTime":"Tue Jun 23 17:56:00 UTC 2015"}}
diff --git a/components/engine/man/src/volume.md b/components/engine/man/src/volume.md
deleted file mode 100644
index 0a09a41da3..0000000000
--- a/components/engine/man/src/volume.md
+++ /dev/null
@@ -1,14 +0,0 @@
-The `docker volume` command has subcommands for managing data volumes. A data
-volume is a specially-designated directory that by-passes storage driver
-management.
-
-Data volumes persist data independent of a container's life cycle. When you
-delete a container, the Docker daemon does not delete any data volumes. You can
-share volumes across multiple containers. Moreover, you can share data volumes
-with other computing resources in your system.
-
-To see help for a subcommand, use:
-
-    docker volume COMMAND --help
-
-For full details on using docker volume visit Docker's online documentation.
diff --git a/components/engine/man/src/volume/create.md b/components/engine/man/src/volume/create.md
deleted file mode 100644
index 408079d62d..0000000000
--- a/components/engine/man/src/volume/create.md
+++ /dev/null
@@ -1,35 +0,0 @@
-Creates a new volume that containers can consume and store data in. If a name
-is not specified, Docker generates a random name. You create a volume and then
-configure the container to use it, for example:
-
-    $ docker volume create hello
-    hello
-    $ docker run -d -v hello:/world busybox ls /world
-
-The mount is created inside the container's `/src` directory. Docker doesn't
-not support relative paths for mount points inside the container.
-
-Multiple containers can use the same volume in the same time period. This is
-useful if two containers need access to shared data. For example, if one
-container writes and the other reads the data.
-
-## Driver specific options
-
-Some volume drivers may take options to customize the volume creation. Use the
-`-o` or `--opt` flags to pass driver options:
-
-    $ docker volume create --driver fake --opt tardis=blue --opt timey=wimey
-
-These options are passed directly to the volume driver. Options for different
-volume drivers may do different things (or nothing at all).
-
-The built-in `local` driver on Windows does not support any options.
-
-The built-in `local` driver on Linux accepts options similar to the linux
-`mount` command:
-
-    $ docker volume create --driver local --opt type=tmpfs --opt device=tmpfs --opt o=size=100m,uid=1000
-
-Another example:
-
-    $ docker volume create --driver local --opt type=btrfs --opt device=/dev/sda2
diff --git a/components/engine/man/src/volume/inspect.md b/components/engine/man/src/volume/inspect.md
deleted file mode 100644
index 0885caab63..0000000000
--- a/components/engine/man/src/volume/inspect.md
+++ /dev/null
@@ -1,4 +0,0 @@
-Returns information about one or more volumes. By default, this command renders
-all results in a JSON array. You can specify an alternate format to execute a
-given template is executed for each result. Go's https://golang.org/pkg/text/template/
-package describes all the details of the format.
diff --git a/components/engine/man/src/volume/ls.md b/components/engine/man/src/volume/ls.md
deleted file mode 100644
index 597884278f..0000000000
--- a/components/engine/man/src/volume/ls.md
+++ /dev/null
@@ -1,11 +0,0 @@
-Lists all the volumes Docker manages. You can filter using the `-f` or
-`--filter` flag. The filtering format is a `key=value` pair. To specify
-more than one filter,  pass multiple flags (for example,
-`--filter "foo=bar" --filter "bif=baz"`)
-
-The currently supported filters are:
-
-* `dangling` (boolean - `true` or `false`, `1` or `0`)
-* `driver` (a volume driver's name)
-* `label` (`label=<key>` or `label=<key>=<value>`)
-* `name` (a volume's name)
diff --git a/components/engine/man/src/wait.md b/components/engine/man/src/wait.md
deleted file mode 100644
index 8700848ec7..0000000000
--- a/components/engine/man/src/wait.md
+++ /dev/null
@@ -1 +0,0 @@
-Alias for `docker container wait`.
diff --git a/components/engine/migrate/v1/migratev1_test.go b/components/engine/migrate/v1/migratev1_test.go
index 55898f12b4..51b6741226 100644
--- a/components/engine/migrate/v1/migratev1_test.go
+++ b/components/engine/migrate/v1/migratev1_test.go
@@ -94,7 +94,7 @@ func TestMigrateContainers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	is, err := image.NewImageStore(ifs, ls)
+	is, err := image.NewImageStore(ifs, runtime.GOOS, ls)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -172,12 +172,12 @@ func TestMigrateImages(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	is, err := image.NewImageStore(ifs, ls)
+	is, err := image.NewImageStore(ifs, runtime.GOOS, ls)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	ms, err := metadata.NewFSMetadataStore(filepath.Join(tmpdir, "distribution"))
+	ms, err := metadata.NewFSMetadataStore(filepath.Join(tmpdir, "distribution"), runtime.GOOS)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -433,6 +433,10 @@ func (l *mockLayer) DiffSize() (int64, error) {
 	return 0, nil
 }
 
+func (l *mockLayer) Platform() layer.Platform {
+	return ""
+}
+
 func (l *mockLayer) Metadata() (map[string]string, error) {
 	return nil, nil
 }
diff --git a/components/engine/oci/defaults_linux.go b/components/engine/oci/defaults.go
similarity index 75%
rename from components/engine/oci/defaults_linux.go
rename to components/engine/oci/defaults.go
index c1ff931c22..4376faf5a7 100644
--- a/components/engine/oci/defaults_linux.go
+++ b/components/engine/oci/defaults.go
@@ -30,14 +30,55 @@ func defaultCapabilities() []string {
 	}
 }
 
-// DefaultSpec returns default oci spec used by docker.
+// DefaultSpec returns the default spec used by docker for the current Platform
 func DefaultSpec() specs.Spec {
-	s := specs.Spec{
+	return DefaultOSSpec(runtime.GOOS)
+}
+
+// DefaultOSSpec returns the spec for a given OS
+func DefaultOSSpec(osName string) specs.Spec {
+	if osName == "windows" {
+		return DefaultWindowsSpec()
+	} else if osName == "solaris" {
+		return DefaultSolarisSpec()
+	} else {
+		return DefaultLinuxSpec()
+	}
+}
+
+// DefaultWindowsSpec create a default spec for running Windows containers
+func DefaultWindowsSpec() specs.Spec {
+	return specs.Spec{
 		Version: specs.Version,
 		Platform: specs.Platform{
 			OS:   runtime.GOOS,
 			Arch: runtime.GOARCH,
 		},
+		Windows: &specs.Windows{},
+	}
+}
+
+// DefaultSolarisSpec create a default spec for running Solaris containers
+func DefaultSolarisSpec() specs.Spec {
+	s := specs.Spec{
+		Version: "0.6.0",
+		Platform: specs.Platform{
+			OS:   "SunOS",
+			Arch: runtime.GOARCH,
+		},
+	}
+	s.Solaris = &specs.Solaris{}
+	return s
+}
+
+// DefaultLinuxSpec create a default spec for running Linux containers
+func DefaultLinuxSpec() specs.Spec {
+	s := specs.Spec{
+		Version: specs.Version,
+		Platform: specs.Platform{
+			OS:   "linux",
+			Arch: runtime.GOARCH,
+		},
 	}
 	s.Mounts = []specs.Mount{
 		{
@@ -91,7 +132,6 @@ func DefaultSpec() specs.Spec {
 			"/proc/timer_list",
 			"/proc/timer_stats",
 			"/proc/sched_debug",
-			"/sys/firmware",
 		},
 		ReadonlyPaths: []string{
 			"/proc/asound",
@@ -172,5 +212,10 @@ func DefaultSpec() specs.Spec {
 		},
 	}
 
+	// For LCOW support, don't mask /sys/firmware
+	if runtime.GOOS != "windows" {
+		s.Linux.MaskedPaths = append(s.Linux.MaskedPaths, "/sys/firmware")
+	}
+
 	return s
 }
diff --git a/components/engine/oci/defaults_solaris.go b/components/engine/oci/defaults_solaris.go
deleted file mode 100644
index 85c8b68e16..0000000000
--- a/components/engine/oci/defaults_solaris.go
+++ /dev/null
@@ -1,20 +0,0 @@
-package oci
-
-import (
-	"runtime"
-
-	"github.com/opencontainers/runtime-spec/specs-go"
-)
-
-// DefaultSpec returns default oci spec used by docker.
-func DefaultSpec() specs.Spec {
-	s := specs.Spec{
-		Version: "0.6.0",
-		Platform: specs.Platform{
-			OS:   "SunOS",
-			Arch: runtime.GOARCH,
-		},
-	}
-	s.Solaris = &specs.Solaris{}
-	return s
-}
diff --git a/components/engine/oci/defaults_windows.go b/components/engine/oci/defaults_windows.go
deleted file mode 100644
index ab51904ec4..0000000000
--- a/components/engine/oci/defaults_windows.go
+++ /dev/null
@@ -1,19 +0,0 @@
-package oci
-
-import (
-	"runtime"
-
-	"github.com/opencontainers/runtime-spec/specs-go"
-)
-
-// DefaultSpec returns default spec used by docker.
-func DefaultSpec() specs.Spec {
-	return specs.Spec{
-		Version: specs.Version,
-		Platform: specs.Platform{
-			OS:   runtime.GOOS,
-			Arch: runtime.GOARCH,
-		},
-		Windows: &specs.Windows{},
-	}
-}
diff --git a/components/engine/opts/ulimit.go b/components/engine/opts/ulimit.go
index 5adfe30851..a2a65fcd21 100644
--- a/components/engine/opts/ulimit.go
+++ b/components/engine/opts/ulimit.go
@@ -55,3 +55,27 @@ func (o *UlimitOpt) GetList() []*units.Ulimit {
 func (o *UlimitOpt) Type() string {
 	return "ulimit"
 }
+
+// NamedUlimitOpt defines a named map of Ulimits
+type NamedUlimitOpt struct {
+	name string
+	UlimitOpt
+}
+
+var _ NamedOption = &NamedUlimitOpt{}
+
+// NewNamedUlimitOpt creates a new NamedUlimitOpt
+func NewNamedUlimitOpt(name string, ref *map[string]*units.Ulimit) *NamedUlimitOpt {
+	if ref == nil {
+		ref = &map[string]*units.Ulimit{}
+	}
+	return &NamedUlimitOpt{
+		name:      name,
+		UlimitOpt: *NewUlimitOpt(ref),
+	}
+}
+
+// Name returns the option name
+func (o *NamedUlimitOpt) Name() string {
+	return o.name
+}
diff --git a/components/engine/pkg/archive/archive.go b/components/engine/pkg/archive/archive.go
index 30b3c5b36f..c6ad7c58a8 100644
--- a/components/engine/pkg/archive/archive.go
+++ b/components/engine/pkg/archive/archive.go
@@ -6,7 +6,6 @@ import (
 	"bytes"
 	"compress/bzip2"
 	"compress/gzip"
-	"errors"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -31,10 +30,6 @@ type (
 	Compression int
 	// WhiteoutFormat is the format of whiteouts unpacked
 	WhiteoutFormat int
-	// TarChownOptions wraps the chown options UID and GID.
-	TarChownOptions struct {
-		UID, GID int
-	}
 
 	// TarOptions wraps the tar options.
 	TarOptions struct {
@@ -44,7 +39,7 @@ type (
 		NoLchown         bool
 		UIDMaps          []idtools.IDMap
 		GIDMaps          []idtools.IDMap
-		ChownOpts        *TarChownOptions
+		ChownOpts        *idtools.IDPair
 		IncludeSourceDir bool
 		// WhiteoutFormat is the expected on disk format for whiteout files.
 		// This format will be converted to the standard format on pack
@@ -58,33 +53,26 @@ type (
 		RebaseNames map[string]string
 		InUserNS    bool
 	}
-
-	// Archiver allows the reuse of most utility functions of this package
-	// with a pluggable Untar function. Also, to facilitate the passing of
-	// specific id mappings for untar, an archiver can be created with maps
-	// which will then be passed to Untar operations
-	Archiver struct {
-		Untar   func(io.Reader, string, *TarOptions) error
-		UIDMaps []idtools.IDMap
-		GIDMaps []idtools.IDMap
-	}
-
-	// breakoutError is used to differentiate errors related to breaking out
-	// When testing archive breakout in the unit tests, this error is expected
-	// in order for the test to pass.
-	breakoutError error
 )
 
-var (
-	// ErrNotImplemented is the error message of function not implemented.
-	ErrNotImplemented = errors.New("Function not implemented")
-	defaultArchiver   = &Archiver{Untar: Untar, UIDMaps: nil, GIDMaps: nil}
-)
+// Archiver allows the reuse of most utility functions of this package
+// with a pluggable Untar function. Also, to facilitate the passing of
+// specific id mappings for untar, an archiver can be created with maps
+// which will then be passed to Untar operations
+type Archiver struct {
+	Untar      func(io.Reader, string, *TarOptions) error
+	IDMappings *idtools.IDMappings
+}
 
-const (
-	// HeaderSize is the size in bytes of a tar header
-	HeaderSize = 512
-)
+// NewDefaultArchiver returns a new Archiver without any IDMappings
+func NewDefaultArchiver() *Archiver {
+	return &Archiver{Untar: Untar, IDMappings: &idtools.IDMappings{}}
+}
+
+// breakoutError is used to differentiate errors related to breaking out
+// When testing archive breakout in the unit tests, this error is expected
+// in order for the test to pass.
+type breakoutError error
 
 const (
 	// Uncompressed represents the uncompressed.
@@ -105,18 +93,6 @@ const (
 	OverlayWhiteoutFormat
 )
 
-// IsArchive checks for the magic bytes of a tar or any supported compression
-// algorithm.
-func IsArchive(header []byte) bool {
-	compression := DetectCompression(header)
-	if compression != Uncompressed {
-		return true
-	}
-	r := tar.NewReader(bytes.NewBuffer(header))
-	_, err := r.Next()
-	return err == nil
-}
-
 // IsArchivePath checks if the (possibly compressed) file at the given path
 // starts with a tar file header.
 func IsArchivePath(path string) bool {
@@ -329,15 +305,7 @@ func (compression *Compression) Extension() string {
 
 // FileInfoHeader creates a populated Header from fi.
 // Compared to archive pkg this function fills in more information.
-func FileInfoHeader(path, name string, fi os.FileInfo) (*tar.Header, error) {
-	var link string
-	if fi.Mode()&os.ModeSymlink != 0 {
-		var err error
-		link, err = os.Readlink(path)
-		if err != nil {
-			return nil, err
-		}
-	}
+func FileInfoHeader(name string, fi os.FileInfo, link string) (*tar.Header, error) {
 	hdr, err := tar.FileInfoHeader(fi, link)
 	if err != nil {
 		return nil, err
@@ -351,12 +319,18 @@ func FileInfoHeader(path, name string, fi os.FileInfo) (*tar.Header, error) {
 	if err := setHeaderForSpecialDevice(hdr, name, fi.Sys()); err != nil {
 		return nil, err
 	}
+	return hdr, nil
+}
+
+// ReadSecurityXattrToTarHeader reads security.capability xattr from filesystem
+// to a tar header
+func ReadSecurityXattrToTarHeader(path string, hdr *tar.Header) error {
 	capability, _ := system.Lgetxattr(path, "security.capability")
 	if capability != nil {
 		hdr.Xattrs = make(map[string]string)
 		hdr.Xattrs["security.capability"] = string(capability)
 	}
-	return hdr, nil
+	return nil
 }
 
 type tarWhiteoutConverter interface {
@@ -369,9 +343,8 @@ type tarAppender struct {
 	Buffer    *bufio.Writer
 
 	// for hardlink mapping
-	SeenFiles map[uint64]string
-	UIDMaps   []idtools.IDMap
-	GIDMaps   []idtools.IDMap
+	SeenFiles  map[uint64]string
+	IDMappings *idtools.IDMappings
 
 	// For packing and unpacking whiteout files in the
 	// non standard format. The whiteout files defined
@@ -380,6 +353,15 @@ type tarAppender struct {
 	WhiteoutConverter tarWhiteoutConverter
 }
 
+func newTarAppender(idMapping *idtools.IDMappings, writer io.Writer) *tarAppender {
+	return &tarAppender{
+		SeenFiles:  make(map[uint64]string),
+		TarWriter:  tar.NewWriter(writer),
+		Buffer:     pools.BufioWriter32KPool.Get(nil),
+		IDMappings: idMapping,
+	}
+}
+
 // canonicalTarName provides a platform-independent and consistent posix-style
 //path for files and directories to be archived regardless of the platform.
 func canonicalTarName(name string, isDir bool) (string, error) {
@@ -402,10 +384,22 @@ func (ta *tarAppender) addTarFile(path, name string) error {
 		return err
 	}
 
-	hdr, err := FileInfoHeader(path, name, fi)
+	var link string
+	if fi.Mode()&os.ModeSymlink != 0 {
+		var err error
+		link, err = os.Readlink(path)
+		if err != nil {
+			return err
+		}
+	}
+
+	hdr, err := FileInfoHeader(name, fi, link)
 	if err != nil {
 		return err
 	}
+	if err := ReadSecurityXattrToTarHeader(path, hdr); err != nil {
+		return err
+	}
 
 	// if it's not a directory and has more than 1 link,
 	// it's hard linked, so set the type flag accordingly
@@ -428,21 +422,15 @@ func (ta *tarAppender) addTarFile(path, name string) error {
 	//handle re-mapping container ID mappings back to host ID mappings before
 	//writing tar headers/files. We skip whiteout files because they were written
 	//by the kernel and already have proper ownership relative to the host
-	if !strings.HasPrefix(filepath.Base(hdr.Name), WhiteoutPrefix) && (ta.UIDMaps != nil || ta.GIDMaps != nil) {
-		uid, gid, err := getFileUIDGID(fi.Sys())
+	if !strings.HasPrefix(filepath.Base(hdr.Name), WhiteoutPrefix) && !ta.IDMappings.Empty() {
+		fileIDPair, err := getFileUIDGID(fi.Sys())
 		if err != nil {
 			return err
 		}
-		xUID, err := idtools.ToContainer(uid, ta.UIDMaps)
+		hdr.Uid, hdr.Gid, err = ta.IDMappings.ToContainer(fileIDPair)
 		if err != nil {
 			return err
 		}
-		xGID, err := idtools.ToContainer(gid, ta.GIDMaps)
-		if err != nil {
-			return err
-		}
-		hdr.Uid = xUID
-		hdr.Gid = xGID
 	}
 
 	if ta.WhiteoutConverter != nil {
@@ -496,7 +484,7 @@ func (ta *tarAppender) addTarFile(path, name string) error {
 	return nil
 }
 
-func createTarFile(path, extractDir string, hdr *tar.Header, reader io.Reader, Lchown bool, chownOpts *TarChownOptions, inUserns bool) error {
+func createTarFile(path, extractDir string, hdr *tar.Header, reader io.Reader, Lchown bool, chownOpts *idtools.IDPair, inUserns bool) error {
 	// hdr.Mode is in linux format, which we can use for sycalls,
 	// but for os.Foo() calls we need the mode converted to os.FileMode,
 	// so use hdrInfo.Mode() (they differ for e.g. setuid bits)
@@ -576,7 +564,7 @@ func createTarFile(path, extractDir string, hdr *tar.Header, reader io.Reader, L
 	// Lchown is not supported on Windows.
 	if Lchown && runtime.GOOS != "windows" {
 		if chownOpts == nil {
-			chownOpts = &TarChownOptions{UID: hdr.Uid, GID: hdr.Gid}
+			chownOpts = &idtools.IDPair{UID: hdr.Uid, GID: hdr.Gid}
 		}
 		if err := os.Lchown(path, chownOpts.UID, chownOpts.GID); err != nil {
 			return err
@@ -664,14 +652,11 @@ func TarWithOptions(srcPath string, options *TarOptions) (io.ReadCloser, error)
 	}
 
 	go func() {
-		ta := &tarAppender{
-			TarWriter:         tar.NewWriter(compressWriter),
-			Buffer:            pools.BufioWriter32KPool.Get(nil),
-			SeenFiles:         make(map[uint64]string),
-			UIDMaps:           options.UIDMaps,
-			GIDMaps:           options.GIDMaps,
-			WhiteoutConverter: getWhiteoutConverter(options.WhiteoutFormat),
-		}
+		ta := newTarAppender(
+			idtools.NewIDMappingsFromMaps(options.UIDMaps, options.GIDMaps),
+			compressWriter,
+		)
+		ta.WhiteoutConverter = getWhiteoutConverter(options.WhiteoutFormat)
 
 		defer func() {
 			// Make sure to check the error on Close.
@@ -827,10 +812,8 @@ func Unpack(decompressedArchive io.Reader, dest string, options *TarOptions) err
 	defer pools.BufioReader32KPool.Put(trBuf)
 
 	var dirs []*tar.Header
-	remappedRootUID, remappedRootGID, err := idtools.GetRootUIDGID(options.UIDMaps, options.GIDMaps)
-	if err != nil {
-		return err
-	}
+	idMappings := idtools.NewIDMappingsFromMaps(options.UIDMaps, options.GIDMaps)
+	rootIDs := idMappings.RootPair()
 	whiteoutConverter := getWhiteoutConverter(options.WhiteoutFormat)
 
 	// Iterate through the files in the archive.
@@ -864,7 +847,7 @@ loop:
 			parent := filepath.Dir(hdr.Name)
 			parentPath := filepath.Join(dest, parent)
 			if _, err := os.Lstat(parentPath); err != nil && os.IsNotExist(err) {
-				err = idtools.MkdirAllNewAs(parentPath, 0777, remappedRootUID, remappedRootGID)
+				err = idtools.MkdirAllAndChownNew(parentPath, 0777, rootIDs)
 				if err != nil {
 					return err
 				}
@@ -909,26 +892,8 @@ loop:
 		}
 		trBuf.Reset(tr)
 
-		// if the options contain a uid & gid maps, convert header uid/gid
-		// entries using the maps such that lchown sets the proper mapped
-		// uid/gid after writing the file. We only perform this mapping if
-		// the file isn't already owned by the remapped root UID or GID, as
-		// that specific uid/gid has no mapping from container -> host, and
-		// those files already have the proper ownership for inside the
-		// container.
-		if hdr.Uid != remappedRootUID {
-			xUID, err := idtools.ToHost(hdr.Uid, options.UIDMaps)
-			if err != nil {
-				return err
-			}
-			hdr.Uid = xUID
-		}
-		if hdr.Gid != remappedRootGID {
-			xGID, err := idtools.ToHost(hdr.Gid, options.GIDMaps)
-			if err != nil {
-				return err
-			}
-			hdr.Gid = xGID
+		if err := remapIDs(idMappings, hdr); err != nil {
+			return err
 		}
 
 		if whiteoutConverter != nil {
@@ -1013,23 +978,13 @@ func (archiver *Archiver) TarUntar(src, dst string) error {
 		return err
 	}
 	defer archive.Close()
-
-	var options *TarOptions
-	if archiver.UIDMaps != nil || archiver.GIDMaps != nil {
-		options = &TarOptions{
-			UIDMaps: archiver.UIDMaps,
-			GIDMaps: archiver.GIDMaps,
-		}
+	options := &TarOptions{
+		UIDMaps: archiver.IDMappings.UIDs(),
+		GIDMaps: archiver.IDMappings.GIDs(),
 	}
 	return archiver.Untar(archive, dst, options)
 }
 
-// TarUntar is a convenience function which calls Tar and Untar, with the output of one piped into the other.
-// If either Tar or Untar fails, TarUntar aborts and returns the error.
-func TarUntar(src, dst string) error {
-	return defaultArchiver.TarUntar(src, dst)
-}
-
 // UntarPath untar a file from path to a destination, src is the source tar file path.
 func (archiver *Archiver) UntarPath(src, dst string) error {
 	archive, err := os.Open(src)
@@ -1037,22 +992,13 @@ func (archiver *Archiver) UntarPath(src, dst string) error {
 		return err
 	}
 	defer archive.Close()
-	var options *TarOptions
-	if archiver.UIDMaps != nil || archiver.GIDMaps != nil {
-		options = &TarOptions{
-			UIDMaps: archiver.UIDMaps,
-			GIDMaps: archiver.GIDMaps,
-		}
+	options := &TarOptions{
+		UIDMaps: archiver.IDMappings.UIDs(),
+		GIDMaps: archiver.IDMappings.GIDs(),
 	}
 	return archiver.Untar(archive, dst, options)
 }
 
-// UntarPath is a convenience function which looks for an archive
-// at filesystem path `src`, and unpacks it at `dst`.
-func UntarPath(src, dst string) error {
-	return defaultArchiver.UntarPath(src, dst)
-}
-
 // CopyWithTar creates a tar archive of filesystem path `src`, and
 // unpacks it at filesystem path `dst`.
 // The archive is streamed directly with fixed buffering and no
@@ -1069,27 +1015,16 @@ func (archiver *Archiver) CopyWithTar(src, dst string) error {
 	// if this archiver is set up with ID mapping we need to create
 	// the new destination directory with the remapped root UID/GID pair
 	// as owner
-	rootUID, rootGID, err := idtools.GetRootUIDGID(archiver.UIDMaps, archiver.GIDMaps)
-	if err != nil {
-		return err
-	}
+	rootIDs := archiver.IDMappings.RootPair()
 	// Create dst, copy src's content into it
 	logrus.Debugf("Creating dest directory: %s", dst)
-	if err := idtools.MkdirAllNewAs(dst, 0755, rootUID, rootGID); err != nil {
+	if err := idtools.MkdirAllAndChownNew(dst, 0755, rootIDs); err != nil {
 		return err
 	}
 	logrus.Debugf("Calling TarUntar(%s, %s)", src, dst)
 	return archiver.TarUntar(src, dst)
 }
 
-// CopyWithTar creates a tar archive of filesystem path `src`, and
-// unpacks it at filesystem path `dst`.
-// The archive is streamed directly with fixed buffering and no
-// intermediary disk IO.
-func CopyWithTar(src, dst string) error {
-	return defaultArchiver.CopyWithTar(src, dst)
-}
-
 // CopyFileWithTar emulates the behavior of the 'cp' command-line
 // for a single file. It copies a regular file from path `src` to
 // path `dst`, and preserves all its metadata.
@@ -1110,7 +1045,7 @@ func (archiver *Archiver) CopyFileWithTar(src, dst string) (err error) {
 		dst = filepath.Join(dst, filepath.Base(src))
 	}
 	// Create the holding directory if necessary
-	if err := system.MkdirAll(filepath.Dir(dst), 0700); err != nil {
+	if err := system.MkdirAll(filepath.Dir(dst), 0700, ""); err != nil {
 		return err
 	}
 
@@ -1131,28 +1066,10 @@ func (archiver *Archiver) CopyFileWithTar(src, dst string) (err error) {
 		hdr.Name = filepath.Base(dst)
 		hdr.Mode = int64(chmodTarEntry(os.FileMode(hdr.Mode)))
 
-		remappedRootUID, remappedRootGID, err := idtools.GetRootUIDGID(archiver.UIDMaps, archiver.GIDMaps)
-		if err != nil {
+		if err := remapIDs(archiver.IDMappings, hdr); err != nil {
 			return err
 		}
 
-		// only perform mapping if the file being copied isn't already owned by the
-		// uid or gid of the remapped root in the container
-		if remappedRootUID != hdr.Uid {
-			xUID, err := idtools.ToHost(hdr.Uid, archiver.UIDMaps)
-			if err != nil {
-				return err
-			}
-			hdr.Uid = xUID
-		}
-		if remappedRootGID != hdr.Gid {
-			xGID, err := idtools.ToHost(hdr.Gid, archiver.GIDMaps)
-			if err != nil {
-				return err
-			}
-			hdr.Gid = xGID
-		}
-
 		tw := tar.NewWriter(w)
 		defer tw.Close()
 		if err := tw.WriteHeader(hdr); err != nil {
@@ -1176,16 +1093,10 @@ func (archiver *Archiver) CopyFileWithTar(src, dst string) (err error) {
 	return err
 }
 
-// CopyFileWithTar emulates the behavior of the 'cp' command-line
-// for a single file. It copies a regular file from path `src` to
-// path `dst`, and preserves all its metadata.
-//
-// Destination handling is in an operating specific manner depending
-// where the daemon is running. If `dst` ends with a trailing slash
-// the final destination path will be `dst/base(src)`  (Linux) or
-// `dst\base(src)` (Windows).
-func CopyFileWithTar(src, dst string) (err error) {
-	return defaultArchiver.CopyFileWithTar(src, dst)
+func remapIDs(idMappings *idtools.IDMappings, hdr *tar.Header) error {
+	ids, err := idMappings.ToHost(idtools.IDPair{UID: hdr.Uid, GID: hdr.Gid})
+	hdr.Uid, hdr.Gid = ids.UID, ids.GID
+	return err
 }
 
 // cmdStream executes a command, and returns its stdout as a stream.
diff --git a/components/engine/pkg/archive/archive_test.go b/components/engine/pkg/archive/archive_test.go
index e351a0455b..e85878fd0f 100644
--- a/components/engine/pkg/archive/archive_test.go
+++ b/components/engine/pkg/archive/archive_test.go
@@ -27,35 +27,22 @@ func init() {
 	}
 }
 
-func TestIsArchiveNilHeader(t *testing.T) {
-	out := IsArchive(nil)
-	if out {
-		t.Fatalf("isArchive should return false as nil is not a valid archive header")
-	}
+var defaultArchiver = NewDefaultArchiver()
+
+func defaultTarUntar(src, dst string) error {
+	return defaultArchiver.TarUntar(src, dst)
 }
 
-func TestIsArchiveInvalidHeader(t *testing.T) {
-	header := []byte{0x00, 0x01, 0x02}
-	out := IsArchive(header)
-	if out {
-		t.Fatalf("isArchive should return false as %s is not a valid archive header", header)
-	}
+func defaultUntarPath(src, dst string) error {
+	return defaultArchiver.UntarPath(src, dst)
 }
 
-func TestIsArchiveBzip2(t *testing.T) {
-	header := []byte{0x42, 0x5A, 0x68}
-	out := IsArchive(header)
-	if !out {
-		t.Fatalf("isArchive should return true as %s is a bz2 header", header)
-	}
+func defaultCopyFileWithTar(src, dst string) (err error) {
+	return defaultArchiver.CopyFileWithTar(src, dst)
 }
 
-func TestIsArchive7zip(t *testing.T) {
-	header := []byte{0x50, 0x4b, 0x03, 0x04}
-	out := IsArchive(header)
-	if out {
-		t.Fatalf("isArchive should return false as %s is a 7z header and it is not supported", header)
-	}
+func defaultCopyWithTar(src, dst string) error {
+	return defaultArchiver.CopyWithTar(src, dst)
 }
 
 func TestIsArchivePathDir(t *testing.T) {
@@ -301,7 +288,7 @@ func TestUntarPathWithInvalidDest(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = UntarPath(tarFile, invalidDestFolder)
+	err = defaultUntarPath(tarFile, invalidDestFolder)
 	if err == nil {
 		t.Fatalf("UntarPath with invalid destination path should throw an error.")
 	}
@@ -313,7 +300,7 @@ func TestUntarPathWithInvalidSrc(t *testing.T) {
 		t.Fatalf("Fail to create the destination file")
 	}
 	defer os.RemoveAll(dest)
-	err = UntarPath("/invalid/path", dest)
+	err = defaultUntarPath("/invalid/path", dest)
 	if err == nil {
 		t.Fatalf("UntarPath with invalid src path should throw an error.")
 	}
@@ -348,7 +335,7 @@ func TestUntarPath(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = UntarPath(tarFile, destFolder)
+	err = defaultUntarPath(tarFile, destFolder)
 	if err != nil {
 		t.Fatalf("UntarPath shouldn't throw an error, %s.", err)
 	}
@@ -387,7 +374,7 @@ func TestUntarPathWithDestinationFile(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Fail to create the destination file")
 	}
-	err = UntarPath(tarFile, destFile)
+	err = defaultUntarPath(tarFile, destFile)
 	if err == nil {
 		t.Fatalf("UntarPath should throw an error if the destination if a file")
 	}
@@ -430,7 +417,7 @@ func TestUntarPathWithDestinationSrcFileAsFolder(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	err = UntarPath(tarFile, destFolder)
+	err = defaultUntarPath(tarFile, destFolder)
 	if err != nil {
 		t.Fatalf("UntarPath should throw not throw an error if the extracted file already exists and is a folder")
 	}
@@ -447,7 +434,7 @@ func TestCopyWithTarInvalidSrc(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	err = CopyWithTar(invalidSrc, destFolder)
+	err = defaultCopyWithTar(invalidSrc, destFolder)
 	if err == nil {
 		t.Fatalf("archiver.CopyWithTar with invalid src path should throw an error.")
 	}
@@ -464,7 +451,7 @@ func TestCopyWithTarInexistentDestWillCreateIt(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	err = CopyWithTar(srcFolder, inexistentDestFolder)
+	err = defaultCopyWithTar(srcFolder, inexistentDestFolder)
 	if err != nil {
 		t.Fatalf("CopyWithTar with an inexistent folder shouldn't fail.")
 	}
@@ -493,7 +480,7 @@ func TestCopyWithTarSrcFile(t *testing.T) {
 		t.Fatal(err)
 	}
 	ioutil.WriteFile(src, []byte("content"), 0777)
-	err = CopyWithTar(src, dest)
+	err = defaultCopyWithTar(src, dest)
 	if err != nil {
 		t.Fatalf("archiver.CopyWithTar shouldn't throw an error, %s.", err)
 	}
@@ -522,7 +509,7 @@ func TestCopyWithTarSrcFolder(t *testing.T) {
 		t.Fatal(err)
 	}
 	ioutil.WriteFile(filepath.Join(src, "file"), []byte("content"), 0777)
-	err = CopyWithTar(src, dest)
+	err = defaultCopyWithTar(src, dest)
 	if err != nil {
 		t.Fatalf("archiver.CopyWithTar shouldn't throw an error, %s.", err)
 	}
@@ -545,7 +532,7 @@ func TestCopyFileWithTarInvalidSrc(t *testing.T) {
 		t.Fatal(err)
 	}
 	invalidFile := filepath.Join(tempFolder, "doesnotexists")
-	err = CopyFileWithTar(invalidFile, destFolder)
+	err = defaultCopyFileWithTar(invalidFile, destFolder)
 	if err == nil {
 		t.Fatalf("archiver.CopyWithTar with invalid src path should throw an error.")
 	}
@@ -563,7 +550,7 @@ func TestCopyFileWithTarInexistentDestWillCreateIt(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	err = CopyFileWithTar(srcFile, inexistentDestFolder)
+	err = defaultCopyFileWithTar(srcFile, inexistentDestFolder)
 	if err != nil {
 		t.Fatalf("CopyWithTar with an inexistent folder shouldn't fail.")
 	}
@@ -590,7 +577,7 @@ func TestCopyFileWithTarSrcFolder(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	err = CopyFileWithTar(src, dest)
+	err = defaultCopyFileWithTar(src, dest)
 	if err == nil {
 		t.Fatalf("CopyFileWithTar should throw an error with a folder.")
 	}
@@ -614,7 +601,7 @@ func TestCopyFileWithTarSrcFile(t *testing.T) {
 		t.Fatal(err)
 	}
 	ioutil.WriteFile(src, []byte("content"), 0777)
-	err = CopyWithTar(src, dest+"/")
+	err = defaultCopyWithTar(src, dest+"/")
 	if err != nil {
 		t.Fatalf("archiver.CopyFileWithTar shouldn't throw an error, %s.", err)
 	}
@@ -657,7 +644,7 @@ func checkNoChanges(fileNum int, hardlinks bool) error {
 		return err
 	}
 
-	err = TarUntar(srcDir, destDir)
+	err = defaultTarUntar(srcDir, destDir)
 	if err != nil {
 		return err
 	}
@@ -871,7 +858,7 @@ func BenchmarkTarUntar(b *testing.B) {
 	b.ResetTimer()
 	b.SetBytes(int64(n))
 	for n := 0; n < b.N; n++ {
-		err := TarUntar(origin, target)
+		err := defaultTarUntar(origin, target)
 		if err != nil {
 			b.Fatal(err)
 		}
@@ -899,7 +886,7 @@ func BenchmarkTarUntarWithLinks(b *testing.B) {
 	b.ResetTimer()
 	b.SetBytes(int64(n))
 	for n := 0; n < b.N; n++ {
-		err := TarUntar(origin, target)
+		err := defaultTarUntar(origin, target)
 		if err != nil {
 			b.Fatal(err)
 		}
diff --git a/components/engine/pkg/archive/archive_unix.go b/components/engine/pkg/archive/archive_unix.go
index 68d3c97d27..a33f0fe779 100644
--- a/components/engine/pkg/archive/archive_unix.go
+++ b/components/engine/pkg/archive/archive_unix.go
@@ -9,6 +9,7 @@ import (
 	"path/filepath"
 	"syscall"
 
+	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/system"
 	rsystem "github.com/opencontainers/runc/libcontainer/system"
 )
@@ -44,16 +45,13 @@ func chmodTarEntry(perm os.FileMode) os.FileMode {
 func setHeaderForSpecialDevice(hdr *tar.Header, name string, stat interface{}) (err error) {
 	s, ok := stat.(*syscall.Stat_t)
 
-	if !ok {
-		err = errors.New("cannot convert stat value to syscall.Stat_t")
-		return
-	}
-
-	// Currently go does not fill in the major/minors
-	if s.Mode&syscall.S_IFBLK != 0 ||
-		s.Mode&syscall.S_IFCHR != 0 {
-		hdr.Devmajor = int64(major(uint64(s.Rdev)))
-		hdr.Devminor = int64(minor(uint64(s.Rdev)))
+	if ok {
+		// Currently go does not fill in the major/minors
+		if s.Mode&syscall.S_IFBLK != 0 ||
+			s.Mode&syscall.S_IFCHR != 0 {
+			hdr.Devmajor = int64(major(uint64(s.Rdev)))
+			hdr.Devminor = int64(minor(uint64(s.Rdev)))
+		}
 	}
 
 	return
@@ -62,23 +60,20 @@ func setHeaderForSpecialDevice(hdr *tar.Header, name string, stat interface{}) (
 func getInodeFromStat(stat interface{}) (inode uint64, err error) {
 	s, ok := stat.(*syscall.Stat_t)
 
-	if !ok {
-		err = errors.New("cannot convert stat value to syscall.Stat_t")
-		return
+	if ok {
+		inode = uint64(s.Ino)
 	}
 
-	inode = uint64(s.Ino)
-
 	return
 }
 
-func getFileUIDGID(stat interface{}) (int, int, error) {
+func getFileUIDGID(stat interface{}) (idtools.IDPair, error) {
 	s, ok := stat.(*syscall.Stat_t)
 
 	if !ok {
-		return -1, -1, errors.New("cannot convert stat value to syscall.Stat_t")
+		return idtools.IDPair{}, errors.New("cannot convert stat value to syscall.Stat_t")
 	}
-	return int(s.Uid), int(s.Gid), nil
+	return idtools.IDPair{UID: int(s.Uid), GID: int(s.Gid)}, nil
 }
 
 func major(device uint64) uint64 {
diff --git a/components/engine/pkg/archive/archive_windows.go b/components/engine/pkg/archive/archive_windows.go
index 9c7094738d..a22410c039 100644
--- a/components/engine/pkg/archive/archive_windows.go
+++ b/components/engine/pkg/archive/archive_windows.go
@@ -9,6 +9,7 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/longpath"
 )
 
@@ -72,7 +73,7 @@ func handleLChmod(hdr *tar.Header, path string, hdrInfo os.FileInfo) error {
 	return nil
 }
 
-func getFileUIDGID(stat interface{}) (int, int, error) {
+func getFileUIDGID(stat interface{}) (idtools.IDPair, error) {
 	// no notion of file ownership mapping yet on Windows
-	return 0, 0, nil
+	return idtools.IDPair{0, 0}, nil
 }
diff --git a/components/engine/pkg/archive/archive_windows_test.go b/components/engine/pkg/archive/archive_windows_test.go
index 9dd937f296..685e114baf 100644
--- a/components/engine/pkg/archive/archive_windows_test.go
+++ b/components/engine/pkg/archive/archive_windows_test.go
@@ -27,7 +27,7 @@ func TestCopyFileWithInvalidDest(t *testing.T) {
 		t.Fatal(err)
 	}
 	ioutil.WriteFile(src, []byte("content"), 0777)
-	err = CopyWithTar(src, dest)
+	err = defaultCopyWithTar(src, dest)
 	if err == nil {
 		t.Fatalf("archiver.CopyWithTar should throw an error on invalid dest.")
 	}
diff --git a/components/engine/pkg/archive/changes.go b/components/engine/pkg/archive/changes.go
index ca2c0ca1bf..5ca39b7215 100644
--- a/components/engine/pkg/archive/changes.go
+++ b/components/engine/pkg/archive/changes.go
@@ -394,13 +394,8 @@ func ChangesSize(newDir string, changes []Change) int64 {
 func ExportChanges(dir string, changes []Change, uidMaps, gidMaps []idtools.IDMap) (io.ReadCloser, error) {
 	reader, writer := io.Pipe()
 	go func() {
-		ta := &tarAppender{
-			TarWriter: tar.NewWriter(writer),
-			Buffer:    pools.BufioWriter32KPool.Get(nil),
-			SeenFiles: make(map[uint64]string),
-			UIDMaps:   uidMaps,
-			GIDMaps:   gidMaps,
-		}
+		ta := newTarAppender(idtools.NewIDMappingsFromMaps(uidMaps, gidMaps), writer)
+
 		// this buffer is needed for the duration of this piped stream
 		defer pools.BufioWriter32KPool.Put(ta.Buffer)
 
diff --git a/components/engine/pkg/archive/diff.go b/components/engine/pkg/archive/diff.go
index 2292193942..a2766b5928 100644
--- a/components/engine/pkg/archive/diff.go
+++ b/components/engine/pkg/archive/diff.go
@@ -33,10 +33,7 @@ func UnpackLayer(dest string, layer io.Reader, options *TarOptions) (size int64,
 	if options.ExcludePatterns == nil {
 		options.ExcludePatterns = []string{}
 	}
-	remappedRootUID, remappedRootGID, err := idtools.GetRootUIDGID(options.UIDMaps, options.GIDMaps)
-	if err != nil {
-		return 0, err
-	}
+	idMappings := idtools.NewIDMappingsFromMaps(options.UIDMaps, options.GIDMaps)
 
 	aufsTempdir := ""
 	aufsHardlinks := make(map[string]*tar.Header)
@@ -87,7 +84,7 @@ func UnpackLayer(dest string, layer io.Reader, options *TarOptions) (size int64,
 			parentPath := filepath.Join(dest, parent)
 
 			if _, err := os.Lstat(parentPath); err != nil && os.IsNotExist(err) {
-				err = system.MkdirAll(parentPath, 0600)
+				err = system.MkdirAll(parentPath, 0600, "")
 				if err != nil {
 					return 0, err
 				}
@@ -195,27 +192,10 @@ func UnpackLayer(dest string, layer io.Reader, options *TarOptions) (size int64,
 				srcData = tmpFile
 			}
 
-			// if the options contain a uid & gid maps, convert header uid/gid
-			// entries using the maps such that lchown sets the proper mapped
-			// uid/gid after writing the file. We only perform this mapping if
-			// the file isn't already owned by the remapped root UID or GID, as
-			// that specific uid/gid has no mapping from container -> host, and
-			// those files already have the proper ownership for inside the
-			// container.
-			if srcHdr.Uid != remappedRootUID {
-				xUID, err := idtools.ToHost(srcHdr.Uid, options.UIDMaps)
-				if err != nil {
-					return 0, err
-				}
-				srcHdr.Uid = xUID
-			}
-			if srcHdr.Gid != remappedRootGID {
-				xGID, err := idtools.ToHost(srcHdr.Gid, options.GIDMaps)
-				if err != nil {
-					return 0, err
-				}
-				srcHdr.Gid = xGID
+			if err := remapIDs(idMappings, srcHdr); err != nil {
+				return 0, err
 			}
+
 			if err := createTarFile(path, dest, srcHdr, srcData, true, nil, options.InUserNS); err != nil {
 				return 0, err
 			}
diff --git a/components/engine/pkg/authorization/middleware.go b/components/engine/pkg/authorization/middleware.go
index 05130121e9..7789a758df 100644
--- a/components/engine/pkg/authorization/middleware.go
+++ b/components/engine/pkg/authorization/middleware.go
@@ -25,20 +25,12 @@ func NewMiddleware(names []string, pg plugingetter.PluginGetter) *Middleware {
 	}
 }
 
-// GetAuthzPlugins gets authorization plugins
-func (m *Middleware) GetAuthzPlugins() []Plugin {
+func (m *Middleware) getAuthzPlugins() []Plugin {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 	return m.plugins
 }
 
-// SetAuthzPlugins sets authorization plugins
-func (m *Middleware) SetAuthzPlugins(plugins []Plugin) {
-	m.mu.Lock()
-	m.plugins = plugins
-	m.mu.Unlock()
-}
-
 // SetPlugins sets the plugin used for authorization
 func (m *Middleware) SetPlugins(names []string) {
 	m.mu.Lock()
@@ -46,10 +38,23 @@ func (m *Middleware) SetPlugins(names []string) {
 	m.mu.Unlock()
 }
 
+// RemovePlugin removes a single plugin from this authz middleware chain
+func (m *Middleware) RemovePlugin(name string) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	plugins := m.plugins[:0]
+	for _, authPlugin := range m.plugins {
+		if authPlugin.Name() != name {
+			plugins = append(plugins, authPlugin)
+		}
+	}
+	m.plugins = plugins
+}
+
 // WrapHandler returns a new handler function wrapping the previous one in the request chain.
 func (m *Middleware) WrapHandler(handler func(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error) func(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
 	return func(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
-		plugins := m.GetAuthzPlugins()
+		plugins := m.getAuthzPlugins()
 		if len(plugins) == 0 {
 			return handler(ctx, w, r, vars)
 		}
@@ -83,7 +88,7 @@ func (m *Middleware) WrapHandler(handler func(ctx context.Context, w http.Respon
 
 		// There's a chance that the authCtx.plugins was updated. One of the reasons
 		// this can happen is when an authzplugin is disabled.
-		plugins = m.GetAuthzPlugins()
+		plugins = m.getAuthzPlugins()
 		if len(plugins) == 0 {
 			logrus.Debug("There are no authz plugins in the chain")
 			return nil
diff --git a/components/engine/pkg/chrootarchive/archive.go b/components/engine/pkg/chrootarchive/archive.go
index a7814f5b90..7604418767 100644
--- a/components/engine/pkg/chrootarchive/archive.go
+++ b/components/engine/pkg/chrootarchive/archive.go
@@ -11,7 +11,13 @@ import (
 	"github.com/docker/docker/pkg/idtools"
 )
 
-var chrootArchiver = &archive.Archiver{Untar: Untar}
+// NewArchiver returns a new Archiver which uses chrootarchive.Untar
+func NewArchiver(idMappings *idtools.IDMappings) *archive.Archiver {
+	if idMappings == nil {
+		idMappings = &idtools.IDMappings{}
+	}
+	return &archive.Archiver{Untar: Untar, IDMappings: idMappings}
+}
 
 // Untar reads a stream of bytes from `archive`, parses it as a tar archive,
 // and unpacks it into the directory at `dest`.
@@ -30,7 +36,6 @@ func UntarUncompressed(tarArchive io.Reader, dest string, options *archive.TarOp
 
 // Handler for teasing out the automatic decompression
 func untarHandler(tarArchive io.Reader, dest string, options *archive.TarOptions, decompress bool) error {
-
 	if tarArchive == nil {
 		return fmt.Errorf("Empty archive")
 	}
@@ -41,14 +46,12 @@ func untarHandler(tarArchive io.Reader, dest string, options *archive.TarOptions
 		options.ExcludePatterns = []string{}
 	}
 
-	rootUID, rootGID, err := idtools.GetRootUIDGID(options.UIDMaps, options.GIDMaps)
-	if err != nil {
-		return err
-	}
+	idMappings := idtools.NewIDMappingsFromMaps(options.UIDMaps, options.GIDMaps)
+	rootIDs := idMappings.RootPair()
 
 	dest = filepath.Clean(dest)
 	if _, err := os.Stat(dest); os.IsNotExist(err) {
-		if err := idtools.MkdirAllNewAs(dest, 0755, rootUID, rootGID); err != nil {
+		if err := idtools.MkdirAllAndChownNew(dest, 0755, rootIDs); err != nil {
 			return err
 		}
 	}
@@ -65,33 +68,3 @@ func untarHandler(tarArchive io.Reader, dest string, options *archive.TarOptions
 
 	return invokeUnpack(r, dest, options)
 }
-
-// TarUntar is a convenience function which calls Tar and Untar, with the output of one piped into the other.
-// If either Tar or Untar fails, TarUntar aborts and returns the error.
-func TarUntar(src, dst string) error {
-	return chrootArchiver.TarUntar(src, dst)
-}
-
-// CopyWithTar creates a tar archive of filesystem path `src`, and
-// unpacks it at filesystem path `dst`.
-// The archive is streamed directly with fixed buffering and no
-// intermediary disk IO.
-func CopyWithTar(src, dst string) error {
-	return chrootArchiver.CopyWithTar(src, dst)
-}
-
-// CopyFileWithTar emulates the behavior of the 'cp' command-line
-// for a single file. It copies a regular file from path `src` to
-// path `dst`, and preserves all its metadata.
-//
-// If `dst` ends with a trailing slash '/' ('\' on Windows), the final
-// destination path will be `dst/base(src)` or `dst\base(src)`
-func CopyFileWithTar(src, dst string) (err error) {
-	return chrootArchiver.CopyFileWithTar(src, dst)
-}
-
-// UntarPath is a convenience function which looks for an archive
-// at filesystem path `src`, and unpacks it at `dst`.
-func UntarPath(src, dst string) error {
-	return chrootArchiver.UntarPath(src, dst)
-}
diff --git a/components/engine/pkg/chrootarchive/archive_test.go b/components/engine/pkg/chrootarchive/archive_test.go
index 80e54a0edc..bd2deb2dd9 100644
--- a/components/engine/pkg/chrootarchive/archive_test.go
+++ b/components/engine/pkg/chrootarchive/archive_test.go
@@ -22,6 +22,24 @@ func init() {
 	reexec.Init()
 }
 
+var chrootArchiver = NewArchiver(nil)
+
+func TarUntar(src, dst string) error {
+	return chrootArchiver.TarUntar(src, dst)
+}
+
+func CopyFileWithTar(src, dst string) (err error) {
+	return chrootArchiver.CopyFileWithTar(src, dst)
+}
+
+func UntarPath(src, dst string) error {
+	return chrootArchiver.UntarPath(src, dst)
+}
+
+func CopyWithTar(src, dst string) error {
+	return chrootArchiver.CopyWithTar(src, dst)
+}
+
 func TestChrootTarUntar(t *testing.T) {
 	tmpdir, err := ioutil.TempDir("", "docker-TestChrootTarUntar")
 	if err != nil {
@@ -29,7 +47,7 @@ func TestChrootTarUntar(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpdir)
 	src := filepath.Join(tmpdir, "src")
-	if err := system.MkdirAll(src, 0700); err != nil {
+	if err := system.MkdirAll(src, 0700, ""); err != nil {
 		t.Fatal(err)
 	}
 	if err := ioutil.WriteFile(filepath.Join(src, "toto"), []byte("hello toto"), 0644); err != nil {
@@ -43,7 +61,7 @@ func TestChrootTarUntar(t *testing.T) {
 		t.Fatal(err)
 	}
 	dest := filepath.Join(tmpdir, "src")
-	if err := system.MkdirAll(dest, 0700); err != nil {
+	if err := system.MkdirAll(dest, 0700, ""); err != nil {
 		t.Fatal(err)
 	}
 	if err := Untar(stream, dest, &archive.TarOptions{ExcludePatterns: []string{"lolo"}}); err != nil {
@@ -60,7 +78,7 @@ func TestChrootUntarWithHugeExcludesList(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpdir)
 	src := filepath.Join(tmpdir, "src")
-	if err := system.MkdirAll(src, 0700); err != nil {
+	if err := system.MkdirAll(src, 0700, ""); err != nil {
 		t.Fatal(err)
 	}
 	if err := ioutil.WriteFile(filepath.Join(src, "toto"), []byte("hello toto"), 0644); err != nil {
@@ -71,7 +89,7 @@ func TestChrootUntarWithHugeExcludesList(t *testing.T) {
 		t.Fatal(err)
 	}
 	dest := filepath.Join(tmpdir, "dest")
-	if err := system.MkdirAll(dest, 0700); err != nil {
+	if err := system.MkdirAll(dest, 0700, ""); err != nil {
 		t.Fatal(err)
 	}
 	options := &archive.TarOptions{}
@@ -162,7 +180,7 @@ func TestChrootTarUntarWithSymlink(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpdir)
 	src := filepath.Join(tmpdir, "src")
-	if err := system.MkdirAll(src, 0700); err != nil {
+	if err := system.MkdirAll(src, 0700, ""); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := prepareSourceDirectory(10, src, false); err != nil {
@@ -188,7 +206,7 @@ func TestChrootCopyWithTar(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpdir)
 	src := filepath.Join(tmpdir, "src")
-	if err := system.MkdirAll(src, 0700); err != nil {
+	if err := system.MkdirAll(src, 0700, ""); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := prepareSourceDirectory(10, src, true); err != nil {
@@ -234,7 +252,7 @@ func TestChrootCopyFileWithTar(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpdir)
 	src := filepath.Join(tmpdir, "src")
-	if err := system.MkdirAll(src, 0700); err != nil {
+	if err := system.MkdirAll(src, 0700, ""); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := prepareSourceDirectory(10, src, true); err != nil {
@@ -281,7 +299,7 @@ func TestChrootUntarPath(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpdir)
 	src := filepath.Join(tmpdir, "src")
-	if err := system.MkdirAll(src, 0700); err != nil {
+	if err := system.MkdirAll(src, 0700, ""); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := prepareSourceDirectory(10, src, false); err != nil {
@@ -342,7 +360,7 @@ func TestChrootUntarEmptyArchiveFromSlowReader(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpdir)
 	dest := filepath.Join(tmpdir, "dest")
-	if err := system.MkdirAll(dest, 0700); err != nil {
+	if err := system.MkdirAll(dest, 0700, ""); err != nil {
 		t.Fatal(err)
 	}
 	stream := &slowEmptyTarReader{size: 10240, chunkSize: 1024}
@@ -358,7 +376,7 @@ func TestChrootApplyEmptyArchiveFromSlowReader(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpdir)
 	dest := filepath.Join(tmpdir, "dest")
-	if err := system.MkdirAll(dest, 0700); err != nil {
+	if err := system.MkdirAll(dest, 0700, ""); err != nil {
 		t.Fatal(err)
 	}
 	stream := &slowEmptyTarReader{size: 10240, chunkSize: 1024}
@@ -374,7 +392,7 @@ func TestChrootApplyDotDotFile(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpdir)
 	src := filepath.Join(tmpdir, "src")
-	if err := system.MkdirAll(src, 0700); err != nil {
+	if err := system.MkdirAll(src, 0700, ""); err != nil {
 		t.Fatal(err)
 	}
 	if err := ioutil.WriteFile(filepath.Join(src, "..gitme"), []byte(""), 0644); err != nil {
@@ -385,7 +403,7 @@ func TestChrootApplyDotDotFile(t *testing.T) {
 		t.Fatal(err)
 	}
 	dest := filepath.Join(tmpdir, "dest")
-	if err := system.MkdirAll(dest, 0700); err != nil {
+	if err := system.MkdirAll(dest, 0700, ""); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := ApplyLayer(dest, stream); err != nil {
diff --git a/components/engine/pkg/devicemapper/devmapper.go b/components/engine/pkg/devicemapper/devmapper.go
index ef7dba840d..73433c0e5a 100644
--- a/components/engine/pkg/devicemapper/devmapper.go
+++ b/components/engine/pkg/devicemapper/devmapper.go
@@ -333,6 +333,7 @@ func RemoveDevice(name string) error {
 	if err := task.setCookie(cookie, 0); err != nil {
 		return fmt.Errorf("devicemapper: Can not set cookie: %s", err)
 	}
+	defer UdevWait(cookie)
 
 	dmSawBusy = false // reset before the task is run
 	if err = task.run(); err != nil {
@@ -342,7 +343,7 @@ func RemoveDevice(name string) error {
 		return fmt.Errorf("devicemapper: Error running RemoveDevice %s", err)
 	}
 
-	return UdevWait(cookie)
+	return nil
 }
 
 // RemoveDeviceDeferred is a useful helper for cleaning up a device, but deferred.
@@ -368,10 +369,6 @@ func RemoveDeviceDeferred(name string) error {
 		return fmt.Errorf("devicemapper: Can not set cookie: %s", err)
 	}
 
-	if err = task.run(); err != nil {
-		return fmt.Errorf("devicemapper: Error running RemoveDeviceDeferred %s", err)
-	}
-
 	// libdevmapper and udev relies on System V semaphore for synchronization,
 	// semaphores created in `task.setCookie` will be cleaned up in `UdevWait`.
 	// So these two function call must come in pairs, otherwise semaphores will
@@ -381,8 +378,13 @@ func RemoveDeviceDeferred(name string) error {
 	// this call will not wait for the deferred removal's final executing, since no
 	// udev event will be generated, and the semaphore's value will not be incremented
 	// by udev, what UdevWait is just cleaning up the semaphore.
+	defer UdevWait(cookie)
 
-	return UdevWait(cookie)
+	if err = task.run(); err != nil {
+		return fmt.Errorf("devicemapper: Error running RemoveDeviceDeferred %s", err)
+	}
+
+	return nil
 }
 
 // CancelDeferredRemove cancels a deferred remove for a device.
@@ -476,12 +478,13 @@ func CreatePool(poolName string, dataFile, metadataFile *os.File, poolBlockSize
 	if err := task.setCookie(cookie, flags); err != nil {
 		return fmt.Errorf("devicemapper: Can't set cookie %s", err)
 	}
+	defer UdevWait(cookie)
 
 	if err := task.run(); err != nil {
 		return fmt.Errorf("devicemapper: Error running deviceCreate (CreatePool) %s", err)
 	}
 
-	return UdevWait(cookie)
+	return nil
 }
 
 // ReloadPool is the programmatic example of "dmsetup reload".
@@ -661,12 +664,13 @@ func ResumeDevice(name string) error {
 	if err := task.setCookie(cookie, 0); err != nil {
 		return fmt.Errorf("devicemapper: Can't set cookie %s", err)
 	}
+	defer UdevWait(cookie)
 
 	if err := task.run(); err != nil {
 		return fmt.Errorf("devicemapper: Error running deviceResume %s", err)
 	}
 
-	return UdevWait(cookie)
+	return nil
 }
 
 // CreateDevice creates a device with the specified poolName with the specified device id.
@@ -759,11 +763,13 @@ func activateDevice(poolName string, name string, deviceID int, size uint64, ext
 		return fmt.Errorf("devicemapper: Can't set cookie %s", err)
 	}
 
+	defer UdevWait(cookie)
+
 	if err := task.run(); err != nil {
 		return fmt.Errorf("devicemapper: Error running deviceCreate (ActivateDevice) %s", err)
 	}
 
-	return UdevWait(cookie)
+	return nil
 }
 
 // CreateSnapDeviceRaw creates a snapshot device. Caller needs to suspend and resume the origin device if it is active.
diff --git a/components/engine/pkg/filenotify/poller_test.go b/components/engine/pkg/filenotify/poller_test.go
index b74bd935a0..d854201991 100644
--- a/components/engine/pkg/filenotify/poller_test.go
+++ b/components/engine/pkg/filenotify/poller_test.go
@@ -61,7 +61,7 @@ func TestPollerEvent(t *testing.T) {
 	default:
 	}
 
-	if err := ioutil.WriteFile(f.Name(), []byte("hello"), 644); err != nil {
+	if err := ioutil.WriteFile(f.Name(), []byte("hello"), 0644); err != nil {
 		t.Fatal(err)
 	}
 	if err := assertEvent(w, fsnotify.Write); err != nil {
diff --git a/components/engine/pkg/httputils/httputils.go b/components/engine/pkg/httputils/httputils.go
deleted file mode 100644
index af86835bd9..0000000000
--- a/components/engine/pkg/httputils/httputils.go
+++ /dev/null
@@ -1,56 +0,0 @@
-package httputils
-
-import (
-	"errors"
-	"fmt"
-	"net/http"
-	"regexp"
-	"strings"
-
-	"github.com/docker/docker/pkg/jsonmessage"
-)
-
-var (
-	headerRegexp     = regexp.MustCompile(`^(?:(.+)/(.+?))\((.+)\).*$`)
-	errInvalidHeader = errors.New("Bad header, should be in format `docker/version (platform)`")
-)
-
-// Download requests a given URL and returns an io.Reader.
-func Download(url string) (resp *http.Response, err error) {
-	if resp, err = http.Get(url); err != nil {
-		return nil, err
-	}
-	if resp.StatusCode >= 400 {
-		return nil, fmt.Errorf("Got HTTP status code >= 400: %s", resp.Status)
-	}
-	return resp, nil
-}
-
-// NewHTTPRequestError returns a JSON response error.
-func NewHTTPRequestError(msg string, res *http.Response) error {
-	return &jsonmessage.JSONError{
-		Message: msg,
-		Code:    res.StatusCode,
-	}
-}
-
-// ServerHeader contains the server information.
-type ServerHeader struct {
-	App string // docker
-	Ver string // 1.8.0-dev
-	OS  string // windows or linux
-}
-
-// ParseServerHeader extracts pieces from an HTTP server header
-// which is in the format "docker/version (os)" e.g. docker/1.8.0-dev (windows).
-func ParseServerHeader(hdr string) (*ServerHeader, error) {
-	matches := headerRegexp.FindStringSubmatch(hdr)
-	if len(matches) != 4 {
-		return nil, errInvalidHeader
-	}
-	return &ServerHeader{
-		App: strings.TrimSpace(matches[1]),
-		Ver: strings.TrimSpace(matches[2]),
-		OS:  strings.TrimSpace(matches[3]),
-	}, nil
-}
diff --git a/components/engine/pkg/httputils/httputils_test.go b/components/engine/pkg/httputils/httputils_test.go
deleted file mode 100644
index 725c68f415..0000000000
--- a/components/engine/pkg/httputils/httputils_test.go
+++ /dev/null
@@ -1,115 +0,0 @@
-package httputils
-
-import (
-	"fmt"
-	"io/ioutil"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-func TestDownload(t *testing.T) {
-	expected := "Hello, docker !"
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		fmt.Fprintf(w, expected)
-	}))
-	defer ts.Close()
-	response, err := Download(ts.URL)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	actual, err := ioutil.ReadAll(response.Body)
-	response.Body.Close()
-
-	if err != nil || string(actual) != expected {
-		t.Fatalf("Expected the response %q, got err:%q, actual:%q", expected, err, string(actual))
-	}
-}
-
-func TestDownload400Errors(t *testing.T) {
-	expectedError := "Got HTTP status code >= 400: 403 Forbidden"
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// 403
-		http.Error(w, "something failed (forbidden)", http.StatusForbidden)
-	}))
-	defer ts.Close()
-	// Expected status code = 403
-	if _, err := Download(ts.URL); err == nil || err.Error() != expectedError {
-		t.Fatalf("Expected the error %q, got %q", expectedError, err)
-	}
-}
-
-func TestDownloadOtherErrors(t *testing.T) {
-	if _, err := Download("I'm not an url.."); err == nil || !strings.Contains(err.Error(), "unsupported protocol scheme") {
-		t.Fatalf("Expected an error with 'unsupported protocol scheme', got %q", err)
-	}
-}
-
-func TestNewHTTPRequestError(t *testing.T) {
-	errorMessage := "Some error message"
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// 403
-		http.Error(w, errorMessage, http.StatusForbidden)
-	}))
-	defer ts.Close()
-	httpResponse, err := http.Get(ts.URL)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := NewHTTPRequestError(errorMessage, httpResponse); err.Error() != errorMessage {
-		t.Fatalf("Expected err to be %q, got %q", errorMessage, err)
-	}
-}
-
-func TestParseServerHeader(t *testing.T) {
-	inputs := map[string][]string{
-		"bad header":           {"error"},
-		"(bad header)":         {"error"},
-		"(without/spaces)":     {"error"},
-		"(header/with spaces)": {"error"},
-		"foo/bar (baz)":        {"foo", "bar", "baz"},
-		"foo/bar":              {"error"},
-		"foo":                  {"error"},
-		"foo/bar (baz space)":           {"foo", "bar", "baz space"},
-		"  f  f  /  b  b  (  b  s  )  ": {"f  f", "b  b", "b  s"},
-		"foo/bar (baz) ignore":          {"foo", "bar", "baz"},
-		"foo/bar ()":                    {"error"},
-		"foo/bar()":                     {"error"},
-		"foo/bar(baz)":                  {"foo", "bar", "baz"},
-		"foo/bar/zzz(baz)":              {"foo/bar", "zzz", "baz"},
-		"foo/bar(baz/abc)":              {"foo", "bar", "baz/abc"},
-		"foo/bar(baz (abc))":            {"foo", "bar", "baz (abc)"},
-	}
-
-	for header, values := range inputs {
-		serverHeader, err := ParseServerHeader(header)
-		if err != nil {
-			if err != errInvalidHeader {
-				t.Fatalf("Failed to parse %q, and got some unexpected error: %q", header, err)
-			}
-			if values[0] == "error" {
-				continue
-			}
-			t.Fatalf("Header %q failed to parse when it shouldn't have", header)
-		}
-		if values[0] == "error" {
-			t.Fatalf("Header %q parsed ok when it should have failed(%q).", header, serverHeader)
-		}
-
-		if serverHeader.App != values[0] {
-			t.Fatalf("Expected serverHeader.App for %q to equal %q, got %q", header, values[0], serverHeader.App)
-		}
-
-		if serverHeader.Ver != values[1] {
-			t.Fatalf("Expected serverHeader.Ver for %q to equal %q, got %q", header, values[1], serverHeader.Ver)
-		}
-
-		if serverHeader.OS != values[2] {
-			t.Fatalf("Expected serverHeader.OS for %q to equal %q, got %q", header, values[2], serverHeader.OS)
-		}
-
-	}
-
-}
diff --git a/components/engine/pkg/httputils/mimetype_test.go b/components/engine/pkg/httputils/mimetype_test.go
deleted file mode 100644
index a6cc047db8..0000000000
--- a/components/engine/pkg/httputils/mimetype_test.go
+++ /dev/null
@@ -1,13 +0,0 @@
-package httputils
-
-import (
-	"testing"
-)
-
-func TestDetectContentType(t *testing.T) {
-	input := []byte("That is just a plain text")
-
-	if contentType, _, err := DetectContentType(input); err != nil || contentType != "text/plain" {
-		t.Error("TestDetectContentType failed")
-	}
-}
diff --git a/components/engine/pkg/idtools/idtools.go b/components/engine/pkg/idtools/idtools.go
index 6bca466286..68a072db22 100644
--- a/components/engine/pkg/idtools/idtools.go
+++ b/components/engine/pkg/idtools/idtools.go
@@ -37,49 +37,56 @@ const (
 // MkdirAllAs creates a directory (include any along the path) and then modifies
 // ownership to the requested uid/gid.  If the directory already exists, this
 // function will still change ownership to the requested uid/gid pair.
+// Deprecated: Use MkdirAllAndChown
 func MkdirAllAs(path string, mode os.FileMode, ownerUID, ownerGID int) error {
 	return mkdirAs(path, mode, ownerUID, ownerGID, true, true)
 }
 
-// MkdirAllNewAs creates a directory (include any along the path) and then modifies
-// ownership ONLY of newly created directories to the requested uid/gid. If the
-// directories along the path exist, no change of ownership will be performed
-func MkdirAllNewAs(path string, mode os.FileMode, ownerUID, ownerGID int) error {
-	return mkdirAs(path, mode, ownerUID, ownerGID, true, false)
-}
-
 // MkdirAs creates a directory and then modifies ownership to the requested uid/gid.
 // If the directory already exists, this function still changes ownership
+// Deprecated: Use MkdirAndChown with a IDPair
 func MkdirAs(path string, mode os.FileMode, ownerUID, ownerGID int) error {
 	return mkdirAs(path, mode, ownerUID, ownerGID, false, true)
 }
 
+// MkdirAllAndChown creates a directory (include any along the path) and then modifies
+// ownership to the requested uid/gid.  If the directory already exists, this
+// function will still change ownership to the requested uid/gid pair.
+func MkdirAllAndChown(path string, mode os.FileMode, ids IDPair) error {
+	return mkdirAs(path, mode, ids.UID, ids.GID, true, true)
+}
+
+// MkdirAndChown creates a directory and then modifies ownership to the requested uid/gid.
+// If the directory already exists, this function still changes ownership
+func MkdirAndChown(path string, mode os.FileMode, ids IDPair) error {
+	return mkdirAs(path, mode, ids.UID, ids.GID, false, true)
+}
+
+// MkdirAllAndChownNew creates a directory (include any along the path) and then modifies
+// ownership ONLY of newly created directories to the requested uid/gid. If the
+// directories along the path exist, no change of ownership will be performed
+func MkdirAllAndChownNew(path string, mode os.FileMode, ids IDPair) error {
+	return mkdirAs(path, mode, ids.UID, ids.GID, true, false)
+}
+
 // GetRootUIDGID retrieves the remapped root uid/gid pair from the set of maps.
 // If the maps are empty, then the root uid/gid will default to "real" 0/0
 func GetRootUIDGID(uidMap, gidMap []IDMap) (int, int, error) {
-	var uid, gid int
-
-	if uidMap != nil {
-		xUID, err := ToHost(0, uidMap)
-		if err != nil {
-			return -1, -1, err
-		}
-		uid = xUID
+	uid, err := toHost(0, uidMap)
+	if err != nil {
+		return -1, -1, err
 	}
-	if gidMap != nil {
-		xGID, err := ToHost(0, gidMap)
-		if err != nil {
-			return -1, -1, err
-		}
-		gid = xGID
+	gid, err := toHost(0, gidMap)
+	if err != nil {
+		return -1, -1, err
 	}
 	return uid, gid, nil
 }
 
-// ToContainer takes an id mapping, and uses it to translate a
+// toContainer takes an id mapping, and uses it to translate a
 // host ID to the remapped ID. If no map is provided, then the translation
 // assumes a 1-to-1 mapping and returns the passed in id
-func ToContainer(hostID int, idMap []IDMap) (int, error) {
+func toContainer(hostID int, idMap []IDMap) (int, error) {
 	if idMap == nil {
 		return hostID, nil
 	}
@@ -92,10 +99,10 @@ func ToContainer(hostID int, idMap []IDMap) (int, error) {
 	return -1, fmt.Errorf("Host ID %d cannot be mapped to a container ID", hostID)
 }
 
-// ToHost takes an id mapping and a remapped ID, and translates the
+// toHost takes an id mapping and a remapped ID, and translates the
 // ID to the mapped host ID. If no map is provided, then the translation
 // assumes a 1-to-1 mapping and returns the passed in id #
-func ToHost(contID int, idMap []IDMap) (int, error) {
+func toHost(contID int, idMap []IDMap) (int, error) {
 	if idMap == nil {
 		return contID, nil
 	}
@@ -108,26 +115,101 @@ func ToHost(contID int, idMap []IDMap) (int, error) {
 	return -1, fmt.Errorf("Container ID %d cannot be mapped to a host ID", contID)
 }
 
-// CreateIDMappings takes a requested user and group name and
+// IDPair is a UID and GID pair
+type IDPair struct {
+	UID int
+	GID int
+}
+
+// IDMappings contains a mappings of UIDs and GIDs
+type IDMappings struct {
+	uids []IDMap
+	gids []IDMap
+}
+
+// NewIDMappings takes a requested user and group name and
 // using the data from /etc/sub{uid,gid} ranges, creates the
 // proper uid and gid remapping ranges for that user/group pair
-func CreateIDMappings(username, groupname string) ([]IDMap, []IDMap, error) {
+func NewIDMappings(username, groupname string) (*IDMappings, error) {
 	subuidRanges, err := parseSubuid(username)
 	if err != nil {
-		return nil, nil, err
+		return nil, err
 	}
 	subgidRanges, err := parseSubgid(groupname)
 	if err != nil {
-		return nil, nil, err
+		return nil, err
 	}
 	if len(subuidRanges) == 0 {
-		return nil, nil, fmt.Errorf("No subuid ranges found for user %q", username)
+		return nil, fmt.Errorf("No subuid ranges found for user %q", username)
 	}
 	if len(subgidRanges) == 0 {
-		return nil, nil, fmt.Errorf("No subgid ranges found for group %q", groupname)
+		return nil, fmt.Errorf("No subgid ranges found for group %q", groupname)
 	}
 
-	return createIDMap(subuidRanges), createIDMap(subgidRanges), nil
+	return &IDMappings{
+		uids: createIDMap(subuidRanges),
+		gids: createIDMap(subgidRanges),
+	}, nil
+}
+
+// NewIDMappingsFromMaps creates a new mapping from two slices
+// Deprecated: this is a temporary shim while transitioning to IDMapping
+func NewIDMappingsFromMaps(uids []IDMap, gids []IDMap) *IDMappings {
+	return &IDMappings{uids: uids, gids: gids}
+}
+
+// RootPair returns a uid and gid pair for the root user. The error is ignored
+// because a root user always exists, and the defaults are correct when the uid
+// and gid maps are empty.
+func (i *IDMappings) RootPair() IDPair {
+	uid, gid, _ := GetRootUIDGID(i.uids, i.gids)
+	return IDPair{UID: uid, GID: gid}
+}
+
+// ToHost returns the host UID and GID for the container uid, gid.
+// Remapping is only performed if the ids aren't already the remapped root ids
+func (i *IDMappings) ToHost(pair IDPair) (IDPair, error) {
+	var err error
+	target := i.RootPair()
+
+	if pair.UID != target.UID {
+		target.UID, err = toHost(pair.UID, i.uids)
+		if err != nil {
+			return target, err
+		}
+	}
+
+	if pair.GID != target.GID {
+		target.GID, err = toHost(pair.GID, i.gids)
+	}
+	return target, err
+}
+
+// ToContainer returns the container UID and GID for the host uid and gid
+func (i *IDMappings) ToContainer(pair IDPair) (int, int, error) {
+	uid, err := toContainer(pair.UID, i.uids)
+	if err != nil {
+		return -1, -1, err
+	}
+	gid, err := toContainer(pair.GID, i.gids)
+	return uid, gid, err
+}
+
+// Empty returns true if there are no id mappings
+func (i *IDMappings) Empty() bool {
+	return len(i.uids) == 0 && len(i.gids) == 0
+}
+
+// UIDs return the UID mapping
+// TODO: remove this once everything has been refactored to use pairs
+func (i *IDMappings) UIDs() []IDMap {
+	return i.uids
+}
+
+// GIDs return the UID mapping
+// TODO: remove this once everything has been refactored to use pairs
+func (i *IDMappings) GIDs() []IDMap {
+	return i.gids
 }
 
 func createIDMap(subidRanges ranges) []IDMap {
diff --git a/components/engine/pkg/idtools/idtools_unix.go b/components/engine/pkg/idtools/idtools_unix.go
index 7c7e82aee2..8701bb7fa9 100644
--- a/components/engine/pkg/idtools/idtools_unix.go
+++ b/components/engine/pkg/idtools/idtools_unix.go
@@ -49,7 +49,7 @@ func mkdirAs(path string, mode os.FileMode, ownerUID, ownerGID int, mkAll, chown
 				paths = append(paths, dirPath)
 			}
 		}
-		if err := system.MkdirAll(path, mode); err != nil && !os.IsExist(err) {
+		if err := system.MkdirAll(path, mode, ""); err != nil && !os.IsExist(err) {
 			return err
 		}
 	} else {
@@ -69,15 +69,15 @@ func mkdirAs(path string, mode os.FileMode, ownerUID, ownerGID int, mkAll, chown
 
 // CanAccess takes a valid (existing) directory and a uid, gid pair and determines
 // if that uid, gid pair has access (execute bit) to the directory
-func CanAccess(path string, uid, gid int) bool {
+func CanAccess(path string, pair IDPair) bool {
 	statInfo, err := system.Stat(path)
 	if err != nil {
 		return false
 	}
 	fileMode := os.FileMode(statInfo.Mode())
 	permBits := fileMode.Perm()
-	return accessible(statInfo.UID() == uint32(uid),
-		statInfo.GID() == uint32(gid), permBits)
+	return accessible(statInfo.UID() == uint32(pair.UID),
+		statInfo.GID() == uint32(pair.GID), permBits)
 }
 
 func accessible(isOwner, isGroup bool, perms os.FileMode) bool {
diff --git a/components/engine/pkg/idtools/idtools_unix_test.go b/components/engine/pkg/idtools/idtools_unix_test.go
index 540d3079ee..31522a547d 100644
--- a/components/engine/pkg/idtools/idtools_unix_test.go
+++ b/components/engine/pkg/idtools/idtools_unix_test.go
@@ -9,6 +9,8 @@ import (
 	"path/filepath"
 	"syscall"
 	"testing"
+
+	"github.com/stretchr/testify/require"
 )
 
 type node struct {
@@ -76,12 +78,9 @@ func TestMkdirAllAs(t *testing.T) {
 	}
 }
 
-func TestMkdirAllNewAs(t *testing.T) {
-
+func TestMkdirAllAndChownNew(t *testing.T) {
 	dirName, err := ioutil.TempDir("", "mkdirnew")
-	if err != nil {
-		t.Fatalf("Couldn't create temp dir: %v", err)
-	}
+	require.NoError(t, err)
 	defer os.RemoveAll(dirName)
 
 	testTree := map[string]node{
@@ -91,49 +90,32 @@ func TestMkdirAllNewAs(t *testing.T) {
 		"lib/x86_64":       {45, 45},
 		"lib/x86_64/share": {1, 1},
 	}
-
-	if err := buildTree(dirName, testTree); err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, buildTree(dirName, testTree))
 
 	// test adding a directory to a pre-existing dir; only the new dir is owned by the uid/gid
-	if err := MkdirAllNewAs(filepath.Join(dirName, "usr", "share"), 0755, 99, 99); err != nil {
-		t.Fatal(err)
-	}
+	err = MkdirAllAndChownNew(filepath.Join(dirName, "usr", "share"), 0755, IDPair{99, 99})
+	require.NoError(t, err)
+
 	testTree["usr/share"] = node{99, 99}
 	verifyTree, err := readTree(dirName, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := compareTrees(testTree, verifyTree); err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
+	require.NoError(t, compareTrees(testTree, verifyTree))
 
 	// test 2-deep new directories--both should be owned by the uid/gid pair
-	if err := MkdirAllNewAs(filepath.Join(dirName, "lib", "some", "other"), 0755, 101, 101); err != nil {
-		t.Fatal(err)
-	}
+	err = MkdirAllAndChownNew(filepath.Join(dirName, "lib", "some", "other"), 0755, IDPair{101, 101})
+	require.NoError(t, err)
 	testTree["lib/some"] = node{101, 101}
 	testTree["lib/some/other"] = node{101, 101}
 	verifyTree, err = readTree(dirName, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := compareTrees(testTree, verifyTree); err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
+	require.NoError(t, compareTrees(testTree, verifyTree))
 
 	// test a directory that already exists; should NOT be chowned
-	if err := MkdirAllNewAs(filepath.Join(dirName, "usr"), 0755, 102, 102); err != nil {
-		t.Fatal(err)
-	}
+	err = MkdirAllAndChownNew(filepath.Join(dirName, "usr"), 0755, IDPair{102, 102})
+	require.NoError(t, err)
 	verifyTree, err = readTree(dirName, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := compareTrees(testTree, verifyTree); err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
+	require.NoError(t, compareTrees(testTree, verifyTree))
 }
 
 func TestMkdirAs(t *testing.T) {
diff --git a/components/engine/pkg/idtools/idtools_windows.go b/components/engine/pkg/idtools/idtools_windows.go
index 49f67e78c1..45d2878e38 100644
--- a/components/engine/pkg/idtools/idtools_windows.go
+++ b/components/engine/pkg/idtools/idtools_windows.go
@@ -11,7 +11,7 @@ import (
 // Platforms such as Windows do not support the UID/GID concept. So make this
 // just a wrapper around system.MkdirAll.
 func mkdirAs(path string, mode os.FileMode, ownerUID, ownerGID int, mkAll, chownExisting bool) error {
-	if err := system.MkdirAll(path, mode); err != nil && !os.IsExist(err) {
+	if err := system.MkdirAll(path, mode, ""); err != nil && !os.IsExist(err) {
 		return err
 	}
 	return nil
@@ -20,6 +20,6 @@ func mkdirAs(path string, mode os.FileMode, ownerUID, ownerGID int, mkAll, chown
 // CanAccess takes a valid (existing) directory and a uid, gid pair and determines
 // if that uid, gid pair has access (execute bit) to the directory
 // Windows does not require/support this function, so always return true
-func CanAccess(path string, uid, gid int) bool {
+func CanAccess(path string, pair IDPair) bool {
 	return true
 }
diff --git a/components/engine/pkg/namesgenerator/names-generator.go b/components/engine/pkg/namesgenerator/names-generator.go
index d732a4795f..2f869ed925 100644
--- a/components/engine/pkg/namesgenerator/names-generator.go
+++ b/components/engine/pkg/namesgenerator/names-generator.go
@@ -2,8 +2,7 @@ package namesgenerator
 
 import (
 	"fmt"
-
-	"github.com/docker/docker/pkg/random"
+	"math/rand"
 )
 
 var (
@@ -594,15 +593,14 @@ var (
 // formatted as "adjective_surname". For example 'focused_turing'. If retry is non-zero, a random
 // integer between 0 and 10 will be added to the end of the name, e.g `focused_turing3`
 func GetRandomName(retry int) string {
-	rnd := random.Rand
 begin:
-	name := fmt.Sprintf("%s_%s", left[rnd.Intn(len(left))], right[rnd.Intn(len(right))])
+	name := fmt.Sprintf("%s_%s", left[rand.Intn(len(left))], right[rand.Intn(len(right))])
 	if name == "boring_wozniak" /* Steve Wozniak is not boring */ {
 		goto begin
 	}
 
 	if retry > 0 {
-		name = fmt.Sprintf("%s%d", name, rnd.Intn(10))
+		name = fmt.Sprintf("%s%d", name, rand.Intn(10))
 	}
 	return name
 }
diff --git a/components/engine/pkg/pidfile/pidfile.go b/components/engine/pkg/pidfile/pidfile.go
index 88a195835c..0fc3997a11 100644
--- a/components/engine/pkg/pidfile/pidfile.go
+++ b/components/engine/pkg/pidfile/pidfile.go
@@ -37,7 +37,7 @@ func New(path string) (*PIDFile, error) {
 		return nil, err
 	}
 	// Note MkdirAll returns nil if a directory already exists
-	if err := system.MkdirAll(filepath.Dir(path), os.FileMode(0755)); err != nil {
+	if err := system.MkdirAll(filepath.Dir(path), os.FileMode(0755), ""); err != nil {
 		return nil, err
 	}
 	if err := ioutil.WriteFile(path, []byte(fmt.Sprintf("%d", os.Getpid())), 0644); err != nil {
diff --git a/components/engine/pkg/plugins/client.go b/components/engine/pkg/plugins/client.go
index 84103c7ae7..f221a46fcf 100644
--- a/components/engine/pkg/plugins/client.go
+++ b/components/engine/pkg/plugins/client.go
@@ -57,20 +57,20 @@ func NewClient(addr string, tlsConfig *tlsconfig.Options) (*Client, error) {
 }
 
 // NewClientWithTimeout creates a new plugin client (http).
-func NewClientWithTimeout(addr string, tlsConfig *tlsconfig.Options, timeoutInSecs int) (*Client, error) {
+func NewClientWithTimeout(addr string, tlsConfig *tlsconfig.Options, timeout time.Duration) (*Client, error) {
 	clientTransport, err := newTransport(addr, tlsConfig)
 	if err != nil {
 		return nil, err
 	}
-	return newClientWithTransport(clientTransport, timeoutInSecs), nil
+	return newClientWithTransport(clientTransport, timeout), nil
 }
 
 // newClientWithTransport creates a new plugin client with a given transport.
-func newClientWithTransport(tr transport.Transport, timeoutInSecs int) *Client {
+func newClientWithTransport(tr transport.Transport, timeout time.Duration) *Client {
 	return &Client{
 		http: &http.Client{
 			Transport: tr,
-			Timeout:   time.Duration(timeoutInSecs) * time.Second,
+			Timeout:   timeout,
 		},
 		requestFactory: tr,
 	}
diff --git a/components/engine/pkg/plugins/client_test.go b/components/engine/pkg/plugins/client_test.go
index fc583fe0c2..7c519a2765 100644
--- a/components/engine/pkg/plugins/client_test.go
+++ b/components/engine/pkg/plugins/client_test.go
@@ -1,17 +1,19 @@
 package plugins
 
 import (
+	"bytes"
+	"encoding/json"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
-	"reflect"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/docker/docker/pkg/plugins/transport"
 	"github.com/docker/go-connections/tlsconfig"
+	"github.com/stretchr/testify/assert"
 )
 
 var (
@@ -83,9 +85,7 @@ func TestEchoInputOutput(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if !reflect.DeepEqual(output, m) {
-		t.Fatalf("Expected %v, was %v\n", m, output)
-	}
+	assert.Equal(t, m, output)
 	err = c.Call("Test.Echo", nil, nil)
 	if err != nil {
 		t.Fatal(err)
@@ -153,3 +153,82 @@ func TestClientScheme(t *testing.T) {
 		}
 	}
 }
+
+func TestNewClientWithTimeout(t *testing.T) {
+	addr := setupRemotePluginServer()
+	defer teardownRemotePluginServer()
+
+	m := Manifest{[]string{"VolumeDriver", "NetworkDriver"}}
+
+	mux.HandleFunc("/Test.Echo", func(w http.ResponseWriter, r *http.Request) {
+		time.Sleep(time.Duration(600) * time.Millisecond)
+		io.Copy(w, r.Body)
+	})
+
+	// setting timeout of 500ms
+	timeout := time.Duration(500) * time.Millisecond
+	c, _ := NewClientWithTimeout(addr, &tlsconfig.Options{InsecureSkipVerify: true}, timeout)
+	var output Manifest
+	err := c.Call("Test.Echo", m, &output)
+	if err == nil {
+		t.Fatal("Expected timeout error")
+	}
+}
+
+func TestClientStream(t *testing.T) {
+	addr := setupRemotePluginServer()
+	defer teardownRemotePluginServer()
+
+	m := Manifest{[]string{"VolumeDriver", "NetworkDriver"}}
+	var output Manifest
+
+	mux.HandleFunc("/Test.Echo", func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "POST" {
+			t.Fatalf("Expected POST, got %s", r.Method)
+		}
+
+		header := w.Header()
+		header.Set("Content-Type", transport.VersionMimetype)
+
+		io.Copy(w, r.Body)
+	})
+
+	c, _ := NewClient(addr, &tlsconfig.Options{InsecureSkipVerify: true})
+	body, err := c.Stream("Test.Echo", m)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer body.Close()
+	if err := json.NewDecoder(body).Decode(&output); err != nil {
+		t.Fatalf("Test.Echo: error reading plugin resp: %v", err)
+	}
+	assert.Equal(t, m, output)
+}
+
+func TestClientSendFile(t *testing.T) {
+	addr := setupRemotePluginServer()
+	defer teardownRemotePluginServer()
+
+	m := Manifest{[]string{"VolumeDriver", "NetworkDriver"}}
+	var output Manifest
+	var buf bytes.Buffer
+	if err := json.NewEncoder(&buf).Encode(m); err != nil {
+		t.Fatal(err)
+	}
+	mux.HandleFunc("/Test.Echo", func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "POST" {
+			t.Fatalf("Expected POST, got %s\n", r.Method)
+		}
+
+		header := w.Header()
+		header.Set("Content-Type", transport.VersionMimetype)
+
+		io.Copy(w, r.Body)
+	})
+
+	c, _ := NewClient(addr, &tlsconfig.Options{InsecureSkipVerify: true})
+	if err := c.SendFile("Test.Echo", &buf, &output); err != nil {
+		t.Fatal(err)
+	}
+	assert.Equal(t, m, output)
+}
diff --git a/components/engine/pkg/plugins/discovery_unix_test.go b/components/engine/pkg/plugins/discovery_unix_test.go
index 1b232b7ade..66f50353c3 100644
--- a/components/engine/pkg/plugins/discovery_unix_test.go
+++ b/components/engine/pkg/plugins/discovery_unix_test.go
@@ -4,6 +4,7 @@ package plugins
 
 import (
 	"fmt"
+	"io/ioutil"
 	"net"
 	"os"
 	"path/filepath"
@@ -59,3 +60,41 @@ func TestLocalSocket(t *testing.T) {
 		l.Close()
 	}
 }
+
+func TestScan(t *testing.T) {
+	tmpdir, unregister := Setup(t)
+	defer unregister()
+
+	pluginNames, err := Scan()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if pluginNames != nil {
+		t.Fatal("Plugin names should be empty.")
+	}
+
+	path := filepath.Join(tmpdir, "echo.spec")
+	addr := "unix://var/lib/docker/plugins/echo.sock"
+	name := "echo"
+
+	err = os.MkdirAll(filepath.Dir(path), 0755)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = ioutil.WriteFile(path, []byte(addr), 0644)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := newLocalRegistry()
+	p, err := r.Plugin(name)
+
+	pluginNamesNotEmpty, err := Scan()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p.Name() != pluginNamesNotEmpty[0] {
+		t.Fatalf("Unable to scan plugin with name %s", p.name)
+	}
+}
diff --git a/components/engine/pkg/plugins/plugin_test.go b/components/engine/pkg/plugins/plugin_test.go
index b19c0d52f1..00fcb85f58 100644
--- a/components/engine/pkg/plugins/plugin_test.go
+++ b/components/engine/pkg/plugins/plugin_test.go
@@ -1,12 +1,26 @@
 package plugins
 
 import (
+	"bytes"
+	"encoding/json"
 	"errors"
+	"io"
+	"io/ioutil"
+	"net/http"
 	"path/filepath"
 	"runtime"
 	"sync"
 	"testing"
 	"time"
+
+	"github.com/docker/docker/pkg/plugins/transport"
+	"github.com/docker/go-connections/tlsconfig"
+	"github.com/stretchr/testify/assert"
+)
+
+const (
+	fruitPlugin     = "fruit"
+	fruitImplements = "apple"
 )
 
 // regression test for deadlock in handlers
@@ -42,3 +56,101 @@ func testActive(t *testing.T, p *Plugin) {
 	}
 
 }
+
+func TestGet(t *testing.T) {
+	p := &Plugin{name: fruitPlugin, activateWait: sync.NewCond(&sync.Mutex{})}
+	p.Manifest = &Manifest{Implements: []string{fruitImplements}}
+	storage.plugins[fruitPlugin] = p
+
+	plugin, err := Get(fruitPlugin, fruitImplements)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p.Name() != plugin.Name() {
+		t.Fatalf("No matching plugin with name %s found", plugin.Name())
+	}
+	if plugin.Client() != nil {
+		t.Fatal("expected nil Client but found one")
+	}
+	if !plugin.IsV1() {
+		t.Fatal("Expected true for V1 plugin")
+	}
+
+	// check negative case where plugin fruit doesn't implement banana
+	_, err = Get("fruit", "banana")
+	assert.Equal(t, err, ErrNotImplements)
+
+	// check negative case where plugin vegetable doesn't exist
+	_, err = Get("vegetable", "potato")
+	assert.Equal(t, err, ErrNotFound)
+
+}
+
+func TestPluginWithNoManifest(t *testing.T) {
+	addr := setupRemotePluginServer()
+	defer teardownRemotePluginServer()
+
+	m := Manifest{[]string{fruitImplements}}
+	var buf bytes.Buffer
+	if err := json.NewEncoder(&buf).Encode(m); err != nil {
+		t.Fatal(err)
+	}
+
+	mux.HandleFunc("/Plugin.Activate", func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "POST" {
+			t.Fatalf("Expected POST, got %s\n", r.Method)
+		}
+
+		header := w.Header()
+		header.Set("Content-Type", transport.VersionMimetype)
+
+		io.Copy(w, &buf)
+	})
+
+	p := &Plugin{
+		name:         fruitPlugin,
+		activateWait: sync.NewCond(&sync.Mutex{}),
+		Addr:         addr,
+		TLSConfig:    &tlsconfig.Options{InsecureSkipVerify: true},
+	}
+	storage.plugins[fruitPlugin] = p
+
+	plugin, err := Get(fruitPlugin, fruitImplements)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p.Name() != plugin.Name() {
+		t.Fatalf("No matching plugin with name %s found", plugin.Name())
+	}
+}
+
+func TestGetAll(t *testing.T) {
+	tmpdir, unregister := Setup(t)
+	defer unregister()
+
+	p := filepath.Join(tmpdir, "example.json")
+	spec := `{
+	"Name": "example",
+	"Addr": "https://example.com/docker/plugin"
+}`
+
+	if err := ioutil.WriteFile(p, []byte(spec), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	r := newLocalRegistry()
+	plugin, err := r.Plugin("example")
+	if err != nil {
+		t.Fatal(err)
+	}
+	plugin.Manifest = &Manifest{Implements: []string{"apple"}}
+	storage.plugins["example"] = plugin
+
+	fetchedPlugins, err := GetAll("apple")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if fetchedPlugins[0].Name() != plugin.Name() {
+		t.Fatalf("Expected to get plugin with name %s", plugin.Name())
+	}
+}
diff --git a/components/engine/pkg/plugins/transport/http_test.go b/components/engine/pkg/plugins/transport/http_test.go
new file mode 100644
index 0000000000..b724fd0df0
--- /dev/null
+++ b/components/engine/pkg/plugins/transport/http_test.go
@@ -0,0 +1,20 @@
+package transport
+
+import (
+	"io"
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestHTTPTransport(t *testing.T) {
+	var r io.Reader
+	roundTripper := &http.Transport{}
+	newTransport := NewHTTPTransport(roundTripper, "http", "0.0.0.0")
+	request, err := newTransport.NewRequest("", r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	assert.Equal(t, "POST", request.Method)
+}
diff --git a/components/engine/pkg/pools/pools.go b/components/engine/pkg/pools/pools.go
index 5c5aead698..6a111a3ba7 100644
--- a/components/engine/pkg/pools/pools.go
+++ b/components/engine/pkg/pools/pools.go
@@ -17,15 +17,16 @@ import (
 	"github.com/docker/docker/pkg/ioutils"
 )
 
+const buffer32K = 32 * 1024
+
 var (
 	// BufioReader32KPool is a pool which returns bufio.Reader with a 32K buffer.
 	BufioReader32KPool = newBufioReaderPoolWithSize(buffer32K)
 	// BufioWriter32KPool is a pool which returns bufio.Writer with a 32K buffer.
 	BufioWriter32KPool = newBufioWriterPoolWithSize(buffer32K)
+	buffer32KPool      = newBufferPoolWithSize(buffer32K)
 )
 
-const buffer32K = 32 * 1024
-
 // BufioReaderPool is a bufio reader that uses sync.Pool.
 type BufioReaderPool struct {
 	pool sync.Pool
@@ -54,11 +55,31 @@ func (bufPool *BufioReaderPool) Put(b *bufio.Reader) {
 	bufPool.pool.Put(b)
 }
 
+type bufferPool struct {
+	pool sync.Pool
+}
+
+func newBufferPoolWithSize(size int) *bufferPool {
+	return &bufferPool{
+		pool: sync.Pool{
+			New: func() interface{} { return make([]byte, size) },
+		},
+	}
+}
+
+func (bp *bufferPool) Get() []byte {
+	return bp.pool.Get().([]byte)
+}
+
+func (bp *bufferPool) Put(b []byte) {
+	bp.pool.Put(b)
+}
+
 // Copy is a convenience wrapper which uses a buffer to avoid allocation in io.Copy.
 func Copy(dst io.Writer, src io.Reader) (written int64, err error) {
-	buf := BufioReader32KPool.Get(src)
-	written, err = io.Copy(dst, buf)
-	BufioReader32KPool.Put(buf)
+	buf := buffer32KPool.Get()
+	written, err = io.CopyBuffer(dst, src, buf)
+	buffer32KPool.Put(buf)
 	return
 }
 
diff --git a/components/engine/pkg/pools/pools_test.go b/components/engine/pkg/pools/pools_test.go
index 1661b780c9..d71cb99ac7 100644
--- a/components/engine/pkg/pools/pools_test.go
+++ b/components/engine/pkg/pools/pools_test.go
@@ -159,3 +159,8 @@ func TestNewWriteCloserWrapperWithAWriteCloser(t *testing.T) {
 		t.Fatalf("The ReaderCloser should have been closed, it is not.")
 	}
 }
+
+func TestBufferPoolPutAndGet(t *testing.T) {
+	buf := buffer32KPool.Get()
+	buffer32KPool.Put(buf)
+}
diff --git a/components/engine/pkg/promise/promise_test.go b/components/engine/pkg/promise/promise_test.go
new file mode 100644
index 0000000000..287213b504
--- /dev/null
+++ b/components/engine/pkg/promise/promise_test.go
@@ -0,0 +1,25 @@
+package promise
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGo(t *testing.T) {
+	errCh := Go(functionWithError)
+	er := <-errCh
+	require.EqualValues(t, "Error Occurred", er.Error())
+
+	noErrCh := Go(functionWithNoError)
+	er = <-noErrCh
+	require.Nil(t, er)
+}
+
+func functionWithError() (err error) {
+	return errors.New("Error Occurred")
+}
+func functionWithNoError() (err error) {
+	return nil
+}
diff --git a/components/engine/pkg/random/random.go b/components/engine/pkg/random/random.go
deleted file mode 100644
index 70de4d1304..0000000000
--- a/components/engine/pkg/random/random.go
+++ /dev/null
@@ -1,71 +0,0 @@
-package random
-
-import (
-	cryptorand "crypto/rand"
-	"io"
-	"math"
-	"math/big"
-	"math/rand"
-	"sync"
-	"time"
-)
-
-// Rand is a global *rand.Rand instance, which initialized with NewSource() source.
-var Rand = rand.New(NewSource())
-
-// Reader is a global, shared instance of a pseudorandom bytes generator.
-// It doesn't consume entropy.
-var Reader io.Reader = &reader{rnd: Rand}
-
-// copypaste from standard math/rand
-type lockedSource struct {
-	lk  sync.Mutex
-	src rand.Source
-}
-
-func (r *lockedSource) Int63() (n int64) {
-	r.lk.Lock()
-	n = r.src.Int63()
-	r.lk.Unlock()
-	return
-}
-
-func (r *lockedSource) Seed(seed int64) {
-	r.lk.Lock()
-	r.src.Seed(seed)
-	r.lk.Unlock()
-}
-
-// NewSource returns math/rand.Source safe for concurrent use and initialized
-// with current unix-nano timestamp
-func NewSource() rand.Source {
-	var seed int64
-	if cryptoseed, err := cryptorand.Int(cryptorand.Reader, big.NewInt(math.MaxInt64)); err != nil {
-		// This should not happen, but worst-case fallback to time-based seed.
-		seed = time.Now().UnixNano()
-	} else {
-		seed = cryptoseed.Int64()
-	}
-	return &lockedSource{
-		src: rand.NewSource(seed),
-	}
-}
-
-type reader struct {
-	rnd *rand.Rand
-}
-
-func (r *reader) Read(b []byte) (int, error) {
-	i := 0
-	for {
-		val := r.rnd.Int63()
-		for val > 0 {
-			b[i] = byte(val)
-			i++
-			if i == len(b) {
-				return i, nil
-			}
-			val >>= 8
-		}
-	}
-}
diff --git a/components/engine/pkg/random/random_test.go b/components/engine/pkg/random/random_test.go
deleted file mode 100644
index cf405f78cb..0000000000
--- a/components/engine/pkg/random/random_test.go
+++ /dev/null
@@ -1,22 +0,0 @@
-package random
-
-import (
-	"math/rand"
-	"sync"
-	"testing"
-)
-
-// for go test -v -race
-func TestConcurrency(t *testing.T) {
-	rnd := rand.New(NewSource())
-	var wg sync.WaitGroup
-
-	for i := 0; i < 10; i++ {
-		wg.Add(1)
-		go func() {
-			rnd.Int63()
-			wg.Done()
-		}()
-	}
-	wg.Wait()
-}
diff --git a/components/engine/pkg/reexec/reexec_test.go b/components/engine/pkg/reexec/reexec_test.go
new file mode 100644
index 0000000000..39e87a4a27
--- /dev/null
+++ b/components/engine/pkg/reexec/reexec_test.go
@@ -0,0 +1,53 @@
+package reexec
+
+import (
+	"os"
+	"os/exec"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func init() {
+	Register("reexec", func() {
+		panic("Return Error")
+	})
+	Init()
+}
+
+func TestRegister(t *testing.T) {
+	defer func() {
+		if r := recover(); r != nil {
+			require.Equal(t, `reexec func already registered under name "reexec"`, r)
+		}
+	}()
+	Register("reexec", func() {})
+}
+
+func TestCommand(t *testing.T) {
+	cmd := Command("reexec")
+	w, err := cmd.StdinPipe()
+	require.NoError(t, err, "Error on pipe creation: %v", err)
+	defer w.Close()
+
+	err = cmd.Start()
+	require.NoError(t, err, "Error on re-exec cmd: %v", err)
+	err = cmd.Wait()
+	require.EqualError(t, err, "exit status 2")
+}
+
+func TestNaiveSelf(t *testing.T) {
+	if os.Getenv("TEST_CHECK") == "1" {
+		os.Exit(2)
+	}
+	cmd := exec.Command(naiveSelf(), "-test.run=TestNaiveSelf")
+	cmd.Env = append(os.Environ(), "TEST_CHECK=1")
+	err := cmd.Start()
+	require.NoError(t, err, "Unable to start command")
+	err = cmd.Wait()
+	require.EqualError(t, err, "exit status 2")
+
+	os.Args[0] = "mkdir"
+	assert.NotEqual(t, naiveSelf(), os.Args[0])
+}
diff --git a/components/engine/pkg/signal/signal_linux_test.go b/components/engine/pkg/signal/signal_linux_test.go
new file mode 100644
index 0000000000..32c056fe49
--- /dev/null
+++ b/components/engine/pkg/signal/signal_linux_test.go
@@ -0,0 +1,58 @@
+// +build darwin linux solaris
+
+package signal
+
+import (
+	"os"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCatchAll(t *testing.T) {
+	sigs := make(chan os.Signal, 1)
+	CatchAll(sigs)
+	defer StopCatch(sigs)
+
+	listOfSignals := map[string]string{
+		"CONT": syscall.SIGCONT.String(),
+		"HUP":  syscall.SIGHUP.String(),
+		"CHLD": syscall.SIGCHLD.String(),
+		"ILL":  syscall.SIGILL.String(),
+		"FPE":  syscall.SIGFPE.String(),
+		"CLD":  syscall.SIGCLD.String(),
+	}
+
+	for sigStr := range listOfSignals {
+		signal, ok := SignalMap[sigStr]
+		if ok {
+			go func() {
+				time.Sleep(1 * time.Millisecond)
+				syscall.Kill(syscall.Getpid(), signal)
+			}()
+
+			s := <-sigs
+			assert.EqualValues(t, s.String(), signal.String())
+		}
+
+	}
+}
+
+func TestStopCatch(t *testing.T) {
+	signal, _ := SignalMap["HUP"]
+	channel := make(chan os.Signal, 1)
+	CatchAll(channel)
+	go func() {
+
+		time.Sleep(1 * time.Millisecond)
+		syscall.Kill(syscall.Getpid(), signal)
+	}()
+	signalString := <-channel
+	assert.EqualValues(t, signalString.String(), signal.String())
+
+	StopCatch(channel)
+	_, ok := <-channel
+	assert.EqualValues(t, ok, false)
+}
diff --git a/components/engine/pkg/signal/signal_test.go b/components/engine/pkg/signal/signal_test.go
new file mode 100644
index 0000000000..df02f5bed1
--- /dev/null
+++ b/components/engine/pkg/signal/signal_test.go
@@ -0,0 +1,33 @@
+package signal
+
+import (
+	"syscall"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestParseSignal(t *testing.T) {
+	_, checkAtoiError := ParseSignal("0")
+	assert.EqualError(t, checkAtoiError, "Invalid signal: 0")
+
+	_, error := ParseSignal("SIG")
+	assert.EqualError(t, error, "Invalid signal: SIG")
+
+	for sigStr := range SignalMap {
+		responseSignal, error := ParseSignal(sigStr)
+		assert.NoError(t, error)
+		signal := SignalMap[sigStr]
+		assert.EqualValues(t, signal, responseSignal)
+	}
+}
+
+func TestValidSignalForPlatform(t *testing.T) {
+	isValidSignal := ValidSignalForPlatform(syscall.Signal(0))
+	assert.EqualValues(t, false, isValidSignal)
+
+	for _, sigN := range SignalMap {
+		isValidSignal = ValidSignalForPlatform(syscall.Signal(sigN))
+		assert.EqualValues(t, true, isValidSignal)
+	}
+}
diff --git a/components/engine/pkg/streamformatter/streamformatter_test.go b/components/engine/pkg/streamformatter/streamformatter_test.go
index 8ebcc74ee5..c5c70d7e16 100644
--- a/components/engine/pkg/streamformatter/streamformatter_test.go
+++ b/components/engine/pkg/streamformatter/streamformatter_test.go
@@ -1,6 +1,7 @@
 package streamformatter
 
 import (
+	"bytes"
 	"encoding/json"
 	"errors"
 	"strings"
@@ -19,12 +20,12 @@ func TestRawProgressFormatterFormatStatus(t *testing.T) {
 
 func TestRawProgressFormatterFormatProgress(t *testing.T) {
 	sf := rawProgressFormatter{}
-	progress := &jsonmessage.JSONProgress{
+	jsonProgress := &jsonmessage.JSONProgress{
 		Current: 15,
 		Total:   30,
 		Start:   1,
 	}
-	res := sf.formatProgress("id", "action", progress, nil)
+	res := sf.formatProgress("id", "action", jsonProgress, nil)
 	out := string(res)
 	assert.True(t, strings.HasPrefix(out, "action [===="))
 	assert.Contains(t, out, "15B/30B")
@@ -52,24 +53,25 @@ func TestFormatJSONError(t *testing.T) {
 
 func TestJsonProgressFormatterFormatProgress(t *testing.T) {
 	sf := &jsonProgressFormatter{}
-	progress := &jsonmessage.JSONProgress{
+	jsonProgress := &jsonmessage.JSONProgress{
 		Current: 15,
 		Total:   30,
 		Start:   1,
 	}
-	res := sf.formatProgress("id", "action", progress, nil)
+	res := sf.formatProgress("id", "action", jsonProgress, &AuxFormatter{Writer: &bytes.Buffer{}})
 	msg := &jsonmessage.JSONMessage{}
+
 	require.NoError(t, json.Unmarshal(res, msg))
 	assert.Equal(t, "id", msg.ID)
 	assert.Equal(t, "action", msg.Status)
 
-	// The progress will always be in the format of:
+	// jsonProgress will always be in the format of:
 	// [=========================>                         ]      15B/30B 412910h51m30s
 	// The last entry '404933h7m11s' is the timeLeftBox.
-	// However, the timeLeftBox field may change as progress.String() depends on time.Now().
+	// However, the timeLeftBox field may change as jsonProgress.String() depends on time.Now().
 	// Therefore, we have to strip the timeLeftBox from the strings to do the comparison.
 
-	// Compare the progress strings before the timeLeftBox
+	// Compare the jsonProgress strings before the timeLeftBox
 	expectedProgress := "[=========================>                         ]      15B/30B"
 	// if terminal column is <= 110, expectedProgressShort is expected.
 	expectedProgressShort := "      15B/30B"
@@ -79,5 +81,29 @@ func TestJsonProgressFormatterFormatProgress(t *testing.T) {
 			expectedProgress, expectedProgressShort, msg.ProgressMessage)
 	}
 
-	assert.Equal(t, progress, msg.Progress)
+	assert.Equal(t, jsonProgress, msg.Progress)
+}
+
+func TestJsonProgressFormatterFormatStatus(t *testing.T) {
+	sf := jsonProgressFormatter{}
+	res := sf.formatStatus("ID", "%s%d", "a", 1)
+	assert.Equal(t, `{"status":"a1","id":"ID"}`+streamNewline, string(res))
+}
+
+func TestNewJSONProgressOutput(t *testing.T) {
+	b := bytes.Buffer{}
+	b.Write(FormatStatus("id", "Downloading"))
+	_ = NewJSONProgressOutput(&b, false)
+	assert.Equal(t, `{"status":"Downloading","id":"id"}`+streamNewline, b.String())
+}
+
+func TestAuxFormatterEmit(t *testing.T) {
+	b := bytes.Buffer{}
+	aux := &AuxFormatter{Writer: &b}
+	sampleAux := &struct {
+		Data string
+	}{"Additional data"}
+	err := aux.Emit(sampleAux)
+	require.NoError(t, err)
+	assert.Equal(t, `{"aux":{"Data":"Additional data"}}`+streamNewline, b.String())
 }
diff --git a/components/engine/pkg/stringid/stringid.go b/components/engine/pkg/stringid/stringid.go
index 82f85596c7..a0c7c42a05 100644
--- a/components/engine/pkg/stringid/stringid.go
+++ b/components/engine/pkg/stringid/stringid.go
@@ -2,15 +2,17 @@
 package stringid
 
 import (
-	"crypto/rand"
+	cryptorand "crypto/rand"
 	"encoding/hex"
 	"fmt"
 	"io"
+	"math"
+	"math/big"
+	"math/rand"
 	"regexp"
 	"strconv"
 	"strings"
-
-	"github.com/docker/docker/pkg/random"
+	"time"
 )
 
 const shortLen = 12
@@ -39,12 +41,8 @@ func TruncateID(id string) string {
 	return id
 }
 
-func generateID(crypto bool) string {
+func generateID(r io.Reader) string {
 	b := make([]byte, 32)
-	r := random.Reader
-	if crypto {
-		r = rand.Reader
-	}
 	for {
 		if _, err := io.ReadFull(r, b); err != nil {
 			panic(err) // This shouldn't happen
@@ -62,14 +60,14 @@ func generateID(crypto bool) string {
 
 // GenerateRandomID returns a unique id.
 func GenerateRandomID() string {
-	return generateID(true)
+	return generateID(cryptorand.Reader)
 }
 
 // GenerateNonCryptoID generates unique id without using cryptographically
 // secure sources of random.
 // It helps you to save entropy.
 func GenerateNonCryptoID() string {
-	return generateID(false)
+	return generateID(readerFunc(rand.Read))
 }
 
 // ValidateID checks whether an ID string is a valid image ID.
@@ -79,3 +77,23 @@ func ValidateID(id string) error {
 	}
 	return nil
 }
+
+func init() {
+	// safely set the seed globally so we generate random ids. Tries to use a
+	// crypto seed before falling back to time.
+	var seed int64
+	if cryptoseed, err := cryptorand.Int(cryptorand.Reader, big.NewInt(math.MaxInt64)); err != nil {
+		// This should not happen, but worst-case fallback to time-based seed.
+		seed = time.Now().UnixNano()
+	} else {
+		seed = cryptoseed.Int64()
+	}
+
+	rand.Seed(seed)
+}
+
+type readerFunc func(p []byte) (int, error)
+
+func (fn readerFunc) Read(p []byte) (int, error) {
+	return fn(p)
+}
diff --git a/components/engine/pkg/stringutils/stringutils.go b/components/engine/pkg/stringutils/stringutils.go
index e17951bfc8..8c4c39875e 100644
--- a/components/engine/pkg/stringutils/stringutils.go
+++ b/components/engine/pkg/stringutils/stringutils.go
@@ -5,8 +5,6 @@ import (
 	"bytes"
 	"math/rand"
 	"strings"
-
-	"github.com/docker/docker/pkg/random"
 )
 
 // GenerateRandomAlphaOnlyString generates an alphabetical random string with length n.
@@ -15,7 +13,7 @@ func GenerateRandomAlphaOnlyString(n int) string {
 	letters := []byte("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
 	b := make([]byte, n)
 	for i := range b {
-		b[i] = letters[random.Rand.Intn(len(letters))]
+		b[i] = letters[rand.Intn(len(letters))]
 	}
 	return string(b)
 }
diff --git a/components/engine/pkg/sysinfo/sysinfo_linux_test.go b/components/engine/pkg/sysinfo/sysinfo_linux_test.go
index fae0fdffbb..77c54f27c9 100644
--- a/components/engine/pkg/sysinfo/sysinfo_linux_test.go
+++ b/components/engine/pkg/sysinfo/sysinfo_linux_test.go
@@ -5,30 +5,30 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"syscall"
 	"testing"
+
+	"github.com/stretchr/testify/require"
 )
 
 func TestReadProcBool(t *testing.T) {
 	tmpDir, err := ioutil.TempDir("", "test-sysinfo-proc")
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 	defer os.RemoveAll(tmpDir)
 
 	procFile := filepath.Join(tmpDir, "read-proc-bool")
-	if err := ioutil.WriteFile(procFile, []byte("1"), 644); err != nil {
-		t.Fatal(err)
-	}
+	err = ioutil.WriteFile(procFile, []byte("1"), 0644)
+	require.NoError(t, err)
 
 	if !readProcBool(procFile) {
 		t.Fatal("expected proc bool to be true, got false")
 	}
 
-	if err := ioutil.WriteFile(procFile, []byte("0"), 644); err != nil {
+	if err := ioutil.WriteFile(procFile, []byte("0"), 0644); err != nil {
 		t.Fatal(err)
 	}
 	if readProcBool(procFile) {
-		t.Fatal("expected proc bool to be false, got false")
+		t.Fatal("expected proc bool to be false, got true")
 	}
 
 	if readProcBool(path.Join(tmpDir, "no-exist")) {
@@ -39,20 +39,66 @@ func TestReadProcBool(t *testing.T) {
 
 func TestCgroupEnabled(t *testing.T) {
 	cgroupDir, err := ioutil.TempDir("", "cgroup-test")
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 	defer os.RemoveAll(cgroupDir)
 
 	if cgroupEnabled(cgroupDir, "test") {
 		t.Fatal("cgroupEnabled should be false")
 	}
 
-	if err := ioutil.WriteFile(path.Join(cgroupDir, "test"), []byte{}, 644); err != nil {
-		t.Fatal(err)
-	}
+	err = ioutil.WriteFile(path.Join(cgroupDir, "test"), []byte{}, 0644)
+	require.NoError(t, err)
 
 	if !cgroupEnabled(cgroupDir, "test") {
 		t.Fatal("cgroupEnabled should be true")
 	}
 }
+
+func TestNew(t *testing.T) {
+	sysInfo := New(false)
+	require.NotNil(t, sysInfo)
+	checkSysInfo(t, sysInfo)
+
+	sysInfo = New(true)
+	require.NotNil(t, sysInfo)
+	checkSysInfo(t, sysInfo)
+}
+
+func checkSysInfo(t *testing.T, sysInfo *SysInfo) {
+	// Check if Seccomp is supported, via CONFIG_SECCOMP.then sysInfo.Seccomp must be TRUE , else FALSE
+	if _, _, err := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_GET_SECCOMP, 0, 0); err != syscall.EINVAL {
+		// Make sure the kernel has CONFIG_SECCOMP_FILTER.
+		if _, _, err := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_SECCOMP, SeccompModeFilter, 0); err != syscall.EINVAL {
+			require.True(t, sysInfo.Seccomp)
+		}
+	} else {
+		require.False(t, sysInfo.Seccomp)
+	}
+}
+
+func TestNewAppArmorEnabled(t *testing.T) {
+	// Check if AppArmor is supported. then it must be TRUE , else FALSE
+	if _, err := os.Stat("/sys/kernel/security/apparmor"); err != nil {
+		t.Skip("App Armor Must be Enabled")
+	}
+
+	sysInfo := New(true)
+	require.True(t, sysInfo.AppArmor)
+}
+
+func TestNewAppArmorDisabled(t *testing.T) {
+	// Check if AppArmor is supported. then it must be TRUE , else FALSE
+	if _, err := os.Stat("/sys/kernel/security/apparmor"); !os.IsNotExist(err) {
+		t.Skip("App Armor Must be Disabled")
+	}
+
+	sysInfo := New(true)
+	require.False(t, sysInfo.AppArmor)
+}
+
+func TestNumCPU(t *testing.T) {
+	cpuNumbers := NumCPU()
+	if cpuNumbers <= 0 {
+		t.Fatal("CPU returned must be greater than zero")
+	}
+}
diff --git a/components/engine/pkg/system/chtimes.go b/components/engine/pkg/system/chtimes.go
index 7637f12e1a..056d19954d 100644
--- a/components/engine/pkg/system/chtimes.go
+++ b/components/engine/pkg/system/chtimes.go
@@ -2,26 +2,9 @@ package system
 
 import (
 	"os"
-	"syscall"
 	"time"
-	"unsafe"
 )
 
-var (
-	maxTime time.Time
-)
-
-func init() {
-	if unsafe.Sizeof(syscall.Timespec{}.Nsec) == 8 {
-		// This is a 64 bit timespec
-		// os.Chtimes limits time to the following
-		maxTime = time.Unix(0, 1<<63-1)
-	} else {
-		// This is a 32 bit timespec
-		maxTime = time.Unix(1<<31-1, 0)
-	}
-}
-
 // Chtimes changes the access time and modified time of a file at the given path
 func Chtimes(name string, atime time.Time, mtime time.Time) error {
 	unixMinTime := time.Unix(0, 0)
diff --git a/components/engine/pkg/system/filesys.go b/components/engine/pkg/system/filesys.go
index 7aa920de1a..102565f760 100644
--- a/components/engine/pkg/system/filesys.go
+++ b/components/engine/pkg/system/filesys.go
@@ -8,15 +8,14 @@ import (
 	"path/filepath"
 )
 
-// MkdirAllWithACL is a wrapper for MkdirAll that creates a directory
-// ACL'd for Builtin Administrators and Local System.
-func MkdirAllWithACL(path string, perm os.FileMode) error {
-	return MkdirAll(path, perm)
+// MkdirAllWithACL is a wrapper for MkdirAll on unix systems.
+func MkdirAllWithACL(path string, perm os.FileMode, sddl string) error {
+	return MkdirAll(path, perm, sddl)
 }
 
 // MkdirAll creates a directory named path along with any necessary parents,
 // with permission specified by attribute perm for all dir created.
-func MkdirAll(path string, perm os.FileMode) error {
+func MkdirAll(path string, perm os.FileMode, sddl string) error {
 	return os.MkdirAll(path, perm)
 }
 
diff --git a/components/engine/pkg/system/filesys_windows.go b/components/engine/pkg/system/filesys_windows.go
index 626d2ad886..20117db919 100644
--- a/components/engine/pkg/system/filesys_windows.go
+++ b/components/engine/pkg/system/filesys_windows.go
@@ -16,21 +16,28 @@ import (
 	winio "github.com/Microsoft/go-winio"
 )
 
+const (
+	// SddlAdministratorsLocalSystem is local administrators plus NT AUTHORITY\System
+	SddlAdministratorsLocalSystem = "D:P(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)"
+	// SddlNtvmAdministratorsLocalSystem is NT VIRTUAL MACHINE\Virtual Machines plus local administrators plus NT AUTHORITY\System
+	SddlNtvmAdministratorsLocalSystem = "D:P(A;OICI;GA;;;S-1-5-83-0)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)"
+)
+
 // MkdirAllWithACL is a wrapper for MkdirAll that creates a directory
-// ACL'd for Builtin Administrators and Local System.
-func MkdirAllWithACL(path string, perm os.FileMode) error {
-	return mkdirall(path, true)
+// with an appropriate SDDL defined ACL.
+func MkdirAllWithACL(path string, perm os.FileMode, sddl string) error {
+	return mkdirall(path, true, sddl)
 }
 
 // MkdirAll implementation that is volume path aware for Windows.
-func MkdirAll(path string, _ os.FileMode) error {
-	return mkdirall(path, false)
+func MkdirAll(path string, _ os.FileMode, sddl string) error {
+	return mkdirall(path, false, sddl)
 }
 
 // mkdirall is a custom version of os.MkdirAll modified for use on Windows
 // so that it is both volume path aware, and can create a directory with
 // a DACL.
-func mkdirall(path string, adminAndLocalSystem bool) error {
+func mkdirall(path string, applyACL bool, sddl string) error {
 	if re := regexp.MustCompile(`^\\\\\?\\Volume{[a-z0-9-]+}$`); re.MatchString(path) {
 		return nil
 	}
@@ -64,15 +71,15 @@ func mkdirall(path string, adminAndLocalSystem bool) error {
 
 	if j > 1 {
 		// Create parent
-		err = mkdirall(path[0:j-1], false)
+		err = mkdirall(path[0:j-1], false, sddl)
 		if err != nil {
 			return err
 		}
 	}
 
 	// Parent now exists; invoke os.Mkdir or mkdirWithACL and use its result.
-	if adminAndLocalSystem {
-		err = mkdirWithACL(path)
+	if applyACL {
+		err = mkdirWithACL(path, sddl)
 	} else {
 		err = os.Mkdir(path, 0)
 	}
@@ -96,9 +103,9 @@ func mkdirall(path string, adminAndLocalSystem bool) error {
 // in golang to cater for creating a directory am ACL permitting full
 // access, with inheritance, to any subfolder/file for Built-in Administrators
 // and Local System.
-func mkdirWithACL(name string) error {
+func mkdirWithACL(name string, sddl string) error {
 	sa := syscall.SecurityAttributes{Length: 0}
-	sddl := "D:P(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)"
+
 	sd, err := winio.SddlToSecurityDescriptor(sddl)
 	if err != nil {
 		return &os.PathError{Op: "mkdir", Path: name, Err: err}
diff --git a/components/engine/pkg/system/init.go b/components/engine/pkg/system/init.go
new file mode 100644
index 0000000000..17935088de
--- /dev/null
+++ b/components/engine/pkg/system/init.go
@@ -0,0 +1,22 @@
+package system
+
+import (
+	"syscall"
+	"time"
+	"unsafe"
+)
+
+// Used by chtimes
+var maxTime time.Time
+
+func init() {
+	// chtimes initialization
+	if unsafe.Sizeof(syscall.Timespec{}.Nsec) == 8 {
+		// This is a 64 bit timespec
+		// os.Chtimes limits time to the following
+		maxTime = time.Unix(0, 1<<63-1)
+	} else {
+		// This is a 32 bit timespec
+		maxTime = time.Unix(1<<31-1, 0)
+	}
+}
diff --git a/components/engine/pkg/system/init_windows.go b/components/engine/pkg/system/init_windows.go
new file mode 100644
index 0000000000..019c66441c
--- /dev/null
+++ b/components/engine/pkg/system/init_windows.go
@@ -0,0 +1,17 @@
+package system
+
+import "os"
+
+// LCOWSupported determines if Linux Containers on Windows are supported.
+// Note: This feature is in development (06/17) and enabled through an
+// environment variable. At a future time, it will be enabled based
+// on build number. @jhowardmsft
+var lcowSupported = false
+
+func init() {
+	// LCOW initialization
+	if os.Getenv("LCOW_SUPPORTED") != "" {
+		lcowSupported = true
+	}
+
+}
diff --git a/components/engine/pkg/system/lcow_unix.go b/components/engine/pkg/system/lcow_unix.go
new file mode 100644
index 0000000000..cff33bb408
--- /dev/null
+++ b/components/engine/pkg/system/lcow_unix.go
@@ -0,0 +1,8 @@
+// +build !windows
+
+package system
+
+// LCOWSupported returns true if Linux containers on Windows are supported.
+func LCOWSupported() bool {
+	return false
+}
diff --git a/components/engine/pkg/system/lcow_windows.go b/components/engine/pkg/system/lcow_windows.go
new file mode 100644
index 0000000000..e54d01e696
--- /dev/null
+++ b/components/engine/pkg/system/lcow_windows.go
@@ -0,0 +1,6 @@
+package system
+
+// LCOWSupported returns true if Linux containers on Windows are supported.
+func LCOWSupported() bool {
+	return lcowSupported
+}
diff --git a/components/engine/pkg/system/path.go b/components/engine/pkg/system/path.go
new file mode 100644
index 0000000000..f634a6be67
--- /dev/null
+++ b/components/engine/pkg/system/path.go
@@ -0,0 +1,21 @@
+package system
+
+import "runtime"
+
+const defaultUnixPathEnv = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+// DefaultPathEnv is unix style list of directories to search for
+// executables. Each directory is separated from the next by a colon
+// ':' character .
+func DefaultPathEnv(platform string) string {
+	if runtime.GOOS == "windows" {
+		if platform != runtime.GOOS && LCOWSupported() {
+			return defaultUnixPathEnv
+		}
+		// Deliberately empty on Windows containers on Windows as the default path will be set by
+		// the container. Docker has no context of what the default path should be.
+		return ""
+	}
+	return defaultUnixPathEnv
+
+}
diff --git a/components/engine/pkg/system/path_unix.go b/components/engine/pkg/system/path_unix.go
index c607c4db09..f3762e69d3 100644
--- a/components/engine/pkg/system/path_unix.go
+++ b/components/engine/pkg/system/path_unix.go
@@ -2,11 +2,6 @@
 
 package system
 
-// DefaultPathEnv is unix style list of directories to search for
-// executables. Each directory is separated from the next by a colon
-// ':' character .
-const DefaultPathEnv = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-
 // CheckSystemDriveAndRemoveDriveLetter verifies that a path, if it includes a drive letter,
 // is the system drive. This is a no-op on Linux.
 func CheckSystemDriveAndRemoveDriveLetter(path string) (string, error) {
diff --git a/components/engine/pkg/system/path_windows.go b/components/engine/pkg/system/path_windows.go
index cbfe2c1576..3fc4744948 100644
--- a/components/engine/pkg/system/path_windows.go
+++ b/components/engine/pkg/system/path_windows.go
@@ -8,10 +8,6 @@ import (
 	"strings"
 )
 
-// DefaultPathEnv is deliberately empty on Windows as the default path will be set by
-// the container. Docker has no context of what the default path should be.
-const DefaultPathEnv = ""
-
 // CheckSystemDriveAndRemoveDriveLetter verifies and manipulates a Windows path.
 // This is used, for example, when validating a user provided path in docker cp.
 // If a drive letter is supplied, it must be the system drive. The drive letter
diff --git a/components/engine/pkg/system/syscall_windows.go b/components/engine/pkg/system/syscall_windows.go
index 1f311874f4..c328a6fb86 100644
--- a/components/engine/pkg/system/syscall_windows.go
+++ b/components/engine/pkg/system/syscall_windows.go
@@ -8,8 +8,9 @@ import (
 )
 
 var (
-	ntuserApiset      = syscall.NewLazyDLL("ext-ms-win-ntuser-window-l1-1-0")
-	procGetVersionExW = modkernel32.NewProc("GetVersionExW")
+	ntuserApiset       = syscall.NewLazyDLL("ext-ms-win-ntuser-window-l1-1-0")
+	procGetVersionExW  = modkernel32.NewProc("GetVersionExW")
+	procGetProductInfo = modkernel32.NewProc("GetProductInfo")
 )
 
 // OSVersion is a wrapper for Windows version information
@@ -66,6 +67,22 @@ func IsWindowsClient() bool {
 	return osviex.ProductType == verNTWorkstation
 }
 
+// IsIoTCore returns true if the currently running image is based off of
+// Windows 10 IoT Core.
+// @engine maintainers - this function should not be removed or modified as it
+// is used to enforce licensing restrictions on Windows.
+func IsIoTCore() bool {
+	var returnedProductType uint32
+	r1, _, err := procGetProductInfo.Call(6, 1, 0, 0, uintptr(unsafe.Pointer(&returnedProductType)))
+	if r1 == 0 {
+		logrus.Warnf("GetProductInfo failed - assuming this is not IoT: %v", err)
+		return false
+	}
+	const productIoTUAP = 0x0000007B
+	const productIoTUAPCommercial = 0x00000083
+	return returnedProductType == productIoTUAP || returnedProductType == productIoTUAPCommercial
+}
+
 // Unmount is a platform-specific helper function to call
 // the unmount syscall. Not supported on Windows
 func Unmount(dest string) error {
diff --git a/components/engine/pkg/term/proxy_test.go b/components/engine/pkg/term/proxy_test.go
new file mode 100644
index 0000000000..baba193d16
--- /dev/null
+++ b/components/engine/pkg/term/proxy_test.go
@@ -0,0 +1,92 @@
+package term
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestEscapeProxyRead(t *testing.T) {
+	escapeKeys, _ := ToBytes("DEL")
+	keys, _ := ToBytes("a,b,c,+")
+	reader := NewEscapeProxy(bytes.NewReader(keys), escapeKeys)
+	buf := make([]byte, len(keys))
+	nr, err := reader.Read(buf)
+	require.NoError(t, err)
+	require.EqualValues(t, nr, len(keys), fmt.Sprintf("nr %d should be equal to the number of %d", nr, len(keys)))
+	require.Equal(t, keys, buf, "keys & the read buffer should be equal")
+
+	keys, _ = ToBytes("")
+	reader = NewEscapeProxy(bytes.NewReader(keys), escapeKeys)
+	buf = make([]byte, len(keys))
+	nr, err = reader.Read(buf)
+	require.Error(t, err, "Should throw error when no keys are to read")
+	require.EqualValues(t, nr, 0, "nr should be zero")
+	require.Condition(t, func() (success bool) { return len(keys) == 0 && len(buf) == 0 }, "keys & the read buffer size should be zero")
+
+	escapeKeys, _ = ToBytes("ctrl-x,ctrl-@")
+	keys, _ = ToBytes("DEL")
+	reader = NewEscapeProxy(bytes.NewReader(keys), escapeKeys)
+	buf = make([]byte, len(keys))
+	nr, err = reader.Read(buf)
+	require.NoError(t, err)
+	require.EqualValues(t, nr, 1, fmt.Sprintf("nr %d should be equal to the number of 1", nr))
+	require.Equal(t, keys, buf, "keys & the read buffer should be equal")
+
+	escapeKeys, _ = ToBytes("ctrl-c")
+	keys, _ = ToBytes("ctrl-c")
+	reader = NewEscapeProxy(bytes.NewReader(keys), escapeKeys)
+	buf = make([]byte, len(keys))
+	nr, err = reader.Read(buf)
+	require.Condition(t, func() (success bool) {
+		return reflect.TypeOf(err).Name() == "EscapeError"
+	}, err)
+	require.EqualValues(t, nr, 0, "nr should be equal to 0")
+	require.Equal(t, keys, buf, "keys & the read buffer should be equal")
+
+	escapeKeys, _ = ToBytes("ctrl-c,ctrl-z")
+	keys, _ = ToBytes("ctrl-c,ctrl-z")
+	reader = NewEscapeProxy(bytes.NewReader(keys), escapeKeys)
+	buf = make([]byte, 1)
+	nr, err = reader.Read(buf)
+	require.NoError(t, err)
+	require.EqualValues(t, nr, 0, "nr should be equal to 0")
+	require.Equal(t, keys[0:1], buf, "keys & the read buffer should be equal")
+	nr, err = reader.Read(buf)
+	require.Condition(t, func() (success bool) {
+		return reflect.TypeOf(err).Name() == "EscapeError"
+	}, err)
+	require.EqualValues(t, nr, 0, "nr should be equal to 0")
+	require.Equal(t, keys[1:], buf, "keys & the read buffer should be equal")
+
+	escapeKeys, _ = ToBytes("ctrl-c,ctrl-z")
+	keys, _ = ToBytes("ctrl-c,DEL,+")
+	reader = NewEscapeProxy(bytes.NewReader(keys), escapeKeys)
+	buf = make([]byte, 1)
+	nr, err = reader.Read(buf)
+	require.NoError(t, err)
+	require.EqualValues(t, nr, 0, "nr should be equal to 0")
+	require.Equal(t, keys[0:1], buf, "keys & the read buffer should be equal")
+	buf = make([]byte, len(keys))
+	nr, err = reader.Read(buf)
+	require.NoError(t, err)
+	require.EqualValues(t, nr, len(keys), fmt.Sprintf("nr should be equal to %d", len(keys)))
+	require.Equal(t, keys, buf, "keys & the read buffer should be equal")
+
+	escapeKeys, _ = ToBytes("ctrl-c,ctrl-z")
+	keys, _ = ToBytes("ctrl-c,DEL")
+	reader = NewEscapeProxy(bytes.NewReader(keys), escapeKeys)
+	buf = make([]byte, 1)
+	nr, err = reader.Read(buf)
+	require.NoError(t, err)
+	require.EqualValues(t, nr, 0, "nr should be equal to 0")
+	require.Equal(t, keys[0:1], buf, "keys & the read buffer should be equal")
+	buf = make([]byte, len(keys))
+	nr, err = reader.Read(buf)
+	require.NoError(t, err)
+	require.EqualValues(t, nr, len(keys), fmt.Sprintf("nr should be equal to %d", len(keys)))
+	require.Equal(t, keys, buf, "keys & the read buffer should be equal")
+}
diff --git a/components/engine/pkg/term/term_linux_test.go b/components/engine/pkg/term/term_linux_test.go
new file mode 100644
index 0000000000..a1628c4c6d
--- /dev/null
+++ b/components/engine/pkg/term/term_linux_test.go
@@ -0,0 +1,120 @@
+//+build linux
+
+package term
+
+import (
+	"flag"
+	"io/ioutil"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var rootEnabled bool
+
+func init() {
+	flag.BoolVar(&rootEnabled, "test.root", false, "enable tests that require root")
+}
+
+// RequiresRoot skips tests that require root, unless the test.root flag has
+// been set
+func RequiresRoot(t *testing.T) {
+	if !rootEnabled {
+		t.Skip("skipping test that requires root")
+		return
+	}
+	assert.Equal(t, 0, os.Getuid(), "This test must be run as root.")
+}
+
+func newTtyForTest(t *testing.T) (*os.File, error) {
+	RequiresRoot(t)
+	return os.OpenFile("/dev/tty", os.O_RDWR, os.ModeDevice)
+}
+
+func newTempFile() (*os.File, error) {
+	return ioutil.TempFile(os.TempDir(), "temp")
+}
+
+func TestGetWinsize(t *testing.T) {
+	tty, err := newTtyForTest(t)
+	defer tty.Close()
+	require.NoError(t, err)
+	winSize, err := GetWinsize(tty.Fd())
+	require.NoError(t, err)
+	require.NotNil(t, winSize)
+	require.NotNil(t, winSize.Height)
+	require.NotNil(t, winSize.Width)
+	newSize := Winsize{Width: 200, Height: 200, x: winSize.x, y: winSize.y}
+	err = SetWinsize(tty.Fd(), &newSize)
+	require.NoError(t, err)
+	winSize, err = GetWinsize(tty.Fd())
+	require.NoError(t, err)
+	require.Equal(t, *winSize, newSize)
+}
+
+func TestSetWinsize(t *testing.T) {
+	tty, err := newTtyForTest(t)
+	defer tty.Close()
+	require.NoError(t, err)
+	winSize, err := GetWinsize(tty.Fd())
+	require.NoError(t, err)
+	require.NotNil(t, winSize)
+	newSize := Winsize{Width: 200, Height: 200, x: winSize.x, y: winSize.y}
+	err = SetWinsize(tty.Fd(), &newSize)
+	require.NoError(t, err)
+	winSize, err = GetWinsize(tty.Fd())
+	require.NoError(t, err)
+	require.Equal(t, *winSize, newSize)
+}
+
+func TestGetFdInfo(t *testing.T) {
+	tty, err := newTtyForTest(t)
+	defer tty.Close()
+	require.NoError(t, err)
+	inFd, isTerminal := GetFdInfo(tty)
+	require.Equal(t, inFd, tty.Fd())
+	require.Equal(t, isTerminal, true)
+	tmpFile, err := newTempFile()
+	defer tmpFile.Close()
+	inFd, isTerminal = GetFdInfo(tmpFile)
+	require.Equal(t, inFd, tmpFile.Fd())
+	require.Equal(t, isTerminal, false)
+}
+
+func TestIsTerminal(t *testing.T) {
+	tty, err := newTtyForTest(t)
+	defer tty.Close()
+	require.NoError(t, err)
+	isTerminal := IsTerminal(tty.Fd())
+	require.Equal(t, isTerminal, true)
+	tmpFile, err := newTempFile()
+	defer tmpFile.Close()
+	isTerminal = IsTerminal(tmpFile.Fd())
+	require.Equal(t, isTerminal, false)
+}
+
+func TestSaveState(t *testing.T) {
+	tty, err := newTtyForTest(t)
+	defer tty.Close()
+	require.NoError(t, err)
+	state, err := SaveState(tty.Fd())
+	require.NoError(t, err)
+	require.NotNil(t, state)
+	tty, err = newTtyForTest(t)
+	defer tty.Close()
+	err = RestoreTerminal(tty.Fd(), state)
+	require.NoError(t, err)
+}
+
+func TestDisableEcho(t *testing.T) {
+	tty, err := newTtyForTest(t)
+	defer tty.Close()
+	require.NoError(t, err)
+	state, err := SetRawTerminal(tty.Fd())
+	require.NoError(t, err)
+	require.NotNil(t, state)
+	err = DisableEcho(tty.Fd(), state)
+	require.NoError(t, err)
+}
diff --git a/components/engine/pkg/term/termios_linux.go b/components/engine/pkg/term/termios_linux.go
index b1d9c8d1b5..31bfa8419e 100644
--- a/components/engine/pkg/term/termios_linux.go
+++ b/components/engine/pkg/term/termios_linux.go
@@ -26,7 +26,7 @@ func MakeRaw(fd uintptr) (*State, error) {
 	newState := oldState.termios
 
 	newState.Iflag &^= (unix.IGNBRK | unix.BRKINT | unix.PARMRK | unix.ISTRIP | unix.INLCR | unix.IGNCR | unix.ICRNL | unix.IXON)
-	newState.Oflag |= unix.OPOST
+	newState.Oflag &^= unix.OPOST
 	newState.Lflag &^= (unix.ECHO | unix.ECHONL | unix.ICANON | unix.ISIG | unix.IEXTEN)
 	newState.Cflag &^= (unix.CSIZE | unix.PARENB)
 	newState.Cflag |= unix.CS8
diff --git a/components/engine/pkg/testutil/tempfile/tempfile.go b/components/engine/pkg/testutil/tempfile/tempfile.go
index b375cb9561..01474babff 100644
--- a/components/engine/pkg/testutil/tempfile/tempfile.go
+++ b/components/engine/pkg/testutil/tempfile/tempfile.go
@@ -34,3 +34,23 @@ func (f *TempFile) Name() string {
 func (f *TempFile) Remove() {
 	os.Remove(f.Name())
 }
+
+// TempDir is a temporary directory that can be used with unit tests. TempDir
+// reduces the boilerplate setup required in each test case by handling
+// setup errors.
+type TempDir struct {
+	Path string
+}
+
+// NewTempDir returns a new temp file with contents
+func NewTempDir(t require.TestingT, prefix string) *TempDir {
+	path, err := ioutil.TempDir("", prefix+"-")
+	require.NoError(t, err)
+
+	return &TempDir{Path: path}
+}
+
+// Remove removes the file
+func (f *TempDir) Remove() {
+	os.Remove(f.Path)
+}
diff --git a/components/engine/pkg/tlsconfig/tlsconfig_clone_go16.go b/components/engine/pkg/tlsconfig/tlsconfig_clone_go16.go
deleted file mode 100644
index 0b816650ec..0000000000
--- a/components/engine/pkg/tlsconfig/tlsconfig_clone_go16.go
+++ /dev/null
@@ -1,31 +0,0 @@
-// +build go1.6,!go1.7
-
-package tlsconfig
-
-import "crypto/tls"
-
-// Clone returns a clone of tls.Config. This function is provided for
-// compatibility for go1.6 that doesn't include this method in stdlib.
-func Clone(c *tls.Config) *tls.Config {
-	return &tls.Config{
-		Rand:                     c.Rand,
-		Time:                     c.Time,
-		Certificates:             c.Certificates,
-		NameToCertificate:        c.NameToCertificate,
-		GetCertificate:           c.GetCertificate,
-		RootCAs:                  c.RootCAs,
-		NextProtos:               c.NextProtos,
-		ServerName:               c.ServerName,
-		ClientAuth:               c.ClientAuth,
-		ClientCAs:                c.ClientCAs,
-		InsecureSkipVerify:       c.InsecureSkipVerify,
-		CipherSuites:             c.CipherSuites,
-		PreferServerCipherSuites: c.PreferServerCipherSuites,
-		SessionTicketsDisabled:   c.SessionTicketsDisabled,
-		SessionTicketKey:         c.SessionTicketKey,
-		ClientSessionCache:       c.ClientSessionCache,
-		MinVersion:               c.MinVersion,
-		MaxVersion:               c.MaxVersion,
-		CurvePreferences:         c.CurvePreferences,
-	}
-}
diff --git a/components/engine/plugin/backend_linux.go b/components/engine/plugin/backend_linux.go
index 1d7f3a838c..c2baab5c94 100644
--- a/components/engine/plugin/backend_linux.go
+++ b/components/engine/plugin/backend_linux.go
@@ -60,14 +60,7 @@ func (pm *Manager) Disable(refOrID string, config *types.PluginDisableConfig) er
 
 	for _, typ := range p.GetTypes() {
 		if typ.Capability == authorization.AuthZApiImplements {
-			authzList := pm.config.AuthzMiddleware.GetAuthzPlugins()
-			for i, authPlugin := range authzList {
-				if authPlugin.Name() == p.Name() {
-					// Remove plugin from authzmiddleware chain
-					authzList = append(authzList[:i], authzList[i+1:]...)
-					pm.config.AuthzMiddleware.SetAuthzPlugins(authzList)
-				}
-			}
+			pm.config.AuthzMiddleware.RemovePlugin(p.Name())
 		}
 	}
 
@@ -152,7 +145,7 @@ func (s *tempConfigStore) Get(d digest.Digest) ([]byte, error) {
 	return s.config, nil
 }
 
-func (s *tempConfigStore) RootFSFromConfig(c []byte) (*image.RootFS, error) {
+func (s *tempConfigStore) RootFSAndPlatformFromConfig(c []byte) (*image.RootFS, layer.Platform, error) {
 	return configToRootFS(c)
 }
 
@@ -532,7 +525,7 @@ func (s *pluginConfigStore) Get(d digest.Digest) ([]byte, error) {
 	return ioutil.ReadAll(rwc)
 }
 
-func (s *pluginConfigStore) RootFSFromConfig(c []byte) (*image.RootFS, error) {
+func (s *pluginConfigStore) RootFSAndPlatformFromConfig(c []byte) (*image.RootFS, layer.Platform, error) {
 	return configToRootFS(c)
 }
 
diff --git a/components/engine/plugin/blobstore.go b/components/engine/plugin/blobstore.go
index 172f6b235e..2b79a44270 100644
--- a/components/engine/plugin/blobstore.go
+++ b/components/engine/plugin/blobstore.go
@@ -126,7 +126,8 @@ type downloadManager struct {
 	configDigest digest.Digest
 }
 
-func (dm *downloadManager) Download(ctx context.Context, initialRootFS image.RootFS, layers []xfer.DownloadDescriptor, progressOutput progress.Output) (image.RootFS, func(), error) {
+func (dm *downloadManager) Download(ctx context.Context, initialRootFS image.RootFS, platform layer.Platform, layers []xfer.DownloadDescriptor, progressOutput progress.Output) (image.RootFS, func(), error) {
+	// TODO @jhowardmsft LCOW: May need revisiting.
 	for _, l := range layers {
 		b, err := dm.blobStore.New()
 		if err != nil {
@@ -178,6 +179,6 @@ func (dm *downloadManager) Put(dt []byte) (digest.Digest, error) {
 func (dm *downloadManager) Get(d digest.Digest) ([]byte, error) {
 	return nil, fmt.Errorf("digest not found")
 }
-func (dm *downloadManager) RootFSFromConfig(c []byte) (*image.RootFS, error) {
+func (dm *downloadManager) RootFSAndPlatformFromConfig(c []byte) (*image.RootFS, layer.Platform, error) {
 	return configToRootFS(c)
 }
diff --git a/components/engine/plugin/manager.go b/components/engine/plugin/manager.go
index f1c5788a9f..aa090f5a90 100644
--- a/components/engine/plugin/manager.go
+++ b/components/engine/plugin/manager.go
@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"reflect"
 	"regexp"
+	"runtime"
 	"sort"
 	"strings"
 	"sync"
@@ -21,6 +22,7 @@ import (
 	"github.com/docker/docker/pkg/authorization"
 	"github.com/docker/docker/pkg/ioutils"
 	"github.com/docker/docker/pkg/mount"
+	"github.com/docker/docker/pkg/system"
 	"github.com/docker/docker/plugin/v2"
 	"github.com/docker/docker/registry"
 	"github.com/opencontainers/go-digest"
@@ -348,17 +350,22 @@ func isEqualPrivilege(a, b types.PluginPrivilege) bool {
 	return reflect.DeepEqual(a.Value, b.Value)
 }
 
-func configToRootFS(c []byte) (*image.RootFS, error) {
+func configToRootFS(c []byte) (*image.RootFS, layer.Platform, error) {
+	// TODO @jhowardmsft LCOW - Will need to revisit this. For now, calculate the platform.
+	platform := layer.Platform(runtime.GOOS)
+	if platform == "windows" && system.LCOWSupported() {
+		platform = "linux"
+	}
 	var pluginConfig types.PluginConfig
 	if err := json.Unmarshal(c, &pluginConfig); err != nil {
-		return nil, err
+		return nil, "", err
 	}
 	// validation for empty rootfs is in distribution code
 	if pluginConfig.Rootfs == nil {
-		return nil, nil
+		return nil, platform, nil
 	}
 
-	return rootFSFromPlugin(pluginConfig.Rootfs), nil
+	return rootFSFromPlugin(pluginConfig.Rootfs), platform, nil
 }
 
 func rootFSFromPlugin(pluginfs *types.PluginConfigRootfs) *image.RootFS {
diff --git a/components/engine/plugin/manager_linux.go b/components/engine/plugin/manager_linux.go
index 80fc041623..1e8994043f 100644
--- a/components/engine/plugin/manager_linux.go
+++ b/components/engine/plugin/manager_linux.go
@@ -15,6 +15,7 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/daemon/initlayer"
 	"github.com/docker/docker/libcontainerd"
+	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/mount"
 	"github.com/docker/docker/pkg/plugins"
 	"github.com/docker/docker/pkg/stringid"
@@ -58,7 +59,7 @@ func (pm *Manager) enable(p *v2.Plugin, c *controller, force bool) error {
 		}
 	}
 
-	if err := initlayer.Setup(filepath.Join(pm.config.Root, p.PluginObj.ID, rootFSFileName), 0, 0); err != nil {
+	if err := initlayer.Setup(filepath.Join(pm.config.Root, p.PluginObj.ID, rootFSFileName), idtools.IDPair{0, 0}); err != nil {
 		return errors.WithStack(err)
 	}
 
@@ -79,7 +80,7 @@ func (pm *Manager) enable(p *v2.Plugin, c *controller, force bool) error {
 
 func (pm *Manager) pluginPostStart(p *v2.Plugin, c *controller) error {
 	sockAddr := filepath.Join(pm.config.ExecRoot, p.GetID(), p.GetSocket())
-	client, err := plugins.NewClientWithTimeout("unix://"+sockAddr, nil, c.timeoutInSecs)
+	client, err := plugins.NewClientWithTimeout("unix://"+sockAddr, nil, time.Duration(c.timeoutInSecs)*time.Second)
 	if err != nil {
 		c.restart = false
 		shutdownPlugin(p, c, pm.containerdClient)
diff --git a/components/engine/plugin/store.go b/components/engine/plugin/store.go
index 244522e10a..7f6e954bf8 100644
--- a/components/engine/plugin/store.go
+++ b/components/engine/plugin/store.go
@@ -29,13 +29,20 @@ type ErrNotFound string
 
 func (name ErrNotFound) Error() string { return fmt.Sprintf("plugin %q not found", string(name)) }
 
-// ErrAmbiguous indicates that a plugin was not found locally.
+// ErrAmbiguous indicates that more than one plugin was found
 type ErrAmbiguous string
 
 func (name ErrAmbiguous) Error() string {
 	return fmt.Sprintf("multiple plugins found for %q", string(name))
 }
 
+// ErrDisabled indicates that a plugin was found but it is disabled
+type ErrDisabled string
+
+func (name ErrDisabled) Error() string {
+	return fmt.Sprintf("plugin %s found but disabled", string(name))
+}
+
 // GetV2Plugin retrieves a plugin by name, id or partial ID.
 func (ps *Store) GetV2Plugin(refOrID string) (*v2.Plugin, error) {
 	ps.RLock()
@@ -138,7 +145,7 @@ func (ps *Store) Get(name, capability string, mode int) (plugingetter.CompatPlug
 			}
 			// Plugin was found but it is disabled, so we should not fall back to legacy plugins
 			// but we should error out right away
-			return nil, ErrNotFound(name)
+			return nil, ErrDisabled(name)
 		}
 		if _, ok := errors.Cause(err).(ErrNotFound); !ok {
 			return nil, err
diff --git a/components/engine/plugin/v2/plugin_linux.go b/components/engine/plugin/v2/plugin_linux.go
index 412818ed33..9cae180e33 100644
--- a/components/engine/plugin/v2/plugin_linux.go
+++ b/components/engine/plugin/v2/plugin_linux.go
@@ -5,6 +5,7 @@ package v2
 import (
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 
 	"github.com/docker/docker/api/types"
@@ -108,7 +109,7 @@ func (p *Plugin) InitSpec(execRoot string) (*specs.Spec, error) {
 	}
 
 	envs := make([]string, 1, len(p.PluginObj.Settings.Env)+1)
-	envs[0] = "PATH=" + system.DefaultPathEnv
+	envs[0] = "PATH=" + system.DefaultPathEnv(runtime.GOOS)
 	envs = append(envs, p.PluginObj.Settings.Env...)
 
 	args := append(p.PluginObj.Config.Entrypoint, p.PluginObj.Settings.Args...)
diff --git a/components/engine/poule.yml b/components/engine/poule.yml
index 0f440437ff..2abf0df7f0 100644
--- a/components/engine/poule.yml
+++ b/components/engine/poule.yml
@@ -35,12 +35,6 @@
         }
       - type:       version-label
 
-# When a pull request is closed, attach it to the currently active milestone.
-- triggers:
-      pull_request: [ closed ]
-  operations:
-      - type:       version-milestone
-
 # Labeling a PR with `rebuild/<configuration>` triggers a rebuild job for the associated
 # configuration. The label is automatically removed after the rebuild is initiated. There's no such
 # thing as "templating" in this configuration, so we need one operation for each type of
diff --git a/components/engine/profiles/seccomp/default.json b/components/engine/profiles/seccomp/default.json
index 0d43e60795..b71a8718a4 100755
--- a/components/engine/profiles/seccomp/default.json
+++ b/components/engine/profiles/seccomp/default.json
@@ -55,6 +55,7 @@
 				"accept",
 				"accept4",
 				"access",
+				"adjtimex",
 				"alarm",
 				"alarm",
 				"bind",
@@ -719,7 +720,6 @@
 			"names": [
 				"settimeofday",
 				"stime",
-				"adjtimex",
 				"clock_settime"
 			],
 			"action": "SCMP_ACT_ALLOW",
diff --git a/components/engine/profiles/seccomp/seccomp_default.go b/components/engine/profiles/seccomp/seccomp_default.go
index 8cf0df2698..833dcd5a8a 100644
--- a/components/engine/profiles/seccomp/seccomp_default.go
+++ b/components/engine/profiles/seccomp/seccomp_default.go
@@ -49,6 +49,7 @@ func DefaultProfile() *types.Seccomp {
 				"accept",
 				"accept4",
 				"access",
+				"adjtimex",
 				"alarm",
 				"alarm",
 				"bind",
@@ -611,7 +612,6 @@ func DefaultProfile() *types.Seccomp {
 			Names: []string{
 				"settimeofday",
 				"stime",
-				"adjtimex",
 				"clock_settime",
 			},
 			Action: types.ActAllow,
diff --git a/components/engine/reference/store.go b/components/engine/reference/store.go
index 8466e6e2cc..6599235401 100644
--- a/components/engine/reference/store.go
+++ b/components/engine/reference/store.go
@@ -46,6 +46,9 @@ type store struct {
 	// referencesByIDCache is a cache of references indexed by ID, to speed
 	// up References.
 	referencesByIDCache map[digest.Digest]map[string]reference.Named
+	// platform is the container target platform for this store (which may be
+	// different to the host operating system
+	platform string
 }
 
 // Repository maps tags to digests. The key is a stringified Reference,
@@ -70,7 +73,7 @@ func (a lexicalAssociations) Less(i, j int) bool {
 
 // NewReferenceStore creates a new reference store, tied to a file path where
 // the set of references are serialized in JSON format.
-func NewReferenceStore(jsonPath string) (Store, error) {
+func NewReferenceStore(jsonPath, platform string) (Store, error) {
 	abspath, err := filepath.Abs(jsonPath)
 	if err != nil {
 		return nil, err
@@ -80,6 +83,7 @@ func NewReferenceStore(jsonPath string) (Store, error) {
 		jsonPath:            abspath,
 		Repositories:        make(map[string]repository),
 		referencesByIDCache: make(map[digest.Digest]map[string]reference.Named),
+		platform:            platform,
 	}
 	// Load the json file if it exists, otherwise create it.
 	if err := store.reload(); os.IsNotExist(err) {
diff --git a/components/engine/reference/store_test.go b/components/engine/reference/store_test.go
index 8f0ff6304e..2c796e76f9 100644
--- a/components/engine/reference/store_test.go
+++ b/components/engine/reference/store_test.go
@@ -5,6 +5,7 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"testing"
 
@@ -40,7 +41,7 @@ func TestLoad(t *testing.T) {
 	}
 	jsonFile.Close()
 
-	store, err := NewReferenceStore(jsonFile.Name())
+	store, err := NewReferenceStore(jsonFile.Name(), runtime.GOOS)
 	if err != nil {
 		t.Fatalf("error creating tag store: %v", err)
 	}
@@ -69,7 +70,7 @@ func TestSave(t *testing.T) {
 	jsonFile.Close()
 	defer os.RemoveAll(jsonFile.Name())
 
-	store, err := NewReferenceStore(jsonFile.Name())
+	store, err := NewReferenceStore(jsonFile.Name(), runtime.GOOS)
 	if err != nil {
 		t.Fatalf("error creating tag store: %v", err)
 	}
@@ -111,7 +112,7 @@ func TestAddDeleteGet(t *testing.T) {
 	jsonFile.Close()
 	defer os.RemoveAll(jsonFile.Name())
 
-	store, err := NewReferenceStore(jsonFile.Name())
+	store, err := NewReferenceStore(jsonFile.Name(), runtime.GOOS)
 	if err != nil {
 		t.Fatalf("error creating tag store: %v", err)
 	}
@@ -328,7 +329,7 @@ func TestInvalidTags(t *testing.T) {
 	tmpDir, err := ioutil.TempDir("", "tag-store-test")
 	defer os.RemoveAll(tmpDir)
 
-	store, err := NewReferenceStore(filepath.Join(tmpDir, "repositories.json"))
+	store, err := NewReferenceStore(filepath.Join(tmpDir, "repositories.json"), runtime.GOOS)
 	if err != nil {
 		t.Fatalf("error creating tag store: %v", err)
 	}
diff --git a/components/engine/registry/config_unix.go b/components/engine/registry/config_unix.go
index d692e8ef50..fdc39a1d68 100644
--- a/components/engine/registry/config_unix.go
+++ b/components/engine/registry/config_unix.go
@@ -21,5 +21,5 @@ func cleanPath(s string) string {
 
 // installCliPlatformFlags handles any platform specific flags for the service.
 func (options *ServiceOptions) installCliPlatformFlags(flags *pflag.FlagSet) {
-	flags.BoolVar(&options.V2Only, "disable-legacy-registry", false, "Disable contacting legacy registries")
+	flags.BoolVar(&options.V2Only, "disable-legacy-registry", true, "Disable contacting legacy registries")
 }
diff --git a/components/engine/pkg/httputils/resumablerequestreader.go b/components/engine/registry/resumable/resumablerequestreader.go
similarity index 66%
rename from components/engine/pkg/httputils/resumablerequestreader.go
rename to components/engine/registry/resumable/resumablerequestreader.go
index de488fb531..5403c76847 100644
--- a/components/engine/pkg/httputils/resumablerequestreader.go
+++ b/components/engine/registry/resumable/resumablerequestreader.go
@@ -1,4 +1,4 @@
-package httputils
+package resumable
 
 import (
 	"fmt"
@@ -9,7 +9,7 @@ import (
 	"github.com/Sirupsen/logrus"
 )
 
-type resumableRequestReader struct {
+type requestReader struct {
 	client          *http.Client
 	request         *http.Request
 	lastRange       int64
@@ -20,22 +20,22 @@ type resumableRequestReader struct {
 	waitDuration    time.Duration
 }
 
-// ResumableRequestReader makes it possible to resume reading a request's body transparently
+// NewRequestReader makes it possible to resume reading a request's body transparently
 // maxfail is the number of times we retry to make requests again (not resumes)
 // totalsize is the total length of the body; auto detect if not provided
-func ResumableRequestReader(c *http.Client, r *http.Request, maxfail uint32, totalsize int64) io.ReadCloser {
-	return &resumableRequestReader{client: c, request: r, maxFailures: maxfail, totalSize: totalsize, waitDuration: 5 * time.Second}
+func NewRequestReader(c *http.Client, r *http.Request, maxfail uint32, totalsize int64) io.ReadCloser {
+	return &requestReader{client: c, request: r, maxFailures: maxfail, totalSize: totalsize, waitDuration: 5 * time.Second}
 }
 
-// ResumableRequestReaderWithInitialResponse makes it possible to resume
+// NewRequestReaderWithInitialResponse makes it possible to resume
 // reading the body of an already initiated request.
-func ResumableRequestReaderWithInitialResponse(c *http.Client, r *http.Request, maxfail uint32, totalsize int64, initialResponse *http.Response) io.ReadCloser {
-	return &resumableRequestReader{client: c, request: r, maxFailures: maxfail, totalSize: totalsize, currentResponse: initialResponse, waitDuration: 5 * time.Second}
+func NewRequestReaderWithInitialResponse(c *http.Client, r *http.Request, maxfail uint32, totalsize int64, initialResponse *http.Response) io.ReadCloser {
+	return &requestReader{client: c, request: r, maxFailures: maxfail, totalSize: totalsize, currentResponse: initialResponse, waitDuration: 5 * time.Second}
 }
 
-func (r *resumableRequestReader) Read(p []byte) (n int, err error) {
+func (r *requestReader) Read(p []byte) (n int, err error) {
 	if r.client == nil || r.request == nil {
-		return 0, fmt.Errorf("client and request can't be nil\n")
+		return 0, fmt.Errorf("client and request can't be nil")
 	}
 	isFreshRequest := false
 	if r.lastRange != 0 && r.currentResponse == nil {
@@ -81,14 +81,14 @@ func (r *resumableRequestReader) Read(p []byte) (n int, err error) {
 	return n, err
 }
 
-func (r *resumableRequestReader) Close() error {
+func (r *requestReader) Close() error {
 	r.cleanUpResponse()
 	r.client = nil
 	r.request = nil
 	return nil
 }
 
-func (r *resumableRequestReader) cleanUpResponse() {
+func (r *requestReader) cleanUpResponse() {
 	if r.currentResponse != nil {
 		r.currentResponse.Body.Close()
 		r.currentResponse = nil
diff --git a/components/engine/pkg/httputils/resumablerequestreader_test.go b/components/engine/registry/resumable/resumablerequestreader_test.go
similarity index 69%
rename from components/engine/pkg/httputils/resumablerequestreader_test.go
rename to components/engine/registry/resumable/resumablerequestreader_test.go
index 81cafae579..a632bc673a 100644
--- a/components/engine/pkg/httputils/resumablerequestreader_test.go
+++ b/components/engine/registry/resumable/resumablerequestreader_test.go
@@ -1,7 +1,9 @@
-package httputils
+package resumable
 
 import (
 	"fmt"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"io"
 	"io/ioutil"
 	"net/http"
@@ -21,28 +23,19 @@ func TestResumableRequestHeaderSimpleErrors(t *testing.T) {
 
 	var req *http.Request
 	req, err := http.NewRequest("GET", ts.URL, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
-	expectedError := "client and request can't be nil\n"
-	resreq := &resumableRequestReader{}
+	resreq := &requestReader{}
 	_, err = resreq.Read([]byte{})
-	if err == nil || err.Error() != expectedError {
-		t.Fatalf("Expected an error with '%s', got %v.", expectedError, err)
-	}
+	assert.EqualError(t, err, "client and request can't be nil")
 
-	resreq = &resumableRequestReader{
+	resreq = &requestReader{
 		client:    client,
 		request:   req,
 		totalSize: -1,
 	}
-	expectedError = "failed to auto detect content length"
 	_, err = resreq.Read([]byte{})
-	if err == nil || err.Error() != expectedError {
-		t.Fatalf("Expected an error with '%s', got %v.", expectedError, err)
-	}
-
+	assert.EqualError(t, err, "failed to auto detect content length")
 }
 
 // Not too much failures, bails out after some wait
@@ -51,11 +44,9 @@ func TestResumableRequestHeaderNotTooMuchFailures(t *testing.T) {
 
 	var badReq *http.Request
 	badReq, err := http.NewRequest("GET", "I'm not an url", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
-	resreq := &resumableRequestReader{
+	resreq := &requestReader{
 		client:       client,
 		request:      badReq,
 		failures:     0,
@@ -63,9 +54,8 @@ func TestResumableRequestHeaderNotTooMuchFailures(t *testing.T) {
 		waitDuration: 10 * time.Millisecond,
 	}
 	read, err := resreq.Read([]byte{})
-	if err != nil || read != 0 {
-		t.Fatalf("Expected no error and no byte read, got err:%v, read:%v.", err, read)
-	}
+	require.NoError(t, err)
+	assert.Equal(t, 0, read)
 }
 
 // Too much failures, returns the error
@@ -74,11 +64,9 @@ func TestResumableRequestHeaderTooMuchFailures(t *testing.T) {
 
 	var badReq *http.Request
 	badReq, err := http.NewRequest("GET", "I'm not an url", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
-	resreq := &resumableRequestReader{
+	resreq := &requestReader{
 		client:      client,
 		request:     badReq,
 		failures:    0,
@@ -88,9 +76,8 @@ func TestResumableRequestHeaderTooMuchFailures(t *testing.T) {
 
 	expectedError := `Get I%27m%20not%20an%20url: unsupported protocol scheme ""`
 	read, err := resreq.Read([]byte{})
-	if err == nil || err.Error() != expectedError || read != 0 {
-		t.Fatalf("Expected the error '%s', got err:%v, read:%v.", expectedError, err, read)
-	}
+	assert.EqualError(t, err, expectedError)
+	assert.Equal(t, 0, read)
 }
 
 type errorReaderCloser struct{}
@@ -105,9 +92,7 @@ func (errorReaderCloser) Read(p []byte) (n int, err error) {
 func TestResumableRequestReaderWithReadError(t *testing.T) {
 	var req *http.Request
 	req, err := http.NewRequest("GET", "", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	client := &http.Client{}
 
@@ -119,7 +104,7 @@ func TestResumableRequestReaderWithReadError(t *testing.T) {
 		Body:          errorReaderCloser{},
 	}
 
-	resreq := &resumableRequestReader{
+	resreq := &requestReader{
 		client:          client,
 		request:         req,
 		currentResponse: response,
@@ -130,21 +115,15 @@ func TestResumableRequestReaderWithReadError(t *testing.T) {
 
 	buf := make([]byte, 1)
 	read, err := resreq.Read(buf)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
-	if read != 0 {
-		t.Fatalf("Expected to have read nothing, but read %v", read)
-	}
+	assert.Equal(t, 0, read)
 }
 
 func TestResumableRequestReaderWithEOFWith416Response(t *testing.T) {
 	var req *http.Request
 	req, err := http.NewRequest("GET", "", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	client := &http.Client{}
 
@@ -156,7 +135,7 @@ func TestResumableRequestReaderWithEOFWith416Response(t *testing.T) {
 		Body:          ioutil.NopCloser(strings.NewReader("")),
 	}
 
-	resreq := &resumableRequestReader{
+	resreq := &requestReader{
 		client:          client,
 		request:         req,
 		currentResponse: response,
@@ -167,9 +146,7 @@ func TestResumableRequestReaderWithEOFWith416Response(t *testing.T) {
 
 	buf := make([]byte, 1)
 	_, err = resreq.Read(buf)
-	if err == nil || err != io.EOF {
-		t.Fatalf("Expected an io.EOF error, got %v", err)
-	}
+	assert.EqualError(t, err, io.EOF.Error())
 }
 
 func TestResumableRequestReaderWithServerDoesntSupportByteRanges(t *testing.T) {
@@ -182,29 +159,23 @@ func TestResumableRequestReaderWithServerDoesntSupportByteRanges(t *testing.T) {
 
 	var req *http.Request
 	req, err := http.NewRequest("GET", ts.URL, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	client := &http.Client{}
 
-	resreq := &resumableRequestReader{
+	resreq := &requestReader{
 		client:    client,
 		request:   req,
 		lastRange: 1,
 	}
 	defer resreq.Close()
 
-	expectedError := "the server doesn't support byte ranges"
 	buf := make([]byte, 2)
 	_, err = resreq.Read(buf)
-	if err == nil || err.Error() != expectedError {
-		t.Fatalf("Expected an error '%s', got %v", expectedError, err)
-	}
+	assert.EqualError(t, err, "the server doesn't support byte ranges")
 }
 
 func TestResumableRequestReaderWithZeroTotalSize(t *testing.T) {
-
 	srvtxt := "some response text data"
 
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -214,30 +185,22 @@ func TestResumableRequestReaderWithZeroTotalSize(t *testing.T) {
 
 	var req *http.Request
 	req, err := http.NewRequest("GET", ts.URL, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	client := &http.Client{}
 	retries := uint32(5)
 
-	resreq := ResumableRequestReader(client, req, retries, 0)
+	resreq := NewRequestReader(client, req, retries, 0)
 	defer resreq.Close()
 
 	data, err := ioutil.ReadAll(resreq)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	resstr := strings.TrimSuffix(string(data), "\n")
-
-	if resstr != srvtxt {
-		t.Error("resstr != srvtxt")
-	}
+	assert.Equal(t, srvtxt, resstr)
 }
 
 func TestResumableRequestReader(t *testing.T) {
-
 	srvtxt := "some response text data"
 
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -247,31 +210,23 @@ func TestResumableRequestReader(t *testing.T) {
 
 	var req *http.Request
 	req, err := http.NewRequest("GET", ts.URL, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	client := &http.Client{}
 	retries := uint32(5)
 	imgSize := int64(len(srvtxt))
 
-	resreq := ResumableRequestReader(client, req, retries, imgSize)
+	resreq := NewRequestReader(client, req, retries, imgSize)
 	defer resreq.Close()
 
 	data, err := ioutil.ReadAll(resreq)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	resstr := strings.TrimSuffix(string(data), "\n")
-
-	if resstr != srvtxt {
-		t.Error("resstr != srvtxt")
-	}
+	assert.Equal(t, srvtxt, resstr)
 }
 
 func TestResumableRequestReaderWithInitialResponse(t *testing.T) {
-
 	srvtxt := "some response text data"
 
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -281,30 +236,21 @@ func TestResumableRequestReaderWithInitialResponse(t *testing.T) {
 
 	var req *http.Request
 	req, err := http.NewRequest("GET", ts.URL, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	client := &http.Client{}
 	retries := uint32(5)
 	imgSize := int64(len(srvtxt))
 
 	res, err := client.Do(req)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
-	resreq := ResumableRequestReaderWithInitialResponse(client, req, retries, imgSize, res)
+	resreq := NewRequestReaderWithInitialResponse(client, req, retries, imgSize, res)
 	defer resreq.Close()
 
 	data, err := ioutil.ReadAll(resreq)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	resstr := strings.TrimSuffix(string(data), "\n")
-
-	if resstr != srvtxt {
-		t.Error("resstr != srvtxt")
-	}
+	assert.Equal(t, srvtxt, resstr)
 }
diff --git a/components/engine/registry/session.go b/components/engine/registry/session.go
index c71e778037..9d7f32193f 100644
--- a/components/engine/registry/session.go
+++ b/components/engine/registry/session.go
@@ -23,10 +23,11 @@ import (
 	"github.com/docker/distribution/registry/api/errcode"
 	"github.com/docker/docker/api/types"
 	registrytypes "github.com/docker/docker/api/types/registry"
-	"github.com/docker/docker/pkg/httputils"
 	"github.com/docker/docker/pkg/ioutils"
+	"github.com/docker/docker/pkg/jsonmessage"
 	"github.com/docker/docker/pkg/stringid"
 	"github.com/docker/docker/pkg/tarsum"
+	"github.com/docker/docker/registry/resumable"
 )
 
 var (
@@ -226,7 +227,7 @@ func (r *Session) GetRemoteHistory(imgID, registry string) ([]string, error) {
 		if res.StatusCode == 401 {
 			return nil, errcode.ErrorCodeUnauthorized.WithArgs()
 		}
-		return nil, httputils.NewHTTPRequestError(fmt.Sprintf("Server error: %d trying to fetch remote history for %s", res.StatusCode, imgID), res)
+		return nil, newJSONError(fmt.Sprintf("Server error: %d trying to fetch remote history for %s", res.StatusCode, imgID), res)
 	}
 
 	var history []string
@@ -246,7 +247,7 @@ func (r *Session) LookupRemoteImage(imgID, registry string) error {
 	}
 	res.Body.Close()
 	if res.StatusCode != 200 {
-		return httputils.NewHTTPRequestError(fmt.Sprintf("HTTP code %d", res.StatusCode), res)
+		return newJSONError(fmt.Sprintf("HTTP code %d", res.StatusCode), res)
 	}
 	return nil
 }
@@ -259,7 +260,7 @@ func (r *Session) GetRemoteImageJSON(imgID, registry string) ([]byte, int64, err
 	}
 	defer res.Body.Close()
 	if res.StatusCode != 200 {
-		return nil, -1, httputils.NewHTTPRequestError(fmt.Sprintf("HTTP code %d", res.StatusCode), res)
+		return nil, -1, newJSONError(fmt.Sprintf("HTTP code %d", res.StatusCode), res)
 	}
 	// if the size header is not present, then set it to '-1'
 	imageSize := int64(-1)
@@ -313,7 +314,7 @@ func (r *Session) GetRemoteImageLayer(imgID, registry string, imgSize int64) (io
 
 	if res.Header.Get("Accept-Ranges") == "bytes" && imgSize > 0 {
 		logrus.Debug("server supports resume")
-		return httputils.ResumableRequestReaderWithInitialResponse(r.client, req, 5, imgSize, res), nil
+		return resumable.NewRequestReaderWithInitialResponse(r.client, req, 5, imgSize, res), nil
 	}
 	logrus.Debug("server doesn't support resume")
 	return res.Body, nil
@@ -444,13 +445,13 @@ func (r *Session) GetRepositoryData(name reference.Named) (*RepositoryData, erro
 	// TODO: Right now we're ignoring checksums in the response body.
 	// In the future, we need to use them to check image validity.
 	if res.StatusCode == 404 {
-		return nil, httputils.NewHTTPRequestError(fmt.Sprintf("HTTP code: %d", res.StatusCode), res)
+		return nil, newJSONError(fmt.Sprintf("HTTP code: %d", res.StatusCode), res)
 	} else if res.StatusCode != 200 {
 		errBody, err := ioutil.ReadAll(res.Body)
 		if err != nil {
 			logrus.Debugf("Error reading response body: %s", err)
 		}
-		return nil, httputils.NewHTTPRequestError(fmt.Sprintf("Error: Status %d trying to pull repository %s: %q", res.StatusCode, reference.Path(name), errBody), res)
+		return nil, newJSONError(fmt.Sprintf("Error: Status %d trying to pull repository %s: %q", res.StatusCode, reference.Path(name), errBody), res)
 	}
 
 	var endpoints []string
@@ -537,12 +538,12 @@ func (r *Session) PushImageJSONRegistry(imgData *ImgData, jsonRaw []byte, regist
 	}
 	defer res.Body.Close()
 	if res.StatusCode == 401 && strings.HasPrefix(registry, "http://") {
-		return httputils.NewHTTPRequestError("HTTP code 401, Docker will not send auth headers over HTTP.", res)
+		return newJSONError("HTTP code 401, Docker will not send auth headers over HTTP.", res)
 	}
 	if res.StatusCode != 200 {
 		errBody, err := ioutil.ReadAll(res.Body)
 		if err != nil {
-			return httputils.NewHTTPRequestError(fmt.Sprintf("HTTP code %d while uploading metadata and error when trying to parse response body: %s", res.StatusCode, err), res)
+			return newJSONError(fmt.Sprintf("HTTP code %d while uploading metadata and error when trying to parse response body: %s", res.StatusCode, err), res)
 		}
 		var jsonBody map[string]string
 		if err := json.Unmarshal(errBody, &jsonBody); err != nil {
@@ -550,7 +551,7 @@ func (r *Session) PushImageJSONRegistry(imgData *ImgData, jsonRaw []byte, regist
 		} else if jsonBody["error"] == "Image already exists" {
 			return ErrAlreadyExists
 		}
-		return httputils.NewHTTPRequestError(fmt.Sprintf("HTTP code %d while uploading metadata: %q", res.StatusCode, errBody), res)
+		return newJSONError(fmt.Sprintf("HTTP code %d while uploading metadata: %q", res.StatusCode, errBody), res)
 	}
 	return nil
 }
@@ -591,9 +592,9 @@ func (r *Session) PushImageLayerRegistry(imgID string, layer io.Reader, registry
 	if res.StatusCode != 200 {
 		errBody, err := ioutil.ReadAll(res.Body)
 		if err != nil {
-			return "", "", httputils.NewHTTPRequestError(fmt.Sprintf("HTTP code %d while uploading metadata and error when trying to parse response body: %s", res.StatusCode, err), res)
+			return "", "", newJSONError(fmt.Sprintf("HTTP code %d while uploading metadata and error when trying to parse response body: %s", res.StatusCode, err), res)
 		}
-		return "", "", httputils.NewHTTPRequestError(fmt.Sprintf("Received HTTP code %d while uploading layer: %q", res.StatusCode, errBody), res)
+		return "", "", newJSONError(fmt.Sprintf("Received HTTP code %d while uploading layer: %q", res.StatusCode, errBody), res)
 	}
 
 	checksumPayload = "sha256:" + hex.EncodeToString(h.Sum(nil))
@@ -619,7 +620,7 @@ func (r *Session) PushRegistryTag(remote reference.Named, revision, tag, registr
 	}
 	res.Body.Close()
 	if res.StatusCode != 200 && res.StatusCode != 201 {
-		return httputils.NewHTTPRequestError(fmt.Sprintf("Internal server error: %d trying to push tag %s on %s", res.StatusCode, tag, reference.Path(remote)), res)
+		return newJSONError(fmt.Sprintf("Internal server error: %d trying to push tag %s on %s", res.StatusCode, tag, reference.Path(remote)), res)
 	}
 	return nil
 }
@@ -683,7 +684,7 @@ func (r *Session) PushImageJSONIndex(remote reference.Named, imgList []*ImgData,
 			if err != nil {
 				logrus.Debugf("Error reading response body: %s", err)
 			}
-			return nil, httputils.NewHTTPRequestError(fmt.Sprintf("Error: Status %d trying to push repository %s: %q", res.StatusCode, reference.Path(remote), errBody), res)
+			return nil, newJSONError(fmt.Sprintf("Error: Status %d trying to push repository %s: %q", res.StatusCode, reference.Path(remote), errBody), res)
 		}
 		tokens = res.Header["X-Docker-Token"]
 		logrus.Debugf("Auth token: %v", tokens)
@@ -701,7 +702,7 @@ func (r *Session) PushImageJSONIndex(remote reference.Named, imgList []*ImgData,
 			if err != nil {
 				logrus.Debugf("Error reading response body: %s", err)
 			}
-			return nil, httputils.NewHTTPRequestError(fmt.Sprintf("Error: Status %d trying to push checksums %s: %q", res.StatusCode, reference.Path(remote), errBody), res)
+			return nil, newJSONError(fmt.Sprintf("Error: Status %d trying to push checksums %s: %q", res.StatusCode, reference.Path(remote), errBody), res)
 		}
 	}
 
@@ -750,25 +751,12 @@ func (r *Session) SearchRepositories(term string, limit int) (*registrytypes.Sea
 	}
 	defer res.Body.Close()
 	if res.StatusCode != 200 {
-		return nil, httputils.NewHTTPRequestError(fmt.Sprintf("Unexpected status code %d", res.StatusCode), res)
+		return nil, newJSONError(fmt.Sprintf("Unexpected status code %d", res.StatusCode), res)
 	}
 	result := new(registrytypes.SearchResults)
 	return result, json.NewDecoder(res.Body).Decode(result)
 }
 
-// GetAuthConfig returns the authentication settings for a session
-// TODO(tiborvass): remove this once registry client v2 is vendored
-func (r *Session) GetAuthConfig(withPasswd bool) *types.AuthConfig {
-	password := ""
-	if withPasswd {
-		password = r.authConfig.Password
-	}
-	return &types.AuthConfig{
-		Username: r.authConfig.Username,
-		Password: password,
-	}
-}
-
 func isTimeout(err error) bool {
 	type timeout interface {
 		Timeout() bool
@@ -781,3 +769,10 @@ func isTimeout(err error) bool {
 	t, ok := e.(timeout)
 	return ok && t.Timeout()
 }
+
+func newJSONError(msg string, res *http.Response) error {
+	return &jsonmessage.JSONError{
+		Message: msg,
+		Code:    res.StatusCode,
+	}
+}
diff --git a/components/engine/reports/2017-06-05.md b/components/engine/reports/2017-06-05.md
new file mode 100644
index 0000000000..8e2cc3c458
--- /dev/null
+++ b/components/engine/reports/2017-06-05.md
@@ -0,0 +1,36 @@
+# Development Report for June 5, 2017
+
+## Daily Meeting
+
+A daily meeting is hosted on [slack](https://dockercommunity.slack.com) every business day at 9am PST on the channel `#moby-project`.
+Lots of discussion happened during this meeting to kickstart the project, but now that we have the forums, we see less activity there.
+We are discussing the future of this meeting [here](https://forums.mobyproject.org/t/of-standups-future), we will possibily move the meeting
+to weekly.
+
+## Topics discussed last week
+
+### The CLI split
+
+Thanks to @tiborvass, the man pages, docs and completion scripts were imported to `github.com/docker/cli` [last week](https://github.com/docker/cli/pull/147)
+Once everything is finalised, we will remove them from `github.com/moby/moby`
+
+### Find a good and non-confusing home for the remaining monolith
+
+Discussion on this topic is still ongoing, and possible approaches are looked into. The active discussion has moved
+from GitHub to [https://forums.mobyproject.org/](https://forums.mobyproject.org/t/topic-find-a-good-an-non-confusing-home-for-the-remaining-monolith)
+
+
+### Find a place for `/pkg`
+
+Thanks to @dnephin this topic in on-going, you can follow progress [here](https://github.com/moby/moby/issues/32989)
+Many pkgs were reorganised last week, and more to come this week.
+
+
+### Builder
+
+The builder dev report can be found [here](builder/2017-06-05.md)
+
+
+### LinuxKit
+
+The LinuxKit dev report can be found [here](https://github.com/linuxkit/linuxkit/blob/master/reports/2017-06-03.md)
\ No newline at end of file
diff --git a/components/engine/reports/2017-06-12.md b/components/engine/reports/2017-06-12.md
new file mode 100644
index 0000000000..8aef38c6b0
--- /dev/null
+++ b/components/engine/reports/2017-06-12.md
@@ -0,0 +1,78 @@
+# Development Report for June 12, 2017
+
+## Moby Summit
+
+The next Moby Summit will be at Docker HQ on June 19th, register [here](https://www.eventbrite.com/e/moby-summit-tickets-34483396768)
+
+## Daily Meeting
+
+### The CLI split
+
+Manpages and docs yaml files can now be generated on [docker/cli](https://github.com/docker/cli).
+Man pages, docs and completion scripts will be removed next week thanks to @tiborvass 
+
+### Find a good and non-confusing home for the remaining monolith
+
+Lot's of dicussion happened on the [forums](https://forums.mobyproject.org/t/topic-find-a-good-an-non-confusing-home-for-the-remaining-monolith)
+We should expect to do those changes after the moby summit. We contacted github to work with them so we have a smooth move.
+
+### Moby tool
+
+`moby` tool docs were moved from [LinuxKit](https://github.com/linuxkit/linuxkit) to the [moby tool repo](https://github.com/moby/tool) thanks to @justincormack
+
+### Custom golang URLs
+
+More discussions on the [forums](https://forums.mobyproject.org/t/cutoms-golang-urls), no agreement for now.
+
+### Buildkit
+
+[Proposal](https://github.com/moby/moby/issues/32925)
+
+More updates to the [POC repo](https://github.com/tonistiigi/buildkit_poc). It now contains binaries for the daemon and client. Examples directory shows a way for invoking a build job by generating the internal low-level build graph definition with a helper binary(as there is not support for frontends yet). The grpc control server binary can be built in two versions, one that connects to containerD socket and other that doesn't have any external dependencies.
+
+If you have questions or want to help, stop by the issues section of that repo or the proposal in moby/moby.
+
+#### Typed Dockerfile parsing
+
+[PR](https://github.com/moby/moby/pull/33492)
+
+New PR that enables parsing Dockerfiles into typed structures so they can be preprocessed to eliminate unnecessary build stages and reused with different kinds of dispatchers.
+
+#### Long running session & incremental file sending
+
+[PR ](https://github.com/moby/moby/pull/32677) 
+
+Same status as last week. The PR went through one pass of review from @dnephin and has been rebased again. Maintainers are encouraged to give this one a review so it can be included in `v17.07` release.
+
+
+#### Quality: Dependency interface switch
+
+[Move file copying from the daemon to the builder](https://github.com/moby/moby/pull/33454) PR is waiting for a second review. 
+
+#### Proposals for new Dockerfile features that need design feedback:
+
+[Add IMPORT/EXPORT commands to Dockerfile](https://github.com/moby/moby/issues/32100)
+
+[Add `DOCKEROS/DOCKERARCH` default ARG to Dockerfile](https://github.com/moby/moby/issues/32487)
+
+[Add support for `RUN --mount`](https://github.com/moby/moby/issues/32507)
+
+[DAG image builder](https://github.com/moby/moby/issues/32550)
+
+[Option to export the hash of the build context](https://github.com/moby/moby/issues/32963) (new)
+
+[Allow --cache-from=*](https://github.com/moby/moby/issues/33002#issuecomment-299041162) (new)
+
+[Provide advanced .dockeringore use-cases](https://github.com/moby/moby/issues/12886) [2](https://github.com/moby/moby/issues/12886#issuecomment-306247989)
+
+If you are interested in implementing any of them, leave a comment on the specific issues.
+
+#### Builder features currently in code-review:
+
+[Warn/deprecate continuing on empty lines in `Dockerfile`](https://github.com/moby/moby/pull/29161)
+
+[Fix behavior of absolute paths in .dockerignore](https://github.com/moby/moby/pull/32088)
+
+#### Backlog
+
+[Build secrets](https://github.com/moby/moby/issues/33343) has not got much traction. If you want this feature to become a reality, please make yourself heard.
diff --git a/components/engine/reports/builder/2017-05-22.md b/components/engine/reports/builder/2017-05-22.md
new file mode 100644
index 0000000000..29ecc6bb9a
--- /dev/null
+++ b/components/engine/reports/builder/2017-05-22.md
@@ -0,0 +1,47 @@
+# Development Report for May 22, 2017
+
+### New feature: Long running session
+
+PR for [adding long-running session between daemon and cli](https://github.com/moby/moby/pull/32677) that enables advanced features like incremental context send, build credentials from the client, ssh forwarding etc. is ready for reviews. This is blocking many new features like token signing, not pulling unnecessary context files, exposing sources outside working directory etc.
+
+
+### Quality: Dependency interface switch
+
+Work continues on making the builder dependency interface more stable.
+
+Merged as part of this effort this week:
+
+- [Refactor COPY/ADD dispatchers](https://github.com/moby/moby/pull/33116)
+
+In review:
+- [Refactor builder probe cache and container backend](https://github.com/moby/moby/pull/33061)
+
+### Buildkit
+
+[Diff and snapshot services](https://github.com/containerd/containerd/pull/849) were added to containerd. This is a required dependency for [buildkit](https://github.com/moby/moby/issues/32925).
+
+### Proposals discussed in maintainers meeting
+
+New builder proposals were discussed in maintainers meeting. The decision was to give 2 more weeks for anyone to post feedback to [IMPORT/EXPORT commands](https://github.com/moby/moby/issues/32100) and [`RUN --mount`](https://github.com/moby/moby/issues/32507) and accept them for development if nothing significant comes up.
+
+Build secrets and its possible overlap with [--mount](https://github.com/moby/moby/issues/32507) was discussed as well. The decision was to create a [new issue](https://github.com/moby/moby/issues/33343)(as the [old PR](https://github.com/moby/moby/pull/30637) is closed) to track this and avoid it from blocking `--mount` implementation. 
+
+### Proposals for new Dockerfile features that need design feedback:
+
+[Add IMPORT/EXPORT commands to Dockerfile](https://github.com/moby/moby/issues/32100)
+
+[Add `DOCKEROS/DOCKERARCH` default ARG to Dockerfile](https://github.com/moby/moby/issues/32487)
+
+[Add support for `RUN --mount`](https://github.com/moby/moby/issues/32507)
+
+[DAG image builder](https://github.com/moby/moby/issues/32550)
+
+[Option to export the hash of the build context](https://github.com/moby/moby/issues/32963) (new)
+
+[Allow --cache-from=*](https://github.com/moby/moby/issues/33002#issuecomment-299041162) (new)
+
+If you are interested in implementing any of them, leave a comment on the specific issues.
+
+### Other new builder features currently in code-review:
+
+-
diff --git a/components/engine/reports/builder/2017-05-29.md b/components/engine/reports/builder/2017-05-29.md
new file mode 100644
index 0000000000..33043d9f3b
--- /dev/null
+++ b/components/engine/reports/builder/2017-05-29.md
@@ -0,0 +1,52 @@
+# Development Report for May 29, 2017
+
+### New feature: Long running session
+
+PR for [adding long-running session between daemon and cli](https://github.com/moby/moby/pull/32677) that enables advanced features like incremental context send, build credentials from the client, ssh forwarding, etc. is ready for reviews. It is blocking many new features like the token signing, not pulling unnecessary context files, exposing sources outside working directory, etc. Maintainers are encouraged to give this one a review!
+
+
+### Quality: Dependency interface switch
+
+Work continues on making the builder dependency interface more stable.
+
+Merged as part of this effort this week:
+
+- [Refactor builder probe cache and container backend](https://github.com/moby/moby/pull/33061)
+
+@dnephin continues working on the copy/export aspects of the interface.
+
+### Buildkit
+
+Some initial proof of concept code for [buildkit](https://github.com/moby/moby/issues/32925) has been pushed to https://github.com/tonistiigi/buildkit_poc . It's in a very early exploratory stage. Current development has been about providing concurrent references based access to the snapshot data that is backed by containerd. More info should follow in next weeks, including hopefully opening up an official repo. If you have questions or want to help, stop by the issues section of that repo or the proposal in moby/moby.
+
+### Proposals discussed in maintainers meeting
+
+Reminder from last week: New builder proposals were discussed in maintainers meeting. The decision was to give 2 more weeks for anyone to post feedback to [IMPORT/EXPORT commands](https://github.com/moby/moby/issues/32100) and [`RUN --mount`](https://github.com/moby/moby/issues/32507) and accept them for development if nothing significant comes up.
+
+New issue about [build secrets](https://github.com/moby/moby/issues/33343) has not got much traction. If you want this feature to become a reality please make yourself heard.
+
+### Proposals for new Dockerfile features that need design feedback:
+
+[Add IMPORT/EXPORT commands to Dockerfile](https://github.com/moby/moby/issues/32100)
+
+[Add `DOCKEROS/DOCKERARCH` default ARG to Dockerfile](https://github.com/moby/moby/issues/32487)
+
+[Add support for `RUN --mount`](https://github.com/moby/moby/issues/32507)
+
+[DAG image builder](https://github.com/moby/moby/issues/32550)
+
+[Option to export the hash of the build context](https://github.com/moby/moby/issues/32963) (new)
+
+[Allow --cache-from=*](https://github.com/moby/moby/issues/33002#issuecomment-299041162) (new)
+
+If you are interested in implementing any of them, leave a comment on the specific issues.
+
+### Other new builder features currently in code-review:
+
+[Fix canceling builder on chunked requests](https://github.com/moby/moby/pull/33363)
+
+[Fix parser directive refactoring](https://github.com/moby/moby/pull/33436)
+
+[Warn/deprecate continuing on empty lines in `Dockerfile`](https://github.com/moby/moby/pull/29161)
+
+[Fix behavior of absolute paths in .dockerignore](https://github.com/moby/moby/pull/32088)
\ No newline at end of file
diff --git a/components/engine/reports/builder/2017-06-05.md b/components/engine/reports/builder/2017-06-05.md
new file mode 100644
index 0000000000..3746c2639e
--- /dev/null
+++ b/components/engine/reports/builder/2017-06-05.md
@@ -0,0 +1,58 @@
+# Development Report for June 5, 2017
+
+### New feature: Long running session
+
+Similarly to last week, the PR for [adding long-running session between daemon and cli](https://github.com/moby/moby/pull/32677) is waiting for reviews.  It is blocking many new features like the token signing, not pulling unnecessary context files, exposing sources outside working directory, etc. Maintainers are encouraged to give this one a review so it can be included in `v17.07` release.
+
+
+### Quality: Dependency interface switch
+
+Work continues on making the builder dependency interface more stable.
+
+PRs currently in review as part of this effort:
+
+- [Move file copying from the daemon to the builder](https://github.com/moby/moby/pull/33454)
+
+This PR is the core of the update that removes the need to track active containers and instead of lets builder hold references to layers while it's running.
+
+Related to this, @simonferquel opened a [WIP PR](https://github.com/moby/moby/pull/33492) that introduces typed Dockerfile parsing. This enables making [decisions about dependencies](https://github.com/moby/moby/issues/32550#issuecomment-297867334) between build stages and reusing Dockerfile parsing as a buildkit frontend.
+
+### Buildkit
+
+Some initial proof of concept code for [buildkit](https://github.com/moby/moby/issues/32925) has been pushed to https://github.com/tonistiigi/buildkit_poc . It's in a very early exploratory stage. Current codebase includes libraries for getting concurrency safe references to containerd snapshots using a centralized cache management instance. There is a sample source implementation for pulling images to these snapshots and executing jobs with runc on top of them. There is also some utility code for concurrent execution and progress stream handling. More info should follow in next weeks, including hopefully opening up an official repo. If you have questions or want to help, stop by the issues section of that repo or the proposal in moby/moby.
+
+### Proposals discussed in maintainers meeting
+
+Reminder from last week: New builder proposals were discussed in maintainers meeting. The decision was to give two more weeks for anyone to post feedback to [IMPORT/EXPORT commands](https://github.com/moby/moby/issues/32100) and [`RUN --mount`](https://github.com/moby/moby/issues/32507) and accept them for development if nothing significant comes up. It is the last week to post your feedback on these proposals or the comments in them. You can also volunteer to implement them.
+
+A new issue about [build secrets](https://github.com/moby/moby/issues/33343) has not got much traction. If you want this feature to become a reality, please make yourself heard.
+
+### Proposals for new Dockerfile features that need design feedback:
+
+[Add IMPORT/EXPORT commands to Dockerfile](https://github.com/moby/moby/issues/32100)
+
+[Add `DOCKEROS/DOCKERARCH` default ARG to Dockerfile](https://github.com/moby/moby/issues/32487)
+
+[Add support for `RUN --mount`](https://github.com/moby/moby/issues/32507)
+
+[DAG image builder](https://github.com/moby/moby/issues/32550)
+
+[Option to export the hash of the build context](https://github.com/moby/moby/issues/32963) (new)
+
+[Allow --cache-from=*](https://github.com/moby/moby/issues/33002#issuecomment-299041162) (new)
+
+[Provide advanced .dockeringore use-cases](https://github.com/moby/moby/issues/12886) [2](https://github.com/moby/moby/issues/12886#issuecomment-306247989)
+
+If you are interested in implementing any of them, leave a comment on the specific issues.
+
+### Other builder PRs merged last week
+
+[Fix canceling builder on chunked requests](https://github.com/moby/moby/pull/33363)
+
+[Fix parser directive refactoring](https://github.com/moby/moby/pull/33436)
+
+### Builder features currently in code-review:
+
+[Warn/deprecate continuing on empty lines in `Dockerfile`](https://github.com/moby/moby/pull/29161)
+
+[Fix behavior of absolute paths in .dockerignore](https://github.com/moby/moby/pull/32088)
\ No newline at end of file
diff --git a/components/engine/reports/builder/2017-06-12.md b/components/engine/reports/builder/2017-06-12.md
new file mode 100644
index 0000000000..df5d801e76
--- /dev/null
+++ b/components/engine/reports/builder/2017-06-12.md
@@ -0,0 +1,58 @@
+# Development Report for June 12, 2017
+
+
+### Buildkit
+
+[Proposal](https://github.com/moby/moby/issues/32925)
+
+More updates to the [POC repo](https://github.com/tonistiigi/buildkit_poc). It now contains binaries for the daemon and client. Examples directory shows a way for invoking a build job by generating the internal low-level build graph definition with a helper binary(as there is not support for frontends yet). The grpc control server binary can be built in two versions, one that connects to containerD socket and other that doesn't have any external dependencies.
+
+If you have questions or want to help, stop by the issues section of that repo or the proposal in moby/moby.
+
+### Typed Dockerfile parsing
+
+[PR](https://github.com/moby/moby/pull/33492)
+
+New PR that enables parsing Dockerfiles into typed structures so they can be preprocessed to eliminate unnecessary build stages and reused with different kinds of dispatchers.
+
+### Long running session & incremental file sending
+
+[PR ](https://github.com/moby/moby/pull/32677) 
+
+Same status as last week. The PR went through one pass of review from @dnephin and has been rebased again. Maintainers are encouraged to give this one a review so it can be included in `v17.07` release.
+
+
+### Quality: Dependency interface switch
+
+[Move file copying from the daemon to the builder](https://github.com/moby/moby/pull/33454) PR is waiting for a second review. 
+
+### Proposals for new Dockerfile features that need design feedback:
+
+[Add IMPORT/EXPORT commands to Dockerfile](https://github.com/moby/moby/issues/32100)
+
+[Add `DOCKEROS/DOCKERARCH` default ARG to Dockerfile](https://github.com/moby/moby/issues/32487)
+
+[Add support for `RUN --mount`](https://github.com/moby/moby/issues/32507)
+
+[DAG image builder](https://github.com/moby/moby/issues/32550)
+
+[Option to export the hash of the build context](https://github.com/moby/moby/issues/32963) (new)
+
+[Allow --cache-from=*](https://github.com/moby/moby/issues/33002#issuecomment-299041162) (new)
+
+[Provide advanced .dockeringore use-cases](https://github.com/moby/moby/issues/12886) [2](https://github.com/moby/moby/issues/12886#issuecomment-306247989)
+
+If you are interested in implementing any of them, leave a comment on the specific issues.
+
+### Other builder PRs merged last week
+
+
+### Builder features currently in code-review:
+
+[Warn/deprecate continuing on empty lines in `Dockerfile`](https://github.com/moby/moby/pull/29161)
+
+[Fix behavior of absolute paths in .dockerignore](https://github.com/moby/moby/pull/32088)
+
+### Backlog
+
+[Build secrets](https://github.com/moby/moby/issues/33343) has not got much traction. If you want this feature to become a reality, please make yourself heard.
\ No newline at end of file
diff --git a/components/engine/runconfig/opts/envfile.go b/components/engine/runconfig/opts/envfile.go
deleted file mode 100644
index f723799215..0000000000
--- a/components/engine/runconfig/opts/envfile.go
+++ /dev/null
@@ -1,81 +0,0 @@
-package opts
-
-import (
-	"bufio"
-	"bytes"
-	"fmt"
-	"os"
-	"strings"
-	"unicode"
-	"unicode/utf8"
-)
-
-// ParseEnvFile reads a file with environment variables enumerated by lines
-//
-// ``Environment variable names used by the utilities in the Shell and
-// Utilities volume of IEEE Std 1003.1-2001 consist solely of uppercase
-// letters, digits, and the '_' (underscore) from the characters defined in
-// Portable Character Set and do not begin with a digit. *But*, other
-// characters may be permitted by an implementation; applications shall
-// tolerate the presence of such names.''
-// -- http://pubs.opengroup.org/onlinepubs/009695399/basedefs/xbd_chap08.html
-//
-// As of #16585, it's up to application inside docker to validate or not
-// environment variables, that's why we just strip leading whitespace and
-// nothing more.
-func ParseEnvFile(filename string) ([]string, error) {
-	fh, err := os.Open(filename)
-	if err != nil {
-		return []string{}, err
-	}
-	defer fh.Close()
-
-	lines := []string{}
-	scanner := bufio.NewScanner(fh)
-	currentLine := 0
-	utf8bom := []byte{0xEF, 0xBB, 0xBF}
-	for scanner.Scan() {
-		scannedBytes := scanner.Bytes()
-		if !utf8.Valid(scannedBytes) {
-			return []string{}, fmt.Errorf("env file %s contains invalid utf8 bytes at line %d: %v", filename, currentLine+1, scannedBytes)
-		}
-		// We trim UTF8 BOM
-		if currentLine == 0 {
-			scannedBytes = bytes.TrimPrefix(scannedBytes, utf8bom)
-		}
-		// trim the line from all leading whitespace first
-		line := strings.TrimLeftFunc(string(scannedBytes), unicode.IsSpace)
-		currentLine++
-		// line is not empty, and not starting with '#'
-		if len(line) > 0 && !strings.HasPrefix(line, "#") {
-			data := strings.SplitN(line, "=", 2)
-
-			// trim the front of a variable, but nothing else
-			variable := strings.TrimLeft(data[0], whiteSpaces)
-			if strings.ContainsAny(variable, whiteSpaces) {
-				return []string{}, ErrBadEnvVariable{fmt.Sprintf("variable '%s' has white spaces", variable)}
-			}
-
-			if len(data) > 1 {
-
-				// pass the value through, no trimming
-				lines = append(lines, fmt.Sprintf("%s=%s", variable, data[1]))
-			} else {
-				// if only a pass-through variable is given, clean it up.
-				lines = append(lines, fmt.Sprintf("%s=%s", strings.TrimSpace(line), os.Getenv(line)))
-			}
-		}
-	}
-	return lines, scanner.Err()
-}
-
-var whiteSpaces = " \t"
-
-// ErrBadEnvVariable typed error for bad environment variable
-type ErrBadEnvVariable struct {
-	msg string
-}
-
-func (e ErrBadEnvVariable) Error() string {
-	return fmt.Sprintf("poorly formatted environment: %s", e.msg)
-}
diff --git a/components/engine/runconfig/opts/envfile_test.go b/components/engine/runconfig/opts/envfile_test.go
deleted file mode 100644
index f3faabe3c0..0000000000
--- a/components/engine/runconfig/opts/envfile_test.go
+++ /dev/null
@@ -1,141 +0,0 @@
-package opts
-
-import (
-	"bufio"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-func tmpFileWithContent(content string, t *testing.T) string {
-	tmpFile, err := ioutil.TempFile("", "envfile-test")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer tmpFile.Close()
-
-	tmpFile.WriteString(content)
-	return tmpFile.Name()
-}
-
-// Test ParseEnvFile for a file with a few well formatted lines
-func TestParseEnvFileGoodFile(t *testing.T) {
-	content := `foo=bar
-    baz=quux
-# comment
-
-_foobar=foobaz
-with.dots=working
-and_underscore=working too
-`
-	// Adding a newline + a line with pure whitespace.
-	// This is being done like this instead of the block above
-	// because it's common for editors to trim trailing whitespace
-	// from lines, which becomes annoying since that's the
-	// exact thing we need to test.
-	content += "\n    \t  "
-	tmpFile := tmpFileWithContent(content, t)
-	defer os.Remove(tmpFile)
-
-	lines, err := ParseEnvFile(tmpFile)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	expectedLines := []string{
-		"foo=bar",
-		"baz=quux",
-		"_foobar=foobaz",
-		"with.dots=working",
-		"and_underscore=working too",
-	}
-
-	if !reflect.DeepEqual(lines, expectedLines) {
-		t.Fatal("lines not equal to expectedLines")
-	}
-}
-
-// Test ParseEnvFile for an empty file
-func TestParseEnvFileEmptyFile(t *testing.T) {
-	tmpFile := tmpFileWithContent("", t)
-	defer os.Remove(tmpFile)
-
-	lines, err := ParseEnvFile(tmpFile)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if len(lines) != 0 {
-		t.Fatal("lines not empty; expected empty")
-	}
-}
-
-// Test ParseEnvFile for a non existent file
-func TestParseEnvFileNonExistentFile(t *testing.T) {
-	_, err := ParseEnvFile("foo_bar_baz")
-	if err == nil {
-		t.Fatal("ParseEnvFile succeeded; expected failure")
-	}
-	if _, ok := err.(*os.PathError); !ok {
-		t.Fatalf("Expected a PathError, got [%v]", err)
-	}
-}
-
-// Test ParseEnvFile for a badly formatted file
-func TestParseEnvFileBadlyFormattedFile(t *testing.T) {
-	content := `foo=bar
-    f   =quux
-`
-
-	tmpFile := tmpFileWithContent(content, t)
-	defer os.Remove(tmpFile)
-
-	_, err := ParseEnvFile(tmpFile)
-	if err == nil {
-		t.Fatalf("Expected an ErrBadEnvVariable, got nothing")
-	}
-	if _, ok := err.(ErrBadEnvVariable); !ok {
-		t.Fatalf("Expected an ErrBadEnvVariable, got [%v]", err)
-	}
-	expectedMessage := "poorly formatted environment: variable 'f   ' has white spaces"
-	if err.Error() != expectedMessage {
-		t.Fatalf("Expected [%v], got [%v]", expectedMessage, err.Error())
-	}
-}
-
-// Test ParseEnvFile for a file with a line exceeding bufio.MaxScanTokenSize
-func TestParseEnvFileLineTooLongFile(t *testing.T) {
-	content := strings.Repeat("a", bufio.MaxScanTokenSize+42)
-	content = fmt.Sprint("foo=", content)
-
-	tmpFile := tmpFileWithContent(content, t)
-	defer os.Remove(tmpFile)
-
-	_, err := ParseEnvFile(tmpFile)
-	if err == nil {
-		t.Fatal("ParseEnvFile succeeded; expected failure")
-	}
-}
-
-// ParseEnvFile with a random file, pass through
-func TestParseEnvFileRandomFile(t *testing.T) {
-	content := `first line
-another invalid line`
-	tmpFile := tmpFileWithContent(content, t)
-	defer os.Remove(tmpFile)
-
-	_, err := ParseEnvFile(tmpFile)
-	if err == nil {
-		t.Fatalf("Expected an ErrBadEnvVariable, got nothing")
-	}
-	if _, ok := err.(ErrBadEnvVariable); !ok {
-		t.Fatalf("Expected an ErrBadEnvVariable, got [%v]", err)
-	}
-	expectedMessage := "poorly formatted environment: variable 'first line' has white spaces"
-	if err.Error() != expectedMessage {
-		t.Fatalf("Expected [%v], got [%v]", expectedMessage, err.Error())
-	}
-}
diff --git a/components/engine/runconfig/opts/parse.go b/components/engine/runconfig/opts/parse.go
index a88ea1385a..a7f1b79f16 100644
--- a/components/engine/runconfig/opts/parse.go
+++ b/components/engine/runconfig/opts/parse.go
@@ -1,30 +1,9 @@
 package opts
 
 import (
-	"fmt"
-	"strconv"
 	"strings"
-
-	"github.com/docker/docker/api/types/container"
 )
 
-// ReadKVStrings reads a file of line terminated key=value pairs, and overrides any keys
-// present in the file with additional pairs specified in the override parameter
-func ReadKVStrings(files []string, override []string) ([]string, error) {
-	envVariables := []string{}
-	for _, ef := range files {
-		parsedVars, err := ParseEnvFile(ef)
-		if err != nil {
-			return nil, err
-		}
-		envVariables = append(envVariables, parsedVars...)
-	}
-	// parse the '-e' and '--env' after, to allow override
-	envVariables = append(envVariables, override...)
-
-	return envVariables, nil
-}
-
 // ConvertKVStringsToMap converts ["key=value"] to {"key":"value"}
 func ConvertKVStringsToMap(values []string) map[string]string {
 	result := make(map[string]string, len(values))
@@ -39,49 +18,3 @@ func ConvertKVStringsToMap(values []string) map[string]string {
 
 	return result
 }
-
-// ConvertKVStringsToMapWithNil converts ["key=value"] to {"key":"value"}
-// but set unset keys to nil - meaning the ones with no "=" in them.
-// We use this in cases where we need to distinguish between
-//   FOO=  and FOO
-// where the latter case just means FOO was mentioned but not given a value
-func ConvertKVStringsToMapWithNil(values []string) map[string]*string {
-	result := make(map[string]*string, len(values))
-	for _, value := range values {
-		kv := strings.SplitN(value, "=", 2)
-		if len(kv) == 1 {
-			result[kv[0]] = nil
-		} else {
-			result[kv[0]] = &kv[1]
-		}
-	}
-
-	return result
-}
-
-// ParseRestartPolicy returns the parsed policy or an error indicating what is incorrect
-func ParseRestartPolicy(policy string) (container.RestartPolicy, error) {
-	p := container.RestartPolicy{}
-
-	if policy == "" {
-		return p, nil
-	}
-
-	parts := strings.Split(policy, ":")
-
-	if len(parts) > 2 {
-		return p, fmt.Errorf("invalid restart policy format")
-	}
-	if len(parts) == 2 {
-		count, err := strconv.Atoi(parts[1])
-		if err != nil {
-			return p, fmt.Errorf("maximum retry count must be an integer")
-		}
-
-		p.MaximumRetryCount = count
-	}
-
-	p.Name = parts[0]
-
-	return p, nil
-}
diff --git a/components/engine/vendor.conf b/components/engine/vendor.conf
index 35708e168c..fc7f643b27 100644
--- a/components/engine/vendor.conf
+++ b/components/engine/vendor.conf
@@ -1,6 +1,6 @@
 # the following lines are in sorted order, FYI
 github.com/Azure/go-ansiterm 388960b655244e76e24c75f48631564eaefade62
-github.com/Microsoft/hcsshim v0.5.17
+github.com/Microsoft/hcsshim v0.5.25
 github.com/Microsoft/go-winio v0.4.2
 github.com/Sirupsen/logrus v0.11.0
 github.com/davecgh/go-spew 346938d642f2ec3594ed81d874461961cd0faa76
@@ -8,12 +8,13 @@ github.com/docker/libtrust 9cbd2a1374f46905c68a4eb3694a130610adc62a
 github.com/go-check/check 4ed411733c5785b40214c70bce814c3a3a689609 https://github.com/cpuguy83/check.git
 github.com/gorilla/context v1.1
 github.com/gorilla/mux v1.1
+github.com/jhowardmsft/opengcs v0.0.4
 github.com/kr/pty 5cf931ef8f
 github.com/mattn/go-shellwords v1.0.3
 github.com/tchap/go-patricia v2.2.6
 github.com/vdemeester/shakers 24d7f1d6a71aa5d9cbe7390e4afb66b7eef9e1b3
 # forked golang.org/x/net package includes a patch for lazy loading trace templates
-golang.org/x/net c427ad74c6d7a814201695e9ffde0c5d400a7674
+golang.org/x/net 7dcfb8076726a3fdd9353b6b8a1f1b6be6811bd6
 golang.org/x/sys 8f0908ab3b2457e2e15403d3697c9ef5cb4b57a9
 github.com/docker/go-units 9e638d38cf6977a37a8ea0078f3ee75a7cdb2dd1
 github.com/docker/go-connections e15c02316c12de00874640cd76311849de2aeed5
@@ -26,7 +27,7 @@ github.com/imdario/mergo 0.2.1
 golang.org/x/sync de49d9dcd27d4f764488181bea099dfe6179bcf0
 
 #get libnetwork packages
-github.com/docker/libnetwork 83e1e49475b88a9f1f8ba89a690a7d5de42e24b9
+github.com/docker/libnetwork 6426d1e66f33c0b0c8bb135b7ee547447f54d043
 github.com/docker/go-events 18b43f1bc85d9cdd42c05a6cd2d444c7a200a894
 github.com/armon/go-radix e39d623f12e8e41c7b5529e9a9dd67a1e2261f80
 github.com/armon/go-metrics eb0af217e5e9747e41dd5303755356b62d28e3ec
@@ -38,7 +39,7 @@ github.com/hashicorp/go-multierror fcdddc395df1ddf4247c69bd436e84cfa0733f7e
 github.com/hashicorp/serf 598c54895cc5a7b1a24a398d635e8c0ea0959870
 github.com/docker/libkv 1d8431073ae03cdaedb198a89722f3aab6d418ef
 github.com/vishvananda/netns 604eaf189ee867d8c147fafc28def2394e878d25
-github.com/vishvananda/netlink 1e86b2bee5b6a7d377e4c02bb7f98209d6a7297c
+github.com/vishvananda/netlink bd6d5de5ccef2d66b0a26177928d0d8895d7f969
 github.com/BurntSushi/toml f706d00e3de6abe700c994cdd545a1a4915af060
 github.com/samuel/go-zookeeper d0e0d8e11f318e000a8cc434616d69e329edc374
 github.com/deckarep/golang-set ef32fa3046d9f249d399f98ebaf9be944430fd1d
@@ -57,11 +58,10 @@ github.com/opencontainers/go-digest a6d0ee40d4207ea02364bd3b9e8e77b9159ba1eb
 github.com/mistifyio/go-zfs 22c9b32c84eb0d0c6f4043b6e90fc94073de92fa
 github.com/pborman/uuid v1.0
 
-google.golang.org/grpc v1.0.4
-github.com/miekg/pkcs11 df8ae6ca730422dba20c768ff38ef7d79077a59f
+google.golang.org/grpc v1.3.0
 
 # When updating, also update RUNC_COMMIT in hack/dockerfile/binaries-commits accordingly
-github.com/opencontainers/runc 992a5be178a62e026f4069f443c6164912adbf09
+github.com/opencontainers/runc 2d41c047c83e09a6d61d464906feb2a2f3c52aa4 https://github.com/docker/runc
 github.com/opencontainers/image-spec f03dbe35d449c54915d235f1a3cf8f585a24babe
 github.com/opencontainers/runtime-spec d42f1eb741e6361e858d83fc75aa6893b66292c4 # specs
 
@@ -71,7 +71,7 @@ github.com/seccomp/libseccomp-golang 32f571b70023028bd57d9288c20efbcb237f3ce0
 github.com/coreos/go-systemd v4
 github.com/godbus/dbus v4.0.0
 github.com/syndtr/gocapability 2c00daeb6c3b45114c80ac44119e7b8801fdd852
-github.com/golang/protobuf 8ee79997227bf9b34611aee7946ae64735e6fd93
+github.com/golang/protobuf 7a211bcf3bce0e3f1d74f9894916e6f116ae83b4
 
 # gelf logging driver deps
 github.com/Graylog2/go-gelf 7029da823dad4ef3a876df61065156acb703b2ea
@@ -97,14 +97,16 @@ golang.org/x/oauth2 96382aa079b72d8c014eb0c50f6c223d1e6a2de0
 google.golang.org/api 3cc2e591b550923a2c5f0ab5a803feda924d5823
 cloud.google.com/go 9d965e63e8cceb1b5d7977a202f0fcb8866d6525
 github.com/googleapis/gax-go da06d194a00e19ce00d9011a13931c3f6f6887c7
-google.golang.org/genproto b3e7c2fb04031add52c4817f53f43757ccbf9c18
+google.golang.org/genproto d80a6e20e776b0b17a324d0ba1ab50a39c8e8944
 
 # containerd
 github.com/containerd/containerd 3addd840653146c90a254301d6c3a663c7fd6429
 github.com/tonistiigi/fifo 1405643975692217d6720f8b54aeee1bf2cd5cf4
+github.com/stevvooe/continuity cd7a8e21e2b6f84799f5dd4b65faf49c8d3ee02d
+github.com/tonistiigi/fsutil 0ac4c11b053b9c5c7c47558f81f96c7100ce50fb
 
 # cluster
-github.com/docker/swarmkit eb07af52aa2216100cff1ad0b13df48daa8914bf
+github.com/docker/swarmkit 79381d0840be27f8b3f5c667b348a4467d866eeb
 github.com/gogo/protobuf v0.4
 github.com/cloudflare/cfssl 7fb22c8cba7ecaf98e4082d22d65800cf45e042a
 github.com/google/certificate-transparency d90e65c3a07988180c5b1ece71791c0b6506826e
diff --git a/components/engine/vendor/github.com/Microsoft/hcsshim/container.go b/components/engine/vendor/github.com/Microsoft/hcsshim/container.go
index 3a19519fd6..8bc7d6d2b7 100644
--- a/components/engine/vendor/github.com/Microsoft/hcsshim/container.go
+++ b/components/engine/vendor/github.com/Microsoft/hcsshim/container.go
@@ -35,7 +35,6 @@ type ContainerProperties struct {
 	SystemType        string
 	Owner             string
 	SiloGUID          string            `json:"SiloGuid,omitempty"`
-	IsDummy           bool              `json:",omitempty"`
 	RuntimeID         string            `json:"RuntimeId,omitempty"`
 	IsRuntimeTemplate bool              `json:",omitempty"`
 	RuntimeImagePath  string            `json:",omitempty"`
@@ -121,7 +120,7 @@ const (
 // Supported resource types are Network and Request Types are Add/Remove
 type ResourceModificationRequestResponse struct {
 	Resource ResourceType `json:"ResourceType"`
-	Data     string       `json:"Settings"`
+	Data     interface{}  `json:"Settings"`
 	Request  RequestType  `json:"RequestType,omitempty"`
 }
 
@@ -585,7 +584,7 @@ func (container *container) CreateProcess(c *ProcessConfig) (Process, error) {
 		return nil, makeContainerError(container, operation, "", err)
 	}
 
-	logrus.Debugf(title+" succeeded id=%s processid=%s", container.id, process.processID)
+	logrus.Debugf(title+" succeeded id=%s processid=%d", container.id, process.processID)
 	return process, nil
 }
 
diff --git a/components/engine/vendor/github.com/Microsoft/hcsshim/interface.go b/components/engine/vendor/github.com/Microsoft/hcsshim/interface.go
index d981c4fc4c..5238a641ea 100644
--- a/components/engine/vendor/github.com/Microsoft/hcsshim/interface.go
+++ b/components/engine/vendor/github.com/Microsoft/hcsshim/interface.go
@@ -1,6 +1,7 @@
 package hcsshim
 
 import (
+	"encoding/json"
 	"io"
 	"time"
 )
@@ -8,16 +9,19 @@ import (
 // ProcessConfig is used as both the input of Container.CreateProcess
 // and to convert the parameters to JSON for passing onto the HCS
 type ProcessConfig struct {
-	ApplicationName  string
-	CommandLine      string
-	User             string
-	WorkingDirectory string
-	Environment      map[string]string
-	EmulateConsole   bool
-	CreateStdInPipe  bool
-	CreateStdOutPipe bool
-	CreateStdErrPipe bool
-	ConsoleSize      [2]uint
+	ApplicationName   string            `json:",omitempty"`
+	CommandLine       string            `json:",omitempty"`
+	CommandArgs       []string          `json:",omitempty"` // Used by Linux Containers on Windows
+	User              string            `json:",omitempty"`
+	WorkingDirectory  string            `json:",omitempty"`
+	Environment       map[string]string `json:",omitempty"`
+	EmulateConsole    bool              `json:",omitempty"`
+	CreateStdInPipe   bool              `json:",omitempty"`
+	CreateStdOutPipe  bool              `json:",omitempty"`
+	CreateStdErrPipe  bool              `json:",omitempty"`
+	ConsoleSize       [2]uint           `json:",omitempty"`
+	CreateInUtilityVm bool              `json:",omitempty"` // Used by Linux Containers on Windows
+	OCISpecification  *json.RawMessage  `json:",omitempty"` // Used by Linux Containers on Windows
 }
 
 type Layer struct {
@@ -34,39 +38,50 @@ type MappedDir struct {
 }
 
 type HvRuntime struct {
-	ImagePath    string `json:",omitempty"`
-	SkipTemplate bool   `json:",omitempty"`
+	ImagePath       string `json:",omitempty"`
+	SkipTemplate    bool   `json:",omitempty"`
+	LinuxInitrdFile string `json:",omitempty"` // File under ImagePath on host containing an initrd image for starting a Linux utility VM
+	LinuxKernelFile string `json:",omitempty"` // File under ImagePath on host containing a kernel for starting a Linux utility VM
+}
+
+type MappedVirtualDisk struct {
+	HostPath          string `json:",omitempty"` // Path to VHD on the host
+	ContainerPath     string // Platform-specific mount point path in the container
+	CreateInUtilityVM bool   `json:",omitempty"`
+	ReadOnly          bool   `json:",omitempty"`
+	Cache             string `json:",omitempty"` // "" (Unspecified); "Disabled"; "Enabled"; "Private"; "PrivateAllowSharing"
 }
 
 // ContainerConfig is used as both the input of CreateContainer
 // and to convert the parameters to JSON for passing onto the HCS
 type ContainerConfig struct {
-	SystemType                 string      // HCS requires this to be hard-coded to "Container"
-	Name                       string      // Name of the container. We use the docker ID.
-	Owner                      string      // The management platform that created this container
-	IsDummy                    bool        // Used for development purposes.
-	VolumePath                 string      `json:",omitempty"` // Windows volume path for scratch space. Used by Windows Server Containers only. Format \\?\\Volume{GUID}
-	IgnoreFlushesDuringBoot    bool        // Optimization hint for container startup in Windows
-	LayerFolderPath            string      `json:",omitempty"` // Where the layer folders are located. Used by Windows Server Containers only. Format  %root%\windowsfilter\containerID
-	Layers                     []Layer     // List of storage layers. Required for Windows Server and Hyper-V Containers. Format ID=GUID;Path=%root%\windowsfilter\layerID
-	Credentials                string      `json:",omitempty"` // Credentials information
-	ProcessorCount             uint32      `json:",omitempty"` // Number of processors to assign to the container.
-	ProcessorWeight            uint64      `json:",omitempty"` // CPU Shares 0..10000 on Windows; where 0 will be omitted and HCS will default.
-	ProcessorMaximum           int64       `json:",omitempty"` // CPU maximum usage percent 1..100
-	StorageIOPSMaximum         uint64      `json:",omitempty"` // Maximum Storage IOPS
-	StorageBandwidthMaximum    uint64      `json:",omitempty"` // Maximum Storage Bandwidth in bytes per second
-	StorageSandboxSize         uint64      `json:",omitempty"` // Size in bytes that the container system drive should be expanded to if smaller
-	MemoryMaximumInMB          int64       `json:",omitempty"` // Maximum memory available to the container in Megabytes
-	HostName                   string      // Hostname
-	MappedDirectories          []MappedDir // List of mapped directories (volumes/mounts)
-	SandboxPath                string      `json:",omitempty"` // Location of unmounted sandbox. Used by Hyper-V containers only. Format %root%\windowsfilter
-	HvPartition                bool        // True if it a Hyper-V Container
-	EndpointList               []string    // List of networking endpoints to be attached to container
-	NetworkSharedContainerName string      `json:",omitempty"` // Name (ID) of the container that we will share the network stack with.
-	HvRuntime                  *HvRuntime  `json:",omitempty"` // Hyper-V container settings. Used by Hyper-V containers only. Format ImagePath=%root%\BaseLayerID\UtilityVM
-	Servicing                  bool        // True if this container is for servicing
-	AllowUnqualifiedDNSQuery   bool        // True to allow unqualified DNS name resolution
-	DNSSearchList              string      `json:",omitempty"` // Comma seperated list of DNS suffixes to use for name resolution
+	SystemType                  string              // HCS requires this to be hard-coded to "Container"
+	Name                        string              // Name of the container. We use the docker ID.
+	Owner                       string              `json:",omitempty"` // The management platform that created this container
+	VolumePath                  string              `json:",omitempty"` // Windows volume path for scratch space. Used by Windows Server Containers only. Format \\?\\Volume{GUID}
+	IgnoreFlushesDuringBoot     bool                `json:",omitempty"` // Optimization hint for container startup in Windows
+	LayerFolderPath             string              `json:",omitempty"` // Where the layer folders are located. Used by Windows Server Containers only. Format  %root%\windowsfilter\containerID
+	Layers                      []Layer             // List of storage layers. Required for Windows Server and Hyper-V Containers. Format ID=GUID;Path=%root%\windowsfilter\layerID
+	Credentials                 string              `json:",omitempty"` // Credentials information
+	ProcessorCount              uint32              `json:",omitempty"` // Number of processors to assign to the container.
+	ProcessorWeight             uint64              `json:",omitempty"` // CPU Shares 0..10000 on Windows; where 0 will be omitted and HCS will default.
+	ProcessorMaximum            int64               `json:",omitempty"` // CPU maximum usage percent 1..100
+	StorageIOPSMaximum          uint64              `json:",omitempty"` // Maximum Storage IOPS
+	StorageBandwidthMaximum     uint64              `json:",omitempty"` // Maximum Storage Bandwidth in bytes per second
+	StorageSandboxSize          uint64              `json:",omitempty"` // Size in bytes that the container system drive should be expanded to if smaller
+	MemoryMaximumInMB           int64               `json:",omitempty"` // Maximum memory available to the container in Megabytes
+	HostName                    string              `json:",omitempty"` // Hostname
+	MappedDirectories           []MappedDir         `json:",omitempty"` // List of mapped directories (volumes/mounts)
+	HvPartition                 bool                // True if it a Hyper-V Container
+	NetworkSharedContainerName  string              `json:",omitempty"` // Name (ID) of the container that we will share the network stack with.
+	EndpointList                []string            `json:",omitempty"` // List of networking endpoints to be attached to container
+	HvRuntime                   *HvRuntime          `json:",omitempty"` // Hyper-V container settings. Used by Hyper-V containers only. Format ImagePath=%root%\BaseLayerID\UtilityVM
+	Servicing                   bool                `json:",omitempty"` // True if this container is for servicing
+	AllowUnqualifiedDNSQuery    bool                `json:",omitempty"` // True to allow unqualified DNS name resolution
+	DNSSearchList               string              `json:",omitempty"` // Comma seperated list of DNS suffixes to use for name resolution
+	ContainerType               string              `json:",omitempty"` // "Linux" for Linux containers on Windows. Omitted otherwise.
+	TerminateOnLastHandleClosed bool                `json:",omitempty"` // Should HCS terminate the container once all handles have been closed
+	MappedVirtualDisks          []MappedVirtualDisk `json:",omitempty"` // Array of virtual disks to mount at start
 }
 
 type ComputeSystemQuery struct {
diff --git a/components/engine/vendor/github.com/Microsoft/hcsshim/waithelper.go b/components/engine/vendor/github.com/Microsoft/hcsshim/waithelper.go
index 89c94616ad..828d148e58 100644
--- a/components/engine/vendor/github.com/Microsoft/hcsshim/waithelper.go
+++ b/components/engine/vendor/github.com/Microsoft/hcsshim/waithelper.go
@@ -59,4 +59,5 @@ func waitForNotification(callbackNumber uintptr, expectedNotification hcsNotific
 	case <-c:
 		return ErrTimeout
 	}
+	return nil
 }
diff --git a/components/engine/vendor/github.com/docker/libnetwork/agent.go b/components/engine/vendor/github.com/docker/libnetwork/agent.go
index d67d446fe8..a45a569500 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/agent.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/agent.go
@@ -165,13 +165,13 @@ func (c *controller) handleKeyChange(keys []*types.EncryptionKey) error {
 		a.networkDB.SetKey(added)
 	}
 
-	key, tag, err := c.getPrimaryKeyTag(subsysGossip)
+	key, _, err := c.getPrimaryKeyTag(subsysGossip)
 	if err != nil {
 		return err
 	}
 	a.networkDB.SetPrimaryKey(key)
 
-	key, tag, err = c.getPrimaryKeyTag(subsysIPSec)
+	key, tag, err := c.getPrimaryKeyTag(subsysIPSec)
 	if err != nil {
 		return err
 	}
@@ -583,7 +583,7 @@ func (ep *endpoint) deleteDriverInfoFromCluster() error {
 	return nil
 }
 
-func (ep *endpoint) addServiceInfoToCluster() error {
+func (ep *endpoint) addServiceInfoToCluster(sb *sandbox) error {
 	if ep.isAnonymous() && len(ep.myAliases) == 0 || ep.Iface().Address() == nil {
 		return nil
 	}
@@ -593,26 +593,51 @@ func (ep *endpoint) addServiceInfoToCluster() error {
 		return nil
 	}
 
+	sb.Service.Lock()
+	defer sb.Service.Unlock()
+	logrus.Debugf("addServiceInfoToCluster START for %s %s", ep.svcName, ep.ID())
+
+	// Check that the endpoint is still present on the sandbox before adding it to the service discovery.
+	// This is to handle a race between the EnableService and the sbLeave
+	// It is possible that the EnableService starts, fetches the list of the endpoints and
+	// by the time the addServiceInfoToCluster is called the endpoint got removed from the sandbox
+	// The risk is that the deleteServiceInfoToCluster happens before the addServiceInfoToCluster.
+	// This check under the Service lock of the sandbox ensure the correct behavior.
+	// If the addServiceInfoToCluster arrives first may find or not the endpoint and will proceed or exit
+	// but in any case the deleteServiceInfoToCluster will follow doing the cleanup if needed.
+	// In case the deleteServiceInfoToCluster arrives first, this one is happening after the endpoint is
+	// removed from the list, in this situation the delete will bail out not finding any data to cleanup
+	// and the add will bail out not finding the endpoint on the sandbox.
+	if e := sb.getEndpoint(ep.ID()); e == nil {
+		logrus.Warnf("addServiceInfoToCluster suppressing service resolution ep is not anymore in the sandbox %s", ep.ID())
+		return nil
+	}
+
 	c := n.getController()
 	agent := c.getAgent()
 
-	var ingressPorts []*PortConfig
-	if ep.svcID != "" {
-		// Gossip ingress ports only in ingress network.
-		if n.ingress {
-			ingressPorts = ep.ingressPorts
-		}
-
-		if err := c.addServiceBinding(ep.svcName, ep.svcID, n.ID(), ep.ID(), ep.virtualIP, ingressPorts, ep.svcAliases, ep.Iface().Address().IP); err != nil {
-			return err
-		}
-	}
-
 	name := ep.Name()
 	if ep.isAnonymous() {
 		name = ep.MyAliases()[0]
 	}
 
+	var ingressPorts []*PortConfig
+	if ep.svcID != "" {
+		// This is a task part of a service
+		// Gossip ingress ports only in ingress network.
+		if n.ingress {
+			ingressPorts = ep.ingressPorts
+		}
+		if err := c.addServiceBinding(ep.svcName, ep.svcID, n.ID(), ep.ID(), name, ep.virtualIP, ingressPorts, ep.svcAliases, ep.myAliases, ep.Iface().Address().IP, "addServiceInfoToCluster"); err != nil {
+			return err
+		}
+	} else {
+		// This is a container simply attached to an attachable network
+		if err := c.addContainerNameResolution(n.ID(), ep.ID(), name, ep.myAliases, ep.Iface().Address().IP, "addServiceInfoToCluster"); err != nil {
+			return err
+		}
+	}
+
 	buf, err := proto.Marshal(&EndpointRecord{
 		Name:         name,
 		ServiceName:  ep.svcName,
@@ -623,21 +648,23 @@ func (ep *endpoint) addServiceInfoToCluster() error {
 		TaskAliases:  ep.myAliases,
 		EndpointIP:   ep.Iface().Address().IP.String(),
 	})
-
 	if err != nil {
 		return err
 	}
 
 	if agent != nil {
 		if err := agent.networkDB.CreateEntry(libnetworkEPTable, n.ID(), ep.ID(), buf); err != nil {
+			logrus.Warnf("addServiceInfoToCluster NetworkDB CreateEntry failed for %s %s err:%s", ep.id, n.id, err)
 			return err
 		}
 	}
 
+	logrus.Debugf("addServiceInfoToCluster END for %s %s", ep.svcName, ep.ID())
+
 	return nil
 }
 
-func (ep *endpoint) deleteServiceInfoFromCluster() error {
+func (ep *endpoint) deleteServiceInfoFromCluster(sb *sandbox, method string) error {
 	if ep.isAnonymous() && len(ep.myAliases) == 0 {
 		return nil
 	}
@@ -647,26 +674,45 @@ func (ep *endpoint) deleteServiceInfoFromCluster() error {
 		return nil
 	}
 
+	sb.Service.Lock()
+	defer sb.Service.Unlock()
+	logrus.Debugf("deleteServiceInfoFromCluster from %s START for %s %s", method, ep.svcName, ep.ID())
+
 	c := n.getController()
 	agent := c.getAgent()
 
-	if ep.svcID != "" && ep.Iface().Address() != nil {
-		var ingressPorts []*PortConfig
-		if n.ingress {
-			ingressPorts = ep.ingressPorts
-		}
-
-		if err := c.rmServiceBinding(ep.svcName, ep.svcID, n.ID(), ep.ID(), ep.virtualIP, ingressPorts, ep.svcAliases, ep.Iface().Address().IP); err != nil {
-			return err
-		}
+	name := ep.Name()
+	if ep.isAnonymous() {
+		name = ep.MyAliases()[0]
 	}
 
 	if agent != nil {
+		// First delete from networkDB then locally
 		if err := agent.networkDB.DeleteEntry(libnetworkEPTable, n.ID(), ep.ID()); err != nil {
-			return err
+			logrus.Warnf("deleteServiceInfoFromCluster NetworkDB DeleteEntry failed for %s %s err:%s", ep.id, n.id, err)
 		}
 	}
 
+	if ep.Iface().Address() != nil {
+		if ep.svcID != "" {
+			// This is a task part of a service
+			var ingressPorts []*PortConfig
+			if n.ingress {
+				ingressPorts = ep.ingressPorts
+			}
+			if err := c.rmServiceBinding(ep.svcName, ep.svcID, n.ID(), ep.ID(), name, ep.virtualIP, ingressPorts, ep.svcAliases, ep.myAliases, ep.Iface().Address().IP, "deleteServiceInfoFromCluster", true); err != nil {
+				return err
+			}
+		} else {
+			// This is a container simply attached to an attachable network
+			if err := c.delContainerNameResolution(n.ID(), ep.ID(), name, ep.myAliases, ep.Iface().Address().IP, "deleteServiceInfoFromCluster"); err != nil {
+				return err
+			}
+		}
+	}
+
+	logrus.Debugf("deleteServiceInfoFromCluster from %s END for %s %s", method, ep.svcName, ep.ID())
+
 	return nil
 }
 
@@ -722,15 +768,13 @@ func (n *network) cancelDriverWatches() {
 	}
 }
 
-func (c *controller) handleTableEvents(ch chan events.Event, fn func(events.Event)) {
+func (c *controller) handleTableEvents(ch *events.Channel, fn func(events.Event)) {
 	for {
 		select {
-		case ev, ok := <-ch:
-			if !ok {
-				return
-			}
-
+		case ev := <-ch.C:
 			fn(ev)
+		case <-ch.Done():
+			return
 		}
 	}
 }
@@ -816,58 +860,56 @@ func (c *controller) handleEpTableEvent(ev events.Event) {
 		value = event.Value
 	case networkdb.UpdateEvent:
 		logrus.Errorf("Unexpected update service table event = %#v", event)
-	}
-
-	nw, err := c.NetworkByID(nid)
-	if err != nil {
-		logrus.Errorf("Could not find network %s while handling service table event: %v", nid, err)
 		return
 	}
-	n := nw.(*network)
 
-	err = proto.Unmarshal(value, &epRec)
+	err := proto.Unmarshal(value, &epRec)
 	if err != nil {
 		logrus.Errorf("Failed to unmarshal service table value: %v", err)
 		return
 	}
 
-	name := epRec.Name
+	containerName := epRec.Name
 	svcName := epRec.ServiceName
 	svcID := epRec.ServiceID
 	vip := net.ParseIP(epRec.VirtualIP)
 	ip := net.ParseIP(epRec.EndpointIP)
 	ingressPorts := epRec.IngressPorts
-	aliases := epRec.Aliases
-	taskaliases := epRec.TaskAliases
+	serviceAliases := epRec.Aliases
+	taskAliases := epRec.TaskAliases
 
-	if name == "" || ip == nil {
+	if containerName == "" || ip == nil {
 		logrus.Errorf("Invalid endpoint name/ip received while handling service table event %s", value)
 		return
 	}
 
 	if isAdd {
+		logrus.Debugf("handleEpTableEvent ADD %s R:%v", eid, epRec)
 		if svcID != "" {
-			if err := c.addServiceBinding(svcName, svcID, nid, eid, vip, ingressPorts, aliases, ip); err != nil {
-				logrus.Errorf("Failed adding service binding for value %s: %v", value, err)
+			// This is a remote task part of a service
+			if err := c.addServiceBinding(svcName, svcID, nid, eid, containerName, vip, ingressPorts, serviceAliases, taskAliases, ip, "handleEpTableEvent"); err != nil {
+				logrus.Errorf("failed adding service binding for %s epRec:%v err:%s", eid, epRec, err)
 				return
 			}
-		}
-
-		n.addSvcRecords(name, ip, nil, true)
-		for _, alias := range taskaliases {
-			n.addSvcRecords(alias, ip, nil, true)
+		} else {
+			// This is a remote container simply attached to an attachable network
+			if err := c.addContainerNameResolution(nid, eid, containerName, taskAliases, ip, "handleEpTableEvent"); err != nil {
+				logrus.Errorf("failed adding service binding for %s epRec:%v err:%s", eid, epRec, err)
+			}
 		}
 	} else {
+		logrus.Debugf("handleEpTableEvent DEL %s R:%v", eid, epRec)
 		if svcID != "" {
-			if err := c.rmServiceBinding(svcName, svcID, nid, eid, vip, ingressPorts, aliases, ip); err != nil {
-				logrus.Errorf("Failed adding service binding for value %s: %v", value, err)
+			// This is a remote task part of a service
+			if err := c.rmServiceBinding(svcName, svcID, nid, eid, containerName, vip, ingressPorts, serviceAliases, taskAliases, ip, "handleEpTableEvent", true); err != nil {
+				logrus.Errorf("failed removing service binding for %s epRec:%v err:%s", eid, epRec, err)
 				return
 			}
-		}
-
-		n.deleteSvcRecords(name, ip, nil, true)
-		for _, alias := range taskaliases {
-			n.deleteSvcRecords(alias, ip, nil, true)
+		} else {
+			// This is a remote container simply attached to an attachable network
+			if err := c.delContainerNameResolution(nid, eid, containerName, taskAliases, ip, "handleEpTableEvent"); err != nil {
+				logrus.Errorf("failed adding service binding for %s epRec:%v err:%s", eid, epRec, err)
+			}
 		}
 	}
 }
diff --git a/components/engine/vendor/github.com/docker/libnetwork/agent.proto b/components/engine/vendor/github.com/docker/libnetwork/agent.proto
index 0b7708e32b..54c71c0e2a 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/agent.proto
+++ b/components/engine/vendor/github.com/docker/libnetwork/agent.proto
@@ -14,7 +14,7 @@ option (gogoproto.goproto_stringer_all) = false;
 // EndpointRecord specifies all the endpoint specific information that
 // needs to gossiped to nodes participating in the network.
 message EndpointRecord {
-	// Name of the endpoint
+	// Name of the container
 	string name = 1;
 
 	// Service name of the service to which this endpoint belongs.
diff --git a/components/engine/vendor/github.com/docker/libnetwork/common/setmatrix.go b/components/engine/vendor/github.com/docker/libnetwork/common/setmatrix.go
new file mode 100644
index 0000000000..72be5bbbfc
--- /dev/null
+++ b/components/engine/vendor/github.com/docker/libnetwork/common/setmatrix.go
@@ -0,0 +1,135 @@
+package common
+
+import (
+	"sync"
+
+	mapset "github.com/deckarep/golang-set"
+)
+
+// SetMatrix is a map of Sets
+type SetMatrix interface {
+	// Get returns the members of the set for a specific key as a slice.
+	Get(key string) ([]interface{}, bool)
+	// Contains is used to verify if an element is in a set for a specific key
+	// returns true if the element is in the set
+	// returns true if there is a set for the key
+	Contains(key string, value interface{}) (bool, bool)
+	// Insert inserts the value in the set of a key
+	// returns true if the value is inserted (was not already in the set), false otherwise
+	// returns also the length of the set for the key
+	Insert(key string, value interface{}) (bool, int)
+	// Remove removes the value in the set for a specific key
+	// returns true if the value is deleted, false otherwise
+	// returns also the length of the set for the key
+	Remove(key string, value interface{}) (bool, int)
+	// Cardinality returns the number of elements in the set for a key
+	// returns false if the set is not present
+	Cardinality(key string) (int, bool)
+	// String returns the string version of the set, empty otherwise
+	// returns false if the set is not present
+	String(key string) (string, bool)
+	// Returns all the keys in the map
+	Keys() []string
+}
+
+type setMatrix struct {
+	matrix map[string]mapset.Set
+
+	sync.Mutex
+}
+
+// NewSetMatrix creates a new set matrix object
+func NewSetMatrix() SetMatrix {
+	s := &setMatrix{}
+	s.init()
+	return s
+}
+
+func (s *setMatrix) init() {
+	s.matrix = make(map[string]mapset.Set)
+}
+
+func (s *setMatrix) Get(key string) ([]interface{}, bool) {
+	s.Lock()
+	defer s.Unlock()
+	set, ok := s.matrix[key]
+	if !ok {
+		return nil, ok
+	}
+	return set.ToSlice(), ok
+}
+
+func (s *setMatrix) Contains(key string, value interface{}) (bool, bool) {
+	s.Lock()
+	defer s.Unlock()
+	set, ok := s.matrix[key]
+	if !ok {
+		return false, ok
+	}
+	return set.Contains(value), ok
+}
+
+func (s *setMatrix) Insert(key string, value interface{}) (bool, int) {
+	s.Lock()
+	defer s.Unlock()
+	set, ok := s.matrix[key]
+	if !ok {
+		s.matrix[key] = mapset.NewSet()
+		s.matrix[key].Add(value)
+		return true, 1
+	}
+
+	return set.Add(value), set.Cardinality()
+}
+
+func (s *setMatrix) Remove(key string, value interface{}) (bool, int) {
+	s.Lock()
+	defer s.Unlock()
+	set, ok := s.matrix[key]
+	if !ok {
+		return false, 0
+	}
+
+	var removed bool
+	if set.Contains(value) {
+		set.Remove(value)
+		removed = true
+		// If the set is empty remove it from the matrix
+		if set.Cardinality() == 0 {
+			delete(s.matrix, key)
+		}
+	}
+
+	return removed, set.Cardinality()
+}
+
+func (s *setMatrix) Cardinality(key string) (int, bool) {
+	s.Lock()
+	defer s.Unlock()
+	set, ok := s.matrix[key]
+	if !ok {
+		return 0, ok
+	}
+
+	return set.Cardinality(), ok
+}
+
+func (s *setMatrix) String(key string) (string, bool) {
+	s.Lock()
+	defer s.Unlock()
+	set, ok := s.matrix[key]
+	if !ok {
+		return "", ok
+	}
+	return set.String(), ok
+}
+
+func (s *setMatrix) Keys() []string {
+	s.Lock()
+	defer s.Unlock()
+	keys := make([]string, 0, len(s.matrix))
+	for k := range s.matrix {
+		keys = append(keys, k)
+	}
+	return keys
+}
diff --git a/components/engine/vendor/github.com/docker/libnetwork/controller.go b/components/engine/vendor/github.com/docker/libnetwork/controller.go
index df75be707f..1696e07067 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/controller.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/controller.go
@@ -738,7 +738,6 @@ func (c *controller) NewNetwork(networkType, name string, id string, options ...
 	if network.configOnly {
 		network.scope = datastore.LocalScope
 		network.networkType = "null"
-		network.ipamType = ""
 		goto addToStore
 	}
 
@@ -1015,7 +1014,7 @@ func (c *controller) NetworkByID(id string) (Network, error) {
 }
 
 // NewSandbox creates a new sandbox for the passed container id
-func (c *controller) NewSandbox(containerID string, options ...SandboxOption) (sBox Sandbox, err error) {
+func (c *controller) NewSandbox(containerID string, options ...SandboxOption) (Sandbox, error) {
 	if containerID == "" {
 		return nil, types.BadRequestErrorf("invalid container ID")
 	}
@@ -1055,7 +1054,6 @@ func (c *controller) NewSandbox(containerID string, options ...SandboxOption) (s
 			extDNS:             []extDNSEntry{},
 		}
 	}
-	sBox = sb
 
 	heap.Init(&sb.endpoints)
 
@@ -1074,6 +1072,8 @@ func (c *controller) NewSandbox(containerID string, options ...SandboxOption) (s
 		sb.id = "ingress_sbox"
 	}
 	c.Unlock()
+
+	var err error
 	defer func() {
 		if err != nil {
 			c.Lock()
diff --git a/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/ostweaks_linux.go b/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/ostweaks_linux.go
new file mode 100644
index 0000000000..85840cf8c4
--- /dev/null
+++ b/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/ostweaks_linux.go
@@ -0,0 +1,30 @@
+package overlay
+
+import (
+	"io/ioutil"
+	"path"
+	"strings"
+
+	"github.com/Sirupsen/logrus"
+)
+
+var sysctlConf = map[string]string{
+	"net.ipv4.neigh.default.gc_thresh1": "8192",
+	"net.ipv4.neigh.default.gc_thresh2": "49152",
+	"net.ipv4.neigh.default.gc_thresh3": "65536",
+}
+
+// writeSystemProperty writes the value to a path under /proc/sys as determined from the key.
+// For e.g. net.ipv4.ip_forward translated to /proc/sys/net/ipv4/ip_forward.
+func writeSystemProperty(key, value string) error {
+	keyPath := strings.Replace(key, ".", "/", -1)
+	return ioutil.WriteFile(path.Join("/proc/sys", keyPath), []byte(value), 0644)
+}
+
+func applyOStweaks() {
+	for k, v := range sysctlConf {
+		if err := writeSystemProperty(k, v); err != nil {
+			logrus.Errorf("error setting the kernel parameter %s = %s, err: %s", k, v, err)
+		}
+	}
+}
diff --git a/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/ostweaks_unsupported.go b/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/ostweaks_unsupported.go
new file mode 100644
index 0000000000..a5e8d91083
--- /dev/null
+++ b/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/ostweaks_unsupported.go
@@ -0,0 +1,5 @@
+// +build !linux
+
+package overlay
+
+func applyOStweaks() {}
diff --git a/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/ov_network.go b/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/ov_network.go
index 64e5744403..3a4ea41bfc 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/ov_network.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/ov_network.go
@@ -3,8 +3,10 @@ package overlay
 import (
 	"encoding/json"
 	"fmt"
+	"io/ioutil"
 	"net"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -12,6 +14,7 @@ import (
 	"syscall"
 
 	"github.com/Sirupsen/logrus"
+	"github.com/docker/docker/pkg/reexec"
 	"github.com/docker/libnetwork/datastore"
 	"github.com/docker/libnetwork/driverapi"
 	"github.com/docker/libnetwork/netlabel"
@@ -55,6 +58,7 @@ type network struct {
 	dbIndex   uint64
 	dbExists  bool
 	sbox      osl.Sandbox
+	nlSocket  *nl.NetlinkSocket
 	endpoints endpointTable
 	driver    *driver
 	joinCnt   int
@@ -67,6 +71,54 @@ type network struct {
 	sync.Mutex
 }
 
+func init() {
+	reexec.Register("set-default-vlan", setDefaultVlan)
+}
+
+func setDefaultVlan() {
+	if len(os.Args) < 3 {
+		logrus.Error("insufficient number of arguments")
+		os.Exit(1)
+	}
+	nsPath := os.Args[1]
+	ns, err := netns.GetFromPath(nsPath)
+	if err != nil {
+		logrus.Errorf("overlay namespace get failed, %v", err)
+		os.Exit(1)
+	}
+	if err = netns.Set(ns); err != nil {
+		logrus.Errorf("setting into overlay namespace failed, %v", err)
+		os.Exit(1)
+	}
+
+	// make sure the sysfs mount doesn't propagate back
+	if err = syscall.Unshare(syscall.CLONE_NEWNS); err != nil {
+		logrus.Errorf("unshare failed, %v", err)
+		os.Exit(1)
+	}
+
+	flag := syscall.MS_PRIVATE | syscall.MS_REC
+	if err = syscall.Mount("", "/", "", uintptr(flag), ""); err != nil {
+		logrus.Errorf("root mount failed, %v", err)
+		os.Exit(1)
+	}
+
+	if err = syscall.Mount("sysfs", "/sys", "sysfs", 0, ""); err != nil {
+		logrus.Errorf("mounting sysfs failed, %v", err)
+		os.Exit(1)
+	}
+
+	brName := os.Args[2]
+	path := filepath.Join("/sys/class/net", brName, "bridge/default_pvid")
+	data := []byte{'0', '\n'}
+
+	if err = ioutil.WriteFile(path, data, 0644); err != nil {
+		logrus.Errorf("endbling default vlan on bridge %s failed %v", brName, err)
+		os.Exit(1)
+	}
+	os.Exit(0)
+}
+
 func (d *driver) NetworkAllocate(id string, option map[string]string, ipV4Data, ipV6Data []driverapi.IPAMData) (map[string]string, error) {
 	return nil, types.NotImplementedErrorf("not implemented")
 }
@@ -294,6 +346,12 @@ func (n *network) destroySandbox() {
 			}
 		}
 
+		// Close the netlink socket, this will also release the watchMiss goroutine that is using it
+		if n.nlSocket != nil {
+			n.nlSocket.Close()
+			n.nlSocket = nil
+		}
+
 		n.sbox.Destroy()
 		n.sbox = nil
 	}
@@ -505,6 +563,25 @@ func (n *network) setupSubnetSandbox(s *subnet, brName, vxlanName string) error
 		return fmt.Errorf("vxlan interface creation failed for subnet %q: %v", s.subnetIP.String(), err)
 	}
 
+	if !hostMode {
+		var name string
+		for _, i := range sbox.Info().Interfaces() {
+			if i.Bridge() {
+				name = i.DstName()
+			}
+		}
+		cmd := &exec.Cmd{
+			Path:   reexec.Self(),
+			Args:   []string{"set-default-vlan", sbox.Key(), name},
+			Stdout: os.Stdout,
+			Stderr: os.Stderr,
+		}
+		if err := cmd.Run(); err != nil {
+			// not a fatal error
+			logrus.Errorf("reexec to set bridge default vlan failed %v", err)
+		}
+	}
+
 	if hostMode {
 		if err := addFilters(n.id[:12], brName); err != nil {
 			return err
@@ -593,7 +670,7 @@ func (n *network) initSandbox(restore bool) error {
 	// In the restore case network sandbox already exist; but we don't know
 	// what epoch number it was created with. It has to be retrieved by
 	// searching the net namespaces.
-	key := ""
+	var key string
 	if restore {
 		key = osl.GenerateKey("-" + n.id)
 	} else {
@@ -615,6 +692,7 @@ func (n *network) initSandbox(restore bool) error {
 	sbox.InvokeFunc(func() {
 		nlSock, err = nl.Subscribe(syscall.NETLINK_ROUTE, syscall.RTNLGRP_NEIGH)
 	})
+	n.setNetlinkSocket(nlSock)
 
 	if err == nil {
 		go n.watchMiss(nlSock)
@@ -630,6 +708,13 @@ func (n *network) watchMiss(nlSock *nl.NetlinkSocket) {
 	for {
 		msgs, err := nlSock.Receive()
 		if err != nil {
+			n.Lock()
+			nlFd := nlSock.GetFd()
+			n.Unlock()
+			if nlFd == -1 {
+				// The netlink socket got closed, simply exit to not leak this goroutine
+				return
+			}
 			logrus.Errorf("Failed to receive from netlink: %v ", err)
 			continue
 		}
@@ -746,6 +831,12 @@ func (n *network) setSandbox(sbox osl.Sandbox) {
 	n.Unlock()
 }
 
+func (n *network) setNetlinkSocket(nlSk *nl.NetlinkSocket) {
+	n.Lock()
+	n.nlSocket = nlSk
+	n.Unlock()
+}
+
 func (n *network) vxlanID(s *subnet) uint32 {
 	n.Lock()
 	defer n.Unlock()
@@ -781,15 +872,10 @@ func (n *network) Value() []byte {
 		netJSON = append(netJSON, sj)
 	}
 
-	b, err := json.Marshal(netJSON)
-	if err != nil {
-		return []byte{}
-	}
-
 	m["secure"] = n.secure
 	m["subnets"] = netJSON
 	m["mtu"] = n.mtu
-	b, err = json.Marshal(m)
+	b, err := json.Marshal(m)
 	if err != nil {
 		return []byte{}
 	}
diff --git a/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/overlay.go b/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/overlay.go
index 8a932cf370..8d19b2e1d4 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/overlay.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/overlay.go
@@ -46,7 +46,7 @@ type driver struct {
 	store            datastore.DataStore
 	localStore       datastore.DataStore
 	vxlanIdm         *idm.Idm
-	once             sync.Once
+	initOS           sync.Once
 	joinOnce         sync.Once
 	localJoinOnce    sync.Once
 	keys             []*key
@@ -180,6 +180,10 @@ func Fini(drv driverapi.Driver) {
 }
 
 func (d *driver) configure() error {
+
+	// Apply OS specific kernel configs if needed
+	d.initOS.Do(applyOStweaks)
+
 	if d.store == nil {
 		return nil
 	}
diff --git a/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/peerdb.go b/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/peerdb.go
index 6551e7bcad..21cd1fbe3d 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/peerdb.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/drivers/overlay/peerdb.go
@@ -222,7 +222,7 @@ func (d *driver) peerDbUpdateSandbox(nid string) {
 	for pKeyStr, pEntry := range pMap.mp {
 		var pKey peerKey
 		if _, err := fmt.Sscan(pKeyStr, &pKey); err != nil {
-			fmt.Printf("peer key scan failed: %v", err)
+			logrus.Errorf("peer key scan failed: %v", err)
 		}
 
 		if pEntry.isLocal {
@@ -237,7 +237,7 @@ func (d *driver) peerDbUpdateSandbox(nid string) {
 			if err := d.peerAdd(nid, entry.eid, pKey.peerIP, entry.peerIPMask,
 				pKey.peerMac, entry.vtep,
 				false, false, false); err != nil {
-				fmt.Printf("peerdbupdate in sandbox failed for ip %s and mac %s: %v",
+				logrus.Errorf("peerdbupdate in sandbox failed for ip %s and mac %s: %v",
 					pKey.peerIP, pKey.peerMac, err)
 			}
 		}
diff --git a/components/engine/vendor/github.com/docker/libnetwork/drivers/solaris/overlay/ov_network.go b/components/engine/vendor/github.com/docker/libnetwork/drivers/solaris/overlay/ov_network.go
index 5e3dd5abe1..b0567261c7 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/drivers/solaris/overlay/ov_network.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/drivers/solaris/overlay/ov_network.go
@@ -457,7 +457,7 @@ func (n *network) initSandbox(restore bool) error {
 	// In the restore case network sandbox already exist; but we don't know
 	// what epoch number it was created with. It has to be retrieved by
 	// searching the net namespaces.
-	key := ""
+	var key string
 	if restore {
 		key = osl.GenerateKey("-" + n.id)
 	} else {
@@ -570,15 +570,10 @@ func (n *network) Value() []byte {
 		netJSON = append(netJSON, sj)
 	}
 
-	b, err := json.Marshal(netJSON)
-	if err != nil {
-		return []byte{}
-	}
-
 	m["secure"] = n.secure
 	m["subnets"] = netJSON
 	m["mtu"] = n.mtu
-	b, err = json.Marshal(m)
+	b, err := json.Marshal(m)
 	if err != nil {
 		return []byte{}
 	}
diff --git a/components/engine/vendor/github.com/docker/libnetwork/drivers/windows/windows.go b/components/engine/vendor/github.com/docker/libnetwork/drivers/windows/windows.go
index c1c69f2991..eb1522a74a 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/drivers/windows/windows.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/drivers/windows/windows.go
@@ -324,6 +324,9 @@ func (d *driver) CreateNetwork(id string, option map[string]interface{}, nInfo d
 	}
 
 	n, err := d.getNetwork(id)
+	if err != nil {
+		return err
+	}
 	n.created = true
 	return d.storeUpdate(config)
 }
@@ -530,7 +533,13 @@ func (d *driver) CreateEndpoint(nid, eid string, ifInfo driverapi.InterfaceInfo,
 	}
 
 	epOption, err := parseEndpointOptions(epOptions)
+	if err != nil {
+		return err
+	}
 	epConnectivity, err := parseEndpointConnectivity(epOptions)
+	if err != nil {
+		return err
+	}
 
 	macAddress := ifInfo.MacAddress()
 	// Use the macaddress if it was provided
diff --git a/components/engine/vendor/github.com/docker/libnetwork/drivers/windows/windows_store.go b/components/engine/vendor/github.com/docker/libnetwork/drivers/windows/windows_store.go
index 3c5cb04e21..bbed5aeaa2 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/drivers/windows/windows_store.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/drivers/windows/windows_store.go
@@ -232,9 +232,12 @@ func (ep *hnsEndpoint) MarshalJSON() ([]byte, error) {
 	epMap["Type"] = ep.Type
 	epMap["profileID"] = ep.profileID
 	epMap["MacAddress"] = ep.macAddress.String()
-	epMap["Addr"] = ep.addr.String()
-	epMap["gateway"] = ep.gateway.String()
-
+	if ep.addr.IP != nil {
+		epMap["Addr"] = ep.addr.String()
+	}
+	if ep.gateway != nil {
+		epMap["gateway"] = ep.gateway.String()
+	}
 	epMap["epOption"] = ep.epOption
 	epMap["epConnectivity"] = ep.epConnectivity
 	epMap["PortMapping"] = ep.portMapping
@@ -251,7 +254,6 @@ func (ep *hnsEndpoint) UnmarshalJSON(b []byte) error {
 	if err = json.Unmarshal(b, &epMap); err != nil {
 		return fmt.Errorf("Failed to unmarshal to endpoint: %v", err)
 	}
-
 	if v, ok := epMap["MacAddress"]; ok {
 		if ep.macAddress, err = net.ParseMAC(v.(string)); err != nil {
 			return types.InternalErrorf("failed to decode endpoint MAC address (%s) after json unmarshal: %v", v.(string), err)
@@ -262,7 +264,9 @@ func (ep *hnsEndpoint) UnmarshalJSON(b []byte) error {
 			return types.InternalErrorf("failed to decode endpoint IPv4 address (%s) after json unmarshal: %v", v.(string), err)
 		}
 	}
-
+	if v, ok := epMap["gateway"]; ok {
+		ep.gateway = net.ParseIP(v.(string))
+	}
 	ep.id = epMap["id"].(string)
 	ep.Type = epMap["Type"].(string)
 	ep.nid = epMap["nid"].(string)
diff --git a/components/engine/vendor/github.com/docker/libnetwork/endpoint.go b/components/engine/vendor/github.com/docker/libnetwork/endpoint.go
index e607eddaf2..111b747352 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/endpoint.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/endpoint.go
@@ -597,8 +597,14 @@ func (ep *endpoint) rename(name string) error {
 
 	c := n.getController()
 
+	sb, ok := ep.getSandbox()
+	if !ok {
+		logrus.Warnf("rename for %s aborted, sandbox %s is not anymore present", ep.ID(), ep.sandboxID)
+		return nil
+	}
+
 	if c.isAgent() {
-		if err = ep.deleteServiceInfoFromCluster(); err != nil {
+		if err = ep.deleteServiceInfoFromCluster(sb, "rename"); err != nil {
 			return types.InternalErrorf("Could not delete service state for endpoint %s from cluster on rename: %v", ep.Name(), err)
 		}
 	} else {
@@ -617,15 +623,15 @@ func (ep *endpoint) rename(name string) error {
 	ep.anonymous = false
 
 	if c.isAgent() {
-		if err = ep.addServiceInfoToCluster(); err != nil {
+		if err = ep.addServiceInfoToCluster(sb); err != nil {
 			return types.InternalErrorf("Could not add service state for endpoint %s to cluster on rename: %v", ep.Name(), err)
 		}
 		defer func() {
 			if err != nil {
-				ep.deleteServiceInfoFromCluster()
+				ep.deleteServiceInfoFromCluster(sb, "rename")
 				ep.name = oldName
 				ep.anonymous = oldAnonymous
-				ep.addServiceInfoToCluster()
+				ep.addServiceInfoToCluster(sb)
 			}
 		}()
 	} else {
@@ -746,7 +752,7 @@ func (ep *endpoint) sbLeave(sb *sandbox, force bool, options ...EndpointOption)
 		return err
 	}
 
-	if e := ep.deleteServiceInfoFromCluster(); e != nil {
+	if e := ep.deleteServiceInfoFromCluster(sb, "sbLeave"); e != nil {
 		logrus.Errorf("Could not delete service state for endpoint %s from cluster: %v", ep.Name(), e)
 	}
 
diff --git a/components/engine/vendor/github.com/docker/libnetwork/ipam/allocator.go b/components/engine/vendor/github.com/docker/libnetwork/ipam/allocator.go
index 4243d57a74..b3876ffded 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/ipam/allocator.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/ipam/allocator.go
@@ -448,7 +448,7 @@ func (a *Allocator) RequestAddress(poolID string, prefAddress net.IP, opts map[s
 	c := p
 	for c.Range != nil {
 		k = c.ParentKey
-		c, ok = aSpace.subnets[k]
+		c = aSpace.subnets[k]
 	}
 	aSpace.Unlock()
 
diff --git a/components/engine/vendor/github.com/docker/libnetwork/ipams/remote/api/api.go b/components/engine/vendor/github.com/docker/libnetwork/ipams/remote/api/api.go
index 23f3eda7d1..543c99bb00 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/ipams/remote/api/api.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/ipams/remote/api/api.go
@@ -9,7 +9,7 @@ type Response struct {
 	Error string
 }
 
-// IsSuccess returns wheter the plugin response is successful
+// IsSuccess returns whether the plugin response is successful
 func (r *Response) IsSuccess() bool {
 	return r.Error == ""
 }
diff --git a/components/engine/vendor/github.com/docker/libnetwork/ipvs/constants.go b/components/engine/vendor/github.com/docker/libnetwork/ipvs/constants.go
index 103e71a37c..d36bec0e80 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/ipvs/constants.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/ipvs/constants.go
@@ -85,6 +85,23 @@ const (
 	ipvsDestAttrInactiveConnections
 	ipvsDestAttrPersistentConnections
 	ipvsDestAttrStats
+	ipvsDestAttrAddressFamily
+)
+
+// IPVS Svc Statistics constancs
+
+const (
+	ipvsSvcStatsUnspec int = iota
+	ipvsSvcStatsConns
+	ipvsSvcStatsPktsIn
+	ipvsSvcStatsPktsOut
+	ipvsSvcStatsBytesIn
+	ipvsSvcStatsBytesOut
+	ipvsSvcStatsCPS
+	ipvsSvcStatsPPSIn
+	ipvsSvcStatsPPSOut
+	ipvsSvcStatsBPSIn
+	ipvsSvcStatsBPSOut
 )
 
 // Destination forwarding methods
diff --git a/components/engine/vendor/github.com/docker/libnetwork/ipvs/ipvs.go b/components/engine/vendor/github.com/docker/libnetwork/ipvs/ipvs.go
index 266cc24dbe..a285e102e3 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/ipvs/ipvs.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/ipvs/ipvs.go
@@ -6,6 +6,7 @@ import (
 	"net"
 	"syscall"
 
+	"fmt"
 	"github.com/vishvananda/netlink/nl"
 	"github.com/vishvananda/netns"
 )
@@ -25,6 +26,21 @@ type Service struct {
 	Netmask       uint32
 	AddressFamily uint16
 	PEName        string
+	Stats         SvcStats
+}
+
+// SvcStats defines an IPVS service statistics
+type SvcStats struct {
+	Connections uint32
+	PacketsIn   uint32
+	PacketsOut  uint32
+	BytesIn     uint64
+	BytesOut    uint64
+	CPS         uint32
+	BPSOut      uint32
+	PPSIn       uint32
+	PPSOut      uint32
+	BPSIn       uint32
 }
 
 // Destination defines an IPVS destination (real server) in its
@@ -117,3 +133,29 @@ func (i *Handle) UpdateDestination(s *Service, d *Destination) error {
 func (i *Handle) DelDestination(s *Service, d *Destination) error {
 	return i.doCmd(s, d, ipvsCmdDelDest)
 }
+
+// GetServices returns an array of services configured on the Node
+func (i *Handle) GetServices() ([]*Service, error) {
+	return i.doGetServicesCmd(nil)
+}
+
+// GetDestinations returns an array of Destinations configured for this Service
+func (i *Handle) GetDestinations(s *Service) ([]*Destination, error) {
+	return i.doGetDestinationsCmd(s, nil)
+}
+
+// GetService gets details of a specific IPVS services, useful in updating statisics etc.,
+func (i *Handle) GetService(s *Service) (*Service, error) {
+
+	res, err := i.doGetServicesCmd(s)
+	if err != nil {
+		return nil, err
+	}
+
+	// We are looking for exactly one service otherwise error out
+	if len(res) != 1 {
+		return nil, fmt.Errorf("Expected only one service obtained=%d", len(res))
+	}
+
+	return res[0], nil
+}
diff --git a/components/engine/vendor/github.com/docker/libnetwork/ipvs/netlink.go b/components/engine/vendor/github.com/docker/libnetwork/ipvs/netlink.go
index 635606dacd..5450679c3b 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/ipvs/netlink.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/ipvs/netlink.go
@@ -19,6 +19,7 @@ import (
 	"github.com/vishvananda/netns"
 )
 
+// For Quick Reference IPVS related netlink message is described at the end of this file.
 var (
 	native     = nl.NativeEndian()
 	ipvsFamily int
@@ -89,7 +90,6 @@ func fillService(s *Service) nl.NetlinkRequestData {
 	if s.PEName != "" {
 		nl.NewRtAttrChild(cmdAttr, ipvsSvcAttrPEName, nl.ZeroTerminated(s.PEName))
 	}
-
 	f := &ipvsFlags{
 		flags: s.Flags,
 		mask:  0xFFFFFFFF,
@@ -117,20 +117,38 @@ func fillDestinaton(d *Destination) nl.NetlinkRequestData {
 	return cmdAttr
 }
 
-func (i *Handle) doCmd(s *Service, d *Destination, cmd uint8) error {
+func (i *Handle) doCmdwithResponse(s *Service, d *Destination, cmd uint8) ([][]byte, error) {
 	req := newIPVSRequest(cmd)
 	req.Seq = atomic.AddUint32(&i.seq, 1)
-	req.AddData(fillService(s))
 
-	if d != nil {
+	if s == nil {
+		req.Flags |= syscall.NLM_F_DUMP                    //Flag to dump all messages
+		req.AddData(nl.NewRtAttr(ipvsCmdAttrService, nil)) //Add a dummy attribute
+	} else {
+		req.AddData(fillService(s))
+	}
+
+	if d == nil {
+		if cmd == ipvsCmdGetDest {
+			req.Flags |= syscall.NLM_F_DUMP
+		}
+
+	} else {
 		req.AddData(fillDestinaton(d))
 	}
 
-	if _, err := execute(i.sock, req, 0); err != nil {
-		return err
+	res, err := execute(i.sock, req, 0)
+	if err != nil {
+		return [][]byte{}, err
 	}
 
-	return nil
+	return res, nil
+}
+
+func (i *Handle) doCmd(s *Service, d *Destination, cmd uint8) error {
+	_, err := i.doCmdwithResponse(s, d, cmd)
+
+	return err
 }
 
 func getIPVSFamily() (int, error) {
@@ -171,7 +189,6 @@ func rawIPData(ip net.IP) []byte {
 	if family == nl.FAMILY_V4 {
 		return ip.To4()
 	}
-
 	return ip
 }
 
@@ -235,3 +252,295 @@ done:
 	}
 	return res, nil
 }
+
+func parseIP(ip []byte, family uint16) (net.IP, error) {
+
+	var resIP net.IP
+
+	switch family {
+	case syscall.AF_INET:
+		resIP = (net.IP)(ip[:4])
+	case syscall.AF_INET6:
+		resIP = (net.IP)(ip[:16])
+	default:
+		return nil, fmt.Errorf("parseIP Error ip=%v", ip)
+
+	}
+	return resIP, nil
+}
+
+// parseStats
+func assembleStats(msg []byte) (SvcStats, error) {
+
+	var s SvcStats
+
+	attrs, err := nl.ParseRouteAttr(msg)
+	if err != nil {
+		return s, err
+	}
+
+	for _, attr := range attrs {
+		attrType := int(attr.Attr.Type)
+		switch attrType {
+		case ipvsSvcStatsConns:
+			s.Connections = native.Uint32(attr.Value)
+		case ipvsSvcStatsPktsIn:
+			s.PacketsIn = native.Uint32(attr.Value)
+		case ipvsSvcStatsPktsOut:
+			s.PacketsOut = native.Uint32(attr.Value)
+		case ipvsSvcStatsBytesIn:
+			s.BytesIn = native.Uint64(attr.Value)
+		case ipvsSvcStatsBytesOut:
+			s.BytesOut = native.Uint64(attr.Value)
+		case ipvsSvcStatsCPS:
+			s.CPS = native.Uint32(attr.Value)
+		case ipvsSvcStatsPPSIn:
+			s.PPSIn = native.Uint32(attr.Value)
+		case ipvsSvcStatsPPSOut:
+			s.PPSOut = native.Uint32(attr.Value)
+		case ipvsSvcStatsBPSIn:
+			s.BPSIn = native.Uint32(attr.Value)
+		case ipvsSvcStatsBPSOut:
+			s.BPSOut = native.Uint32(attr.Value)
+		}
+	}
+	return s, nil
+}
+
+// assembleService assembles a services back from a hain of netlink attributes
+func assembleService(attrs []syscall.NetlinkRouteAttr) (*Service, error) {
+
+	var s Service
+
+	for _, attr := range attrs {
+
+		attrType := int(attr.Attr.Type)
+
+		switch attrType {
+
+		case ipvsSvcAttrAddressFamily:
+			s.AddressFamily = native.Uint16(attr.Value)
+		case ipvsSvcAttrProtocol:
+			s.Protocol = native.Uint16(attr.Value)
+		case ipvsSvcAttrAddress:
+			ip, err := parseIP(attr.Value, s.AddressFamily)
+			if err != nil {
+				return nil, err
+			}
+			s.Address = ip
+		case ipvsSvcAttrPort:
+			s.Port = binary.BigEndian.Uint16(attr.Value)
+		case ipvsSvcAttrFWMark:
+			s.FWMark = native.Uint32(attr.Value)
+		case ipvsSvcAttrSchedName:
+			s.SchedName = nl.BytesToString(attr.Value)
+		case ipvsSvcAttrFlags:
+			s.Flags = native.Uint32(attr.Value)
+		case ipvsSvcAttrTimeout:
+			s.Timeout = native.Uint32(attr.Value)
+		case ipvsSvcAttrNetmask:
+			s.Netmask = native.Uint32(attr.Value)
+		case ipvsSvcAttrStats:
+			stats, err := assembleStats(attr.Value)
+			if err != nil {
+				return nil, err
+			}
+			s.Stats = stats
+		}
+
+	}
+	return &s, nil
+}
+
+// parseService given a ipvs netlink response this function will respond with a valid service entry, an error otherwise
+func (i *Handle) parseService(msg []byte) (*Service, error) {
+
+	var s *Service
+
+	//Remove General header for this message and parse the NetLink message
+	hdr := deserializeGenlMsg(msg)
+	NetLinkAttrs, err := nl.ParseRouteAttr(msg[hdr.Len():])
+	if err != nil {
+		return nil, err
+	}
+	if len(NetLinkAttrs) == 0 {
+		return nil, fmt.Errorf("error no valid netlink message found while parsing service record")
+	}
+
+	//Now Parse and get IPVS related attributes messages packed in this message.
+	ipvsAttrs, err := nl.ParseRouteAttr(NetLinkAttrs[0].Value)
+	if err != nil {
+		return nil, err
+	}
+
+	//Assemble all the IPVS related attribute messages and create a service record
+	s, err = assembleService(ipvsAttrs)
+	if err != nil {
+		return nil, err
+	}
+
+	return s, nil
+}
+
+// doGetServicesCmd a wrapper which could be used commonly for both GetServices() and GetService(*Service)
+func (i *Handle) doGetServicesCmd(svc *Service) ([]*Service, error) {
+	var res []*Service
+
+	msgs, err := i.doCmdwithResponse(svc, nil, ipvsCmdGetService)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, msg := range msgs {
+		srv, err := i.parseService(msg)
+		if err != nil {
+			return nil, err
+		}
+		res = append(res, srv)
+	}
+
+	return res, nil
+}
+
+func assembleDestination(attrs []syscall.NetlinkRouteAttr) (*Destination, error) {
+
+	var d Destination
+
+	for _, attr := range attrs {
+
+		attrType := int(attr.Attr.Type)
+
+		switch attrType {
+		case ipvsDestAttrAddress:
+			ip, err := parseIP(attr.Value, syscall.AF_INET)
+			if err != nil {
+				return nil, err
+			}
+			d.Address = ip
+		case ipvsDestAttrPort:
+			d.Port = binary.BigEndian.Uint16(attr.Value)
+		case ipvsDestAttrForwardingMethod:
+			d.ConnectionFlags = native.Uint32(attr.Value)
+		case ipvsDestAttrWeight:
+			d.Weight = int(native.Uint16(attr.Value))
+		case ipvsDestAttrUpperThreshold:
+			d.UpperThreshold = native.Uint32(attr.Value)
+		case ipvsDestAttrLowerThreshold:
+			d.LowerThreshold = native.Uint32(attr.Value)
+		case ipvsDestAttrAddressFamily:
+			d.AddressFamily = native.Uint16(attr.Value)
+		}
+	}
+	return &d, nil
+}
+
+// parseDestination given a ipvs netlink response this function will respond with a valid destination entry, an error otherwise
+func (i *Handle) parseDestination(msg []byte) (*Destination, error) {
+	var dst *Destination
+
+	//Remove General header for this message
+	hdr := deserializeGenlMsg(msg)
+	NetLinkAttrs, err := nl.ParseRouteAttr(msg[hdr.Len():])
+	if err != nil {
+		return nil, err
+	}
+	if len(NetLinkAttrs) == 0 {
+		return nil, fmt.Errorf("error no valid netlink message found while parsing destination record")
+	}
+
+	//Now Parse and get IPVS related attributes messages packed in this message.
+	ipvsAttrs, err := nl.ParseRouteAttr(NetLinkAttrs[0].Value)
+	if err != nil {
+		return nil, err
+	}
+
+	//Assemble netlink attributes and create a Destination record
+	dst, err = assembleDestination(ipvsAttrs)
+	if err != nil {
+		return nil, err
+	}
+
+	return dst, nil
+}
+
+// doGetDestinationsCmd a wrapper function to be used by GetDestinations and GetDestination(d) apis
+func (i *Handle) doGetDestinationsCmd(s *Service, d *Destination) ([]*Destination, error) {
+
+	var res []*Destination
+
+	msgs, err := i.doCmdwithResponse(s, d, ipvsCmdGetDest)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, msg := range msgs {
+		dest, err := i.parseDestination(msg)
+		if err != nil {
+			return res, err
+		}
+		res = append(res, dest)
+	}
+	return res, nil
+}
+
+// IPVS related netlink message format explained
+
+/* EACH NETLINK MSG is of the below format, this is what we will receive from execute() api.
+   If we have multiple netlink objects to process like GetServices() etc., execute() will
+   supply an array of this below object
+
+            NETLINK MSG
+|-----------------------------------|
+    0        1        2        3
+|--------|--------|--------|--------| -
+| CMD ID |  VER   |    RESERVED     | |==> General Message Header represented by genlMsgHdr
+|-----------------------------------| -
+|    ATTR LEN     |   ATTR TYPE     | |
+|-----------------------------------| |
+|                                   | |
+|              VALUE                | |
+|     []byte Array of IPVS MSG      | |==> Attribute Message represented by syscall.NetlinkRouteAttr
+|        PADDED BY 4 BYTES          | |
+|                                   | |
+|-----------------------------------| -
+
+
+ Once We strip genlMsgHdr from above NETLINK MSG, we should parse the VALUE.
+ VALUE will have an array of netlink attributes (syscall.NetlinkRouteAttr) such that each attribute will
+ represent a "Service" or "Destination" object's field.  If we assemble these attributes we can construct
+ Service or Destination.
+
+            IPVS MSG
+|-----------------------------------|
+     0        1        2        3
+|--------|--------|--------|--------|
+|    ATTR LEN     |    ATTR TYPE    |
+|-----------------------------------|
+|                                   |
+|                                   |
+| []byte IPVS ATTRIBUTE  BY 4 BYTES |
+|                                   |
+|                                   |
+|-----------------------------------|
+           NEXT ATTRIBUTE
+|-----------------------------------|
+|    ATTR LEN     |    ATTR TYPE    |
+|-----------------------------------|
+|                                   |
+|                                   |
+| []byte IPVS ATTRIBUTE  BY 4 BYTES |
+|                                   |
+|                                   |
+|-----------------------------------|
+           NEXT ATTRIBUTE
+|-----------------------------------|
+|    ATTR LEN     |    ATTR TYPE    |
+|-----------------------------------|
+|                                   |
+|                                   |
+| []byte IPVS ATTRIBUTE  BY 4 BYTES |
+|                                   |
+|                                   |
+|-----------------------------------|
+
+*/
diff --git a/components/engine/vendor/github.com/docker/libnetwork/network.go b/components/engine/vendor/github.com/docker/libnetwork/network.go
index 2b6c705a7b..9f99064e11 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/network.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/network.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/pkg/stringid"
+	"github.com/docker/libnetwork/common"
 	"github.com/docker/libnetwork/config"
 	"github.com/docker/libnetwork/datastore"
 	"github.com/docker/libnetwork/driverapi"
@@ -91,13 +92,21 @@ type EndpointWalker func(ep Endpoint) bool
 // Its an indication to defer PTR queries also to that external server.
 type ipInfo struct {
 	name        string
+	serviceID   string
 	extResolver bool
 }
 
+// svcMapEntry is the body of the element into the svcMap
+// The ip is a string because the SetMatrix does not accept non hashable values
+type svcMapEntry struct {
+	ip        string
+	serviceID string
+}
+
 type svcInfo struct {
-	svcMap     map[string][]net.IP
-	svcIPv6Map map[string][]net.IP
-	ipMap      map[string]*ipInfo
+	svcMap     common.SetMatrix
+	svcIPv6Map common.SetMatrix
+	ipMap      common.SetMatrix
 	service    map[string][]servicePorts
 }
 
@@ -412,6 +421,9 @@ func (n *network) applyConfigurationTo(to *network) error {
 			}
 		}
 	}
+	if len(n.ipamType) != 0 {
+		to.ipamType = n.ipamType
+	}
 	if len(n.ipamOptions) > 0 {
 		to.ipamOptions = make(map[string]string, len(n.ipamOptions))
 		for k, v := range n.ipamOptions {
@@ -929,6 +941,9 @@ func (n *network) delete(force bool) error {
 	id := n.id
 	n.Unlock()
 
+	c.networkLocker.Lock(id)
+	defer c.networkLocker.Unlock(id)
+
 	n, err := c.getNetworkFromStore(id)
 	if err != nil {
 		return &UnknownNetworkError{name: name, id: id}
@@ -1060,6 +1075,9 @@ func (n *network) CreateEndpoint(name string, options ...EndpointOption) (Endpoi
 	ep := &endpoint{name: name, generic: make(map[string]interface{}), iface: &endpointInterface{}}
 	ep.id = stringid.GenerateRandomID()
 
+	n.ctrlr.networkLocker.Lock(n.id)
+	defer n.ctrlr.networkLocker.Unlock(n.id)
+
 	// Initialize ep.network with a possibly stale copy of n. We need this to get network from
 	// store. But once we get it from store we will have the most uptodate copy possibly.
 	ep.network = n
@@ -1218,133 +1236,135 @@ func (n *network) updateSvcRecord(ep *endpoint, localEps []*endpoint, isAdd bool
 			ipv6 = iface.AddressIPv6().IP
 		}
 
+		serviceID := ep.svcID
+		if serviceID == "" {
+			serviceID = ep.ID()
+		}
 		if isAdd {
 			// If anonymous endpoint has an alias use the first alias
 			// for ip->name mapping. Not having the reverse mapping
 			// breaks some apps
 			if ep.isAnonymous() {
 				if len(myAliases) > 0 {
-					n.addSvcRecords(myAliases[0], iface.Address().IP, ipv6, true)
+					n.addSvcRecords(ep.ID(), myAliases[0], serviceID, iface.Address().IP, ipv6, true, "updateSvcRecord")
 				}
 			} else {
-				n.addSvcRecords(epName, iface.Address().IP, ipv6, true)
+				n.addSvcRecords(ep.ID(), epName, serviceID, iface.Address().IP, ipv6, true, "updateSvcRecord")
 			}
 			for _, alias := range myAliases {
-				n.addSvcRecords(alias, iface.Address().IP, ipv6, false)
+				n.addSvcRecords(ep.ID(), alias, serviceID, iface.Address().IP, ipv6, false, "updateSvcRecord")
 			}
 		} else {
 			if ep.isAnonymous() {
 				if len(myAliases) > 0 {
-					n.deleteSvcRecords(myAliases[0], iface.Address().IP, ipv6, true)
+					n.deleteSvcRecords(ep.ID(), myAliases[0], serviceID, iface.Address().IP, ipv6, true, "updateSvcRecord")
 				}
 			} else {
-				n.deleteSvcRecords(epName, iface.Address().IP, ipv6, true)
+				n.deleteSvcRecords(ep.ID(), epName, serviceID, iface.Address().IP, ipv6, true, "updateSvcRecord")
 			}
 			for _, alias := range myAliases {
-				n.deleteSvcRecords(alias, iface.Address().IP, ipv6, false)
+				n.deleteSvcRecords(ep.ID(), alias, serviceID, iface.Address().IP, ipv6, false, "updateSvcRecord")
 			}
 		}
 	}
 }
 
-func addIPToName(ipMap map[string]*ipInfo, name string, ip net.IP) {
+func addIPToName(ipMap common.SetMatrix, name, serviceID string, ip net.IP) {
 	reverseIP := netutils.ReverseIP(ip.String())
-	if _, ok := ipMap[reverseIP]; !ok {
-		ipMap[reverseIP] = &ipInfo{
-			name: name,
-		}
-	}
+	ipMap.Insert(reverseIP, ipInfo{
+		name:      name,
+		serviceID: serviceID,
+	})
 }
 
-func addNameToIP(svcMap map[string][]net.IP, name string, epIP net.IP) {
-	ipList := svcMap[name]
-	for _, ip := range ipList {
-		if ip.Equal(epIP) {
-			return
-		}
-	}
-	svcMap[name] = append(svcMap[name], epIP)
+func delIPToName(ipMap common.SetMatrix, name, serviceID string, ip net.IP) {
+	reverseIP := netutils.ReverseIP(ip.String())
+	ipMap.Remove(reverseIP, ipInfo{
+		name:      name,
+		serviceID: serviceID,
+	})
 }
 
-func delNameToIP(svcMap map[string][]net.IP, name string, epIP net.IP) {
-	ipList := svcMap[name]
-	for i, ip := range ipList {
-		if ip.Equal(epIP) {
-			ipList = append(ipList[:i], ipList[i+1:]...)
-			break
-		}
-	}
-	svcMap[name] = ipList
-
-	if len(ipList) == 0 {
-		delete(svcMap, name)
-	}
+func addNameToIP(svcMap common.SetMatrix, name, serviceID string, epIP net.IP) {
+	svcMap.Insert(name, svcMapEntry{
+		ip:        epIP.String(),
+		serviceID: serviceID,
+	})
 }
 
-func (n *network) addSvcRecords(name string, epIP net.IP, epIPv6 net.IP, ipMapUpdate bool) {
+func delNameToIP(svcMap common.SetMatrix, name, serviceID string, epIP net.IP) {
+	svcMap.Remove(name, svcMapEntry{
+		ip:        epIP.String(),
+		serviceID: serviceID,
+	})
+}
+
+func (n *network) addSvcRecords(eID, name, serviceID string, epIP, epIPv6 net.IP, ipMapUpdate bool, method string) {
 	// Do not add service names for ingress network as this is a
 	// routing only network
 	if n.ingress {
 		return
 	}
 
-	logrus.Debugf("(%s).addSvcRecords(%s, %s, %s, %t)", n.ID()[0:7], name, epIP, epIPv6, ipMapUpdate)
+	logrus.Debugf("%s (%s).addSvcRecords(%s, %s, %s, %t) %s sid:%s", eID, n.ID()[0:7], name, epIP, epIPv6, ipMapUpdate, method, serviceID)
 
 	c := n.getController()
 	c.Lock()
 	defer c.Unlock()
+
 	sr, ok := c.svcRecords[n.ID()]
 	if !ok {
 		sr = svcInfo{
-			svcMap:     make(map[string][]net.IP),
-			svcIPv6Map: make(map[string][]net.IP),
-			ipMap:      make(map[string]*ipInfo),
+			svcMap:     common.NewSetMatrix(),
+			svcIPv6Map: common.NewSetMatrix(),
+			ipMap:      common.NewSetMatrix(),
 		}
 		c.svcRecords[n.ID()] = sr
 	}
 
 	if ipMapUpdate {
-		addIPToName(sr.ipMap, name, epIP)
+		addIPToName(sr.ipMap, name, serviceID, epIP)
 		if epIPv6 != nil {
-			addIPToName(sr.ipMap, name, epIPv6)
+			addIPToName(sr.ipMap, name, serviceID, epIPv6)
 		}
 	}
 
-	addNameToIP(sr.svcMap, name, epIP)
+	addNameToIP(sr.svcMap, name, serviceID, epIP)
 	if epIPv6 != nil {
-		addNameToIP(sr.svcIPv6Map, name, epIPv6)
+		addNameToIP(sr.svcIPv6Map, name, serviceID, epIPv6)
 	}
 }
 
-func (n *network) deleteSvcRecords(name string, epIP net.IP, epIPv6 net.IP, ipMapUpdate bool) {
+func (n *network) deleteSvcRecords(eID, name, serviceID string, epIP net.IP, epIPv6 net.IP, ipMapUpdate bool, method string) {
 	// Do not delete service names from ingress network as this is a
 	// routing only network
 	if n.ingress {
 		return
 	}
 
-	logrus.Debugf("(%s).deleteSvcRecords(%s, %s, %s, %t)", n.ID()[0:7], name, epIP, epIPv6, ipMapUpdate)
+	logrus.Debugf("%s (%s).deleteSvcRecords(%s, %s, %s, %t) %s sid:%s ", eID, n.ID()[0:7], name, epIP, epIPv6, ipMapUpdate, method, serviceID)
 
 	c := n.getController()
 	c.Lock()
 	defer c.Unlock()
+
 	sr, ok := c.svcRecords[n.ID()]
 	if !ok {
 		return
 	}
 
 	if ipMapUpdate {
-		delete(sr.ipMap, netutils.ReverseIP(epIP.String()))
+		delIPToName(sr.ipMap, name, serviceID, epIP)
 
 		if epIPv6 != nil {
-			delete(sr.ipMap, netutils.ReverseIP(epIPv6.String()))
+			delIPToName(sr.ipMap, name, serviceID, epIPv6)
 		}
 	}
 
-	delNameToIP(sr.svcMap, name, epIP)
+	delNameToIP(sr.svcMap, name, serviceID, epIP)
 
 	if epIPv6 != nil {
-		delNameToIP(sr.svcIPv6Map, name, epIPv6)
+		delNameToIP(sr.svcIPv6Map, name, serviceID, epIPv6)
 	}
 }
 
@@ -1362,19 +1382,31 @@ func (n *network) getSvcRecords(ep *endpoint) []etchosts.Record {
 
 	n.ctrlr.Lock()
 	defer n.ctrlr.Unlock()
-	sr, _ := n.ctrlr.svcRecords[n.id]
+	sr, ok := n.ctrlr.svcRecords[n.id]
+	if !ok || sr.svcMap == nil {
+		return nil
+	}
 
-	for h, ip := range sr.svcMap {
-		if strings.Split(h, ".")[0] == epName {
+	svcMapKeys := sr.svcMap.Keys()
+	// Loop on service names on this network
+	for _, k := range svcMapKeys {
+		if strings.Split(k, ".")[0] == epName {
 			continue
 		}
-		if len(ip) == 0 {
-			logrus.Warnf("Found empty list of IP addresses for service %s on network %s (%s)", h, n.name, n.id)
+		// Get all the IPs associated to this service
+		mapEntryList, ok := sr.svcMap.Get(k)
+		if !ok {
+			// The key got deleted
 			continue
 		}
+		if len(mapEntryList) == 0 {
+			logrus.Warnf("Found empty list of IP addresses for service %s on network %s (%s)", k, n.name, n.id)
+			continue
+		}
+
 		recs = append(recs, etchosts.Record{
-			Hosts: h,
-			IP:    ip[0].String(),
+			Hosts: k,
+			IP:    mapEntryList[0].(svcMapEntry).ip,
 		})
 	}
 
@@ -1831,8 +1863,7 @@ func (n *network) ResolveName(req string, ipType int) ([]net.IP, bool) {
 	}
 
 	req = strings.TrimSuffix(req, ".")
-	var ip []net.IP
-	ip, ok = sr.svcMap[req]
+	ipSet, ok := sr.svcMap.Get(req)
 
 	if ipType == types.IPv6 {
 		// If the name resolved to v4 address then its a valid name in
@@ -1842,13 +1873,20 @@ func (n *network) ResolveName(req string, ipType int) ([]net.IP, bool) {
 		if ok && n.enableIPv6 == false {
 			ipv6Miss = true
 		}
-		ip = sr.svcIPv6Map[req]
+		ipSet, ok = sr.svcIPv6Map.Get(req)
 	}
 
-	if ip != nil {
-		ipLocal := make([]net.IP, len(ip))
-		copy(ipLocal, ip)
-		return ipLocal, false
+	if ok && len(ipSet) > 0 {
+		// this map is to avoid IP duplicates, this can happen during a transition period where 2 services are using the same IP
+		noDup := make(map[string]bool)
+		var ipLocal []net.IP
+		for _, ip := range ipSet {
+			if _, dup := noDup[ip.(svcMapEntry).ip]; !dup {
+				noDup[ip.(svcMapEntry).ip] = true
+				ipLocal = append(ipLocal, net.ParseIP(ip.(svcMapEntry).ip))
+			}
+		}
+		return ipLocal, ok
 	}
 
 	return nil, ipv6Miss
@@ -1865,9 +1903,11 @@ func (n *network) HandleQueryResp(name string, ip net.IP) {
 	}
 
 	ipStr := netutils.ReverseIP(ip.String())
-
-	if ipInfo, ok := sr.ipMap[ipStr]; ok {
-		ipInfo.extResolver = true
+	// If an object with extResolver == true is already in the set this call will fail
+	// but anyway it means that has already been inserted before
+	if ok, _ := sr.ipMap.Contains(ipStr, ipInfo{name: name}); ok {
+		sr.ipMap.Remove(ipStr, ipInfo{name: name})
+		sr.ipMap.Insert(ipStr, ipInfo{name: name, extResolver: true})
 	}
 }
 
@@ -1883,13 +1923,27 @@ func (n *network) ResolveIP(ip string) string {
 
 	nwName := n.Name()
 
-	ipInfo, ok := sr.ipMap[ip]
-
-	if !ok || ipInfo.extResolver {
+	elemSet, ok := sr.ipMap.Get(ip)
+	if !ok || len(elemSet) == 0 {
+		return ""
+	}
+	// NOTE it is possible to have more than one element in the Set, this will happen
+	// because of interleave of different events from different sources (local container create vs
+	// network db notifications)
+	// In such cases the resolution will be based on the first element of the set, and can vary
+	// during the system stabilitation
+	elem, ok := elemSet[0].(ipInfo)
+	if !ok {
+		setStr, b := sr.ipMap.String(ip)
+		logrus.Errorf("expected set of ipInfo type for key %s set:%t %s", ip, b, setStr)
 		return ""
 	}
 
-	return ipInfo.name + "." + nwName
+	if elem.extResolver {
+		return ""
+	}
+
+	return elem.name + "." + nwName
 }
 
 func (n *network) ResolveService(name string) ([]*net.SRV, []net.IP) {
diff --git a/components/engine/vendor/github.com/docker/libnetwork/networkdb/cluster.go b/components/engine/vendor/github.com/docker/libnetwork/networkdb/cluster.go
index d448c8caef..9156d0da68 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/networkdb/cluster.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/networkdb/cluster.go
@@ -284,7 +284,6 @@ func (nDB *NetworkDB) reconnectNode() {
 	}
 
 	if err := nDB.sendNodeEvent(NodeEventTypeJoin); err != nil {
-		logrus.Errorf("failed to send node join during reconnect: %v", err)
 		return
 	}
 
diff --git a/components/engine/vendor/github.com/docker/libnetwork/networkdb/delegate.go b/components/engine/vendor/github.com/docker/libnetwork/networkdb/delegate.go
index 2096ea622e..6df358382f 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/networkdb/delegate.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/networkdb/delegate.go
@@ -17,6 +17,25 @@ func (d *delegate) NodeMeta(limit int) []byte {
 	return []byte{}
 }
 
+func (nDB *NetworkDB) getNode(nEvent *NodeEvent) *node {
+	nDB.Lock()
+	defer nDB.Unlock()
+
+	for _, nodes := range []map[string]*node{
+		nDB.failedNodes,
+		nDB.leftNodes,
+		nDB.nodes,
+	} {
+		if n, ok := nodes[nEvent.NodeName]; ok {
+			if n.ltime >= nEvent.LTime {
+				return nil
+			}
+			return n
+		}
+	}
+	return nil
+}
+
 func (nDB *NetworkDB) checkAndGetNode(nEvent *NodeEvent) *node {
 	nDB.Lock()
 	defer nDB.Unlock()
@@ -63,10 +82,28 @@ func (nDB *NetworkDB) purgeSameNode(n *node) {
 }
 
 func (nDB *NetworkDB) handleNodeEvent(nEvent *NodeEvent) bool {
-	n := nDB.checkAndGetNode(nEvent)
+	// Update our local clock if the received messages has newer
+	// time.
+	nDB.networkClock.Witness(nEvent.LTime)
+
+	n := nDB.getNode(nEvent)
 	if n == nil {
 		return false
 	}
+	// If its a node leave event for a manager and this is the only manager we
+	// know of we want the reconnect logic to kick in. In a single manager
+	// cluster manager's gossip can't be bootstrapped unless some other node
+	// connects to it.
+	if len(nDB.bootStrapIP) == 1 && nEvent.Type == NodeEventTypeLeave {
+		for _, ip := range nDB.bootStrapIP {
+			if ip.Equal(n.Addr) {
+				n.ltime = nEvent.LTime
+				return true
+			}
+		}
+	}
+
+	n = nDB.checkAndGetNode(nEvent)
 
 	nDB.purgeSameNode(n)
 	n.ltime = nEvent.LTime
@@ -76,11 +113,13 @@ func (nDB *NetworkDB) handleNodeEvent(nEvent *NodeEvent) bool {
 		nDB.Lock()
 		nDB.nodes[n.Name] = n
 		nDB.Unlock()
+		logrus.Infof("Node join event for %s/%s", n.Name, n.Addr)
 		return true
 	case NodeEventTypeLeave:
 		nDB.Lock()
 		nDB.leftNodes[n.Name] = n
 		nDB.Unlock()
+		logrus.Infof("Node leave event for %s/%s", n.Name, n.Addr)
 		return true
 	}
 
diff --git a/components/engine/vendor/github.com/docker/libnetwork/networkdb/event_delegate.go b/components/engine/vendor/github.com/docker/libnetwork/networkdb/event_delegate.go
index 6ae0a32ad1..23e16832e7 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/networkdb/event_delegate.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/networkdb/event_delegate.go
@@ -22,6 +22,7 @@ func (e *eventDelegate) broadcastNodeEvent(addr net.IP, op opType) {
 }
 
 func (e *eventDelegate) NotifyJoin(mn *memberlist.Node) {
+	logrus.Infof("Node %s/%s, joined gossip cluster", mn.Name, mn.Addr)
 	e.broadcastNodeEvent(mn.Addr, opCreate)
 	e.nDB.Lock()
 	// In case the node is rejoining after a failure or leave,
@@ -37,9 +38,12 @@ func (e *eventDelegate) NotifyJoin(mn *memberlist.Node) {
 
 	e.nDB.nodes[mn.Name] = &node{Node: *mn}
 	e.nDB.Unlock()
+	logrus.Infof("Node %s/%s, added to nodes list", mn.Name, mn.Addr)
 }
 
 func (e *eventDelegate) NotifyLeave(mn *memberlist.Node) {
+	var failed bool
+	logrus.Infof("Node %s/%s, left gossip cluster", mn.Name, mn.Addr)
 	e.broadcastNodeEvent(mn.Addr, opDelete)
 	e.nDB.deleteNodeTableEntries(mn.Name)
 	e.nDB.deleteNetworkEntriesForNode(mn.Name)
@@ -47,10 +51,17 @@ func (e *eventDelegate) NotifyLeave(mn *memberlist.Node) {
 	if n, ok := e.nDB.nodes[mn.Name]; ok {
 		delete(e.nDB.nodes, mn.Name)
 
-		n.reapTime = reapInterval
+		// In case of node failure, keep retrying to reconnect every retryInterval (1sec) for nodeReapInterval (24h)
+		// Explicit leave will have already removed the node from the list of nodes (nDB.nodes) and put it into the leftNodes map
+		n.reapTime = nodeReapInterval
 		e.nDB.failedNodes[mn.Name] = n
+		failed = true
 	}
 	e.nDB.Unlock()
+	if failed {
+		logrus.Infof("Node %s/%s, added to failed nodes list", mn.Name, mn.Addr)
+	}
+
 }
 
 func (e *eventDelegate) NotifyUpdate(n *memberlist.Node) {
diff --git a/components/engine/vendor/github.com/docker/libnetwork/networkdb/networkdb.go b/components/engine/vendor/github.com/docker/libnetwork/networkdb/networkdb.go
index 86b0128b60..b93a90d019 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/networkdb/networkdb.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/networkdb/networkdb.go
@@ -4,6 +4,7 @@ package networkdb
 
 import (
 	"fmt"
+	"net"
 	"strings"
 	"sync"
 	"time"
@@ -88,6 +89,10 @@ type NetworkDB struct {
 
 	// Reference to the memberlist's keyring to add & remove keys
 	keyring *memberlist.Keyring
+
+	// bootStrapIP is the list of IPs that can be used to bootstrap
+	// the gossip.
+	bootStrapIP []net.IP
 }
 
 // PeerInfo represents the peer (gossip cluster) nodes of a network
@@ -194,6 +199,11 @@ func New(c *Config) (*NetworkDB, error) {
 // Join joins this NetworkDB instance with a list of peer NetworkDB
 // instances passed by the caller in the form of addr:port
 func (nDB *NetworkDB) Join(members []string) error {
+	nDB.Lock()
+	for _, m := range members {
+		nDB.bootStrapIP = append(nDB.bootStrapIP, net.ParseIP(m))
+	}
+	nDB.Unlock()
 	return nDB.clusterJoin(members)
 }
 
@@ -275,7 +285,6 @@ func (nDB *NetworkDB) CreateEntry(tname, nid, key string, value []byte) error {
 	nDB.indexes[byNetwork].Insert(fmt.Sprintf("/%s/%s/%s", nid, tname, key), entry)
 	nDB.Unlock()
 
-	nDB.broadcaster.Write(makeEvent(opCreate, tname, nid, key, value))
 	return nil
 }
 
@@ -303,7 +312,6 @@ func (nDB *NetworkDB) UpdateEntry(tname, nid, key string, value []byte) error {
 	nDB.indexes[byNetwork].Insert(fmt.Sprintf("/%s/%s/%s", nid, tname, key), entry)
 	nDB.Unlock()
 
-	nDB.broadcaster.Write(makeEvent(opUpdate, tname, nid, key, value))
 	return nil
 }
 
@@ -349,7 +357,6 @@ func (nDB *NetworkDB) DeleteEntry(tname, nid, key string) error {
 	nDB.indexes[byNetwork].Insert(fmt.Sprintf("/%s/%s/%s", nid, tname, key), entry)
 	nDB.Unlock()
 
-	nDB.broadcaster.Write(makeEvent(opDelete, tname, nid, key, value))
 	return nil
 }
 
diff --git a/components/engine/vendor/github.com/docker/libnetwork/networkdb/watch.go b/components/engine/vendor/github.com/docker/libnetwork/networkdb/watch.go
index 088b666f01..2ef30422a8 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/networkdb/watch.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/networkdb/watch.go
@@ -43,7 +43,7 @@ type DeleteEvent event
 // filter is an empty string it acts as a wildcard for that
 // field. Watch returns a channel of events, where the events will be
 // sent.
-func (nDB *NetworkDB) Watch(tname, nid, key string) (chan events.Event, func()) {
+func (nDB *NetworkDB) Watch(tname, nid, key string) (*events.Channel, func()) {
 	var matcher events.Matcher
 
 	if tname != "" || nid != "" || key != "" {
@@ -82,7 +82,7 @@ func (nDB *NetworkDB) Watch(tname, nid, key string) (chan events.Event, func())
 	}
 
 	nDB.broadcaster.Add(sink)
-	return ch.C, func() {
+	return ch, func() {
 		nDB.broadcaster.Remove(sink)
 		ch.Close()
 		sink.Close()
diff --git a/components/engine/vendor/github.com/docker/libnetwork/osl/namespace_unsupported.go b/components/engine/vendor/github.com/docker/libnetwork/osl/namespace_unsupported.go
index e385046121..74372e2492 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/osl/namespace_unsupported.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/osl/namespace_unsupported.go
@@ -7,6 +7,7 @@ package osl
 func GC() {
 }
 
+// GetSandboxForExternalKey returns sandbox object for the supplied path
 func GetSandboxForExternalKey(path string, key string) (Sandbox, error) {
 	return nil, nil
 }
diff --git a/components/engine/vendor/github.com/docker/libnetwork/osl/neigh_linux.go b/components/engine/vendor/github.com/docker/libnetwork/osl/neigh_linux.go
index 81b6cd9c1c..161ffa7beb 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/osl/neigh_linux.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/osl/neigh_linux.go
@@ -78,6 +78,23 @@ func (n *networkNamespace) DeleteNeighbor(dstIP net.IP, dstMac net.HardwareAddr,
 		if err := nlh.NeighDel(nlnh); err != nil {
 			logrus.Warnf("Deleting neighbor IP %s, mac %s failed, %v", dstIP, dstMac, err)
 		}
+
+		// Delete the dynamic entry in the bridge
+		if nlnh.Family > 0 {
+			nlnh := &netlink.Neigh{
+				IP:     dstIP,
+				Family: nh.family,
+			}
+
+			nlnh.HardwareAddr = dstMac
+			nlnh.Flags = netlink.NTF_MASTER
+			if nh.linkDst != "" {
+				nlnh.LinkIndex = iface.Attrs().Index
+			}
+			if err := nlh.NeighDel(nlnh); err != nil {
+				logrus.Warnf("Deleting bridge mac mac %s failed, %v", dstMac, err)
+			}
+		}
 	}
 
 	n.Lock()
diff --git a/components/engine/vendor/github.com/docker/libnetwork/sandbox.go b/components/engine/vendor/github.com/docker/libnetwork/sandbox.go
index c820cc04e9..9454c5c286 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/sandbox.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/sandbox.go
@@ -86,6 +86,9 @@ type sandbox struct {
 	ingress            bool
 	ndotsSet           bool
 	sync.Mutex
+	// This mutex is used to serialize service related operation for an endpoint
+	// The lock is here because the endpoint is saved into the store so is not unique
+	Service sync.Mutex
 }
 
 // These are the container configs used to customize container /etc/hosts file.
@@ -626,6 +629,10 @@ func (sb *sandbox) SetKey(basePath string) error {
 	}
 
 	sb.Lock()
+	if sb.inDelete {
+		sb.Unlock()
+		return types.ForbiddenErrorf("failed to SetKey: sandbox %q delete in progress", sb.id)
+	}
 	oldosSbox := sb.osSbox
 	sb.Unlock()
 
@@ -668,26 +675,25 @@ func (sb *sandbox) SetKey(basePath string) error {
 }
 
 func (sb *sandbox) EnableService() error {
+	logrus.Debugf("EnableService %s START", sb.containerID)
 	for _, ep := range sb.getConnectedEndpoints() {
 		if ep.enableService(true) {
-			if err := ep.addServiceInfoToCluster(); err != nil {
+			if err := ep.addServiceInfoToCluster(sb); err != nil {
 				ep.enableService(false)
 				return fmt.Errorf("could not update state for endpoint %s into cluster: %v", ep.Name(), err)
 			}
 		}
 	}
+	logrus.Debugf("EnableService %s DONE", sb.containerID)
 	return nil
 }
 
 func (sb *sandbox) DisableService() error {
+	logrus.Debugf("DisableService %s START", sb.containerID)
 	for _, ep := range sb.getConnectedEndpoints() {
-		if ep.enableService(false) {
-			if err := ep.deleteServiceInfoFromCluster(); err != nil {
-				ep.enableService(true)
-				return fmt.Errorf("could not delete state for endpoint %s from cluster: %v", ep.Name(), err)
-			}
-		}
+		ep.enableService(false)
 	}
+	logrus.Debugf("DisableService %s DONE", sb.containerID)
 	return nil
 }
 
diff --git a/components/engine/vendor/github.com/docker/libnetwork/service.go b/components/engine/vendor/github.com/docker/libnetwork/service.go
index a957026b2f..5a0d7e0057 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/service.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/service.go
@@ -4,6 +4,8 @@ import (
 	"fmt"
 	"net"
 	"sync"
+
+	"github.com/docker/libnetwork/common"
 )
 
 var (
@@ -48,9 +50,35 @@ type service struct {
 	// Service aliases
 	aliases []string
 
+	// This maps tracks for each IP address the list of endpoints ID
+	// associated with it. At stable state the endpoint ID expected is 1
+	// but during transition and service change it is possible to have
+	// temporary more than 1
+	ipToEndpoint common.SetMatrix
+
+	deleted bool
+
 	sync.Mutex
 }
 
+// assignIPToEndpoint inserts the mapping between the IP and the endpoint identifier
+// returns true if the mapping was not present, false otherwise
+// returns also the number of endpoints associated to the IP
+func (s *service) assignIPToEndpoint(ip, eID string) (bool, int) {
+	return s.ipToEndpoint.Insert(ip, eID)
+}
+
+// removeIPToEndpoint removes the mapping between the IP and the endpoint identifier
+// returns true if the mapping was deleted, false otherwise
+// returns also the number of endpoints associated to the IP
+func (s *service) removeIPToEndpoint(ip, eID string) (bool, int) {
+	return s.ipToEndpoint.Remove(ip, eID)
+}
+
+func (s *service) printIPToEndpoint(ip string) (string, bool) {
+	return s.ipToEndpoint.String(ip)
+}
+
 type loadBalancer struct {
 	vip    net.IP
 	fwMark uint32
diff --git a/components/engine/vendor/github.com/docker/libnetwork/service_common.go b/components/engine/vendor/github.com/docker/libnetwork/service_common.go
index 049d308423..7e3367c71c 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/service_common.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/service_common.go
@@ -6,15 +6,138 @@ import (
 	"net"
 
 	"github.com/Sirupsen/logrus"
+	"github.com/docker/libnetwork/common"
 )
 
-func newService(name string, id string, ingressPorts []*PortConfig, aliases []string) *service {
+func (c *controller) addEndpointNameResolution(svcName, svcID, nID, eID, containerName string, vip net.IP, serviceAliases, taskAliases []string, ip net.IP, addService bool, method string) error {
+	n, err := c.NetworkByID(nID)
+	if err != nil {
+		return err
+	}
+
+	logrus.Debugf("addEndpointNameResolution %s %s add_service:%t sAliases:%v tAliases:%v", eID, svcName, addService, serviceAliases, taskAliases)
+
+	// Add container resolution mappings
+	c.addContainerNameResolution(nID, eID, containerName, taskAliases, ip, method)
+
+	serviceID := svcID
+	if serviceID == "" {
+		// This is the case of a normal container not part of a service
+		serviceID = eID
+	}
+
+	// Add endpoint IP to special "tasks.svc_name" so that the applications have access to DNS RR.
+	n.(*network).addSvcRecords(eID, "tasks."+svcName, serviceID, ip, nil, false, method)
+	for _, alias := range serviceAliases {
+		n.(*network).addSvcRecords(eID, "tasks."+alias, serviceID, ip, nil, false, method)
+	}
+
+	// Add service name to vip in DNS, if vip is valid. Otherwise resort to DNS RR
+	if len(vip) == 0 {
+		n.(*network).addSvcRecords(eID, svcName, serviceID, ip, nil, false, method)
+		for _, alias := range serviceAliases {
+			n.(*network).addSvcRecords(eID, alias, serviceID, ip, nil, false, method)
+		}
+	}
+
+	if addService && len(vip) != 0 {
+		n.(*network).addSvcRecords(eID, svcName, serviceID, vip, nil, false, method)
+		for _, alias := range serviceAliases {
+			n.(*network).addSvcRecords(eID, alias, serviceID, vip, nil, false, method)
+		}
+	}
+
+	return nil
+}
+
+func (c *controller) addContainerNameResolution(nID, eID, containerName string, taskAliases []string, ip net.IP, method string) error {
+	n, err := c.NetworkByID(nID)
+	if err != nil {
+		return err
+	}
+	logrus.Debugf("addContainerNameResolution %s %s", eID, containerName)
+
+	// Add resolution for container name
+	n.(*network).addSvcRecords(eID, containerName, eID, ip, nil, true, method)
+
+	// Add resolution for taskaliases
+	for _, alias := range taskAliases {
+		n.(*network).addSvcRecords(eID, alias, eID, ip, nil, true, method)
+	}
+
+	return nil
+}
+
+func (c *controller) deleteEndpointNameResolution(svcName, svcID, nID, eID, containerName string, vip net.IP, serviceAliases, taskAliases []string, ip net.IP, rmService, multipleEntries bool, method string) error {
+	n, err := c.NetworkByID(nID)
+	if err != nil {
+		return err
+	}
+
+	logrus.Debugf("deleteEndpointNameResolution %s %s rm_service:%t suppress:%t sAliases:%v tAliases:%v", eID, svcName, rmService, multipleEntries, serviceAliases, taskAliases)
+
+	// Delete container resolution mappings
+	c.delContainerNameResolution(nID, eID, containerName, taskAliases, ip, method)
+
+	serviceID := svcID
+	if serviceID == "" {
+		// This is the case of a normal container not part of a service
+		serviceID = eID
+	}
+
+	// Delete the special "tasks.svc_name" backend record.
+	if !multipleEntries {
+		n.(*network).deleteSvcRecords(eID, "tasks."+svcName, serviceID, ip, nil, false, method)
+		for _, alias := range serviceAliases {
+			n.(*network).deleteSvcRecords(eID, "tasks."+alias, serviceID, ip, nil, false, method)
+		}
+	}
+
+	// If we are doing DNS RR delete the endpoint IP from DNS record right away.
+	if !multipleEntries && len(vip) == 0 {
+		n.(*network).deleteSvcRecords(eID, svcName, serviceID, ip, nil, false, method)
+		for _, alias := range serviceAliases {
+			n.(*network).deleteSvcRecords(eID, alias, serviceID, ip, nil, false, method)
+		}
+	}
+
+	// Remove the DNS record for VIP only if we are removing the service
+	if rmService && len(vip) != 0 && !multipleEntries {
+		n.(*network).deleteSvcRecords(eID, svcName, serviceID, vip, nil, false, method)
+		for _, alias := range serviceAliases {
+			n.(*network).deleteSvcRecords(eID, alias, serviceID, vip, nil, false, method)
+		}
+	}
+
+	return nil
+}
+
+func (c *controller) delContainerNameResolution(nID, eID, containerName string, taskAliases []string, ip net.IP, method string) error {
+	n, err := c.NetworkByID(nID)
+	if err != nil {
+		return err
+	}
+	logrus.Debugf("delContainerNameResolution %s %s", eID, containerName)
+
+	// Delete resolution for container name
+	n.(*network).deleteSvcRecords(eID, containerName, eID, ip, nil, true, method)
+
+	// Delete resolution for taskaliases
+	for _, alias := range taskAliases {
+		n.(*network).deleteSvcRecords(eID, alias, eID, ip, nil, true, method)
+	}
+
+	return nil
+}
+
+func newService(name string, id string, ingressPorts []*PortConfig, serviceAliases []string) *service {
 	return &service{
 		name:          name,
 		id:            id,
 		ingressPorts:  ingressPorts,
 		loadBalancers: make(map[string]*loadBalancer),
-		aliases:       aliases,
+		aliases:       serviceAliases,
+		ipToEndpoint:  common.NewSetMatrix(),
 	}
 }
 
@@ -41,6 +164,7 @@ func (c *controller) getLBIndex(sid, nid string, ingressPorts []*PortConfig) int
 func (c *controller) cleanupServiceBindings(cleanupNID string) {
 	var cleanupFuncs []func()
 
+	logrus.Debugf("cleanupServiceBindings for %s", cleanupNID)
 	c.Lock()
 	services := make([]*service, 0, len(c.serviceBindings))
 	for _, s := range c.serviceBindings {
@@ -50,21 +174,37 @@ func (c *controller) cleanupServiceBindings(cleanupNID string) {
 
 	for _, s := range services {
 		s.Lock()
+		// Skip the serviceBindings that got deleted
+		if s.deleted {
+			s.Unlock()
+			continue
+		}
 		for nid, lb := range s.loadBalancers {
 			if cleanupNID != "" && nid != cleanupNID {
 				continue
 			}
 
+			// The network is being deleted, erase all the associated service discovery records
+			// TODO(fcrisciani) separate the Load Balancer from the Service discovery, this operation
+			// can be done safely here, but the rmServiceBinding is still keeping consistency in the
+			// data structures that are tracking the endpoint to IP mapping.
+			c.Lock()
+			logrus.Debugf("cleanupServiceBindings erasing the svcRecords for %s", nid)
+			delete(c.svcRecords, nid)
+			c.Unlock()
+
 			for eid, ip := range lb.backEnds {
+				epID := eid
+				epIP := ip
 				service := s
 				loadBalancer := lb
 				networkID := nid
-				epID := eid
-				epIP := ip
-
 				cleanupFuncs = append(cleanupFuncs, func() {
-					if err := c.rmServiceBinding(service.name, service.id, networkID, epID, loadBalancer.vip,
-						service.ingressPorts, service.aliases, epIP); err != nil {
+					// ContainerName and taskAliases are not available here, this is still fine because the Service discovery
+					// cleanup already happened before. The only thing that rmServiceBinding is still doing here a part from the Load
+					// Balancer bookeeping, is to keep consistent the mapping of endpoint to IP.
+					if err := c.rmServiceBinding(service.name, service.id, networkID, epID, "", loadBalancer.vip,
+						service.ingressPorts, service.aliases, []string{}, epIP, "cleanupServiceBindings", false); err != nil {
 						logrus.Errorf("Failed to remove service bindings for service %s network %s endpoint %s while cleanup: %v",
 							service.id, networkID, epID, err)
 					}
@@ -80,52 +220,48 @@ func (c *controller) cleanupServiceBindings(cleanupNID string) {
 
 }
 
-func (c *controller) addServiceBinding(name, sid, nid, eid string, vip net.IP, ingressPorts []*PortConfig, aliases []string, ip net.IP) error {
-	n, err := c.NetworkByID(nid)
+func (c *controller) addServiceBinding(svcName, svcID, nID, eID, containerName string, vip net.IP, ingressPorts []*PortConfig, serviceAliases, taskAliases []string, ip net.IP, method string) error {
+	var addService bool
+
+	n, err := c.NetworkByID(nID)
 	if err != nil {
 		return err
 	}
 
 	skey := serviceKey{
-		id:    sid,
+		id:    svcID,
 		ports: portConfigs(ingressPorts).String(),
 	}
 
-	c.Lock()
-	s, ok := c.serviceBindings[skey]
-	if !ok {
-		// Create a new service if we are seeing this service
-		// for the first time.
-		s = newService(name, sid, ingressPorts, aliases)
-		c.serviceBindings[skey] = s
+	var s *service
+	for {
+		c.Lock()
+		var ok bool
+		s, ok = c.serviceBindings[skey]
+		if !ok {
+			// Create a new service if we are seeing this service
+			// for the first time.
+			s = newService(svcName, svcID, ingressPorts, serviceAliases)
+			c.serviceBindings[skey] = s
+		}
+		c.Unlock()
+		s.Lock()
+		if !s.deleted {
+			// ok the object is good to be used
+			break
+		}
+		s.Unlock()
 	}
-	c.Unlock()
-
-	// Add endpoint IP to special "tasks.svc_name" so that the
-	// applications have access to DNS RR.
-	n.(*network).addSvcRecords("tasks."+name, ip, nil, false)
-	for _, alias := range aliases {
-		n.(*network).addSvcRecords("tasks."+alias, ip, nil, false)
-	}
-
-	// Add service name to vip in DNS, if vip is valid. Otherwise resort to DNS RR
-	svcIP := vip
-	if len(svcIP) == 0 {
-		svcIP = ip
-	}
-	n.(*network).addSvcRecords(name, svcIP, nil, false)
-	for _, alias := range aliases {
-		n.(*network).addSvcRecords(alias, svcIP, nil, false)
-	}
-
-	s.Lock()
+	logrus.Debugf("addServiceBinding from %s START for %s %s p:%p nid:%s skey:%v", method, svcName, eID, s, nID, skey)
 	defer s.Unlock()
 
-	lb, ok := s.loadBalancers[nid]
+	lb, ok := s.loadBalancers[nID]
 	if !ok {
 		// Create a new load balancer if we are seeing this
 		// network attachment on the service for the first
 		// time.
+		fwMarkCtrMu.Lock()
+
 		lb = &loadBalancer{
 			vip:      vip,
 			fwMark:   fwMarkCtr,
@@ -133,14 +269,20 @@ func (c *controller) addServiceBinding(name, sid, nid, eid string, vip net.IP, i
 			service:  s,
 		}
 
-		fwMarkCtrMu.Lock()
 		fwMarkCtr++
 		fwMarkCtrMu.Unlock()
 
-		s.loadBalancers[nid] = lb
+		s.loadBalancers[nID] = lb
+		addService = true
 	}
 
-	lb.backEnds[eid] = ip
+	lb.backEnds[eID] = ip
+
+	ok, entries := s.assignIPToEndpoint(ip.String(), eID)
+	if !ok || entries > 1 {
+		setStr, b := s.printIPToEndpoint(ip.String())
+		logrus.Warnf("addServiceBinding %s possible trainsient state ok:%t entries:%d set:%t %s", eID, ok, entries, b, setStr)
+	}
 
 	// Add loadbalancer service and backend in all sandboxes in
 	// the network only if vip is valid.
@@ -148,19 +290,25 @@ func (c *controller) addServiceBinding(name, sid, nid, eid string, vip net.IP, i
 		n.(*network).addLBBackend(ip, vip, lb.fwMark, ingressPorts)
 	}
 
+	// Add the appropriate name resolutions
+	c.addEndpointNameResolution(svcName, svcID, nID, eID, containerName, vip, serviceAliases, taskAliases, ip, addService, "addServiceBinding")
+
+	logrus.Debugf("addServiceBinding from %s END for %s %s", method, svcName, eID)
+
 	return nil
 }
 
-func (c *controller) rmServiceBinding(name, sid, nid, eid string, vip net.IP, ingressPorts []*PortConfig, aliases []string, ip net.IP) error {
+func (c *controller) rmServiceBinding(svcName, svcID, nID, eID, containerName string, vip net.IP, ingressPorts []*PortConfig, serviceAliases []string, taskAliases []string, ip net.IP, method string, deleteSvcRecords bool) error {
+
 	var rmService bool
 
-	n, err := c.NetworkByID(nid)
+	n, err := c.NetworkByID(nID)
 	if err != nil {
 		return err
 	}
 
 	skey := serviceKey{
-		id:    sid,
+		id:    svcID,
 		ports: portConfigs(ingressPorts).String(),
 	}
 
@@ -168,69 +316,66 @@ func (c *controller) rmServiceBinding(name, sid, nid, eid string, vip net.IP, in
 	s, ok := c.serviceBindings[skey]
 	c.Unlock()
 	if !ok {
+		logrus.Warnf("rmServiceBinding %s %s %s aborted c.serviceBindings[skey] !ok", method, svcName, eID)
 		return nil
 	}
 
 	s.Lock()
-	lb, ok := s.loadBalancers[nid]
+	defer s.Unlock()
+	logrus.Debugf("rmServiceBinding from %s START for %s %s p:%p nid:%s sKey:%v deleteSvc:%t", method, svcName, eID, s, nID, skey, deleteSvcRecords)
+	lb, ok := s.loadBalancers[nID]
 	if !ok {
-		s.Unlock()
+		logrus.Warnf("rmServiceBinding %s %s %s aborted s.loadBalancers[nid] !ok", method, svcName, eID)
 		return nil
 	}
 
-	_, ok = lb.backEnds[eid]
+	_, ok = lb.backEnds[eID]
 	if !ok {
-		s.Unlock()
+		logrus.Warnf("rmServiceBinding %s %s %s aborted lb.backEnds[eid] !ok", method, svcName, eID)
 		return nil
 	}
 
-	delete(lb.backEnds, eid)
+	delete(lb.backEnds, eID)
 	if len(lb.backEnds) == 0 {
 		// All the backends for this service have been
 		// removed. Time to remove the load balancer and also
 		// remove the service entry in IPVS.
 		rmService = true
 
-		delete(s.loadBalancers, nid)
+		delete(s.loadBalancers, nID)
+		logrus.Debugf("rmServiceBinding %s delete %s, p:%p in loadbalancers len:%d", eID, nID, lb, len(s.loadBalancers))
+	}
+
+	ok, entries := s.removeIPToEndpoint(ip.String(), eID)
+	if !ok || entries > 0 {
+		setStr, b := s.printIPToEndpoint(ip.String())
+		logrus.Warnf("rmServiceBinding %s possible trainsient state ok:%t entries:%d set:%t %s", eID, ok, entries, b, setStr)
+	}
+
+	// Remove loadbalancer service(if needed) and backend in all
+	// sandboxes in the network only if the vip is valid.
+	if len(vip) != 0 && entries == 0 {
+		n.(*network).rmLBBackend(ip, vip, lb.fwMark, ingressPorts, rmService)
+	}
+
+	// Delete the name resolutions
+	if deleteSvcRecords {
+		c.deleteEndpointNameResolution(svcName, svcID, nID, eID, containerName, vip, serviceAliases, taskAliases, ip, rmService, entries > 0, "rmServiceBinding")
 	}
 
 	if len(s.loadBalancers) == 0 {
 		// All loadbalancers for the service removed. Time to
 		// remove the service itself.
 		c.Lock()
+
+		// Mark the object as deleted so that the add won't use it wrongly
+		s.deleted = true
+		// NOTE The delete from the serviceBindings map has to be the last operation else we are allowing a race between this service
+		// that is getting deleted and a new service that will be created if the entry is not anymore there
 		delete(c.serviceBindings, skey)
 		c.Unlock()
 	}
 
-	// Remove loadbalancer service(if needed) and backend in all
-	// sandboxes in the network only if the vip is valid.
-	if len(vip) != 0 {
-		n.(*network).rmLBBackend(ip, vip, lb.fwMark, ingressPorts, rmService)
-	}
-	s.Unlock()
-
-	// Delete the special "tasks.svc_name" backend record.
-	n.(*network).deleteSvcRecords("tasks."+name, ip, nil, false)
-	for _, alias := range aliases {
-		n.(*network).deleteSvcRecords("tasks."+alias, ip, nil, false)
-	}
-
-	// If we are doing DNS RR add the endpoint IP to DNS record
-	// right away.
-	if len(vip) == 0 {
-		n.(*network).deleteSvcRecords(name, ip, nil, false)
-		for _, alias := range aliases {
-			n.(*network).deleteSvcRecords(alias, ip, nil, false)
-		}
-	}
-
-	// Remove the DNS record for VIP only if we are removing the service
-	if rmService && len(vip) != 0 {
-		n.(*network).deleteSvcRecords(name, vip, nil, false)
-		for _, alias := range aliases {
-			n.(*network).deleteSvcRecords(alias, vip, nil, false)
-		}
-	}
-
+	logrus.Debugf("rmServiceBinding from %s END for %s %s", method, svcName, eID)
 	return nil
 }
diff --git a/components/engine/vendor/github.com/docker/libnetwork/service_linux.go b/components/engine/vendor/github.com/docker/libnetwork/service_linux.go
index 2bcb6de5eb..1cf7ee91aa 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/service_linux.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/service_linux.go
@@ -44,6 +44,11 @@ func (n *network) connectedLoadbalancers() []*loadBalancer {
 	var lbs []*loadBalancer
 	for _, s := range serviceBindings {
 		s.Lock()
+		// Skip the serviceBindings that got deleted
+		if s.deleted {
+			s.Unlock()
+			continue
+		}
 		if lb, ok := s.loadBalancers[n.ID()]; ok {
 			lbs = append(lbs, lb)
 		}
@@ -515,7 +520,7 @@ func writePortsToFile(ports []*PortConfig) (string, error) {
 	}
 	defer f.Close()
 
-	buf, err := proto.Marshal(&EndpointRecord{
+	buf, _ := proto.Marshal(&EndpointRecord{
 		IngressPorts: ports,
 	})
 
diff --git a/components/engine/vendor/github.com/docker/libnetwork/vendor.conf b/components/engine/vendor/github.com/docker/libnetwork/vendor.conf
index 0f1db6d18f..203e1cebf5 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/vendor.conf
+++ b/components/engine/vendor/github.com/docker/libnetwork/vendor.conf
@@ -19,11 +19,11 @@ github.com/docker/libkv 1d8431073ae03cdaedb198a89722f3aab6d418ef
 
 github.com/godbus/dbus 5f6efc7ef2759c81b7ba876593971bfce311eab3
 github.com/gogo/protobuf 8d70fb3182befc465c4a1eac8ad4d38ff49778e2
-github.com/golang/protobuf/proto f7137ae6b19afbfd61a94b746fda3b3fe0491874
+github.com/golang/protobuf f7137ae6b19afbfd61a94b746fda3b3fe0491874
 github.com/gorilla/context 215affda49addc4c8ef7e2534915df2c8c35c6cd
 github.com/gorilla/mux 8096f47503459bcc74d1f4c487b7e6e42e5746b5
-github.com/hashicorp/consul/api 954aec66231b79c161a4122b023fbcad13047f79
-github.com/hashicorp/go-msgpack/codec 71c2886f5a673a35f909803f38ece5810165097b
+github.com/hashicorp/consul 954aec66231b79c161a4122b023fbcad13047f79
+github.com/hashicorp/go-msgpack 71c2886f5a673a35f909803f38ece5810165097b
 github.com/hashicorp/go-multierror 2167c8ec40776024589f483a6b836489e47e1049
 github.com/hashicorp/memberlist v0.1.0
 github.com/sean-/seed e2103e2c35297fb7e17febb81e49b312087a2372
@@ -31,13 +31,13 @@ github.com/hashicorp/go-sockaddr acd314c5781ea706c710d9ea70069fd2e110d61d
 github.com/hashicorp/serf 598c54895cc5a7b1a24a398d635e8c0ea0959870
 github.com/mattn/go-shellwords 525bedee691b5a8df547cb5cf9f86b7fb1883e24
 github.com/miekg/dns d27455715200c7d3e321a1e5cadb27c9ee0b0f02
-github.com/opencontainers/runc/libcontainer ba1568de399395774ad84c2ace65937814c542ed
-github.com/samuel/go-zookeeper/zk d0e0d8e11f318e000a8cc434616d69e329edc374
+github.com/opencontainers/runc ba1568de399395774ad84c2ace65937814c542ed
+github.com/samuel/go-zookeeper d0e0d8e11f318e000a8cc434616d69e329edc374
 github.com/seccomp/libseccomp-golang 1b506fc7c24eec5a3693cdcbed40d9c226cfc6a1
 github.com/stretchr/testify dab07ac62d4905d3e48d17dc549c684ac3b7c15a
-github.com/syndtr/gocapability/capability 2c00daeb6c3b45114c80ac44119e7b8801fdd852
+github.com/syndtr/gocapability 2c00daeb6c3b45114c80ac44119e7b8801fdd852
 github.com/ugorji/go f1f1a805ed361a0e078bb537e4ea78cd37dcf065
-github.com/vishvananda/netlink 1e86b2bee5b6a7d377e4c02bb7f98209d6a7297c
+github.com/vishvananda/netlink bd6d5de5ccef2d66b0a26177928d0d8895d7f969
 github.com/vishvananda/netns 604eaf189ee867d8c147fafc28def2394e878d25
 golang.org/x/net c427ad74c6d7a814201695e9ffde0c5d400a7674
 golang.org/x/sys 8f0908ab3b2457e2e15403d3697c9ef5cb4b57a9
diff --git a/components/engine/vendor/github.com/docker/swarmkit/agent/agent.go b/components/engine/vendor/github.com/docker/swarmkit/agent/agent.go
index 841048ffe0..dc72fa0407 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/agent/agent.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/agent/agent.go
@@ -206,6 +206,9 @@ func (a *Agent) run(ctx context.Context) {
 		leaving       = a.leaving
 		subscriptions = map[string]context.CancelFunc{}
 	)
+	defer func() {
+		session.close()
+	}()
 
 	if err := a.worker.Init(ctx); err != nil {
 		log.G(ctx).WithError(err).Error("worker initialization failed")
@@ -314,6 +317,9 @@ func (a *Agent) run(ctx context.Context) {
 			if ready != nil {
 				close(ready)
 			}
+			if a.config.SessionTracker != nil {
+				a.config.SessionTracker.SessionEstablished()
+			}
 			ready = nil
 			registered = nil // we only care about this once per session
 			backoff = 0      // reset backoff
@@ -323,6 +329,10 @@ func (a *Agent) run(ctx context.Context) {
 			// but no error was sent. This must be the only place
 			// session.close is called in response to errors, for this to work.
 			if err != nil {
+				if a.config.SessionTracker != nil {
+					a.config.SessionTracker.SessionError(err)
+				}
+
 				log.G(ctx).WithError(err).Error("agent: session failed")
 				backoff = initialSessionFailureBackoff + 2*backoff
 				if backoff > maxSessionFailureBackoff {
@@ -337,6 +347,14 @@ func (a *Agent) run(ctx context.Context) {
 			// if we're here before <-registered, do nothing for that event
 			registered = nil
 		case <-session.closed:
+			if a.config.SessionTracker != nil {
+				if err := a.config.SessionTracker.SessionClosed(); err != nil {
+					log.G(ctx).WithError(err).Error("agent: exiting")
+					a.err = err
+					return
+				}
+			}
+
 			log.G(ctx).Debugf("agent: rebuild session")
 
 			// select a session registration delay from backoff range.
@@ -365,8 +383,6 @@ func (a *Agent) run(ctx context.Context) {
 			if a.err == nil {
 				a.err = ctx.Err()
 			}
-			session.close()
-
 			return
 		}
 	}
diff --git a/components/engine/vendor/github.com/docker/swarmkit/agent/config.go b/components/engine/vendor/github.com/docker/swarmkit/agent/config.go
index 70c94ecb65..98d5bf5728 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/agent/config.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/agent/config.go
@@ -43,6 +43,10 @@ type Config struct {
 
 	// NodeTLSInfo contains the starting node TLS info to bootstrap into the agent
 	NodeTLSInfo *api.NodeTLSInfo
+
+	// SessionTracker, if provided, will have its SessionClosed and SessionError methods called
+	// when sessions close and error.
+	SessionTracker SessionTracker
 }
 
 func (c *Config) validate() error {
@@ -64,3 +68,16 @@ func (c *Config) validate() error {
 
 	return nil
 }
+
+// A SessionTracker gets notified when sessions close and error
+type SessionTracker interface {
+	// SessionClosed is called whenever a session is closed - if the function errors, the agent
+	// will exit with the returned error.  Otherwise the agent can continue and rebuild a new session.
+	SessionClosed() error
+
+	// SessionError is called whenever a session errors
+	SessionError(err error)
+
+	// SessionEstablished is called whenever a session is established
+	SessionEstablished()
+}
diff --git a/components/engine/vendor/github.com/docker/swarmkit/agent/configs/configs.go b/components/engine/vendor/github.com/docker/swarmkit/agent/configs/configs.go
index f29e8afcba..ae5fc8c18c 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/agent/configs/configs.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/agent/configs/configs.go
@@ -1,6 +1,7 @@
 package configs
 
 import (
+	"fmt"
 	"sync"
 
 	"github.com/docker/swarmkit/agent/exec"
@@ -22,13 +23,13 @@ func NewManager() exec.ConfigsManager {
 }
 
 // Get returns a config by ID.  If the config doesn't exist, returns nil.
-func (r *configs) Get(configID string) *api.Config {
+func (r *configs) Get(configID string) (*api.Config, error) {
 	r.mu.RLock()
 	defer r.mu.RUnlock()
 	if r, ok := r.m[configID]; ok {
-		return r
+		return r, nil
 	}
-	return nil
+	return nil, fmt.Errorf("config %s not found", configID)
 }
 
 // Add adds one or more configs to the config map.
@@ -63,9 +64,9 @@ type taskRestrictedConfigsProvider struct {
 	configIDs map[string]struct{} // allow list of config ids
 }
 
-func (sp *taskRestrictedConfigsProvider) Get(configID string) *api.Config {
+func (sp *taskRestrictedConfigsProvider) Get(configID string) (*api.Config, error) {
 	if _, ok := sp.configIDs[configID]; !ok {
-		return nil
+		return nil, fmt.Errorf("task not authorized to access config %s", configID)
 	}
 
 	return sp.configs.Get(configID)
diff --git a/components/engine/vendor/github.com/docker/swarmkit/agent/exec/executor.go b/components/engine/vendor/github.com/docker/swarmkit/agent/exec/executor.go
index 12bf29b4d2..8c3fd03506 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/agent/exec/executor.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/agent/exec/executor.go
@@ -52,7 +52,7 @@ type DependencyGetter interface {
 type SecretGetter interface {
 	// Get returns the the secret with a specific secret ID, if available.
 	// When the secret is not available, the return will be nil.
-	Get(secretID string) *api.Secret
+	Get(secretID string) (*api.Secret, error)
 }
 
 // SecretsManager is the interface for secret storage and updates.
@@ -68,7 +68,7 @@ type SecretsManager interface {
 type ConfigGetter interface {
 	// Get returns the the config with a specific config ID, if available.
 	// When the config is not available, the return will be nil.
-	Get(configID string) *api.Config
+	Get(configID string) (*api.Config, error)
 }
 
 // ConfigsManager is the interface for config storage and updates.
diff --git a/components/engine/vendor/github.com/docker/swarmkit/agent/secrets/secrets.go b/components/engine/vendor/github.com/docker/swarmkit/agent/secrets/secrets.go
index 2f68fa20f3..233101d0fb 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/agent/secrets/secrets.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/agent/secrets/secrets.go
@@ -1,6 +1,7 @@
 package secrets
 
 import (
+	"fmt"
 	"sync"
 
 	"github.com/docker/swarmkit/agent/exec"
@@ -22,13 +23,13 @@ func NewManager() exec.SecretsManager {
 }
 
 // Get returns a secret by ID.  If the secret doesn't exist, returns nil.
-func (s *secrets) Get(secretID string) *api.Secret {
+func (s *secrets) Get(secretID string) (*api.Secret, error) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 	if s, ok := s.m[secretID]; ok {
-		return s
+		return s, nil
 	}
-	return nil
+	return nil, fmt.Errorf("secret %s not found", secretID)
 }
 
 // Add adds one or more secrets to the secret map.
@@ -63,9 +64,9 @@ type taskRestrictedSecretsProvider struct {
 	secretIDs map[string]struct{} // allow list of secret ids
 }
 
-func (sp *taskRestrictedSecretsProvider) Get(secretID string) *api.Secret {
+func (sp *taskRestrictedSecretsProvider) Get(secretID string) (*api.Secret, error) {
 	if _, ok := sp.secretIDs[secretID]; !ok {
-		return nil
+		return nil, fmt.Errorf("task not authorized to access secret %s", secretID)
 	}
 
 	return sp.secrets.Get(secretID)
diff --git a/components/engine/vendor/github.com/docker/swarmkit/agent/session.go b/components/engine/vendor/github.com/docker/swarmkit/agent/session.go
index 36a3a375cb..faa1fa8cac 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/agent/session.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/agent/session.go
@@ -409,7 +409,7 @@ func (s *session) sendError(err error) {
 }
 
 // close closing session. It should be called only in <-session.errs branch
-// of event loop.
+// of event loop, or when cleaning up the agent.
 func (s *session) close() error {
 	s.closeOnce.Do(func() {
 		s.cancel()
diff --git a/components/engine/vendor/github.com/docker/swarmkit/api/genericresource/helpers.go b/components/engine/vendor/github.com/docker/swarmkit/api/genericresource/helpers.go
new file mode 100644
index 0000000000..f9c22ac6cc
--- /dev/null
+++ b/components/engine/vendor/github.com/docker/swarmkit/api/genericresource/helpers.go
@@ -0,0 +1,111 @@
+package genericresource
+
+import (
+	"github.com/docker/swarmkit/api"
+)
+
+// NewSet creates a set object
+func NewSet(key string, vals ...string) []*api.GenericResource {
+	rs := make([]*api.GenericResource, 0, len(vals))
+
+	for _, v := range vals {
+		rs = append(rs, NewString(key, v))
+	}
+
+	return rs
+}
+
+// NewString creates a String resource
+func NewString(key, val string) *api.GenericResource {
+	return &api.GenericResource{
+		Resource: &api.GenericResource_Str{
+			Str: &api.GenericString{
+				Kind:  key,
+				Value: val,
+			},
+		},
+	}
+}
+
+// NewDiscrete creates a Discrete resource
+func NewDiscrete(key string, val int64) *api.GenericResource {
+	return &api.GenericResource{
+		Resource: &api.GenericResource_Discrete{
+			Discrete: &api.GenericDiscrete{
+				Kind:  key,
+				Value: val,
+			},
+		},
+	}
+}
+
+// GetResource returns resources from the "resources" parameter matching the kind key
+func GetResource(kind string, resources []*api.GenericResource) []*api.GenericResource {
+	var res []*api.GenericResource
+
+	for _, r := range resources {
+		if Kind(r) != kind {
+			continue
+		}
+
+		res = append(res, r)
+	}
+
+	return res
+}
+
+// ConsumeNodeResources removes "res" from nodeAvailableResources
+func ConsumeNodeResources(nodeAvailableResources *[]*api.GenericResource, res []*api.GenericResource) {
+	if nodeAvailableResources == nil {
+		return
+	}
+
+	w := 0
+
+loop:
+	for _, na := range *nodeAvailableResources {
+		for _, r := range res {
+			if Kind(na) != Kind(r) {
+				continue
+			}
+
+			if remove(na, r) {
+				continue loop
+			}
+			// If this wasn't the right element then
+			// we need to continue
+		}
+
+		(*nodeAvailableResources)[w] = na
+		w++
+	}
+
+	*nodeAvailableResources = (*nodeAvailableResources)[:w]
+}
+
+// Returns true if the element is to be removed from the list
+func remove(na, r *api.GenericResource) bool {
+	switch tr := r.Resource.(type) {
+	case *api.GenericResource_Discrete:
+		if na.GetDiscrete() == nil {
+			return false // Type change, ignore
+		}
+
+		na.GetDiscrete().Value -= tr.Discrete.Value
+		if na.GetDiscrete().Value <= 0 {
+			return true
+		}
+	case *api.GenericResource_Str:
+		if na.GetStr() == nil {
+			return false // Type change, ignore
+		}
+
+		if tr.Str.Value != na.GetStr().Value {
+			return false // not the right item, ignore
+		}
+
+		return true
+	}
+
+	return false
+}
diff --git a/components/engine/vendor/github.com/docker/swarmkit/api/genericresource/parse.go b/components/engine/vendor/github.com/docker/swarmkit/api/genericresource/parse.go
new file mode 100644
index 0000000000..de30908104
--- /dev/null
+++ b/components/engine/vendor/github.com/docker/swarmkit/api/genericresource/parse.go
@@ -0,0 +1,47 @@
+package genericresource
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/docker/swarmkit/api"
+)
+
+func newParseError(format string, args ...interface{}) error {
+	return fmt.Errorf("could not parse GenericResource: "+format, args...)
+}
+
+// Parse parses the GenericResource resources given by the arguments
+func Parse(cmd string) ([]*api.GenericResource, error) {
+	var rs []*api.GenericResource
+
+	for _, term := range strings.Split(cmd, ";") {
+		kva := strings.Split(term, "=")
+		if len(kva) != 2 {
+			return nil, newParseError("incorrect term %s, missing '=' or malformed expr", term)
+		}
+
+		key := strings.TrimSpace(kva[0])
+		val := strings.TrimSpace(kva[1])
+
+		u, err := strconv.ParseInt(val, 10, 64)
+		if err == nil {
+			if u < 0 {
+				return nil, newParseError("cannot ask for negative resource %s", key)
+			}
+			rs = append(rs, NewDiscrete(key, u))
+			continue
+		}
+
+		if len(val) > 2 && val[0] == '{' && val[len(val)-1] == '}' {
+			val = val[1 : len(val)-1]
+			rs = append(rs, NewSet(key, strings.Split(val, ",")...)...)
+			continue
+		}
+
+		return nil, newParseError("could not parse expression '%s'", term)
+	}
+
+	return rs, nil
+}
diff --git a/components/engine/vendor/github.com/docker/swarmkit/api/genericresource/resource_management.go b/components/engine/vendor/github.com/docker/swarmkit/api/genericresource/resource_management.go
new file mode 100644
index 0000000000..217c52051a
--- /dev/null
+++ b/components/engine/vendor/github.com/docker/swarmkit/api/genericresource/resource_management.go
@@ -0,0 +1,202 @@
+package genericresource
+
+import (
+	"fmt"
+	"github.com/docker/swarmkit/api"
+)
+
+// Claim assigns GenericResources to a task by taking them from the
+// node's GenericResource list and storing them in the task's available list
+func Claim(nodeAvailableResources, taskAssigned *[]*api.GenericResource,
+	taskReservations []*api.GenericResource) error {
+	var resSelected []*api.GenericResource
+
+	for _, res := range taskReservations {
+		tr := res.GetDiscrete()
+		if tr == nil {
+			return fmt.Errorf("task should only hold Discrete type")
+		}
+
+		// Select the resources
+		nrs, err := selectNodeResources(*nodeAvailableResources, tr)
+		if err != nil {
+			return err
+		}
+
+		resSelected = append(resSelected, nrs...)
+	}
+
+	ClaimResources(nodeAvailableResources, taskAssigned, resSelected)
+	return nil
+}
+
+// ClaimResources adds the specified resources to the task's list
+// and removes them from the node's generic resource list
+func ClaimResources(nodeAvailableResources, taskAssigned *[]*api.GenericResource,
+	resSelected []*api.GenericResource) {
+	*taskAssigned = append(*taskAssigned, resSelected...)
+	ConsumeNodeResources(nodeAvailableResources, resSelected)
+}
+
+func selectNodeResources(nodeRes []*api.GenericResource,
+	tr *api.GenericDiscrete) ([]*api.GenericResource, error) {
+	var nrs []*api.GenericResource
+
+	for _, res := range nodeRes {
+		if Kind(res) != tr.Kind {
+			continue
+		}
+
+		switch nr := res.Resource.(type) {
+		case *api.GenericResource_Discrete:
+			if nr.Discrete.Value >= tr.Value && tr.Value != 0 {
+				nrs = append(nrs, NewDiscrete(tr.Kind, tr.Value))
+			}
+
+			return nrs, nil
+		case *api.GenericResource_Str:
+			nrs = append(nrs, res.Copy())
+
+			if int64(len(nrs)) == tr.Value {
+				return nrs, nil
+			}
+		}
+	}
+
+	if len(nrs) == 0 {
+		return nil, fmt.Errorf("not enough resources available for task reservations: %+v", tr)
+	}
+
+	return nrs, nil
+}
+
+// Reclaim adds the resources taken by the task to the node's store
+func Reclaim(nodeAvailableResources *[]*api.GenericResource, taskAssigned, nodeRes []*api.GenericResource) error {
+	err := reclaimResources(nodeAvailableResources, taskAssigned)
+	if err != nil {
+		return err
+	}
+
+	sanitize(nodeRes, nodeAvailableResources)
+
+	return nil
+}
+
+func reclaimResources(nodeAvailableResources *[]*api.GenericResource, taskAssigned []*api.GenericResource) error {
+	// The node could have been updated
+	if nodeAvailableResources == nil {
+		return fmt.Errorf("node no longer has any resources")
+	}
+
+	for _, res := range taskAssigned {
+		switch tr := res.Resource.(type) {
+		case *api.GenericResource_Discrete:
+			nrs := GetResource(tr.Discrete.Kind, *nodeAvailableResources)
+
+			// If the resource went down to 0 it's no longer in the
+			// available list
+			if len(nrs) == 0 {
+				*nodeAvailableResources = append(*nodeAvailableResources, res.Copy())
+			}
+
+			if len(nrs) != 1 {
+				continue // Type change
+			}
+
+			nr := nrs[0].GetDiscrete()
+			if nr == nil {
+				continue // Type change
+			}
+
+			nr.Value += tr.Discrete.Value
+		case *api.GenericResource_Str:
+			*nodeAvailableResources = append(*nodeAvailableResources, res.Copy())
+		}
+	}
+
+	return nil
+}
+
+// sanitize checks that nodeAvailableResources does not add resources unknown
+// to the nodeSpec (nodeRes) or goes over the integer bound specified
+// by the spec.
+// Note this is because the user is able to update a node's resources
+func sanitize(nodeRes []*api.GenericResource, nodeAvailableResources *[]*api.GenericResource) {
+	// - We add the sanitized resources at the end, after
+	// having removed the elements from the list
+
+	// - When a set changes to a Discrete we also need
+	// to make sure that we don't add the Discrete multiple
+	// time hence, the need of a map to remember that
+	var sanitized []*api.GenericResource
+	kindSanitized := make(map[string]struct{})
+	w := 0
+
+	for _, na := range *nodeAvailableResources {
+		ok, nrs := sanitizeResource(nodeRes, na)
+		if !ok {
+			if _, ok = kindSanitized[Kind(na)]; ok {
+				continue
+			}
+
+			kindSanitized[Kind(na)] = struct{}{}
+			sanitized = append(sanitized, nrs...)
+
+			continue
+		}
+
+		(*nodeAvailableResources)[w] = na
+		w++
+	}
+
+	*nodeAvailableResources = (*nodeAvailableResources)[:w]
+	*nodeAvailableResources = append(*nodeAvailableResources, sanitized...)
+}
+
+// Returns true if the element is in nodeRes and "sane"
+// Returns false if the element isn't in nodeRes and "sane" and the element(s) that should be replacing it
+func sanitizeResource(nodeRes []*api.GenericResource, res *api.GenericResource) (ok bool, nrs []*api.GenericResource) {
+	switch na := res.Resource.(type) {
+	case *api.GenericResource_Discrete:
+		nrs := GetResource(na.Discrete.Kind, nodeRes)
+
+		// Type change or removed: reset
+		if len(nrs) != 1 {
+			return false, nrs
+		}
+
+		// Type change: reset
+		nr := nrs[0].GetDiscrete()
+		if nr == nil {
+			return false, nrs
+		}
+
+		// Amount change: reset
+		if na.Discrete.Value > nr.Value {
+			return false, nrs
+		}
+	case *api.GenericResource_Str:
+		nrs := GetResource(na.Str.Kind, nodeRes)
+
+		// Type change
+		if len(nrs) == 0 {
+			return false, nrs
+		}
+
+		for _, nr := range nrs {
+			// Type change: reset
+			if nr.GetDiscrete() != nil {
+				return false, nrs
+			}
+
+			if na.Str.Value == nr.GetStr().Value {
+				return true, nil
+			}
+		}
+
+		// Removed
+		return false, nil
+	}
+
+	return true, nil
+}
diff --git a/components/engine/vendor/github.com/docker/swarmkit/api/genericresource/string.go b/components/engine/vendor/github.com/docker/swarmkit/api/genericresource/string.go
new file mode 100644
index 0000000000..a353853135
--- /dev/null
+++ b/components/engine/vendor/github.com/docker/swarmkit/api/genericresource/string.go
@@ -0,0 +1,54 @@
+package genericresource
+
+import (
+	"strconv"
+	"strings"
+
+	"github.com/docker/swarmkit/api"
+)
+
+func discreteToString(d *api.GenericResource_Discrete) string {
+	return strconv.FormatInt(d.Discrete.Value, 10)
+}
+
+// Kind returns the kind key as a string
+func Kind(res *api.GenericResource) string {
+	switch r := res.Resource.(type) {
+	case *api.GenericResource_Discrete:
+		return r.Discrete.Kind
+	case *api.GenericResource_Str:
+		return r.Str.Kind
+	}
+
+	return ""
+}
+
+// Value returns the value key as a string
+func Value(res *api.GenericResource) string {
+	switch res := res.Resource.(type) {
+	case *api.GenericResource_Discrete:
+		return discreteToString(res)
+	case *api.GenericResource_Str:
+		return res.Str.Value
+	}
+
+	return ""
+}
+
+// EnvFormat returns the environment string version of the resource
+func EnvFormat(res []*api.GenericResource, prefix string) []string {
+	envs := make(map[string][]string)
+	for _, v := range res {
+		key := Kind(v)
+		val := Value(v)
+		envs[key] = append(envs[key], val)
+	}
+
+	env := make([]string, 0, len(res))
+	for k, v := range envs {
+		k = strings.ToUpper(prefix + "_" + k)
+		env = append(env, k+"="+strings.Join(v, ","))
+	}
+
+	return env
+}
diff --git a/components/engine/vendor/github.com/docker/swarmkit/api/genericresource/validate.go b/components/engine/vendor/github.com/docker/swarmkit/api/genericresource/validate.go
new file mode 100644
index 0000000000..98953e107d
--- /dev/null
+++ b/components/engine/vendor/github.com/docker/swarmkit/api/genericresource/validate.go
@@ -0,0 +1,84 @@
+package genericresource
+
+import (
+	"fmt"
+	"github.com/docker/swarmkit/api"
+)
+
+// ValidateTask validates that the task only uses integers
+// for generic resources
+func ValidateTask(resources *api.Resources) error {
+	for _, v := range resources.Generic {
+		if v.GetDiscrete() != nil {
+			continue
+		}
+
+		return fmt.Errorf("invalid argument for resource %s", Kind(v))
+	}
+
+	return nil
+}
+
+// HasEnough returns true if node can satisfy the task's GenericResource request
+func HasEnough(nodeRes []*api.GenericResource, taskRes *api.GenericResource) (bool, error) {
+	t := taskRes.GetDiscrete()
+	if t == nil {
+		return false, fmt.Errorf("task should only hold Discrete type")
+	}
+
+	if nodeRes == nil {
+		return false, nil
+	}
+
+	nrs := GetResource(t.Kind, nodeRes)
+	if len(nrs) == 0 {
+		return false, nil
+	}
+
+	switch nr := nrs[0].Resource.(type) {
+	case *api.GenericResource_Discrete:
+		if t.Value > nr.Discrete.Value {
+			return false, nil
+		}
+	case *api.GenericResource_Str:
+		if t.Value > int64(len(nrs)) {
+			return false, nil
+		}
+	}
+
+	return true, nil
+}
+
+// HasResource checks if there is enough "res" in the "resources" argument
+func HasResource(res *api.GenericResource, resources []*api.GenericResource) bool {
+	for _, r := range resources {
+		if Kind(res) != Kind(r) {
+			continue
+		}
+
+		switch rtype := r.Resource.(type) {
+		case *api.GenericResource_Discrete:
+			if res.GetDiscrete() == nil {
+				return false
+			}
+
+			if res.GetDiscrete().Value < rtype.Discrete.Value {
+				return false
+			}
+
+			return true
+		case *api.GenericResource_Str:
+			if res.GetStr() == nil {
+				return false
+			}
+
+			if res.GetStr().Value != rtype.Str.Value {
+				continue
+			}
+
+			return true
+		}
+	}
+
+	return false
+}
diff --git a/components/engine/vendor/github.com/docker/swarmkit/api/objects.pb.go b/components/engine/vendor/github.com/docker/swarmkit/api/objects.pb.go
index e9c2438502..b6a9389a6d 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/api/objects.pb.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/api/objects.pb.go
@@ -198,7 +198,8 @@ type Task struct {
 	// such a cluster default or policy-based value.
 	//
 	// If not present, the daemon's default will be used.
-	LogDriver *Driver `protobuf:"bytes,13,opt,name=log_driver,json=logDriver" json:"log_driver,omitempty"`
+	LogDriver                *Driver            `protobuf:"bytes,13,opt,name=log_driver,json=logDriver" json:"log_driver,omitempty"`
+	AssignedGenericResources []*GenericResource `protobuf:"bytes,15,rep,name=assigned_generic_resources,json=assignedGenericResources" json:"assigned_generic_resources,omitempty"`
 }
 
 func (m *Task) Reset()                    { *m = Task{} }
@@ -529,6 +530,14 @@ func (m *Task) CopyFrom(src interface{}) {
 		m.LogDriver = &Driver{}
 		github_com_docker_swarmkit_api_deepcopy.Copy(m.LogDriver, o.LogDriver)
 	}
+	if o.AssignedGenericResources != nil {
+		m.AssignedGenericResources = make([]*GenericResource, len(o.AssignedGenericResources))
+		for i := range m.AssignedGenericResources {
+			m.AssignedGenericResources[i] = &GenericResource{}
+			github_com_docker_swarmkit_api_deepcopy.Copy(m.AssignedGenericResources[i], o.AssignedGenericResources[i])
+		}
+	}
+
 }
 
 func (m *NetworkAttachment) Copy() *NetworkAttachment {
@@ -1140,6 +1149,18 @@ func (m *Task) MarshalTo(dAtA []byte) (int, error) {
 		}
 		i += n26
 	}
+	if len(m.AssignedGenericResources) > 0 {
+		for _, msg := range m.AssignedGenericResources {
+			dAtA[i] = 0x7a
+			i++
+			i = encodeVarintObjects(dAtA, i, uint64(msg.Size()))
+			n, err := msg.MarshalTo(dAtA[i:])
+			if err != nil {
+				return 0, err
+			}
+			i += n
+		}
+	}
 	return i, nil
 }
 
@@ -1771,6 +1792,12 @@ func (m *Task) Size() (n int) {
 		l = m.SpecVersion.Size()
 		n += 1 + l + sovObjects(uint64(l))
 	}
+	if len(m.AssignedGenericResources) > 0 {
+		for _, e := range m.AssignedGenericResources {
+			l = e.Size()
+			n += 1 + l + sovObjects(uint64(l))
+		}
+	}
 	return n
 }
 
@@ -4419,6 +4446,7 @@ func (this *Task) String() string {
 		`Endpoint:` + strings.Replace(fmt.Sprintf("%v", this.Endpoint), "Endpoint", "Endpoint", 1) + `,`,
 		`LogDriver:` + strings.Replace(fmt.Sprintf("%v", this.LogDriver), "Driver", "Driver", 1) + `,`,
 		`SpecVersion:` + strings.Replace(fmt.Sprintf("%v", this.SpecVersion), "Version", "Version", 1) + `,`,
+		`AssignedGenericResources:` + strings.Replace(fmt.Sprintf("%v", this.AssignedGenericResources), "GenericResource", "GenericResource", 1) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -6001,6 +6029,37 @@ func (m *Task) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 15:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AssignedGenericResources", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowObjects
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthObjects
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AssignedGenericResources = append(m.AssignedGenericResources, &GenericResource{})
+			if err := m.AssignedGenericResources[len(m.AssignedGenericResources)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipObjects(dAtA[iNdEx:])
@@ -7630,96 +7689,99 @@ var (
 func init() { proto.RegisterFile("objects.proto", fileDescriptorObjects) }
 
 var fileDescriptorObjects = []byte{
-	// 1451 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x58, 0xcd, 0x6f, 0x1b, 0x45,
-	0x14, 0xef, 0xda, 0x1b, 0x7f, 0x3c, 0x27, 0x56, 0x98, 0x86, 0xe0, 0x9a, 0x60, 0x07, 0x57, 0xa0,
-	0x0a, 0x55, 0x4e, 0x09, 0x05, 0xa5, 0x81, 0xd2, 0xda, 0x49, 0xd4, 0x5a, 0xa5, 0x34, 0x9a, 0x96,
-	0x96, 0x9b, 0x99, 0xec, 0x4e, 0xdd, 0xc5, 0xeb, 0x9d, 0xd5, 0xce, 0xd8, 0xc5, 0x37, 0xce, 0xf9,
-	0x07, 0x72, 0xe3, 0xd0, 0x13, 0x77, 0xb8, 0x70, 0xe1, 0xc0, 0xa9, 0x47, 0x4e, 0x88, 0x53, 0x44,
-	0xfd, 0x5f, 0x20, 0x71, 0x40, 0x33, 0x3b, 0x6b, 0x6f, 0xea, 0x75, 0x92, 0xa2, 0x2a, 0xe2, 0xe4,
-	0xf9, 0xf8, 0xfd, 0xde, 0xd7, 0xbc, 0xf7, 0x66, 0xd6, 0xb0, 0xc0, 0xf6, 0xbe, 0xa5, 0x96, 0xe0,
-	0x75, 0x3f, 0x60, 0x82, 0x21, 0x64, 0x33, 0xab, 0x4b, 0x83, 0x3a, 0x7f, 0x4a, 0x82, 0x5e, 0xd7,
-	0x11, 0xf5, 0xc1, 0x87, 0xe5, 0x82, 0x18, 0xfa, 0x54, 0x03, 0xca, 0x05, 0xee, 0x53, 0x2b, 0x9a,
-	0x54, 0x3b, 0x8c, 0x75, 0x5c, 0xba, 0xa6, 0x66, 0x7b, 0xfd, 0xc7, 0x6b, 0xc2, 0xe9, 0x51, 0x2e,
-	0x48, 0xcf, 0xd7, 0x80, 0xa5, 0x0e, 0xeb, 0x30, 0x35, 0x5c, 0x93, 0x23, 0xbd, 0x7a, 0xe1, 0x65,
-	0x1a, 0xf1, 0x86, 0x7a, 0xeb, 0xbc, 0xef, 0xf6, 0x3b, 0x8e, 0xb7, 0x16, 0xfe, 0x84, 0x8b, 0xb5,
-	0x5f, 0x0c, 0x30, 0xef, 0x52, 0x41, 0xd0, 0xa7, 0x90, 0x1d, 0xd0, 0x80, 0x3b, 0xcc, 0x2b, 0x19,
-	0xab, 0xc6, 0xa5, 0xc2, 0xfa, 0xdb, 0xf5, 0x69, 0x7b, 0xeb, 0x0f, 0x43, 0x48, 0xd3, 0x7c, 0x7e,
-	0x58, 0x3d, 0x87, 0x23, 0x06, 0xba, 0x06, 0x60, 0x05, 0x94, 0x08, 0x6a, 0xb7, 0x89, 0x28, 0xa5,
-	0x14, 0xbf, 0x5c, 0x0f, 0x4d, 0xa9, 0x47, 0xa6, 0xd4, 0x1f, 0x44, 0x1e, 0xe0, 0xbc, 0x46, 0x37,
-	0x84, 0xa4, 0xf6, 0x7d, 0x3b, 0xa2, 0xa6, 0x4f, 0xa6, 0x6a, 0x74, 0x43, 0xd4, 0x7e, 0x32, 0xc1,
-	0xfc, 0x92, 0xd9, 0x14, 0x2d, 0x43, 0xca, 0xb1, 0x95, 0xd9, 0xf9, 0x66, 0x66, 0x74, 0x58, 0x4d,
-	0xb5, 0xb6, 0x71, 0xca, 0xb1, 0xd1, 0x3a, 0x98, 0x3d, 0x2a, 0x88, 0x36, 0xa8, 0x94, 0xe4, 0x90,
-	0xf4, 0x5d, 0x7b, 0xa3, 0xb0, 0xe8, 0x13, 0x30, 0xe5, 0x31, 0x68, 0x4b, 0x56, 0x92, 0x38, 0x52,
-	0xe7, 0x7d, 0x9f, 0x5a, 0x11, 0x4f, 0xe2, 0xd1, 0x0e, 0x14, 0x6c, 0xca, 0xad, 0xc0, 0xf1, 0x85,
-	0x8c, 0xa1, 0xa9, 0xe8, 0x17, 0x67, 0xd1, 0xb7, 0x27, 0x50, 0x1c, 0xe7, 0xa1, 0xcf, 0x20, 0xc3,
-	0x05, 0x11, 0x7d, 0x5e, 0x9a, 0x53, 0x12, 0x2a, 0x33, 0x0d, 0x50, 0x28, 0x6d, 0x82, 0xe6, 0xa0,
-	0xdb, 0x50, 0xec, 0x11, 0x8f, 0x74, 0x68, 0xd0, 0xd6, 0x52, 0x32, 0x4a, 0xca, 0xbb, 0x89, 0xae,
-	0x87, 0xc8, 0x50, 0x10, 0x5e, 0xe8, 0xc5, 0xa7, 0x68, 0x07, 0x80, 0x08, 0x41, 0xac, 0x27, 0x3d,
-	0xea, 0x89, 0x52, 0x56, 0x49, 0x79, 0x2f, 0xd1, 0x16, 0x2a, 0x9e, 0xb2, 0xa0, 0xdb, 0x18, 0x83,
-	0x71, 0x8c, 0x88, 0x6e, 0x41, 0xc1, 0xa2, 0x81, 0x70, 0x1e, 0x3b, 0x16, 0x11, 0xb4, 0x94, 0x53,
-	0x72, 0xaa, 0x49, 0x72, 0xb6, 0x26, 0x30, 0xed, 0x54, 0x9c, 0x89, 0xae, 0x80, 0x19, 0x30, 0x97,
-	0x96, 0xf2, 0xab, 0xc6, 0xa5, 0xe2, 0xec, 0x63, 0xc1, 0xcc, 0xa5, 0x58, 0x21, 0x37, 0x97, 0xf7,
-	0x0f, 0x6a, 0x08, 0x16, 0x73, 0xc6, 0xa2, 0xa1, 0x52, 0xc3, 0xb8, 0x62, 0x7c, 0x6d, 0x7c, 0x63,
-	0xd4, 0xfe, 0x49, 0x43, 0xf6, 0x3e, 0x0d, 0x06, 0x8e, 0xf5, 0x7a, 0x13, 0xe7, 0xda, 0x91, 0xc4,
-	0x49, 0xf4, 0x51, 0xab, 0x9d, 0xca, 0x9d, 0x0d, 0xc8, 0x51, 0xcf, 0xf6, 0x99, 0xe3, 0x09, 0x9d,
-	0x38, 0x89, 0x0e, 0xee, 0x68, 0x0c, 0x1e, 0xa3, 0xd1, 0x0e, 0x2c, 0x84, 0xf5, 0xd0, 0x3e, 0x92,
-	0x35, 0xab, 0x49, 0xf4, 0xaf, 0x14, 0x50, 0x1f, 0xf7, 0x7c, 0x3f, 0x36, 0x43, 0xdb, 0xb0, 0xe0,
-	0x07, 0x74, 0xe0, 0xb0, 0x3e, 0x6f, 0x2b, 0x27, 0x32, 0xa7, 0x72, 0x02, 0xcf, 0x47, 0x2c, 0x39,
-	0x43, 0x9f, 0xc3, 0xbc, 0x24, 0xb7, 0xa3, 0x3e, 0x02, 0x27, 0xf6, 0x11, 0xac, 0x5a, 0x9e, 0x9e,
-	0xa0, 0x7b, 0xf0, 0xe6, 0x11, 0x2b, 0xc6, 0x82, 0x0a, 0x27, 0x0b, 0x3a, 0x1f, 0xb7, 0x44, 0x2f,
-	0x6e, 0xa2, 0xfd, 0x83, 0x5a, 0x11, 0xe6, 0xe3, 0x29, 0x50, 0xfb, 0x21, 0x05, 0xb9, 0x28, 0x90,
-	0xe8, 0xaa, 0x3e, 0x33, 0x63, 0x76, 0xd4, 0x22, 0xac, 0xf2, 0x37, 0x3c, 0xae, 0xab, 0x30, 0xe7,
-	0xb3, 0x40, 0xf0, 0x52, 0x6a, 0x35, 0x3d, 0xab, 0x44, 0x77, 0x59, 0x20, 0xb6, 0x98, 0xf7, 0xd8,
-	0xe9, 0xe0, 0x10, 0x8c, 0x1e, 0x41, 0x61, 0xe0, 0x04, 0xa2, 0x4f, 0xdc, 0xb6, 0xe3, 0xf3, 0x52,
-	0x5a, 0x71, 0xdf, 0x3f, 0x4e, 0x65, 0xfd, 0x61, 0x88, 0x6f, 0xed, 0x36, 0x8b, 0xa3, 0xc3, 0x2a,
-	0x8c, 0xa7, 0x1c, 0x83, 0x16, 0xd5, 0xf2, 0x79, 0xf9, 0x2e, 0xe4, 0xc7, 0x3b, 0xe8, 0x32, 0x80,
-	0x17, 0x56, 0x64, 0x7b, 0x9c, 0xd9, 0x0b, 0xa3, 0xc3, 0x6a, 0x5e, 0xd7, 0x69, 0x6b, 0x1b, 0xe7,
-	0x35, 0xa0, 0x65, 0x23, 0x04, 0x26, 0xb1, 0xed, 0x40, 0xe5, 0x79, 0x1e, 0xab, 0x71, 0xed, 0xc7,
-	0x0c, 0x98, 0x0f, 0x08, 0xef, 0x9e, 0x75, 0x57, 0x95, 0x3a, 0xa7, 0x2a, 0xe3, 0x32, 0x00, 0x0f,
-	0xf3, 0x4d, 0xba, 0x63, 0x4e, 0xdc, 0xd1, 0x59, 0x28, 0xdd, 0xd1, 0x80, 0xd0, 0x1d, 0xee, 0x32,
-	0xa1, 0x8a, 0xc0, 0xc4, 0x6a, 0x8c, 0x2e, 0x42, 0xd6, 0x63, 0xb6, 0xa2, 0x67, 0x14, 0x1d, 0x46,
-	0x87, 0xd5, 0x8c, 0xec, 0x15, 0xad, 0x6d, 0x9c, 0x91, 0x5b, 0x2d, 0x5b, 0xb6, 0x29, 0xe2, 0x79,
-	0x4c, 0x10, 0xd9, 0x83, 0xb9, 0x6e, 0x77, 0x89, 0xd9, 0xdf, 0x98, 0xc0, 0xa2, 0x36, 0x15, 0x63,
-	0xa2, 0x87, 0x70, 0x3e, 0xb2, 0x37, 0x2e, 0x30, 0xf7, 0x2a, 0x02, 0x91, 0x96, 0x10, 0xdb, 0x89,
-	0x5d, 0x0b, 0xf9, 0xd9, 0xd7, 0x82, 0x8a, 0x60, 0xd2, 0xb5, 0xd0, 0x84, 0x05, 0x9b, 0x72, 0x27,
-	0xa0, 0xb6, 0x6a, 0x13, 0x54, 0x55, 0x66, 0x71, 0xfd, 0x9d, 0xe3, 0x84, 0x50, 0x3c, 0xaf, 0x39,
-	0x6a, 0x86, 0x1a, 0x90, 0xd3, 0x79, 0xc3, 0x4b, 0x05, 0x95, 0xbb, 0xa7, 0xbc, 0x0e, 0xc6, 0xb4,
-	0x23, 0x6d, 0x6e, 0xfe, 0x95, 0xda, 0xdc, 0x35, 0x00, 0x97, 0x75, 0xda, 0x76, 0xe0, 0x0c, 0x68,
-	0x50, 0x5a, 0xd0, 0x8f, 0x84, 0x04, 0xee, 0xb6, 0x42, 0xe0, 0xbc, 0xcb, 0x3a, 0xe1, 0x70, 0xaa,
-	0x29, 0x15, 0x5f, 0xad, 0x29, 0x6d, 0x96, 0xf7, 0x0f, 0x6a, 0xcb, 0xb0, 0x14, 0xef, 0x21, 0x1b,
-	0xc6, 0x4d, 0xe3, 0xb6, 0xb1, 0x6b, 0xd4, 0x7e, 0x4b, 0xc1, 0x1b, 0x53, 0x0e, 0xa3, 0x8f, 0x21,
-	0xab, 0x5d, 0x3e, 0xee, 0x25, 0xa5, 0x79, 0x38, 0xc2, 0xa2, 0x15, 0xc8, 0xcb, 0xfa, 0xa3, 0x9c,
-	0xd3, 0xb0, 0xb3, 0xe4, 0xf1, 0x64, 0x01, 0x95, 0x20, 0x4b, 0x5c, 0x87, 0xc8, 0xbd, 0xb4, 0xda,
-	0x8b, 0xa6, 0xa8, 0x0f, 0xcb, 0x61, 0x5c, 0xda, 0x93, 0x7b, 0xb7, 0xcd, 0x7c, 0xc1, 0x4b, 0xa6,
-	0x3a, 0xa6, 0x1b, 0xa7, 0x3a, 0x26, 0x1d, 0xb9, 0xc9, 0xc2, 0x3d, 0x5f, 0xf0, 0x1d, 0x4f, 0x04,
-	0x43, 0xbc, 0x64, 0x27, 0x6c, 0x95, 0x6f, 0xc1, 0x85, 0x99, 0x14, 0xb4, 0x08, 0xe9, 0x2e, 0x1d,
-	0x86, 0xbd, 0x03, 0xcb, 0x21, 0x5a, 0x82, 0xb9, 0x01, 0x71, 0xfb, 0x54, 0xb7, 0x9a, 0x70, 0xb2,
-	0x99, 0xda, 0x30, 0x6a, 0xcf, 0x52, 0x90, 0xd5, 0xe6, 0x9c, 0xf5, 0x7d, 0xac, 0xd5, 0x4e, 0x75,
-	0x9d, 0xeb, 0x30, 0xaf, 0x43, 0x1a, 0x96, 0x8b, 0x79, 0x62, 0xc2, 0x15, 0x42, 0x7c, 0x58, 0x2a,
-	0xd7, 0xc1, 0x74, 0x7c, 0xd2, 0xd3, 0x77, 0x71, 0xa2, 0xe6, 0xd6, 0x6e, 0xe3, 0xee, 0x3d, 0x3f,
-	0xac, 0xfa, 0xdc, 0xe8, 0xb0, 0x6a, 0xca, 0x05, 0xac, 0x68, 0x89, 0xb7, 0xd6, 0xcf, 0x73, 0x90,
-	0xdd, 0x72, 0xfb, 0x5c, 0xd0, 0xe0, 0xac, 0x83, 0xa4, 0xd5, 0x4e, 0x05, 0x69, 0x0b, 0xb2, 0x01,
-	0x63, 0xa2, 0x6d, 0x91, 0xe3, 0xe2, 0x83, 0x19, 0x13, 0x5b, 0x8d, 0x66, 0x51, 0x12, 0x65, 0xe3,
-	0x0d, 0xe7, 0x38, 0x23, 0xa9, 0x5b, 0x04, 0x3d, 0x82, 0xe5, 0xe8, 0xba, 0xda, 0x63, 0x4c, 0x70,
-	0x11, 0x10, 0xbf, 0xdd, 0xa5, 0x43, 0xf9, 0x90, 0x49, 0xcf, 0x7a, 0xb8, 0xee, 0x78, 0x56, 0x30,
-	0x54, 0xc1, 0xbb, 0x43, 0x87, 0x78, 0x49, 0x0b, 0x68, 0x46, 0xfc, 0x3b, 0x74, 0xc8, 0xd1, 0x0d,
-	0x58, 0xa1, 0x63, 0x98, 0x94, 0xd8, 0x76, 0x49, 0x4f, 0x5e, 0xc4, 0x6d, 0xcb, 0x65, 0x56, 0x57,
-	0xdd, 0x05, 0x26, 0xbe, 0x40, 0xe3, 0xa2, 0xbe, 0x08, 0x11, 0x5b, 0x12, 0x80, 0x38, 0x94, 0xf6,
-	0x5c, 0x62, 0x75, 0x5d, 0x87, 0xcb, 0x6f, 0x93, 0xd8, 0x5b, 0x54, 0xb6, 0x73, 0x69, 0xdb, 0xc6,
-	0x31, 0xd1, 0xaa, 0x37, 0x27, 0xdc, 0xd8, 0xcb, 0x56, 0x57, 0xd4, 0x5b, 0x7b, 0xc9, 0xbb, 0xa8,
-	0x09, 0x85, 0xbe, 0x27, 0xd5, 0x87, 0x31, 0xc8, 0x9f, 0x36, 0x06, 0x10, 0xb2, 0xa4, 0xe7, 0xe5,
-	0x01, 0xac, 0x1c, 0xa7, 0x3c, 0xa1, 0x36, 0x6f, 0xc6, 0x6b, 0xb3, 0xb0, 0xfe, 0x41, 0x92, 0xbe,
-	0x64, 0x91, 0xb1, 0x3a, 0x4e, 0x4c, 0xdb, 0x5f, 0x0d, 0xc8, 0xdc, 0xa7, 0x56, 0x40, 0xc5, 0x6b,
-	0xcd, 0xda, 0x8d, 0x23, 0x59, 0x5b, 0x49, 0x7e, 0xa5, 0x4a, 0xad, 0x53, 0x49, 0x5b, 0x86, 0x9c,
-	0xe3, 0x09, 0x1a, 0x78, 0xc4, 0x55, 0x59, 0x9b, 0xc3, 0xe3, 0x79, 0xa2, 0x03, 0xcf, 0x0c, 0xc8,
-	0x84, 0xcf, 0xb8, 0xb3, 0x76, 0x20, 0xd4, 0xfa, 0xb2, 0x03, 0x89, 0x46, 0xfe, 0x6d, 0x40, 0x0e,
-	0x53, 0xce, 0xfa, 0xc1, 0x6b, 0xfe, 0xa4, 0x79, 0xe9, 0x59, 0x94, 0xfe, 0xcf, 0xcf, 0x22, 0x04,
-	0x66, 0xd7, 0xf1, 0xf4, 0x03, 0x0e, 0xab, 0x31, 0xaa, 0x43, 0xd6, 0x27, 0x43, 0x97, 0x11, 0x5b,
-	0x37, 0xca, 0xa5, 0xa9, 0xaf, 0xfe, 0x86, 0x37, 0xc4, 0x11, 0x68, 0x73, 0x69, 0xff, 0xa0, 0xb6,
-	0x08, 0xc5, 0xb8, 0xe7, 0x4f, 0x8c, 0xda, 0x1f, 0x06, 0xe4, 0x77, 0xbe, 0x13, 0xd4, 0x53, 0x5f,
-	0x10, 0xff, 0x4b, 0xe7, 0x57, 0xa7, 0xff, 0x19, 0xc8, 0x1f, 0xf9, 0xe8, 0x4f, 0x3a, 0xd4, 0x66,
-	0xe9, 0xf9, 0x8b, 0xca, 0xb9, 0x3f, 0x5f, 0x54, 0xce, 0x7d, 0x3f, 0xaa, 0x18, 0xcf, 0x47, 0x15,
-	0xe3, 0xf7, 0x51, 0xc5, 0xf8, 0x6b, 0x54, 0x31, 0xf6, 0x32, 0x2a, 0x3e, 0x1f, 0xfd, 0x1b, 0x00,
-	0x00, 0xff, 0xff, 0x1b, 0x47, 0x17, 0xba, 0x5f, 0x12, 0x00, 0x00,
+	// 1491 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x58, 0xcf, 0x6f, 0x1b, 0x4f,
+	0x15, 0xef, 0xda, 0x1b, 0xff, 0x78, 0x4e, 0x4c, 0x98, 0x86, 0xb0, 0x35, 0xc1, 0x0e, 0xae, 0x40,
+	0x15, 0xaa, 0x9c, 0x12, 0x0a, 0x4a, 0x03, 0xa5, 0xb5, 0x93, 0xa8, 0xb5, 0x4a, 0x69, 0x34, 0x2d,
+	0x2d, 0xb7, 0x65, 0xb2, 0x3b, 0x75, 0x17, 0xaf, 0x77, 0x56, 0x3b, 0x63, 0x17, 0xdf, 0x38, 0x87,
+	0x3f, 0x20, 0x37, 0x0e, 0xfd, 0x17, 0xe0, 0xc2, 0x85, 0x03, 0xa7, 0x1e, 0x39, 0x21, 0x4e, 0x11,
+	0xf5, 0x7f, 0x81, 0xc4, 0xe1, 0xab, 0x99, 0x9d, 0xb5, 0x37, 0xf1, 0x3a, 0x49, 0xbf, 0xaa, 0xa2,
+	0xef, 0x29, 0x33, 0x3b, 0x9f, 0xcf, 0x9b, 0xf7, 0xde, 0xbc, 0x5f, 0x31, 0xac, 0xb0, 0xa3, 0x3f,
+	0x50, 0x47, 0xf0, 0x56, 0x18, 0x31, 0xc1, 0x10, 0x72, 0x99, 0xd3, 0xa7, 0x51, 0x8b, 0xbf, 0x27,
+	0xd1, 0xa0, 0xef, 0x89, 0xd6, 0xe8, 0x27, 0xb5, 0x8a, 0x18, 0x87, 0x54, 0x03, 0x6a, 0x15, 0x1e,
+	0x52, 0x27, 0xd9, 0x34, 0x7a, 0x8c, 0xf5, 0x7c, 0xba, 0xa5, 0x76, 0x47, 0xc3, 0xb7, 0x5b, 0xc2,
+	0x1b, 0x50, 0x2e, 0xc8, 0x20, 0xd4, 0x80, 0xb5, 0x1e, 0xeb, 0x31, 0xb5, 0xdc, 0x92, 0x2b, 0xfd,
+	0xf5, 0xd6, 0x79, 0x1a, 0x09, 0xc6, 0xfa, 0xe8, 0x66, 0xe8, 0x0f, 0x7b, 0x5e, 0xb0, 0x15, 0xff,
+	0x89, 0x3f, 0x36, 0xff, 0x6e, 0x80, 0xf9, 0x9c, 0x0a, 0x82, 0x7e, 0x01, 0xc5, 0x11, 0x8d, 0xb8,
+	0xc7, 0x02, 0xcb, 0xd8, 0x34, 0xee, 0x54, 0xb6, 0xbf, 0xd7, 0x9a, 0xd7, 0xb7, 0xf5, 0x3a, 0x86,
+	0x74, 0xcc, 0x8f, 0xa7, 0x8d, 0x1b, 0x38, 0x61, 0xa0, 0x07, 0x00, 0x4e, 0x44, 0x89, 0xa0, 0xae,
+	0x4d, 0x84, 0x95, 0x53, 0xfc, 0x5a, 0x2b, 0x56, 0xa5, 0x95, 0xa8, 0xd2, 0x7a, 0x95, 0x58, 0x80,
+	0xcb, 0x1a, 0xdd, 0x16, 0x92, 0x3a, 0x0c, 0xdd, 0x84, 0x9a, 0xbf, 0x9c, 0xaa, 0xd1, 0x6d, 0xd1,
+	0xfc, 0xab, 0x09, 0xe6, 0x6f, 0x98, 0x4b, 0xd1, 0x3a, 0xe4, 0x3c, 0x57, 0xa9, 0x5d, 0xee, 0x14,
+	0x26, 0xa7, 0x8d, 0x5c, 0x77, 0x1f, 0xe7, 0x3c, 0x17, 0x6d, 0x83, 0x39, 0xa0, 0x82, 0x68, 0x85,
+	0xac, 0x2c, 0x83, 0xa4, 0xed, 0xda, 0x1a, 0x85, 0x45, 0x3f, 0x07, 0x53, 0x3e, 0x83, 0xd6, 0x64,
+	0x23, 0x8b, 0x23, 0xef, 0x7c, 0x19, 0x52, 0x27, 0xe1, 0x49, 0x3c, 0x3a, 0x80, 0x8a, 0x4b, 0xb9,
+	0x13, 0x79, 0xa1, 0x90, 0x3e, 0x34, 0x15, 0xfd, 0xf6, 0x22, 0xfa, 0xfe, 0x0c, 0x8a, 0xd3, 0x3c,
+	0xf4, 0x4b, 0x28, 0x70, 0x41, 0xc4, 0x90, 0x5b, 0x4b, 0x4a, 0x42, 0x7d, 0xa1, 0x02, 0x0a, 0xa5,
+	0x55, 0xd0, 0x1c, 0xf4, 0x14, 0xaa, 0x03, 0x12, 0x90, 0x1e, 0x8d, 0x6c, 0x2d, 0xa5, 0xa0, 0xa4,
+	0xfc, 0x20, 0xd3, 0xf4, 0x18, 0x19, 0x0b, 0xc2, 0x2b, 0x83, 0xf4, 0x16, 0x1d, 0x00, 0x10, 0x21,
+	0x88, 0xf3, 0x6e, 0x40, 0x03, 0x61, 0x15, 0x95, 0x94, 0x1f, 0x66, 0xea, 0x42, 0xc5, 0x7b, 0x16,
+	0xf5, 0xdb, 0x53, 0x30, 0x4e, 0x11, 0xd1, 0x13, 0xa8, 0x38, 0x34, 0x12, 0xde, 0x5b, 0xcf, 0x21,
+	0x82, 0x5a, 0x25, 0x25, 0xa7, 0x91, 0x25, 0x67, 0x6f, 0x06, 0xd3, 0x46, 0xa5, 0x99, 0xe8, 0x1e,
+	0x98, 0x11, 0xf3, 0xa9, 0x55, 0xde, 0x34, 0xee, 0x54, 0x17, 0x3f, 0x0b, 0x66, 0x3e, 0xc5, 0x0a,
+	0xb9, 0xbb, 0x7e, 0x7c, 0xd2, 0x44, 0xb0, 0x5a, 0x32, 0x56, 0x0d, 0x15, 0x1a, 0xc6, 0x3d, 0xe3,
+	0x77, 0xc6, 0xef, 0x8d, 0xe6, 0xff, 0xf3, 0x50, 0x7c, 0x49, 0xa3, 0x91, 0xe7, 0x7c, 0xd9, 0xc0,
+	0x79, 0x70, 0x26, 0x70, 0x32, 0x6d, 0xd4, 0xd7, 0xce, 0xc5, 0xce, 0x0e, 0x94, 0x68, 0xe0, 0x86,
+	0xcc, 0x0b, 0x84, 0x0e, 0x9c, 0x4c, 0x03, 0x0f, 0x34, 0x06, 0x4f, 0xd1, 0xe8, 0x00, 0x56, 0xe2,
+	0x7c, 0xb0, 0xcf, 0x44, 0xcd, 0x66, 0x16, 0xfd, 0xb7, 0x0a, 0xa8, 0x9f, 0x7b, 0x79, 0x98, 0xda,
+	0xa1, 0x7d, 0x58, 0x09, 0x23, 0x3a, 0xf2, 0xd8, 0x90, 0xdb, 0xca, 0x88, 0xc2, 0x95, 0x8c, 0xc0,
+	0xcb, 0x09, 0x4b, 0xee, 0xd0, 0xaf, 0x60, 0x59, 0x92, 0xed, 0xa4, 0x8e, 0xc0, 0xa5, 0x75, 0x04,
+	0xab, 0x92, 0xa7, 0x37, 0xe8, 0x05, 0x7c, 0xe7, 0x8c, 0x16, 0x53, 0x41, 0x95, 0xcb, 0x05, 0xdd,
+	0x4c, 0x6b, 0xa2, 0x3f, 0xee, 0xa2, 0xe3, 0x93, 0x66, 0x15, 0x96, 0xd3, 0x21, 0xd0, 0xfc, 0x4b,
+	0x0e, 0x4a, 0x89, 0x23, 0xd1, 0x7d, 0xfd, 0x66, 0xc6, 0x62, 0xaf, 0x25, 0x58, 0x65, 0x6f, 0xfc,
+	0x5c, 0xf7, 0x61, 0x29, 0x64, 0x91, 0xe0, 0x56, 0x6e, 0x33, 0xbf, 0x28, 0x45, 0x0f, 0x59, 0x24,
+	0xf6, 0x58, 0xf0, 0xd6, 0xeb, 0xe1, 0x18, 0x8c, 0xde, 0x40, 0x65, 0xe4, 0x45, 0x62, 0x48, 0x7c,
+	0xdb, 0x0b, 0xb9, 0x95, 0x57, 0xdc, 0x1f, 0x5d, 0x74, 0x65, 0xeb, 0x75, 0x8c, 0xef, 0x1e, 0x76,
+	0xaa, 0x93, 0xd3, 0x06, 0x4c, 0xb7, 0x1c, 0x83, 0x16, 0xd5, 0x0d, 0x79, 0xed, 0x39, 0x94, 0xa7,
+	0x27, 0xe8, 0x2e, 0x40, 0x10, 0x67, 0xa4, 0x3d, 0x8d, 0xec, 0x95, 0xc9, 0x69, 0xa3, 0xac, 0xf3,
+	0xb4, 0xbb, 0x8f, 0xcb, 0x1a, 0xd0, 0x75, 0x11, 0x02, 0x93, 0xb8, 0x6e, 0xa4, 0xe2, 0xbc, 0x8c,
+	0xd5, 0xba, 0xf9, 0xe7, 0x22, 0x98, 0xaf, 0x08, 0xef, 0x5f, 0x77, 0x55, 0x95, 0x77, 0xce, 0x65,
+	0xc6, 0x5d, 0x00, 0x1e, 0xc7, 0x9b, 0x34, 0xc7, 0x9c, 0x99, 0xa3, 0xa3, 0x50, 0x9a, 0xa3, 0x01,
+	0xb1, 0x39, 0xdc, 0x67, 0x42, 0x25, 0x81, 0x89, 0xd5, 0x1a, 0xdd, 0x86, 0x62, 0xc0, 0x5c, 0x45,
+	0x2f, 0x28, 0x3a, 0x4c, 0x4e, 0x1b, 0x05, 0x59, 0x2b, 0xba, 0xfb, 0xb8, 0x20, 0x8f, 0xba, 0xae,
+	0x2c, 0x53, 0x24, 0x08, 0x98, 0x20, 0xb2, 0x06, 0x73, 0x5d, 0xee, 0x32, 0xa3, 0xbf, 0x3d, 0x83,
+	0x25, 0x65, 0x2a, 0xc5, 0x44, 0xaf, 0xe1, 0x66, 0xa2, 0x6f, 0x5a, 0x60, 0xe9, 0x73, 0x04, 0x22,
+	0x2d, 0x21, 0x75, 0x92, 0x6a, 0x0b, 0xe5, 0xc5, 0x6d, 0x41, 0x79, 0x30, 0xab, 0x2d, 0x74, 0x60,
+	0xc5, 0xa5, 0xdc, 0x8b, 0xa8, 0xab, 0xca, 0x04, 0x55, 0x99, 0x59, 0xdd, 0xfe, 0xfe, 0x45, 0x42,
+	0x28, 0x5e, 0xd6, 0x1c, 0xb5, 0x43, 0x6d, 0x28, 0xe9, 0xb8, 0xe1, 0x56, 0x45, 0xc5, 0xee, 0x15,
+	0xdb, 0xc1, 0x94, 0x76, 0xa6, 0xcc, 0x2d, 0x7f, 0x56, 0x99, 0x7b, 0x00, 0xe0, 0xb3, 0x9e, 0xed,
+	0x46, 0xde, 0x88, 0x46, 0xd6, 0x8a, 0x1e, 0x12, 0x32, 0xb8, 0xfb, 0x0a, 0x81, 0xcb, 0x3e, 0xeb,
+	0xc5, 0xcb, 0xb9, 0xa2, 0x54, 0xfd, 0xcc, 0xa2, 0x44, 0xa0, 0x46, 0x38, 0xf7, 0x7a, 0x01, 0x75,
+	0xed, 0x1e, 0x0d, 0x68, 0xe4, 0x39, 0x76, 0x44, 0x39, 0x1b, 0x46, 0x0e, 0xe5, 0xd6, 0xb7, 0x94,
+	0x27, 0x32, 0xdb, 0xfc, 0x93, 0x18, 0x8c, 0x35, 0x16, 0x5b, 0x89, 0x98, 0x73, 0x07, 0x7c, 0xb7,
+	0x76, 0x7c, 0xd2, 0x5c, 0x87, 0xb5, 0x74, 0x99, 0xda, 0x31, 0x1e, 0x1b, 0x4f, 0x8d, 0x43, 0xa3,
+	0xf9, 0xcf, 0x1c, 0x7c, 0x7b, 0xce, 0xa7, 0xe8, 0x67, 0x50, 0xd4, 0x5e, 0xbd, 0x68, 0x58, 0xd3,
+	0x3c, 0x9c, 0x60, 0xd1, 0x06, 0x94, 0x65, 0x8a, 0x53, 0xce, 0x69, 0x5c, 0xbc, 0xca, 0x78, 0xf6,
+	0x01, 0x59, 0x50, 0x24, 0xbe, 0x47, 0xe4, 0x59, 0x5e, 0x9d, 0x25, 0x5b, 0x34, 0x84, 0xf5, 0xd8,
+	0xf5, 0xf6, 0xac, 0xb5, 0xdb, 0x2c, 0x14, 0xdc, 0x32, 0x95, 0xfd, 0x8f, 0xae, 0x14, 0x09, 0xfa,
+	0x71, 0x66, 0x1f, 0x5e, 0x84, 0x82, 0x1f, 0x04, 0x22, 0x1a, 0xe3, 0x35, 0x37, 0xe3, 0xa8, 0xf6,
+	0x04, 0x6e, 0x2d, 0xa4, 0xa0, 0x55, 0xc8, 0xf7, 0xe9, 0x38, 0x2e, 0x4f, 0x58, 0x2e, 0xd1, 0x1a,
+	0x2c, 0x8d, 0x88, 0x3f, 0xa4, 0xba, 0x9a, 0xc5, 0x9b, 0xdd, 0xdc, 0x8e, 0xd1, 0xfc, 0x90, 0x83,
+	0xa2, 0x56, 0xe7, 0xba, 0x5b, 0xbe, 0xbe, 0x76, 0xae, 0xb0, 0x3d, 0x84, 0x65, 0xed, 0xd2, 0x38,
+	0x23, 0xcd, 0x4b, 0x63, 0xba, 0x12, 0xe3, 0xe3, 0x6c, 0x7c, 0x08, 0xa6, 0x17, 0x92, 0x81, 0x6e,
+	0xf7, 0x99, 0x37, 0x77, 0x0f, 0xdb, 0xcf, 0x5f, 0x84, 0x71, 0x61, 0x29, 0x4d, 0x4e, 0x1b, 0xa6,
+	0xfc, 0x80, 0x15, 0x2d, 0xb3, 0x31, 0xfe, 0x6d, 0x09, 0x8a, 0x7b, 0xfe, 0x90, 0x0b, 0x1a, 0x5d,
+	0xb7, 0x93, 0xf4, 0xb5, 0x73, 0x4e, 0xda, 0x83, 0x62, 0xc4, 0x98, 0xb0, 0x1d, 0x72, 0x91, 0x7f,
+	0x30, 0x63, 0x62, 0xaf, 0xdd, 0xa9, 0x4a, 0xa2, 0xac, 0xed, 0xf1, 0x1e, 0x17, 0x24, 0x75, 0x8f,
+	0xa0, 0x37, 0xb0, 0x9e, 0x74, 0xc4, 0x23, 0xc6, 0x04, 0x17, 0x11, 0x09, 0xed, 0x3e, 0x1d, 0xcb,
+	0x59, 0x29, 0xbf, 0x68, 0x36, 0x3e, 0x08, 0x9c, 0x68, 0xac, 0x9c, 0xf7, 0x8c, 0x8e, 0xf1, 0x9a,
+	0x16, 0xd0, 0x49, 0xf8, 0xcf, 0xe8, 0x98, 0xa3, 0x47, 0xb0, 0x41, 0xa7, 0x30, 0x29, 0xd1, 0xf6,
+	0xc9, 0x40, 0xf6, 0x7a, 0xdb, 0xf1, 0x99, 0xd3, 0x57, 0xed, 0xc6, 0xc4, 0xb7, 0x68, 0x5a, 0xd4,
+	0xaf, 0x63, 0xc4, 0x9e, 0x04, 0x20, 0x0e, 0xd6, 0x91, 0x4f, 0x9c, 0xbe, 0xef, 0x71, 0xf9, 0xef,
+	0x4f, 0x6a, 0xdc, 0x95, 0x1d, 0x43, 0xea, 0xb6, 0x73, 0x81, 0xb7, 0x5a, 0x9d, 0x19, 0x37, 0x35,
+	0x3c, 0xeb, 0x8c, 0xfa, 0xee, 0x51, 0xf6, 0x29, 0xea, 0x40, 0x65, 0x18, 0xc8, 0xeb, 0x63, 0x1f,
+	0x94, 0xaf, 0xea, 0x03, 0x88, 0x59, 0xd2, 0xf2, 0xda, 0x08, 0x36, 0x2e, 0xba, 0x3c, 0x23, 0x37,
+	0x1f, 0xa7, 0x73, 0xb3, 0xb2, 0xfd, 0xe3, 0xac, 0xfb, 0xb2, 0x45, 0xa6, 0xf2, 0x38, 0x33, 0x6c,
+	0xff, 0x61, 0x40, 0xe1, 0x25, 0x75, 0x22, 0x2a, 0xbe, 0x68, 0xd4, 0xee, 0x9c, 0x89, 0xda, 0x7a,
+	0xf6, 0x20, 0x2c, 0x6f, 0x9d, 0x0b, 0xda, 0x1a, 0x94, 0xbc, 0x40, 0xd0, 0x28, 0x20, 0xbe, 0x8a,
+	0xda, 0x12, 0x9e, 0xee, 0x33, 0x0d, 0xf8, 0x60, 0x40, 0x21, 0x9e, 0x14, 0xaf, 0xdb, 0x80, 0xf8,
+	0xd6, 0xf3, 0x06, 0x64, 0x2a, 0xf9, 0x3f, 0x03, 0x4a, 0x49, 0xc3, 0xfa, 0xa2, 0x6a, 0x9e, 0x9b,
+	0xbc, 0xf2, 0x5f, 0x7b, 0xf2, 0x42, 0x60, 0xf6, 0xbd, 0x40, 0xcf, 0x88, 0x58, 0xad, 0x51, 0x0b,
+	0x8a, 0x21, 0x19, 0xfb, 0x8c, 0xb8, 0xba, 0x50, 0xae, 0xcd, 0xfd, 0xb0, 0xd0, 0x0e, 0xc6, 0x38,
+	0x01, 0xed, 0xae, 0x1d, 0x9f, 0x34, 0x57, 0xa1, 0x9a, 0xb6, 0xfc, 0x9d, 0xd1, 0xfc, 0xb7, 0x01,
+	0xe5, 0x83, 0x3f, 0x0a, 0x1a, 0xa8, 0x79, 0xe0, 0x1b, 0x69, 0xfc, 0xe6, 0xfc, 0x8f, 0x0f, 0xe5,
+	0x33, 0xbf, 0x2b, 0x64, 0x3d, 0x6a, 0xc7, 0xfa, 0xf8, 0xa9, 0x7e, 0xe3, 0x3f, 0x9f, 0xea, 0x37,
+	0xfe, 0x34, 0xa9, 0x1b, 0x1f, 0x27, 0x75, 0xe3, 0x5f, 0x93, 0xba, 0xf1, 0xdf, 0x49, 0xdd, 0x38,
+	0x2a, 0x28, 0xff, 0xfc, 0xf4, 0xab, 0x00, 0x00, 0x00, 0xff, 0xff, 0xe4, 0x48, 0xcb, 0x39, 0xc2,
+	0x12, 0x00, 0x00,
 }
diff --git a/components/engine/vendor/github.com/docker/swarmkit/api/objects.proto b/components/engine/vendor/github.com/docker/swarmkit/api/objects.proto
index 5f7cf26b7f..311c1f2fb6 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/api/objects.proto
+++ b/components/engine/vendor/github.com/docker/swarmkit/api/objects.proto
@@ -239,6 +239,8 @@ message Task {
 	//
 	// If not present, the daemon's default will be used.
 	Driver log_driver = 13;
+
+	repeated GenericResource assigned_generic_resources = 15;
 }
 
 // NetworkAttachment specifies the network parameters of attachment to
diff --git a/components/engine/vendor/github.com/docker/swarmkit/api/specs.pb.go b/components/engine/vendor/github.com/docker/swarmkit/api/specs.pb.go
index 39b0c0abf0..8578cf3849 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/api/specs.pb.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/api/specs.pb.go
@@ -760,6 +760,12 @@ type SecretSpec struct {
 	Annotations Annotations `protobuf:"bytes,1,opt,name=annotations" json:"annotations"`
 	// Data is the secret payload - the maximum size is 500KB (that is, 500*1024 bytes)
 	Data []byte `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"`
+	// Templating controls whether and how to evaluate the secret payload as
+	// a template. If it is not set, no templating is used.
+	//
+	// The currently recognized values are:
+	// - golang: Go templating
+	Templating *Driver `protobuf:"bytes,3,opt,name=templating" json:"templating,omitempty"`
 }
 
 func (m *SecretSpec) Reset()                    { *m = SecretSpec{} }
@@ -773,6 +779,12 @@ type ConfigSpec struct {
 	// TODO(aaronl): Do we want to revise this to include multiple payloads in a single
 	// ConfigSpec? Define this to be a tar? etc...
 	Data []byte `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"`
+	// Templating controls whether and how to evaluate the secret payload as
+	// a template. If it is not set, no templating is used.
+	//
+	// The currently recognized values are:
+	// - golang: Go templating
+	Templating *Driver `protobuf:"bytes,3,opt,name=templating" json:"templating,omitempty"`
 }
 
 func (m *ConfigSpec) Reset()                    { *m = ConfigSpec{} }
@@ -1224,6 +1236,10 @@ func (m *SecretSpec) CopyFrom(src interface{}) {
 		m.Data = make([]byte, len(o.Data))
 		copy(m.Data, o.Data)
 	}
+	if o.Templating != nil {
+		m.Templating = &Driver{}
+		github_com_docker_swarmkit_api_deepcopy.Copy(m.Templating, o.Templating)
+	}
 }
 
 func (m *ConfigSpec) Copy() *ConfigSpec {
@@ -1244,6 +1260,10 @@ func (m *ConfigSpec) CopyFrom(src interface{}) {
 		m.Data = make([]byte, len(o.Data))
 		copy(m.Data, o.Data)
 	}
+	if o.Templating != nil {
+		m.Templating = &Driver{}
+		github_com_docker_swarmkit_api_deepcopy.Copy(m.Templating, o.Templating)
+	}
 }
 
 func (m *NodeSpec) Marshal() (dAtA []byte, err error) {
@@ -2227,6 +2247,16 @@ func (m *SecretSpec) MarshalTo(dAtA []byte) (int, error) {
 		i = encodeVarintSpecs(dAtA, i, uint64(len(m.Data)))
 		i += copy(dAtA[i:], m.Data)
 	}
+	if m.Templating != nil {
+		dAtA[i] = 0x1a
+		i++
+		i = encodeVarintSpecs(dAtA, i, uint64(m.Templating.Size()))
+		n37, err := m.Templating.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n37
+	}
 	return i, nil
 }
 
@@ -2248,17 +2278,27 @@ func (m *ConfigSpec) MarshalTo(dAtA []byte) (int, error) {
 	dAtA[i] = 0xa
 	i++
 	i = encodeVarintSpecs(dAtA, i, uint64(m.Annotations.Size()))
-	n37, err := m.Annotations.MarshalTo(dAtA[i:])
+	n38, err := m.Annotations.MarshalTo(dAtA[i:])
 	if err != nil {
 		return 0, err
 	}
-	i += n37
+	i += n38
 	if len(m.Data) > 0 {
 		dAtA[i] = 0x12
 		i++
 		i = encodeVarintSpecs(dAtA, i, uint64(len(m.Data)))
 		i += copy(dAtA[i:], m.Data)
 	}
+	if m.Templating != nil {
+		dAtA[i] = 0x1a
+		i++
+		i = encodeVarintSpecs(dAtA, i, uint64(m.Templating.Size()))
+		n39, err := m.Templating.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n39
+	}
 	return i, nil
 }
 
@@ -2685,6 +2725,10 @@ func (m *SecretSpec) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovSpecs(uint64(l))
 	}
+	if m.Templating != nil {
+		l = m.Templating.Size()
+		n += 1 + l + sovSpecs(uint64(l))
+	}
 	return n
 }
 
@@ -2697,6 +2741,10 @@ func (m *ConfigSpec) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovSpecs(uint64(l))
 	}
+	if m.Templating != nil {
+		l = m.Templating.Size()
+		n += 1 + l + sovSpecs(uint64(l))
+	}
 	return n
 }
 
@@ -2973,6 +3021,7 @@ func (this *SecretSpec) String() string {
 	s := strings.Join([]string{`&SecretSpec{`,
 		`Annotations:` + strings.Replace(strings.Replace(this.Annotations.String(), "Annotations", "Annotations", 1), `&`, ``, 1) + `,`,
 		`Data:` + fmt.Sprintf("%v", this.Data) + `,`,
+		`Templating:` + strings.Replace(fmt.Sprintf("%v", this.Templating), "Driver", "Driver", 1) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -2984,6 +3033,7 @@ func (this *ConfigSpec) String() string {
 	s := strings.Join([]string{`&ConfigSpec{`,
 		`Annotations:` + strings.Replace(strings.Replace(this.Annotations.String(), "Annotations", "Annotations", 1), `&`, ``, 1) + `,`,
 		`Data:` + fmt.Sprintf("%v", this.Data) + `,`,
+		`Templating:` + strings.Replace(fmt.Sprintf("%v", this.Templating), "Driver", "Driver", 1) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -5800,6 +5850,39 @@ func (m *SecretSpec) Unmarshal(dAtA []byte) error {
 				m.Data = []byte{}
 			}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Templating", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowSpecs
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthSpecs
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Templating == nil {
+				m.Templating = &Driver{}
+			}
+			if err := m.Templating.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipSpecs(dAtA[iNdEx:])
@@ -5911,6 +5994,39 @@ func (m *ConfigSpec) Unmarshal(dAtA []byte) error {
 				m.Data = []byte{}
 			}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Templating", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowSpecs
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthSpecs
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Templating == nil {
+				m.Templating = &Driver{}
+			}
+			if err := m.Templating.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipSpecs(dAtA[iNdEx:])
@@ -6040,121 +6156,122 @@ var (
 func init() { proto.RegisterFile("specs.proto", fileDescriptorSpecs) }
 
 var fileDescriptorSpecs = []byte{
-	// 1846 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x57, 0xcf, 0x73, 0x1b, 0x49,
-	0x15, 0xb6, 0x6c, 0x59, 0x3f, 0xde, 0xc8, 0x89, 0xd2, 0x24, 0x61, 0xac, 0xb0, 0xb2, 0xa2, 0x0d,
-	0xc1, 0xcb, 0x16, 0x72, 0x61, 0xa8, 0x25, 0x4b, 0x58, 0x40, 0xb2, 0x84, 0x63, 0x8c, 0x1d, 0x55,
-	0xdb, 0x1b, 0xc8, 0x49, 0xd5, 0x9e, 0x69, 0x4b, 0x53, 0x1e, 0x75, 0x0f, 0xdd, 0x3d, 0xda, 0xd2,
-	0x8d, 0xe3, 0x56, 0xae, 0x9c, 0x5d, 0x1c, 0xf8, 0x67, 0x72, 0xa4, 0x38, 0x71, 0x72, 0xb1, 0xfe,
-	0x17, 0xb8, 0x71, 0x81, 0xea, 0x9e, 0x1e, 0xfd, 0x48, 0xc6, 0x9b, 0x54, 0x11, 0x6e, 0xdd, 0xaf,
-	0xbf, 0xef, 0x75, 0xf7, 0xeb, 0xaf, 0xfb, 0xbd, 0x06, 0x47, 0x46, 0xd4, 0x93, 0xad, 0x48, 0x70,
-	0xc5, 0x11, 0xf2, 0xb9, 0x77, 0x41, 0x45, 0x4b, 0x7e, 0x45, 0xc4, 0xf8, 0x22, 0x50, 0xad, 0xc9,
-	0x8f, 0x6b, 0x8e, 0x9a, 0x46, 0xd4, 0x02, 0x6a, 0x77, 0x87, 0x7c, 0xc8, 0x4d, 0x73, 0x47, 0xb7,
-	0xac, 0xb5, 0x3e, 0xe4, 0x7c, 0x18, 0xd2, 0x1d, 0xd3, 0x3b, 0x8b, 0xcf, 0x77, 0xfc, 0x58, 0x10,
-	0x15, 0x70, 0x66, 0xc7, 0x37, 0xdf, 0x1c, 0x27, 0x6c, 0x9a, 0x0c, 0x35, 0x2f, 0xf3, 0x50, 0x3a,
-	0xe6, 0x3e, 0x3d, 0x89, 0xa8, 0x87, 0xf6, 0xc1, 0x21, 0x8c, 0x71, 0x65, 0xb8, 0xd2, 0xcd, 0x35,
-	0x72, 0xdb, 0xce, 0xee, 0x56, 0xeb, 0xed, 0x45, 0xb5, 0xda, 0x73, 0x58, 0x27, 0xff, 0xfa, 0x6a,
-	0x6b, 0x05, 0x2f, 0x32, 0xd1, 0xaf, 0xa0, 0xe2, 0x53, 0x19, 0x08, 0xea, 0x0f, 0x04, 0x0f, 0xa9,
-	0xbb, 0xda, 0xc8, 0x6d, 0xdf, 0xda, 0xfd, 0x5e, 0x96, 0x27, 0x3d, 0x39, 0xe6, 0x21, 0xc5, 0x8e,
-	0x65, 0xe8, 0x0e, 0xda, 0x07, 0x18, 0xd3, 0xf1, 0x19, 0x15, 0x72, 0x14, 0x44, 0xee, 0x9a, 0xa1,
-	0xff, 0xe0, 0x26, 0xba, 0x5e, 0x7b, 0xeb, 0x68, 0x06, 0xc7, 0x0b, 0x54, 0x74, 0x04, 0x15, 0x32,
-	0x21, 0x41, 0x48, 0xce, 0x82, 0x30, 0x50, 0x53, 0x37, 0x6f, 0x5c, 0x7d, 0xf2, 0xad, 0xae, 0xda,
-	0x0b, 0x04, 0xbc, 0x44, 0x6f, 0xfa, 0x00, 0xf3, 0x89, 0xd0, 0x63, 0x28, 0xf6, 0x7b, 0xc7, 0xdd,
-	0x83, 0xe3, 0xfd, 0xea, 0x4a, 0x6d, 0xf3, 0xd5, 0x65, 0xe3, 0x9e, 0xf6, 0x31, 0x07, 0xf4, 0x29,
-	0xf3, 0x03, 0x36, 0x44, 0xdb, 0x50, 0x6a, 0xef, 0xed, 0xf5, 0xfa, 0xa7, 0xbd, 0x6e, 0x35, 0x57,
-	0xab, 0xbd, 0xba, 0x6c, 0xdc, 0x5f, 0x06, 0xb6, 0x3d, 0x8f, 0x46, 0x8a, 0xfa, 0xb5, 0xfc, 0xd7,
-	0x7f, 0xad, 0xaf, 0x34, 0xbf, 0xce, 0x41, 0x65, 0x71, 0x11, 0xe8, 0x31, 0x14, 0xda, 0x7b, 0xa7,
-	0x07, 0x2f, 0x7a, 0xd5, 0x95, 0x39, 0x7d, 0x11, 0xd1, 0xf6, 0x54, 0x30, 0xa1, 0xe8, 0x11, 0xac,
-	0xf7, 0xdb, 0x5f, 0x9e, 0xf4, 0xaa, 0xb9, 0xf9, 0x72, 0x16, 0x61, 0x7d, 0x12, 0x4b, 0x83, 0xea,
-	0xe2, 0xf6, 0xc1, 0x71, 0x75, 0x35, 0x1b, 0xd5, 0x15, 0x24, 0x60, 0x76, 0x29, 0x7f, 0xc9, 0x83,
-	0x73, 0x42, 0xc5, 0x24, 0xf0, 0x3e, 0xb0, 0x44, 0x3e, 0x83, 0xbc, 0x22, 0xf2, 0xc2, 0x48, 0xc3,
-	0xc9, 0x96, 0xc6, 0x29, 0x91, 0x17, 0x7a, 0x52, 0x4b, 0x37, 0x78, 0xad, 0x0c, 0x41, 0xa3, 0x30,
-	0xf0, 0x88, 0xa2, 0xbe, 0x51, 0x86, 0xb3, 0xfb, 0xfd, 0x2c, 0x36, 0x9e, 0xa1, 0xec, 0xfa, 0x9f,
-	0xad, 0xe0, 0x05, 0x2a, 0x7a, 0x0a, 0x85, 0x61, 0xc8, 0xcf, 0x48, 0x68, 0x34, 0xe1, 0xec, 0x3e,
-	0xcc, 0x72, 0xb2, 0x6f, 0x10, 0x73, 0x07, 0x96, 0x82, 0x9e, 0x40, 0x21, 0x8e, 0x7c, 0xa2, 0xa8,
-	0x5b, 0x30, 0xe4, 0x46, 0x16, 0xf9, 0x4b, 0x83, 0xd8, 0xe3, 0xec, 0x3c, 0x18, 0x62, 0x8b, 0x47,
-	0x87, 0x50, 0x62, 0x54, 0x7d, 0xc5, 0xc5, 0x85, 0x74, 0x8b, 0x8d, 0xb5, 0x6d, 0x67, 0xf7, 0xd3,
-	0x4c, 0x31, 0x26, 0x98, 0xb6, 0x52, 0xc4, 0x1b, 0x8d, 0x29, 0x53, 0x89, 0x9b, 0xce, 0xaa, 0x9b,
-	0xc3, 0x33, 0x07, 0xe8, 0x17, 0x50, 0xa2, 0xcc, 0x8f, 0x78, 0xc0, 0x94, 0x5b, 0xba, 0x79, 0x21,
-	0x3d, 0x8b, 0xd1, 0xc1, 0xc4, 0x33, 0x86, 0x66, 0x0b, 0x1e, 0x86, 0x67, 0xc4, 0xbb, 0x70, 0xcb,
-	0xef, 0xb9, 0x8d, 0x19, 0xa3, 0x53, 0x80, 0xfc, 0x98, 0xfb, 0xb4, 0xb9, 0x03, 0x77, 0xde, 0x0a,
-	0x35, 0xaa, 0x41, 0xc9, 0x86, 0x3a, 0xd1, 0x48, 0x1e, 0xcf, 0xfa, 0xcd, 0xdb, 0xb0, 0xb1, 0x14,
-	0xd6, 0xe6, 0xdf, 0xf3, 0x50, 0x4a, 0xcf, 0x1a, 0xb5, 0xa1, 0xec, 0x71, 0xa6, 0x48, 0xc0, 0xa8,
-	0xb0, 0xf2, 0xca, 0x3c, 0x99, 0xbd, 0x14, 0xa4, 0x59, 0xcf, 0x56, 0xf0, 0x9c, 0x85, 0x7e, 0x03,
-	0x65, 0x41, 0x25, 0x8f, 0x85, 0x47, 0xa5, 0xd5, 0xd7, 0x76, 0xb6, 0x42, 0x12, 0x10, 0xa6, 0x7f,
-	0x8c, 0x03, 0x41, 0x75, 0x94, 0x25, 0x9e, 0x53, 0xd1, 0x53, 0x28, 0x0a, 0x2a, 0x15, 0x11, 0xea,
-	0xdb, 0x24, 0x82, 0x13, 0x48, 0x9f, 0x87, 0x81, 0x37, 0xc5, 0x29, 0x03, 0x3d, 0x85, 0x72, 0x14,
-	0x12, 0xcf, 0x78, 0x75, 0xd7, 0x0d, 0xfd, 0xa3, 0x2c, 0x7a, 0x3f, 0x05, 0xe1, 0x39, 0x1e, 0x7d,
-	0x0e, 0x10, 0xf2, 0xe1, 0xc0, 0x17, 0xc1, 0x84, 0x0a, 0x2b, 0xb1, 0x5a, 0x16, 0xbb, 0x6b, 0x10,
-	0xb8, 0x1c, 0xf2, 0x61, 0xd2, 0x44, 0xfb, 0xff, 0x93, 0xbe, 0x16, 0xb4, 0x75, 0x08, 0x40, 0x66,
-	0xa3, 0x56, 0x5d, 0x9f, 0xbc, 0x97, 0x2b, 0x7b, 0x22, 0x0b, 0x74, 0xf4, 0x10, 0x2a, 0xe7, 0x5c,
-	0x78, 0x74, 0x60, 0x6f, 0x4d, 0xd9, 0x68, 0xc2, 0x31, 0xb6, 0x44, 0x5f, 0xa8, 0x03, 0xc5, 0x21,
-	0x65, 0x54, 0x04, 0x9e, 0x0b, 0x66, 0xb2, 0xc7, 0x99, 0x17, 0x32, 0x81, 0xe0, 0x98, 0xa9, 0x60,
-	0x4c, 0xed, 0x4c, 0x29, 0xb1, 0x53, 0x86, 0xa2, 0x48, 0x46, 0x9a, 0x7f, 0x00, 0xf4, 0x36, 0x16,
-	0x21, 0xc8, 0x5f, 0x04, 0xcc, 0x37, 0xc2, 0x2a, 0x63, 0xd3, 0x46, 0x2d, 0x28, 0x46, 0x64, 0x1a,
-	0x72, 0xe2, 0x5b, 0xb1, 0xdc, 0x6d, 0x25, 0xf9, 0xb2, 0x95, 0xe6, 0xcb, 0x56, 0x9b, 0x4d, 0x71,
-	0x0a, 0x6a, 0x1e, 0xc2, 0xbd, 0xcc, 0x2d, 0xa3, 0x5d, 0xa8, 0xcc, 0x44, 0x38, 0x08, 0xec, 0x24,
-	0x9d, 0xdb, 0xd7, 0x57, 0x5b, 0xce, 0x4c, 0xad, 0x07, 0x5d, 0xec, 0xcc, 0x40, 0x07, 0x7e, 0xf3,
-	0xcf, 0x65, 0xd8, 0x58, 0x92, 0x32, 0xba, 0x0b, 0xeb, 0xc1, 0x98, 0x0c, 0xa9, 0x5d, 0x63, 0xd2,
-	0x41, 0x3d, 0x28, 0x84, 0xe4, 0x8c, 0x86, 0x5a, 0xd0, 0xfa, 0x50, 0x7f, 0xf4, 0xce, 0x3b, 0xd1,
-	0xfa, 0x9d, 0xc1, 0xf7, 0x98, 0x12, 0x53, 0x6c, 0xc9, 0xc8, 0x85, 0xa2, 0xc7, 0xc7, 0x63, 0xc2,
-	0xf4, 0xd3, 0xb9, 0xb6, 0x5d, 0xc6, 0x69, 0x57, 0x47, 0x86, 0x88, 0xa1, 0x74, 0xf3, 0xc6, 0x6c,
-	0xda, 0xa8, 0x0a, 0x6b, 0x94, 0x4d, 0xdc, 0x75, 0x63, 0xd2, 0x4d, 0x6d, 0xf1, 0x83, 0x44, 0x91,
-	0x65, 0xac, 0x9b, 0x9a, 0x17, 0x4b, 0x2a, 0xdc, 0x62, 0x12, 0x51, 0xdd, 0x46, 0x3f, 0x83, 0xc2,
-	0x98, 0xc7, 0x4c, 0x49, 0xb7, 0x64, 0x16, 0xbb, 0x99, 0xb5, 0xd8, 0x23, 0x8d, 0xb0, 0x4f, 0xbb,
-	0x85, 0xa3, 0x1e, 0xdc, 0x91, 0x8a, 0x47, 0x83, 0xa1, 0x20, 0x1e, 0x1d, 0x44, 0x54, 0x04, 0xdc,
-	0xb7, 0x4f, 0xd3, 0xe6, 0x5b, 0x87, 0xd2, 0xb5, 0x45, 0x0e, 0xbe, 0xad, 0x39, 0xfb, 0x9a, 0xd2,
-	0x37, 0x0c, 0xd4, 0x87, 0x4a, 0x14, 0x87, 0xe1, 0x80, 0x47, 0x49, 0x96, 0x4a, 0xf4, 0xf4, 0x1e,
-	0x21, 0xeb, 0xc7, 0x61, 0xf8, 0x3c, 0x21, 0x61, 0x27, 0x9a, 0x77, 0xd0, 0x7d, 0x28, 0x0c, 0x05,
-	0x8f, 0x23, 0xe9, 0x3a, 0x26, 0x18, 0xb6, 0x87, 0xbe, 0x80, 0xa2, 0xa4, 0x9e, 0xa0, 0x4a, 0xba,
-	0x15, 0xb3, 0xd5, 0x8f, 0xb3, 0x26, 0x39, 0x31, 0x10, 0x4c, 0xcf, 0xa9, 0xa0, 0xcc, 0xa3, 0x38,
-	0xe5, 0xa0, 0x4d, 0x58, 0x53, 0x6a, 0xea, 0x6e, 0x34, 0x72, 0xdb, 0xa5, 0x4e, 0xf1, 0xfa, 0x6a,
-	0x6b, 0xed, 0xf4, 0xf4, 0x25, 0xd6, 0x36, 0xfd, 0x82, 0x8e, 0xb8, 0x54, 0x8c, 0x8c, 0xa9, 0x7b,
-	0xcb, 0xc4, 0x76, 0xd6, 0x47, 0x2f, 0x01, 0x7c, 0x26, 0x07, 0x9e, 0xb9, 0xb2, 0xee, 0x6d, 0xb3,
-	0xbb, 0x4f, 0xdf, 0xbd, 0xbb, 0xee, 0xf1, 0x89, 0xcd, 0x22, 0x1b, 0xd7, 0x57, 0x5b, 0xe5, 0x59,
-	0x17, 0x97, 0x7d, 0x26, 0x93, 0x26, 0xea, 0x80, 0x33, 0xa2, 0x24, 0x54, 0x23, 0x6f, 0x44, 0xbd,
-	0x0b, 0xb7, 0x7a, 0x73, 0x5a, 0x78, 0x66, 0x60, 0xd6, 0xc3, 0x22, 0x49, 0x2b, 0x58, 0x2f, 0x55,
-	0xba, 0x77, 0x4c, 0xac, 0x92, 0x0e, 0xfa, 0x08, 0x80, 0x47, 0x94, 0x0d, 0xa4, 0xf2, 0x03, 0xe6,
-	0x22, 0xbd, 0x65, 0x5c, 0xd6, 0x96, 0x13, 0x6d, 0x40, 0x0f, 0xf4, 0xa3, 0x4d, 0xfc, 0x01, 0x67,
-	0xe1, 0xd4, 0xfd, 0x8e, 0x19, 0x2d, 0x69, 0xc3, 0x73, 0x16, 0x4e, 0xd1, 0x16, 0x38, 0x46, 0x17,
-	0x32, 0x18, 0x32, 0x12, 0xba, 0x77, 0x4d, 0x3c, 0x40, 0x9b, 0x4e, 0x8c, 0x45, 0x9f, 0x43, 0x12,
-	0x0d, 0xe9, 0xde, 0xbb, 0xf9, 0x1c, 0xec, 0x62, 0xe7, 0xe7, 0x60, 0x39, 0xe8, 0x97, 0x00, 0x91,
-	0x08, 0x26, 0x41, 0x48, 0x87, 0x54, 0xba, 0xf7, 0xcd, 0xa6, 0xeb, 0x99, 0xaf, 0xf5, 0x0c, 0x85,
-	0x17, 0x18, 0xb5, 0xcf, 0xc1, 0x59, 0xb8, 0x6d, 0xfa, 0x96, 0x5c, 0xd0, 0xa9, 0xbd, 0xc0, 0xba,
-	0xa9, 0x43, 0x32, 0x21, 0x61, 0x9c, 0x54, 0xc2, 0x65, 0x9c, 0x74, 0x7e, 0xbe, 0xfa, 0x24, 0x57,
-	0xdb, 0x05, 0x67, 0x41, 0x75, 0xe8, 0x63, 0xd8, 0x10, 0x74, 0x18, 0x48, 0x25, 0xa6, 0x03, 0x12,
-	0xab, 0x91, 0xfb, 0x6b, 0x43, 0xa8, 0xa4, 0xc6, 0x76, 0xac, 0x46, 0xb5, 0x01, 0xcc, 0x0f, 0x0f,
-	0x35, 0xc0, 0xd1, 0xa2, 0x90, 0x54, 0x4c, 0xa8, 0xd0, 0xd9, 0x56, 0xc7, 0x7c, 0xd1, 0xa4, 0xc5,
-	0x2b, 0x29, 0x11, 0xde, 0xc8, 0xbc, 0x1d, 0x65, 0x6c, 0x7b, 0xfa, 0x31, 0x48, 0x6f, 0x88, 0x7d,
-	0x0c, 0x6c, 0xb7, 0xf9, 0xaf, 0x1c, 0x54, 0x16, 0x8b, 0x06, 0xb4, 0x97, 0x24, 0x7b, 0xb3, 0xa5,
-	0x5b, 0xbb, 0x3b, 0xef, 0x2a, 0x32, 0x4c, 0x6a, 0x0d, 0x63, 0xed, 0xec, 0x48, 0xd7, 0xf7, 0x86,
-	0x8c, 0x7e, 0x0a, 0xeb, 0x11, 0x17, 0x2a, 0x7d, 0xc2, 0xb2, 0x03, 0xcc, 0x45, 0x9a, 0x8a, 0x12,
-	0x70, 0x73, 0x04, 0xb7, 0x96, 0xbd, 0xa1, 0x47, 0xb0, 0xf6, 0xe2, 0xa0, 0x5f, 0x5d, 0xa9, 0x3d,
-	0x78, 0x75, 0xd9, 0xf8, 0xee, 0xf2, 0xe0, 0x8b, 0x40, 0xa8, 0x98, 0x84, 0x07, 0x7d, 0xf4, 0x43,
-	0x58, 0xef, 0x1e, 0x9f, 0x60, 0x5c, 0xcd, 0xd5, 0xb6, 0x5e, 0x5d, 0x36, 0x1e, 0x2c, 0xe3, 0xf4,
-	0x10, 0x8f, 0x99, 0x8f, 0xf9, 0xd9, 0xac, 0xd6, 0xfd, 0xf7, 0x2a, 0x38, 0xf6, 0x65, 0xff, 0xd0,
-	0xdf, 0xa1, 0x8d, 0x24, 0x95, 0xa7, 0x57, 0x76, 0xf5, 0x9d, 0x19, 0xbd, 0x92, 0x10, 0xec, 0x19,
-	0x3f, 0x84, 0x4a, 0x10, 0x4d, 0x3e, 0x1b, 0x50, 0x46, 0xce, 0x42, 0x5b, 0xf6, 0x96, 0xb0, 0xa3,
-	0x6d, 0xbd, 0xc4, 0xa4, 0xdf, 0x8b, 0x80, 0x29, 0x2a, 0x98, 0x2d, 0x68, 0x4b, 0x78, 0xd6, 0x47,
-	0x5f, 0x40, 0x3e, 0x88, 0xc8, 0xd8, 0x96, 0x21, 0x99, 0x3b, 0x38, 0xe8, 0xb7, 0x8f, 0xac, 0x06,
-	0x3b, 0xa5, 0xeb, 0xab, 0xad, 0xbc, 0x36, 0x60, 0x43, 0x43, 0xf5, 0xb4, 0x12, 0xd0, 0x33, 0x99,
-	0xb7, 0xbf, 0x84, 0x17, 0x2c, 0x5a, 0x47, 0x01, 0x1b, 0x0a, 0x2a, 0xa5, 0xc9, 0x02, 0x25, 0x9c,
-	0x76, 0x51, 0x0d, 0x8a, 0xb6, 0x9e, 0x30, 0x05, 0x44, 0x59, 0xe7, 0x6a, 0x6b, 0xe8, 0x6c, 0x80,
-	0x93, 0x44, 0x63, 0x70, 0x2e, 0xf8, 0xb8, 0xf9, 0x9f, 0x3c, 0x38, 0x7b, 0x61, 0x2c, 0x95, 0x4d,
-	0x83, 0x1f, 0x2c, 0xf8, 0x2f, 0xe1, 0x0e, 0x31, 0xdf, 0x2b, 0xc2, 0x74, 0x4e, 0x31, 0x65, 0x9a,
-	0x3d, 0x80, 0x47, 0x99, 0xee, 0x66, 0xe0, 0xa4, 0xa4, 0xeb, 0x14, 0xb4, 0x4f, 0x37, 0x87, 0xab,
-	0xe4, 0x8d, 0x11, 0x74, 0x02, 0x1b, 0x5c, 0x78, 0x23, 0x2a, 0x55, 0x92, 0x89, 0xec, 0x77, 0x24,
-	0xf3, 0xa3, 0xfa, 0x7c, 0x11, 0x68, 0x9f, 0xe1, 0x64, 0xb5, 0xcb, 0x3e, 0xd0, 0x13, 0xc8, 0x0b,
-	0x72, 0x9e, 0x96, 0x9c, 0x99, 0x97, 0x04, 0x93, 0x73, 0xb5, 0xe4, 0xc2, 0x30, 0xd0, 0x6f, 0x01,
-	0xfc, 0x40, 0x46, 0x44, 0x79, 0x23, 0x2a, 0xec, 0x61, 0x67, 0x6e, 0xb1, 0x3b, 0x43, 0x2d, 0x79,
-	0x59, 0x60, 0xa3, 0x43, 0x28, 0x7b, 0x24, 0x95, 0x6b, 0xe1, 0xe6, 0x3f, 0xda, 0x5e, 0xdb, 0xba,
-	0xa8, 0x6a, 0x17, 0xd7, 0x57, 0x5b, 0xa5, 0xd4, 0x82, 0x4b, 0x1e, 0xb1, 0xf2, 0x3d, 0x84, 0x0d,
-	0xfd, 0x77, 0x1b, 0xf8, 0xf4, 0x9c, 0xc4, 0xa1, 0x4a, 0x64, 0x72, 0x43, 0x5a, 0xd1, 0x1f, 0x81,
-	0xae, 0xc5, 0xd9, 0x75, 0x55, 0xd4, 0x82, 0x0d, 0xfd, 0x1e, 0xee, 0x50, 0xe6, 0x89, 0xa9, 0x11,
-	0x6b, 0xba, 0xc2, 0xd2, 0xcd, 0x9b, 0xed, 0xcd, 0xc0, 0x4b, 0x9b, 0xad, 0xd2, 0x37, 0xec, 0xcd,
-	0x00, 0x20, 0x49, 0xd4, 0x1f, 0x56, 0x7f, 0x08, 0xf2, 0x3e, 0x51, 0xc4, 0x48, 0xae, 0x82, 0x4d,
-	0x5b, 0x4f, 0x95, 0x4c, 0xfa, 0x7f, 0x9f, 0xaa, 0xe3, 0xbe, 0xfe, 0xa6, 0xbe, 0xf2, 0x8f, 0x6f,
-	0xea, 0x2b, 0x7f, 0xba, 0xae, 0xe7, 0x5e, 0x5f, 0xd7, 0x73, 0x7f, 0xbb, 0xae, 0xe7, 0xfe, 0x79,
-	0x5d, 0xcf, 0x9d, 0x15, 0x4c, 0x25, 0xf5, 0x93, 0xff, 0x06, 0x00, 0x00, 0xff, 0xff, 0xb3, 0x21,
-	0x2b, 0x33, 0x82, 0x12, 0x00, 0x00,
+	// 1867 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x57, 0xcf, 0x73, 0x1b, 0x49,
+	0x15, 0xb6, 0x6c, 0x59, 0x3f, 0xde, 0xc8, 0x89, 0xd2, 0x24, 0x61, 0xa2, 0xb0, 0xb2, 0xa2, 0x0d,
+	0xc1, 0xcb, 0x16, 0x72, 0x61, 0xa8, 0x25, 0xbb, 0x61, 0x01, 0xc9, 0x12, 0x8e, 0x31, 0x76, 0x54,
+	0x6d, 0x6f, 0x20, 0x27, 0x55, 0x7b, 0xa6, 0x3d, 0x9a, 0xf2, 0xa8, 0x7b, 0xe8, 0xe9, 0xd1, 0x96,
+	0x6e, 0x1c, 0xb7, 0x72, 0xe5, 0xec, 0xe2, 0x40, 0xf1, 0xbf, 0xe4, 0x48, 0x71, 0xe2, 0xe4, 0x62,
+	0xfd, 0x2f, 0x70, 0xe3, 0x02, 0xd5, 0x3d, 0x3d, 0xd2, 0x28, 0x19, 0x27, 0xa9, 0x22, 0x07, 0x6e,
+	0xdd, 0xaf, 0xbf, 0xef, 0xcd, 0xeb, 0xd7, 0x5f, 0xf7, 0x7b, 0x03, 0x56, 0x14, 0x52, 0x27, 0xea,
+	0x84, 0x82, 0x4b, 0x8e, 0x90, 0xcb, 0x9d, 0x73, 0x2a, 0x3a, 0xd1, 0xd7, 0x44, 0x4c, 0xce, 0x7d,
+	0xd9, 0x99, 0xfe, 0xb8, 0x61, 0xc9, 0x59, 0x48, 0x0d, 0xa0, 0x71, 0xdb, 0xe3, 0x1e, 0xd7, 0xc3,
+	0x6d, 0x35, 0x32, 0xd6, 0xa6, 0xc7, 0xb9, 0x17, 0xd0, 0x6d, 0x3d, 0x3b, 0x8d, 0xcf, 0xb6, 0xdd,
+	0x58, 0x10, 0xe9, 0x73, 0x66, 0xd6, 0xef, 0xbd, 0xbe, 0x4e, 0xd8, 0x2c, 0x59, 0x6a, 0x5f, 0x14,
+	0xa1, 0x72, 0xc4, 0x5d, 0x7a, 0x1c, 0x52, 0x07, 0xed, 0x81, 0x45, 0x18, 0xe3, 0x52, 0x73, 0x23,
+	0xbb, 0xd0, 0x2a, 0x6c, 0x59, 0x3b, 0x9b, 0x9d, 0x37, 0x83, 0xea, 0x74, 0x17, 0xb0, 0x5e, 0xf1,
+	0xd5, 0xe5, 0xe6, 0x0a, 0xce, 0x32, 0xd1, 0x2f, 0xa1, 0xe6, 0xd2, 0xc8, 0x17, 0xd4, 0x1d, 0x09,
+	0x1e, 0x50, 0x7b, 0xb5, 0x55, 0xd8, 0xba, 0xb1, 0xf3, 0xbd, 0x3c, 0x4f, 0xea, 0xe3, 0x98, 0x07,
+	0x14, 0x5b, 0x86, 0xa1, 0x26, 0x68, 0x0f, 0x60, 0x42, 0x27, 0xa7, 0x54, 0x44, 0x63, 0x3f, 0xb4,
+	0xd7, 0x34, 0xfd, 0x07, 0xd7, 0xd1, 0x55, 0xec, 0x9d, 0xc3, 0x39, 0x1c, 0x67, 0xa8, 0xe8, 0x10,
+	0x6a, 0x64, 0x4a, 0xfc, 0x80, 0x9c, 0xfa, 0x81, 0x2f, 0x67, 0x76, 0x51, 0xbb, 0xfa, 0xe4, 0xad,
+	0xae, 0xba, 0x19, 0x02, 0x5e, 0xa2, 0xb7, 0x5d, 0x80, 0xc5, 0x87, 0xd0, 0x23, 0x28, 0x0f, 0x07,
+	0x47, 0xfd, 0xfd, 0xa3, 0xbd, 0xfa, 0x4a, 0xe3, 0xde, 0xcb, 0x8b, 0xd6, 0x1d, 0xe5, 0x63, 0x01,
+	0x18, 0x52, 0xe6, 0xfa, 0xcc, 0x43, 0x5b, 0x50, 0xe9, 0xee, 0xee, 0x0e, 0x86, 0x27, 0x83, 0x7e,
+	0xbd, 0xd0, 0x68, 0xbc, 0xbc, 0x68, 0xdd, 0x5d, 0x06, 0x76, 0x1d, 0x87, 0x86, 0x92, 0xba, 0x8d,
+	0xe2, 0x37, 0x7f, 0x69, 0xae, 0xb4, 0xbf, 0x29, 0x40, 0x2d, 0x1b, 0x04, 0x7a, 0x04, 0xa5, 0xee,
+	0xee, 0xc9, 0xfe, 0xf3, 0x41, 0x7d, 0x65, 0x41, 0xcf, 0x22, 0xba, 0x8e, 0xf4, 0xa7, 0x14, 0x3d,
+	0x84, 0xf5, 0x61, 0xf7, 0xab, 0xe3, 0x41, 0xbd, 0xb0, 0x08, 0x27, 0x0b, 0x1b, 0x92, 0x38, 0xd2,
+	0xa8, 0x3e, 0xee, 0xee, 0x1f, 0xd5, 0x57, 0xf3, 0x51, 0x7d, 0x41, 0x7c, 0x66, 0x42, 0xf9, 0x73,
+	0x11, 0xac, 0x63, 0x2a, 0xa6, 0xbe, 0xf3, 0x81, 0x25, 0xf2, 0x19, 0x14, 0x25, 0x89, 0xce, 0xb5,
+	0x34, 0xac, 0x7c, 0x69, 0x9c, 0x90, 0xe8, 0x5c, 0x7d, 0xd4, 0xd0, 0x35, 0x5e, 0x29, 0x43, 0xd0,
+	0x30, 0xf0, 0x1d, 0x22, 0xa9, 0xab, 0x95, 0x61, 0xed, 0x7c, 0x3f, 0x8f, 0x8d, 0xe7, 0x28, 0x13,
+	0xff, 0xd3, 0x15, 0x9c, 0xa1, 0xa2, 0x27, 0x50, 0xf2, 0x02, 0x7e, 0x4a, 0x02, 0xad, 0x09, 0x6b,
+	0xe7, 0x41, 0x9e, 0x93, 0x3d, 0x8d, 0x58, 0x38, 0x30, 0x14, 0xf4, 0x18, 0x4a, 0x71, 0xe8, 0x12,
+	0x49, 0xed, 0x92, 0x26, 0xb7, 0xf2, 0xc8, 0x5f, 0x69, 0xc4, 0x2e, 0x67, 0x67, 0xbe, 0x87, 0x0d,
+	0x1e, 0x1d, 0x40, 0x85, 0x51, 0xf9, 0x35, 0x17, 0xe7, 0x91, 0x5d, 0x6e, 0xad, 0x6d, 0x59, 0x3b,
+	0x9f, 0xe6, 0x8a, 0x31, 0xc1, 0x74, 0xa5, 0x24, 0xce, 0x78, 0x42, 0x99, 0x4c, 0xdc, 0xf4, 0x56,
+	0xed, 0x02, 0x9e, 0x3b, 0x40, 0x3f, 0x87, 0x0a, 0x65, 0x6e, 0xc8, 0x7d, 0x26, 0xed, 0xca, 0xf5,
+	0x81, 0x0c, 0x0c, 0x46, 0x25, 0x13, 0xcf, 0x19, 0x8a, 0x2d, 0x78, 0x10, 0x9c, 0x12, 0xe7, 0xdc,
+	0xae, 0xbe, 0xe7, 0x36, 0xe6, 0x8c, 0x5e, 0x09, 0x8a, 0x13, 0xee, 0xd2, 0xf6, 0x36, 0xdc, 0x7a,
+	0x23, 0xd5, 0xa8, 0x01, 0x15, 0x93, 0xea, 0x44, 0x23, 0x45, 0x3c, 0x9f, 0xb7, 0x6f, 0xc2, 0xc6,
+	0x52, 0x5a, 0xdb, 0x7f, 0x2f, 0x42, 0x25, 0x3d, 0x6b, 0xd4, 0x85, 0xaa, 0xc3, 0x99, 0x24, 0x3e,
+	0xa3, 0xc2, 0xc8, 0x2b, 0xf7, 0x64, 0x76, 0x53, 0x90, 0x62, 0x3d, 0x5d, 0xc1, 0x0b, 0x16, 0xfa,
+	0x35, 0x54, 0x05, 0x8d, 0x78, 0x2c, 0x1c, 0x1a, 0x19, 0x7d, 0x6d, 0xe5, 0x2b, 0x24, 0x01, 0x61,
+	0xfa, 0x87, 0xd8, 0x17, 0x54, 0x65, 0x39, 0xc2, 0x0b, 0x2a, 0x7a, 0x02, 0x65, 0x41, 0x23, 0x49,
+	0x84, 0x7c, 0x9b, 0x44, 0x70, 0x02, 0x19, 0xf2, 0xc0, 0x77, 0x66, 0x38, 0x65, 0xa0, 0x27, 0x50,
+	0x0d, 0x03, 0xe2, 0x68, 0xaf, 0xf6, 0xba, 0xa6, 0x7f, 0x94, 0x47, 0x1f, 0xa6, 0x20, 0xbc, 0xc0,
+	0xa3, 0xcf, 0x01, 0x02, 0xee, 0x8d, 0x5c, 0xe1, 0x4f, 0xa9, 0x30, 0x12, 0x6b, 0xe4, 0xb1, 0xfb,
+	0x1a, 0x81, 0xab, 0x01, 0xf7, 0x92, 0x21, 0xda, 0xfb, 0x9f, 0xf4, 0x95, 0xd1, 0xd6, 0x01, 0x00,
+	0x99, 0xaf, 0x1a, 0x75, 0x7d, 0xf2, 0x5e, 0xae, 0xcc, 0x89, 0x64, 0xe8, 0xe8, 0x01, 0xd4, 0xce,
+	0xb8, 0x70, 0xe8, 0xc8, 0xdc, 0x9a, 0xaa, 0xd6, 0x84, 0xa5, 0x6d, 0x89, 0xbe, 0x50, 0x0f, 0xca,
+	0x1e, 0x65, 0x54, 0xf8, 0x8e, 0x0d, 0xfa, 0x63, 0x8f, 0x72, 0x2f, 0x64, 0x02, 0xc1, 0x31, 0x93,
+	0xfe, 0x84, 0x9a, 0x2f, 0xa5, 0xc4, 0x5e, 0x15, 0xca, 0x22, 0x59, 0x69, 0xff, 0x1e, 0xd0, 0x9b,
+	0x58, 0x84, 0xa0, 0x78, 0xee, 0x33, 0x57, 0x0b, 0xab, 0x8a, 0xf5, 0x18, 0x75, 0xa0, 0x1c, 0x92,
+	0x59, 0xc0, 0x89, 0x6b, 0xc4, 0x72, 0xbb, 0x93, 0xd4, 0xcb, 0x4e, 0x5a, 0x2f, 0x3b, 0x5d, 0x36,
+	0xc3, 0x29, 0xa8, 0x7d, 0x00, 0x77, 0x72, 0xb7, 0x8c, 0x76, 0xa0, 0x36, 0x17, 0xe1, 0xc8, 0x37,
+	0x1f, 0xe9, 0xdd, 0xbc, 0xba, 0xdc, 0xb4, 0xe6, 0x6a, 0xdd, 0xef, 0x63, 0x6b, 0x0e, 0xda, 0x77,
+	0xdb, 0x7f, 0xaa, 0xc2, 0xc6, 0x92, 0x94, 0xd1, 0x6d, 0x58, 0xf7, 0x27, 0xc4, 0xa3, 0x26, 0xc6,
+	0x64, 0x82, 0x06, 0x50, 0x0a, 0xc8, 0x29, 0x0d, 0x94, 0xa0, 0xd5, 0xa1, 0xfe, 0xe8, 0x9d, 0x77,
+	0xa2, 0xf3, 0x5b, 0x8d, 0x1f, 0x30, 0x29, 0x66, 0xd8, 0x90, 0x91, 0x0d, 0x65, 0x87, 0x4f, 0x26,
+	0x84, 0xa9, 0xa7, 0x73, 0x6d, 0xab, 0x8a, 0xd3, 0xa9, 0xca, 0x0c, 0x11, 0x5e, 0x64, 0x17, 0xb5,
+	0x59, 0x8f, 0x51, 0x1d, 0xd6, 0x28, 0x9b, 0xda, 0xeb, 0xda, 0xa4, 0x86, 0xca, 0xe2, 0xfa, 0x89,
+	0x22, 0xab, 0x58, 0x0d, 0x15, 0x2f, 0x8e, 0xa8, 0xb0, 0xcb, 0x49, 0x46, 0xd5, 0x18, 0xfd, 0x0c,
+	0x4a, 0x13, 0x1e, 0x33, 0x19, 0xd9, 0x15, 0x1d, 0xec, 0xbd, 0xbc, 0x60, 0x0f, 0x15, 0xc2, 0x3c,
+	0xed, 0x06, 0x8e, 0x06, 0x70, 0x2b, 0x92, 0x3c, 0x1c, 0x79, 0x82, 0x38, 0x74, 0x14, 0x52, 0xe1,
+	0x73, 0xd7, 0x3c, 0x4d, 0xf7, 0xde, 0x38, 0x94, 0xbe, 0x69, 0x72, 0xf0, 0x4d, 0xc5, 0xd9, 0x53,
+	0x94, 0xa1, 0x66, 0xa0, 0x21, 0xd4, 0xc2, 0x38, 0x08, 0x46, 0x3c, 0x4c, 0xaa, 0x54, 0xa2, 0xa7,
+	0xf7, 0x48, 0xd9, 0x30, 0x0e, 0x82, 0x67, 0x09, 0x09, 0x5b, 0xe1, 0x62, 0x82, 0xee, 0x42, 0xc9,
+	0x13, 0x3c, 0x0e, 0x23, 0xdb, 0xd2, 0xc9, 0x30, 0x33, 0xf4, 0x25, 0x94, 0x23, 0xea, 0x08, 0x2a,
+	0x23, 0xbb, 0xa6, 0xb7, 0xfa, 0x71, 0xde, 0x47, 0x8e, 0x35, 0x04, 0xd3, 0x33, 0x2a, 0x28, 0x73,
+	0x28, 0x4e, 0x39, 0xe8, 0x1e, 0xac, 0x49, 0x39, 0xb3, 0x37, 0x5a, 0x85, 0xad, 0x4a, 0xaf, 0x7c,
+	0x75, 0xb9, 0xb9, 0x76, 0x72, 0xf2, 0x02, 0x2b, 0x9b, 0x7a, 0x41, 0xc7, 0x3c, 0x92, 0x8c, 0x4c,
+	0xa8, 0x7d, 0x43, 0xe7, 0x76, 0x3e, 0x47, 0x2f, 0x00, 0x5c, 0x16, 0x8d, 0x1c, 0x7d, 0x65, 0xed,
+	0x9b, 0x7a, 0x77, 0x9f, 0xbe, 0x7b, 0x77, 0xfd, 0xa3, 0x63, 0x53, 0x45, 0x36, 0xae, 0x2e, 0x37,
+	0xab, 0xf3, 0x29, 0xae, 0xba, 0x2c, 0x4a, 0x86, 0xa8, 0x07, 0xd6, 0x98, 0x92, 0x40, 0x8e, 0x9d,
+	0x31, 0x75, 0xce, 0xed, 0xfa, 0xf5, 0x65, 0xe1, 0xa9, 0x86, 0x19, 0x0f, 0x59, 0x92, 0x52, 0xb0,
+	0x0a, 0x35, 0xb2, 0x6f, 0xe9, 0x5c, 0x25, 0x13, 0xf4, 0x11, 0x00, 0x0f, 0x29, 0x1b, 0x45, 0xd2,
+	0xf5, 0x99, 0x8d, 0xd4, 0x96, 0x71, 0x55, 0x59, 0x8e, 0x95, 0x01, 0xdd, 0x57, 0x8f, 0x36, 0x71,
+	0x47, 0x9c, 0x05, 0x33, 0xfb, 0x3b, 0x7a, 0xb5, 0xa2, 0x0c, 0xcf, 0x58, 0x30, 0x43, 0x9b, 0x60,
+	0x69, 0x5d, 0x44, 0xbe, 0xc7, 0x48, 0x60, 0xdf, 0xd6, 0xf9, 0x00, 0x65, 0x3a, 0xd6, 0x16, 0x75,
+	0x0e, 0x49, 0x36, 0x22, 0xfb, 0xce, 0xf5, 0xe7, 0x60, 0x82, 0x5d, 0x9c, 0x83, 0xe1, 0xa0, 0x5f,
+	0x00, 0x84, 0xc2, 0x9f, 0xfa, 0x01, 0xf5, 0x68, 0x64, 0xdf, 0xd5, 0x9b, 0x6e, 0xe6, 0xbe, 0xd6,
+	0x73, 0x14, 0xce, 0x30, 0x1a, 0x9f, 0x83, 0x95, 0xb9, 0x6d, 0xea, 0x96, 0x9c, 0xd3, 0x99, 0xb9,
+	0xc0, 0x6a, 0xa8, 0x52, 0x32, 0x25, 0x41, 0x9c, 0x74, 0xc2, 0x55, 0x9c, 0x4c, 0xbe, 0x58, 0x7d,
+	0x5c, 0x68, 0xec, 0x80, 0x95, 0x51, 0x1d, 0xfa, 0x18, 0x36, 0x04, 0xf5, 0xfc, 0x48, 0x8a, 0xd9,
+	0x88, 0xc4, 0x72, 0x6c, 0xff, 0x4a, 0x13, 0x6a, 0xa9, 0xb1, 0x1b, 0xcb, 0x71, 0x63, 0x04, 0x8b,
+	0xc3, 0x43, 0x2d, 0xb0, 0x94, 0x28, 0x22, 0x2a, 0xa6, 0x54, 0xa8, 0x6a, 0xab, 0x72, 0x9e, 0x35,
+	0x29, 0xf1, 0x46, 0x94, 0x08, 0x67, 0xac, 0xdf, 0x8e, 0x2a, 0x36, 0x33, 0xf5, 0x18, 0xa4, 0x37,
+	0xc4, 0x3c, 0x06, 0x66, 0xda, 0xfe, 0x57, 0x01, 0x6a, 0xd9, 0xa6, 0x01, 0xed, 0x26, 0xc5, 0x5e,
+	0x6f, 0xe9, 0xc6, 0xce, 0xf6, 0xbb, 0x9a, 0x0c, 0x5d, 0x5a, 0x83, 0x58, 0x39, 0x3b, 0x54, 0xfd,
+	0xbd, 0x26, 0xa3, 0x9f, 0xc2, 0x7a, 0xc8, 0x85, 0x4c, 0x9f, 0xb0, 0xfc, 0x04, 0x73, 0x91, 0x96,
+	0xa2, 0x04, 0xdc, 0x1e, 0xc3, 0x8d, 0x65, 0x6f, 0xe8, 0x21, 0xac, 0x3d, 0xdf, 0x1f, 0xd6, 0x57,
+	0x1a, 0xf7, 0x5f, 0x5e, 0xb4, 0xbe, 0xbb, 0xbc, 0xf8, 0xdc, 0x17, 0x32, 0x26, 0xc1, 0xfe, 0x10,
+	0xfd, 0x10, 0xd6, 0xfb, 0x47, 0xc7, 0x18, 0xd7, 0x0b, 0x8d, 0xcd, 0x97, 0x17, 0xad, 0xfb, 0xcb,
+	0x38, 0xb5, 0xc4, 0x63, 0xe6, 0x62, 0x7e, 0x3a, 0xef, 0x75, 0xff, 0xbd, 0x0a, 0x96, 0x79, 0xd9,
+	0x3f, 0xf4, 0xef, 0xd0, 0x46, 0x52, 0xca, 0xd3, 0x2b, 0xbb, 0xfa, 0xce, 0x8a, 0x5e, 0x4b, 0x08,
+	0xe6, 0x8c, 0x1f, 0x40, 0xcd, 0x0f, 0xa7, 0x9f, 0x8d, 0x28, 0x23, 0xa7, 0x81, 0x69, 0x7b, 0x2b,
+	0xd8, 0x52, 0xb6, 0x41, 0x62, 0x52, 0xef, 0x85, 0xcf, 0x24, 0x15, 0xcc, 0x34, 0xb4, 0x15, 0x3c,
+	0x9f, 0xa3, 0x2f, 0xa1, 0xe8, 0x87, 0x64, 0x62, 0xda, 0x90, 0xdc, 0x1d, 0xec, 0x0f, 0xbb, 0x87,
+	0x46, 0x83, 0xbd, 0xca, 0xd5, 0xe5, 0x66, 0x51, 0x19, 0xb0, 0xa6, 0xa1, 0x66, 0xda, 0x09, 0xa8,
+	0x2f, 0xe9, 0xb7, 0xbf, 0x82, 0x33, 0x16, 0xa5, 0x23, 0x9f, 0x79, 0x82, 0x46, 0x91, 0xae, 0x02,
+	0x15, 0x9c, 0x4e, 0x51, 0x03, 0xca, 0xa6, 0x9f, 0xd0, 0x0d, 0x44, 0x55, 0xd5, 0x6a, 0x63, 0xe8,
+	0x6d, 0x80, 0x95, 0x64, 0x63, 0x74, 0x26, 0xf8, 0xa4, 0xfd, 0x9f, 0x22, 0x58, 0xbb, 0x41, 0x1c,
+	0x49, 0x53, 0x06, 0x3f, 0x58, 0xf2, 0x5f, 0xc0, 0x2d, 0xa2, 0x7f, 0xaf, 0x08, 0x53, 0x35, 0x45,
+	0xb7, 0x69, 0xe6, 0x00, 0x1e, 0xe6, 0xba, 0x9b, 0x83, 0x93, 0x96, 0xae, 0x57, 0x52, 0x3e, 0xed,
+	0x02, 0xae, 0x93, 0xd7, 0x56, 0xd0, 0x31, 0x6c, 0x70, 0xe1, 0x8c, 0x69, 0x24, 0x93, 0x4a, 0x64,
+	0x7e, 0x47, 0x72, 0x7f, 0x54, 0x9f, 0x65, 0x81, 0xe6, 0x19, 0x4e, 0xa2, 0x5d, 0xf6, 0x81, 0x1e,
+	0x43, 0x51, 0x90, 0xb3, 0xb4, 0xe5, 0xcc, 0xbd, 0x24, 0x98, 0x9c, 0xc9, 0x25, 0x17, 0x9a, 0x81,
+	0x7e, 0x03, 0xe0, 0xfa, 0x51, 0x48, 0xa4, 0x33, 0xa6, 0xc2, 0x1c, 0x76, 0xee, 0x16, 0xfb, 0x73,
+	0xd4, 0x92, 0x97, 0x0c, 0x1b, 0x1d, 0x40, 0xd5, 0x21, 0xa9, 0x5c, 0x4b, 0xd7, 0xff, 0xa3, 0xed,
+	0x76, 0x8d, 0x8b, 0xba, 0x72, 0x71, 0x75, 0xb9, 0x59, 0x49, 0x2d, 0xb8, 0xe2, 0x10, 0x23, 0xdf,
+	0x03, 0xd8, 0x50, 0xff, 0x6e, 0x23, 0x97, 0x9e, 0x91, 0x38, 0x90, 0x89, 0x4c, 0xae, 0x29, 0x2b,
+	0xea, 0x47, 0xa0, 0x6f, 0x70, 0x26, 0xae, 0x9a, 0xcc, 0xd8, 0xd0, 0xef, 0xe0, 0x16, 0x65, 0x8e,
+	0x98, 0x69, 0xb1, 0xa6, 0x11, 0x56, 0xae, 0xdf, 0xec, 0x60, 0x0e, 0x5e, 0xda, 0x6c, 0x9d, 0xbe,
+	0x66, 0x6f, 0xff, 0xb5, 0x00, 0x90, 0x54, 0xea, 0x0f, 0x2b, 0x40, 0x04, 0x45, 0x97, 0x48, 0xa2,
+	0x35, 0x57, 0xc3, 0x7a, 0x8c, 0xbe, 0x00, 0x90, 0x74, 0x12, 0x06, 0x44, 0xfa, 0xcc, 0x33, 0xb2,
+	0x79, 0xdb, 0x73, 0x90, 0x41, 0xeb, 0x38, 0x93, 0x90, 0xff, 0xaf, 0xe3, 0xec, 0xd9, 0xaf, 0xbe,
+	0x6d, 0xae, 0xfc, 0xe3, 0xdb, 0xe6, 0xca, 0x1f, 0xaf, 0x9a, 0x85, 0x57, 0x57, 0xcd, 0xc2, 0xdf,
+	0xae, 0x9a, 0x85, 0x7f, 0x5e, 0x35, 0x0b, 0xa7, 0x25, 0xdd, 0xc3, 0xfd, 0xe4, 0xbf, 0x01, 0x00,
+	0x00, 0xff, 0xff, 0x06, 0x93, 0x6e, 0xba, 0xfc, 0x12, 0x00, 0x00,
 }
diff --git a/components/engine/vendor/github.com/docker/swarmkit/api/specs.proto b/components/engine/vendor/github.com/docker/swarmkit/api/specs.proto
index f7a4d18b2e..13b52d4105 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/api/specs.proto
+++ b/components/engine/vendor/github.com/docker/swarmkit/api/specs.proto
@@ -386,6 +386,13 @@ message SecretSpec {
 
 	// Data is the secret payload - the maximum size is 500KB (that is, 500*1024 bytes)
 	bytes data = 2;
+
+	// Templating controls whether and how to evaluate the secret payload as
+	// a template. If it is not set, no templating is used.
+	//
+	// The currently recognized values are:
+	// - golang: Go templating
+	Driver templating = 3;
 }
 
 // ConfigSpec specifies user-provided configuration files.
@@ -396,4 +403,11 @@ message ConfigSpec {
 	// TODO(aaronl): Do we want to revise this to include multiple payloads in a single
 	// ConfigSpec? Define this to be a tar? etc...
 	bytes data = 2;
+
+	// Templating controls whether and how to evaluate the secret payload as
+	// a template. If it is not set, no templating is used.
+	//
+	// The currently recognized values are:
+	// - golang: Go templating
+	Driver templating = 3;
 }
diff --git a/components/engine/vendor/github.com/docker/swarmkit/api/types.pb.go b/components/engine/vendor/github.com/docker/swarmkit/api/types.pb.go
index 7ff65e47ca..2befc03577 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/api/types.pb.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/api/types.pb.go
@@ -23,6 +23,9 @@
 		Version
 		IndexEntry
 		Annotations
+		GenericString
+		GenericDiscrete
+		GenericResource
 		Resources
 		ResourceRequirements
 		Platform
@@ -354,7 +357,7 @@ func (x RaftMemberStatus_Reachability) String() string {
 	return proto.EnumName(RaftMemberStatus_Reachability_name, int32(x))
 }
 func (RaftMemberStatus_Reachability) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptorTypes, []int{10, 0}
+	return fileDescriptorTypes, []int{13, 0}
 }
 
 // TODO(aluzzardi) These should be using `gogoproto.enumvalue_customname`.
@@ -387,7 +390,7 @@ var NodeStatus_State_value = map[string]int32{
 func (x NodeStatus_State) String() string {
 	return proto.EnumName(NodeStatus_State_name, int32(x))
 }
-func (NodeStatus_State) EnumDescriptor() ([]byte, []int) { return fileDescriptorTypes, []int{11, 0} }
+func (NodeStatus_State) EnumDescriptor() ([]byte, []int) { return fileDescriptorTypes, []int{14, 0} }
 
 type Mount_MountType int32
 
@@ -411,7 +414,7 @@ var Mount_MountType_value = map[string]int32{
 func (x Mount_MountType) String() string {
 	return proto.EnumName(Mount_MountType_name, int32(x))
 }
-func (Mount_MountType) EnumDescriptor() ([]byte, []int) { return fileDescriptorTypes, []int{13, 0} }
+func (Mount_MountType) EnumDescriptor() ([]byte, []int) { return fileDescriptorTypes, []int{16, 0} }
 
 type Mount_BindOptions_MountPropagation int32
 
@@ -445,7 +448,7 @@ func (x Mount_BindOptions_MountPropagation) String() string {
 	return proto.EnumName(Mount_BindOptions_MountPropagation_name, int32(x))
 }
 func (Mount_BindOptions_MountPropagation) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptorTypes, []int{13, 0, 0}
+	return fileDescriptorTypes, []int{16, 0, 0}
 }
 
 type RestartPolicy_RestartCondition int32
@@ -471,7 +474,7 @@ func (x RestartPolicy_RestartCondition) String() string {
 	return proto.EnumName(RestartPolicy_RestartCondition_name, int32(x))
 }
 func (RestartPolicy_RestartCondition) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptorTypes, []int{14, 0}
+	return fileDescriptorTypes, []int{17, 0}
 }
 
 type UpdateConfig_FailureAction int32
@@ -497,7 +500,7 @@ func (x UpdateConfig_FailureAction) String() string {
 	return proto.EnumName(UpdateConfig_FailureAction_name, int32(x))
 }
 func (UpdateConfig_FailureAction) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptorTypes, []int{15, 0}
+	return fileDescriptorTypes, []int{18, 0}
 }
 
 // UpdateOrder controls the order of operations when rolling out an
@@ -524,7 +527,7 @@ func (x UpdateConfig_UpdateOrder) String() string {
 	return proto.EnumName(UpdateConfig_UpdateOrder_name, int32(x))
 }
 func (UpdateConfig_UpdateOrder) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptorTypes, []int{15, 1}
+	return fileDescriptorTypes, []int{18, 1}
 }
 
 type UpdateStatus_UpdateState int32
@@ -562,7 +565,7 @@ func (x UpdateStatus_UpdateState) String() string {
 	return proto.EnumName(UpdateStatus_UpdateState_name, int32(x))
 }
 func (UpdateStatus_UpdateState) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptorTypes, []int{16, 0}
+	return fileDescriptorTypes, []int{19, 0}
 }
 
 // AddressFamily specifies the network address family that
@@ -590,7 +593,7 @@ func (x IPAMConfig_AddressFamily) String() string {
 	return proto.EnumName(IPAMConfig_AddressFamily_name, int32(x))
 }
 func (IPAMConfig_AddressFamily) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptorTypes, []int{21, 0}
+	return fileDescriptorTypes, []int{24, 0}
 }
 
 type PortConfig_Protocol int32
@@ -612,7 +615,7 @@ var PortConfig_Protocol_value = map[string]int32{
 func (x PortConfig_Protocol) String() string {
 	return proto.EnumName(PortConfig_Protocol_name, int32(x))
 }
-func (PortConfig_Protocol) EnumDescriptor() ([]byte, []int) { return fileDescriptorTypes, []int{22, 0} }
+func (PortConfig_Protocol) EnumDescriptor() ([]byte, []int) { return fileDescriptorTypes, []int{25, 0} }
 
 // PublishMode controls how ports are published on the swarm.
 type PortConfig_PublishMode int32
@@ -640,7 +643,7 @@ func (x PortConfig_PublishMode) String() string {
 	return proto.EnumName(PortConfig_PublishMode_name, int32(x))
 }
 func (PortConfig_PublishMode) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptorTypes, []int{22, 1}
+	return fileDescriptorTypes, []int{25, 1}
 }
 
 type IssuanceStatus_State int32
@@ -680,7 +683,7 @@ var IssuanceStatus_State_value = map[string]int32{
 func (x IssuanceStatus_State) String() string {
 	return proto.EnumName(IssuanceStatus_State_name, int32(x))
 }
-func (IssuanceStatus_State) EnumDescriptor() ([]byte, []int) { return fileDescriptorTypes, []int{27, 0} }
+func (IssuanceStatus_State) EnumDescriptor() ([]byte, []int) { return fileDescriptorTypes, []int{30, 0} }
 
 type ExternalCA_CAProtocol int32
 
@@ -699,7 +702,7 @@ func (x ExternalCA_CAProtocol) String() string {
 	return proto.EnumName(ExternalCA_CAProtocol_name, int32(x))
 }
 func (ExternalCA_CAProtocol) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptorTypes, []int{29, 0}
+	return fileDescriptorTypes, []int{32, 0}
 }
 
 // Encryption algorithm that can implemented using this key
@@ -720,7 +723,7 @@ func (x EncryptionKey_Algorithm) String() string {
 	return proto.EnumName(EncryptionKey_Algorithm_name, int32(x))
 }
 func (EncryptionKey_Algorithm) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptorTypes, []int{42, 0}
+	return fileDescriptorTypes, []int{45, 0}
 }
 
 type MaybeEncryptedRecord_Algorithm int32
@@ -743,7 +746,7 @@ func (x MaybeEncryptedRecord_Algorithm) String() string {
 	return proto.EnumName(MaybeEncryptedRecord_Algorithm_name, int32(x))
 }
 func (MaybeEncryptedRecord_Algorithm) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptorTypes, []int{49, 0}
+	return fileDescriptorTypes, []int{52, 0}
 }
 
 // Version tracks the last time an object in the store was updated.
@@ -778,16 +781,158 @@ func (m *Annotations) Reset()                    { *m = Annotations{} }
 func (*Annotations) ProtoMessage()               {}
 func (*Annotations) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{2} }
 
+type GenericString struct {
+	Kind  string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (m *GenericString) Reset()                    { *m = GenericString{} }
+func (*GenericString) ProtoMessage()               {}
+func (*GenericString) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{3} }
+
+type GenericDiscrete struct {
+	Kind  string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	Value int64  `protobuf:"varint,2,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (m *GenericDiscrete) Reset()                    { *m = GenericDiscrete{} }
+func (*GenericDiscrete) ProtoMessage()               {}
+func (*GenericDiscrete) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{4} }
+
+type GenericResource struct {
+	// Types that are valid to be assigned to Resource:
+	//	*GenericResource_Str
+	//	*GenericResource_Discrete
+	Resource isGenericResource_Resource `protobuf_oneof:"resource"`
+}
+
+func (m *GenericResource) Reset()                    { *m = GenericResource{} }
+func (*GenericResource) ProtoMessage()               {}
+func (*GenericResource) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{5} }
+
+type isGenericResource_Resource interface {
+	isGenericResource_Resource()
+	MarshalTo([]byte) (int, error)
+	Size() int
+}
+
+type GenericResource_Str struct {
+	Str *GenericString `protobuf:"bytes,1,opt,name=str,oneof"`
+}
+type GenericResource_Discrete struct {
+	Discrete *GenericDiscrete `protobuf:"bytes,2,opt,name=discrete,oneof"`
+}
+
+func (*GenericResource_Str) isGenericResource_Resource()      {}
+func (*GenericResource_Discrete) isGenericResource_Resource() {}
+
+func (m *GenericResource) GetResource() isGenericResource_Resource {
+	if m != nil {
+		return m.Resource
+	}
+	return nil
+}
+
+func (m *GenericResource) GetStr() *GenericString {
+	if x, ok := m.GetResource().(*GenericResource_Str); ok {
+		return x.Str
+	}
+	return nil
+}
+
+func (m *GenericResource) GetDiscrete() *GenericDiscrete {
+	if x, ok := m.GetResource().(*GenericResource_Discrete); ok {
+		return x.Discrete
+	}
+	return nil
+}
+
+// XXX_OneofFuncs is for the internal use of the proto package.
+func (*GenericResource) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
+	return _GenericResource_OneofMarshaler, _GenericResource_OneofUnmarshaler, _GenericResource_OneofSizer, []interface{}{
+		(*GenericResource_Str)(nil),
+		(*GenericResource_Discrete)(nil),
+	}
+}
+
+func _GenericResource_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
+	m := msg.(*GenericResource)
+	// resource
+	switch x := m.Resource.(type) {
+	case *GenericResource_Str:
+		_ = b.EncodeVarint(1<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.Str); err != nil {
+			return err
+		}
+	case *GenericResource_Discrete:
+		_ = b.EncodeVarint(2<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.Discrete); err != nil {
+			return err
+		}
+	case nil:
+	default:
+		return fmt.Errorf("GenericResource.Resource has unexpected type %T", x)
+	}
+	return nil
+}
+
+func _GenericResource_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
+	m := msg.(*GenericResource)
+	switch tag {
+	case 1: // resource.str
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(GenericString)
+		err := b.DecodeMessage(msg)
+		m.Resource = &GenericResource_Str{msg}
+		return true, err
+	case 2: // resource.discrete
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(GenericDiscrete)
+		err := b.DecodeMessage(msg)
+		m.Resource = &GenericResource_Discrete{msg}
+		return true, err
+	default:
+		return false, nil
+	}
+}
+
+func _GenericResource_OneofSizer(msg proto.Message) (n int) {
+	m := msg.(*GenericResource)
+	// resource
+	switch x := m.Resource.(type) {
+	case *GenericResource_Str:
+		s := proto.Size(x.Str)
+		n += proto.SizeVarint(1<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *GenericResource_Discrete:
+		s := proto.Size(x.Discrete)
+		n += proto.SizeVarint(2<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case nil:
+	default:
+		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
+	}
+	return n
+}
+
 type Resources struct {
 	// Amount of CPUs (e.g. 2000000000 = 2 CPU cores)
 	NanoCPUs int64 `protobuf:"varint,1,opt,name=nano_cpus,json=nanoCpus,proto3" json:"nano_cpus,omitempty"`
 	// Amount of memory in bytes.
 	MemoryBytes int64 `protobuf:"varint,2,opt,name=memory_bytes,json=memoryBytes,proto3" json:"memory_bytes,omitempty"`
+	// User specified resource (e.g: bananas=2;apple={red,yellow,green})
+	Generic []*GenericResource `protobuf:"bytes,3,rep,name=generic" json:"generic,omitempty"`
 }
 
 func (m *Resources) Reset()                    { *m = Resources{} }
 func (*Resources) ProtoMessage()               {}
-func (*Resources) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{3} }
+func (*Resources) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{6} }
 
 type ResourceRequirements struct {
 	Limits       *Resources `protobuf:"bytes,1,opt,name=limits" json:"limits,omitempty"`
@@ -796,7 +941,7 @@ type ResourceRequirements struct {
 
 func (m *ResourceRequirements) Reset()                    { *m = ResourceRequirements{} }
 func (*ResourceRequirements) ProtoMessage()               {}
-func (*ResourceRequirements) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{4} }
+func (*ResourceRequirements) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{7} }
 
 type Platform struct {
 	// Architecture (e.g. x86_64)
@@ -807,7 +952,7 @@ type Platform struct {
 
 func (m *Platform) Reset()                    { *m = Platform{} }
 func (*Platform) ProtoMessage()               {}
-func (*Platform) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{5} }
+func (*Platform) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{8} }
 
 // PluginDescription describes an engine plugin.
 type PluginDescription struct {
@@ -821,7 +966,7 @@ type PluginDescription struct {
 
 func (m *PluginDescription) Reset()                    { *m = PluginDescription{} }
 func (*PluginDescription) ProtoMessage()               {}
-func (*PluginDescription) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{6} }
+func (*PluginDescription) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{9} }
 
 type EngineDescription struct {
 	// Docker daemon version running on the node.
@@ -834,7 +979,7 @@ type EngineDescription struct {
 
 func (m *EngineDescription) Reset()                    { *m = EngineDescription{} }
 func (*EngineDescription) ProtoMessage()               {}
-func (*EngineDescription) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{7} }
+func (*EngineDescription) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{10} }
 
 type NodeDescription struct {
 	// Hostname of the node as reported by the agent.
@@ -852,7 +997,7 @@ type NodeDescription struct {
 
 func (m *NodeDescription) Reset()                    { *m = NodeDescription{} }
 func (*NodeDescription) ProtoMessage()               {}
-func (*NodeDescription) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{8} }
+func (*NodeDescription) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{11} }
 
 type NodeTLSInfo struct {
 	// Information about which root certs the node trusts
@@ -864,7 +1009,7 @@ type NodeTLSInfo struct {
 
 func (m *NodeTLSInfo) Reset()                    { *m = NodeTLSInfo{} }
 func (*NodeTLSInfo) ProtoMessage()               {}
-func (*NodeTLSInfo) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{9} }
+func (*NodeTLSInfo) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{12} }
 
 type RaftMemberStatus struct {
 	Leader       bool                          `protobuf:"varint,1,opt,name=leader,proto3" json:"leader,omitempty"`
@@ -874,7 +1019,7 @@ type RaftMemberStatus struct {
 
 func (m *RaftMemberStatus) Reset()                    { *m = RaftMemberStatus{} }
 func (*RaftMemberStatus) ProtoMessage()               {}
-func (*RaftMemberStatus) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{10} }
+func (*RaftMemberStatus) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{13} }
 
 type NodeStatus struct {
 	State   NodeStatus_State `protobuf:"varint,1,opt,name=state,proto3,enum=docker.swarmkit.v1.NodeStatus_State" json:"state,omitempty"`
@@ -885,7 +1030,7 @@ type NodeStatus struct {
 
 func (m *NodeStatus) Reset()                    { *m = NodeStatus{} }
 func (*NodeStatus) ProtoMessage()               {}
-func (*NodeStatus) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{11} }
+func (*NodeStatus) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{14} }
 
 type Image struct {
 	// reference is a docker image reference. This can include a rpository, tag
@@ -896,7 +1041,7 @@ type Image struct {
 
 func (m *Image) Reset()                    { *m = Image{} }
 func (*Image) ProtoMessage()               {}
-func (*Image) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{12} }
+func (*Image) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{15} }
 
 // Mount describes volume mounts for a container.
 //
@@ -931,7 +1076,7 @@ type Mount struct {
 
 func (m *Mount) Reset()                    { *m = Mount{} }
 func (*Mount) ProtoMessage()               {}
-func (*Mount) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{13} }
+func (*Mount) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{16} }
 
 // BindOptions specifies options that are specific to a bind mount.
 type Mount_BindOptions struct {
@@ -941,7 +1086,7 @@ type Mount_BindOptions struct {
 
 func (m *Mount_BindOptions) Reset()                    { *m = Mount_BindOptions{} }
 func (*Mount_BindOptions) ProtoMessage()               {}
-func (*Mount_BindOptions) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{13, 0} }
+func (*Mount_BindOptions) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{16, 0} }
 
 // VolumeOptions contains parameters for mounting the volume.
 type Mount_VolumeOptions struct {
@@ -958,7 +1103,7 @@ type Mount_VolumeOptions struct {
 
 func (m *Mount_VolumeOptions) Reset()                    { *m = Mount_VolumeOptions{} }
 func (*Mount_VolumeOptions) ProtoMessage()               {}
-func (*Mount_VolumeOptions) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{13, 1} }
+func (*Mount_VolumeOptions) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{16, 1} }
 
 type Mount_TmpfsOptions struct {
 	// Size sets the size of the tmpfs, in bytes.
@@ -976,7 +1121,7 @@ type Mount_TmpfsOptions struct {
 
 func (m *Mount_TmpfsOptions) Reset()                    { *m = Mount_TmpfsOptions{} }
 func (*Mount_TmpfsOptions) ProtoMessage()               {}
-func (*Mount_TmpfsOptions) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{13, 2} }
+func (*Mount_TmpfsOptions) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{16, 2} }
 
 type RestartPolicy struct {
 	Condition RestartPolicy_RestartCondition `protobuf:"varint,1,opt,name=condition,proto3,enum=docker.swarmkit.v1.RestartPolicy_RestartCondition" json:"condition,omitempty"`
@@ -994,7 +1139,7 @@ type RestartPolicy struct {
 
 func (m *RestartPolicy) Reset()                    { *m = RestartPolicy{} }
 func (*RestartPolicy) ProtoMessage()               {}
-func (*RestartPolicy) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{14} }
+func (*RestartPolicy) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{17} }
 
 // UpdateConfig specifies the rate and policy of updates.
 // TODO(aluzzardi): Consider making this a oneof with RollingStrategy and LockstepStrategy.
@@ -1034,7 +1179,7 @@ type UpdateConfig struct {
 
 func (m *UpdateConfig) Reset()                    { *m = UpdateConfig{} }
 func (*UpdateConfig) ProtoMessage()               {}
-func (*UpdateConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{15} }
+func (*UpdateConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{18} }
 
 // UpdateStatus is the status of an update in progress.
 type UpdateStatus struct {
@@ -1058,7 +1203,7 @@ type UpdateStatus struct {
 
 func (m *UpdateStatus) Reset()                    { *m = UpdateStatus{} }
 func (*UpdateStatus) ProtoMessage()               {}
-func (*UpdateStatus) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{16} }
+func (*UpdateStatus) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{19} }
 
 // Container specific status.
 type ContainerStatus struct {
@@ -1069,7 +1214,7 @@ type ContainerStatus struct {
 
 func (m *ContainerStatus) Reset()                    { *m = ContainerStatus{} }
 func (*ContainerStatus) ProtoMessage()               {}
-func (*ContainerStatus) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{17} }
+func (*ContainerStatus) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{20} }
 
 // PortStatus specifies the actual allocated runtime state of a list
 // of port configs.
@@ -1079,7 +1224,7 @@ type PortStatus struct {
 
 func (m *PortStatus) Reset()                    { *m = PortStatus{} }
 func (*PortStatus) ProtoMessage()               {}
-func (*PortStatus) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{18} }
+func (*PortStatus) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{21} }
 
 type TaskStatus struct {
 	// Note: can't use stdtime because this field is nullable.
@@ -1116,7 +1261,7 @@ type TaskStatus struct {
 
 func (m *TaskStatus) Reset()                    { *m = TaskStatus{} }
 func (*TaskStatus) ProtoMessage()               {}
-func (*TaskStatus) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{19} }
+func (*TaskStatus) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{22} }
 
 type isTaskStatus_RuntimeStatus interface {
 	isTaskStatus_RuntimeStatus()
@@ -1220,7 +1365,7 @@ type NetworkAttachmentConfig struct {
 
 func (m *NetworkAttachmentConfig) Reset()                    { *m = NetworkAttachmentConfig{} }
 func (*NetworkAttachmentConfig) ProtoMessage()               {}
-func (*NetworkAttachmentConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{20} }
+func (*NetworkAttachmentConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{23} }
 
 // IPAMConfig specifies parameters for IP Address Management.
 type IPAMConfig struct {
@@ -1241,7 +1386,7 @@ type IPAMConfig struct {
 
 func (m *IPAMConfig) Reset()                    { *m = IPAMConfig{} }
 func (*IPAMConfig) ProtoMessage()               {}
-func (*IPAMConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{21} }
+func (*IPAMConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{24} }
 
 // PortConfig specifies an exposed port which can be
 // addressed using the given name. This can be later queried
@@ -1267,7 +1412,7 @@ type PortConfig struct {
 
 func (m *PortConfig) Reset()                    { *m = PortConfig{} }
 func (*PortConfig) ProtoMessage()               {}
-func (*PortConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{22} }
+func (*PortConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{25} }
 
 // Driver is a generic driver type to be used throughout the API. For now, a
 // driver is simply a name and set of options. The field contents depend on the
@@ -1280,7 +1425,7 @@ type Driver struct {
 
 func (m *Driver) Reset()                    { *m = Driver{} }
 func (*Driver) ProtoMessage()               {}
-func (*Driver) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{23} }
+func (*Driver) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{26} }
 
 type IPAMOptions struct {
 	Driver  *Driver       `protobuf:"bytes,1,opt,name=driver" json:"driver,omitempty"`
@@ -1289,7 +1434,7 @@ type IPAMOptions struct {
 
 func (m *IPAMOptions) Reset()                    { *m = IPAMOptions{} }
 func (*IPAMOptions) ProtoMessage()               {}
-func (*IPAMOptions) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{24} }
+func (*IPAMOptions) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{27} }
 
 // Peer should be used anywhere where we are describing a remote peer.
 type Peer struct {
@@ -1299,7 +1444,7 @@ type Peer struct {
 
 func (m *Peer) Reset()                    { *m = Peer{} }
 func (*Peer) ProtoMessage()               {}
-func (*Peer) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{25} }
+func (*Peer) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{28} }
 
 // WeightedPeer should be used anywhere where we are describing a remote peer
 // with a weight.
@@ -1310,7 +1455,7 @@ type WeightedPeer struct {
 
 func (m *WeightedPeer) Reset()                    { *m = WeightedPeer{} }
 func (*WeightedPeer) ProtoMessage()               {}
-func (*WeightedPeer) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{26} }
+func (*WeightedPeer) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{29} }
 
 type IssuanceStatus struct {
 	State IssuanceStatus_State `protobuf:"varint,1,opt,name=state,proto3,enum=docker.swarmkit.v1.IssuanceStatus_State" json:"state,omitempty"`
@@ -1322,7 +1467,7 @@ type IssuanceStatus struct {
 
 func (m *IssuanceStatus) Reset()                    { *m = IssuanceStatus{} }
 func (*IssuanceStatus) ProtoMessage()               {}
-func (*IssuanceStatus) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{27} }
+func (*IssuanceStatus) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{30} }
 
 type AcceptancePolicy struct {
 	Policies []*AcceptancePolicy_RoleAdmissionPolicy `protobuf:"bytes,1,rep,name=policies" json:"policies,omitempty"`
@@ -1330,7 +1475,7 @@ type AcceptancePolicy struct {
 
 func (m *AcceptancePolicy) Reset()                    { *m = AcceptancePolicy{} }
 func (*AcceptancePolicy) ProtoMessage()               {}
-func (*AcceptancePolicy) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{28} }
+func (*AcceptancePolicy) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{31} }
 
 type AcceptancePolicy_RoleAdmissionPolicy struct {
 	Role NodeRole `protobuf:"varint,1,opt,name=role,proto3,enum=docker.swarmkit.v1.NodeRole" json:"role,omitempty"`
@@ -1345,7 +1490,7 @@ type AcceptancePolicy_RoleAdmissionPolicy struct {
 func (m *AcceptancePolicy_RoleAdmissionPolicy) Reset()      { *m = AcceptancePolicy_RoleAdmissionPolicy{} }
 func (*AcceptancePolicy_RoleAdmissionPolicy) ProtoMessage() {}
 func (*AcceptancePolicy_RoleAdmissionPolicy) Descriptor() ([]byte, []int) {
-	return fileDescriptorTypes, []int{28, 0}
+	return fileDescriptorTypes, []int{31, 0}
 }
 
 type AcceptancePolicy_RoleAdmissionPolicy_Secret struct {
@@ -1360,7 +1505,7 @@ func (m *AcceptancePolicy_RoleAdmissionPolicy_Secret) Reset() {
 }
 func (*AcceptancePolicy_RoleAdmissionPolicy_Secret) ProtoMessage() {}
 func (*AcceptancePolicy_RoleAdmissionPolicy_Secret) Descriptor() ([]byte, []int) {
-	return fileDescriptorTypes, []int{28, 0, 0}
+	return fileDescriptorTypes, []int{31, 0, 0}
 }
 
 type ExternalCA struct {
@@ -1377,7 +1522,7 @@ type ExternalCA struct {
 
 func (m *ExternalCA) Reset()                    { *m = ExternalCA{} }
 func (*ExternalCA) ProtoMessage()               {}
-func (*ExternalCA) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{29} }
+func (*ExternalCA) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{32} }
 
 type CAConfig struct {
 	// NodeCertExpiry is the duration certificates should be issued for
@@ -1402,7 +1547,7 @@ type CAConfig struct {
 
 func (m *CAConfig) Reset()                    { *m = CAConfig{} }
 func (*CAConfig) ProtoMessage()               {}
-func (*CAConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{30} }
+func (*CAConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{33} }
 
 // OrchestrationConfig defines cluster-level orchestration settings.
 type OrchestrationConfig struct {
@@ -1413,7 +1558,7 @@ type OrchestrationConfig struct {
 
 func (m *OrchestrationConfig) Reset()                    { *m = OrchestrationConfig{} }
 func (*OrchestrationConfig) ProtoMessage()               {}
-func (*OrchestrationConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{31} }
+func (*OrchestrationConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{34} }
 
 // TaskDefaults specifies default values for task creation.
 type TaskDefaults struct {
@@ -1427,7 +1572,7 @@ type TaskDefaults struct {
 
 func (m *TaskDefaults) Reset()                    { *m = TaskDefaults{} }
 func (*TaskDefaults) ProtoMessage()               {}
-func (*TaskDefaults) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{32} }
+func (*TaskDefaults) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{35} }
 
 // DispatcherConfig defines cluster-level dispatcher settings.
 type DispatcherConfig struct {
@@ -1439,7 +1584,7 @@ type DispatcherConfig struct {
 
 func (m *DispatcherConfig) Reset()                    { *m = DispatcherConfig{} }
 func (*DispatcherConfig) ProtoMessage()               {}
-func (*DispatcherConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{33} }
+func (*DispatcherConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{36} }
 
 // RaftConfig defines raft settings for the cluster.
 type RaftConfig struct {
@@ -1461,7 +1606,7 @@ type RaftConfig struct {
 
 func (m *RaftConfig) Reset()                    { *m = RaftConfig{} }
 func (*RaftConfig) ProtoMessage()               {}
-func (*RaftConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{34} }
+func (*RaftConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{37} }
 
 type EncryptionConfig struct {
 	// AutoLockManagers specifies whether or not managers TLS keys and raft data
@@ -1472,7 +1617,7 @@ type EncryptionConfig struct {
 
 func (m *EncryptionConfig) Reset()                    { *m = EncryptionConfig{} }
 func (*EncryptionConfig) ProtoMessage()               {}
-func (*EncryptionConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{35} }
+func (*EncryptionConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{38} }
 
 type SpreadOver struct {
 	SpreadDescriptor string `protobuf:"bytes,1,opt,name=spread_descriptor,json=spreadDescriptor,proto3" json:"spread_descriptor,omitempty"`
@@ -1480,7 +1625,7 @@ type SpreadOver struct {
 
 func (m *SpreadOver) Reset()                    { *m = SpreadOver{} }
 func (*SpreadOver) ProtoMessage()               {}
-func (*SpreadOver) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{36} }
+func (*SpreadOver) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{39} }
 
 type PlacementPreference struct {
 	// Types that are valid to be assigned to Preference:
@@ -1490,7 +1635,7 @@ type PlacementPreference struct {
 
 func (m *PlacementPreference) Reset()                    { *m = PlacementPreference{} }
 func (*PlacementPreference) ProtoMessage()               {}
-func (*PlacementPreference) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{37} }
+func (*PlacementPreference) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{40} }
 
 type isPlacementPreference_Preference interface {
 	isPlacementPreference_Preference()
@@ -1589,7 +1734,7 @@ type Placement struct {
 
 func (m *Placement) Reset()                    { *m = Placement{} }
 func (*Placement) ProtoMessage()               {}
-func (*Placement) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{38} }
+func (*Placement) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{41} }
 
 // JoinToken contains the join tokens for workers and managers.
 type JoinTokens struct {
@@ -1601,7 +1746,7 @@ type JoinTokens struct {
 
 func (m *JoinTokens) Reset()                    { *m = JoinTokens{} }
 func (*JoinTokens) ProtoMessage()               {}
-func (*JoinTokens) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{39} }
+func (*JoinTokens) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{42} }
 
 type RootCA struct {
 	// CAKey is the root CA private key.
@@ -1622,7 +1767,7 @@ type RootCA struct {
 
 func (m *RootCA) Reset()                    { *m = RootCA{} }
 func (*RootCA) ProtoMessage()               {}
-func (*RootCA) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{40} }
+func (*RootCA) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{43} }
 
 type Certificate struct {
 	Role        NodeRole       `protobuf:"varint,1,opt,name=role,proto3,enum=docker.swarmkit.v1.NodeRole" json:"role,omitempty"`
@@ -1635,7 +1780,7 @@ type Certificate struct {
 
 func (m *Certificate) Reset()                    { *m = Certificate{} }
 func (*Certificate) ProtoMessage()               {}
-func (*Certificate) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{41} }
+func (*Certificate) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{44} }
 
 // Symmetric keys to encrypt inter-agent communication.
 type EncryptionKey struct {
@@ -1651,7 +1796,7 @@ type EncryptionKey struct {
 
 func (m *EncryptionKey) Reset()                    { *m = EncryptionKey{} }
 func (*EncryptionKey) ProtoMessage()               {}
-func (*EncryptionKey) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{42} }
+func (*EncryptionKey) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{45} }
 
 // ManagerStatus provides informations about the state of a manager in the cluster.
 type ManagerStatus struct {
@@ -1668,7 +1813,7 @@ type ManagerStatus struct {
 
 func (m *ManagerStatus) Reset()                    { *m = ManagerStatus{} }
 func (*ManagerStatus) ProtoMessage()               {}
-func (*ManagerStatus) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{43} }
+func (*ManagerStatus) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{46} }
 
 // FileTarget represents a specific target that is backed by a file
 type FileTarget struct {
@@ -1684,7 +1829,7 @@ type FileTarget struct {
 
 func (m *FileTarget) Reset()                    { *m = FileTarget{} }
 func (*FileTarget) ProtoMessage()               {}
-func (*FileTarget) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{44} }
+func (*FileTarget) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{47} }
 
 // SecretReference is the linkage between a service and a secret that it uses.
 type SecretReference struct {
@@ -1704,7 +1849,7 @@ type SecretReference struct {
 
 func (m *SecretReference) Reset()                    { *m = SecretReference{} }
 func (*SecretReference) ProtoMessage()               {}
-func (*SecretReference) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{45} }
+func (*SecretReference) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{48} }
 
 type isSecretReference_Target interface {
 	isSecretReference_Target()
@@ -1804,7 +1949,7 @@ type ConfigReference struct {
 
 func (m *ConfigReference) Reset()                    { *m = ConfigReference{} }
 func (*ConfigReference) ProtoMessage()               {}
-func (*ConfigReference) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{46} }
+func (*ConfigReference) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{49} }
 
 type isConfigReference_Target interface {
 	isConfigReference_Target()
@@ -1898,7 +2043,7 @@ type BlacklistedCertificate struct {
 
 func (m *BlacklistedCertificate) Reset()                    { *m = BlacklistedCertificate{} }
 func (*BlacklistedCertificate) ProtoMessage()               {}
-func (*BlacklistedCertificate) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{47} }
+func (*BlacklistedCertificate) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{50} }
 
 // HealthConfig holds configuration settings for the HEALTHCHECK feature.
 type HealthConfig struct {
@@ -1928,7 +2073,7 @@ type HealthConfig struct {
 
 func (m *HealthConfig) Reset()                    { *m = HealthConfig{} }
 func (*HealthConfig) ProtoMessage()               {}
-func (*HealthConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{48} }
+func (*HealthConfig) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{51} }
 
 type MaybeEncryptedRecord struct {
 	Algorithm MaybeEncryptedRecord_Algorithm `protobuf:"varint,1,opt,name=algorithm,proto3,enum=docker.swarmkit.v1.MaybeEncryptedRecord_Algorithm" json:"algorithm,omitempty"`
@@ -1938,7 +2083,7 @@ type MaybeEncryptedRecord struct {
 
 func (m *MaybeEncryptedRecord) Reset()                    { *m = MaybeEncryptedRecord{} }
 func (*MaybeEncryptedRecord) ProtoMessage()               {}
-func (*MaybeEncryptedRecord) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{49} }
+func (*MaybeEncryptedRecord) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{52} }
 
 type RootRotation struct {
 	CACert []byte `protobuf:"bytes,1,opt,name=ca_cert,json=caCert,proto3" json:"ca_cert,omitempty"`
@@ -1949,7 +2094,7 @@ type RootRotation struct {
 
 func (m *RootRotation) Reset()                    { *m = RootRotation{} }
 func (*RootRotation) ProtoMessage()               {}
-func (*RootRotation) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{50} }
+func (*RootRotation) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{53} }
 
 // Privileges specifies security configuration/permissions.
 type Privileges struct {
@@ -1959,7 +2104,7 @@ type Privileges struct {
 
 func (m *Privileges) Reset()                    { *m = Privileges{} }
 func (*Privileges) ProtoMessage()               {}
-func (*Privileges) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{51} }
+func (*Privileges) Descriptor() ([]byte, []int) { return fileDescriptorTypes, []int{54} }
 
 // CredentialSpec for managed service account (Windows only).
 type Privileges_CredentialSpec struct {
@@ -1972,7 +2117,7 @@ type Privileges_CredentialSpec struct {
 func (m *Privileges_CredentialSpec) Reset()      { *m = Privileges_CredentialSpec{} }
 func (*Privileges_CredentialSpec) ProtoMessage() {}
 func (*Privileges_CredentialSpec) Descriptor() ([]byte, []int) {
-	return fileDescriptorTypes, []int{51, 0}
+	return fileDescriptorTypes, []int{54, 0}
 }
 
 type isPrivileges_CredentialSpec_Source interface {
@@ -2090,13 +2235,16 @@ type Privileges_SELinuxContext struct {
 func (m *Privileges_SELinuxContext) Reset()      { *m = Privileges_SELinuxContext{} }
 func (*Privileges_SELinuxContext) ProtoMessage() {}
 func (*Privileges_SELinuxContext) Descriptor() ([]byte, []int) {
-	return fileDescriptorTypes, []int{51, 1}
+	return fileDescriptorTypes, []int{54, 1}
 }
 
 func init() {
 	proto.RegisterType((*Version)(nil), "docker.swarmkit.v1.Version")
 	proto.RegisterType((*IndexEntry)(nil), "docker.swarmkit.v1.IndexEntry")
 	proto.RegisterType((*Annotations)(nil), "docker.swarmkit.v1.Annotations")
+	proto.RegisterType((*GenericString)(nil), "docker.swarmkit.v1.GenericString")
+	proto.RegisterType((*GenericDiscrete)(nil), "docker.swarmkit.v1.GenericDiscrete")
+	proto.RegisterType((*GenericResource)(nil), "docker.swarmkit.v1.GenericResource")
 	proto.RegisterType((*Resources)(nil), "docker.swarmkit.v1.Resources")
 	proto.RegisterType((*ResourceRequirements)(nil), "docker.swarmkit.v1.ResourceRequirements")
 	proto.RegisterType((*Platform)(nil), "docker.swarmkit.v1.Platform")
@@ -2231,6 +2379,68 @@ func (m *Annotations) CopyFrom(src interface{}) {
 
 }
 
+func (m *GenericString) Copy() *GenericString {
+	if m == nil {
+		return nil
+	}
+	o := &GenericString{}
+	o.CopyFrom(m)
+	return o
+}
+
+func (m *GenericString) CopyFrom(src interface{}) {
+
+	o := src.(*GenericString)
+	*m = *o
+}
+
+func (m *GenericDiscrete) Copy() *GenericDiscrete {
+	if m == nil {
+		return nil
+	}
+	o := &GenericDiscrete{}
+	o.CopyFrom(m)
+	return o
+}
+
+func (m *GenericDiscrete) CopyFrom(src interface{}) {
+
+	o := src.(*GenericDiscrete)
+	*m = *o
+}
+
+func (m *GenericResource) Copy() *GenericResource {
+	if m == nil {
+		return nil
+	}
+	o := &GenericResource{}
+	o.CopyFrom(m)
+	return o
+}
+
+func (m *GenericResource) CopyFrom(src interface{}) {
+
+	o := src.(*GenericResource)
+	*m = *o
+	if o.Resource != nil {
+		switch o.Resource.(type) {
+		case *GenericResource_Str:
+			v := GenericResource_Str{
+				Str: &GenericString{},
+			}
+			github_com_docker_swarmkit_api_deepcopy.Copy(v.Str, o.GetStr())
+			m.Resource = &v
+		case *GenericResource_Discrete:
+			v := GenericResource_Discrete{
+				Discrete: &GenericDiscrete{},
+			}
+			github_com_docker_swarmkit_api_deepcopy.Copy(v.Discrete, o.GetDiscrete())
+			m.Resource = &v
+		}
+	}
+
+}
+
 func (m *Resources) Copy() *Resources {
 	if m == nil {
 		return nil
@@ -2244,6 +2454,14 @@ func (m *Resources) CopyFrom(src interface{}) {
 
 	o := src.(*Resources)
 	*m = *o
+	if o.Generic != nil {
+		m.Generic = make([]*GenericResource, len(o.Generic))
+		for i := range m.Generic {
+			m.Generic[i] = &GenericResource{}
+			github_com_docker_swarmkit_api_deepcopy.Copy(m.Generic[i], o.Generic[i])
+		}
+	}
+
 }
 
 func (m *ResourceRequirements) Copy() *ResourceRequirements {
@@ -3544,6 +3762,118 @@ func (m *Annotations) MarshalTo(dAtA []byte) (int, error) {
 	return i, nil
 }
 
+func (m *GenericString) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GenericString) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.Kind) > 0 {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Kind)))
+		i += copy(dAtA[i:], m.Kind)
+	}
+	if len(m.Value) > 0 {
+		dAtA[i] = 0x12
+		i++
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Value)))
+		i += copy(dAtA[i:], m.Value)
+	}
+	return i, nil
+}
+
+func (m *GenericDiscrete) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GenericDiscrete) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.Kind) > 0 {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintTypes(dAtA, i, uint64(len(m.Kind)))
+		i += copy(dAtA[i:], m.Kind)
+	}
+	if m.Value != 0 {
+		dAtA[i] = 0x10
+		i++
+		i = encodeVarintTypes(dAtA, i, uint64(m.Value))
+	}
+	return i, nil
+}
+
+func (m *GenericResource) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GenericResource) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if m.Resource != nil {
+		nn1, err := m.Resource.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += nn1
+	}
+	return i, nil
+}
+
+func (m *GenericResource_Str) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	if m.Str != nil {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintTypes(dAtA, i, uint64(m.Str.Size()))
+		n2, err := m.Str.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n2
+	}
+	return i, nil
+}
+func (m *GenericResource_Discrete) MarshalTo(dAtA []byte) (int, error) {
+	i := 0
+	if m.Discrete != nil {
+		dAtA[i] = 0x12
+		i++
+		i = encodeVarintTypes(dAtA, i, uint64(m.Discrete.Size()))
+		n3, err := m.Discrete.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n3
+	}
+	return i, nil
+}
 func (m *Resources) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -3569,6 +3899,18 @@ func (m *Resources) MarshalTo(dAtA []byte) (int, error) {
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.MemoryBytes))
 	}
+	if len(m.Generic) > 0 {
+		for _, msg := range m.Generic {
+			dAtA[i] = 0x1a
+			i++
+			i = encodeVarintTypes(dAtA, i, uint64(msg.Size()))
+			n, err := msg.MarshalTo(dAtA[i:])
+			if err != nil {
+				return 0, err
+			}
+			i += n
+		}
+	}
 	return i, nil
 }
 
@@ -3591,21 +3933,21 @@ func (m *ResourceRequirements) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0xa
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Limits.Size()))
-		n1, err := m.Limits.MarshalTo(dAtA[i:])
+		n4, err := m.Limits.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n1
+		i += n4
 	}
 	if m.Reservations != nil {
 		dAtA[i] = 0x12
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Reservations.Size()))
-		n2, err := m.Reservations.MarshalTo(dAtA[i:])
+		n5, err := m.Reservations.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n2
+		i += n5
 	}
 	return i, nil
 }
@@ -3748,41 +4090,41 @@ func (m *NodeDescription) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x12
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Platform.Size()))
-		n3, err := m.Platform.MarshalTo(dAtA[i:])
+		n6, err := m.Platform.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n3
+		i += n6
 	}
 	if m.Resources != nil {
 		dAtA[i] = 0x1a
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Resources.Size()))
-		n4, err := m.Resources.MarshalTo(dAtA[i:])
+		n7, err := m.Resources.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n4
+		i += n7
 	}
 	if m.Engine != nil {
 		dAtA[i] = 0x22
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Engine.Size()))
-		n5, err := m.Engine.MarshalTo(dAtA[i:])
+		n8, err := m.Engine.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n5
+		i += n8
 	}
 	if m.TLSInfo != nil {
 		dAtA[i] = 0x2a
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.TLSInfo.Size()))
-		n6, err := m.TLSInfo.MarshalTo(dAtA[i:])
+		n9, err := m.TLSInfo.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n6
+		i += n9
 	}
 	return i, nil
 }
@@ -3967,31 +4309,31 @@ func (m *Mount) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x2a
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.BindOptions.Size()))
-		n7, err := m.BindOptions.MarshalTo(dAtA[i:])
+		n10, err := m.BindOptions.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n7
+		i += n10
 	}
 	if m.VolumeOptions != nil {
 		dAtA[i] = 0x32
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.VolumeOptions.Size()))
-		n8, err := m.VolumeOptions.MarshalTo(dAtA[i:])
+		n11, err := m.VolumeOptions.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n8
+		i += n11
 	}
 	if m.TmpfsOptions != nil {
 		dAtA[i] = 0x3a
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.TmpfsOptions.Size()))
-		n9, err := m.TmpfsOptions.MarshalTo(dAtA[i:])
+		n12, err := m.TmpfsOptions.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n9
+		i += n12
 	}
 	return i, nil
 }
@@ -4065,11 +4407,11 @@ func (m *Mount_VolumeOptions) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x1a
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.DriverConfig.Size()))
-		n10, err := m.DriverConfig.MarshalTo(dAtA[i:])
+		n13, err := m.DriverConfig.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n10
+		i += n13
 	}
 	return i, nil
 }
@@ -4126,11 +4468,11 @@ func (m *RestartPolicy) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x12
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Delay.Size()))
-		n11, err := m.Delay.MarshalTo(dAtA[i:])
+		n14, err := m.Delay.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n11
+		i += n14
 	}
 	if m.MaxAttempts != 0 {
 		dAtA[i] = 0x18
@@ -4141,11 +4483,11 @@ func (m *RestartPolicy) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x22
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Window.Size()))
-		n12, err := m.Window.MarshalTo(dAtA[i:])
+		n15, err := m.Window.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n12
+		i += n15
 	}
 	return i, nil
 }
@@ -4173,11 +4515,11 @@ func (m *UpdateConfig) MarshalTo(dAtA []byte) (int, error) {
 	dAtA[i] = 0x12
 	i++
 	i = encodeVarintTypes(dAtA, i, uint64(github_com_gogo_protobuf_types.SizeOfStdDuration(m.Delay)))
-	n13, err := github_com_gogo_protobuf_types.StdDurationMarshalTo(m.Delay, dAtA[i:])
+	n16, err := github_com_gogo_protobuf_types.StdDurationMarshalTo(m.Delay, dAtA[i:])
 	if err != nil {
 		return 0, err
 	}
-	i += n13
+	i += n16
 	if m.FailureAction != 0 {
 		dAtA[i] = 0x18
 		i++
@@ -4187,11 +4529,11 @@ func (m *UpdateConfig) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x22
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Monitor.Size()))
-		n14, err := m.Monitor.MarshalTo(dAtA[i:])
+		n17, err := m.Monitor.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n14
+		i += n17
 	}
 	if m.MaxFailureRatio != 0 {
 		dAtA[i] = 0x2d
@@ -4230,21 +4572,21 @@ func (m *UpdateStatus) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x12
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.StartedAt.Size()))
-		n15, err := m.StartedAt.MarshalTo(dAtA[i:])
+		n18, err := m.StartedAt.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n15
+		i += n18
 	}
 	if m.CompletedAt != nil {
 		dAtA[i] = 0x1a
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.CompletedAt.Size()))
-		n16, err := m.CompletedAt.MarshalTo(dAtA[i:])
+		n19, err := m.CompletedAt.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n16
+		i += n19
 	}
 	if len(m.Message) > 0 {
 		dAtA[i] = 0x22
@@ -4338,11 +4680,11 @@ func (m *TaskStatus) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0xa
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Timestamp.Size()))
-		n17, err := m.Timestamp.MarshalTo(dAtA[i:])
+		n20, err := m.Timestamp.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n17
+		i += n20
 	}
 	if m.State != 0 {
 		dAtA[i] = 0x10
@@ -4362,21 +4704,21 @@ func (m *TaskStatus) MarshalTo(dAtA []byte) (int, error) {
 		i += copy(dAtA[i:], m.Err)
 	}
 	if m.RuntimeStatus != nil {
-		nn18, err := m.RuntimeStatus.MarshalTo(dAtA[i:])
+		nn21, err := m.RuntimeStatus.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += nn18
+		i += nn21
 	}
 	if m.PortStatus != nil {
 		dAtA[i] = 0x32
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.PortStatus.Size()))
-		n19, err := m.PortStatus.MarshalTo(dAtA[i:])
+		n22, err := m.PortStatus.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n19
+		i += n22
 	}
 	return i, nil
 }
@@ -4387,11 +4729,11 @@ func (m *TaskStatus_Container) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x2a
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Container.Size()))
-		n20, err := m.Container.MarshalTo(dAtA[i:])
+		n23, err := m.Container.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n20
+		i += n23
 	}
 	return i, nil
 }
@@ -4628,11 +4970,11 @@ func (m *IPAMOptions) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0xa
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Driver.Size()))
-		n21, err := m.Driver.MarshalTo(dAtA[i:])
+		n24, err := m.Driver.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n21
+		i += n24
 	}
 	if len(m.Configs) > 0 {
 		for _, msg := range m.Configs {
@@ -4698,11 +5040,11 @@ func (m *WeightedPeer) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0xa
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Peer.Size()))
-		n22, err := m.Peer.MarshalTo(dAtA[i:])
+		n25, err := m.Peer.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n22
+		i += n25
 	}
 	if m.Weight != 0 {
 		dAtA[i] = 0x10
@@ -4805,11 +5147,11 @@ func (m *AcceptancePolicy_RoleAdmissionPolicy) MarshalTo(dAtA []byte) (int, erro
 		dAtA[i] = 0x1a
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Secret.Size()))
-		n23, err := m.Secret.MarshalTo(dAtA[i:])
+		n26, err := m.Secret.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n23
+		i += n26
 	}
 	return i, nil
 }
@@ -4915,11 +5257,11 @@ func (m *CAConfig) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0xa
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.NodeCertExpiry.Size()))
-		n24, err := m.NodeCertExpiry.MarshalTo(dAtA[i:])
+		n27, err := m.NodeCertExpiry.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n24
+		i += n27
 	}
 	if len(m.ExternalCAs) > 0 {
 		for _, msg := range m.ExternalCAs {
@@ -4995,11 +5337,11 @@ func (m *TaskDefaults) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0xa
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.LogDriver.Size()))
-		n25, err := m.LogDriver.MarshalTo(dAtA[i:])
+		n28, err := m.LogDriver.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n25
+		i += n28
 	}
 	return i, nil
 }
@@ -5023,11 +5365,11 @@ func (m *DispatcherConfig) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0xa
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.HeartbeatPeriod.Size()))
-		n26, err := m.HeartbeatPeriod.MarshalTo(dAtA[i:])
+		n29, err := m.HeartbeatPeriod.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n26
+		i += n29
 	}
 	return i, nil
 }
@@ -5143,11 +5485,11 @@ func (m *PlacementPreference) MarshalTo(dAtA []byte) (int, error) {
 	var l int
 	_ = l
 	if m.Preference != nil {
-		nn27, err := m.Preference.MarshalTo(dAtA[i:])
+		nn30, err := m.Preference.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += nn27
+		i += nn30
 	}
 	return i, nil
 }
@@ -5158,11 +5500,11 @@ func (m *PlacementPreference_Spread) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0xa
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Spread.Size()))
-		n28, err := m.Spread.MarshalTo(dAtA[i:])
+		n31, err := m.Spread.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n28
+		i += n31
 	}
 	return i, nil
 }
@@ -5289,20 +5631,20 @@ func (m *RootCA) MarshalTo(dAtA []byte) (int, error) {
 	dAtA[i] = 0x22
 	i++
 	i = encodeVarintTypes(dAtA, i, uint64(m.JoinTokens.Size()))
-	n29, err := m.JoinTokens.MarshalTo(dAtA[i:])
+	n32, err := m.JoinTokens.MarshalTo(dAtA[i:])
 	if err != nil {
 		return 0, err
 	}
-	i += n29
+	i += n32
 	if m.RootRotation != nil {
 		dAtA[i] = 0x2a
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.RootRotation.Size()))
-		n30, err := m.RootRotation.MarshalTo(dAtA[i:])
+		n33, err := m.RootRotation.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n30
+		i += n33
 	}
 	if m.LastForcedRotation != 0 {
 		dAtA[i] = 0x30
@@ -5341,11 +5683,11 @@ func (m *Certificate) MarshalTo(dAtA []byte) (int, error) {
 	dAtA[i] = 0x1a
 	i++
 	i = encodeVarintTypes(dAtA, i, uint64(m.Status.Size()))
-	n31, err := m.Status.MarshalTo(dAtA[i:])
+	n34, err := m.Status.MarshalTo(dAtA[i:])
 	if err != nil {
 		return 0, err
 	}
-	i += n31
+	i += n34
 	if len(m.Certificate) > 0 {
 		dAtA[i] = 0x22
 		i++
@@ -5514,11 +5856,11 @@ func (m *SecretReference) MarshalTo(dAtA []byte) (int, error) {
 		i += copy(dAtA[i:], m.SecretName)
 	}
 	if m.Target != nil {
-		nn32, err := m.Target.MarshalTo(dAtA[i:])
+		nn35, err := m.Target.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += nn32
+		i += nn35
 	}
 	return i, nil
 }
@@ -5529,11 +5871,11 @@ func (m *SecretReference_File) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x1a
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.File.Size()))
-		n33, err := m.File.MarshalTo(dAtA[i:])
+		n36, err := m.File.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n33
+		i += n36
 	}
 	return i, nil
 }
@@ -5565,11 +5907,11 @@ func (m *ConfigReference) MarshalTo(dAtA []byte) (int, error) {
 		i += copy(dAtA[i:], m.ConfigName)
 	}
 	if m.Target != nil {
-		nn34, err := m.Target.MarshalTo(dAtA[i:])
+		nn37, err := m.Target.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += nn34
+		i += nn37
 	}
 	return i, nil
 }
@@ -5580,11 +5922,11 @@ func (m *ConfigReference_File) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x1a
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.File.Size()))
-		n35, err := m.File.MarshalTo(dAtA[i:])
+		n38, err := m.File.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n35
+		i += n38
 	}
 	return i, nil
 }
@@ -5607,11 +5949,11 @@ func (m *BlacklistedCertificate) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0xa
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Expiry.Size()))
-		n36, err := m.Expiry.MarshalTo(dAtA[i:])
+		n39, err := m.Expiry.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n36
+		i += n39
 	}
 	return i, nil
 }
@@ -5650,21 +5992,21 @@ func (m *HealthConfig) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x12
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Interval.Size()))
-		n37, err := m.Interval.MarshalTo(dAtA[i:])
+		n40, err := m.Interval.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n37
+		i += n40
 	}
 	if m.Timeout != nil {
 		dAtA[i] = 0x1a
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.Timeout.Size()))
-		n38, err := m.Timeout.MarshalTo(dAtA[i:])
+		n41, err := m.Timeout.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n38
+		i += n41
 	}
 	if m.Retries != 0 {
 		dAtA[i] = 0x20
@@ -5675,11 +6017,11 @@ func (m *HealthConfig) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x2a
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.StartPeriod.Size()))
-		n39, err := m.StartPeriod.MarshalTo(dAtA[i:])
+		n42, err := m.StartPeriod.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n39
+		i += n42
 	}
 	return i, nil
 }
@@ -5774,21 +6116,21 @@ func (m *Privileges) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0xa
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.CredentialSpec.Size()))
-		n40, err := m.CredentialSpec.MarshalTo(dAtA[i:])
+		n43, err := m.CredentialSpec.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n40
+		i += n43
 	}
 	if m.SELinuxContext != nil {
 		dAtA[i] = 0x12
 		i++
 		i = encodeVarintTypes(dAtA, i, uint64(m.SELinuxContext.Size()))
-		n41, err := m.SELinuxContext.MarshalTo(dAtA[i:])
+		n44, err := m.SELinuxContext.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n41
+		i += n44
 	}
 	return i, nil
 }
@@ -5809,11 +6151,11 @@ func (m *Privileges_CredentialSpec) MarshalTo(dAtA []byte) (int, error) {
 	var l int
 	_ = l
 	if m.Source != nil {
-		nn42, err := m.Source.MarshalTo(dAtA[i:])
+		nn45, err := m.Source.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += nn42
+		i += nn45
 	}
 	return i, nil
 }
@@ -5961,6 +6303,60 @@ func (m *Annotations) Size() (n int) {
 	return n
 }
 
+func (m *GenericString) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.Kind)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	l = len(m.Value)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	return n
+}
+
+func (m *GenericDiscrete) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.Kind)
+	if l > 0 {
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	if m.Value != 0 {
+		n += 1 + sovTypes(uint64(m.Value))
+	}
+	return n
+}
+
+func (m *GenericResource) Size() (n int) {
+	var l int
+	_ = l
+	if m.Resource != nil {
+		n += m.Resource.Size()
+	}
+	return n
+}
+
+func (m *GenericResource_Str) Size() (n int) {
+	var l int
+	_ = l
+	if m.Str != nil {
+		l = m.Str.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	return n
+}
+func (m *GenericResource_Discrete) Size() (n int) {
+	var l int
+	_ = l
+	if m.Discrete != nil {
+		l = m.Discrete.Size()
+		n += 1 + l + sovTypes(uint64(l))
+	}
+	return n
+}
 func (m *Resources) Size() (n int) {
 	var l int
 	_ = l
@@ -5970,6 +6366,12 @@ func (m *Resources) Size() (n int) {
 	if m.MemoryBytes != 0 {
 		n += 1 + sovTypes(uint64(m.MemoryBytes))
 	}
+	if len(m.Generic) > 0 {
+		for _, e := range m.Generic {
+			l = e.Size()
+			n += 1 + l + sovTypes(uint64(l))
+		}
+	}
 	return n
 }
 
@@ -7056,6 +7458,58 @@ func (this *Annotations) String() string {
 	}, "")
 	return s
 }
+func (this *GenericString) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&GenericString{`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`Value:` + fmt.Sprintf("%v", this.Value) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *GenericDiscrete) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&GenericDiscrete{`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`Value:` + fmt.Sprintf("%v", this.Value) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *GenericResource) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&GenericResource{`,
+		`Resource:` + fmt.Sprintf("%v", this.Resource) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *GenericResource_Str) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&GenericResource_Str{`,
+		`Str:` + strings.Replace(fmt.Sprintf("%v", this.Str), "GenericString", "GenericString", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *GenericResource_Discrete) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&GenericResource_Discrete{`,
+		`Discrete:` + strings.Replace(fmt.Sprintf("%v", this.Discrete), "GenericDiscrete", "GenericDiscrete", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
 func (this *Resources) String() string {
 	if this == nil {
 		return "nil"
@@ -7063,6 +7517,7 @@ func (this *Resources) String() string {
 	s := strings.Join([]string{`&Resources{`,
 		`NanoCPUs:` + fmt.Sprintf("%v", this.NanoCPUs) + `,`,
 		`MemoryBytes:` + fmt.Sprintf("%v", this.MemoryBytes) + `,`,
+		`Generic:` + strings.Replace(fmt.Sprintf("%v", this.Generic), "GenericResource", "GenericResource", 1) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -8258,6 +8713,326 @@ func (m *Annotations) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *GenericString) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GenericString: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GenericString: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Value = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GenericDiscrete) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GenericDiscrete: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GenericDiscrete: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+			}
+			m.Value = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Value |= (int64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GenericResource) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowTypes
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GenericResource: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GenericResource: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Str", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &GenericString{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Resource = &GenericResource_Str{v}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Discrete", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &GenericDiscrete{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Resource = &GenericResource_Discrete{v}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipTypes(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthTypes
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *Resources) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -8325,6 +9100,37 @@ func (m *Resources) Unmarshal(dAtA []byte) error {
 					break
 				}
 			}
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Generic", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTypes
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthTypes
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Generic = append(m.Generic, &GenericResource{})
+			if err := m.Generic[len(m.Generic)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTypes(dAtA[iNdEx:])
@@ -16245,300 +17051,306 @@ var (
 func init() { proto.RegisterFile("types.proto", fileDescriptorTypes) }
 
 var fileDescriptorTypes = []byte{
-	// 4705 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xac, 0x7a, 0x4d, 0x6c, 0x24, 0xd7,
-	0x56, 0xbf, 0xfb, 0xd3, 0xdd, 0xa7, 0xdb, 0x76, 0xf9, 0x8e, 0x33, 0xf1, 0x74, 0x26, 0x76, 0xa7,
-	0x92, 0x79, 0xf9, 0x78, 0xf9, 0x77, 0x66, 0x3c, 0x49, 0x34, 0x49, 0xfe, 0x2f, 0x49, 0x7f, 0x79,
-	0xdc, 0x6f, 0xec, 0xee, 0xd6, 0xed, 0xf6, 0xcc, 0xcb, 0x02, 0x4a, 0xe5, 0xaa, 0xeb, 0x76, 0xc5,
-	0xd5, 0x75, 0x9b, 0xaa, 0x6a, 0x7b, 0x9a, 0x07, 0x62, 0xc4, 0x02, 0x90, 0x57, 0xb0, 0x43, 0x42,
-	0x66, 0x03, 0x2b, 0x84, 0xc4, 0x02, 0x24, 0x04, 0x1b, 0x82, 0xc4, 0x22, 0x3b, 0x1e, 0x20, 0xa1,
-	0x27, 0x90, 0x0c, 0xf1, 0x82, 0x1d, 0x82, 0xcd, 0x13, 0x1b, 0x90, 0xd0, 0xfd, 0xa8, 0xea, 0x6a,
-	0x4f, 0xd9, 0x9e, 0x90, 0xb7, 0xb1, 0xeb, 0x9e, 0xf3, 0x3b, 0xe7, 0xde, 0x7b, 0xee, 0xb9, 0xe7,
-	0x9e, 0x73, 0x6f, 0x43, 0xc1, 0x9f, 0x8c, 0x88, 0x57, 0x19, 0xb9, 0xd4, 0xa7, 0x08, 0x99, 0xd4,
-	0x38, 0x24, 0x6e, 0xc5, 0x3b, 0xd6, 0xdd, 0xe1, 0xa1, 0xe5, 0x57, 0x8e, 0xee, 0x95, 0xd6, 0x07,
-	0x94, 0x0e, 0x6c, 0xf2, 0x1e, 0x47, 0xec, 0x8d, 0xf7, 0xdf, 0xf3, 0xad, 0x21, 0xf1, 0x7c, 0x7d,
-	0x38, 0x12, 0x42, 0xa5, 0xb5, 0x8b, 0x00, 0x73, 0xec, 0xea, 0xbe, 0x45, 0x1d, 0xc9, 0x5f, 0x19,
-	0xd0, 0x01, 0xe5, 0x9f, 0xef, 0xb1, 0x2f, 0x41, 0x55, 0xd7, 0x61, 0xfe, 0x31, 0x71, 0x3d, 0x8b,
-	0x3a, 0x68, 0x05, 0x32, 0x96, 0x63, 0x92, 0xa7, 0xab, 0x89, 0x72, 0xe2, 0xad, 0x34, 0x16, 0x0d,
-	0xf5, 0x2e, 0x40, 0x8b, 0x7d, 0x34, 0x1d, 0xdf, 0x9d, 0x20, 0x05, 0x52, 0x87, 0x64, 0xc2, 0x11,
-	0x79, 0xcc, 0x3e, 0x19, 0xe5, 0x48, 0xb7, 0x57, 0x93, 0x82, 0x72, 0xa4, 0xdb, 0xea, 0x37, 0x09,
-	0x28, 0x54, 0x1d, 0x87, 0xfa, 0xbc, 0x77, 0x0f, 0x21, 0x48, 0x3b, 0xfa, 0x90, 0x48, 0x21, 0xfe,
-	0x8d, 0xea, 0x90, 0xb5, 0xf5, 0x3d, 0x62, 0x7b, 0xab, 0xc9, 0x72, 0xea, 0xad, 0xc2, 0xc6, 0xf7,
-	0x2b, 0xcf, 0x4f, 0xb9, 0x12, 0x51, 0x52, 0xd9, 0xe6, 0x68, 0x3e, 0x08, 0x2c, 0x45, 0xd1, 0xa7,
-	0x30, 0x6f, 0x39, 0xa6, 0x65, 0x10, 0x6f, 0x35, 0xcd, 0xb5, 0xac, 0xc5, 0x69, 0x99, 0x8e, 0xbe,
-	0x96, 0xfe, 0xfa, 0x6c, 0x7d, 0x0e, 0x07, 0x42, 0xa5, 0x8f, 0xa0, 0x10, 0x51, 0x1b, 0x33, 0xb7,
-	0x15, 0xc8, 0x1c, 0xe9, 0xf6, 0x98, 0xc8, 0xd9, 0x89, 0xc6, 0xc7, 0xc9, 0x07, 0x09, 0xf5, 0x0b,
-	0xc8, 0x63, 0xe2, 0xd1, 0xb1, 0x6b, 0x10, 0x0f, 0xbd, 0x0d, 0x79, 0x47, 0x77, 0xa8, 0x66, 0x8c,
-	0xc6, 0x1e, 0x17, 0x4f, 0xd5, 0x8a, 0xe7, 0x67, 0xeb, 0xb9, 0xb6, 0xee, 0xd0, 0x7a, 0x77, 0xd7,
-	0xc3, 0x39, 0xc6, 0xae, 0x8f, 0xc6, 0x1e, 0x7a, 0x0d, 0x8a, 0x43, 0x32, 0xa4, 0xee, 0x44, 0xdb,
-	0x9b, 0xf8, 0xc4, 0xe3, 0x8a, 0x53, 0xb8, 0x20, 0x68, 0x35, 0x46, 0x52, 0x7f, 0x3b, 0x01, 0x2b,
-	0x81, 0x6e, 0x4c, 0x7e, 0x69, 0x6c, 0xb9, 0x64, 0x48, 0x1c, 0xdf, 0x43, 0x1f, 0x40, 0xd6, 0xb6,
-	0x86, 0x96, 0x2f, 0xfa, 0x28, 0x6c, 0xbc, 0x1a, 0x37, 0xdb, 0x70, 0x54, 0x58, 0x82, 0x51, 0x15,
-	0x8a, 0x2e, 0xf1, 0x88, 0x7b, 0x24, 0x2c, 0xc9, 0xbb, 0xbc, 0x56, 0x78, 0x46, 0x44, 0xdd, 0x84,
-	0x5c, 0xd7, 0xd6, 0xfd, 0x7d, 0xea, 0x0e, 0x91, 0x0a, 0x45, 0xdd, 0x35, 0x0e, 0x2c, 0x9f, 0x18,
-	0xfe, 0xd8, 0x0d, 0x56, 0x75, 0x86, 0x86, 0x6e, 0x42, 0x92, 0x8a, 0x8e, 0xf2, 0xb5, 0xec, 0xf9,
-	0xd9, 0x7a, 0xb2, 0xd3, 0xc3, 0x49, 0xea, 0xa9, 0x9f, 0xc0, 0x72, 0xd7, 0x1e, 0x0f, 0x2c, 0xa7,
-	0x41, 0x3c, 0xc3, 0xb5, 0x46, 0x4c, 0x3b, 0x73, 0x0f, 0xe6, 0xfb, 0x81, 0x7b, 0xb0, 0xef, 0xd0,
-	0x65, 0x92, 0x53, 0x97, 0x51, 0x7f, 0x33, 0x09, 0xcb, 0x4d, 0x67, 0x60, 0x39, 0x24, 0x2a, 0x7d,
-	0x07, 0x16, 0x09, 0x27, 0x6a, 0x47, 0xc2, 0x8d, 0xa5, 0x9e, 0x05, 0x41, 0x0d, 0x7c, 0xbb, 0x75,
-	0xc1, 0xdf, 0xee, 0xc5, 0x4d, 0xff, 0x39, 0xed, 0xb1, 0x5e, 0xd7, 0x84, 0xf9, 0x11, 0x9f, 0x84,
-	0xb7, 0x9a, 0xe2, 0xba, 0xee, 0xc4, 0xe9, 0x7a, 0x6e, 0x9e, 0x81, 0xf3, 0x49, 0xd9, 0xef, 0xe2,
-	0x7c, 0x7f, 0x9c, 0x84, 0xa5, 0x36, 0x35, 0x67, 0xec, 0x50, 0x82, 0xdc, 0x01, 0xf5, 0xfc, 0xc8,
-	0x46, 0x0b, 0xdb, 0xe8, 0x01, 0xe4, 0x46, 0x72, 0xf9, 0xe4, 0xea, 0xdf, 0x8e, 0x1f, 0xb2, 0xc0,
-	0xe0, 0x10, 0x8d, 0x3e, 0x81, 0xbc, 0x1b, 0xf8, 0xc4, 0x6a, 0xea, 0x45, 0x1c, 0x67, 0x8a, 0x47,
-	0x3f, 0x80, 0xac, 0x58, 0x84, 0xd5, 0x34, 0x97, 0xbc, 0xf3, 0x42, 0x36, 0xc7, 0x52, 0x08, 0x3d,
-	0x84, 0x9c, 0x6f, 0x7b, 0x9a, 0xe5, 0xec, 0xd3, 0xd5, 0x0c, 0x57, 0xb0, 0x1e, 0xa7, 0x80, 0x19,
-	0xa2, 0xbf, 0xdd, 0x6b, 0x39, 0xfb, 0xb4, 0x56, 0x38, 0x3f, 0x5b, 0x9f, 0x97, 0x0d, 0x3c, 0xef,
-	0xdb, 0x1e, 0xfb, 0x50, 0x7f, 0x27, 0x01, 0x85, 0x08, 0x0a, 0xbd, 0x0a, 0xe0, 0xbb, 0x63, 0xcf,
-	0xd7, 0x5c, 0x4a, 0x7d, 0x6e, 0xac, 0x22, 0xce, 0x73, 0x0a, 0xa6, 0xd4, 0x47, 0x15, 0xb8, 0x61,
-	0x10, 0xd7, 0xd7, 0x2c, 0xcf, 0x1b, 0x13, 0x57, 0xf3, 0xc6, 0x7b, 0x5f, 0x12, 0xc3, 0xe7, 0x86,
-	0x2b, 0xe2, 0x65, 0xc6, 0x6a, 0x71, 0x4e, 0x4f, 0x30, 0xd0, 0x7d, 0xb8, 0x19, 0xc5, 0x8f, 0xc6,
-	0x7b, 0xb6, 0x65, 0x68, 0x6c, 0x31, 0x53, 0x5c, 0xe4, 0xc6, 0x54, 0xa4, 0xcb, 0x79, 0x8f, 0xc8,
-	0x44, 0xfd, 0x69, 0x02, 0x14, 0xac, 0xef, 0xfb, 0x3b, 0x64, 0xb8, 0x47, 0xdc, 0x9e, 0xaf, 0xfb,
-	0x63, 0x0f, 0xdd, 0x84, 0xac, 0x4d, 0x74, 0x93, 0xb8, 0x7c, 0x50, 0x39, 0x2c, 0x5b, 0x68, 0x97,
-	0xed, 0x60, 0xdd, 0x38, 0xd0, 0xf7, 0x2c, 0xdb, 0xf2, 0x27, 0x7c, 0x28, 0x8b, 0xf1, 0x2e, 0x7c,
-	0x51, 0x67, 0x05, 0x47, 0x04, 0xf1, 0x8c, 0x1a, 0xb4, 0x0a, 0xf3, 0x43, 0xe2, 0x79, 0xfa, 0x80,
-	0xf0, 0x91, 0xe6, 0x71, 0xd0, 0x54, 0x3f, 0x81, 0x62, 0x54, 0x0e, 0x15, 0x60, 0x7e, 0xb7, 0xfd,
-	0xa8, 0xdd, 0x79, 0xd2, 0x56, 0xe6, 0xd0, 0x12, 0x14, 0x76, 0xdb, 0xb8, 0x59, 0xad, 0x6f, 0x55,
-	0x6b, 0xdb, 0x4d, 0x25, 0x81, 0x16, 0x20, 0x3f, 0x6d, 0x26, 0xd5, 0x3f, 0x4d, 0x00, 0x30, 0x73,
-	0xcb, 0x49, 0x7d, 0x0c, 0x19, 0xcf, 0xd7, 0x7d, 0xe1, 0x95, 0x8b, 0x1b, 0x6f, 0x5c, 0xb6, 0x86,
-	0x72, 0xbc, 0xec, 0x1f, 0xc1, 0x42, 0x24, 0x3a, 0xc2, 0xe4, 0xcc, 0x08, 0x59, 0x80, 0xd0, 0x4d,
-	0xd3, 0x95, 0x03, 0xe7, 0xdf, 0xea, 0x27, 0x90, 0xe1, 0xd2, 0xb3, 0xc3, 0xcd, 0x41, 0xba, 0xc1,
-	0xbe, 0x12, 0x28, 0x0f, 0x19, 0xdc, 0xac, 0x36, 0xbe, 0x50, 0x92, 0x48, 0x81, 0x62, 0xa3, 0xd5,
-	0xab, 0x77, 0xda, 0xed, 0x66, 0xbd, 0xdf, 0x6c, 0x28, 0x29, 0xf5, 0x0e, 0x64, 0x5a, 0x43, 0xa6,
-	0xf9, 0x36, 0x73, 0xf9, 0x7d, 0xe2, 0x12, 0xc7, 0x08, 0x76, 0xd2, 0x94, 0xa0, 0xfe, 0x24, 0x0f,
-	0x99, 0x1d, 0x3a, 0x76, 0x7c, 0xb4, 0x11, 0x09, 0x5b, 0x8b, 0xf1, 0x27, 0x0f, 0x07, 0x56, 0xfa,
-	0x93, 0x11, 0x91, 0x61, 0xed, 0x26, 0x64, 0xc5, 0xe6, 0x90, 0xd3, 0x91, 0x2d, 0x46, 0xf7, 0x75,
-	0x77, 0x40, 0x7c, 0x39, 0x1f, 0xd9, 0x42, 0x6f, 0x41, 0xce, 0x25, 0xba, 0x49, 0x1d, 0x7b, 0xc2,
-	0xf7, 0x50, 0x4e, 0x9c, 0x2b, 0x98, 0xe8, 0x66, 0xc7, 0xb1, 0x27, 0x38, 0xe4, 0xa2, 0x2d, 0x28,
-	0xee, 0x59, 0x8e, 0xa9, 0xd1, 0x91, 0x08, 0xf2, 0x99, 0xcb, 0x77, 0x9c, 0x18, 0x55, 0xcd, 0x72,
-	0xcc, 0x8e, 0x00, 0xe3, 0xc2, 0xde, 0xb4, 0x81, 0xda, 0xb0, 0x78, 0x44, 0xed, 0xf1, 0x90, 0x84,
-	0xba, 0xb2, 0x5c, 0xd7, 0x9b, 0x97, 0xeb, 0x7a, 0xcc, 0xf1, 0x81, 0xb6, 0x85, 0xa3, 0x68, 0x13,
-	0x3d, 0x82, 0x05, 0x7f, 0x38, 0xda, 0xf7, 0x42, 0x75, 0xf3, 0x5c, 0xdd, 0xf7, 0xae, 0x30, 0x18,
-	0x83, 0x07, 0xda, 0x8a, 0x7e, 0xa4, 0x55, 0xfa, 0xf5, 0x14, 0x14, 0x22, 0x23, 0x47, 0x3d, 0x28,
-	0x8c, 0x5c, 0x3a, 0xd2, 0x07, 0xfc, 0xa0, 0x92, 0x6b, 0x71, 0xef, 0x85, 0x66, 0x5d, 0xe9, 0x4e,
-	0x05, 0x71, 0x54, 0x8b, 0x7a, 0x9a, 0x84, 0x42, 0x84, 0x89, 0xde, 0x81, 0x1c, 0xee, 0xe2, 0xd6,
-	0xe3, 0x6a, 0xbf, 0xa9, 0xcc, 0x95, 0x6e, 0x9f, 0x9c, 0x96, 0x57, 0xb9, 0xb6, 0xa8, 0x82, 0xae,
-	0x6b, 0x1d, 0x31, 0xd7, 0x7b, 0x0b, 0xe6, 0x03, 0x68, 0xa2, 0xf4, 0xca, 0xc9, 0x69, 0xf9, 0xe5,
-	0x8b, 0xd0, 0x08, 0x12, 0xf7, 0xb6, 0xaa, 0xb8, 0xd9, 0x50, 0x92, 0xf1, 0x48, 0xdc, 0x3b, 0xd0,
-	0x5d, 0x62, 0xa2, 0xef, 0x41, 0x56, 0x02, 0x53, 0xa5, 0xd2, 0xc9, 0x69, 0xf9, 0xe6, 0x45, 0xe0,
-	0x14, 0x87, 0x7b, 0xdb, 0xd5, 0xc7, 0x4d, 0x25, 0x1d, 0x8f, 0xc3, 0x3d, 0x5b, 0x3f, 0x22, 0xe8,
-	0x0d, 0xc8, 0x08, 0x58, 0xa6, 0x74, 0xeb, 0xe4, 0xb4, 0xfc, 0xd2, 0x73, 0xea, 0x18, 0xaa, 0xb4,
-	0xfa, 0x5b, 0x7f, 0xb0, 0x36, 0xf7, 0x97, 0x7f, 0xb8, 0xa6, 0x5c, 0x64, 0x97, 0xfe, 0x3b, 0x01,
-	0x0b, 0x33, 0x4b, 0x8e, 0x54, 0xc8, 0x3a, 0xd4, 0xa0, 0x23, 0x71, 0x7e, 0xe5, 0x6a, 0x70, 0x7e,
-	0xb6, 0x9e, 0x6d, 0xd3, 0x3a, 0x1d, 0x4d, 0xb0, 0xe4, 0xa0, 0x47, 0x17, 0x4e, 0xe0, 0xfb, 0x2f,
-	0xe8, 0x4f, 0xb1, 0x67, 0xf0, 0x67, 0xb0, 0x60, 0xba, 0xd6, 0x11, 0x71, 0x35, 0x83, 0x3a, 0xfb,
-	0xd6, 0x40, 0x9e, 0x4d, 0xa5, 0x38, 0x9d, 0x0d, 0x0e, 0xc4, 0x45, 0x21, 0x50, 0xe7, 0xf8, 0xef,
-	0x70, 0xfa, 0x96, 0x1e, 0x43, 0x31, 0xea, 0xa1, 0xec, 0x38, 0xf1, 0xac, 0x5f, 0x26, 0x32, 0xa1,
-	0xe3, 0xe9, 0x1f, 0xce, 0x33, 0x0a, 0x4f, 0xe7, 0xd0, 0x9b, 0x90, 0x1e, 0x52, 0x53, 0xe8, 0x59,
-	0xa8, 0xdd, 0x60, 0x49, 0xc0, 0x3f, 0x9d, 0xad, 0x17, 0xa8, 0x57, 0xd9, 0xb4, 0x6c, 0xb2, 0x43,
-	0x4d, 0x82, 0x39, 0x40, 0x3d, 0x82, 0x34, 0x0b, 0x15, 0xe8, 0x15, 0x48, 0xd7, 0x5a, 0xed, 0x86,
-	0x32, 0x57, 0x5a, 0x3e, 0x39, 0x2d, 0x2f, 0x70, 0x93, 0x30, 0x06, 0xf3, 0x5d, 0xb4, 0x0e, 0xd9,
-	0xc7, 0x9d, 0xed, 0xdd, 0x1d, 0xe6, 0x5e, 0x37, 0x4e, 0x4e, 0xcb, 0x4b, 0x21, 0x5b, 0x18, 0x0d,
-	0xbd, 0x0a, 0x99, 0xfe, 0x4e, 0x77, 0xb3, 0xa7, 0x24, 0x4b, 0xe8, 0xe4, 0xb4, 0xbc, 0x18, 0xf2,
-	0xf9, 0x98, 0x4b, 0xcb, 0x72, 0x55, 0xf3, 0x21, 0x5d, 0xfd, 0x59, 0x12, 0x16, 0x30, 0xab, 0x24,
-	0x5c, 0xbf, 0x4b, 0x6d, 0xcb, 0x98, 0xa0, 0x2e, 0xe4, 0x0d, 0xea, 0x98, 0x56, 0x64, 0x4f, 0x6d,
-	0x5c, 0x72, 0xea, 0x4f, 0xa5, 0x82, 0x56, 0x3d, 0x90, 0xc4, 0x53, 0x25, 0xe8, 0x3d, 0xc8, 0x98,
-	0xc4, 0xd6, 0x27, 0x32, 0xfd, 0xb8, 0x55, 0x11, 0xb5, 0x4a, 0x25, 0xa8, 0x55, 0x2a, 0x0d, 0x59,
-	0xab, 0x60, 0x81, 0xe3, 0x79, 0xb2, 0xfe, 0x54, 0xd3, 0x7d, 0x9f, 0x0c, 0x47, 0xbe, 0xc8, 0x3d,
-	0xd2, 0xb8, 0x30, 0xd4, 0x9f, 0x56, 0x25, 0x09, 0xdd, 0x83, 0xec, 0xb1, 0xe5, 0x98, 0xf4, 0x58,
-	0xa6, 0x17, 0x57, 0x28, 0x95, 0x40, 0xf5, 0x84, 0x9d, 0xba, 0x17, 0x86, 0xc9, 0xec, 0xdd, 0xee,
-	0xb4, 0x9b, 0x81, 0xbd, 0x25, 0xbf, 0xe3, 0xb4, 0xa9, 0xc3, 0xf6, 0x0a, 0x74, 0xda, 0xda, 0x66,
-	0xb5, 0xb5, 0xbd, 0x8b, 0x99, 0xcd, 0x57, 0x4e, 0x4e, 0xcb, 0x4a, 0x08, 0xd9, 0xd4, 0x2d, 0x9b,
-	0xe5, 0xbb, 0xb7, 0x20, 0x55, 0x6d, 0x7f, 0xa1, 0x24, 0x4b, 0xca, 0xc9, 0x69, 0xb9, 0x18, 0xb2,
-	0xab, 0xce, 0x64, 0xba, 0x8d, 0x2e, 0xf6, 0xab, 0xfe, 0x6d, 0x0a, 0x8a, 0xbb, 0x23, 0x53, 0xf7,
-	0x89, 0xf0, 0x49, 0x54, 0x86, 0xc2, 0x48, 0x77, 0x75, 0xdb, 0x26, 0xb6, 0xe5, 0x0d, 0x65, 0x15,
-	0x16, 0x25, 0xa1, 0x8f, 0x5e, 0xd4, 0x8c, 0xb5, 0x1c, 0xf3, 0xb3, 0xdf, 0xfd, 0x97, 0xf5, 0x44,
-	0x60, 0xd0, 0x5d, 0x58, 0xdc, 0x17, 0xa3, 0xd5, 0x74, 0x83, 0x2f, 0x6c, 0x8a, 0x2f, 0x6c, 0x25,
-	0x6e, 0x61, 0xa3, 0xc3, 0xaa, 0xc8, 0x49, 0x56, 0xb9, 0x14, 0x5e, 0xd8, 0x8f, 0x36, 0xd1, 0x7d,
-	0x98, 0x1f, 0x52, 0xc7, 0xf2, 0xa9, 0x7b, 0xfd, 0x2a, 0x04, 0x48, 0xf4, 0x0e, 0x2c, 0xb3, 0xc5,
-	0x0d, 0xc6, 0xc3, 0xd9, 0xfc, 0xc4, 0x4a, 0xe2, 0xa5, 0xa1, 0xfe, 0x54, 0x76, 0x88, 0x19, 0x19,
-	0xd5, 0x20, 0x43, 0x5d, 0x96, 0x12, 0x65, 0xf9, 0x70, 0xdf, 0xbd, 0x76, 0xb8, 0xa2, 0xd1, 0x61,
-	0x32, 0x58, 0x88, 0xaa, 0x1f, 0xc2, 0xc2, 0xcc, 0x24, 0x58, 0x26, 0xd0, 0xad, 0xee, 0xf6, 0x9a,
-	0xca, 0x1c, 0x2a, 0x42, 0xae, 0xde, 0x69, 0xf7, 0x5b, 0xed, 0x5d, 0x96, 0xca, 0x14, 0x21, 0x87,
-	0x3b, 0xdb, 0xdb, 0xb5, 0x6a, 0xfd, 0x91, 0x92, 0x54, 0x2b, 0x50, 0x88, 0x68, 0x43, 0x8b, 0x00,
-	0xbd, 0x7e, 0xa7, 0xab, 0x6d, 0xb6, 0x70, 0xaf, 0x2f, 0x12, 0xa1, 0x5e, 0xbf, 0x8a, 0xfb, 0x92,
-	0x90, 0x50, 0xff, 0x23, 0x19, 0xac, 0xa8, 0xcc, 0x7d, 0x6a, 0xb3, 0xb9, 0xcf, 0x15, 0x83, 0x97,
-	0xd9, 0xcf, 0xb4, 0x11, 0xe6, 0x40, 0x1f, 0x01, 0x70, 0xc7, 0x21, 0xa6, 0xa6, 0xfb, 0x72, 0xe1,
-	0x4b, 0xcf, 0x19, 0xb9, 0x1f, 0x5c, 0x06, 0xe0, 0xbc, 0x44, 0x57, 0x7d, 0xf4, 0x03, 0x28, 0x1a,
-	0x74, 0x38, 0xb2, 0x89, 0x14, 0x4e, 0x5d, 0x2b, 0x5c, 0x08, 0xf1, 0x55, 0x3f, 0x9a, 0x7d, 0xa5,
-	0x67, 0xf3, 0xc3, 0xdf, 0x48, 0x04, 0x96, 0x89, 0x49, 0xb8, 0x8a, 0x90, 0xdb, 0xed, 0x36, 0xaa,
-	0xfd, 0x56, 0xfb, 0xa1, 0x92, 0x40, 0x00, 0x59, 0x6e, 0xea, 0x86, 0x92, 0x64, 0x89, 0x62, 0xbd,
-	0xb3, 0xd3, 0xdd, 0x6e, 0xf2, 0x94, 0x0b, 0xad, 0x80, 0x12, 0x18, 0x5b, 0xe3, 0x86, 0x6c, 0x36,
-	0x94, 0x34, 0xba, 0x01, 0x4b, 0x21, 0x55, 0x4a, 0x66, 0xd0, 0x4d, 0x40, 0x21, 0x71, 0xaa, 0x22,
-	0xab, 0xfe, 0x2a, 0x2c, 0xd5, 0xa9, 0xe3, 0xeb, 0x96, 0x13, 0x26, 0xd1, 0x1b, 0x6c, 0xd2, 0x92,
-	0xa4, 0x59, 0xa6, 0x88, 0xe9, 0xb5, 0xa5, 0xf3, 0xb3, 0xf5, 0x42, 0x08, 0x6d, 0x35, 0xd8, 0x4c,
-	0x83, 0x86, 0xc9, 0xf6, 0xef, 0xc8, 0x32, 0xb9, 0x71, 0x33, 0xb5, 0xf9, 0xf3, 0xb3, 0xf5, 0x54,
-	0xb7, 0xd5, 0xc0, 0x8c, 0x86, 0x5e, 0x81, 0x3c, 0x79, 0x6a, 0xf9, 0x9a, 0xc1, 0x62, 0x38, 0x33,
-	0x60, 0x06, 0xe7, 0x18, 0xa1, 0xce, 0x42, 0x76, 0x0d, 0xa0, 0x4b, 0x5d, 0x5f, 0xf6, 0xfc, 0x3e,
-	0x64, 0x46, 0xd4, 0xe5, 0xe5, 0xf9, 0xa5, 0x97, 0x11, 0x0c, 0x2e, 0x1c, 0x15, 0x0b, 0xb0, 0xfa,
-	0x57, 0x49, 0x80, 0xbe, 0xee, 0x1d, 0x4a, 0x25, 0x0f, 0x20, 0x1f, 0x5e, 0xec, 0xc8, 0x3a, 0xff,
-	0xca, 0xd5, 0x0e, 0xc1, 0xe8, 0x7e, 0xe0, 0x6c, 0xa2, 0x3c, 0x88, 0xad, 0xd3, 0x82, 0x8e, 0xe2,
-	0x32, 0xec, 0xd9, 0x1a, 0x80, 0x1d, 0x89, 0xc4, 0x75, 0xe5, 0xca, 0xb3, 0x4f, 0x54, 0xe7, 0xc7,
-	0x82, 0x30, 0x9a, 0x4c, 0x30, 0x5f, 0x8f, 0xeb, 0xe4, 0xc2, 0x8a, 0x6c, 0xcd, 0xe1, 0xa9, 0x1c,
-	0xfa, 0x0c, 0x0a, 0x6c, 0xde, 0x9a, 0xc7, 0x79, 0x32, 0xb7, 0xbc, 0xd4, 0x54, 0x42, 0x03, 0x86,
-	0x51, 0xf8, 0x5d, 0x53, 0x60, 0xd1, 0x1d, 0x3b, 0x6c, 0xda, 0x52, 0x87, 0xfa, 0x27, 0x49, 0x78,
-	0xb9, 0x4d, 0xfc, 0x63, 0xea, 0x1e, 0x56, 0x7d, 0x5f, 0x37, 0x0e, 0x86, 0xc4, 0x91, 0x46, 0x8e,
-	0x64, 0xd6, 0x89, 0x99, 0xcc, 0x7a, 0x15, 0xe6, 0x75, 0xdb, 0xd2, 0x3d, 0x22, 0xd2, 0x91, 0x3c,
-	0x0e, 0x9a, 0x2c, 0xff, 0x67, 0xd5, 0x04, 0xf1, 0x3c, 0x22, 0x0a, 0xfc, 0x3c, 0x9e, 0x12, 0xd0,
-	0x8f, 0xe1, 0xa6, 0x4c, 0x3c, 0xf4, 0xb0, 0x2b, 0x96, 0xd9, 0x06, 0x37, 0x50, 0xcd, 0xd8, 0xf2,
-	0x26, 0x7e, 0x70, 0x32, 0x33, 0x99, 0x92, 0x3b, 0x23, 0x5f, 0xe6, 0x39, 0x2b, 0x66, 0x0c, 0xab,
-	0xf4, 0x10, 0x6e, 0x5d, 0x2a, 0xf2, 0xad, 0x2e, 0x10, 0xfe, 0x21, 0x09, 0xd0, 0xea, 0x56, 0x77,
-	0xa4, 0x91, 0x1a, 0x90, 0xdd, 0xd7, 0x87, 0x96, 0x3d, 0xb9, 0x2a, 0x4e, 0x4d, 0xf1, 0x95, 0xaa,
-	0x30, 0xc7, 0x26, 0x97, 0xc1, 0x52, 0x96, 0x17, 0x37, 0xe3, 0x3d, 0x87, 0xf8, 0x61, 0x71, 0xc3,
-	0x5b, 0x6c, 0x18, 0xae, 0xee, 0x84, 0x0e, 0x26, 0x1a, 0x6c, 0x01, 0x06, 0xba, 0x4f, 0x8e, 0xf5,
-	0x49, 0x10, 0x5c, 0x64, 0x13, 0x6d, 0xb1, 0xa2, 0xc7, 0x23, 0xee, 0x11, 0x31, 0x57, 0x33, 0xdc,
-	0xa8, 0xd7, 0x8d, 0x07, 0x4b, 0xb8, 0xb0, 0x5d, 0x28, 0x5d, 0xfa, 0x84, 0x27, 0x36, 0x53, 0xd6,
-	0xb7, 0xb2, 0xd1, 0x5d, 0x58, 0x98, 0x99, 0xe7, 0x73, 0x55, 0x65, 0xab, 0xfb, 0xf8, 0x7d, 0x25,
-	0x2d, 0xbf, 0x3e, 0x54, 0xb2, 0xea, 0x1f, 0xa5, 0x44, 0x38, 0x90, 0x56, 0x8d, 0xbf, 0xf6, 0xcc,
-	0xf1, 0x4d, 0x6c, 0x50, 0x5b, 0x6e, 0xd3, 0x37, 0xaf, 0x8e, 0x12, 0xac, 0x4a, 0xe1, 0x70, 0x1c,
-	0x0a, 0xa2, 0x75, 0x28, 0x08, 0x2f, 0xd6, 0xd8, 0xb6, 0xe0, 0x66, 0x5d, 0xc0, 0x20, 0x48, 0x4c,
-	0x12, 0xdd, 0x81, 0x45, 0x7e, 0x0b, 0xe1, 0x1d, 0x10, 0x53, 0x60, 0xd2, 0x1c, 0xb3, 0x10, 0x52,
-	0x39, 0x6c, 0x07, 0x8a, 0x92, 0xa0, 0xf1, 0x0c, 0x35, 0xc3, 0x07, 0xf4, 0xce, 0x75, 0x03, 0x12,
-	0x22, 0x3c, 0x71, 0x2d, 0x8c, 0xa6, 0x0d, 0xb5, 0x01, 0xb9, 0x60, 0xb0, 0x68, 0x15, 0x52, 0xfd,
-	0x7a, 0x57, 0x99, 0x2b, 0x2d, 0x9d, 0x9c, 0x96, 0x0b, 0x01, 0xb9, 0x5f, 0xef, 0x32, 0xce, 0x6e,
-	0xa3, 0xab, 0x24, 0x66, 0x39, 0xbb, 0x8d, 0x6e, 0x29, 0xcd, 0x32, 0x25, 0x75, 0x1f, 0x0a, 0x91,
-	0x1e, 0xd0, 0xeb, 0x30, 0xdf, 0x6a, 0x3f, 0xc4, 0xcd, 0x5e, 0x4f, 0x99, 0x2b, 0xdd, 0x3c, 0x39,
-	0x2d, 0xa3, 0x08, 0xb7, 0xe5, 0x0c, 0xd8, 0xfa, 0xa0, 0x57, 0x21, 0xbd, 0xd5, 0x61, 0x27, 0xb0,
-	0x48, 0x89, 0x23, 0x88, 0x2d, 0xea, 0xf9, 0xa5, 0x1b, 0x32, 0x05, 0x8b, 0x2a, 0x56, 0x7f, 0x2f,
-	0x01, 0x59, 0xb1, 0x99, 0x62, 0x17, 0xaa, 0x0a, 0xf3, 0x41, 0xbd, 0x2a, 0xca, 0x95, 0x37, 0x2f,
-	0x2f, 0x2d, 0x2a, 0xb2, 0x12, 0x10, 0xee, 0x17, 0xc8, 0x95, 0x3e, 0x86, 0x62, 0x94, 0xf1, 0xad,
-	0x9c, 0xef, 0xc7, 0x50, 0x60, 0xfe, 0x1d, 0x94, 0x18, 0x1b, 0x90, 0x15, 0x01, 0x21, 0x3c, 0x11,
-	0x2e, 0xaf, 0x73, 0x24, 0x12, 0x3d, 0x80, 0x79, 0x51, 0x1b, 0x05, 0xd7, 0x94, 0x6b, 0x57, 0xef,
-	0x22, 0x1c, 0xc0, 0xd5, 0xcf, 0x20, 0xdd, 0x25, 0xc4, 0x65, 0xb6, 0x77, 0xa8, 0x49, 0xa6, 0x87,
-	0xa8, 0x2c, 0xeb, 0x4c, 0xd2, 0x6a, 0xb0, 0xb2, 0xce, 0x24, 0x2d, 0x33, 0xbc, 0x88, 0x49, 0x46,
-	0x2e, 0x62, 0xfa, 0x50, 0x7c, 0x42, 0xac, 0xc1, 0x81, 0x4f, 0x4c, 0xae, 0xe8, 0x5d, 0x48, 0x8f,
-	0x48, 0x38, 0xf8, 0xd5, 0x58, 0x07, 0x23, 0xc4, 0xc5, 0x1c, 0xc5, 0xe2, 0xc8, 0x31, 0x97, 0x96,
-	0x97, 0xe3, 0xb2, 0xa5, 0xfe, 0x7d, 0x12, 0x16, 0x5b, 0x9e, 0x37, 0xd6, 0x1d, 0x23, 0xc8, 0xaf,
-	0x3e, 0x9d, 0xcd, 0xaf, 0xde, 0x8a, 0x9d, 0xe1, 0x8c, 0xc8, 0xec, 0xfd, 0x92, 0x3c, 0xe3, 0x92,
-	0xe1, 0x19, 0xa7, 0xfe, 0x7b, 0x22, 0xb8, 0x44, 0xba, 0x13, 0xd9, 0xee, 0xa5, 0xd5, 0x93, 0xd3,
-	0xf2, 0x4a, 0x54, 0x13, 0xd9, 0x75, 0x0e, 0x1d, 0x7a, 0xec, 0xa0, 0xd7, 0x20, 0x83, 0x9b, 0xed,
-	0xe6, 0x13, 0x25, 0x21, 0xdc, 0x73, 0x06, 0x84, 0x89, 0x43, 0x8e, 0x99, 0xa6, 0x6e, 0xb3, 0xdd,
-	0x60, 0xf9, 0x50, 0x32, 0x46, 0x53, 0x97, 0x38, 0xa6, 0xe5, 0x0c, 0xd0, 0xeb, 0x90, 0x6d, 0xf5,
-	0x7a, 0xbb, 0xbc, 0xcc, 0x7f, 0xf9, 0xe4, 0xb4, 0x7c, 0x63, 0x06, 0xc5, 0x2f, 0x10, 0x4d, 0x06,
-	0x62, 0xc5, 0x08, 0xcb, 0x94, 0x62, 0x40, 0x2c, 0xcb, 0x15, 0x20, 0xdc, 0xe9, 0x57, 0xfb, 0xac,
-	0xc2, 0x7f, 0x1e, 0x84, 0x29, 0xfb, 0x2b, 0xb7, 0xdb, 0x3f, 0x27, 0x41, 0xa9, 0x1a, 0x06, 0x19,
-	0xf9, 0x8c, 0x2f, 0xeb, 0xbf, 0x3e, 0xe4, 0x46, 0xec, 0xcb, 0x22, 0x41, 0x2e, 0xf3, 0x20, 0xf6,
-	0x79, 0xe6, 0x82, 0x5c, 0x05, 0x53, 0x9b, 0x54, 0xcd, 0xa1, 0xe5, 0x79, 0x16, 0x75, 0x04, 0x0d,
-	0x87, 0x9a, 0x4a, 0xff, 0x99, 0x80, 0x1b, 0x31, 0x08, 0x74, 0x17, 0xd2, 0x2e, 0xb5, 0x83, 0x35,
-	0xbc, 0x7d, 0xd9, 0xfd, 0x20, 0x13, 0xc5, 0x1c, 0x89, 0xd6, 0x00, 0xf4, 0xb1, 0x4f, 0x75, 0xde,
-	0x3f, 0x5f, 0xbd, 0x1c, 0x8e, 0x50, 0xd0, 0x13, 0xc8, 0x7a, 0xc4, 0x70, 0x49, 0x90, 0xf1, 0x7e,
-	0xf6, 0x7f, 0x1d, 0x7d, 0xa5, 0xc7, 0xd5, 0x60, 0xa9, 0xae, 0x54, 0x81, 0xac, 0xa0, 0x30, 0xb7,
-	0x37, 0x75, 0x5f, 0x97, 0xb7, 0xc7, 0xfc, 0x9b, 0x79, 0x93, 0x6e, 0x0f, 0x02, 0x6f, 0xd2, 0xed,
-	0x81, 0xfa, 0x37, 0x49, 0x80, 0xe6, 0x53, 0x9f, 0xb8, 0x8e, 0x6e, 0xd7, 0xab, 0xa8, 0x19, 0x89,
-	0xfe, 0x62, 0xb6, 0x6f, 0xc7, 0x5e, 0x89, 0x87, 0x12, 0x95, 0x7a, 0x35, 0x26, 0xfe, 0xdf, 0x82,
-	0xd4, 0xd8, 0x95, 0x2f, 0x6e, 0x22, 0x5b, 0xdd, 0xc5, 0xdb, 0x98, 0xd1, 0x50, 0x73, 0x1a, 0xb6,
-	0x52, 0x97, 0xbf, 0xab, 0x45, 0x3a, 0x88, 0x0d, 0x5d, 0x6c, 0xe7, 0x1b, 0xba, 0x66, 0x10, 0x79,
-	0x72, 0x14, 0xc5, 0xce, 0xaf, 0x57, 0xeb, 0xc4, 0xf5, 0x71, 0xd6, 0xd0, 0xd9, 0xff, 0xef, 0x14,
-	0xdf, 0xde, 0x05, 0x98, 0x4e, 0x0d, 0xad, 0x41, 0xa6, 0xbe, 0xd9, 0xeb, 0x6d, 0x2b, 0x73, 0x22,
-	0x80, 0x4f, 0x59, 0x9c, 0xac, 0xfe, 0x45, 0x12, 0x72, 0xf5, 0xaa, 0x3c, 0x56, 0xeb, 0xa0, 0xf0,
-	0xa8, 0xc4, 0xef, 0xdc, 0xc9, 0xd3, 0x91, 0xe5, 0x4e, 0x64, 0x60, 0xb9, 0xa2, 0xf4, 0x5c, 0x64,
-	0x22, 0x6c, 0xd4, 0x4d, 0x2e, 0x80, 0x30, 0x14, 0x89, 0x34, 0x82, 0x66, 0xe8, 0x41, 0x8c, 0x5f,
-	0xbb, 0xda, 0x58, 0xa2, 0x88, 0x98, 0xb6, 0x3d, 0x5c, 0x08, 0x94, 0xd4, 0x75, 0x0f, 0x7d, 0x04,
-	0x4b, 0x9e, 0x35, 0x70, 0x2c, 0x67, 0xa0, 0x05, 0xc6, 0xe3, 0x0f, 0x00, 0xb5, 0xe5, 0xf3, 0xb3,
-	0xf5, 0x85, 0x9e, 0x60, 0x49, 0x1b, 0x2e, 0x48, 0x64, 0x9d, 0x9b, 0x12, 0x7d, 0x08, 0x8b, 0x11,
-	0x51, 0x66, 0x45, 0x61, 0x76, 0xe5, 0xfc, 0x6c, 0xbd, 0x18, 0x4a, 0x3e, 0x22, 0x13, 0x5c, 0x0c,
-	0x05, 0x1f, 0x11, 0x7e, 0x4b, 0xb2, 0x4f, 0x5d, 0x83, 0x68, 0x2e, 0xdf, 0xd3, 0xfc, 0x04, 0x4f,
-	0xe3, 0x02, 0xa7, 0x89, 0x6d, 0xae, 0x3e, 0x86, 0x1b, 0x1d, 0xd7, 0x38, 0x20, 0x9e, 0x2f, 0x4c,
-	0x21, 0xad, 0xf8, 0x19, 0xdc, 0xf6, 0x75, 0xef, 0x50, 0x3b, 0xb0, 0x3c, 0x9f, 0xba, 0x13, 0xcd,
-	0x25, 0x3e, 0x71, 0x18, 0x5f, 0xe3, 0xaf, 0x86, 0xf2, 0x1a, 0xeb, 0x16, 0xc3, 0x6c, 0x09, 0x08,
-	0x0e, 0x10, 0xdb, 0x0c, 0xa0, 0xb6, 0xa0, 0xc8, 0x8a, 0x89, 0x06, 0xd9, 0xd7, 0xc7, 0xb6, 0xcf,
-	0x66, 0x0f, 0x36, 0x1d, 0x68, 0x2f, 0x7c, 0x4c, 0xe5, 0x6d, 0x3a, 0x10, 0x9f, 0xea, 0x8f, 0x40,
-	0x69, 0x58, 0xde, 0x48, 0xf7, 0x8d, 0x83, 0xe0, 0x7e, 0x0e, 0x35, 0x40, 0x39, 0x20, 0xba, 0xeb,
-	0xef, 0x11, 0xdd, 0xd7, 0x46, 0xc4, 0xb5, 0xa8, 0x79, 0xfd, 0x2a, 0x2f, 0x85, 0x22, 0x5d, 0x2e,
-	0xa1, 0xfe, 0x57, 0x02, 0x00, 0xeb, 0xfb, 0x41, 0x46, 0xf6, 0x7d, 0x58, 0xf6, 0x1c, 0x7d, 0xe4,
-	0x1d, 0x50, 0x5f, 0xb3, 0x1c, 0x9f, 0xb8, 0x47, 0xba, 0x2d, 0xaf, 0x59, 0x94, 0x80, 0xd1, 0x92,
-	0x74, 0xf4, 0x2e, 0xa0, 0x43, 0x42, 0x46, 0x1a, 0xb5, 0x4d, 0x2d, 0x60, 0x8a, 0x37, 0xcd, 0x34,
-	0x56, 0x18, 0xa7, 0x63, 0x9b, 0xbd, 0x80, 0x8e, 0x6a, 0xb0, 0xc6, 0xa6, 0x4f, 0x1c, 0xdf, 0xb5,
-	0x88, 0xa7, 0xed, 0x53, 0x57, 0xf3, 0x6c, 0x7a, 0xac, 0xed, 0x53, 0xdb, 0xa6, 0xc7, 0xc4, 0x0d,
-	0x6e, 0xb0, 0x4a, 0x36, 0x1d, 0x34, 0x05, 0x68, 0x93, 0xba, 0x3d, 0x9b, 0x1e, 0x6f, 0x06, 0x08,
-	0x96, 0xb6, 0x4d, 0xe7, 0xec, 0x5b, 0xc6, 0x61, 0x90, 0xb6, 0x85, 0xd4, 0xbe, 0x65, 0x1c, 0xa2,
-	0xd7, 0x61, 0x81, 0xd8, 0x84, 0x5f, 0x64, 0x08, 0x54, 0x86, 0xa3, 0x8a, 0x01, 0x91, 0x81, 0xd4,
-	0xcf, 0x41, 0x69, 0x3a, 0x86, 0x3b, 0x19, 0x45, 0xd6, 0xfc, 0x5d, 0x40, 0x2c, 0x48, 0x6a, 0x36,
-	0x35, 0x0e, 0xb5, 0xa1, 0xee, 0xe8, 0x03, 0x36, 0x2e, 0xf1, 0xd4, 0xa4, 0x30, 0xce, 0x36, 0x35,
-	0x0e, 0x77, 0x24, 0x5d, 0xfd, 0x08, 0xa0, 0x37, 0x72, 0x89, 0x6e, 0x76, 0x58, 0x36, 0xc1, 0x4c,
-	0xc7, 0x5b, 0x9a, 0x29, 0x9f, 0xea, 0xa8, 0x2b, 0xb7, 0xba, 0x22, 0x18, 0x8d, 0x90, 0xae, 0xfe,
-	0x02, 0xdc, 0xe8, 0xda, 0xba, 0xc1, 0x9f, 0xad, 0xbb, 0xe1, 0xdb, 0x09, 0x7a, 0x00, 0x59, 0x01,
-	0x95, 0x2b, 0x19, 0xbb, 0xdd, 0xa6, 0x7d, 0x6e, 0xcd, 0x61, 0x89, 0xaf, 0x15, 0x01, 0xa6, 0x7a,
-	0xd4, 0x3f, 0x4b, 0x40, 0x3e, 0xd4, 0x8f, 0xca, 0xc0, 0x4a, 0x79, 0xe6, 0xde, 0x96, 0x23, 0x6b,
-	0xef, 0x3c, 0x8e, 0x92, 0x50, 0x0b, 0x0a, 0xa3, 0x50, 0xfa, 0xca, 0x7c, 0x2e, 0x66, 0xd4, 0x38,
-	0x2a, 0x8b, 0x3e, 0x86, 0x7c, 0xf0, 0x36, 0x1a, 0x44, 0xd8, 0xab, 0x9f, 0x52, 0xa7, 0x70, 0xf5,
-	0x53, 0x80, 0x1f, 0x52, 0xcb, 0xe9, 0xd3, 0x43, 0xe2, 0xf0, 0xb7, 0x3e, 0x56, 0x13, 0x92, 0xc0,
-	0x8a, 0xb2, 0xc5, 0x0b, 0x72, 0xb1, 0x04, 0xe1, 0x93, 0x97, 0x68, 0xaa, 0x7f, 0x9d, 0x84, 0x2c,
-	0xa6, 0xd4, 0xaf, 0x57, 0x51, 0x19, 0xb2, 0x32, 0x4e, 0xf0, 0xf3, 0xa7, 0x96, 0x3f, 0x3f, 0x5b,
-	0xcf, 0x88, 0x00, 0x91, 0x31, 0x78, 0x64, 0x88, 0x44, 0xf0, 0xe4, 0x65, 0x11, 0x1c, 0xdd, 0x85,
-	0xa2, 0x04, 0x69, 0x07, 0xba, 0x77, 0x20, 0x0a, 0xb4, 0xda, 0xe2, 0xf9, 0xd9, 0x3a, 0x08, 0xe4,
-	0x96, 0xee, 0x1d, 0x60, 0x10, 0x68, 0xf6, 0x8d, 0x9a, 0x50, 0xf8, 0x92, 0x5a, 0x8e, 0xe6, 0xf3,
-	0x49, 0xc8, 0x2b, 0xbf, 0xd8, 0x75, 0x9c, 0x4e, 0x55, 0x3e, 0x7c, 0xc3, 0x97, 0xd3, 0xc9, 0x37,
-	0x61, 0xc1, 0xa5, 0xd4, 0x17, 0x61, 0xcb, 0xa2, 0x8e, 0xbc, 0x4d, 0x28, 0xc7, 0x5e, 0x32, 0x53,
-	0xea, 0x63, 0x89, 0xc3, 0x45, 0x37, 0xd2, 0x42, 0x77, 0x61, 0xc5, 0xd6, 0x3d, 0x5f, 0xe3, 0xf1,
-	0xce, 0x9c, 0x6a, 0xcb, 0xf2, 0xad, 0x86, 0x18, 0x6f, 0x93, 0xb3, 0x02, 0x09, 0xf5, 0x1f, 0x13,
-	0x50, 0x60, 0x93, 0xb1, 0xf6, 0x2d, 0x83, 0x25, 0x79, 0xdf, 0x3e, 0xf7, 0xb8, 0x05, 0x29, 0xc3,
-	0x73, 0xa5, 0x51, 0xf9, 0xe1, 0x5b, 0xef, 0x61, 0xcc, 0x68, 0xe8, 0x73, 0xc8, 0xca, 0x5b, 0x0d,
-	0x91, 0x76, 0xa8, 0xd7, 0xa7, 0xa3, 0xd2, 0x36, 0x52, 0x8e, 0xfb, 0xf2, 0x74, 0x74, 0xe2, 0x10,
-	0xc0, 0x51, 0x12, 0xba, 0x09, 0x49, 0x43, 0x98, 0x4b, 0xfe, 0xb2, 0xa2, 0xde, 0xc6, 0x49, 0xc3,
-	0x51, 0xff, 0x2e, 0x01, 0x0b, 0xd3, 0x0d, 0xcf, 0x3c, 0xe0, 0x36, 0xe4, 0xbd, 0xf1, 0x9e, 0x37,
-	0xf1, 0x7c, 0x32, 0x0c, 0xde, 0x31, 0x43, 0x02, 0x6a, 0x41, 0x5e, 0xb7, 0x07, 0xd4, 0xb5, 0xfc,
-	0x83, 0xa1, 0xac, 0x44, 0xe3, 0x53, 0x85, 0xa8, 0xce, 0x4a, 0x35, 0x10, 0xc1, 0x53, 0xe9, 0xe0,
-	0xdc, 0x17, 0x8f, 0xdd, 0xfc, 0xdc, 0x7f, 0x0d, 0x8a, 0xb6, 0x3e, 0xe4, 0xd7, 0x3c, 0xbe, 0x35,
-	0x14, 0xf3, 0x48, 0xe3, 0x82, 0xa4, 0xf5, 0xad, 0x21, 0x51, 0x55, 0xc8, 0x87, 0xca, 0xd0, 0x12,
-	0x14, 0xaa, 0xcd, 0x9e, 0x76, 0x6f, 0xe3, 0x81, 0xf6, 0xb0, 0xbe, 0xa3, 0xcc, 0xc9, 0xdc, 0xf4,
-	0xcf, 0x13, 0xb0, 0x20, 0xc3, 0x91, 0xcc, 0xf7, 0x5f, 0x87, 0x79, 0x57, 0xdf, 0xf7, 0x83, 0x8a,
-	0x24, 0x2d, 0xbc, 0x9a, 0x45, 0x78, 0x56, 0x91, 0x30, 0x56, 0x7c, 0x45, 0x12, 0x79, 0x59, 0x4f,
-	0x5d, 0xf9, 0xb2, 0x9e, 0xfe, 0xb9, 0xbc, 0xac, 0xab, 0xbf, 0x06, 0xb0, 0x69, 0xd9, 0xa4, 0x2f,
-	0xee, 0x9a, 0xe2, 0xea, 0x4b, 0x96, 0xc3, 0xc9, 0x1b, 0xc7, 0x20, 0x87, 0x6b, 0x35, 0x30, 0xa3,
-	0x31, 0xd6, 0xc0, 0x32, 0xe5, 0x66, 0xe4, 0xac, 0x87, 0x8c, 0x35, 0xb0, 0xcc, 0xf0, 0x2d, 0x29,
-	0x7d, 0xdd, 0x5b, 0xd2, 0x69, 0x02, 0x96, 0x64, 0xee, 0x1a, 0x86, 0xdf, 0xb7, 0x21, 0x2f, 0xd2,
-	0xd8, 0x69, 0x41, 0xc7, 0x5f, 0x93, 0x05, 0xae, 0xd5, 0xc0, 0x39, 0xc1, 0x6e, 0x99, 0x68, 0x1d,
-	0x0a, 0x12, 0x1a, 0xf9, 0x15, 0x0e, 0x08, 0x52, 0x9b, 0x0d, 0xff, 0x7d, 0x48, 0xef, 0x5b, 0x36,
-	0x91, 0x8e, 0x1e, 0x1b, 0x00, 0xa6, 0x06, 0xd8, 0x9a, 0xc3, 0x1c, 0x5d, 0xcb, 0x05, 0x97, 0x71,
-	0x7c, 0x7c, 0xb2, 0xec, 0x8c, 0x8e, 0x4f, 0x54, 0xa0, 0x17, 0xc6, 0x27, 0x70, 0x6c, 0x7c, 0x82,
-	0x2d, 0xc6, 0x27, 0xa1, 0xd1, 0xf1, 0x09, 0xd2, 0xcf, 0x65, 0x7c, 0xdb, 0x70, 0xb3, 0x66, 0xeb,
-	0xc6, 0xa1, 0x6d, 0x79, 0x3e, 0x31, 0xa3, 0x11, 0x63, 0x03, 0xb2, 0x33, 0x49, 0xe7, 0x55, 0x97,
-	0xb3, 0x12, 0xa9, 0xfe, 0x5b, 0x02, 0x8a, 0x5b, 0x44, 0xb7, 0xfd, 0x83, 0xe9, 0xd5, 0x90, 0x4f,
-	0x3c, 0x5f, 0x1e, 0x56, 0xfc, 0x1b, 0x7d, 0x00, 0xb9, 0x30, 0x27, 0xb9, 0xf6, 0x95, 0x2c, 0x84,
-	0xa2, 0xfb, 0x30, 0xcf, 0xf6, 0x18, 0x1d, 0x07, 0xc5, 0xce, 0x55, 0x0f, 0x30, 0x12, 0xc9, 0x0e,
-	0x19, 0x97, 0xf0, 0x24, 0x84, 0xbb, 0x52, 0x06, 0x07, 0x4d, 0xf4, 0xff, 0xa1, 0xc8, 0xdf, 0x0f,
-	0x82, 0x9c, 0x2b, 0x73, 0x9d, 0xce, 0x82, 0x78, 0x02, 0x14, 0xf9, 0xd6, 0xff, 0x24, 0x60, 0x65,
-	0x47, 0x9f, 0xec, 0x11, 0x19, 0x36, 0x88, 0x89, 0x89, 0x41, 0x5d, 0x13, 0x75, 0xa3, 0xe1, 0xe6,
-	0x8a, 0x17, 0xc5, 0x38, 0xe1, 0xf8, 0xa8, 0x13, 0x14, 0x60, 0xc9, 0x48, 0x01, 0xb6, 0x02, 0x19,
-	0x87, 0x3a, 0x06, 0x91, 0xb1, 0x48, 0x34, 0x54, 0x2b, 0x1a, 0x6a, 0x4a, 0xe1, 0x63, 0x1f, 0x7f,
-	0xaa, 0x6b, 0x53, 0x3f, 0xec, 0x0d, 0x7d, 0x0e, 0xa5, 0x5e, 0xb3, 0x8e, 0x9b, 0xfd, 0x5a, 0xe7,
-	0x47, 0x5a, 0xaf, 0xba, 0xdd, 0xab, 0x6e, 0xdc, 0xd5, 0xba, 0x9d, 0xed, 0x2f, 0xee, 0xdd, 0xbf,
-	0xfb, 0x81, 0x92, 0x28, 0x95, 0x4f, 0x4e, 0xcb, 0xb7, 0xdb, 0xd5, 0xfa, 0xb6, 0xd8, 0x31, 0x7b,
-	0xf4, 0x69, 0x4f, 0xb7, 0x3d, 0x7d, 0xe3, 0x6e, 0x97, 0xda, 0x13, 0x86, 0x61, 0x6e, 0x5d, 0x8c,
-	0x9e, 0x57, 0xd1, 0x63, 0x38, 0x71, 0xe9, 0x31, 0x3c, 0x3d, 0xcd, 0x93, 0x97, 0x9c, 0xe6, 0x9b,
-	0xb0, 0x62, 0xb8, 0xd4, 0xf3, 0x34, 0x96, 0xfd, 0x13, 0xf3, 0x42, 0x7d, 0xf1, 0xd2, 0xf9, 0xd9,
-	0xfa, 0x72, 0x9d, 0xf1, 0x7b, 0x9c, 0x2d, 0xd5, 0x2f, 0x1b, 0x11, 0x12, 0xef, 0x49, 0xfd, 0xfd,
-	0x14, 0x4b, 0xa4, 0xac, 0x23, 0xcb, 0x26, 0x03, 0xe2, 0xa1, 0xc7, 0xb0, 0x64, 0xb8, 0xc4, 0x64,
-	0x69, 0xbd, 0x6e, 0x6b, 0xde, 0x88, 0x18, 0xd2, 0xa9, 0xff, 0x5f, 0x6c, 0x4e, 0x13, 0x0a, 0x56,
-	0xea, 0xa1, 0x54, 0x6f, 0x44, 0x0c, 0xbc, 0x68, 0xcc, 0xb4, 0xd1, 0x97, 0xb0, 0xe4, 0x11, 0xdb,
-	0x72, 0xc6, 0x4f, 0x35, 0x83, 0x3a, 0x3e, 0x79, 0x1a, 0xbc, 0x5b, 0x5d, 0xa7, 0xb7, 0xd7, 0xdc,
-	0x66, 0x52, 0x75, 0x21, 0x54, 0x43, 0xe7, 0x67, 0xeb, 0x8b, 0xb3, 0x34, 0xbc, 0x28, 0x35, 0xcb,
-	0x76, 0xa9, 0x0d, 0x8b, 0xb3, 0xa3, 0x41, 0x2b, 0x72, 0xef, 0xf3, 0x10, 0x12, 0xec, 0x6d, 0x74,
-	0x1b, 0x72, 0x2e, 0x19, 0x58, 0x9e, 0xef, 0x0a, 0x33, 0x33, 0x4e, 0x48, 0x61, 0x3b, 0x5f, 0xfc,
-	0x14, 0xa7, 0xf4, 0x2b, 0x70, 0xa1, 0x47, 0xb6, 0x59, 0x4c, 0xcb, 0xd3, 0xf7, 0xa4, 0xca, 0x1c,
-	0x0e, 0x9a, 0xcc, 0x07, 0xc7, 0x5e, 0x98, 0xa8, 0xf1, 0x6f, 0x46, 0xe3, 0x19, 0x85, 0xfc, 0x61,
-	0x12, 0xcf, 0x19, 0x82, 0x5f, 0x38, 0xa6, 0x23, 0xbf, 0x70, 0x5c, 0x81, 0x8c, 0x4d, 0x8e, 0x88,
-	0x2d, 0xce, 0x72, 0x2c, 0x1a, 0xef, 0xfc, 0x2c, 0x05, 0xf9, 0xf0, 0x8d, 0x86, 0x9d, 0x04, 0xed,
-	0xe6, 0x93, 0xc0, 0x57, 0x43, 0x7a, 0x9b, 0x1c, 0xa3, 0xd7, 0xa6, 0x77, 0x4a, 0x9f, 0x8b, 0x47,
-	0xe9, 0x90, 0x1d, 0xdc, 0x27, 0xbd, 0x01, 0xb9, 0x6a, 0xaf, 0xd7, 0x7a, 0xd8, 0x6e, 0x36, 0x94,
-	0xaf, 0x12, 0xa5, 0x97, 0x4e, 0x4e, 0xcb, 0xcb, 0x21, 0xa8, 0xea, 0x09, 0x57, 0xe2, 0xa8, 0x7a,
-	0xbd, 0xd9, 0xed, 0x37, 0x1b, 0xca, 0xb3, 0xe4, 0x45, 0x14, 0xbf, 0x23, 0xe1, 0x3f, 0x2d, 0xc9,
-	0x77, 0x71, 0xb3, 0x5b, 0xc5, 0xac, 0xc3, 0xaf, 0x92, 0xe2, 0xaa, 0x6b, 0xda, 0xa3, 0x4b, 0x46,
-	0xba, 0xcb, 0xfa, 0x5c, 0x0b, 0x7e, 0x62, 0xf5, 0x2c, 0x25, 0x7e, 0x7e, 0x30, 0x7d, 0x70, 0x22,
-	0xba, 0x39, 0x61, 0xbd, 0xf1, 0x97, 0x3e, 0xae, 0x26, 0x75, 0xa1, 0xb7, 0x1e, 0x8b, 0x24, 0x4c,
-	0x8b, 0x0a, 0xf3, 0x78, 0xb7, 0xdd, 0x66, 0xa0, 0x67, 0xe9, 0x0b, 0xb3, 0xc3, 0x63, 0x87, 0xd5,
-	0xbf, 0xe8, 0x0e, 0xe4, 0x82, 0x87, 0x40, 0xe5, 0xab, 0xf4, 0x85, 0x01, 0xd5, 0x83, 0x57, 0x4c,
-	0xde, 0xe1, 0xd6, 0x6e, 0x9f, 0xff, 0x02, 0xec, 0x59, 0xe6, 0x62, 0x87, 0x07, 0x63, 0xdf, 0xa4,
-	0xc7, 0x0e, 0xdb, 0x81, 0xf2, 0x56, 0xed, 0xab, 0x8c, 0xb8, 0x82, 0x08, 0x31, 0xf2, 0x4a, 0xed,
-	0x0d, 0xc8, 0xe1, 0xe6, 0x0f, 0xc5, 0x8f, 0xc5, 0x9e, 0x65, 0x2f, 0xe8, 0xc1, 0xe4, 0x4b, 0x62,
-	0xc8, 0xde, 0x3a, 0xb8, 0xbb, 0x55, 0xe5, 0x26, 0xbf, 0x88, 0xea, 0xb8, 0xa3, 0x03, 0xdd, 0x21,
-	0xe6, 0xf4, 0x37, 0x18, 0x21, 0xeb, 0x9d, 0x5f, 0x84, 0x5c, 0x90, 0x67, 0xa2, 0x35, 0xc8, 0x3e,
-	0xe9, 0xe0, 0x47, 0x4d, 0xac, 0xcc, 0x09, 0x1b, 0x06, 0x9c, 0x27, 0xa2, 0x42, 0x28, 0xc3, 0xfc,
-	0x4e, 0xb5, 0x5d, 0x7d, 0xd8, 0xc4, 0xc1, 0x85, 0x77, 0x00, 0x90, 0xc9, 0x52, 0x49, 0x91, 0x1d,
-	0x84, 0x3a, 0x6b, 0xab, 0x5f, 0x7f, 0xb3, 0x36, 0xf7, 0xd3, 0x6f, 0xd6, 0xe6, 0x9e, 0x9d, 0xaf,
-	0x25, 0xbe, 0x3e, 0x5f, 0x4b, 0xfc, 0xe4, 0x7c, 0x2d, 0xf1, 0xaf, 0xe7, 0x6b, 0x89, 0xbd, 0x2c,
-	0x0f, 0xe9, 0xf7, 0xff, 0x37, 0x00, 0x00, 0xff, 0xff, 0x62, 0x46, 0x73, 0x55, 0x80, 0x2e, 0x00,
-	0x00,
+	// 4808 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xac, 0x7a, 0x4d, 0x6c, 0x24, 0x49,
+	0x56, 0xbf, 0xeb, 0xd3, 0x55, 0xaf, 0xca, 0x76, 0x76, 0xb4, 0xb7, 0xd7, 0x5d, 0xd3, 0x63, 0xd7,
+	0xe4, 0x4c, 0xef, 0x7c, 0xec, 0xfc, 0x6b, 0xba, 0xdd, 0x33, 0xa3, 0xee, 0xe9, 0xff, 0x7c, 0xd4,
+	0x97, 0xdb, 0xb5, 0x6d, 0x57, 0x95, 0xa2, 0xca, 0xdd, 0x3b, 0x07, 0x48, 0xa5, 0x33, 0xc3, 0xe5,
+	0x1c, 0x67, 0x65, 0x14, 0x99, 0x59, 0x76, 0x17, 0x0b, 0xa2, 0xc5, 0x01, 0x90, 0x4f, 0x70, 0x62,
+	0x25, 0x64, 0x2e, 0x70, 0x42, 0x48, 0x1c, 0x40, 0x42, 0x70, 0x61, 0x90, 0x38, 0xcc, 0x8d, 0x05,
+	0x24, 0xb4, 0x02, 0xc9, 0x30, 0x3e, 0x70, 0x43, 0x70, 0x59, 0x71, 0x01, 0x09, 0xc5, 0x47, 0x66,
+	0x65, 0xb9, 0xd3, 0x76, 0x0f, 0xb3, 0x17, 0x3b, 0xe3, 0xbd, 0xdf, 0x7b, 0xf1, 0xe2, 0x45, 0xc4,
+	0x8b, 0xf7, 0x22, 0x0a, 0x0a, 0xfe, 0x64, 0x44, 0xbc, 0xca, 0xc8, 0xa5, 0x3e, 0x45, 0xc8, 0xa4,
+	0xc6, 0x01, 0x71, 0x2b, 0xde, 0x91, 0xee, 0x0e, 0x0f, 0x2c, 0xbf, 0x72, 0x78, 0xb7, 0xb4, 0x36,
+	0xa0, 0x74, 0x60, 0x93, 0xf7, 0x38, 0x62, 0x77, 0xbc, 0xf7, 0x9e, 0x6f, 0x0d, 0x89, 0xe7, 0xeb,
+	0xc3, 0x91, 0x10, 0x2a, 0xad, 0x9e, 0x07, 0x98, 0x63, 0x57, 0xf7, 0x2d, 0xea, 0x48, 0xfe, 0xf2,
+	0x80, 0x0e, 0x28, 0xff, 0x7c, 0x8f, 0x7d, 0x09, 0xaa, 0xba, 0x06, 0xf3, 0x4f, 0x88, 0xeb, 0x59,
+	0xd4, 0x41, 0xcb, 0x90, 0xb1, 0x1c, 0x93, 0x3c, 0x5b, 0x49, 0x94, 0x13, 0x6f, 0xa5, 0xb1, 0x68,
+	0xa8, 0x77, 0x00, 0x5a, 0xec, 0xa3, 0xe9, 0xf8, 0xee, 0x04, 0x29, 0x90, 0x3a, 0x20, 0x13, 0x8e,
+	0xc8, 0x63, 0xf6, 0xc9, 0x28, 0x87, 0xba, 0xbd, 0x92, 0x14, 0x94, 0x43, 0xdd, 0x56, 0xbf, 0x4e,
+	0x40, 0xa1, 0xea, 0x38, 0xd4, 0xe7, 0xbd, 0x7b, 0x08, 0x41, 0xda, 0xd1, 0x87, 0x44, 0x0a, 0xf1,
+	0x6f, 0x54, 0x87, 0xac, 0xad, 0xef, 0x12, 0xdb, 0x5b, 0x49, 0x96, 0x53, 0x6f, 0x15, 0xd6, 0xbf,
+	0x5f, 0x79, 0x71, 0xc8, 0x95, 0x88, 0x92, 0xca, 0x16, 0x47, 0x73, 0x23, 0xb0, 0x14, 0x45, 0x9f,
+	0xc0, 0xbc, 0xe5, 0x98, 0x96, 0x41, 0xbc, 0x95, 0x34, 0xd7, 0xb2, 0x1a, 0xa7, 0x65, 0x6a, 0x7d,
+	0x2d, 0xfd, 0xd5, 0xe9, 0xda, 0x1c, 0x0e, 0x84, 0x4a, 0x0f, 0xa0, 0x10, 0x51, 0x1b, 0x33, 0xb6,
+	0x65, 0xc8, 0x1c, 0xea, 0xf6, 0x98, 0xc8, 0xd1, 0x89, 0xc6, 0x47, 0xc9, 0xfb, 0x09, 0xf5, 0x01,
+	0x2c, 0x3c, 0x22, 0x0e, 0x71, 0x2d, 0xa3, 0xe7, 0xbb, 0x96, 0x33, 0x60, 0x83, 0x3c, 0xb0, 0x1c,
+	0x33, 0x18, 0x24, 0xfb, 0x8e, 0x17, 0x57, 0x1f, 0xc2, 0x92, 0x14, 0x6d, 0x58, 0x9e, 0xe1, 0x12,
+	0x9f, 0x5c, 0x2d, 0x9c, 0x0a, 0x84, 0x7f, 0x37, 0x11, 0x4a, 0x63, 0xe2, 0xd1, 0xb1, 0x6b, 0x10,
+	0xf4, 0x01, 0xa4, 0x3c, 0xdf, 0xe5, 0xc2, 0x85, 0xf5, 0xd7, 0xe2, 0x5c, 0x30, 0x63, 0xea, 0xe6,
+	0x1c, 0x66, 0x78, 0x54, 0x85, 0x9c, 0x29, 0x0d, 0xe0, 0x7d, 0x14, 0xd6, 0x5f, 0xbf, 0x44, 0x36,
+	0xb0, 0x75, 0x73, 0x0e, 0x87, 0x62, 0x35, 0x80, 0x9c, 0x2b, 0xad, 0x50, 0x7f, 0x9c, 0x80, 0x7c,
+	0x60, 0x92, 0x87, 0xde, 0x86, 0xbc, 0xa3, 0x3b, 0x54, 0x33, 0x46, 0x63, 0x8f, 0x5b, 0x96, 0xaa,
+	0x15, 0xcf, 0x4e, 0xd7, 0x72, 0x6d, 0xdd, 0xa1, 0xf5, 0xee, 0x8e, 0x87, 0x73, 0x8c, 0x5d, 0x1f,
+	0x8d, 0x3d, 0xf4, 0x1a, 0x14, 0x87, 0x64, 0x48, 0xdd, 0x89, 0xb6, 0x3b, 0xf1, 0x89, 0x27, 0xc7,
+	0x5b, 0x10, 0xb4, 0x1a, 0x23, 0xa1, 0x8f, 0x61, 0x7e, 0x20, 0xcc, 0x58, 0x49, 0xf1, 0x89, 0xbe,
+	0xcc, 0xd2, 0xc0, 0x08, 0x1c, 0xc8, 0xa8, 0xbf, 0x9d, 0x80, 0xe5, 0x90, 0x4a, 0x7e, 0x69, 0x6c,
+	0xb9, 0x64, 0x48, 0x1c, 0xdf, 0x43, 0x1f, 0x40, 0xd6, 0xb6, 0x86, 0x96, 0xef, 0x49, 0xe7, 0xbd,
+	0x1a, 0xa7, 0x36, 0x1c, 0x14, 0x96, 0x60, 0x54, 0x85, 0xa2, 0x4b, 0x3c, 0xe2, 0x1e, 0x8a, 0xb5,
+	0x29, 0xbd, 0x77, 0x85, 0xf0, 0x8c, 0x88, 0xba, 0x01, 0xb9, 0xae, 0xad, 0xfb, 0x7b, 0xd4, 0x1d,
+	0x22, 0x15, 0x8a, 0xba, 0x6b, 0xec, 0x5b, 0x3e, 0x31, 0xfc, 0xb1, 0x1b, 0xec, 0x93, 0x19, 0x1a,
+	0xba, 0x01, 0x49, 0x2a, 0x3a, 0xca, 0xd7, 0xb2, 0x67, 0xa7, 0x6b, 0xc9, 0x4e, 0x0f, 0x27, 0xa9,
+	0xa7, 0x3e, 0x84, 0x6b, 0x5d, 0x7b, 0x3c, 0xb0, 0x9c, 0x06, 0xf1, 0x0c, 0xd7, 0x1a, 0x31, 0xed,
+	0x6c, 0x39, 0xb1, 0x68, 0x12, 0x2c, 0x27, 0xf6, 0x1d, 0x6e, 0xc2, 0xe4, 0x74, 0x13, 0xaa, 0xbf,
+	0x99, 0x84, 0x6b, 0x4d, 0x67, 0x60, 0x39, 0x24, 0x2a, 0x7d, 0x1b, 0x16, 0x09, 0x27, 0x6a, 0x87,
+	0x22, 0x30, 0x48, 0x3d, 0x0b, 0x82, 0x1a, 0x44, 0x8b, 0xd6, 0xb9, 0x1d, 0x7c, 0x37, 0x6e, 0xf8,
+	0x2f, 0x68, 0x8f, 0xdd, 0xc7, 0x4d, 0x98, 0x1f, 0xf1, 0x41, 0x78, 0x72, 0x7a, 0x6f, 0xc7, 0xe9,
+	0x7a, 0x61, 0x9c, 0xc1, 0x76, 0x96, 0xb2, 0xdf, 0x66, 0x3b, 0xff, 0x71, 0x12, 0x96, 0xda, 0xd4,
+	0x9c, 0xf1, 0x43, 0x09, 0x72, 0xfb, 0xd4, 0xf3, 0x23, 0xa1, 0x2b, 0x6c, 0xa3, 0xfb, 0x90, 0x1b,
+	0xc9, 0xe9, 0x93, 0xb3, 0x7f, 0x2b, 0xde, 0x64, 0x81, 0xc1, 0x21, 0x1a, 0x3d, 0x84, 0x7c, 0xb0,
+	0x65, 0xd8, 0x68, 0x5f, 0x62, 0xe1, 0x4c, 0xf1, 0xe8, 0x63, 0xc8, 0x8a, 0x49, 0x58, 0x49, 0x73,
+	0xc9, 0xdb, 0x2f, 0xe5, 0x73, 0x2c, 0x85, 0xd0, 0x23, 0xc8, 0xf9, 0xb6, 0xa7, 0x59, 0xce, 0x1e,
+	0x5d, 0xc9, 0x70, 0x05, 0x6b, 0x71, 0x0a, 0x98, 0x23, 0xfa, 0x5b, 0xbd, 0x96, 0xb3, 0x47, 0x6b,
+	0x85, 0xb3, 0xd3, 0xb5, 0x79, 0xd9, 0xc0, 0xf3, 0xbe, 0xed, 0xb1, 0x0f, 0xf5, 0x77, 0x12, 0x50,
+	0x88, 0xa0, 0xd0, 0xab, 0x00, 0xbe, 0x3b, 0xf6, 0x7c, 0xcd, 0xa5, 0xd4, 0xe7, 0xce, 0x2a, 0xe2,
+	0x3c, 0xa7, 0x60, 0x4a, 0x7d, 0x54, 0x81, 0xeb, 0x06, 0x71, 0x7d, 0xcd, 0xf2, 0xbc, 0x31, 0x71,
+	0x35, 0x6f, 0xbc, 0xfb, 0x05, 0x31, 0x7c, 0xee, 0xb8, 0x22, 0xbe, 0xc6, 0x58, 0x2d, 0xce, 0xe9,
+	0x09, 0x06, 0xba, 0x07, 0x37, 0xa2, 0xf8, 0xd1, 0x78, 0xd7, 0xb6, 0x0c, 0x8d, 0x4d, 0x66, 0x8a,
+	0x8b, 0x5c, 0x9f, 0x8a, 0x74, 0x39, 0xef, 0x31, 0x99, 0xa8, 0x3f, 0x4d, 0x80, 0x82, 0xf5, 0x3d,
+	0x7f, 0x9b, 0x0c, 0x77, 0x89, 0xdb, 0xf3, 0x75, 0x7f, 0xec, 0xa1, 0x1b, 0x90, 0xb5, 0x89, 0x6e,
+	0x12, 0x11, 0x1d, 0x73, 0x58, 0xb6, 0xd0, 0x0e, 0xdb, 0xc1, 0xba, 0xb1, 0xaf, 0xef, 0x5a, 0xb6,
+	0xe5, 0x4f, 0xb8, 0x29, 0x8b, 0xf1, 0x4b, 0xf8, 0xbc, 0xce, 0x0a, 0x8e, 0x08, 0xe2, 0x19, 0x35,
+	0x68, 0x05, 0xe6, 0x87, 0xc4, 0xf3, 0xf4, 0x01, 0xe1, 0x96, 0xe6, 0x71, 0xd0, 0x54, 0x1f, 0x42,
+	0x31, 0x2a, 0x87, 0x0a, 0x30, 0xbf, 0xd3, 0x7e, 0xdc, 0xee, 0x3c, 0x6d, 0x2b, 0x73, 0x68, 0x09,
+	0x0a, 0x3b, 0x6d, 0xdc, 0xac, 0xd6, 0x37, 0xab, 0xb5, 0xad, 0xa6, 0x92, 0x40, 0x0b, 0x90, 0x9f,
+	0x36, 0x93, 0xea, 0x9f, 0x26, 0x00, 0x98, 0xbb, 0xe5, 0xa0, 0x3e, 0x82, 0x8c, 0xe7, 0xeb, 0xbe,
+	0x58, 0x95, 0x8b, 0xeb, 0x6f, 0x5c, 0x34, 0x87, 0xd2, 0x5e, 0xf6, 0x8f, 0x60, 0x21, 0x12, 0xb5,
+	0x30, 0x39, 0x63, 0x21, 0x0b, 0x10, 0xba, 0x69, 0xba, 0xd2, 0x70, 0xfe, 0xad, 0x3e, 0x84, 0x0c,
+	0x97, 0x9e, 0x35, 0x37, 0x07, 0xe9, 0x06, 0xfb, 0x4a, 0xa0, 0x3c, 0x64, 0x70, 0xb3, 0xda, 0xf8,
+	0x5c, 0x49, 0x22, 0x05, 0x8a, 0x8d, 0x56, 0xaf, 0xde, 0x69, 0xb7, 0x9b, 0xf5, 0x7e, 0xb3, 0xa1,
+	0xa4, 0xd4, 0xdb, 0x90, 0x69, 0x0d, 0x99, 0xe6, 0x5b, 0x6c, 0xc9, 0xef, 0x11, 0x97, 0x38, 0x46,
+	0xb0, 0x93, 0xa6, 0x04, 0xf5, 0x27, 0x79, 0xc8, 0x6c, 0xd3, 0xb1, 0xe3, 0xa3, 0xf5, 0x48, 0xd8,
+	0x5a, 0x8c, 0x3f, 0xcb, 0x39, 0xb0, 0xd2, 0x9f, 0x8c, 0x88, 0x0c, 0x6b, 0x37, 0x20, 0x2b, 0x36,
+	0x87, 0x1c, 0x8e, 0x6c, 0x31, 0xba, 0xaf, 0xbb, 0x03, 0xe2, 0xcb, 0xf1, 0xc8, 0x16, 0x7a, 0x8b,
+	0x9d, 0x58, 0xba, 0x49, 0x1d, 0x7b, 0xc2, 0xf7, 0x50, 0x4e, 0x1c, 0x4b, 0x98, 0xe8, 0x66, 0xc7,
+	0xb1, 0x27, 0x38, 0xe4, 0xa2, 0x4d, 0x28, 0xee, 0x5a, 0x8e, 0xa9, 0xd1, 0x91, 0x08, 0xf2, 0x99,
+	0x8b, 0x77, 0x9c, 0xb0, 0xaa, 0x66, 0x39, 0x66, 0x47, 0x80, 0x71, 0x61, 0x77, 0xda, 0x40, 0x6d,
+	0x58, 0x3c, 0xa4, 0xf6, 0x78, 0x48, 0x42, 0x5d, 0x59, 0xae, 0xeb, 0xcd, 0x8b, 0x75, 0x3d, 0xe1,
+	0xf8, 0x40, 0xdb, 0xc2, 0x61, 0xb4, 0x89, 0x1e, 0xc3, 0x82, 0x3f, 0x1c, 0xed, 0x79, 0xa1, 0xba,
+	0x79, 0xae, 0xee, 0x7b, 0x97, 0x38, 0x8c, 0xc1, 0x03, 0x6d, 0x45, 0x3f, 0xd2, 0x2a, 0xfd, 0x7a,
+	0x0a, 0x0a, 0x11, 0xcb, 0x51, 0x0f, 0x0a, 0x23, 0x97, 0x8e, 0xf4, 0x01, 0x3f, 0xa8, 0xe4, 0x5c,
+	0xdc, 0x7d, 0xa9, 0x51, 0x57, 0xba, 0x53, 0x41, 0x1c, 0xd5, 0xa2, 0x9e, 0x24, 0xa1, 0x10, 0x61,
+	0xa2, 0x77, 0x20, 0x87, 0xbb, 0xb8, 0xf5, 0xa4, 0xda, 0x6f, 0x2a, 0x73, 0xa5, 0x5b, 0xc7, 0x27,
+	0xe5, 0x15, 0xae, 0x2d, 0xaa, 0xa0, 0xeb, 0x5a, 0x87, 0x6c, 0xe9, 0xbd, 0x05, 0xf3, 0x01, 0x34,
+	0x51, 0x7a, 0xe5, 0xf8, 0xa4, 0xfc, 0xdd, 0xf3, 0xd0, 0x08, 0x12, 0xf7, 0x36, 0xab, 0xb8, 0xd9,
+	0x50, 0x92, 0xf1, 0x48, 0xdc, 0xdb, 0xd7, 0x5d, 0x62, 0xa2, 0xef, 0x41, 0x56, 0x02, 0x53, 0xa5,
+	0xd2, 0xf1, 0x49, 0xf9, 0xc6, 0x79, 0xe0, 0x14, 0x87, 0x7b, 0x5b, 0xd5, 0x27, 0x4d, 0x25, 0x1d,
+	0x8f, 0xc3, 0x3d, 0x5b, 0x3f, 0x24, 0xe8, 0x0d, 0xc8, 0x08, 0x58, 0xa6, 0x74, 0xf3, 0xf8, 0xa4,
+	0xfc, 0x9d, 0x17, 0xd4, 0x31, 0x54, 0x69, 0xe5, 0xb7, 0xfe, 0x60, 0x75, 0xee, 0x2f, 0xff, 0x70,
+	0x55, 0x39, 0xcf, 0x2e, 0xfd, 0x77, 0x02, 0x16, 0x66, 0xa6, 0x1c, 0xa9, 0x90, 0x75, 0xa8, 0x41,
+	0x47, 0xe2, 0xfc, 0xca, 0xd5, 0xe0, 0xec, 0x74, 0x2d, 0xdb, 0xa6, 0x75, 0x3a, 0x9a, 0x60, 0xc9,
+	0x41, 0x8f, 0xcf, 0x9d, 0xc0, 0xf7, 0x5e, 0x72, 0x3d, 0xc5, 0x9e, 0xc1, 0x9f, 0xc2, 0x82, 0xe9,
+	0x5a, 0x87, 0xc4, 0xd5, 0x0c, 0xea, 0xec, 0x59, 0x03, 0x79, 0x36, 0x95, 0xe2, 0x74, 0x36, 0x38,
+	0x10, 0x17, 0x85, 0x40, 0x9d, 0xe3, 0xbf, 0xc5, 0xe9, 0x5b, 0x7a, 0x02, 0xc5, 0xe8, 0x0a, 0x65,
+	0xc7, 0x89, 0x67, 0xfd, 0x32, 0x91, 0xf9, 0x20, 0xcf, 0x1e, 0x71, 0x9e, 0x51, 0x44, 0x36, 0xf8,
+	0x26, 0xa4, 0x87, 0xd4, 0x14, 0x7a, 0x16, 0x6a, 0xd7, 0x59, 0x12, 0xf0, 0x4f, 0xa7, 0x6b, 0x05,
+	0xea, 0x55, 0x36, 0x2c, 0x9b, 0x6c, 0x53, 0x93, 0x60, 0x0e, 0x50, 0x0f, 0x21, 0xcd, 0x42, 0x05,
+	0x7a, 0x05, 0xd2, 0xb5, 0x56, 0xbb, 0xa1, 0xcc, 0x95, 0xae, 0x1d, 0x9f, 0x94, 0x17, 0xb8, 0x4b,
+	0x18, 0x83, 0xad, 0x5d, 0xb4, 0x06, 0xd9, 0x27, 0x9d, 0xad, 0x9d, 0x6d, 0xb6, 0xbc, 0xae, 0x1f,
+	0x9f, 0x94, 0x97, 0x42, 0xb6, 0x70, 0x1a, 0x7a, 0x15, 0x32, 0xfd, 0xed, 0xee, 0x46, 0x4f, 0x49,
+	0x96, 0xd0, 0xf1, 0x49, 0x79, 0x31, 0xe4, 0x73, 0x9b, 0x4b, 0xd7, 0xe4, 0xac, 0xe6, 0x43, 0xba,
+	0xfa, 0xb3, 0x24, 0x2c, 0x60, 0x56, 0x9b, 0xb9, 0x7e, 0x97, 0xda, 0x96, 0x31, 0x41, 0x5d, 0xc8,
+	0x1b, 0xd4, 0x31, 0xad, 0xc8, 0x9e, 0x5a, 0xbf, 0xe0, 0xd4, 0x9f, 0x4a, 0x05, 0xad, 0x7a, 0x20,
+	0x89, 0xa7, 0x4a, 0xd0, 0x7b, 0x90, 0x31, 0x89, 0xad, 0x4f, 0x64, 0xfa, 0x71, 0xb3, 0x22, 0xaa,
+	0xbf, 0x4a, 0x50, 0xfd, 0x55, 0x1a, 0xb2, 0xfa, 0xc3, 0x02, 0xc7, 0xd3, 0x6c, 0xfd, 0x99, 0xa6,
+	0xfb, 0x3e, 0x19, 0x8e, 0x7c, 0x91, 0x7b, 0xa4, 0x71, 0x61, 0xa8, 0x3f, 0xab, 0x4a, 0x12, 0xba,
+	0x0b, 0xd9, 0x23, 0xcb, 0x31, 0xe9, 0x91, 0x4c, 0x2f, 0x2e, 0x51, 0x2a, 0x81, 0xea, 0x31, 0x3b,
+	0x75, 0xcf, 0x99, 0xc9, 0xfc, 0xdd, 0xee, 0xb4, 0x9b, 0x81, 0xbf, 0x25, 0xbf, 0xe3, 0xb4, 0xa9,
+	0xc3, 0xf6, 0x0a, 0x74, 0xda, 0xda, 0x46, 0xb5, 0xb5, 0xb5, 0x83, 0x99, 0xcf, 0x97, 0x8f, 0x4f,
+	0xca, 0x4a, 0x08, 0xd9, 0xd0, 0x2d, 0x9b, 0xe5, 0xbb, 0x37, 0x21, 0x55, 0x6d, 0x7f, 0xae, 0x24,
+	0x4b, 0xca, 0xf1, 0x49, 0xb9, 0x18, 0xb2, 0xab, 0xce, 0x64, 0xba, 0x8d, 0xce, 0xf7, 0xab, 0xfe,
+	0x6d, 0x0a, 0x8a, 0x3b, 0x23, 0x53, 0xf7, 0x89, 0x58, 0x93, 0xa8, 0x0c, 0x85, 0x91, 0xee, 0xea,
+	0xb6, 0x4d, 0x6c, 0xcb, 0x1b, 0xca, 0xba, 0x36, 0x4a, 0x42, 0x0f, 0x5e, 0xd6, 0x8d, 0xb5, 0x1c,
+	0x5b, 0x67, 0x3f, 0xfe, 0x97, 0xb5, 0x44, 0xe0, 0xd0, 0x1d, 0x58, 0xdc, 0x13, 0xd6, 0x6a, 0xba,
+	0xc1, 0x27, 0x36, 0xc5, 0x27, 0xb6, 0x12, 0x37, 0xb1, 0x51, 0xb3, 0x2a, 0x72, 0x90, 0x55, 0x2e,
+	0x85, 0x17, 0xf6, 0xa2, 0x4d, 0x74, 0x0f, 0xe6, 0x87, 0xd4, 0xb1, 0x7c, 0xea, 0x5e, 0x3d, 0x0b,
+	0x01, 0x12, 0xbd, 0x03, 0xd7, 0xd8, 0xe4, 0x06, 0xf6, 0x70, 0x36, 0x3f, 0xb1, 0x92, 0x78, 0x69,
+	0xa8, 0x3f, 0x93, 0x1d, 0x62, 0x46, 0x46, 0x35, 0xc8, 0x50, 0x97, 0xa5, 0x44, 0x59, 0x6e, 0xee,
+	0xbb, 0x57, 0x9a, 0x2b, 0x1a, 0x1d, 0x26, 0x83, 0x85, 0xa8, 0xfa, 0x21, 0x2c, 0xcc, 0x0c, 0x82,
+	0x65, 0x02, 0xdd, 0xea, 0x4e, 0xaf, 0xa9, 0xcc, 0xa1, 0x22, 0xe4, 0xea, 0x9d, 0x76, 0xbf, 0xd5,
+	0xde, 0x61, 0xa9, 0x4c, 0x11, 0x72, 0xb8, 0xb3, 0xb5, 0x55, 0xab, 0xd6, 0x1f, 0x2b, 0x49, 0xb5,
+	0x02, 0x85, 0x88, 0x36, 0xb4, 0x08, 0xd0, 0xeb, 0x77, 0xba, 0xda, 0x46, 0x0b, 0xf7, 0xfa, 0x22,
+	0x11, 0xea, 0xf5, 0xab, 0xb8, 0x2f, 0x09, 0x09, 0xf5, 0x3f, 0x92, 0xc1, 0x8c, 0xca, 0xdc, 0xa7,
+	0x36, 0x9b, 0xfb, 0x5c, 0x62, 0xbc, 0xcc, 0x7e, 0xa6, 0x8d, 0x30, 0x07, 0x7a, 0x00, 0xc0, 0x17,
+	0x0e, 0x31, 0x35, 0xdd, 0x97, 0x13, 0x5f, 0x7a, 0xc1, 0xc9, 0xfd, 0xe0, 0x7a, 0x05, 0xe7, 0x25,
+	0xba, 0xea, 0xa3, 0x8f, 0xa1, 0x68, 0xd0, 0xe1, 0xc8, 0x26, 0x52, 0x38, 0x75, 0xa5, 0x70, 0x21,
+	0xc4, 0x57, 0xfd, 0x68, 0xf6, 0x95, 0x9e, 0xcd, 0x0f, 0x7f, 0x23, 0x11, 0x78, 0x26, 0x26, 0xe1,
+	0x2a, 0x42, 0x6e, 0xa7, 0xdb, 0xa8, 0xf6, 0x5b, 0xed, 0x47, 0x4a, 0x02, 0x01, 0x64, 0xb9, 0xab,
+	0x1b, 0x4a, 0x92, 0x25, 0x8a, 0xf5, 0xce, 0x76, 0x77, 0xab, 0xc9, 0x53, 0x2e, 0xb4, 0x0c, 0x4a,
+	0xe0, 0x6c, 0x8d, 0x3b, 0xb2, 0xd9, 0x50, 0xd2, 0xe8, 0x3a, 0x2c, 0x85, 0x54, 0x29, 0x99, 0x41,
+	0x37, 0x00, 0x85, 0xc4, 0xa9, 0x8a, 0xac, 0xfa, 0xab, 0xb0, 0x54, 0xa7, 0x8e, 0xaf, 0x5b, 0x4e,
+	0x98, 0x44, 0xaf, 0xb3, 0x41, 0x4b, 0x92, 0x66, 0xc9, 0x5b, 0x8a, 0xda, 0xd2, 0xd9, 0xe9, 0x5a,
+	0x21, 0x84, 0xb6, 0x1a, 0x6c, 0xa4, 0x41, 0xc3, 0x64, 0xfb, 0x77, 0x64, 0x99, 0xdc, 0xb9, 0x99,
+	0xda, 0xfc, 0xd9, 0xe9, 0x5a, 0xaa, 0xdb, 0x6a, 0x60, 0x46, 0x43, 0xaf, 0x40, 0x9e, 0x3c, 0xb3,
+	0x7c, 0xcd, 0x60, 0x31, 0x9c, 0x39, 0x30, 0x83, 0x73, 0x8c, 0x50, 0x67, 0x21, 0xbb, 0x06, 0xd0,
+	0xa5, 0xae, 0x2f, 0x7b, 0x7e, 0x1f, 0x32, 0x23, 0xea, 0xf2, 0xf2, 0xfc, 0xc2, 0xeb, 0x1d, 0x06,
+	0x17, 0x0b, 0x15, 0x0b, 0xb0, 0xfa, 0x57, 0x49, 0x80, 0xbe, 0xee, 0x1d, 0x48, 0x25, 0xf7, 0x21,
+	0x1f, 0x5e, 0x95, 0xc9, 0x3a, 0xff, 0xd2, 0xd9, 0x0e, 0xc1, 0xe8, 0x5e, 0xb0, 0xd8, 0x44, 0x79,
+	0x10, 0x5b, 0xa7, 0x05, 0x1d, 0xc5, 0x65, 0xd8, 0xb3, 0x35, 0x00, 0x3b, 0x12, 0x89, 0xeb, 0xca,
+	0x99, 0x67, 0x9f, 0xa8, 0xce, 0x8f, 0x05, 0xe1, 0x34, 0x99, 0x60, 0xc6, 0xde, 0x6c, 0x9c, 0x9b,
+	0x91, 0xcd, 0x39, 0x3c, 0x95, 0x43, 0x9f, 0x42, 0x81, 0x8d, 0x5b, 0xf3, 0x38, 0x4f, 0xe6, 0x96,
+	0x17, 0xba, 0x4a, 0x68, 0xc0, 0x30, 0x0a, 0xbf, 0x6b, 0x0a, 0x2c, 0xba, 0x63, 0x87, 0x0d, 0x5b,
+	0xea, 0x50, 0xff, 0x24, 0x09, 0xdf, 0x6d, 0x13, 0xff, 0x88, 0xba, 0x07, 0x55, 0xdf, 0xd7, 0x8d,
+	0xfd, 0x21, 0x71, 0xa4, 0x93, 0x23, 0x99, 0x75, 0x62, 0x26, 0xb3, 0x5e, 0x81, 0x79, 0xdd, 0xb6,
+	0x74, 0x8f, 0x88, 0x74, 0x24, 0x8f, 0x83, 0x26, 0xcb, 0xff, 0x59, 0x35, 0x41, 0x3c, 0x8f, 0x88,
+	0x02, 0x3f, 0x8f, 0xa7, 0x04, 0xf4, 0x23, 0xb8, 0x21, 0x13, 0x0f, 0x3d, 0xec, 0x8a, 0x65, 0xb6,
+	0xc1, 0x9d, 0x5e, 0x33, 0xb6, 0xbc, 0x89, 0x37, 0x4e, 0x66, 0x26, 0x53, 0x72, 0x67, 0xe4, 0xcb,
+	0x3c, 0x67, 0xd9, 0x8c, 0x61, 0x95, 0x1e, 0xc1, 0xcd, 0x0b, 0x45, 0xbe, 0xd1, 0x05, 0xc2, 0x3f,
+	0x24, 0x01, 0x5a, 0xdd, 0xea, 0xb6, 0x74, 0x52, 0x03, 0xb2, 0x7b, 0xfa, 0xd0, 0xb2, 0x27, 0x97,
+	0xc5, 0xa9, 0x29, 0xbe, 0x52, 0x15, 0xee, 0xd8, 0xe0, 0x32, 0x58, 0xca, 0xf2, 0xe2, 0x66, 0xbc,
+	0xeb, 0x10, 0x3f, 0x2c, 0x6e, 0x78, 0x8b, 0x99, 0xe1, 0xea, 0x4e, 0xb8, 0xc0, 0x44, 0x83, 0x4d,
+	0xc0, 0x40, 0xf7, 0xc9, 0x91, 0x3e, 0x09, 0x82, 0x8b, 0x6c, 0xa2, 0x4d, 0x7e, 0x4d, 0x47, 0xdc,
+	0x43, 0x62, 0xae, 0x64, 0xb8, 0x53, 0xaf, 0xb2, 0x07, 0x4b, 0xb8, 0xf0, 0x5d, 0x28, 0x5d, 0x7a,
+	0xc8, 0x13, 0x9b, 0x29, 0xeb, 0x1b, 0xf9, 0xe8, 0x0e, 0x2c, 0xcc, 0x8c, 0xf3, 0x85, 0xaa, 0xb2,
+	0xd5, 0x7d, 0xf2, 0xbe, 0x92, 0x96, 0x5f, 0x1f, 0x2a, 0x59, 0xf5, 0x8f, 0x52, 0x22, 0x1c, 0x48,
+	0xaf, 0xc6, 0x5f, 0x24, 0xe7, 0xf8, 0x26, 0x36, 0xa8, 0x2d, 0xb7, 0xe9, 0x9b, 0x97, 0x47, 0x09,
+	0x56, 0xa5, 0x70, 0x38, 0x0e, 0x05, 0xd1, 0x1a, 0x14, 0xc4, 0x2a, 0xd6, 0xd8, 0xb6, 0xe0, 0x6e,
+	0x5d, 0xc0, 0x20, 0x48, 0x4c, 0x12, 0xdd, 0x86, 0x45, 0x7e, 0x0b, 0xe1, 0xed, 0x13, 0x53, 0x60,
+	0xd2, 0x1c, 0xb3, 0x10, 0x52, 0x39, 0x6c, 0x1b, 0x8a, 0x92, 0xa0, 0xf1, 0x0c, 0x35, 0xc3, 0x0d,
+	0x7a, 0xe7, 0x2a, 0x83, 0x84, 0x08, 0x4f, 0x5c, 0x0b, 0xa3, 0x69, 0x43, 0x6d, 0x40, 0x2e, 0x30,
+	0x16, 0xad, 0x40, 0xaa, 0x5f, 0xef, 0x2a, 0x73, 0xa5, 0xa5, 0xe3, 0x93, 0x72, 0x21, 0x20, 0xf7,
+	0xeb, 0x5d, 0xc6, 0xd9, 0x69, 0x74, 0x95, 0xc4, 0x2c, 0x67, 0xa7, 0xd1, 0x2d, 0xa5, 0x59, 0xa6,
+	0xa4, 0xee, 0x41, 0x21, 0xd2, 0x03, 0x7a, 0x1d, 0xe6, 0x5b, 0xed, 0x47, 0xb8, 0xd9, 0xeb, 0x29,
+	0x73, 0xa5, 0x1b, 0xc7, 0x27, 0x65, 0x14, 0xe1, 0xb6, 0x9c, 0x01, 0x9b, 0x1f, 0xf4, 0x2a, 0xa4,
+	0x37, 0x3b, 0xec, 0x04, 0x16, 0x29, 0x71, 0x04, 0xb1, 0x49, 0x3d, 0xbf, 0x74, 0x5d, 0xa6, 0x60,
+	0x51, 0xc5, 0xea, 0xef, 0x25, 0x20, 0x2b, 0x36, 0x53, 0xec, 0x44, 0x55, 0x61, 0x3e, 0xa8, 0x57,
+	0x45, 0xb9, 0xf2, 0xe6, 0xc5, 0xa5, 0x45, 0x45, 0x56, 0x02, 0x62, 0xf9, 0x05, 0x72, 0xa5, 0x8f,
+	0xa0, 0x18, 0x65, 0x7c, 0xa3, 0xc5, 0xf7, 0x23, 0x28, 0xb0, 0xf5, 0x1d, 0x94, 0x18, 0xeb, 0x90,
+	0x15, 0x01, 0x21, 0x3c, 0x11, 0x2e, 0xae, 0x73, 0x24, 0x12, 0xdd, 0x87, 0x79, 0x51, 0x1b, 0x05,
+	0xd7, 0x94, 0xab, 0x97, 0xef, 0x22, 0x1c, 0xc0, 0xd5, 0x4f, 0x21, 0xdd, 0x25, 0xc4, 0x65, 0xbe,
+	0x77, 0xa8, 0x49, 0xa6, 0x87, 0xa8, 0x2c, 0xeb, 0x4c, 0xd2, 0x6a, 0xb0, 0xb2, 0xce, 0x24, 0x2d,
+	0x33, 0xbc, 0x88, 0x49, 0x46, 0x2e, 0x62, 0xfa, 0x50, 0x7c, 0x4a, 0xac, 0xc1, 0xbe, 0x4f, 0x4c,
+	0xae, 0xe8, 0x5d, 0x48, 0x8f, 0x48, 0x68, 0xfc, 0x4a, 0xec, 0x02, 0x23, 0xc4, 0xc5, 0x1c, 0xc5,
+	0xe2, 0xc8, 0x11, 0x97, 0x96, 0x77, 0xeb, 0xb2, 0xa5, 0xfe, 0x7d, 0x12, 0x16, 0x5b, 0x9e, 0x37,
+	0xd6, 0x1d, 0x23, 0xc8, 0xaf, 0x3e, 0x99, 0xcd, 0xaf, 0xde, 0x8a, 0x1d, 0xe1, 0x8c, 0xc8, 0xec,
+	0xfd, 0x92, 0x3c, 0xe3, 0x92, 0xe1, 0x19, 0xa7, 0xfe, 0x7b, 0x22, 0xb8, 0x44, 0xba, 0x1d, 0xd9,
+	0xee, 0xa5, 0x95, 0xe3, 0x93, 0xf2, 0x72, 0x54, 0x13, 0xd9, 0x71, 0x0e, 0x1c, 0x7a, 0xe4, 0xa0,
+	0xd7, 0x20, 0x83, 0x9b, 0xed, 0xe6, 0x53, 0x25, 0x21, 0x96, 0xe7, 0x0c, 0x08, 0x13, 0x87, 0x1c,
+	0x31, 0x4d, 0xdd, 0x66, 0xbb, 0xc1, 0xf2, 0xa1, 0x64, 0x8c, 0xa6, 0x2e, 0x71, 0x4c, 0xcb, 0x19,
+	0xa0, 0xd7, 0x21, 0xdb, 0xea, 0xf5, 0x76, 0x78, 0x99, 0xff, 0xdd, 0xe3, 0x93, 0xf2, 0xf5, 0x19,
+	0x14, 0xbf, 0x40, 0x34, 0x19, 0x88, 0x15, 0x23, 0x2c, 0x53, 0x8a, 0x01, 0xb1, 0x2c, 0x57, 0x80,
+	0x70, 0xa7, 0x5f, 0xed, 0xb3, 0x0a, 0xff, 0x45, 0x10, 0xa6, 0xec, 0xaf, 0xdc, 0x6e, 0xff, 0x9c,
+	0x04, 0xa5, 0x6a, 0x18, 0x64, 0xe4, 0x33, 0xbe, 0xac, 0xff, 0xfa, 0x90, 0x1b, 0xb1, 0x2f, 0x8b,
+	0x04, 0xb9, 0xcc, 0xfd, 0xd8, 0x07, 0xaf, 0x73, 0x72, 0x15, 0x4c, 0x6d, 0x52, 0x35, 0x87, 0x96,
+	0xe7, 0x59, 0xd4, 0x11, 0x34, 0x1c, 0x6a, 0x2a, 0xfd, 0x67, 0x02, 0xae, 0xc7, 0x20, 0xd0, 0x1d,
+	0x48, 0xbb, 0xd4, 0x0e, 0xe6, 0xf0, 0xd6, 0x45, 0xf7, 0x83, 0x4c, 0x14, 0x73, 0x24, 0x5a, 0x05,
+	0xd0, 0xc7, 0x3e, 0xd5, 0x79, 0xff, 0x7c, 0xf6, 0x72, 0x38, 0x42, 0x41, 0x4f, 0x21, 0xeb, 0x11,
+	0xc3, 0x25, 0x41, 0xc6, 0xfb, 0xe9, 0xff, 0xd5, 0xfa, 0x4a, 0x8f, 0xab, 0xc1, 0x52, 0x5d, 0xa9,
+	0x02, 0x59, 0x41, 0x61, 0xcb, 0xde, 0xd4, 0x7d, 0x5d, 0xde, 0x1e, 0xf3, 0x6f, 0xb6, 0x9a, 0x74,
+	0x7b, 0x10, 0xac, 0x26, 0xdd, 0x1e, 0xa8, 0x7f, 0x93, 0x04, 0x68, 0x3e, 0xf3, 0x89, 0xeb, 0xe8,
+	0x76, 0xbd, 0x8a, 0x9a, 0x91, 0xe8, 0x2f, 0x46, 0xfb, 0x76, 0xec, 0x95, 0x78, 0x28, 0x51, 0xa9,
+	0x57, 0x63, 0xe2, 0xff, 0x4d, 0x48, 0x8d, 0x5d, 0xf9, 0x86, 0x29, 0xb2, 0xd5, 0x1d, 0xbc, 0x85,
+	0x19, 0x0d, 0x35, 0xa7, 0x61, 0x2b, 0x75, 0xf1, 0x4b, 0x65, 0xa4, 0x83, 0xd8, 0xd0, 0xc5, 0x76,
+	0xbe, 0xa1, 0x6b, 0x06, 0x91, 0x27, 0x47, 0x51, 0xec, 0xfc, 0x7a, 0xb5, 0x4e, 0x5c, 0x1f, 0x67,
+	0x0d, 0x9d, 0xfd, 0xff, 0x56, 0xf1, 0xed, 0x5d, 0x80, 0xe9, 0xd0, 0xd0, 0x2a, 0x64, 0xea, 0x1b,
+	0xbd, 0xde, 0x96, 0x32, 0x27, 0x02, 0xf8, 0x94, 0xc5, 0xc9, 0xea, 0x5f, 0x24, 0x21, 0x57, 0xaf,
+	0xca, 0x63, 0xb5, 0x0e, 0x0a, 0x8f, 0x4a, 0xfc, 0xce, 0x9d, 0x3c, 0x1b, 0x59, 0xee, 0x44, 0x06,
+	0x96, 0x4b, 0x4a, 0xcf, 0x45, 0x26, 0xc2, 0xac, 0x6e, 0x72, 0x01, 0x84, 0xa1, 0x48, 0xa4, 0x13,
+	0x34, 0x43, 0x0f, 0x62, 0xfc, 0xea, 0xe5, 0xce, 0x12, 0x45, 0xc4, 0xb4, 0xed, 0xe1, 0x42, 0xa0,
+	0xa4, 0xae, 0x7b, 0xe8, 0x01, 0x2c, 0x79, 0xd6, 0xc0, 0xb1, 0x9c, 0x81, 0x16, 0x38, 0x8f, 0x3f,
+	0x00, 0xd4, 0xae, 0x9d, 0x9d, 0xae, 0x2d, 0xf4, 0x04, 0x4b, 0xfa, 0x70, 0x41, 0x22, 0xeb, 0xdc,
+	0x95, 0xe8, 0x43, 0x58, 0x8c, 0x88, 0x32, 0x2f, 0x0a, 0xb7, 0x2b, 0x67, 0xa7, 0x6b, 0xc5, 0x50,
+	0xf2, 0x31, 0x99, 0xe0, 0x62, 0x28, 0xf8, 0x98, 0xf0, 0x5b, 0x92, 0x3d, 0xea, 0x1a, 0x44, 0x73,
+	0xf9, 0x9e, 0xe6, 0x27, 0x78, 0x1a, 0x17, 0x38, 0x4d, 0x6c, 0x73, 0xf5, 0x09, 0x5c, 0xef, 0xb8,
+	0xc6, 0x3e, 0xf1, 0x7c, 0xe1, 0x0a, 0xe9, 0xc5, 0x4f, 0xe1, 0x96, 0xaf, 0x7b, 0x07, 0xda, 0xbe,
+	0xe5, 0xf9, 0xd4, 0x9d, 0x68, 0x2e, 0xf1, 0x89, 0xc3, 0xf8, 0x1a, 0x7f, 0x35, 0x94, 0xd7, 0x58,
+	0x37, 0x19, 0x66, 0x53, 0x40, 0x70, 0x80, 0xd8, 0x62, 0x00, 0xb5, 0x05, 0x45, 0x56, 0x4c, 0x34,
+	0xc8, 0x9e, 0x3e, 0xb6, 0x7d, 0x36, 0x7a, 0xb0, 0xe9, 0x40, 0x7b, 0xe9, 0x63, 0x2a, 0x6f, 0xd3,
+	0x81, 0xf8, 0x54, 0x7f, 0x08, 0x4a, 0xc3, 0xf2, 0x46, 0xba, 0x6f, 0xec, 0x07, 0xf7, 0x73, 0xa8,
+	0x01, 0xca, 0x3e, 0xd1, 0x5d, 0x7f, 0x97, 0xe8, 0xbe, 0x36, 0x22, 0xae, 0x45, 0xcd, 0xab, 0x67,
+	0x79, 0x29, 0x14, 0xe9, 0x72, 0x09, 0xf5, 0xbf, 0x12, 0x00, 0x58, 0xdf, 0x0b, 0x32, 0xb2, 0xef,
+	0xc3, 0x35, 0xcf, 0xd1, 0x47, 0xde, 0x3e, 0xf5, 0x35, 0xcb, 0xf1, 0x89, 0x7b, 0xa8, 0xdb, 0xf2,
+	0x9a, 0x45, 0x09, 0x18, 0x2d, 0x49, 0x47, 0xef, 0x02, 0x3a, 0x20, 0x64, 0xa4, 0x51, 0xdb, 0xd4,
+	0x02, 0xa6, 0x78, 0xd3, 0x4c, 0x63, 0x85, 0x71, 0x3a, 0xb6, 0xd9, 0x0b, 0xe8, 0xa8, 0x06, 0xab,
+	0x6c, 0xf8, 0xc4, 0xf1, 0x5d, 0x8b, 0x78, 0xda, 0x1e, 0x75, 0x35, 0xcf, 0xa6, 0x47, 0xda, 0x1e,
+	0xb5, 0x6d, 0x7a, 0x44, 0xdc, 0xe0, 0x06, 0xab, 0x64, 0xd3, 0x41, 0x53, 0x80, 0x36, 0xa8, 0xdb,
+	0xb3, 0xe9, 0xd1, 0x46, 0x80, 0x60, 0x69, 0xdb, 0x74, 0xcc, 0xbe, 0x65, 0x1c, 0x04, 0x69, 0x5b,
+	0x48, 0xed, 0x5b, 0xc6, 0x01, 0x7a, 0x1d, 0x16, 0x88, 0x4d, 0xf8, 0x45, 0x86, 0x40, 0x65, 0x38,
+	0xaa, 0x18, 0x10, 0x19, 0x48, 0xfd, 0x0c, 0x94, 0xa6, 0x63, 0xb8, 0x93, 0x51, 0x64, 0xce, 0xdf,
+	0x05, 0xc4, 0x82, 0xa4, 0x66, 0x53, 0xe3, 0x40, 0x1b, 0xea, 0x8e, 0x3e, 0x60, 0x76, 0x89, 0xa7,
+	0x26, 0x85, 0x71, 0xb6, 0xa8, 0x71, 0xb0, 0x2d, 0xe9, 0xea, 0x03, 0x80, 0xde, 0xc8, 0x25, 0xba,
+	0xd9, 0x61, 0xd9, 0x04, 0x73, 0x1d, 0x6f, 0x69, 0xa6, 0x7c, 0xaa, 0xa3, 0xae, 0xdc, 0xea, 0x8a,
+	0x60, 0x34, 0x42, 0xba, 0xfa, 0x0b, 0x70, 0xbd, 0x6b, 0xeb, 0x06, 0x7f, 0xb6, 0xee, 0x86, 0x6f,
+	0x27, 0xe8, 0x3e, 0x64, 0x05, 0x54, 0xce, 0x64, 0xec, 0x76, 0x9b, 0xf6, 0xb9, 0x39, 0x87, 0x25,
+	0xbe, 0x56, 0x04, 0x98, 0xea, 0x51, 0xff, 0x2c, 0x01, 0xf9, 0x50, 0x3f, 0x2a, 0x03, 0x2b, 0xe5,
+	0xd9, 0xf2, 0xb6, 0x1c, 0x59, 0x7b, 0xe7, 0x71, 0x94, 0x84, 0x5a, 0x50, 0x18, 0x85, 0xd2, 0x97,
+	0xe6, 0x73, 0x31, 0x56, 0xe3, 0xa8, 0x2c, 0xfa, 0x08, 0xf2, 0xc1, 0xdb, 0x68, 0x10, 0x61, 0x2f,
+	0x7f, 0x4a, 0x9d, 0xc2, 0xd5, 0x4f, 0x00, 0x7e, 0x40, 0x2d, 0xa7, 0x4f, 0x0f, 0x88, 0xc3, 0xdf,
+	0xfa, 0x58, 0x4d, 0x48, 0x02, 0x2f, 0xca, 0x16, 0x2f, 0xc8, 0xc5, 0x14, 0x84, 0x4f, 0x5e, 0xa2,
+	0xa9, 0xfe, 0x75, 0x12, 0xb2, 0x98, 0x52, 0xbf, 0x5e, 0x45, 0x65, 0xc8, 0xca, 0x38, 0xc1, 0xcf,
+	0x9f, 0x5a, 0xfe, 0xec, 0x74, 0x2d, 0x23, 0x02, 0x44, 0xc6, 0xe0, 0x91, 0x21, 0x12, 0xc1, 0x93,
+	0x17, 0x45, 0x70, 0x74, 0x07, 0x8a, 0x12, 0xa4, 0xed, 0xeb, 0xde, 0xbe, 0x28, 0xd0, 0x6a, 0x8b,
+	0x67, 0xa7, 0x6b, 0x20, 0x90, 0x9b, 0xba, 0xb7, 0x8f, 0x41, 0xa0, 0xd9, 0x37, 0x6a, 0x42, 0xe1,
+	0x0b, 0x6a, 0x39, 0x9a, 0xcf, 0x07, 0x21, 0xaf, 0xfc, 0x62, 0xe7, 0x71, 0x3a, 0x54, 0xf9, 0xf0,
+	0x0d, 0x5f, 0x4c, 0x07, 0xdf, 0x84, 0x05, 0x97, 0x52, 0x5f, 0x84, 0x2d, 0x8b, 0x3a, 0xf2, 0x36,
+	0xa1, 0x1c, 0x7b, 0xc9, 0x4c, 0xa9, 0x8f, 0x25, 0x0e, 0x17, 0xdd, 0x48, 0x0b, 0xdd, 0x81, 0x65,
+	0x5b, 0xf7, 0x7c, 0x8d, 0xc7, 0x3b, 0x73, 0xaa, 0x2d, 0xcb, 0xb7, 0x1a, 0x62, 0xbc, 0x0d, 0xce,
+	0x0a, 0x24, 0xd4, 0x7f, 0x4c, 0x40, 0x81, 0x0d, 0xc6, 0xda, 0xb3, 0x0c, 0x96, 0xe4, 0x7d, 0xf3,
+	0xdc, 0xe3, 0x26, 0xa4, 0x0c, 0xcf, 0x95, 0x4e, 0xe5, 0x87, 0x6f, 0xbd, 0x87, 0x31, 0xa3, 0xa1,
+	0xcf, 0x20, 0x2b, 0x6f, 0x35, 0x44, 0xda, 0xa1, 0x5e, 0x9d, 0x8e, 0x4a, 0xdf, 0x48, 0x39, 0xbe,
+	0x96, 0xa7, 0xd6, 0x89, 0x43, 0x00, 0x47, 0x49, 0xe8, 0x06, 0x24, 0x0d, 0xe1, 0x2e, 0xf9, 0xcb,
+	0x8a, 0x7a, 0x1b, 0x27, 0x0d, 0x47, 0xfd, 0xbb, 0x04, 0x2c, 0x4c, 0x37, 0x3c, 0x5b, 0x01, 0xb7,
+	0x20, 0xef, 0x8d, 0x77, 0xbd, 0x89, 0xe7, 0x93, 0x61, 0xf0, 0x8e, 0x19, 0x12, 0x50, 0x0b, 0xf2,
+	0xba, 0x3d, 0xa0, 0xae, 0xe5, 0xef, 0x0f, 0x65, 0x25, 0x1a, 0x9f, 0x2a, 0x44, 0x75, 0x56, 0xaa,
+	0x81, 0x08, 0x9e, 0x4a, 0x07, 0xe7, 0xbe, 0x78, 0xec, 0xe6, 0xe7, 0xfe, 0x6b, 0x50, 0xb4, 0xf5,
+	0x21, 0xbf, 0xe6, 0xf1, 0xad, 0xa1, 0x18, 0x47, 0x1a, 0x17, 0x24, 0xad, 0x6f, 0x0d, 0x89, 0xaa,
+	0x42, 0x3e, 0x54, 0x86, 0x96, 0xa0, 0x50, 0x6d, 0xf6, 0xb4, 0xbb, 0xeb, 0xf7, 0xb5, 0x47, 0xf5,
+	0x6d, 0x65, 0x4e, 0xe6, 0xa6, 0x7f, 0x9e, 0x80, 0x05, 0x19, 0x8e, 0x64, 0xbe, 0xff, 0x3a, 0xcc,
+	0xbb, 0xfa, 0x9e, 0x1f, 0x54, 0x24, 0x69, 0xb1, 0xaa, 0x59, 0x84, 0x67, 0x15, 0x09, 0x63, 0xc5,
+	0x57, 0x24, 0x91, 0x97, 0xf5, 0xd4, 0xa5, 0x2f, 0xeb, 0xe9, 0x9f, 0xcb, 0xcb, 0xba, 0xfa, 0x6b,
+	0x00, 0x1b, 0x96, 0x4d, 0xfa, 0xe2, 0xae, 0x29, 0xae, 0xbe, 0x64, 0x39, 0x9c, 0xbc, 0x71, 0x0c,
+	0x72, 0xb8, 0x56, 0x03, 0x33, 0x1a, 0x63, 0x0d, 0x2c, 0x53, 0x6e, 0x46, 0xce, 0x7a, 0xc4, 0x58,
+	0x03, 0xcb, 0x0c, 0xdf, 0x92, 0xd2, 0x57, 0xbd, 0x25, 0x9d, 0x24, 0x60, 0x49, 0xe6, 0xae, 0x61,
+	0xf8, 0x7d, 0x1b, 0xf2, 0x22, 0x8d, 0x9d, 0x16, 0x74, 0xfc, 0x35, 0x59, 0xe0, 0x5a, 0x0d, 0x9c,
+	0x13, 0xec, 0x96, 0x89, 0xd6, 0xa0, 0x20, 0xa1, 0x91, 0x5f, 0xe1, 0x80, 0x20, 0xb5, 0x99, 0xf9,
+	0xef, 0x43, 0x7a, 0xcf, 0xb2, 0x89, 0x5c, 0xe8, 0xb1, 0x01, 0x60, 0xea, 0x80, 0xcd, 0x39, 0xcc,
+	0xd1, 0xb5, 0x5c, 0x70, 0x19, 0xc7, 0xed, 0x93, 0x65, 0x67, 0xd4, 0x3e, 0x51, 0x81, 0x9e, 0xb3,
+	0x4f, 0xe0, 0x98, 0x7d, 0x82, 0x2d, 0xec, 0x93, 0xd0, 0xa8, 0x7d, 0x82, 0xf4, 0x73, 0xb1, 0x6f,
+	0x0b, 0x6e, 0xd4, 0x6c, 0xdd, 0x38, 0xb0, 0x2d, 0xcf, 0x27, 0x66, 0x34, 0x62, 0xac, 0x43, 0x76,
+	0x26, 0xe9, 0xbc, 0xec, 0x72, 0x56, 0x22, 0xd5, 0x7f, 0x4b, 0x40, 0x71, 0x93, 0xe8, 0xb6, 0xbf,
+	0x3f, 0xbd, 0x1a, 0xf2, 0x89, 0xe7, 0xcb, 0xc3, 0x8a, 0x7f, 0xa3, 0x0f, 0x20, 0x17, 0xe6, 0x24,
+	0x57, 0xbe, 0x92, 0x85, 0x50, 0x74, 0x0f, 0xe6, 0xd9, 0x1e, 0xa3, 0xe3, 0xa0, 0xd8, 0xb9, 0xec,
+	0x01, 0x46, 0x22, 0xd9, 0x21, 0xe3, 0x12, 0x9e, 0x84, 0xf0, 0xa5, 0x94, 0xc1, 0x41, 0x13, 0xfd,
+	0x7f, 0x28, 0xf2, 0xf7, 0x83, 0x20, 0xe7, 0xca, 0x5c, 0xa5, 0xb3, 0x20, 0x9e, 0x00, 0x45, 0xbe,
+	0xf5, 0x3f, 0x09, 0x58, 0xde, 0xd6, 0x27, 0xbb, 0x44, 0x86, 0x0d, 0x62, 0x62, 0x62, 0x50, 0xd7,
+	0x44, 0xdd, 0x68, 0xb8, 0xb9, 0xe4, 0x45, 0x31, 0x4e, 0x38, 0x3e, 0xea, 0x04, 0x05, 0x58, 0x32,
+	0x52, 0x80, 0x2d, 0x43, 0xc6, 0xa1, 0x8e, 0x41, 0x64, 0x2c, 0x12, 0x0d, 0xd5, 0x8a, 0x86, 0x9a,
+	0x52, 0xf8, 0xd8, 0xc7, 0x9f, 0xea, 0xda, 0xd4, 0x0f, 0x7b, 0x43, 0x9f, 0x41, 0xa9, 0xd7, 0xac,
+	0xe3, 0x66, 0xbf, 0xd6, 0xf9, 0xa1, 0xd6, 0xab, 0x6e, 0xf5, 0xaa, 0xeb, 0x77, 0xb4, 0x6e, 0x67,
+	0xeb, 0xf3, 0xbb, 0xf7, 0xee, 0x7c, 0xa0, 0x24, 0x4a, 0xe5, 0xe3, 0x93, 0xf2, 0xad, 0x76, 0xb5,
+	0xbe, 0x25, 0x76, 0xcc, 0x2e, 0x7d, 0xd6, 0xd3, 0x6d, 0x4f, 0x5f, 0xbf, 0xd3, 0xa5, 0xf6, 0x84,
+	0x61, 0xd8, 0xb2, 0x2e, 0x46, 0xcf, 0xab, 0xe8, 0x31, 0x9c, 0xb8, 0xf0, 0x18, 0x9e, 0x9e, 0xe6,
+	0xc9, 0x0b, 0x4e, 0xf3, 0x0d, 0x58, 0x36, 0x5c, 0xea, 0x79, 0x1a, 0xcb, 0xfe, 0x89, 0x79, 0xae,
+	0xbe, 0xf8, 0xce, 0xd9, 0xe9, 0xda, 0xb5, 0x3a, 0xe3, 0xf7, 0x38, 0x5b, 0xaa, 0xbf, 0x66, 0x44,
+	0x48, 0xbc, 0x27, 0xf5, 0xf7, 0x53, 0x2c, 0x91, 0xb2, 0x0e, 0x2d, 0x9b, 0x0c, 0x88, 0x87, 0x9e,
+	0xc0, 0x92, 0xe1, 0x12, 0x93, 0xa5, 0xf5, 0xba, 0xad, 0x79, 0x23, 0x62, 0xc8, 0x45, 0xfd, 0xff,
+	0x62, 0x73, 0x9a, 0x50, 0xb0, 0x52, 0x0f, 0xa5, 0x7a, 0x23, 0x62, 0xe0, 0x45, 0x63, 0xa6, 0x8d,
+	0xbe, 0x80, 0x25, 0x8f, 0xd8, 0x96, 0x33, 0x7e, 0xa6, 0x19, 0xd4, 0xf1, 0xc9, 0xb3, 0xe0, 0xdd,
+	0xea, 0x2a, 0xbd, 0xbd, 0xe6, 0x16, 0x93, 0xaa, 0x0b, 0xa1, 0x1a, 0x3a, 0x3b, 0x5d, 0x5b, 0x9c,
+	0xa5, 0xe1, 0x45, 0xa9, 0x59, 0xb6, 0x4b, 0x6d, 0x58, 0x9c, 0xb5, 0x06, 0x2d, 0xcb, 0xbd, 0xcf,
+	0x43, 0x48, 0xb0, 0xb7, 0xd1, 0x2d, 0xc8, 0xb9, 0x64, 0x60, 0x79, 0xbe, 0x2b, 0xdc, 0xcc, 0x38,
+	0x21, 0x85, 0xed, 0x7c, 0xf1, 0x53, 0x9c, 0xd2, 0xaf, 0xc0, 0xb9, 0x1e, 0xd9, 0x66, 0x31, 0x2d,
+	0x4f, 0xdf, 0x95, 0x2a, 0x73, 0x38, 0x68, 0xb2, 0x35, 0x38, 0xf6, 0xc2, 0x44, 0x8d, 0x7f, 0x33,
+	0x1a, 0xcf, 0x28, 0xe4, 0x0f, 0x93, 0x78, 0xce, 0x10, 0xfc, 0xc2, 0x31, 0x1d, 0xf9, 0x85, 0xe3,
+	0x32, 0x64, 0x6c, 0x72, 0x48, 0x6c, 0x71, 0x96, 0x63, 0xd1, 0x78, 0xe7, 0x67, 0x29, 0xc8, 0x87,
+	0x6f, 0x34, 0xec, 0x24, 0x68, 0x37, 0x9f, 0x06, 0x6b, 0x35, 0xa4, 0xb7, 0xc9, 0x11, 0x7a, 0x6d,
+	0x7a, 0xa7, 0xf4, 0x99, 0x78, 0x94, 0x0e, 0xd9, 0xc1, 0x7d, 0xd2, 0x1b, 0x90, 0xab, 0xf6, 0x7a,
+	0xad, 0x47, 0xed, 0x66, 0x43, 0xf9, 0x32, 0x51, 0xfa, 0xce, 0xf1, 0x49, 0xf9, 0x5a, 0x08, 0xaa,
+	0x7a, 0x62, 0x29, 0x71, 0x54, 0xbd, 0xde, 0xec, 0xf6, 0x9b, 0x0d, 0xe5, 0x79, 0xf2, 0x3c, 0x8a,
+	0xdf, 0x91, 0xf0, 0x9f, 0x96, 0xe4, 0xbb, 0xb8, 0xd9, 0xad, 0x62, 0xd6, 0xe1, 0x97, 0x49, 0x71,
+	0xd5, 0x35, 0xed, 0xd1, 0x25, 0x23, 0x9d, 0xff, 0xae, 0x78, 0x35, 0xf8, 0x89, 0xd5, 0xf3, 0x94,
+	0xf8, 0xf9, 0xc1, 0xf4, 0xc1, 0x89, 0xe8, 0xe6, 0x84, 0xf5, 0xc6, 0x5f, 0xfa, 0xb8, 0x9a, 0xd4,
+	0xb9, 0xde, 0x7a, 0x2c, 0x92, 0x30, 0x2d, 0x2a, 0xcc, 0xe3, 0x9d, 0x76, 0x9b, 0x81, 0x9e, 0xa7,
+	0xcf, 0x8d, 0x0e, 0x8f, 0x1d, 0x56, 0xff, 0xa2, 0xdb, 0x90, 0x0b, 0x1e, 0x02, 0x95, 0x2f, 0xd3,
+	0xe7, 0x0c, 0xaa, 0x07, 0xaf, 0x98, 0xbc, 0xc3, 0xcd, 0x9d, 0x3e, 0xff, 0x05, 0xd8, 0xf3, 0xcc,
+	0xf9, 0x0e, 0xf7, 0xc7, 0xbe, 0x49, 0x8f, 0x1c, 0xb6, 0x03, 0xe5, 0xad, 0xda, 0x97, 0x19, 0x71,
+	0x05, 0x11, 0x62, 0xe4, 0x95, 0xda, 0x1b, 0x90, 0xc3, 0xcd, 0x1f, 0x88, 0x1f, 0x8b, 0x3d, 0xcf,
+	0x9e, 0xd3, 0x83, 0xc9, 0x17, 0xc4, 0x90, 0xbd, 0x75, 0x70, 0x77, 0xb3, 0xca, 0x5d, 0x7e, 0x1e,
+	0xd5, 0x71, 0x47, 0xfb, 0xba, 0x43, 0xcc, 0xe9, 0x6f, 0x30, 0x42, 0xd6, 0x3b, 0xbf, 0x08, 0xb9,
+	0x20, 0xcf, 0x44, 0xab, 0x90, 0x7d, 0xda, 0xc1, 0x8f, 0x9b, 0x58, 0x99, 0x13, 0x3e, 0x0c, 0x38,
+	0x4f, 0x45, 0x85, 0x50, 0x86, 0xf9, 0xed, 0x6a, 0xbb, 0xfa, 0xa8, 0x89, 0x83, 0x0b, 0xef, 0x00,
+	0x20, 0x93, 0xa5, 0x92, 0x22, 0x3b, 0x08, 0x75, 0xd6, 0x56, 0xbe, 0xfa, 0x7a, 0x75, 0xee, 0xa7,
+	0x5f, 0xaf, 0xce, 0x3d, 0x3f, 0x5b, 0x4d, 0x7c, 0x75, 0xb6, 0x9a, 0xf8, 0xc9, 0xd9, 0x6a, 0xe2,
+	0x5f, 0xcf, 0x56, 0x13, 0xbb, 0x59, 0x1e, 0xd2, 0xef, 0xfd, 0x6f, 0x00, 0x00, 0x00, 0xff, 0xff,
+	0xdb, 0x9d, 0xe2, 0x3d, 0xd2, 0x2f, 0x00, 0x00,
 }
diff --git a/components/engine/vendor/github.com/docker/swarmkit/api/types.proto b/components/engine/vendor/github.com/docker/swarmkit/api/types.proto
index 719b88a9c6..201bc3587f 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/api/types.proto
+++ b/components/engine/vendor/github.com/docker/swarmkit/api/types.proto
@@ -30,12 +30,32 @@ message Annotations {
 	repeated IndexEntry indices = 4 [(gogoproto.nullable) = false];
 }
 
+message GenericString {
+	string kind = 1;
+	string value = 2;
+}
+
+message GenericDiscrete {
+	string kind = 1;
+	int64 value = 2;
+}
+
+message GenericResource {
+	oneof resource {
+		GenericString str = 1;
+		GenericDiscrete discrete = 2;
+	}
+}
+
 message Resources {
 	// Amount of CPUs (e.g. 2000000000 = 2 CPU cores)
 	int64 nano_cpus = 1 [(gogoproto.customname) = "NanoCPUs"];
 
 	// Amount of memory in bytes.
 	int64 memory_bytes = 2;
+
+	// User specified resource (e.g: bananas=2;apple={red,yellow,green})
+	repeated GenericResource generic = 3;
 }
 
 message ResourceRequirements {
diff --git a/components/engine/vendor/github.com/docker/swarmkit/ca/certificates.go b/components/engine/vendor/github.com/docker/swarmkit/ca/certificates.go
index 37c8a172de..7a638fe136 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/ca/certificates.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/ca/certificates.go
@@ -126,6 +126,11 @@ type LocalSigner struct {
 	cryptoSigner crypto.Signer
 }
 
+type x509UnknownAuthError struct {
+	error
+	failedLeafCert *x509.Certificate
+}
+
 // RootCA is the representation of everything we need to sign certificates and/or to verify certificates
 //
 // RootCA.Cert:          [CA cert1][CA cert2]
@@ -275,6 +280,17 @@ func (rca *RootCA) RequestAndSaveNewCertificates(ctx context.Context, kw KeyWrit
 	// Create an X509Cert so we can .Verify()
 	// Check to see if this certificate was signed by our CA, and isn't expired
 	parsedCerts, chains, err := ValidateCertChain(rca.Pool, signedCert, false)
+	// TODO(cyli): - right now we need the invalid certificate in order to determine whether or not we should
+	// download a new root, because we only want to do that in the case of workers.  When we have a single
+	// codepath for updating the root CAs for both managers and workers, this snippet can go.
+	if _, ok := err.(x509.UnknownAuthorityError); ok {
+		if parsedCerts, parseErr := helpers.ParseCertificatesPEM(signedCert); parseErr == nil && len(parsedCerts) > 0 {
+			return nil, nil, x509UnknownAuthError{
+				error:          err,
+				failedLeafCert: parsedCerts[0],
+			}
+		}
+	}
 	if err != nil {
 		return nil, nil, err
 	}
@@ -871,7 +887,7 @@ func GetRemoteSignedCertificate(ctx context.Context, csr []byte, rootCAPool *x50
 			caClient = api.NewNodeCAClient(conn.ClientConn)
 
 		// If there was no deadline exceeded error, and the certificate was issued, return
-		case err == nil && statusResponse.Status.State == api.IssuanceStateIssued:
+		case err == nil && (statusResponse.Status.State == api.IssuanceStateIssued || statusResponse.Status.State == api.IssuanceStateRotate):
 			if statusResponse.Certificate == nil {
 				conn.Close(false)
 				return nil, errors.New("no certificate in CertificateStatus response")
diff --git a/components/engine/vendor/github.com/docker/swarmkit/ca/config.go b/components/engine/vendor/github.com/docker/swarmkit/ca/config.go
index 2aaaf78aba..9dd84ecb36 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/ca/config.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/ca/config.go
@@ -89,6 +89,39 @@ type CertificateUpdate struct {
 	Err  error
 }
 
+func validateRootCAAndTLSCert(rootCA *RootCA, externalCARootPool *x509.CertPool, tlsKeyPair *tls.Certificate) error {
+	var (
+		leafCert         *x509.Certificate
+		intermediatePool *x509.CertPool
+	)
+	for i, derBytes := range tlsKeyPair.Certificate {
+		parsed, err := x509.ParseCertificate(derBytes)
+		if err != nil {
+			return errors.Wrap(err, "could not validate new root certificates due to parse error")
+		}
+		if i == 0 {
+			leafCert = parsed
+		} else {
+			if intermediatePool == nil {
+				intermediatePool = x509.NewCertPool()
+			}
+			intermediatePool.AddCert(parsed)
+		}
+	}
+	opts := x509.VerifyOptions{
+		Roots:         rootCA.Pool,
+		Intermediates: intermediatePool,
+	}
+	if _, err := leafCert.Verify(opts); err != nil {
+		return errors.Wrap(err, "new root CA does not match existing TLS credentials")
+	}
+	opts.Roots = externalCARootPool
+	if _, err := leafCert.Verify(opts); err != nil {
+		return errors.Wrap(err, "new external root pool does not match existing TLS credentials")
+	}
+	return nil
+}
+
 // NewSecurityConfig initializes and returns a new SecurityConfig.
 func NewSecurityConfig(rootCA *RootCA, krw *KeyReadWriter, tlsKeyPair *tls.Certificate, issuerInfo *IssuerInfo) (*SecurityConfig, error) {
 	// Create the Server TLS Credentials for this node. These will not be used by workers.
@@ -155,8 +188,15 @@ func (s *SecurityConfig) UpdateRootCA(rootCA *RootCA, externalCARootPool *x509.C
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
+	// refuse to update the root CA if the current TLS credentials do not validate against it
+	if err := validateRootCAAndTLSCert(rootCA, externalCARootPool, s.certificate); err != nil {
+		return err
+	}
+
 	s.rootCA = rootCA
 	s.externalCAClientRootPool = externalCARootPool
+	s.externalCA.UpdateRootCA(rootCA)
+
 	return s.updateTLSCredentials(s.certificate, s.issuerInfo)
 }
 
@@ -215,6 +255,13 @@ func (s *SecurityConfig) updateTLSCredentials(certificate *tls.Certificate, issu
 	return nil
 }
 
+// UpdateTLSCredentials updates the security config with an updated TLS certificate and issuer info
+func (s *SecurityConfig) UpdateTLSCredentials(certificate *tls.Certificate, issuerInfo *IssuerInfo) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.updateTLSCredentials(certificate, issuerInfo)
+}
+
 // SigningPolicy creates a policy used by the signer to ensure that the only fields
 // from the remote CSRs we trust are: PublicKey, PublicKeyAlgorithm and SignatureAlgorithm.
 // It receives the duration a certificate will be valid for
@@ -445,9 +492,35 @@ func (rootCA RootCA) CreateSecurityConfig(ctx context.Context, krw *KeyReadWrite
 	return secConfig, err
 }
 
+// TODO(cyli): currently we have to only update if it's a worker role - if we have a single root CA update path for
+// both managers and workers, we won't need to check any more.
+func updateRootThenUpdateCert(ctx context.Context, s *SecurityConfig, connBroker *connectionbroker.Broker, rootPaths CertPaths, failedCert *x509.Certificate) (*tls.Certificate, *IssuerInfo, error) {
+	if len(failedCert.Subject.OrganizationalUnit) == 0 || failedCert.Subject.OrganizationalUnit[0] != WorkerRole {
+		return nil, nil, errors.New("cannot update root CA since this is not a worker")
+	}
+	// try downloading a new root CA if it's an unknown authority issue, in case there was a root rotation completion
+	// and we just didn't get the new root
+	rootCA, err := GetRemoteCA(ctx, "", connBroker)
+	if err != nil {
+		return nil, nil, err
+	}
+	// validate against the existing security config creds
+	if err := s.UpdateRootCA(&rootCA, rootCA.Pool); err != nil {
+		return nil, nil, err
+	}
+	if err := SaveRootCA(rootCA, rootPaths); err != nil {
+		return nil, nil, err
+	}
+	return rootCA.RequestAndSaveNewCertificates(ctx, s.KeyWriter(),
+		CertificateRequestConfig{
+			ConnBroker:  connBroker,
+			Credentials: s.ClientTLSCreds,
+		})
+}
+
 // RenewTLSConfigNow gets a new TLS cert and key, and updates the security config if provided.  This is similar to
 // RenewTLSConfig, except while that monitors for expiry, and periodically renews, this renews once and is blocking
-func RenewTLSConfigNow(ctx context.Context, s *SecurityConfig, connBroker *connectionbroker.Broker) error {
+func RenewTLSConfigNow(ctx context.Context, s *SecurityConfig, connBroker *connectionbroker.Broker, rootPaths CertPaths) error {
 	s.renewalMu.Lock()
 	defer s.renewalMu.Unlock()
 
@@ -465,14 +538,21 @@ func RenewTLSConfigNow(ctx context.Context, s *SecurityConfig, connBroker *conne
 			ConnBroker:  connBroker,
 			Credentials: s.ClientTLSCreds,
 		})
+	if wrappedError, ok := err.(x509UnknownAuthError); ok {
+		var newErr error
+		tlsKeyPair, issuerInfo, newErr = updateRootThenUpdateCert(ctx, s, connBroker, rootPaths, wrappedError.failedLeafCert)
+		if newErr != nil {
+			err = wrappedError.error
+		} else {
+			err = nil
+		}
+	}
 	if err != nil {
 		log.WithError(err).Errorf("failed to renew the certificate")
 		return err
 	}
 
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return s.updateTLSCredentials(tlsKeyPair, issuerInfo)
+	return s.UpdateTLSCredentials(tlsKeyPair, issuerInfo)
 }
 
 // calculateRandomExpiry returns a random duration between 50% and 80% of the
diff --git a/components/engine/vendor/github.com/docker/swarmkit/ca/external.go b/components/engine/vendor/github.com/docker/swarmkit/ca/external.go
index 6f23ff1fbf..d6a9421e0d 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/ca/external.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/ca/external.go
@@ -18,11 +18,15 @@ import (
 	"github.com/cloudflare/cfssl/config"
 	"github.com/cloudflare/cfssl/csr"
 	"github.com/cloudflare/cfssl/signer"
+	"github.com/docker/swarmkit/log"
 	"github.com/pkg/errors"
 	"golang.org/x/net/context"
 	"golang.org/x/net/context/ctxhttp"
 )
 
+// ExternalCrossSignProfile is the profile that we will be sending cross-signing CSR sign requests with
+const ExternalCrossSignProfile = "CA"
+
 // ErrNoExternalCAURLs is an error used it indicate that an ExternalCA is
 // configured with no URLs to which it can proxy certificate signing requests.
 var ErrNoExternalCAURLs = errors.New("no external CA URLs")
@@ -79,8 +83,7 @@ func (eca *ExternalCA) UpdateTLSConfig(tlsConfig *tls.Config) {
 	}
 }
 
-// UpdateURLs updates the list of CSR API endpoints by setting it to the given
-// urls.
+// UpdateURLs updates the list of CSR API endpoints by setting it to the given urls.
 func (eca *ExternalCA) UpdateURLs(urls ...string) {
 	eca.mu.Lock()
 	defer eca.mu.Unlock()
@@ -88,6 +91,13 @@ func (eca *ExternalCA) UpdateURLs(urls ...string) {
 	eca.urls = urls
 }
 
+// UpdateRootCA changes the root CA used to append intermediates
+func (eca *ExternalCA) UpdateRootCA(rca *RootCA) {
+	eca.mu.Lock()
+	eca.rootCA = rca
+	eca.mu.Unlock()
+}
+
 // Sign signs a new certificate by proxying the given certificate signing
 // request to an external CFSSL API server.
 func (eca *ExternalCA) Sign(ctx context.Context, req signer.SignRequest) (cert []byte, err error) {
@@ -96,6 +106,7 @@ func (eca *ExternalCA) Sign(ctx context.Context, req signer.SignRequest) (cert [
 	eca.mu.Lock()
 	urls := eca.urls
 	client := eca.client
+	intermediates := eca.rootCA.Intermediates
 	eca.mu.Unlock()
 
 	if len(urls) == 0 {
@@ -114,9 +125,9 @@ func (eca *ExternalCA) Sign(ctx context.Context, req signer.SignRequest) (cert [
 		cert, err = makeExternalSignRequest(requestCtx, client, url, csrJSON)
 		cancel()
 		if err == nil {
-			return append(cert, eca.rootCA.Intermediates...), err
+			return append(cert, intermediates...), err
 		}
-		logrus.Debugf("unable to proxy certificate signing request to %s: %s", url, err)
+		log.G(ctx).Debugf("unable to proxy certificate signing request to %s: %s", url, err)
 	}
 
 	return nil, err
@@ -157,6 +168,7 @@ func (eca *ExternalCA) CrossSignRootCA(ctx context.Context, rca RootCA) ([]byte,
 			CN:    rootCert.Subject.CommonName,
 			Names: cfCSRObj.Names,
 		},
+		Profile: ExternalCrossSignProfile,
 	}
 	// cfssl actually ignores non subject alt name extensions in the CSR, so we have to add the CA extension in the signing
 	// request as well
diff --git a/components/engine/vendor/github.com/docker/swarmkit/ca/reconciler.go b/components/engine/vendor/github.com/docker/swarmkit/ca/reconciler.go
index 6651393b50..6daec76d39 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/ca/reconciler.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/ca/reconciler.go
@@ -99,7 +99,7 @@ func (r *rootRotationReconciler) UpdateRootCA(newRootCA *api.RootCA) {
 	if newRootCA.RootRotation != nil {
 		var nodes []*api.Node
 		r.store.View(func(tx store.ReadTx) {
-			nodes, err = store.FindNodes(tx, store.ByMembership(api.NodeMembershipAccepted))
+			nodes, err = store.FindNodes(tx, store.All)
 		})
 		if err != nil {
 			log.G(r.ctx).WithError(err).Error("unable to list nodes, so unable to process the current root CA")
@@ -132,8 +132,8 @@ func (r *rootRotationReconciler) UpdateRootCA(newRootCA *api.RootCA) {
 func (r *rootRotationReconciler) UpdateNode(node *api.Node) {
 	r.mu.Lock()
 	defer r.mu.Unlock()
-	// if we're not in the middle of a root rotation, or if this node does not have membership, ignore it
-	if r.currentRootCA == nil || r.currentRootCA.RootRotation == nil || node.Spec.Membership != api.NodeMembershipAccepted {
+	// if we're not in the middle of a root rotation ignore the update
+	if r.currentRootCA == nil || r.currentRootCA.RootRotation == nil {
 		return
 	}
 	if hasIssuer(node, &r.currentIssuer) {
diff --git a/components/engine/vendor/github.com/docker/swarmkit/ca/renewer.go b/components/engine/vendor/github.com/docker/swarmkit/ca/renewer.go
index 213a66a25b..6d0229bd1d 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/ca/renewer.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/ca/renewer.go
@@ -27,14 +27,16 @@ type TLSRenewer struct {
 	connBroker   *connectionbroker.Broker
 	renew        chan struct{}
 	expectedRole string
+	rootPaths    CertPaths
 }
 
 // NewTLSRenewer creates a new TLS renewer. It must be started with Start.
-func NewTLSRenewer(s *SecurityConfig, connBroker *connectionbroker.Broker) *TLSRenewer {
+func NewTLSRenewer(s *SecurityConfig, connBroker *connectionbroker.Broker, rootPaths CertPaths) *TLSRenewer {
 	return &TLSRenewer{
 		s:          s,
 		connBroker: connBroker,
 		renew:      make(chan struct{}, 1),
+		rootPaths:  rootPaths,
 	}
 }
 
@@ -135,7 +137,7 @@ func (t *TLSRenewer) Start(ctx context.Context) <-chan CertificateUpdate {
 
 			// ignore errors - it will just try again later
 			var certUpdate CertificateUpdate
-			if err := RenewTLSConfigNow(ctx, t.s, t.connBroker); err != nil {
+			if err := RenewTLSConfigNow(ctx, t.s, t.connBroker, t.rootPaths); err != nil {
 				certUpdate.Err = err
 				expBackoff.Failure(nil, nil)
 			} else {
diff --git a/components/engine/vendor/github.com/docker/swarmkit/ca/server.go b/components/engine/vendor/github.com/docker/swarmkit/ca/server.go
index b4b0668049..cb3b6acdc1 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/ca/server.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/ca/server.go
@@ -624,10 +624,6 @@ func (s *Server) UpdateRootCA(ctx context.Context, cluster *api.Cluster) error {
 		if err != nil {
 			return errors.Wrap(err, "invalid Root CA object in cluster")
 		}
-		if err := SaveRootCA(updatedRootCA, s.rootPaths); err != nil {
-			return errors.Wrap(err, "unable to save new root CA certificates")
-		}
-
 		externalCARootPool := updatedRootCA.Pool
 		if rCA.RootRotation != nil {
 			// the external CA has to trust the new CA cert
@@ -640,6 +636,9 @@ func (s *Server) UpdateRootCA(ctx context.Context, cluster *api.Cluster) error {
 		if err := s.securityConfig.UpdateRootCA(&updatedRootCA, externalCARootPool); err != nil {
 			return errors.Wrap(err, "updating Root CA failed")
 		}
+		if err := SaveRootCA(updatedRootCA, s.rootPaths); err != nil {
+			return errors.Wrap(err, "unable to save new root CA certificates")
+		}
 		// only update the server cache if we've successfully updated the root CA
 		logger.Debugf("Root CA %s successfully", setOrUpdate)
 		s.lastSeenClusterRootCA = rCA
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/allocator.go b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/allocator.go
index 95528e750e..5ca50623bb 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/allocator.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/allocator.go
@@ -51,13 +51,6 @@ type taskBallot struct {
 
 // allocActor controls the various phases in the lifecycle of one kind of allocator.
 type allocActor struct {
-	// Channel through which the allocator gets all the events
-	// that it is interested in.
-	ch chan events.Event
-
-	// cancel unregisters the watcher.
-	cancel func()
-
 	// Task voter identity of the allocator.
 	taskVoter string
 
@@ -90,7 +83,10 @@ func New(store *store.MemoryStore, pg plugingetter.PluginGetter) (*Allocator, er
 func (a *Allocator) Run(ctx context.Context) error {
 	// Setup cancel context for all goroutines to use.
 	ctx, cancel := context.WithCancel(ctx)
-	var wg sync.WaitGroup
+	var (
+		wg     sync.WaitGroup
+		actors []func() error
+	)
 
 	defer func() {
 		cancel()
@@ -98,26 +94,8 @@ func (a *Allocator) Run(ctx context.Context) error {
 		close(a.doneChan)
 	}()
 
-	var actors []func() error
-	watch, watchCancel := state.Watch(a.store.WatchQueue(),
-		api.EventCreateNetwork{},
-		api.EventDeleteNetwork{},
-		api.EventCreateService{},
-		api.EventUpdateService{},
-		api.EventDeleteService{},
-		api.EventCreateTask{},
-		api.EventUpdateTask{},
-		api.EventDeleteTask{},
-		api.EventCreateNode{},
-		api.EventUpdateNode{},
-		api.EventDeleteNode{},
-		state.EventCommit{},
-	)
-
 	for _, aa := range []allocActor{
 		{
-			ch:        watch,
-			cancel:    watchCancel,
 			taskVoter: networkVoter,
 			init:      a.doNetworkInit,
 			action:    a.doNetworkAlloc,
@@ -127,8 +105,8 @@ func (a *Allocator) Run(ctx context.Context) error {
 			a.registerToVote(aa.taskVoter)
 		}
 
-		// Copy the iterated value for variable capture.
-		aaCopy := aa
+		// Assign a pointer for variable capture
+		aaPtr := &aa
 		actor := func() error {
 			wg.Add(1)
 			defer wg.Done()
@@ -136,19 +114,19 @@ func (a *Allocator) Run(ctx context.Context) error {
 			// init might return an allocator specific context
 			// which is a child of the passed in context to hold
 			// allocator specific state
-			if err := aaCopy.init(ctx); err != nil {
-				// Stop the watches for this allocator
-				// if we are failing in the init of
-				// this allocator.
-				aa.cancel()
+			watch, watchCancel, err := a.init(ctx, aaPtr)
+			if err != nil {
 				return err
 			}
 
 			wg.Add(1)
-			go func() {
-				defer wg.Done()
-				a.run(ctx, aaCopy)
-			}()
+			go func(watch <-chan events.Event, watchCancel func()) {
+				defer func() {
+					wg.Done()
+					watchCancel()
+				}()
+				a.run(ctx, *aaPtr, watch)
+			}(watch, watchCancel)
 			return nil
 		}
 
@@ -172,10 +150,34 @@ func (a *Allocator) Stop() {
 	<-a.doneChan
 }
 
-func (a *Allocator) run(ctx context.Context, aa allocActor) {
+func (a *Allocator) init(ctx context.Context, aa *allocActor) (<-chan events.Event, func(), error) {
+	watch, watchCancel := state.Watch(a.store.WatchQueue(),
+		api.EventCreateNetwork{},
+		api.EventDeleteNetwork{},
+		api.EventCreateService{},
+		api.EventUpdateService{},
+		api.EventDeleteService{},
+		api.EventCreateTask{},
+		api.EventUpdateTask{},
+		api.EventDeleteTask{},
+		api.EventCreateNode{},
+		api.EventUpdateNode{},
+		api.EventDeleteNode{},
+		state.EventCommit{},
+	)
+
+	if err := aa.init(ctx); err != nil {
+		watchCancel()
+		return nil, nil, err
+	}
+
+	return watch, watchCancel, nil
+}
+
+func (a *Allocator) run(ctx context.Context, aa allocActor, watch <-chan events.Event) {
 	for {
 		select {
-		case ev, ok := <-aa.ch:
+		case ev, ok := <-watch:
 			if !ok {
 				return
 			}
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/drivers_darwin.go b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/drivers_darwin.go
similarity index 65%
rename from components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/drivers_darwin.go
rename to components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/drivers_darwin.go
index 9b56f7be36..8cbedbd6b8 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/drivers_darwin.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/drivers_darwin.go
@@ -1,8 +1,9 @@
-package networkallocator
+package cnmallocator
 
 import (
 	"github.com/docker/libnetwork/drivers/overlay/ovmanager"
 	"github.com/docker/libnetwork/drivers/remote"
+	"github.com/docker/swarmkit/manager/allocator/networkallocator"
 )
 
 var initializers = []initializer{
@@ -11,6 +12,6 @@ var initializers = []initializer{
 }
 
 // PredefinedNetworks returns the list of predefined network structures
-func PredefinedNetworks() []PredefinedNetworkData {
+func PredefinedNetworks() []networkallocator.PredefinedNetworkData {
 	return nil
 }
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/drivers_ipam.go b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/drivers_ipam.go
similarity index 95%
rename from components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/drivers_ipam.go
rename to components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/drivers_ipam.go
index 56b944a1a7..eb854c56bf 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/drivers_ipam.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/drivers_ipam.go
@@ -1,4 +1,4 @@
-package networkallocator
+package cnmallocator
 
 import (
 	"github.com/docker/libnetwork/drvregistry"
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/drivers_network_linux.go b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/drivers_network_linux.go
similarity index 68%
rename from components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/drivers_network_linux.go
rename to components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/drivers_network_linux.go
index 035a904b18..5d6a0e74bf 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/drivers_network_linux.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/drivers_network_linux.go
@@ -1,4 +1,4 @@
-package networkallocator
+package cnmallocator
 
 import (
 	"github.com/docker/libnetwork/drivers/bridge/brmanager"
@@ -7,6 +7,7 @@ import (
 	"github.com/docker/libnetwork/drivers/macvlan/mvmanager"
 	"github.com/docker/libnetwork/drivers/overlay/ovmanager"
 	"github.com/docker/libnetwork/drivers/remote"
+	"github.com/docker/swarmkit/manager/allocator/networkallocator"
 )
 
 var initializers = []initializer{
@@ -19,9 +20,9 @@ var initializers = []initializer{
 }
 
 // PredefinedNetworks returns the list of predefined network structures
-func PredefinedNetworks() []PredefinedNetworkData {
-	return []PredefinedNetworkData{
-		{"bridge", "bridge"},
-		{"host", "host"},
+func PredefinedNetworks() []networkallocator.PredefinedNetworkData {
+	return []networkallocator.PredefinedNetworkData{
+		{Name: "bridge", Driver: "bridge"},
+		{Name: "host", Driver: "host"},
 	}
 }
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/drivers_network_windows.go b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/drivers_network_windows.go
similarity index 65%
rename from components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/drivers_network_windows.go
rename to components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/drivers_network_windows.go
index 9b56f7be36..8cbedbd6b8 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/drivers_network_windows.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/drivers_network_windows.go
@@ -1,8 +1,9 @@
-package networkallocator
+package cnmallocator
 
 import (
 	"github.com/docker/libnetwork/drivers/overlay/ovmanager"
 	"github.com/docker/libnetwork/drivers/remote"
+	"github.com/docker/swarmkit/manager/allocator/networkallocator"
 )
 
 var initializers = []initializer{
@@ -11,6 +12,6 @@ var initializers = []initializer{
 }
 
 // PredefinedNetworks returns the list of predefined network structures
-func PredefinedNetworks() []PredefinedNetworkData {
+func PredefinedNetworks() []networkallocator.PredefinedNetworkData {
 	return nil
 }
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/drivers_unsupported.go b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/drivers_unsupported.go
new file mode 100644
index 0000000000..f9de277e38
--- /dev/null
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/drivers_unsupported.go
@@ -0,0 +1,14 @@
+// +build !linux,!darwin,!windows
+
+package cnmallocator
+
+import (
+	"github.com/docker/swarmkit/manager/allocator/networkallocator"
+)
+
+const initializers = nil
+
+// PredefinedNetworks returns the list of predefined network structures
+func PredefinedNetworks() []networkallocator.PredefinedNetworkData {
+	return nil
+}
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/networkallocator.go b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/networkallocator.go
new file mode 100644
index 0000000000..2cfc95130d
--- /dev/null
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/networkallocator.go
@@ -0,0 +1,961 @@
+package cnmallocator
+
+import (
+	"fmt"
+	"net"
+	"strings"
+
+	"github.com/docker/docker/pkg/plugingetter"
+	"github.com/docker/libnetwork/datastore"
+	"github.com/docker/libnetwork/driverapi"
+	"github.com/docker/libnetwork/drvregistry"
+	"github.com/docker/libnetwork/ipamapi"
+	"github.com/docker/libnetwork/netlabel"
+	"github.com/docker/swarmkit/api"
+	"github.com/docker/swarmkit/log"
+	"github.com/docker/swarmkit/manager/allocator/networkallocator"
+	"github.com/pkg/errors"
+	"golang.org/x/net/context"
+)
+
+const (
+	// DefaultDriver defines the name of the driver to be used by
+	// default if a network without any driver name specified is
+	// created.
+	DefaultDriver = "overlay"
+)
+
+// cnmNetworkAllocator acts as the controller for all network related operations
+// like managing network and IPAM drivers and also creating and
+// deleting networks and the associated resources.
+type cnmNetworkAllocator struct {
+	// The driver register which manages all internal and external
+	// IPAM and network drivers.
+	drvRegistry *drvregistry.DrvRegistry
+
+	// The port allocator instance for allocating node ports
+	portAllocator *portAllocator
+
+	// Local network state used by cnmNetworkAllocator to do network management.
+	networks map[string]*network
+
+	// Allocator state to indicate if allocation has been
+	// successfully completed for this service.
+	services map[string]struct{}
+
+	// Allocator state to indicate if allocation has been
+	// successfully completed for this task.
+	tasks map[string]struct{}
+
+	// Allocator state to indicate if allocation has been
+	// successfully completed for this node.
+	nodes map[string]struct{}
+}
+
+// Local in-memory state related to network that need to be tracked by cnmNetworkAllocator
+type network struct {
+	// A local cache of the store object.
+	nw *api.Network
+
+	// pools is used to save the internal poolIDs needed when
+	// releasing the pool.
+	pools map[string]string
+
+	// endpoints is a map of endpoint IP to the poolID from which it
+	// was allocated.
+	endpoints map[string]string
+
+	// isNodeLocal indicates whether the scope of the network's resources
+	// is local to the node. If true, it means the resources can only be
+	// allocated locally by the node where the network will be deployed.
+	// In this the swarm manager will skip the allocations.
+	isNodeLocal bool
+}
+
+type networkDriver struct {
+	driver     driverapi.Driver
+	name       string
+	capability *driverapi.Capability
+}
+
+type initializer struct {
+	fn    drvregistry.InitFunc
+	ntype string
+}
+
+// New returns a new NetworkAllocator handle
+func New(pg plugingetter.PluginGetter) (networkallocator.NetworkAllocator, error) {
+	na := &cnmNetworkAllocator{
+		networks: make(map[string]*network),
+		services: make(map[string]struct{}),
+		tasks:    make(map[string]struct{}),
+		nodes:    make(map[string]struct{}),
+	}
+
+	// There are no driver configurations and notification
+	// functions as of now.
+	reg, err := drvregistry.New(nil, nil, nil, nil, pg)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := initializeDrivers(reg); err != nil {
+		return nil, err
+	}
+
+	if err = initIPAMDrivers(reg); err != nil {
+		return nil, err
+	}
+
+	pa, err := newPortAllocator()
+	if err != nil {
+		return nil, err
+	}
+
+	na.portAllocator = pa
+	na.drvRegistry = reg
+	return na, nil
+}
+
+// Allocate allocates all the necessary resources both general
+// and driver-specific which may be specified in the NetworkSpec
+func (na *cnmNetworkAllocator) Allocate(n *api.Network) error {
+	if _, ok := na.networks[n.ID]; ok {
+		return fmt.Errorf("network %s already allocated", n.ID)
+	}
+
+	d, err := na.resolveDriver(n)
+	if err != nil {
+		return err
+	}
+
+	nw := &network{
+		nw:          n,
+		endpoints:   make(map[string]string),
+		isNodeLocal: d.capability.DataScope == datastore.LocalScope,
+	}
+
+	// No swarm-level allocation can be provided by the network driver for
+	// node-local networks. Only thing needed is populating the driver's name
+	// in the driver's state.
+	if nw.isNodeLocal {
+		n.DriverState = &api.Driver{
+			Name: d.name,
+		}
+		// In order to support backward compatibility with older daemon
+		// versions which assumes the network attachment to contains
+		// non nil IPAM attribute, passing an empty object
+		n.IPAM = &api.IPAMOptions{Driver: &api.Driver{}}
+	} else {
+		nw.pools, err = na.allocatePools(n)
+		if err != nil {
+			return errors.Wrapf(err, "failed allocating pools and gateway IP for network %s", n.ID)
+		}
+
+		if err := na.allocateDriverState(n); err != nil {
+			na.freePools(n, nw.pools)
+			return errors.Wrapf(err, "failed while allocating driver state for network %s", n.ID)
+		}
+	}
+
+	na.networks[n.ID] = nw
+
+	return nil
+}
+
+func (na *cnmNetworkAllocator) getNetwork(id string) *network {
+	return na.networks[id]
+}
+
+// Deallocate frees all the general and driver specific resources
+// which were assigned to the passed network.
+func (na *cnmNetworkAllocator) Deallocate(n *api.Network) error {
+	localNet := na.getNetwork(n.ID)
+	if localNet == nil {
+		return fmt.Errorf("could not get networker state for network %s", n.ID)
+	}
+
+	// No swarm-level resource deallocation needed for node-local networks
+	if localNet.isNodeLocal {
+		delete(na.networks, n.ID)
+		return nil
+	}
+
+	if err := na.freeDriverState(n); err != nil {
+		return errors.Wrapf(err, "failed to free driver state for network %s", n.ID)
+	}
+
+	delete(na.networks, n.ID)
+
+	return na.freePools(n, localNet.pools)
+}
+
+// AllocateService allocates all the network resources such as virtual
+// IP and ports needed by the service.
+func (na *cnmNetworkAllocator) AllocateService(s *api.Service) (err error) {
+	if err = na.portAllocator.serviceAllocatePorts(s); err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			na.DeallocateService(s)
+		}
+	}()
+
+	if s.Endpoint == nil {
+		s.Endpoint = &api.Endpoint{}
+	}
+	s.Endpoint.Spec = s.Spec.Endpoint.Copy()
+
+	// If ResolutionMode is DNSRR do not try allocating VIPs, but
+	// free any VIP from previous state.
+	if s.Spec.Endpoint != nil && s.Spec.Endpoint.Mode == api.ResolutionModeDNSRoundRobin {
+		for _, vip := range s.Endpoint.VirtualIPs {
+			if err := na.deallocateVIP(vip); err != nil {
+				// don't bail here, deallocate as many as possible.
+				log.L.WithError(err).
+					WithField("vip.network", vip.NetworkID).
+					WithField("vip.addr", vip.Addr).Error("error deallocating vip")
+			}
+		}
+
+		s.Endpoint.VirtualIPs = nil
+
+		delete(na.services, s.ID)
+		return nil
+	}
+
+	specNetworks := serviceNetworks(s)
+
+	// Allocate VIPs for all the pre-populated endpoint attachments
+	eVIPs := s.Endpoint.VirtualIPs[:0]
+
+vipLoop:
+	for _, eAttach := range s.Endpoint.VirtualIPs {
+		if na.IsVIPOnIngressNetwork(eAttach) && networkallocator.IsIngressNetworkNeeded(s) {
+			if err = na.allocateVIP(eAttach); err != nil {
+				return err
+			}
+			eVIPs = append(eVIPs, eAttach)
+			continue vipLoop
+
+		}
+		for _, nAttach := range specNetworks {
+			if nAttach.Target == eAttach.NetworkID {
+				if err = na.allocateVIP(eAttach); err != nil {
+					return err
+				}
+				eVIPs = append(eVIPs, eAttach)
+				continue vipLoop
+			}
+		}
+		// If the network of the VIP is not part of the service spec,
+		// deallocate the vip
+		na.deallocateVIP(eAttach)
+	}
+
+networkLoop:
+	for _, nAttach := range specNetworks {
+		for _, vip := range s.Endpoint.VirtualIPs {
+			if vip.NetworkID == nAttach.Target {
+				continue networkLoop
+			}
+		}
+
+		vip := &api.Endpoint_VirtualIP{NetworkID: nAttach.Target}
+		if err = na.allocateVIP(vip); err != nil {
+			return err
+		}
+
+		eVIPs = append(eVIPs, vip)
+	}
+
+	if len(eVIPs) > 0 {
+		na.services[s.ID] = struct{}{}
+	} else {
+		delete(na.services, s.ID)
+	}
+
+	s.Endpoint.VirtualIPs = eVIPs
+	return nil
+}
+
+// DeallocateService de-allocates all the network resources such as
+// virtual IP and ports associated with the service.
+func (na *cnmNetworkAllocator) DeallocateService(s *api.Service) error {
+	if s.Endpoint == nil {
+		return nil
+	}
+
+	for _, vip := range s.Endpoint.VirtualIPs {
+		if err := na.deallocateVIP(vip); err != nil {
+			// don't bail here, deallocate as many as possible.
+			log.L.WithError(err).
+				WithField("vip.network", vip.NetworkID).
+				WithField("vip.addr", vip.Addr).Error("error deallocating vip")
+		}
+	}
+	s.Endpoint.VirtualIPs = nil
+
+	na.portAllocator.serviceDeallocatePorts(s)
+	delete(na.services, s.ID)
+
+	return nil
+}
+
+// IsAllocated returns if the passed network has been allocated or not.
+func (na *cnmNetworkAllocator) IsAllocated(n *api.Network) bool {
+	_, ok := na.networks[n.ID]
+	return ok
+}
+
+// IsTaskAllocated returns if the passed task has its network resources allocated or not.
+func (na *cnmNetworkAllocator) IsTaskAllocated(t *api.Task) bool {
+	// If the task is not found in the allocated set, then it is
+	// not allocated.
+	if _, ok := na.tasks[t.ID]; !ok {
+		return false
+	}
+
+	// If Networks is empty there is no way this Task is allocated.
+	if len(t.Networks) == 0 {
+		return false
+	}
+
+	// To determine whether the task has its resources allocated,
+	// we just need to look at one global scope network (in case of
+	// multi-network attachment).  This is because we make sure we
+	// allocate for every network or we allocate for none.
+
+	// Find the first global scope network
+	for _, nAttach := range t.Networks {
+		// If the network is not allocated, the task cannot be allocated.
+		localNet, ok := na.networks[nAttach.Network.ID]
+		if !ok {
+			return false
+		}
+
+		// Nothing else to check for local scope network
+		if localNet.isNodeLocal {
+			continue
+		}
+
+		// Addresses empty. Task is not allocated.
+		if len(nAttach.Addresses) == 0 {
+			return false
+		}
+
+		// The allocated IP address not found in local endpoint state. Not allocated.
+		if _, ok := localNet.endpoints[nAttach.Addresses[0]]; !ok {
+			return false
+		}
+	}
+
+	return true
+}
+
+// HostPublishPortsNeedUpdate returns true if the passed service needs
+// allocations for its published ports in host (non ingress) mode
+func (na *cnmNetworkAllocator) HostPublishPortsNeedUpdate(s *api.Service) bool {
+	return na.portAllocator.hostPublishPortsNeedUpdate(s)
+}
+
+// IsServiceAllocated returns false if the passed service needs to have network resources allocated/updated.
+func (na *cnmNetworkAllocator) IsServiceAllocated(s *api.Service, flags ...func(*networkallocator.ServiceAllocationOpts)) bool {
+	var options networkallocator.ServiceAllocationOpts
+	for _, flag := range flags {
+		flag(&options)
+	}
+
+	specNetworks := serviceNetworks(s)
+
+	// If endpoint mode is VIP and allocator does not have the
+	// service in VIP allocated set then it needs to be allocated.
+	if len(specNetworks) != 0 &&
+		(s.Spec.Endpoint == nil ||
+			s.Spec.Endpoint.Mode == api.ResolutionModeVirtualIP) {
+
+		if _, ok := na.services[s.ID]; !ok {
+			return false
+		}
+
+		if s.Endpoint == nil || len(s.Endpoint.VirtualIPs) == 0 {
+			return false
+		}
+
+		// If the spec has networks which don't have a corresponding VIP,
+		// the service needs to be allocated.
+	networkLoop:
+		for _, net := range specNetworks {
+			for _, vip := range s.Endpoint.VirtualIPs {
+				if vip.NetworkID == net.Target {
+					continue networkLoop
+				}
+			}
+			return false
+		}
+	}
+
+	// If the spec no longer has networks attached and has a vip allocated
+	// from previous spec the service needs to allocated.
+	if s.Endpoint != nil {
+	vipLoop:
+		for _, vip := range s.Endpoint.VirtualIPs {
+			if na.IsVIPOnIngressNetwork(vip) && networkallocator.IsIngressNetworkNeeded(s) {
+				continue vipLoop
+			}
+			for _, net := range specNetworks {
+				if vip.NetworkID == net.Target {
+					continue vipLoop
+				}
+			}
+			return false
+		}
+	}
+
+	// If the endpoint mode is DNSRR and allocator has the service
+	// in VIP allocated set then we return to be allocated to make
+	// sure the allocator triggers networkallocator to free up the
+	// resources if any.
+	if s.Spec.Endpoint != nil && s.Spec.Endpoint.Mode == api.ResolutionModeDNSRoundRobin {
+		if _, ok := na.services[s.ID]; ok {
+			return false
+		}
+	}
+
+	if (s.Spec.Endpoint != nil && len(s.Spec.Endpoint.Ports) != 0) ||
+		(s.Endpoint != nil && len(s.Endpoint.Ports) != 0) {
+		return na.portAllocator.isPortsAllocatedOnInit(s, options.OnInit)
+	}
+	return true
+}
+
+// IsNodeAllocated returns if the passed node has its network resources allocated or not.
+func (na *cnmNetworkAllocator) IsNodeAllocated(node *api.Node) bool {
+	// If the node is not found in the allocated set, then it is
+	// not allocated.
+	if _, ok := na.nodes[node.ID]; !ok {
+		return false
+	}
+
+	// If no attachment, not allocated.
+	if node.Attachment == nil {
+		return false
+	}
+
+	// If the network is not allocated, the node cannot be allocated.
+	localNet, ok := na.networks[node.Attachment.Network.ID]
+	if !ok {
+		return false
+	}
+
+	// Addresses empty, not allocated.
+	if len(node.Attachment.Addresses) == 0 {
+		return false
+	}
+
+	// The allocated IP address not found in local endpoint state. Not allocated.
+	if _, ok := localNet.endpoints[node.Attachment.Addresses[0]]; !ok {
+		return false
+	}
+
+	return true
+}
+
+// AllocateNode allocates the IP addresses for the network to which
+// the node is attached.
+func (na *cnmNetworkAllocator) AllocateNode(node *api.Node) error {
+	if err := na.allocateNetworkIPs(node.Attachment); err != nil {
+		return err
+	}
+
+	na.nodes[node.ID] = struct{}{}
+	return nil
+}
+
+// DeallocateNode deallocates the IP addresses for the network to
+// which the node is attached.
+func (na *cnmNetworkAllocator) DeallocateNode(node *api.Node) error {
+	delete(na.nodes, node.ID)
+	return na.releaseEndpoints([]*api.NetworkAttachment{node.Attachment})
+}
+
+// AllocateTask allocates all the endpoint resources for all the
+// networks that a task is attached to.
+func (na *cnmNetworkAllocator) AllocateTask(t *api.Task) error {
+	for i, nAttach := range t.Networks {
+		if localNet := na.getNetwork(nAttach.Network.ID); localNet != nil && localNet.isNodeLocal {
+			continue
+		}
+		if err := na.allocateNetworkIPs(nAttach); err != nil {
+			if err := na.releaseEndpoints(t.Networks[:i]); err != nil {
+				log.G(context.TODO()).WithError(err).Errorf("Failed to release IP addresses while rolling back allocation for task %s network %s", t.ID, nAttach.Network.ID)
+			}
+			return errors.Wrapf(err, "failed to allocate network IP for task %s network %s", t.ID, nAttach.Network.ID)
+		}
+	}
+
+	na.tasks[t.ID] = struct{}{}
+
+	return nil
+}
+
+// DeallocateTask releases all the endpoint resources for all the
+// networks that a task is attached to.
+func (na *cnmNetworkAllocator) DeallocateTask(t *api.Task) error {
+	delete(na.tasks, t.ID)
+	return na.releaseEndpoints(t.Networks)
+}
+
+func (na *cnmNetworkAllocator) releaseEndpoints(networks []*api.NetworkAttachment) error {
+	for _, nAttach := range networks {
+		localNet := na.getNetwork(nAttach.Network.ID)
+		if localNet == nil {
+			return fmt.Errorf("could not find network allocator state for network %s", nAttach.Network.ID)
+		}
+
+		if localNet.isNodeLocal {
+			continue
+		}
+
+		ipam, _, _, err := na.resolveIPAM(nAttach.Network)
+		if err != nil {
+			return errors.Wrap(err, "failed to resolve IPAM while releasing")
+		}
+
+		// Do not fail and bail out if we fail to release IP
+		// address here. Keep going and try releasing as many
+		// addresses as possible.
+		for _, addr := range nAttach.Addresses {
+			// Retrieve the poolID and immediately nuke
+			// out the mapping.
+			poolID := localNet.endpoints[addr]
+			delete(localNet.endpoints, addr)
+
+			ip, _, err := net.ParseCIDR(addr)
+			if err != nil {
+				log.G(context.TODO()).Errorf("Could not parse IP address %s while releasing", addr)
+				continue
+			}
+
+			if err := ipam.ReleaseAddress(poolID, ip); err != nil {
+				log.G(context.TODO()).WithError(err).Errorf("IPAM failure while releasing IP address %s", addr)
+			}
+		}
+
+		// Clear out the address list when we are done with
+		// this network.
+		nAttach.Addresses = nil
+	}
+
+	return nil
+}
+
+// allocate virtual IP for a single endpoint attachment of the service.
+func (na *cnmNetworkAllocator) allocateVIP(vip *api.Endpoint_VirtualIP) error {
+	localNet := na.getNetwork(vip.NetworkID)
+	if localNet == nil {
+		return errors.New("networkallocator: could not find local network state")
+	}
+
+	if localNet.isNodeLocal {
+		return nil
+	}
+
+	// If this IP is already allocated in memory we don't need to
+	// do anything.
+	if _, ok := localNet.endpoints[vip.Addr]; ok {
+		return nil
+	}
+
+	ipam, _, _, err := na.resolveIPAM(localNet.nw)
+	if err != nil {
+		return errors.Wrap(err, "failed to resolve IPAM while allocating")
+	}
+
+	var addr net.IP
+	if vip.Addr != "" {
+		var err error
+
+		addr, _, err = net.ParseCIDR(vip.Addr)
+		if err != nil {
+			return err
+		}
+	}
+
+	for _, poolID := range localNet.pools {
+		ip, _, err := ipam.RequestAddress(poolID, addr, nil)
+		if err != nil && err != ipamapi.ErrNoAvailableIPs && err != ipamapi.ErrIPOutOfRange {
+			return errors.Wrap(err, "could not allocate VIP from IPAM")
+		}
+
+		// If we got an address then we are done.
+		if err == nil {
+			ipStr := ip.String()
+			localNet.endpoints[ipStr] = poolID
+			vip.Addr = ipStr
+			return nil
+		}
+	}
+
+	return errors.New("could not find an available IP while allocating VIP")
+}
+
+func (na *cnmNetworkAllocator) deallocateVIP(vip *api.Endpoint_VirtualIP) error {
+	localNet := na.getNetwork(vip.NetworkID)
+	if localNet == nil {
+		return errors.New("networkallocator: could not find local network state")
+	}
+	if localNet.isNodeLocal {
+		return nil
+	}
+	ipam, _, _, err := na.resolveIPAM(localNet.nw)
+	if err != nil {
+		return errors.Wrap(err, "failed to resolve IPAM while allocating")
+	}
+
+	// Retrieve the poolID and immediately nuke
+	// out the mapping.
+	poolID := localNet.endpoints[vip.Addr]
+	delete(localNet.endpoints, vip.Addr)
+
+	ip, _, err := net.ParseCIDR(vip.Addr)
+	if err != nil {
+		log.G(context.TODO()).Errorf("Could not parse VIP address %s while releasing", vip.Addr)
+		return err
+	}
+
+	if err := ipam.ReleaseAddress(poolID, ip); err != nil {
+		log.G(context.TODO()).WithError(err).Errorf("IPAM failure while releasing VIP address %s", vip.Addr)
+		return err
+	}
+
+	return nil
+}
+
+// allocate the IP addresses for a single network attachment of the task.
+func (na *cnmNetworkAllocator) allocateNetworkIPs(nAttach *api.NetworkAttachment) error {
+	var ip *net.IPNet
+
+	ipam, _, _, err := na.resolveIPAM(nAttach.Network)
+	if err != nil {
+		return errors.Wrap(err, "failed to resolve IPAM while allocating")
+	}
+
+	localNet := na.getNetwork(nAttach.Network.ID)
+	if localNet == nil {
+		return fmt.Errorf("could not find network allocator state for network %s", nAttach.Network.ID)
+	}
+
+	addresses := nAttach.Addresses
+	if len(addresses) == 0 {
+		addresses = []string{""}
+	}
+
+	for i, rawAddr := range addresses {
+		var addr net.IP
+		if rawAddr != "" {
+			var err error
+			addr, _, err = net.ParseCIDR(rawAddr)
+			if err != nil {
+				addr = net.ParseIP(rawAddr)
+
+				if addr == nil {
+					return errors.Wrapf(err, "could not parse address string %s", rawAddr)
+				}
+			}
+		}
+
+		for _, poolID := range localNet.pools {
+			var err error
+
+			ip, _, err = ipam.RequestAddress(poolID, addr, nil)
+			if err != nil && err != ipamapi.ErrNoAvailableIPs && err != ipamapi.ErrIPOutOfRange {
+				return errors.Wrap(err, "could not allocate IP from IPAM")
+			}
+
+			// If we got an address then we are done.
+			if err == nil {
+				ipStr := ip.String()
+				localNet.endpoints[ipStr] = poolID
+				addresses[i] = ipStr
+				nAttach.Addresses = addresses
+				return nil
+			}
+		}
+	}
+
+	return errors.New("could not find an available IP")
+}
+
+func (na *cnmNetworkAllocator) freeDriverState(n *api.Network) error {
+	d, err := na.resolveDriver(n)
+	if err != nil {
+		return err
+	}
+
+	return d.driver.NetworkFree(n.ID)
+}
+
+func (na *cnmNetworkAllocator) allocateDriverState(n *api.Network) error {
+	d, err := na.resolveDriver(n)
+	if err != nil {
+		return err
+	}
+
+	options := make(map[string]string)
+	// reconcile the driver specific options from the network spec
+	// and from the operational state retrieved from the store
+	if n.Spec.DriverConfig != nil {
+		for k, v := range n.Spec.DriverConfig.Options {
+			options[k] = v
+		}
+	}
+	if n.DriverState != nil {
+		for k, v := range n.DriverState.Options {
+			options[k] = v
+		}
+	}
+
+	// Construct IPAM data for driver consumption.
+	ipv4Data := make([]driverapi.IPAMData, 0, len(n.IPAM.Configs))
+	for _, ic := range n.IPAM.Configs {
+		if ic.Family == api.IPAMConfig_IPV6 {
+			continue
+		}
+
+		_, subnet, err := net.ParseCIDR(ic.Subnet)
+		if err != nil {
+			return errors.Wrapf(err, "error parsing subnet %s while allocating driver state", ic.Subnet)
+		}
+
+		gwIP := net.ParseIP(ic.Gateway)
+		gwNet := &net.IPNet{
+			IP:   gwIP,
+			Mask: subnet.Mask,
+		}
+
+		data := driverapi.IPAMData{
+			Pool:    subnet,
+			Gateway: gwNet,
+		}
+
+		ipv4Data = append(ipv4Data, data)
+	}
+
+	ds, err := d.driver.NetworkAllocate(n.ID, options, ipv4Data, nil)
+	if err != nil {
+		return err
+	}
+
+	// Update network object with the obtained driver state.
+	n.DriverState = &api.Driver{
+		Name:    d.name,
+		Options: ds,
+	}
+
+	return nil
+}
+
+// Resolve network driver
+func (na *cnmNetworkAllocator) resolveDriver(n *api.Network) (*networkDriver, error) {
+	dName := DefaultDriver
+	if n.Spec.DriverConfig != nil && n.Spec.DriverConfig.Name != "" {
+		dName = n.Spec.DriverConfig.Name
+	}
+
+	d, drvcap := na.drvRegistry.Driver(dName)
+	if d == nil {
+		var err error
+		err = na.loadDriver(dName)
+		if err != nil {
+			return nil, err
+		}
+
+		d, drvcap = na.drvRegistry.Driver(dName)
+		if d == nil {
+			return nil, fmt.Errorf("could not resolve network driver %s", dName)
+		}
+	}
+
+	return &networkDriver{driver: d, capability: drvcap, name: dName}, nil
+}
+
+func (na *cnmNetworkAllocator) loadDriver(name string) error {
+	pg := na.drvRegistry.GetPluginGetter()
+	if pg == nil {
+		return errors.New("plugin store is uninitialized")
+	}
+	_, err := pg.Get(name, driverapi.NetworkPluginEndpointType, plugingetter.Lookup)
+	return err
+}
+
+// Resolve the IPAM driver
+func (na *cnmNetworkAllocator) resolveIPAM(n *api.Network) (ipamapi.Ipam, string, map[string]string, error) {
+	dName := ipamapi.DefaultIPAM
+	if n.Spec.IPAM != nil && n.Spec.IPAM.Driver != nil && n.Spec.IPAM.Driver.Name != "" {
+		dName = n.Spec.IPAM.Driver.Name
+	}
+
+	var dOptions map[string]string
+	if n.Spec.IPAM != nil && n.Spec.IPAM.Driver != nil && len(n.Spec.IPAM.Driver.Options) != 0 {
+		dOptions = n.Spec.IPAM.Driver.Options
+	}
+
+	ipam, _ := na.drvRegistry.IPAM(dName)
+	if ipam == nil {
+		return nil, "", nil, fmt.Errorf("could not resolve IPAM driver %s", dName)
+	}
+
+	return ipam, dName, dOptions, nil
+}
+
+func (na *cnmNetworkAllocator) freePools(n *api.Network, pools map[string]string) error {
+	ipam, _, _, err := na.resolveIPAM(n)
+	if err != nil {
+		return errors.Wrapf(err, "failed to resolve IPAM while freeing pools for network %s", n.ID)
+	}
+
+	releasePools(ipam, n.IPAM.Configs, pools)
+	return nil
+}
+
+func releasePools(ipam ipamapi.Ipam, icList []*api.IPAMConfig, pools map[string]string) {
+	for _, ic := range icList {
+		if err := ipam.ReleaseAddress(pools[ic.Subnet], net.ParseIP(ic.Gateway)); err != nil {
+			log.G(context.TODO()).WithError(err).Errorf("Failed to release address %s", ic.Subnet)
+		}
+	}
+
+	for k, p := range pools {
+		if err := ipam.ReleasePool(p); err != nil {
+			log.G(context.TODO()).WithError(err).Errorf("Failed to release pool %s", k)
+		}
+	}
+}
+
+func (na *cnmNetworkAllocator) allocatePools(n *api.Network) (map[string]string, error) {
+	ipam, dName, dOptions, err := na.resolveIPAM(n)
+	if err != nil {
+		return nil, err
+	}
+
+	// We don't support user defined address spaces yet so just
+	// retrieve default address space names for the driver.
+	_, asName, err := na.drvRegistry.IPAMDefaultAddressSpaces(dName)
+	if err != nil {
+		return nil, err
+	}
+
+	pools := make(map[string]string)
+
+	var ipamConfigs []*api.IPAMConfig
+
+	// If there is non-nil IPAM state always prefer those subnet
+	// configs over Spec configs.
+	if n.IPAM != nil {
+		ipamConfigs = n.IPAM.Configs
+	} else if n.Spec.IPAM != nil {
+		ipamConfigs = make([]*api.IPAMConfig, len(n.Spec.IPAM.Configs))
+		copy(ipamConfigs, n.Spec.IPAM.Configs)
+	}
+
+	// Append an empty slot for subnet allocation if there are no
+	// IPAM configs from either spec or state.
+	if len(ipamConfigs) == 0 {
+		ipamConfigs = append(ipamConfigs, &api.IPAMConfig{Family: api.IPAMConfig_IPV4})
+	}
+
+	// Update the runtime IPAM configurations with initial state
+	n.IPAM = &api.IPAMOptions{
+		Driver:  &api.Driver{Name: dName, Options: dOptions},
+		Configs: ipamConfigs,
+	}
+
+	for i, ic := range ipamConfigs {
+		poolID, poolIP, meta, err := ipam.RequestPool(asName, ic.Subnet, ic.Range, dOptions, false)
+		if err != nil {
+			// Rollback by releasing all the resources allocated so far.
+			releasePools(ipam, ipamConfigs[:i], pools)
+			return nil, err
+		}
+		pools[poolIP.String()] = poolID
+
+		// The IPAM contract allows the IPAM driver to autonomously
+		// provide a network gateway in response to the pool request.
+		// But if the network spec contains a gateway, we will allocate
+		// it irrespective of whether the ipam driver returned one already.
+		// If none of the above is true, we need to allocate one now, and
+		// let the driver know this request is for the network gateway.
+		var (
+			gwIP *net.IPNet
+			ip   net.IP
+		)
+		if gws, ok := meta[netlabel.Gateway]; ok {
+			if ip, gwIP, err = net.ParseCIDR(gws); err != nil {
+				return nil, fmt.Errorf("failed to parse gateway address (%v) returned by ipam driver: %v", gws, err)
+			}
+			gwIP.IP = ip
+		}
+		if ic.Gateway != "" || gwIP == nil {
+			gwIP, _, err = ipam.RequestAddress(poolID, net.ParseIP(ic.Gateway), map[string]string{ipamapi.RequestAddressType: netlabel.Gateway})
+			if err != nil {
+				// Rollback by releasing all the resources allocated so far.
+				releasePools(ipam, ipamConfigs[:i], pools)
+				return nil, err
+			}
+		}
+
+		if ic.Subnet == "" {
+			ic.Subnet = poolIP.String()
+		}
+
+		if ic.Gateway == "" {
+			ic.Gateway = gwIP.IP.String()
+		}
+
+	}
+
+	return pools, nil
+}
+
+func initializeDrivers(reg *drvregistry.DrvRegistry) error {
+	for _, i := range initializers {
+		if err := reg.AddDriver(i.ntype, i.fn, nil); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func serviceNetworks(s *api.Service) []*api.NetworkAttachmentConfig {
+	// Always prefer NetworkAttachmentConfig in the TaskSpec
+	if len(s.Spec.Task.Networks) == 0 && len(s.Spec.Networks) != 0 {
+		return s.Spec.Networks
+	}
+	return s.Spec.Task.Networks
+}
+
+// IsVIPOnIngressNetwork check if the vip is in ingress network
+func (na *cnmNetworkAllocator) IsVIPOnIngressNetwork(vip *api.Endpoint_VirtualIP) bool {
+	if vip == nil {
+		return false
+	}
+
+	localNet := na.getNetwork(vip.NetworkID)
+	if localNet != nil && localNet.nw != nil {
+		return networkallocator.IsIngressNetwork(localNet.nw)
+	}
+	return false
+}
+
+// IsBuiltInDriver returns whether the passed driver is an internal network driver
+func IsBuiltInDriver(name string) bool {
+	n := strings.ToLower(name)
+	for _, d := range initializers {
+		if n == d.ntype {
+			return true
+		}
+	}
+	return false
+}
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/portallocator.go b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/portallocator.go
similarity index 99%
rename from components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/portallocator.go
rename to components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/portallocator.go
index af8126ea25..b09ac47c79 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/portallocator.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/cnmallocator/portallocator.go
@@ -1,4 +1,4 @@
-package networkallocator
+package cnmallocator
 
 import (
 	"fmt"
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/network.go b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/network.go
index 23d3f6f0a1..c760ad53dc 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/network.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/network.go
@@ -7,6 +7,7 @@ import (
 	"github.com/docker/go-events"
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/log"
+	"github.com/docker/swarmkit/manager/allocator/cnmallocator"
 	"github.com/docker/swarmkit/manager/allocator/networkallocator"
 	"github.com/docker/swarmkit/manager/state"
 	"github.com/docker/swarmkit/manager/state/store"
@@ -34,7 +35,7 @@ type networkContext struct {
 	ingressNetwork *api.Network
 	// Instance of the low-level network allocator which performs
 	// the actual network allocation.
-	nwkAllocator *networkallocator.NetworkAllocator
+	nwkAllocator networkallocator.NetworkAllocator
 
 	// A set of tasks which are ready to be allocated as a batch. This is
 	// distinct from "unallocatedTasks" which are tasks that failed to
@@ -58,10 +59,16 @@ type networkContext struct {
 	// lastRetry is the last timestamp when unallocated
 	// tasks/services/networks were retried.
 	lastRetry time.Time
+
+	// somethingWasDeallocated indicates that we just deallocated at
+	// least one service/task/network, so we should retry failed
+	// allocations (in we are experiencing IP exhaustion and an IP was
+	// released).
+	somethingWasDeallocated bool
 }
 
 func (a *Allocator) doNetworkInit(ctx context.Context) (err error) {
-	na, err := networkallocator.New(a.pluginGetter)
+	na, err := cnmallocator.New(a.pluginGetter)
 	if err != nil {
 		return err
 	}
@@ -145,16 +152,337 @@ func (a *Allocator) doNetworkInit(ctx context.Context) (err error) {
 		log.G(ctx).WithError(err).Error("failed committing allocation of networks during init")
 	}
 
-	// Allocate nodes in the store so far before we process watched events,
-	// if the ingress network is present.
+	// First, allocate objects that already have addresses associated with
+	// them, to reserve these IP addresses in internal state.
 	if nc.ingressNetwork != nil {
-		if err := a.allocateNodes(ctx); err != nil {
+		if err := a.allocateNodes(ctx, true); err != nil {
 			return err
 		}
 	}
+	if err := a.allocateServices(ctx, true); err != nil {
+		return err
+	}
+	if err := a.allocateTasks(ctx, true); err != nil {
+		return err
+	}
 
-	// Allocate services in the store so far before we process watched events.
-	var services []*api.Service
+	// Now allocate objects that don't have addresses yet.
+	if nc.ingressNetwork != nil {
+		if err := a.allocateNodes(ctx, false); err != nil {
+			return err
+		}
+	}
+	if err := a.allocateServices(ctx, false); err != nil {
+		return err
+	}
+	if err := a.allocateTasks(ctx, false); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (a *Allocator) doNetworkAlloc(ctx context.Context, ev events.Event) {
+	nc := a.netCtx
+
+	switch v := ev.(type) {
+	case api.EventCreateNetwork:
+		n := v.Network.Copy()
+		if nc.nwkAllocator.IsAllocated(n) {
+			break
+		}
+
+		if IsIngressNetwork(n) && nc.ingressNetwork != nil {
+			log.G(ctx).Errorf("Cannot allocate ingress network %s (%s) because another ingress network is already present: %s (%s)",
+				n.ID, n.Spec.Annotations.Name, nc.ingressNetwork.ID, nc.ingressNetwork.Spec.Annotations)
+			break
+		}
+
+		if err := a.allocateNetwork(ctx, n); err != nil {
+			log.G(ctx).WithError(err).Errorf("Failed allocation for network %s", n.ID)
+			break
+		}
+
+		if err := a.store.Batch(func(batch *store.Batch) error {
+			return a.commitAllocatedNetwork(ctx, batch, n)
+		}); err != nil {
+			log.G(ctx).WithError(err).Errorf("Failed to commit allocation for network %s", n.ID)
+		}
+
+		if IsIngressNetwork(n) {
+			nc.ingressNetwork = n
+			err := a.allocateNodes(ctx, false)
+			if err != nil {
+				log.G(ctx).WithError(err).Error(err)
+			}
+		}
+	case api.EventDeleteNetwork:
+		n := v.Network.Copy()
+
+		if IsIngressNetwork(n) && nc.ingressNetwork != nil && nc.ingressNetwork.ID == n.ID {
+			nc.ingressNetwork = nil
+			if err := a.deallocateNodes(ctx); err != nil {
+				log.G(ctx).WithError(err).Error(err)
+			}
+		}
+
+		// The assumption here is that all dependent objects
+		// have been cleaned up when we are here so the only
+		// thing that needs to happen is free the network
+		// resources.
+		if err := nc.nwkAllocator.Deallocate(n); err != nil {
+			log.G(ctx).WithError(err).Errorf("Failed during network free for network %s", n.ID)
+		} else {
+			nc.somethingWasDeallocated = true
+		}
+
+		delete(nc.unallocatedNetworks, n.ID)
+	case api.EventCreateService:
+		var s *api.Service
+		a.store.View(func(tx store.ReadTx) {
+			s = store.GetService(tx, v.Service.ID)
+		})
+
+		if s == nil {
+			break
+		}
+
+		if nc.nwkAllocator.IsServiceAllocated(s) {
+			break
+		}
+
+		if err := a.allocateService(ctx, s); err != nil {
+			log.G(ctx).WithError(err).Errorf("Failed allocation for service %s", s.ID)
+			break
+		}
+
+		if err := a.store.Batch(func(batch *store.Batch) error {
+			return a.commitAllocatedService(ctx, batch, s)
+		}); err != nil {
+			log.G(ctx).WithError(err).Errorf("Failed to commit allocation for service %s", s.ID)
+		}
+	case api.EventUpdateService:
+		// We may have already allocated this service. If a create or
+		// update event is older than the current version in the store,
+		// we run the risk of allocating the service a second time.
+		// Only operate on the latest version of the service.
+		var s *api.Service
+		a.store.View(func(tx store.ReadTx) {
+			s = store.GetService(tx, v.Service.ID)
+		})
+
+		if s == nil {
+			break
+		}
+
+		if nc.nwkAllocator.IsServiceAllocated(s) {
+			if !nc.nwkAllocator.HostPublishPortsNeedUpdate(s) {
+				break
+			}
+			updatePortsInHostPublishMode(s)
+		} else {
+			if err := a.allocateService(ctx, s); err != nil {
+				log.G(ctx).WithError(err).Errorf("Failed allocation during update of service %s", s.ID)
+				break
+			}
+		}
+
+		if err := a.store.Batch(func(batch *store.Batch) error {
+			return a.commitAllocatedService(ctx, batch, s)
+		}); err != nil {
+			log.G(ctx).WithError(err).Errorf("Failed to commit allocation during update for service %s", s.ID)
+			nc.unallocatedServices[s.ID] = s
+		} else {
+			delete(nc.unallocatedServices, s.ID)
+		}
+	case api.EventDeleteService:
+		s := v.Service.Copy()
+
+		if err := nc.nwkAllocator.DeallocateService(s); err != nil {
+			log.G(ctx).WithError(err).Errorf("Failed deallocation during delete of service %s", s.ID)
+		} else {
+			nc.somethingWasDeallocated = true
+		}
+
+		// Remove it from unallocatedServices just in case
+		// it's still there.
+		delete(nc.unallocatedServices, s.ID)
+	case api.EventCreateNode, api.EventUpdateNode, api.EventDeleteNode:
+		a.doNodeAlloc(ctx, ev)
+	case api.EventCreateTask, api.EventUpdateTask, api.EventDeleteTask:
+		a.doTaskAlloc(ctx, ev)
+	case state.EventCommit:
+		a.procTasksNetwork(ctx, false)
+
+		if time.Since(nc.lastRetry) > retryInterval || nc.somethingWasDeallocated {
+			a.procUnallocatedNetworks(ctx)
+			a.procUnallocatedServices(ctx)
+			a.procTasksNetwork(ctx, true)
+			nc.lastRetry = time.Now()
+			nc.somethingWasDeallocated = false
+		}
+
+		// Any left over tasks are moved to the unallocated set
+		for _, t := range nc.pendingTasks {
+			nc.unallocatedTasks[t.ID] = t
+		}
+		nc.pendingTasks = make(map[string]*api.Task)
+	}
+}
+
+func (a *Allocator) doNodeAlloc(ctx context.Context, ev events.Event) {
+	var (
+		isDelete bool
+		node     *api.Node
+	)
+
+	// We may have already allocated this node. If a create or update
+	// event is older than the current version in the store, we run the
+	// risk of allocating the node a second time. Only operate on the
+	// latest version of the node.
+	switch v := ev.(type) {
+	case api.EventCreateNode:
+		a.store.View(func(tx store.ReadTx) {
+			node = store.GetNode(tx, v.Node.ID)
+		})
+	case api.EventUpdateNode:
+		a.store.View(func(tx store.ReadTx) {
+			node = store.GetNode(tx, v.Node.ID)
+		})
+	case api.EventDeleteNode:
+		isDelete = true
+		node = v.Node.Copy()
+	}
+
+	if node == nil {
+		return
+	}
+
+	nc := a.netCtx
+
+	if isDelete {
+		if nc.nwkAllocator.IsNodeAllocated(node) {
+			if err := nc.nwkAllocator.DeallocateNode(node); err != nil {
+				log.G(ctx).WithError(err).Errorf("Failed freeing network resources for node %s", node.ID)
+			} else {
+				nc.somethingWasDeallocated = true
+			}
+		}
+		return
+	}
+
+	if !nc.nwkAllocator.IsNodeAllocated(node) && nc.ingressNetwork != nil {
+		if node.Attachment == nil {
+			node.Attachment = &api.NetworkAttachment{}
+		}
+
+		node.Attachment.Network = nc.ingressNetwork.Copy()
+		if err := a.allocateNode(ctx, node); err != nil {
+			log.G(ctx).WithError(err).Errorf("Failed to allocate network resources for node %s", node.ID)
+			return
+		}
+
+		if err := a.store.Batch(func(batch *store.Batch) error {
+			return a.commitAllocatedNode(ctx, batch, node)
+		}); err != nil {
+			log.G(ctx).WithError(err).Errorf("Failed to commit allocation of network resources for node %s", node.ID)
+		}
+	}
+}
+
+func (a *Allocator) allocateNodes(ctx context.Context, existingAddressesOnly bool) error {
+	// Allocate nodes in the store so far before we process watched events.
+	var (
+		allocatedNodes []*api.Node
+		nodes          []*api.Node
+		err            error
+		nc             = a.netCtx
+	)
+
+	a.store.View(func(tx store.ReadTx) {
+		nodes, err = store.FindNodes(tx, store.All)
+	})
+	if err != nil {
+		return errors.Wrap(err, "error listing all nodes in store while trying to allocate network resources")
+	}
+
+	for _, node := range nodes {
+		if nc.nwkAllocator.IsNodeAllocated(node) {
+			continue
+		}
+
+		if node.Attachment == nil {
+			node.Attachment = &api.NetworkAttachment{}
+		}
+
+		if existingAddressesOnly && len(node.Attachment.Addresses) == 0 {
+			continue
+		}
+
+		node.Attachment.Network = nc.ingressNetwork.Copy()
+		if err := a.allocateNode(ctx, node); err != nil {
+			log.G(ctx).WithError(err).Errorf("Failed to allocate network resources for node %s", node.ID)
+			continue
+		}
+
+		allocatedNodes = append(allocatedNodes, node)
+	}
+
+	if err := a.store.Batch(func(batch *store.Batch) error {
+		for _, node := range allocatedNodes {
+			if err := a.commitAllocatedNode(ctx, batch, node); err != nil {
+				log.G(ctx).WithError(err).Errorf("Failed to commit allocation of network resources for node %s", node.ID)
+			}
+		}
+		return nil
+	}); err != nil {
+		log.G(ctx).WithError(err).Error("Failed to commit allocation of network resources for nodes")
+	}
+
+	return nil
+}
+
+func (a *Allocator) deallocateNodes(ctx context.Context) error {
+	var (
+		nodes []*api.Node
+		nc    = a.netCtx
+		err   error
+	)
+
+	a.store.View(func(tx store.ReadTx) {
+		nodes, err = store.FindNodes(tx, store.All)
+	})
+	if err != nil {
+		return fmt.Errorf("error listing all nodes in store while trying to free network resources")
+	}
+
+	for _, node := range nodes {
+		if nc.nwkAllocator.IsNodeAllocated(node) {
+			if err := nc.nwkAllocator.DeallocateNode(node); err != nil {
+				log.G(ctx).WithError(err).Errorf("Failed freeing network resources for node %s", node.ID)
+			} else {
+				nc.somethingWasDeallocated = true
+			}
+			node.Attachment = nil
+			if err := a.store.Batch(func(batch *store.Batch) error {
+				return a.commitAllocatedNode(ctx, batch, node)
+			}); err != nil {
+				log.G(ctx).WithError(err).Errorf("Failed to commit deallocation of network resources for node %s", node.ID)
+			}
+		}
+	}
+
+	return nil
+}
+
+// allocateServices allocates services in the store so far before we process
+// watched events.
+func (a *Allocator) allocateServices(ctx context.Context, existingAddressesOnly bool) error {
+	var (
+		nc       = a.netCtx
+		services []*api.Service
+		err      error
+	)
 	a.store.View(func(tx store.ReadTx) {
 		services, err = store.FindServices(tx, store.All)
 	})
@@ -164,7 +492,13 @@ func (a *Allocator) doNetworkInit(ctx context.Context) (err error) {
 
 	var allocatedServices []*api.Service
 	for _, s := range services {
-		if !nc.nwkAllocator.ServiceNeedsAllocation(s, networkallocator.OnInit) {
+		if nc.nwkAllocator.IsServiceAllocated(s, networkallocator.OnInit) {
+			continue
+		}
+
+		if existingAddressesOnly &&
+			(s.Endpoint == nil ||
+				len(s.Endpoint.VirtualIPs) == 0) {
 			continue
 		}
 
@@ -186,10 +520,16 @@ func (a *Allocator) doNetworkInit(ctx context.Context) (err error) {
 		log.G(ctx).WithError(err).Error("failed committing allocation of services during init")
 	}
 
-	// Allocate tasks in the store so far before we started watching.
+	return nil
+}
+
+// allocateTasks allocates tasks in the store so far before we started watching.
+func (a *Allocator) allocateTasks(ctx context.Context, existingAddressesOnly bool) error {
 	var (
+		nc             = a.netCtx
 		tasks          []*api.Task
 		allocatedTasks []*api.Task
+		err            error
 	)
 	a.store.View(func(tx store.ReadTx) {
 		tasks, err = store.FindTasks(tx, store.All)
@@ -203,6 +543,19 @@ func (a *Allocator) doNetworkInit(ctx context.Context) (err error) {
 			continue
 		}
 
+		if existingAddressesOnly {
+			hasAddresses := false
+			for _, nAttach := range t.Networks {
+				if len(nAttach.Addresses) != 0 {
+					hasAddresses = true
+					break
+				}
+			}
+			if !hasAddresses {
+				continue
+			}
+		}
+
 		var s *api.Service
 		if t.ServiceID != "" {
 			a.store.View(func(tx store.ReadTx) {
@@ -254,286 +607,6 @@ func (a *Allocator) doNetworkInit(ctx context.Context) (err error) {
 	return nil
 }
 
-func (a *Allocator) doNetworkAlloc(ctx context.Context, ev events.Event) {
-	nc := a.netCtx
-
-	switch v := ev.(type) {
-	case api.EventCreateNetwork:
-		n := v.Network.Copy()
-		if nc.nwkAllocator.IsAllocated(n) {
-			break
-		}
-
-		if IsIngressNetwork(n) && nc.ingressNetwork != nil {
-			log.G(ctx).Errorf("Cannot allocate ingress network %s (%s) because another ingress network is already present: %s (%s)",
-				n.ID, n.Spec.Annotations.Name, nc.ingressNetwork.ID, nc.ingressNetwork.Spec.Annotations)
-			break
-		}
-
-		if err := a.allocateNetwork(ctx, n); err != nil {
-			log.G(ctx).WithError(err).Errorf("Failed allocation for network %s", n.ID)
-			break
-		}
-
-		if err := a.store.Batch(func(batch *store.Batch) error {
-			return a.commitAllocatedNetwork(ctx, batch, n)
-		}); err != nil {
-			log.G(ctx).WithError(err).Errorf("Failed to commit allocation for network %s", n.ID)
-		}
-
-		if IsIngressNetwork(n) {
-			nc.ingressNetwork = n
-			err := a.allocateNodes(ctx)
-			if err != nil {
-				log.G(ctx).WithError(err).Error(err)
-			}
-		}
-	case api.EventDeleteNetwork:
-		n := v.Network.Copy()
-
-		if IsIngressNetwork(n) && nc.ingressNetwork != nil && nc.ingressNetwork.ID == n.ID {
-			nc.ingressNetwork = nil
-			if err := a.deallocateNodes(ctx); err != nil {
-				log.G(ctx).WithError(err).Error(err)
-			}
-		}
-
-		// The assumption here is that all dependent objects
-		// have been cleaned up when we are here so the only
-		// thing that needs to happen is free the network
-		// resources.
-		if err := nc.nwkAllocator.Deallocate(n); err != nil {
-			log.G(ctx).WithError(err).Errorf("Failed during network free for network %s", n.ID)
-		}
-
-		delete(nc.unallocatedNetworks, n.ID)
-	case api.EventCreateService:
-		var s *api.Service
-		a.store.View(func(tx store.ReadTx) {
-			s = store.GetService(tx, v.Service.ID)
-		})
-
-		if s == nil {
-			break
-		}
-
-		if !nc.nwkAllocator.ServiceNeedsAllocation(s) {
-			break
-		}
-
-		if err := a.allocateService(ctx, s); err != nil {
-			log.G(ctx).WithError(err).Errorf("Failed allocation for service %s", s.ID)
-			break
-		}
-
-		if err := a.store.Batch(func(batch *store.Batch) error {
-			return a.commitAllocatedService(ctx, batch, s)
-		}); err != nil {
-			log.G(ctx).WithError(err).Errorf("Failed to commit allocation for service %s", s.ID)
-		}
-	case api.EventUpdateService:
-		// We may have already allocated this service. If a create or
-		// update event is older than the current version in the store,
-		// we run the risk of allocating the service a second time.
-		// Only operate on the latest version of the service.
-		var s *api.Service
-		a.store.View(func(tx store.ReadTx) {
-			s = store.GetService(tx, v.Service.ID)
-		})
-
-		if s == nil {
-			break
-		}
-
-		if !nc.nwkAllocator.ServiceNeedsAllocation(s) {
-			if !nc.nwkAllocator.HostPublishPortsNeedUpdate(s) {
-				break
-			}
-			updatePortsInHostPublishMode(s)
-		} else {
-			if err := a.allocateService(ctx, s); err != nil {
-				log.G(ctx).WithError(err).Errorf("Failed allocation during update of service %s", s.ID)
-				break
-			}
-		}
-
-		if err := a.store.Batch(func(batch *store.Batch) error {
-			return a.commitAllocatedService(ctx, batch, s)
-		}); err != nil {
-			log.G(ctx).WithError(err).Errorf("Failed to commit allocation during update for service %s", s.ID)
-			nc.unallocatedServices[s.ID] = s
-		} else {
-			delete(nc.unallocatedServices, s.ID)
-		}
-	case api.EventDeleteService:
-		s := v.Service.Copy()
-
-		if err := nc.nwkAllocator.ServiceDeallocate(s); err != nil {
-			log.G(ctx).WithError(err).Errorf("Failed deallocation during delete of service %s", s.ID)
-		}
-
-		// Remove it from unallocatedServices just in case
-		// it's still there.
-		delete(nc.unallocatedServices, s.ID)
-	case api.EventCreateNode, api.EventUpdateNode, api.EventDeleteNode:
-		a.doNodeAlloc(ctx, ev)
-	case api.EventCreateTask, api.EventUpdateTask, api.EventDeleteTask:
-		a.doTaskAlloc(ctx, ev)
-	case state.EventCommit:
-		a.procTasksNetwork(ctx, false)
-
-		if time.Since(nc.lastRetry) > retryInterval {
-			a.procUnallocatedNetworks(ctx)
-			a.procUnallocatedServices(ctx)
-			a.procTasksNetwork(ctx, true)
-			nc.lastRetry = time.Now()
-		}
-
-		// Any left over tasks are moved to the unallocated set
-		for _, t := range nc.pendingTasks {
-			nc.unallocatedTasks[t.ID] = t
-		}
-		nc.pendingTasks = make(map[string]*api.Task)
-	}
-}
-
-func (a *Allocator) doNodeAlloc(ctx context.Context, ev events.Event) {
-	var (
-		isDelete bool
-		node     *api.Node
-	)
-
-	// We may have already allocated this node. If a create or update
-	// event is older than the current version in the store, we run the
-	// risk of allocating the node a second time. Only operate on the
-	// latest version of the node.
-	switch v := ev.(type) {
-	case api.EventCreateNode:
-		a.store.View(func(tx store.ReadTx) {
-			node = store.GetNode(tx, v.Node.ID)
-		})
-	case api.EventUpdateNode:
-		a.store.View(func(tx store.ReadTx) {
-			node = store.GetNode(tx, v.Node.ID)
-		})
-	case api.EventDeleteNode:
-		isDelete = true
-		node = v.Node.Copy()
-	}
-
-	if node == nil {
-		return
-	}
-
-	nc := a.netCtx
-
-	if isDelete {
-		if nc.nwkAllocator.IsNodeAllocated(node) {
-			if err := nc.nwkAllocator.DeallocateNode(node); err != nil {
-				log.G(ctx).WithError(err).Errorf("Failed freeing network resources for node %s", node.ID)
-			}
-		}
-		return
-	}
-
-	if !nc.nwkAllocator.IsNodeAllocated(node) && nc.ingressNetwork != nil {
-		if node.Attachment == nil {
-			node.Attachment = &api.NetworkAttachment{}
-		}
-
-		node.Attachment.Network = nc.ingressNetwork.Copy()
-		if err := a.allocateNode(ctx, node); err != nil {
-			log.G(ctx).WithError(err).Errorf("Failed to allocate network resources for node %s", node.ID)
-			return
-		}
-
-		if err := a.store.Batch(func(batch *store.Batch) error {
-			return a.commitAllocatedNode(ctx, batch, node)
-		}); err != nil {
-			log.G(ctx).WithError(err).Errorf("Failed to commit allocation of network resources for node %s", node.ID)
-		}
-	}
-}
-
-func (a *Allocator) allocateNodes(ctx context.Context) error {
-	// Allocate nodes in the store so far before we process watched events.
-	var (
-		allocatedNodes []*api.Node
-		nodes          []*api.Node
-		err            error
-		nc             = a.netCtx
-	)
-
-	a.store.View(func(tx store.ReadTx) {
-		nodes, err = store.FindNodes(tx, store.All)
-	})
-	if err != nil {
-		return errors.Wrap(err, "error listing all nodes in store while trying to allocate network resources")
-	}
-
-	for _, node := range nodes {
-		if nc.nwkAllocator.IsNodeAllocated(node) {
-			continue
-		}
-
-		if node.Attachment == nil {
-			node.Attachment = &api.NetworkAttachment{}
-		}
-
-		node.Attachment.Network = nc.ingressNetwork.Copy()
-		if err := a.allocateNode(ctx, node); err != nil {
-			log.G(ctx).WithError(err).Errorf("Failed to allocate network resources for node %s", node.ID)
-			continue
-		}
-
-		allocatedNodes = append(allocatedNodes, node)
-	}
-
-	if err := a.store.Batch(func(batch *store.Batch) error {
-		for _, node := range allocatedNodes {
-			if err := a.commitAllocatedNode(ctx, batch, node); err != nil {
-				log.G(ctx).WithError(err).Errorf("Failed to commit allocation of network resources for node %s", node.ID)
-			}
-		}
-		return nil
-	}); err != nil {
-		log.G(ctx).WithError(err).Error("Failed to commit allocation of network resources for nodes")
-	}
-
-	return nil
-}
-
-func (a *Allocator) deallocateNodes(ctx context.Context) error {
-	var (
-		nodes []*api.Node
-		nc    = a.netCtx
-		err   error
-	)
-
-	a.store.View(func(tx store.ReadTx) {
-		nodes, err = store.FindNodes(tx, store.All)
-	})
-	if err != nil {
-		return fmt.Errorf("error listing all nodes in store while trying to free network resources")
-	}
-
-	for _, node := range nodes {
-		if nc.nwkAllocator.IsNodeAllocated(node) {
-			if err := nc.nwkAllocator.DeallocateNode(node); err != nil {
-				log.G(ctx).WithError(err).Errorf("Failed freeing network resources for node %s", node.ID)
-			}
-			node.Attachment = nil
-			if err := a.store.Batch(func(batch *store.Batch) error {
-				return a.commitAllocatedNode(ctx, batch, node)
-			}); err != nil {
-				log.G(ctx).WithError(err).Errorf("Failed to commit deallocation of network resources for node %s", node.ID)
-			}
-		}
-	}
-
-	return nil
-}
-
 // taskReadyForNetworkVote checks if the task is ready for a network
 // vote to move it to PENDING state.
 func taskReadyForNetworkVote(t *api.Task, s *api.Service, nc *networkContext) bool {
@@ -544,7 +617,7 @@ func taskReadyForNetworkVote(t *api.Task, s *api.Service, nc *networkContext) bo
 	// network configured or service endpoints have been
 	// allocated.
 	return (len(t.Networks) == 0 || nc.nwkAllocator.IsTaskAllocated(t)) &&
-		(s == nil || !nc.nwkAllocator.ServiceNeedsAllocation(s))
+		(s == nil || nc.nwkAllocator.IsServiceAllocated(s))
 }
 
 func taskUpdateNetworks(t *api.Task, networks []*api.NetworkAttachment) {
@@ -637,12 +710,15 @@ func (a *Allocator) doTaskAlloc(ctx context.Context, ev events.Event) {
 		if nc.nwkAllocator.IsTaskAllocated(t) {
 			if err := nc.nwkAllocator.DeallocateTask(t); err != nil {
 				log.G(ctx).WithError(err).Errorf("Failed freeing network resources for task %s", t.ID)
+			} else {
+				nc.somethingWasDeallocated = true
 			}
 		}
 
 		// Cleanup any task references that might exist
 		delete(nc.pendingTasks, t.ID)
 		delete(nc.unallocatedTasks, t.ID)
+
 		return
 	}
 
@@ -774,12 +850,13 @@ func (a *Allocator) allocateService(ctx context.Context, s *api.Service) error {
 	} else if s.Endpoint != nil {
 		// service has no user-defined endpoints while has already allocated network resources,
 		// need deallocated.
-		if err := nc.nwkAllocator.ServiceDeallocate(s); err != nil {
+		if err := nc.nwkAllocator.DeallocateService(s); err != nil {
 			return err
 		}
+		nc.somethingWasDeallocated = true
 	}
 
-	if err := nc.nwkAllocator.ServiceAllocate(s); err != nil {
+	if err := nc.nwkAllocator.AllocateService(s); err != nil {
 		nc.unallocatedServices[s.ID] = s
 		return err
 	}
@@ -814,7 +891,7 @@ func (a *Allocator) commitAllocatedService(ctx context.Context, batch *store.Bat
 
 		return errors.Wrapf(err, "failed updating state in store transaction for service %s", s.ID)
 	}); err != nil {
-		if err := a.netCtx.nwkAllocator.ServiceDeallocate(s); err != nil {
+		if err := a.netCtx.nwkAllocator.DeallocateService(s); err != nil {
 			log.G(ctx).WithError(err).Errorf("failed rolling back allocation of service %s", s.ID)
 		}
 
@@ -829,7 +906,7 @@ func (a *Allocator) allocateNetwork(ctx context.Context, n *api.Network) error {
 
 	if err := nc.nwkAllocator.Allocate(n); err != nil {
 		nc.unallocatedNetworks[n.ID] = n
-		return errors.Wrapf(err, "failed during network allocation for network %s", n.ID)
+		return err
 	}
 
 	return nil
@@ -869,7 +946,7 @@ func (a *Allocator) allocateTask(ctx context.Context, t *api.Task) (err error) {
 					return
 				}
 
-				if nc.nwkAllocator.ServiceNeedsAllocation(s) {
+				if !nc.nwkAllocator.IsServiceAllocated(s) {
 					err = fmt.Errorf("service %s to which this task %s belongs has pending allocations", s.ID, t.ID)
 					return
 				}
@@ -896,7 +973,6 @@ func (a *Allocator) allocateTask(ctx context.Context, t *api.Task) (err error) {
 			}
 
 			if err = nc.nwkAllocator.AllocateTask(t); err != nil {
-				err = errors.Wrapf(err, "failed during network allocation for task %s", t.ID)
 				return
 			}
 			if nc.nwkAllocator.IsTaskAllocated(t) {
@@ -986,7 +1062,7 @@ func (a *Allocator) procUnallocatedServices(ctx context.Context) {
 	nc := a.netCtx
 	var allocatedServices []*api.Service
 	for _, s := range nc.unallocatedServices {
-		if nc.nwkAllocator.ServiceNeedsAllocation(s) {
+		if !nc.nwkAllocator.IsServiceAllocated(s) {
 			if err := a.allocateService(ctx, s); err != nil {
 				log.G(ctx).WithError(err).Debugf("Failed allocation of unallocated service %s", s.ID)
 				continue
@@ -1071,6 +1147,16 @@ func (a *Allocator) procTasksNetwork(ctx context.Context, onRetry bool) {
 	}
 }
 
+// IsBuiltInNetworkDriver returns whether the passed driver is an internal network driver
+func IsBuiltInNetworkDriver(name string) bool {
+	return cnmallocator.IsBuiltInDriver(name)
+}
+
+// PredefinedNetworks returns the list of predefined network structures for a given network model
+func PredefinedNetworks() []networkallocator.PredefinedNetworkData {
+	return cnmallocator.PredefinedNetworks()
+}
+
 // updateTaskStatus sets TaskStatus and updates timestamp.
 func updateTaskStatus(t *api.Task, newStatus api.TaskState, message string) {
 	t.Status.State = newStatus
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/drivers_unsupported.go b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/drivers_unsupported.go
deleted file mode 100644
index 5facfdc7f4..0000000000
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/drivers_unsupported.go
+++ /dev/null
@@ -1,10 +0,0 @@
-// +build !linux,!darwin,!windows
-
-package networkallocator
-
-const initializers = nil
-
-// PredefinedNetworks returns the list of predefined network structures
-func PredefinedNetworks() []PredefinedNetworkData {
-	return nil
-}
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/networkallocator.go b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/networkallocator.go
index a2fda20348..04dd168126 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/networkallocator.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/allocator/networkallocator/networkallocator.go
@@ -1,91 +1,15 @@
 package networkallocator
 
 import (
-	"fmt"
-	"net"
-	"strings"
-
-	"github.com/docker/docker/pkg/plugingetter"
-	"github.com/docker/libnetwork/datastore"
-	"github.com/docker/libnetwork/driverapi"
-	"github.com/docker/libnetwork/drvregistry"
-	"github.com/docker/libnetwork/ipamapi"
-	"github.com/docker/libnetwork/netlabel"
 	"github.com/docker/swarmkit/api"
-	"github.com/docker/swarmkit/log"
-	"github.com/pkg/errors"
-	"golang.org/x/net/context"
 )
 
 const (
-	// DefaultDriver defines the name of the driver to be used by
-	// default if a network without any driver name specified is
-	// created.
-	DefaultDriver = "overlay"
-
 	// PredefinedLabel identifies internally allocated swarm networks
 	// corresponding to the node-local predefined networks on the host.
 	PredefinedLabel = "com.docker.swarm.predefined"
 )
 
-// NetworkAllocator acts as the controller for all network related operations
-// like managing network and IPAM drivers and also creating and
-// deleting networks and the associated resources.
-type NetworkAllocator struct {
-	// The driver register which manages all internal and external
-	// IPAM and network drivers.
-	drvRegistry *drvregistry.DrvRegistry
-
-	// The port allocator instance for allocating node ports
-	portAllocator *portAllocator
-
-	// Local network state used by NetworkAllocator to do network management.
-	networks map[string]*network
-
-	// Allocator state to indicate if allocation has been
-	// successfully completed for this service.
-	services map[string]struct{}
-
-	// Allocator state to indicate if allocation has been
-	// successfully completed for this task.
-	tasks map[string]struct{}
-
-	// Allocator state to indicate if allocation has been
-	// successfully completed for this node.
-	nodes map[string]struct{}
-}
-
-// Local in-memory state related to network that need to be tracked by NetworkAllocator
-type network struct {
-	// A local cache of the store object.
-	nw *api.Network
-
-	// pools is used to save the internal poolIDs needed when
-	// releasing the pool.
-	pools map[string]string
-
-	// endpoints is a map of endpoint IP to the poolID from which it
-	// was allocated.
-	endpoints map[string]string
-
-	// isNodeLocal indicates whether the scope of the network's resources
-	// is local to the node. If true, it means the resources can only be
-	// allocated locally by the node where the network will be deployed.
-	// In this the swarm manager will skip the allocations.
-	isNodeLocal bool
-}
-
-type networkDriver struct {
-	driver     driverapi.Driver
-	name       string
-	capability *driverapi.Capability
-}
-
-type initializer struct {
-	fn    drvregistry.InitFunc
-	ntype string
-}
-
 // PredefinedNetworkData contains the minimum set of data needed
 // to create the correspondent predefined network object in the store.
 type PredefinedNetworkData struct {
@@ -93,280 +17,8 @@ type PredefinedNetworkData struct {
 	Driver string
 }
 
-// New returns a new NetworkAllocator handle
-func New(pg plugingetter.PluginGetter) (*NetworkAllocator, error) {
-	na := &NetworkAllocator{
-		networks: make(map[string]*network),
-		services: make(map[string]struct{}),
-		tasks:    make(map[string]struct{}),
-		nodes:    make(map[string]struct{}),
-	}
-
-	// There are no driver configurations and notification
-	// functions as of now.
-	reg, err := drvregistry.New(nil, nil, nil, nil, pg)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := initializeDrivers(reg); err != nil {
-		return nil, err
-	}
-
-	if err = initIPAMDrivers(reg); err != nil {
-		return nil, err
-	}
-
-	pa, err := newPortAllocator()
-	if err != nil {
-		return nil, err
-	}
-
-	na.portAllocator = pa
-	na.drvRegistry = reg
-	return na, nil
-}
-
-// Allocate allocates all the necessary resources both general
-// and driver-specific which may be specified in the NetworkSpec
-func (na *NetworkAllocator) Allocate(n *api.Network) error {
-	if _, ok := na.networks[n.ID]; ok {
-		return fmt.Errorf("network %s already allocated", n.ID)
-	}
-
-	d, err := na.resolveDriver(n)
-	if err != nil {
-		return err
-	}
-
-	nw := &network{
-		nw:          n,
-		endpoints:   make(map[string]string),
-		isNodeLocal: d.capability.DataScope == datastore.LocalScope,
-	}
-
-	// No swarm-level allocation can be provided by the network driver for
-	// node-local networks. Only thing needed is populating the driver's name
-	// in the driver's state.
-	if nw.isNodeLocal {
-		n.DriverState = &api.Driver{
-			Name: d.name,
-		}
-	} else {
-		nw.pools, err = na.allocatePools(n)
-		if err != nil {
-			return errors.Wrapf(err, "failed allocating pools and gateway IP for network %s", n.ID)
-		}
-
-		if err := na.allocateDriverState(n); err != nil {
-			na.freePools(n, nw.pools)
-			return errors.Wrapf(err, "failed while allocating driver state for network %s", n.ID)
-		}
-	}
-
-	na.networks[n.ID] = nw
-
-	return nil
-}
-
-func (na *NetworkAllocator) getNetwork(id string) *network {
-	return na.networks[id]
-}
-
-// Deallocate frees all the general and driver specific resources
-// which were assigned to the passed network.
-func (na *NetworkAllocator) Deallocate(n *api.Network) error {
-	localNet := na.getNetwork(n.ID)
-	if localNet == nil {
-		return fmt.Errorf("could not get networker state for network %s", n.ID)
-	}
-
-	// No swarm-level resource deallocation needed for node-local networks
-	if localNet.isNodeLocal {
-		delete(na.networks, n.ID)
-		return nil
-	}
-
-	if err := na.freeDriverState(n); err != nil {
-		return errors.Wrapf(err, "failed to free driver state for network %s", n.ID)
-	}
-
-	delete(na.networks, n.ID)
-
-	return na.freePools(n, localNet.pools)
-}
-
-// ServiceAllocate allocates all the network resources such as virtual
-// IP and ports needed by the service.
-func (na *NetworkAllocator) ServiceAllocate(s *api.Service) (err error) {
-	if err = na.portAllocator.serviceAllocatePorts(s); err != nil {
-		return err
-	}
-	defer func() {
-		if err != nil {
-			na.ServiceDeallocate(s)
-		}
-	}()
-
-	if s.Endpoint == nil {
-		s.Endpoint = &api.Endpoint{}
-	}
-	s.Endpoint.Spec = s.Spec.Endpoint.Copy()
-
-	// If ResolutionMode is DNSRR do not try allocating VIPs, but
-	// free any VIP from previous state.
-	if s.Spec.Endpoint != nil && s.Spec.Endpoint.Mode == api.ResolutionModeDNSRoundRobin {
-		for _, vip := range s.Endpoint.VirtualIPs {
-			if err := na.deallocateVIP(vip); err != nil {
-				// don't bail here, deallocate as many as possible.
-				log.L.WithError(err).
-					WithField("vip.network", vip.NetworkID).
-					WithField("vip.addr", vip.Addr).Error("error deallocating vip")
-			}
-		}
-
-		s.Endpoint.VirtualIPs = nil
-
-		delete(na.services, s.ID)
-		return nil
-	}
-
-	specNetworks := serviceNetworks(s)
-
-	// Allocate VIPs for all the pre-populated endpoint attachments
-	eVIPs := s.Endpoint.VirtualIPs[:0]
-
-vipLoop:
-	for _, eAttach := range s.Endpoint.VirtualIPs {
-		if na.IsVIPOnIngressNetwork(eAttach) && IsIngressNetworkNeeded(s) {
-			if err = na.allocateVIP(eAttach); err != nil {
-				return err
-			}
-			eVIPs = append(eVIPs, eAttach)
-			continue vipLoop
-
-		}
-		for _, nAttach := range specNetworks {
-			if nAttach.Target == eAttach.NetworkID {
-				if err = na.allocateVIP(eAttach); err != nil {
-					return err
-				}
-				eVIPs = append(eVIPs, eAttach)
-				continue vipLoop
-			}
-		}
-		// If the network of the VIP is not part of the service spec,
-		// deallocate the vip
-		na.deallocateVIP(eAttach)
-	}
-
-networkLoop:
-	for _, nAttach := range specNetworks {
-		for _, vip := range s.Endpoint.VirtualIPs {
-			if vip.NetworkID == nAttach.Target {
-				continue networkLoop
-			}
-		}
-
-		vip := &api.Endpoint_VirtualIP{NetworkID: nAttach.Target}
-		if err = na.allocateVIP(vip); err != nil {
-			return err
-		}
-
-		eVIPs = append(eVIPs, vip)
-	}
-
-	if len(eVIPs) > 0 {
-		na.services[s.ID] = struct{}{}
-	} else {
-		delete(na.services, s.ID)
-	}
-
-	s.Endpoint.VirtualIPs = eVIPs
-	return nil
-}
-
-// ServiceDeallocate de-allocates all the network resources such as
-// virtual IP and ports associated with the service.
-func (na *NetworkAllocator) ServiceDeallocate(s *api.Service) error {
-	if s.Endpoint == nil {
-		return nil
-	}
-
-	for _, vip := range s.Endpoint.VirtualIPs {
-		if err := na.deallocateVIP(vip); err != nil {
-			// don't bail here, deallocate as many as possible.
-			log.L.WithError(err).
-				WithField("vip.network", vip.NetworkID).
-				WithField("vip.addr", vip.Addr).Error("error deallocating vip")
-		}
-	}
-	s.Endpoint.VirtualIPs = nil
-
-	na.portAllocator.serviceDeallocatePorts(s)
-	delete(na.services, s.ID)
-
-	return nil
-}
-
-// IsAllocated returns if the passed network has been allocated or not.
-func (na *NetworkAllocator) IsAllocated(n *api.Network) bool {
-	_, ok := na.networks[n.ID]
-	return ok
-}
-
-// IsTaskAllocated returns if the passed task has its network resources allocated or not.
-func (na *NetworkAllocator) IsTaskAllocated(t *api.Task) bool {
-	// If the task is not found in the allocated set, then it is
-	// not allocated.
-	if _, ok := na.tasks[t.ID]; !ok {
-		return false
-	}
-
-	// If Networks is empty there is no way this Task is allocated.
-	if len(t.Networks) == 0 {
-		return false
-	}
-
-	// To determine whether the task has its resources allocated,
-	// we just need to look at one global scope network (in case of
-	// multi-network attachment).  This is because we make sure we
-	// allocate for every network or we allocate for none.
-
-	// Find the first global scope network
-	for _, nAttach := range t.Networks {
-		// If the network is not allocated, the task cannot be allocated.
-		localNet, ok := na.networks[nAttach.Network.ID]
-		if !ok {
-			return false
-		}
-
-		// Nothing else to check for local scope network
-		if localNet.isNodeLocal {
-			continue
-		}
-
-		// Addresses empty. Task is not allocated.
-		if len(nAttach.Addresses) == 0 {
-			return false
-		}
-
-		// The allocated IP address not found in local endpoint state. Not allocated.
-		if _, ok := localNet.endpoints[nAttach.Addresses[0]]; !ok {
-			return false
-		}
-	}
-
-	return true
-}
-
-// HostPublishPortsNeedUpdate returns true if the passed service needs
-// allocations for its published ports in host (non ingress) mode
-func (na *NetworkAllocator) HostPublishPortsNeedUpdate(s *api.Service) bool {
-	return na.portAllocator.hostPublishPortsNeedUpdate(s)
-}
-
-// ServiceAllocationOpts is struct used for functional options in IsServiceAllocated
+// ServiceAllocationOpts is struct used for functional options in
+// IsServiceAllocated
 type ServiceAllocationOpts struct {
 	OnInit bool
 }
@@ -376,593 +28,74 @@ func OnInit(options *ServiceAllocationOpts) {
 	options.OnInit = true
 }
 
-// ServiceNeedsAllocation returns true if the passed service needs to have network resources allocated/updated.
-func (na *NetworkAllocator) ServiceNeedsAllocation(s *api.Service, flags ...func(*ServiceAllocationOpts)) bool {
-	var options ServiceAllocationOpts
-	for _, flag := range flags {
-		flag(&options)
-	}
-
-	specNetworks := serviceNetworks(s)
-
-	// If endpoint mode is VIP and allocator does not have the
-	// service in VIP allocated set then it needs to be allocated.
-	if len(specNetworks) != 0 &&
-		(s.Spec.Endpoint == nil ||
-			s.Spec.Endpoint.Mode == api.ResolutionModeVirtualIP) {
-
-		if _, ok := na.services[s.ID]; !ok {
-			return true
-		}
-
-		if s.Endpoint == nil || len(s.Endpoint.VirtualIPs) == 0 {
-			return true
-		}
-
-		// If the spec has networks which don't have a corresponding VIP,
-		// the service needs to be allocated.
-	networkLoop:
-		for _, net := range specNetworks {
-			for _, vip := range s.Endpoint.VirtualIPs {
-				if vip.NetworkID == net.Target {
-					continue networkLoop
-				}
-			}
-			return true
-		}
-	}
-
-	// If the spec no longer has networks attached and has a vip allocated
-	// from previous spec the service needs to allocated.
-	if s.Endpoint != nil {
-	vipLoop:
-		for _, vip := range s.Endpoint.VirtualIPs {
-			if na.IsVIPOnIngressNetwork(vip) && IsIngressNetworkNeeded(s) {
-				continue vipLoop
-			}
-			for _, net := range specNetworks {
-				if vip.NetworkID == net.Target {
-					continue vipLoop
-				}
-			}
-			return true
-		}
-	}
-
-	// If the endpoint mode is DNSRR and allocator has the service
-	// in VIP allocated set then we return to be allocated to make
-	// sure the allocator triggers networkallocator to free up the
-	// resources if any.
-	if s.Spec.Endpoint != nil && s.Spec.Endpoint.Mode == api.ResolutionModeDNSRoundRobin {
-		if _, ok := na.services[s.ID]; ok {
-			return true
-		}
-	}
-
-	if (s.Spec.Endpoint != nil && len(s.Spec.Endpoint.Ports) != 0) ||
-		(s.Endpoint != nil && len(s.Endpoint.Ports) != 0) {
-		return !na.portAllocator.isPortsAllocatedOnInit(s, options.OnInit)
-	}
-	return false
-}
-
-// IsNodeAllocated returns if the passed node has its network resources allocated or not.
-func (na *NetworkAllocator) IsNodeAllocated(node *api.Node) bool {
-	// If the node is not found in the allocated set, then it is
-	// not allocated.
-	if _, ok := na.nodes[node.ID]; !ok {
-		return false
-	}
-
-	// If no attachment, not allocated.
-	if node.Attachment == nil {
-		return false
-	}
-
-	// If the network is not allocated, the node cannot be allocated.
-	localNet, ok := na.networks[node.Attachment.Network.ID]
-	if !ok {
-		return false
-	}
-
-	// Addresses empty, not allocated.
-	if len(node.Attachment.Addresses) == 0 {
-		return false
-	}
-
-	// The allocated IP address not found in local endpoint state. Not allocated.
-	if _, ok := localNet.endpoints[node.Attachment.Addresses[0]]; !ok {
-		return false
-	}
-
-	return true
-}
-
-// AllocateNode allocates the IP addresses for the network to which
-// the node is attached.
-func (na *NetworkAllocator) AllocateNode(node *api.Node) error {
-	if err := na.allocateNetworkIPs(node.Attachment); err != nil {
-		return err
-	}
-
-	na.nodes[node.ID] = struct{}{}
-	return nil
-}
-
-// DeallocateNode deallocates the IP addresses for the network to
-// which the node is attached.
-func (na *NetworkAllocator) DeallocateNode(node *api.Node) error {
-	delete(na.nodes, node.ID)
-	return na.releaseEndpoints([]*api.NetworkAttachment{node.Attachment})
-}
-
-// AllocateTask allocates all the endpoint resources for all the
-// networks that a task is attached to.
-func (na *NetworkAllocator) AllocateTask(t *api.Task) error {
-	for i, nAttach := range t.Networks {
-		if localNet := na.getNetwork(nAttach.Network.ID); localNet != nil && localNet.isNodeLocal {
-			continue
-		}
-		if err := na.allocateNetworkIPs(nAttach); err != nil {
-			if err := na.releaseEndpoints(t.Networks[:i]); err != nil {
-				log.G(context.TODO()).WithError(err).Errorf("Failed to release IP addresses while rolling back allocation for task %s network %s", t.ID, nAttach.Network.ID)
-			}
-			return errors.Wrapf(err, "failed to allocate network IP for task %s network %s", t.ID, nAttach.Network.ID)
-		}
-	}
-
-	na.tasks[t.ID] = struct{}{}
-
-	return nil
-}
-
-// DeallocateTask releases all the endpoint resources for all the
-// networks that a task is attached to.
-func (na *NetworkAllocator) DeallocateTask(t *api.Task) error {
-	delete(na.tasks, t.ID)
-	return na.releaseEndpoints(t.Networks)
-}
-
-func (na *NetworkAllocator) releaseEndpoints(networks []*api.NetworkAttachment) error {
-	for _, nAttach := range networks {
-		localNet := na.getNetwork(nAttach.Network.ID)
-		if localNet == nil {
-			return fmt.Errorf("could not find network allocator state for network %s", nAttach.Network.ID)
-		}
-
-		if localNet.isNodeLocal {
-			continue
-		}
-
-		ipam, _, _, err := na.resolveIPAM(nAttach.Network)
-		if err != nil {
-			return errors.Wrap(err, "failed to resolve IPAM while releasing")
-		}
-
-		// Do not fail and bail out if we fail to release IP
-		// address here. Keep going and try releasing as many
-		// addresses as possible.
-		for _, addr := range nAttach.Addresses {
-			// Retrieve the poolID and immediately nuke
-			// out the mapping.
-			poolID := localNet.endpoints[addr]
-			delete(localNet.endpoints, addr)
-
-			ip, _, err := net.ParseCIDR(addr)
-			if err != nil {
-				log.G(context.TODO()).Errorf("Could not parse IP address %s while releasing", addr)
-				continue
-			}
-
-			if err := ipam.ReleaseAddress(poolID, ip); err != nil {
-				log.G(context.TODO()).WithError(err).Errorf("IPAM failure while releasing IP address %s", addr)
-			}
-		}
-
-		// Clear out the address list when we are done with
-		// this network.
-		nAttach.Addresses = nil
-	}
-
-	return nil
-}
-
-// allocate virtual IP for a single endpoint attachment of the service.
-func (na *NetworkAllocator) allocateVIP(vip *api.Endpoint_VirtualIP) error {
-	localNet := na.getNetwork(vip.NetworkID)
-	if localNet == nil {
-		return errors.New("networkallocator: could not find local network state")
-	}
-
-	if localNet.isNodeLocal {
-		return nil
-	}
-
-	// If this IP is already allocated in memory we don't need to
-	// do anything.
-	if _, ok := localNet.endpoints[vip.Addr]; ok {
-		return nil
-	}
-
-	ipam, _, _, err := na.resolveIPAM(localNet.nw)
-	if err != nil {
-		return errors.Wrap(err, "failed to resolve IPAM while allocating")
-	}
-
-	var addr net.IP
-	if vip.Addr != "" {
-		var err error
-
-		addr, _, err = net.ParseCIDR(vip.Addr)
-		if err != nil {
-			return err
-		}
-	}
-
-	for _, poolID := range localNet.pools {
-		ip, _, err := ipam.RequestAddress(poolID, addr, nil)
-		if err != nil && err != ipamapi.ErrNoAvailableIPs && err != ipamapi.ErrIPOutOfRange {
-			return errors.Wrap(err, "could not allocate VIP from IPAM")
-		}
-
-		// If we got an address then we are done.
-		if err == nil {
-			ipStr := ip.String()
-			localNet.endpoints[ipStr] = poolID
-			vip.Addr = ipStr
-			return nil
-		}
-	}
-
-	return errors.New("could not find an available IP while allocating VIP")
-}
-
-func (na *NetworkAllocator) deallocateVIP(vip *api.Endpoint_VirtualIP) error {
-	localNet := na.getNetwork(vip.NetworkID)
-	if localNet == nil {
-		return errors.New("networkallocator: could not find local network state")
-	}
-	if localNet.isNodeLocal {
-		return nil
-	}
-	ipam, _, _, err := na.resolveIPAM(localNet.nw)
-	if err != nil {
-		return errors.Wrap(err, "failed to resolve IPAM while allocating")
-	}
-
-	// Retrieve the poolID and immediately nuke
-	// out the mapping.
-	poolID := localNet.endpoints[vip.Addr]
-	delete(localNet.endpoints, vip.Addr)
-
-	ip, _, err := net.ParseCIDR(vip.Addr)
-	if err != nil {
-		log.G(context.TODO()).Errorf("Could not parse VIP address %s while releasing", vip.Addr)
-		return err
-	}
-
-	if err := ipam.ReleaseAddress(poolID, ip); err != nil {
-		log.G(context.TODO()).WithError(err).Errorf("IPAM failure while releasing VIP address %s", vip.Addr)
-		return err
-	}
-
-	return nil
-}
-
-// allocate the IP addresses for a single network attachment of the task.
-func (na *NetworkAllocator) allocateNetworkIPs(nAttach *api.NetworkAttachment) error {
-	var ip *net.IPNet
-
-	ipam, _, _, err := na.resolveIPAM(nAttach.Network)
-	if err != nil {
-		return errors.Wrap(err, "failed to resolve IPAM while allocating")
-	}
-
-	localNet := na.getNetwork(nAttach.Network.ID)
-	if localNet == nil {
-		return fmt.Errorf("could not find network allocator state for network %s", nAttach.Network.ID)
-	}
-
-	addresses := nAttach.Addresses
-	if len(addresses) == 0 {
-		addresses = []string{""}
-	}
-
-	for i, rawAddr := range addresses {
-		var addr net.IP
-		if rawAddr != "" {
-			var err error
-			addr, _, err = net.ParseCIDR(rawAddr)
-			if err != nil {
-				addr = net.ParseIP(rawAddr)
-
-				if addr == nil {
-					return errors.Wrapf(err, "could not parse address string %s", rawAddr)
-				}
-			}
-		}
-
-		for _, poolID := range localNet.pools {
-			var err error
-
-			ip, _, err = ipam.RequestAddress(poolID, addr, nil)
-			if err != nil && err != ipamapi.ErrNoAvailableIPs && err != ipamapi.ErrIPOutOfRange {
-				return errors.Wrap(err, "could not allocate IP from IPAM")
-			}
-
-			// If we got an address then we are done.
-			if err == nil {
-				ipStr := ip.String()
-				localNet.endpoints[ipStr] = poolID
-				addresses[i] = ipStr
-				nAttach.Addresses = addresses
-				return nil
-			}
-		}
-	}
-
-	return errors.New("could not find an available IP")
-}
-
-func (na *NetworkAllocator) freeDriverState(n *api.Network) error {
-	d, err := na.resolveDriver(n)
-	if err != nil {
-		return err
-	}
-
-	return d.driver.NetworkFree(n.ID)
-}
-
-func (na *NetworkAllocator) allocateDriverState(n *api.Network) error {
-	d, err := na.resolveDriver(n)
-	if err != nil {
-		return err
-	}
-
-	options := make(map[string]string)
-	// reconcile the driver specific options from the network spec
-	// and from the operational state retrieved from the store
-	if n.Spec.DriverConfig != nil {
-		for k, v := range n.Spec.DriverConfig.Options {
-			options[k] = v
-		}
-	}
-	if n.DriverState != nil {
-		for k, v := range n.DriverState.Options {
-			options[k] = v
-		}
-	}
-
-	// Construct IPAM data for driver consumption.
-	ipv4Data := make([]driverapi.IPAMData, 0, len(n.IPAM.Configs))
-	for _, ic := range n.IPAM.Configs {
-		if ic.Family == api.IPAMConfig_IPV6 {
-			continue
-		}
-
-		_, subnet, err := net.ParseCIDR(ic.Subnet)
-		if err != nil {
-			return errors.Wrapf(err, "error parsing subnet %s while allocating driver state", ic.Subnet)
-		}
-
-		gwIP := net.ParseIP(ic.Gateway)
-		gwNet := &net.IPNet{
-			IP:   gwIP,
-			Mask: subnet.Mask,
-		}
-
-		data := driverapi.IPAMData{
-			Pool:    subnet,
-			Gateway: gwNet,
-		}
-
-		ipv4Data = append(ipv4Data, data)
-	}
-
-	ds, err := d.driver.NetworkAllocate(n.ID, options, ipv4Data, nil)
-	if err != nil {
-		return err
-	}
-
-	// Update network object with the obtained driver state.
-	n.DriverState = &api.Driver{
-		Name:    d.name,
-		Options: ds,
-	}
-
-	return nil
-}
-
-// Resolve network driver
-func (na *NetworkAllocator) resolveDriver(n *api.Network) (*networkDriver, error) {
-	dName := DefaultDriver
-	if n.Spec.DriverConfig != nil && n.Spec.DriverConfig.Name != "" {
-		dName = n.Spec.DriverConfig.Name
-	}
-
-	d, drvcap := na.drvRegistry.Driver(dName)
-	if d == nil {
-		var err error
-		err = na.loadDriver(dName)
-		if err != nil {
-			return nil, err
-		}
-
-		d, drvcap = na.drvRegistry.Driver(dName)
-		if d == nil {
-			return nil, fmt.Errorf("could not resolve network driver %s", dName)
-		}
-	}
-
-	return &networkDriver{driver: d, capability: drvcap, name: dName}, nil
-}
-
-func (na *NetworkAllocator) loadDriver(name string) error {
-	pg := na.drvRegistry.GetPluginGetter()
-	if pg == nil {
-		return errors.New("plugin store is uninitialized")
-	}
-	_, err := pg.Get(name, driverapi.NetworkPluginEndpointType, plugingetter.Lookup)
-	return err
-}
-
-// Resolve the IPAM driver
-func (na *NetworkAllocator) resolveIPAM(n *api.Network) (ipamapi.Ipam, string, map[string]string, error) {
-	dName := ipamapi.DefaultIPAM
-	if n.Spec.IPAM != nil && n.Spec.IPAM.Driver != nil && n.Spec.IPAM.Driver.Name != "" {
-		dName = n.Spec.IPAM.Driver.Name
-	}
-
-	var dOptions map[string]string
-	if n.Spec.IPAM != nil && n.Spec.IPAM.Driver != nil && len(n.Spec.IPAM.Driver.Options) != 0 {
-		dOptions = n.Spec.IPAM.Driver.Options
-	}
-
-	ipam, _ := na.drvRegistry.IPAM(dName)
-	if ipam == nil {
-		return nil, "", nil, fmt.Errorf("could not resolve IPAM driver %s", dName)
-	}
-
-	return ipam, dName, dOptions, nil
-}
-
-func (na *NetworkAllocator) freePools(n *api.Network, pools map[string]string) error {
-	ipam, _, _, err := na.resolveIPAM(n)
-	if err != nil {
-		return errors.Wrapf(err, "failed to resolve IPAM while freeing pools for network %s", n.ID)
-	}
-
-	releasePools(ipam, n.IPAM.Configs, pools)
-	return nil
-}
-
-func releasePools(ipam ipamapi.Ipam, icList []*api.IPAMConfig, pools map[string]string) {
-	for _, ic := range icList {
-		if err := ipam.ReleaseAddress(pools[ic.Subnet], net.ParseIP(ic.Gateway)); err != nil {
-			log.G(context.TODO()).WithError(err).Errorf("Failed to release address %s", ic.Subnet)
-		}
-	}
-
-	for k, p := range pools {
-		if err := ipam.ReleasePool(p); err != nil {
-			log.G(context.TODO()).WithError(err).Errorf("Failed to release pool %s", k)
-		}
-	}
-}
-
-func (na *NetworkAllocator) allocatePools(n *api.Network) (map[string]string, error) {
-	ipam, dName, dOptions, err := na.resolveIPAM(n)
-	if err != nil {
-		return nil, err
-	}
-
-	// We don't support user defined address spaces yet so just
-	// retrieve default address space names for the driver.
-	_, asName, err := na.drvRegistry.IPAMDefaultAddressSpaces(dName)
-	if err != nil {
-		return nil, err
-	}
-
-	pools := make(map[string]string)
-
-	var ipamConfigs []*api.IPAMConfig
-
-	// If there is non-nil IPAM state always prefer those subnet
-	// configs over Spec configs.
-	if n.IPAM != nil {
-		ipamConfigs = n.IPAM.Configs
-	} else if n.Spec.IPAM != nil {
-		ipamConfigs = make([]*api.IPAMConfig, len(n.Spec.IPAM.Configs))
-		copy(ipamConfigs, n.Spec.IPAM.Configs)
-	}
-
-	// Append an empty slot for subnet allocation if there are no
-	// IPAM configs from either spec or state.
-	if len(ipamConfigs) == 0 {
-		ipamConfigs = append(ipamConfigs, &api.IPAMConfig{Family: api.IPAMConfig_IPV4})
-	}
-
-	// Update the runtime IPAM configurations with initial state
-	n.IPAM = &api.IPAMOptions{
-		Driver:  &api.Driver{Name: dName, Options: dOptions},
-		Configs: ipamConfigs,
-	}
-
-	for i, ic := range ipamConfigs {
-		poolID, poolIP, meta, err := ipam.RequestPool(asName, ic.Subnet, ic.Range, dOptions, false)
-		if err != nil {
-			// Rollback by releasing all the resources allocated so far.
-			releasePools(ipam, ipamConfigs[:i], pools)
-			return nil, err
-		}
-		pools[poolIP.String()] = poolID
-
-		// The IPAM contract allows the IPAM driver to autonomously
-		// provide a network gateway in response to the pool request.
-		// But if the network spec contains a gateway, we will allocate
-		// it irrespective of whether the ipam driver returned one already.
-		// If none of the above is true, we need to allocate one now, and
-		// let the driver know this request is for the network gateway.
-		var (
-			gwIP *net.IPNet
-			ip   net.IP
-		)
-		if gws, ok := meta[netlabel.Gateway]; ok {
-			if ip, gwIP, err = net.ParseCIDR(gws); err != nil {
-				return nil, fmt.Errorf("failed to parse gateway address (%v) returned by ipam driver: %v", gws, err)
-			}
-			gwIP.IP = ip
-		}
-		if ic.Gateway != "" || gwIP == nil {
-			gwIP, _, err = ipam.RequestAddress(poolID, net.ParseIP(ic.Gateway), map[string]string{ipamapi.RequestAddressType: netlabel.Gateway})
-			if err != nil {
-				// Rollback by releasing all the resources allocated so far.
-				releasePools(ipam, ipamConfigs[:i], pools)
-				return nil, err
-			}
-		}
-
-		if ic.Subnet == "" {
-			ic.Subnet = poolIP.String()
-		}
-
-		if ic.Gateway == "" {
-			ic.Gateway = gwIP.IP.String()
-		}
-
-	}
-
-	return pools, nil
-}
-
-func initializeDrivers(reg *drvregistry.DrvRegistry) error {
-	for _, i := range initializers {
-		if err := reg.AddDriver(i.ntype, i.fn, nil); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func serviceNetworks(s *api.Service) []*api.NetworkAttachmentConfig {
-	// Always prefer NetworkAttachmentConfig in the TaskSpec
-	if len(s.Spec.Task.Networks) == 0 && len(s.Spec.Networks) != 0 {
-		return s.Spec.Networks
-	}
-	return s.Spec.Task.Networks
-}
-
-// IsVIPOnIngressNetwork check if the vip is in ingress network
-func (na *NetworkAllocator) IsVIPOnIngressNetwork(vip *api.Endpoint_VirtualIP) bool {
-	if vip == nil {
-		return false
-	}
-
-	localNet := na.getNetwork(vip.NetworkID)
-	if localNet != nil && localNet.nw != nil {
-		return IsIngressNetwork(localNet.nw)
-	}
-	return false
+// NetworkAllocator provides network model specific allocation functionality.
+type NetworkAllocator interface {
+	//
+	// Network Allocation
+	//
+
+	// IsAllocated returns if the passed network has been allocated or not.
+	IsAllocated(n *api.Network) bool
+
+	// Allocate allocates all the necessary resources both general
+	// and driver-specific which may be specified in the NetworkSpec
+	Allocate(n *api.Network) error
+
+	// Deallocate frees all the general and driver specific resources
+	// which were assigned to the passed network.
+	Deallocate(n *api.Network) error
+
+	//
+	// Service Allocation
+	//
+
+	// IsServiceAllocated returns false if the passed service
+	// needs to have network resources allocated/updated.
+	IsServiceAllocated(s *api.Service, flags ...func(*ServiceAllocationOpts)) bool
+
+	// AllocateService allocates all the network resources such as virtual
+	// IP and ports needed by the service.
+	AllocateService(s *api.Service) (err error)
+
+	// DeallocateService de-allocates all the network resources such as
+	// virtual IP and ports associated with the service.
+	DeallocateService(s *api.Service) error
+
+	// HostPublishPortsNeedUpdate returns true if the passed service needs
+	// allocations for its published ports in host (non ingress) mode
+	HostPublishPortsNeedUpdate(s *api.Service) bool
+
+	//
+	// Node Allocation
+	//
+
+	// IsNodeAllocated returns if the passed node has its network
+	// resources allocated or not.
+	IsNodeAllocated(node *api.Node) bool
+
+	// AllocateNode allocates the IP addresses for the network to which
+	// the node is attached.
+	AllocateNode(node *api.Node) error
+
+	// DeallocateNode deallocates the IP addresses for the network to
+	// which the node is attached.
+	DeallocateNode(node *api.Node) error
+
+	//
+	// Task Allocation
+	//
+
+	// IsTaskAllocated returns if the passed task has its network
+	// resources allocated or not.
+	IsTaskAllocated(t *api.Task) bool
+
+	// AllocateTask allocates all the endpoint resources for all the
+	// networks that a task is attached to.
+	AllocateTask(t *api.Task) error
+
+	// DeallocateTask releases all the endpoint resources for all the
+	// networks that a task is attached to.
+	DeallocateTask(t *api.Task) error
 }
 
 // IsIngressNetwork check if the network is an ingress network
@@ -997,14 +130,3 @@ func IsIngressNetworkNeeded(s *api.Service) bool {
 
 	return false
 }
-
-// IsBuiltInDriver returns whether the passed driver is an internal network driver
-func IsBuiltInDriver(name string) bool {
-	n := strings.ToLower(name)
-	for _, d := range initializers {
-		if n == d.ntype {
-			return true
-		}
-	}
-	return false
-}
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/controlapi/cluster.go b/components/engine/vendor/github.com/docker/swarmkit/manager/controlapi/cluster.go
index 9832272a3f..7e9dea2ce5 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/controlapi/cluster.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/controlapi/cluster.go
@@ -247,6 +247,11 @@ func redactClusters(clusters []*api.Cluster) []*api.Cluster {
 		// Do not copy secret keys
 		redactedSpec := cluster.Spec.Copy()
 		redactedSpec.CAConfig.SigningCAKey = nil
+		// the cert is not a secret, but if API users get the cluster spec and then update,
+		// then because the cert is included but not the key, the user can get update errors
+		// or unintended consequences (such as telling swarm to forget about the key so long
+		// as there is a corresponding external CA)
+		redactedSpec.CAConfig.SigningCACert = nil
 
 		redactedRootCA := cluster.RootCA.Copy()
 		redactedRootCA.CAKey = nil
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/controlapi/common.go b/components/engine/vendor/github.com/docker/swarmkit/manager/controlapi/common.go
index 56f0f8a00d..c01662379e 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/controlapi/common.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/controlapi/common.go
@@ -5,9 +5,10 @@ import (
 	"strings"
 
 	"github.com/docker/docker/pkg/plugingetter"
+	"github.com/docker/libnetwork/driverapi"
 	"github.com/docker/libnetwork/ipamapi"
 	"github.com/docker/swarmkit/api"
-	"github.com/docker/swarmkit/manager/allocator/networkallocator"
+	"github.com/docker/swarmkit/manager/allocator"
 	"github.com/docker/swarmkit/manager/state/store"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
@@ -110,10 +111,11 @@ func validateDriver(driver *api.Driver, pg plugingetter.PluginGetter, pluginType
 		if strings.ToLower(driver.Name) == ipamapi.DefaultIPAM {
 			return nil
 		}
-	default:
-		if networkallocator.IsBuiltInDriver(driver.Name) {
+	case driverapi.NetworkPluginEndpointType:
+		if allocator.IsBuiltInNetworkDriver(driver.Name) {
 			return nil
 		}
+	default:
 	}
 
 	if pg == nil {
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/controlapi/service.go b/components/engine/vendor/github.com/docker/swarmkit/manager/controlapi/service.go
index ecf79579c6..d556b6c0e7 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/controlapi/service.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/controlapi/service.go
@@ -9,6 +9,7 @@ import (
 	"github.com/docker/distribution/reference"
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/api/defaults"
+	"github.com/docker/swarmkit/api/genericresource"
 	"github.com/docker/swarmkit/api/naming"
 	"github.com/docker/swarmkit/identity"
 	"github.com/docker/swarmkit/manager/allocator"
@@ -42,6 +43,9 @@ func validateResources(r *api.Resources) error {
 	if r.MemoryBytes != 0 && r.MemoryBytes < 4*1024*1024 {
 		return grpc.Errorf(codes.InvalidArgument, "invalid memory value %d: Must be at least 4MiB", r.MemoryBytes)
 	}
+	if err := genericresource.ValidateTask(r); err != nil {
+		return nil
+	}
 	return nil
 }
 
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/dispatcher/dispatcher.go b/components/engine/vendor/github.com/docker/swarmkit/manager/dispatcher/dispatcher.go
index 4eeb4ccb10..33275f4c16 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/dispatcher/dispatcher.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/dispatcher/dispatcher.go
@@ -631,7 +631,7 @@ func (d *Dispatcher) processUpdates(ctx context.Context) {
 					logger.WithError(err).Error("failed to update task status")
 					return nil
 				}
-				logger.Debug("task status updated")
+				logger.Debug("dispatcher committed status update to store")
 				return nil
 			})
 			if err != nil {
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/manager.go b/components/engine/vendor/github.com/docker/swarmkit/manager/manager.go
index 005a56c33d..d17e8ec231 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/manager.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/manager.go
@@ -217,7 +217,6 @@ func New(config *Config) (*Manager, error) {
 
 	m := &Manager{
 		config:          *config,
-		collector:       metrics.NewCollector(raftNode.MemoryStore()),
 		caserver:        ca.NewServer(raftNode.MemoryStore(), config.SecurityConfig, config.RootCAPaths),
 		dispatcher:      dispatcher.New(raftNode, dispatcher.DefaultConfig()),
 		logbroker:       logbroker.New(raftNode.MemoryStore()),
@@ -502,12 +501,16 @@ func (m *Manager) Run(parent context.Context) error {
 	healthServer.SetServingStatus("Raft", api.HealthCheckResponse_SERVING)
 
 	if err := m.raftNode.JoinAndStart(ctx); err != nil {
+		// Don't block future calls to Stop.
+		close(m.started)
 		return errors.Wrap(err, "can't initialize raft node")
 	}
 
 	localHealthServer.SetServingStatus("ControlAPI", api.HealthCheckResponse_SERVING)
 
 	// Start metrics collection.
+
+	m.collector = metrics.NewCollector(m.raftNode.MemoryStore())
 	go func(collector *metrics.Collector) {
 		if err := collector.Run(ctx); err != nil {
 			log.G(ctx).WithError(err).Error("collector failed with an error")
@@ -590,7 +593,10 @@ func (m *Manager) Stop(ctx context.Context, clearData bool) {
 
 	m.raftNode.Cancel()
 
-	m.collector.Stop()
+	if m.collector != nil {
+		m.collector.Stop()
+	}
+
 	m.dispatcher.Stop()
 	m.logbroker.Stop()
 	m.caserver.Stop()
@@ -692,7 +698,7 @@ func (m *Manager) updateKEK(ctx context.Context, cluster *api.Cluster) error {
 
 			connBroker := connectionbroker.New(remotes.NewRemotes())
 			connBroker.SetLocalConn(conn)
-			if err := ca.RenewTLSConfigNow(ctx, securityConfig, connBroker); err != nil {
+			if err := ca.RenewTLSConfigNow(ctx, securityConfig, connBroker, m.config.RootCAPaths); err != nil {
 				logger.WithError(err).Error("failed to download new TLS certificate after locking the cluster")
 			}
 		}()
@@ -939,18 +945,19 @@ func (m *Manager) becomeLeader(ctx context.Context) {
 			if err := store.CreateNetwork(tx, newIngressNetwork()); err != nil {
 				log.G(ctx).WithError(err).Error("failed to create default ingress network")
 			}
-			// Create now the static predefined node-local networks which
-			// are known to be present in each cluster node. This is needed
-			// in order to allow running services on the predefined docker
-			// networks like `bridge` and `host`.
-			log.G(ctx).Info("Creating node-local predefined networks")
-			for _, p := range networkallocator.PredefinedNetworks() {
+		}
+		// Create now the static predefined if the store does not contain predefined
+		//networks like bridge/host node-local networks which
+		// are known to be present in each cluster node. This is needed
+		// in order to allow running services on the predefined docker
+		// networks like `bridge` and `host`.
+		for _, p := range allocator.PredefinedNetworks() {
+			if store.GetNetwork(tx, p.Name) == nil {
 				if err := store.CreateNetwork(tx, newPredefinedNetwork(p.Name, p.Driver)); err != nil {
 					log.G(ctx).WithError(err).Error("failed to create predefined network " + p.Name)
 				}
 			}
 		}
-
 		return nil
 	})
 
@@ -1027,7 +1034,7 @@ func (m *Manager) becomeLeader(ctx context.Context) {
 	}(m.constraintEnforcer)
 
 	go func(taskReaper *taskreaper.TaskReaper) {
-		taskReaper.Run()
+		taskReaper.Run(ctx)
 	}(m.taskReaper)
 
 	go func(orchestrator *replicated.Orchestrator) {
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/orchestrator/constraintenforcer/constraint_enforcer.go b/components/engine/vendor/github.com/docker/swarmkit/manager/orchestrator/constraintenforcer/constraint_enforcer.go
index 06c34d9a21..2978898ccb 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/orchestrator/constraintenforcer/constraint_enforcer.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/orchestrator/constraintenforcer/constraint_enforcer.go
@@ -4,6 +4,7 @@ import (
 	"time"
 
 	"github.com/docker/swarmkit/api"
+	"github.com/docker/swarmkit/api/genericresource"
 	"github.com/docker/swarmkit/log"
 	"github.com/docker/swarmkit/manager/constraint"
 	"github.com/docker/swarmkit/manager/state"
@@ -83,10 +84,11 @@ func (ce *ConstraintEnforcer) rejectNoncompliantTasks(node *api.Node) {
 		log.L.WithError(err).Errorf("failed to list tasks for node ID %s", node.ID)
 	}
 
-	var availableMemoryBytes, availableNanoCPUs int64
+	available := &api.Resources{}
+	var fakeStore []*api.GenericResource
+
 	if node.Description != nil && node.Description.Resources != nil {
-		availableMemoryBytes = node.Description.Resources.MemoryBytes
-		availableNanoCPUs = node.Description.Resources.NanoCPUs
+		available = node.Description.Resources.Copy()
 	}
 
 	removeTasks := make(map[string]*api.Task)
@@ -97,6 +99,7 @@ func (ce *ConstraintEnforcer) rejectNoncompliantTasks(node *api.Node) {
 	// a separate pass over the tasks for each type of
 	// resource, and sort by the size of the reservation
 	// to remove the most resource-intensive tasks.
+loop:
 	for _, t := range tasks {
 		if t.DesiredState < api.TaskStateAssigned || t.DesiredState > api.TaskStateRunning {
 			continue
@@ -115,16 +118,27 @@ func (ce *ConstraintEnforcer) rejectNoncompliantTasks(node *api.Node) {
 		// Ensure that the task assigned to the node
 		// still satisfies the resource limits.
 		if t.Spec.Resources != nil && t.Spec.Resources.Reservations != nil {
-			if t.Spec.Resources.Reservations.MemoryBytes > availableMemoryBytes {
+			if t.Spec.Resources.Reservations.MemoryBytes > available.MemoryBytes {
 				removeTasks[t.ID] = t
 				continue
 			}
-			if t.Spec.Resources.Reservations.NanoCPUs > availableNanoCPUs {
+			if t.Spec.Resources.Reservations.NanoCPUs > available.NanoCPUs {
 				removeTasks[t.ID] = t
 				continue
 			}
-			availableMemoryBytes -= t.Spec.Resources.Reservations.MemoryBytes
-			availableNanoCPUs -= t.Spec.Resources.Reservations.NanoCPUs
+			for _, ta := range t.AssignedGenericResources {
+				// Type change or no longer available
+				if genericresource.HasResource(ta, available.Generic) {
+					removeTasks[t.ID] = t
+					break loop
+				}
+			}
+
+			available.MemoryBytes -= t.Spec.Resources.Reservations.MemoryBytes
+			available.NanoCPUs -= t.Spec.Resources.Reservations.NanoCPUs
+
+			genericresource.ClaimResources(&available.Generic,
+				&fakeStore, t.AssignedGenericResources)
 		}
 	}
 
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/orchestrator/task.go b/components/engine/vendor/github.com/docker/swarmkit/manager/orchestrator/task.go
index 54a069e199..32a22d5f5a 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/orchestrator/task.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/orchestrator/task.go
@@ -63,7 +63,7 @@ func IsTaskDirty(s *api.Service, t *api.Task) bool {
 	// If the spec version matches, we know the task is not dirty. However,
 	// if it does not match, that doesn't mean the task is dirty, since
 	// only a portion of the spec is included in the comparison.
-	if t.SpecVersion != nil && *s.SpecVersion == *t.SpecVersion {
+	if t.SpecVersion != nil && s.SpecVersion != nil && *s.SpecVersion == *t.SpecVersion {
 		return false
 	}
 
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/orchestrator/taskreaper/task_reaper.go b/components/engine/vendor/github.com/docker/swarmkit/manager/orchestrator/taskreaper/task_reaper.go
index e051155dff..edb771c699 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/orchestrator/taskreaper/task_reaper.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/orchestrator/taskreaper/task_reaper.go
@@ -4,7 +4,6 @@ import (
 	"sort"
 	"time"
 
-	"github.com/docker/go-events"
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/log"
 	"github.com/docker/swarmkit/manager/state"
@@ -33,29 +32,28 @@ type TaskReaper struct {
 	taskHistory int64
 	dirty       map[instanceTuple]struct{}
 	orphaned    []string
-	watcher     chan events.Event
-	cancelWatch func()
 	stopChan    chan struct{}
 	doneChan    chan struct{}
 }
 
 // New creates a new TaskReaper.
 func New(store *store.MemoryStore) *TaskReaper {
-	watcher, cancel := state.Watch(store.WatchQueue(), api.EventCreateTask{}, api.EventUpdateTask{}, api.EventUpdateCluster{})
-
 	return &TaskReaper{
-		store:       store,
-		watcher:     watcher,
-		cancelWatch: cancel,
-		dirty:       make(map[instanceTuple]struct{}),
-		stopChan:    make(chan struct{}),
-		doneChan:    make(chan struct{}),
+		store:    store,
+		dirty:    make(map[instanceTuple]struct{}),
+		stopChan: make(chan struct{}),
+		doneChan: make(chan struct{}),
 	}
 }
 
 // Run is the TaskReaper's main loop.
-func (tr *TaskReaper) Run() {
-	defer close(tr.doneChan)
+func (tr *TaskReaper) Run(ctx context.Context) {
+	watcher, watchCancel := state.Watch(tr.store.WatchQueue(), api.EventCreateTask{}, api.EventUpdateTask{}, api.EventUpdateCluster{})
+
+	defer func() {
+		close(tr.doneChan)
+		watchCancel()
+	}()
 
 	var tasks []*api.Task
 	tr.store.View(func(readTx store.ReadTx) {
@@ -68,7 +66,7 @@ func (tr *TaskReaper) Run() {
 
 		tasks, err = store.FindTasks(readTx, store.ByTaskState(api.TaskStateOrphaned))
 		if err != nil {
-			log.G(context.TODO()).WithError(err).Error("failed to find Orphaned tasks in task reaper init")
+			log.G(ctx).WithError(err).Error("failed to find Orphaned tasks in task reaper init")
 		}
 	})
 
@@ -91,7 +89,7 @@ func (tr *TaskReaper) Run() {
 
 	for {
 		select {
-		case event := <-tr.watcher:
+		case event := <-watcher:
 			switch v := event.(type) {
 			case api.EventCreateTask:
 				t := v.Task
@@ -218,7 +216,6 @@ func (tr *TaskReaper) tick() {
 
 // Stop stops the TaskReaper and waits for the main loop to exit.
 func (tr *TaskReaper) Stop() {
-	tr.cancelWatch()
 	close(tr.stopChan)
 	<-tr.doneChan
 }
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/scheduler/filter.go b/components/engine/vendor/github.com/docker/swarmkit/manager/scheduler/filter.go
index 2909a648d7..36b601c4b4 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/scheduler/filter.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/scheduler/filter.go
@@ -5,6 +5,7 @@ import (
 	"strings"
 
 	"github.com/docker/swarmkit/api"
+	"github.com/docker/swarmkit/api/genericresource"
 	"github.com/docker/swarmkit/manager/constraint"
 )
 
@@ -61,9 +62,12 @@ func (f *ResourceFilter) SetTask(t *api.Task) bool {
 	if r == nil || r.Reservations == nil {
 		return false
 	}
-	if r.Reservations.NanoCPUs == 0 && r.Reservations.MemoryBytes == 0 {
+
+	res := r.Reservations
+	if res.NanoCPUs == 0 && res.MemoryBytes == 0 && len(res.Generic) == 0 {
 		return false
 	}
+
 	f.reservations = r.Reservations
 	return true
 }
@@ -78,6 +82,13 @@ func (f *ResourceFilter) Check(n *NodeInfo) bool {
 		return false
 	}
 
+	for _, v := range f.reservations.Generic {
+		enough, err := genericresource.HasEnough(n.AvailableResources.Generic, v)
+		if err != nil || !enough {
+			return false
+		}
+	}
+
 	return true
 }
 
@@ -117,7 +128,7 @@ func (f *PluginFilter) SetTask(t *api.Task) bool {
 		}
 	}
 
-	if (c != nil && volumeTemplates) || len(t.Networks) > 0 {
+	if (c != nil && volumeTemplates) || len(t.Networks) > 0 || t.Spec.LogDriver != nil {
 		f.t = t
 		return true
 	}
@@ -128,6 +139,12 @@ func (f *PluginFilter) SetTask(t *api.Task) bool {
 // Check returns true if the task can be scheduled into the given node.
 // TODO(amitshukla): investigate storing Plugins as a map so it can be easily probed
 func (f *PluginFilter) Check(n *NodeInfo) bool {
+	if n.Description == nil || n.Description.Engine == nil {
+		// If the node is not running Engine, plugins are not
+		// supported.
+		return true
+	}
+
 	// Get list of plugins on the node
 	nodePlugins := n.Description.Engine.Plugins
 
@@ -136,7 +153,7 @@ func (f *PluginFilter) Check(n *NodeInfo) bool {
 	if container != nil {
 		for _, mount := range container.Mounts {
 			if referencesVolumePlugin(mount) {
-				if !f.pluginExistsOnNode("Volume", mount.VolumeOptions.DriverConfig.Name, nodePlugins) {
+				if _, exists := f.pluginExistsOnNode("Volume", mount.VolumeOptions.DriverConfig.Name, nodePlugins); !exists {
 					return false
 				}
 			}
@@ -146,22 +163,34 @@ func (f *PluginFilter) Check(n *NodeInfo) bool {
 	// Check if all network plugins required by task are installed on node
 	for _, tn := range f.t.Networks {
 		if tn.Network != nil && tn.Network.DriverState != nil && tn.Network.DriverState.Name != "" {
-			if !f.pluginExistsOnNode("Network", tn.Network.DriverState.Name, nodePlugins) {
+			if _, exists := f.pluginExistsOnNode("Network", tn.Network.DriverState.Name, nodePlugins); !exists {
 				return false
 			}
 		}
 	}
+
+	if f.t.Spec.LogDriver != nil {
+		// If there are no log driver types in the list at all, most likely this is
+		// an older daemon that did not report this information. In this case don't filter
+		if typeFound, exists := f.pluginExistsOnNode("Log", f.t.Spec.LogDriver.Name, nodePlugins); !exists && typeFound {
+			return false
+		}
+	}
 	return true
 }
 
 // pluginExistsOnNode returns true if the (pluginName, pluginType) pair is present in nodePlugins
-func (f *PluginFilter) pluginExistsOnNode(pluginType string, pluginName string, nodePlugins []api.PluginDescription) bool {
+func (f *PluginFilter) pluginExistsOnNode(pluginType string, pluginName string, nodePlugins []api.PluginDescription) (bool, bool) {
+	var typeFound bool
+
 	for _, np := range nodePlugins {
 		if pluginType != np.Type {
 			continue
 		}
+		typeFound = true
+
 		if pluginName == np.Name {
-			return true
+			return true, true
 		}
 		// This does not use the reference package to avoid the
 		// overhead of parsing references as part of the scheduling
@@ -169,10 +198,10 @@ func (f *PluginFilter) pluginExistsOnNode(pluginType string, pluginName string,
 		// strict subset of the reference grammar that is always
 		// name:tag.
 		if strings.HasPrefix(np.Name, pluginName) && np.Name[len(pluginName):] == ":latest" {
-			return true
+			return true, true
 		}
 	}
-	return false
+	return typeFound, false
 }
 
 // Explain returns an explanation of a failure.
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/scheduler/nodeinfo.go b/components/engine/vendor/github.com/docker/swarmkit/manager/scheduler/nodeinfo.go
index 25b22d7b15..a375ed9f5d 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/scheduler/nodeinfo.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/scheduler/nodeinfo.go
@@ -4,6 +4,7 @@ import (
 	"time"
 
 	"github.com/docker/swarmkit/api"
+	"github.com/docker/swarmkit/api/genericresource"
 	"github.com/docker/swarmkit/log"
 	"golang.org/x/net/context"
 )
@@ -20,7 +21,7 @@ type NodeInfo struct {
 	Tasks                     map[string]*api.Task
 	ActiveTasksCount          int
 	ActiveTasksCountByService map[string]int
-	AvailableResources        api.Resources
+	AvailableResources        *api.Resources
 	usedHostPorts             map[hostPortSpec]struct{}
 
 	// recentFailures is a map from service ID to the timestamps of the
@@ -36,7 +37,7 @@ func newNodeInfo(n *api.Node, tasks map[string]*api.Task, availableResources api
 		Node:  n,
 		Tasks: make(map[string]*api.Task),
 		ActiveTasksCountByService: make(map[string]int),
-		AvailableResources:        availableResources,
+		AvailableResources:        availableResources.Copy(),
 		usedHostPorts:             make(map[hostPortSpec]struct{}),
 		recentFailures:            make(map[string][]time.Time),
 	}
@@ -44,6 +45,7 @@ func newNodeInfo(n *api.Node, tasks map[string]*api.Task, availableResources api
 	for _, t := range tasks {
 		nodeInfo.addTask(t)
 	}
+
 	return nodeInfo
 }
 
@@ -61,10 +63,6 @@ func (nodeInfo *NodeInfo) removeTask(t *api.Task) bool {
 		nodeInfo.ActiveTasksCountByService[t.ServiceID]--
 	}
 
-	reservations := taskReservations(t.Spec)
-	nodeInfo.AvailableResources.MemoryBytes += reservations.MemoryBytes
-	nodeInfo.AvailableResources.NanoCPUs += reservations.NanoCPUs
-
 	if t.Endpoint != nil {
 		for _, port := range t.Endpoint.Ports {
 			if port.PublishMode == api.PublishModeHost && port.PublishedPort != 0 {
@@ -74,6 +72,22 @@ func (nodeInfo *NodeInfo) removeTask(t *api.Task) bool {
 		}
 	}
 
+	reservations := taskReservations(t.Spec)
+	resources := nodeInfo.AvailableResources
+
+	resources.MemoryBytes += reservations.MemoryBytes
+	resources.NanoCPUs += reservations.NanoCPUs
+
+	if nodeInfo.Description == nil || nodeInfo.Description.Resources == nil ||
+		nodeInfo.Description.Resources.Generic == nil {
+		return true
+	}
+
+	taskAssigned := t.AssignedGenericResources
+	nodeAvailableResources := &resources.Generic
+	nodeRes := nodeInfo.Description.Resources.Generic
+	genericresource.Reclaim(nodeAvailableResources, taskAssigned, nodeRes)
+
 	return true
 }
 
@@ -97,9 +111,18 @@ func (nodeInfo *NodeInfo) addTask(t *api.Task) bool {
 	}
 
 	nodeInfo.Tasks[t.ID] = t
+
 	reservations := taskReservations(t.Spec)
-	nodeInfo.AvailableResources.MemoryBytes -= reservations.MemoryBytes
-	nodeInfo.AvailableResources.NanoCPUs -= reservations.NanoCPUs
+	resources := nodeInfo.AvailableResources
+
+	resources.MemoryBytes -= reservations.MemoryBytes
+	resources.NanoCPUs -= reservations.NanoCPUs
+
+	// minimum size required
+	t.AssignedGenericResources = make([]*api.GenericResource, 0, len(resources.Generic))
+	taskAssigned := &t.AssignedGenericResources
+
+	genericresource.Claim(&resources.Generic, taskAssigned, reservations.Generic)
 
 	if t.Endpoint != nil {
 		for _, port := range t.Endpoint.Ports {
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/scheduler/nodeset.go b/components/engine/vendor/github.com/docker/swarmkit/manager/scheduler/nodeset.go
index 7f899d8b26..b83704a18d 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/scheduler/nodeset.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/scheduler/nodeset.go
@@ -4,7 +4,6 @@ import (
 	"container/heap"
 	"errors"
 	"strings"
-	"time"
 
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/manager/constraint"
@@ -32,16 +31,6 @@ func (ns *nodeSet) nodeInfo(nodeID string) (NodeInfo, error) {
 // addOrUpdateNode sets the number of tasks for a given node. It adds the node
 // to the set if it wasn't already tracked.
 func (ns *nodeSet) addOrUpdateNode(n NodeInfo) {
-	if n.Tasks == nil {
-		n.Tasks = make(map[string]*api.Task)
-	}
-	if n.ActiveTasksCountByService == nil {
-		n.ActiveTasksCountByService = make(map[string]int)
-	}
-	if n.recentFailures == nil {
-		n.recentFailures = make(map[string][]time.Time)
-	}
-
 	ns.nodes[n.ID] = n
 }
 
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/scheduler/scheduler.go b/components/engine/vendor/github.com/docker/swarmkit/manager/scheduler/scheduler.go
index a6479b8834..07d9b0458c 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/scheduler/scheduler.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/scheduler/scheduler.go
@@ -4,6 +4,7 @@ import (
 	"time"
 
 	"github.com/docker/swarmkit/api"
+	"github.com/docker/swarmkit/api/genericresource"
 	"github.com/docker/swarmkit/log"
 	"github.com/docker/swarmkit/manager/state"
 	"github.com/docker/swarmkit/manager/state/store"
@@ -30,8 +31,11 @@ type schedulingDecision struct {
 type Scheduler struct {
 	store           *store.MemoryStore
 	unassignedTasks map[string]*api.Task
-	// preassignedTasks already have NodeID, need resource validation
-	preassignedTasks map[string]*api.Task
+	// pendingPreassignedTasks already have NodeID, need resource validation
+	pendingPreassignedTasks map[string]*api.Task
+	// preassignedTasks tracks tasks that were preassigned, including those
+	// past the pending state.
+	preassignedTasks map[string]struct{}
 	nodeSet          nodeSet
 	allTasks         map[string]*api.Task
 	pipeline         *Pipeline
@@ -45,13 +49,14 @@ type Scheduler struct {
 // New creates a new scheduler.
 func New(store *store.MemoryStore) *Scheduler {
 	return &Scheduler{
-		store:            store,
-		unassignedTasks:  make(map[string]*api.Task),
-		preassignedTasks: make(map[string]*api.Task),
-		allTasks:         make(map[string]*api.Task),
-		stopChan:         make(chan struct{}),
-		doneChan:         make(chan struct{}),
-		pipeline:         NewPipeline(),
+		store:                   store,
+		unassignedTasks:         make(map[string]*api.Task),
+		pendingPreassignedTasks: make(map[string]*api.Task),
+		preassignedTasks:        make(map[string]struct{}),
+		allTasks:                make(map[string]*api.Task),
+		stopChan:                make(chan struct{}),
+		doneChan:                make(chan struct{}),
+		pipeline:                NewPipeline(),
 	}
 }
 
@@ -76,7 +81,8 @@ func (s *Scheduler) setupTasksList(tx store.ReadTx) error {
 		}
 		// preassigned tasks need to validate resource requirement on corresponding node
 		if t.Status.State == api.TaskStatePending {
-			s.preassignedTasks[t.ID] = t
+			s.preassignedTasks[t.ID] = struct{}{}
+			s.pendingPreassignedTasks[t.ID] = t
 			continue
 		}
 
@@ -128,7 +134,7 @@ func (s *Scheduler) Run(ctx context.Context) error {
 	tickRequired := false
 
 	schedule := func() {
-		if len(s.preassignedTasks) > 0 {
+		if len(s.pendingPreassignedTasks) > 0 {
 			s.processPreassignedTasks(ctx)
 		}
 		if tickRequired {
@@ -151,7 +157,7 @@ func (s *Scheduler) Run(ctx context.Context) error {
 					tickRequired = true
 				}
 			case api.EventDeleteTask:
-				if s.deleteTask(ctx, v.Task) {
+				if s.deleteTask(v.Task) {
 					// deleting tasks may free up node resource, pending tasks should be re-evaluated.
 					tickRequired = true
 				}
@@ -215,7 +221,8 @@ func (s *Scheduler) createTask(ctx context.Context, t *api.Task) bool {
 	}
 
 	if t.Status.State == api.TaskStatePending {
-		s.preassignedTasks[t.ID] = t
+		s.preassignedTasks[t.ID] = struct{}{}
+		s.pendingPreassignedTasks[t.ID] = t
 		// preassigned tasks do not contribute to running tasks count
 		return false
 	}
@@ -243,22 +250,32 @@ func (s *Scheduler) updateTask(ctx context.Context, t *api.Task) bool {
 		if oldTask == nil {
 			return false
 		}
-		s.deleteTask(ctx, oldTask)
+
 		if t.Status.State != oldTask.Status.State &&
 			(t.Status.State == api.TaskStateFailed || t.Status.State == api.TaskStateRejected) {
-			nodeInfo, err := s.nodeSet.nodeInfo(t.NodeID)
-			if err == nil {
-				nodeInfo.taskFailed(ctx, t.ServiceID)
-				s.nodeSet.updateNode(nodeInfo)
+			// Keep track of task failures, so other nodes can be preferred
+			// for scheduling this service if it looks like the service is
+			// failing in a loop on this node. However, skip this for
+			// preassigned tasks, because the scheduler does not choose
+			// which nodes those run on.
+			if _, wasPreassigned := s.preassignedTasks[t.ID]; !wasPreassigned {
+				nodeInfo, err := s.nodeSet.nodeInfo(t.NodeID)
+				if err == nil {
+					nodeInfo.taskFailed(ctx, t.ServiceID)
+					s.nodeSet.updateNode(nodeInfo)
+				}
 			}
 		}
+
+		s.deleteTask(oldTask)
+
 		return true
 	}
 
 	if t.NodeID == "" {
 		// unassigned task
 		if oldTask != nil {
-			s.deleteTask(ctx, oldTask)
+			s.deleteTask(oldTask)
 		}
 		s.allTasks[t.ID] = t
 		s.enqueue(t)
@@ -267,10 +284,11 @@ func (s *Scheduler) updateTask(ctx context.Context, t *api.Task) bool {
 
 	if t.Status.State == api.TaskStatePending {
 		if oldTask != nil {
-			s.deleteTask(ctx, oldTask)
+			s.deleteTask(oldTask)
 		}
+		s.preassignedTasks[t.ID] = struct{}{}
 		s.allTasks[t.ID] = t
-		s.preassignedTasks[t.ID] = t
+		s.pendingPreassignedTasks[t.ID] = t
 		// preassigned tasks do not contribute to running tasks count
 		return false
 	}
@@ -284,9 +302,10 @@ func (s *Scheduler) updateTask(ctx context.Context, t *api.Task) bool {
 	return false
 }
 
-func (s *Scheduler) deleteTask(ctx context.Context, t *api.Task) bool {
+func (s *Scheduler) deleteTask(t *api.Task) bool {
 	delete(s.allTasks, t.ID)
 	delete(s.preassignedTasks, t.ID)
+	delete(s.pendingPreassignedTasks, t.ID)
 	nodeInfo, err := s.nodeSet.nodeInfo(t.NodeID)
 	if err == nil && nodeInfo.removeTask(t) {
 		s.nodeSet.updateNode(nodeInfo)
@@ -296,25 +315,38 @@ func (s *Scheduler) deleteTask(ctx context.Context, t *api.Task) bool {
 }
 
 func (s *Scheduler) createOrUpdateNode(n *api.Node) {
-	nodeInfo, _ := s.nodeSet.nodeInfo(n.ID)
-	var resources api.Resources
+	nodeInfo, nodeInfoErr := s.nodeSet.nodeInfo(n.ID)
+	var resources *api.Resources
 	if n.Description != nil && n.Description.Resources != nil {
-		resources = *n.Description.Resources
+		resources = n.Description.Resources.Copy()
 		// reconcile resources by looping over all tasks in this node
-		for _, task := range nodeInfo.Tasks {
-			reservations := taskReservations(task.Spec)
-			resources.MemoryBytes -= reservations.MemoryBytes
-			resources.NanoCPUs -= reservations.NanoCPUs
+		if nodeInfoErr == nil {
+			for _, task := range nodeInfo.Tasks {
+				reservations := taskReservations(task.Spec)
+
+				resources.MemoryBytes -= reservations.MemoryBytes
+				resources.NanoCPUs -= reservations.NanoCPUs
+
+				genericresource.ConsumeNodeResources(&resources.Generic,
+					task.AssignedGenericResources)
+			}
 		}
+	} else {
+		resources = &api.Resources{}
+	}
+
+	if nodeInfoErr != nil {
+		nodeInfo = newNodeInfo(n, nil, *resources)
+	} else {
+		nodeInfo.Node = n
+		nodeInfo.AvailableResources = resources
 	}
-	nodeInfo.Node = n
-	nodeInfo.AvailableResources = resources
 	s.nodeSet.addOrUpdateNode(nodeInfo)
 }
 
 func (s *Scheduler) processPreassignedTasks(ctx context.Context) {
-	schedulingDecisions := make(map[string]schedulingDecision, len(s.preassignedTasks))
-	for _, t := range s.preassignedTasks {
+	schedulingDecisions := make(map[string]schedulingDecision, len(s.pendingPreassignedTasks))
+	for _, t := range s.pendingPreassignedTasks {
 		newT := s.taskFitNode(ctx, t, t.NodeID)
 		if newT == nil {
 			continue
@@ -326,7 +358,7 @@ func (s *Scheduler) processPreassignedTasks(ctx context.Context) {
 
 	for _, decision := range successful {
 		if decision.new.Status.State == api.TaskStateAssigned {
-			delete(s.preassignedTasks, decision.old.ID)
+			delete(s.pendingPreassignedTasks, decision.old.ID)
 		}
 	}
 	for _, decision := range failed {
@@ -414,12 +446,7 @@ func (s *Scheduler) applySchedulingDecisions(ctx context.Context, schedulingDeci
 					t := store.GetTask(tx, taskID)
 					if t == nil {
 						// Task no longer exists
-						nodeInfo, err := s.nodeSet.nodeInfo(decision.new.NodeID)
-						if err == nil && nodeInfo.removeTask(decision.new) {
-							s.nodeSet.updateNode(nodeInfo)
-						}
-						delete(s.allTasks, decision.old.ID)
-
+						s.deleteTask(decision.new)
 						continue
 					}
 
diff --git a/components/engine/vendor/github.com/docker/swarmkit/manager/state/raft/raft.go b/components/engine/vendor/github.com/docker/swarmkit/manager/state/raft/raft.go
index 82a550d0f6..b793374095 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/manager/state/raft/raft.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/manager/state/raft/raft.go
@@ -361,7 +361,7 @@ func (n *Node) JoinAndStart(ctx context.Context) (err error) {
 		if err != nil {
 			n.stopMu.Lock()
 			// to shutdown transport
-			close(n.stopped)
+			n.cancelFunc()
 			n.stopMu.Unlock()
 			n.done()
 		} else {
diff --git a/components/engine/vendor/github.com/docker/swarmkit/node/node.go b/components/engine/vendor/github.com/docker/swarmkit/node/node.go
index 6a40a06e16..29badd06ed 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/node/node.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/node/node.go
@@ -10,6 +10,7 @@ import (
 	"path/filepath"
 	"reflect"
 	"sort"
+	"strings"
 	"sync"
 	"time"
 
@@ -33,6 +34,7 @@ import (
 	"github.com/pkg/errors"
 	"golang.org/x/net/context"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials"
 )
 
@@ -279,7 +281,7 @@ func (n *Node) run(ctx context.Context) (err error) {
 		return err
 	}
 
-	renewer := ca.NewTLSRenewer(securityConfig, n.connBroker)
+	renewer := ca.NewTLSRenewer(securityConfig, n.connBroker, paths.RootCA)
 
 	ctx = log.WithLogger(ctx, log.G(ctx).WithField("node.id", n.NodeID()))
 
@@ -344,14 +346,14 @@ func (n *Node) run(ctx context.Context) (err error) {
 						log.G(ctx).WithError(err).Error("invalid new root certificate from the dispatcher")
 						continue
 					}
-					if err := ca.SaveRootCA(newRootCA, paths.RootCA); err != nil {
-						log.G(ctx).WithError(err).Error("could not save new root certificate from the dispatcher")
-						continue
-					}
 					if err := securityConfig.UpdateRootCA(&newRootCA, newRootCA.Pool); err != nil {
 						log.G(ctx).WithError(err).Error("could not use new root CA from dispatcher")
 						continue
 					}
+					if err := ca.SaveRootCA(newRootCA, paths.RootCA); err != nil {
+						log.G(ctx).WithError(err).Error("could not save new root certificate from the dispatcher")
+						continue
+					}
 				}
 			}
 		}
@@ -432,10 +434,10 @@ func (n *Node) run(ctx context.Context) (err error) {
 	}()
 
 	wg.Wait()
-	if managerErr != nil && managerErr != context.Canceled {
+	if managerErr != nil && errors.Cause(managerErr) != context.Canceled {
 		return managerErr
 	}
-	if agentErr != nil && agentErr != context.Canceled {
+	if agentErr != nil && errors.Cause(agentErr) != context.Canceled {
 		return agentErr
 	}
 	return err
@@ -516,7 +518,7 @@ waitPeer:
 	rootCA := securityConfig.RootCA()
 	issuer := securityConfig.IssuerInfo()
 
-	a, err := agent.New(&agent.Config{
+	agentConfig := &agent.Config{
 		Hostname:         n.config.Hostname,
 		ConnBroker:       n.connBroker,
 		Executor:         n.config.Executor,
@@ -529,7 +531,14 @@ waitPeer:
 			CertIssuerPublicKey: issuer.PublicKey,
 			CertIssuerSubject:   issuer.Subject,
 		},
-	})
+	}
+	// if a join address has been specified, then if the agent fails to connect due to a TLS error, fail fast - don't
+	// keep re-trying to join
+	if n.config.JoinAddr != "" {
+		agentConfig.SessionTracker = &firstSessionErrorTracker{}
+	}
+
+	a, err := agent.New(agentConfig)
 	if err != nil {
 		return err
 	}
@@ -1055,3 +1064,37 @@ func (sp sortablePeers) Less(i, j int) bool { return sp[i].NodeID < sp[j].NodeID
 func (sp sortablePeers) Len() int { return len(sp) }
 
 func (sp sortablePeers) Swap(i, j int) { sp[i], sp[j] = sp[j], sp[i] }
+
+// firstSessionErrorTracker is a utility that helps determine whether the agent should exit after
+// a TLS failure on establishing the first session.  This should only happen if a join address
+// is specified.  If establishing the first session succeeds, but later on some session fails
+// because of a TLS error, we don't want to exit the agent because a previously successful
+// session indicates that the TLS error may be a transient issue.
+type firstSessionErrorTracker struct {
+	mu               sync.Mutex
+	pastFirstSession bool
+	err              error
+}
+
+func (fs *firstSessionErrorTracker) SessionEstablished() {
+	fs.mu.Lock()
+	fs.pastFirstSession = true
+	fs.mu.Unlock()
+}
+
+func (fs *firstSessionErrorTracker) SessionError(err error) {
+	fs.mu.Lock()
+	fs.err = err
+	fs.mu.Unlock()
+}
+
+func (fs *firstSessionErrorTracker) SessionClosed() error {
+	fs.mu.Lock()
+	defer fs.mu.Unlock()
+	// unfortunately grpc connection errors are type grpc.rpcError, which are not exposed, and we can't get at the underlying error type
+	if !fs.pastFirstSession && grpc.Code(fs.err) == codes.Internal &&
+		strings.HasPrefix(grpc.ErrorDesc(fs.err), "connection error") && strings.Contains(grpc.ErrorDesc(fs.err), "transport: x509:") {
+		return fs.err
+	}
+	return nil
+}
diff --git a/components/engine/vendor/github.com/docker/swarmkit/template/context.go b/components/engine/vendor/github.com/docker/swarmkit/template/context.go
index e3c3aab113..d26e155be4 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/template/context.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/template/context.go
@@ -3,13 +3,22 @@ package template
 import (
 	"bytes"
 	"fmt"
+	"strings"
+	"text/template"
 
+	"github.com/docker/swarmkit/agent/configs"
+	"github.com/docker/swarmkit/agent/exec"
+	"github.com/docker/swarmkit/agent/secrets"
 	"github.com/docker/swarmkit/api"
 	"github.com/docker/swarmkit/api/naming"
+	"github.com/pkg/errors"
 )
 
 // Context defines the strict set of values that can be injected into a
 // template expression in SwarmKit data structure.
+// NOTE: Be very careful adding any fields to this structure with types
+// that have methods defined on them. The template would be able to
+// invoke those methods.
 type Context struct {
 	Service struct {
 		ID     string
@@ -58,7 +67,118 @@ func NewContextFromTask(t *api.Task) (ctx Context) {
 // Expand treats the string s as a template and populates it with values from
 // the context.
 func (ctx *Context) Expand(s string) (string, error) {
-	tmpl, err := newTemplate(s)
+	tmpl, err := newTemplate(s, nil)
+	if err != nil {
+		return s, err
+	}
+
+	var buf bytes.Buffer
+	if err := tmpl.Execute(&buf, ctx); err != nil {
+		return s, err
+	}
+
+	return buf.String(), nil
+}
+
+// PayloadContext provides a context for expanding a config or secret payload.
+// NOTE: Be very careful adding any fields to this structure with types
+// that have methods defined on them. The template would be able to
+// invoke those methods.
+type PayloadContext struct {
+	Context
+
+	t                 *api.Task
+	restrictedSecrets exec.SecretGetter
+	restrictedConfigs exec.ConfigGetter
+}
+
+func (ctx PayloadContext) secretGetter(target string) (string, error) {
+	if ctx.restrictedSecrets == nil {
+		return "", errors.New("secrets unavailable")
+	}
+
+	container := ctx.t.Spec.GetContainer()
+	if container == nil {
+		return "", errors.New("task is not a container")
+	}
+
+	for _, secretRef := range container.Secrets {
+		file := secretRef.GetFile()
+		if file != nil && file.Name == target {
+			secret, err := ctx.restrictedSecrets.Get(secretRef.SecretID)
+			if err != nil {
+				return "", err
+			}
+			return string(secret.Spec.Data), nil
+		}
+	}
+
+	return "", errors.Errorf("secret target %s not found", target)
+}
+
+func (ctx PayloadContext) configGetter(target string) (string, error) {
+	if ctx.restrictedConfigs == nil {
+		return "", errors.New("configs unavailable")
+	}
+
+	container := ctx.t.Spec.GetContainer()
+	if container == nil {
+		return "", errors.New("task is not a container")
+	}
+
+	for _, configRef := range container.Configs {
+		file := configRef.GetFile()
+		if file != nil && file.Name == target {
+			config, err := ctx.restrictedConfigs.Get(configRef.ConfigID)
+			if err != nil {
+				return "", err
+			}
+			return string(config.Spec.Data), nil
+		}
+	}
+
+	return "", errors.Errorf("config target %s not found", target)
+}
+
+func (ctx PayloadContext) envGetter(variable string) (string, error) {
+	container := ctx.t.Spec.GetContainer()
+	if container == nil {
+		return "", errors.New("task is not a container")
+	}
+
+	for _, env := range container.Env {
+		parts := strings.SplitN(env, "=", 2)
+
+		if len(parts) > 1 && parts[0] == variable {
+			return parts[1], nil
+		}
+	}
+	return "", nil
+}
+
+// NewPayloadContextFromTask returns a new template context from the data
+// available in the task. This context also provides access to the configs
+// and secrets that the task has access to. The provided context can then
+// be used to populate runtime values in a templated config or secret.
+func NewPayloadContextFromTask(t *api.Task, dependencies exec.DependencyGetter) (ctx PayloadContext) {
+	return PayloadContext{
+		Context:           NewContextFromTask(t),
+		t:                 t,
+		restrictedSecrets: secrets.Restrict(dependencies.Secrets(), t),
+		restrictedConfigs: configs.Restrict(dependencies.Configs(), t),
+	}
+}
+
+// Expand treats the string s as a template and populates it with values from
+// the context.
+func (ctx *PayloadContext) Expand(s string) (string, error) {
+	funcMap := template.FuncMap{
+		"secret": ctx.secretGetter,
+		"config": ctx.configGetter,
+		"env":    ctx.envGetter,
+	}
+
+	tmpl, err := newTemplate(s, funcMap)
 	if err != nil {
 		return s, err
 	}
diff --git a/components/engine/vendor/github.com/docker/swarmkit/template/expand.go b/components/engine/vendor/github.com/docker/swarmkit/template/expand.go
index 75fbc09aee..e45c36252d 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/template/expand.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/template/expand.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/docker/swarmkit/agent/exec"
 	"github.com/docker/swarmkit/api"
 	"github.com/pkg/errors"
 )
@@ -116,3 +117,45 @@ func expandEnv(ctx Context, values []string) ([]string, error) {
 
 	return result, nil
 }
+
+func expandPayload(ctx PayloadContext, payload []byte) ([]byte, error) {
+	result, err := ctx.Expand(string(payload))
+	if err != nil {
+		return payload, err
+	}
+	return []byte(result), nil
+}
+
+// ExpandSecretSpec expands the template inside the secret payload, if any.
+// Templating is evaluated on the agent-side.
+func ExpandSecretSpec(s *api.Secret, t *api.Task, dependencies exec.DependencyGetter) (*api.SecretSpec, error) {
+	if s.Spec.Templating == nil {
+		return &s.Spec, nil
+	}
+	if s.Spec.Templating.Name == "golang" {
+		ctx := NewPayloadContextFromTask(t, dependencies)
+		secretSpec := s.Spec.Copy()
+
+		var err error
+		secretSpec.Data, err = expandPayload(ctx, secretSpec.Data)
+		return secretSpec, err
+	}
+	return &s.Spec, errors.New("unrecognized template type")
+}
+
+// ExpandConfigSpec expands the template inside the config payload, if any.
+// Templating is evaluated on the agent-side.
+func ExpandConfigSpec(c *api.Config, t *api.Task, dependencies exec.DependencyGetter) (*api.ConfigSpec, error) {
+	if c.Spec.Templating == nil {
+		return &c.Spec, nil
+	}
+	if c.Spec.Templating.Name == "golang" {
+		ctx := NewPayloadContextFromTask(t, dependencies)
+		configSpec := c.Spec.Copy()
+
+		var err error
+		configSpec.Data, err = expandPayload(ctx, configSpec.Data)
+		return configSpec, err
+	}
+	return &c.Spec, errors.New("unrecognized template type")
+}
diff --git a/components/engine/vendor/github.com/docker/swarmkit/template/getter.go b/components/engine/vendor/github.com/docker/swarmkit/template/getter.go
new file mode 100644
index 0000000000..f06c438c25
--- /dev/null
+++ b/components/engine/vendor/github.com/docker/swarmkit/template/getter.go
@@ -0,0 +1,98 @@
+package template
+
+import (
+	"github.com/docker/swarmkit/agent/exec"
+	"github.com/docker/swarmkit/api"
+	"github.com/pkg/errors"
+)
+
+type templatedSecretGetter struct {
+	dependencies exec.DependencyGetter
+	t            *api.Task
+}
+
+// NewTemplatedSecretGetter returns a SecretGetter that evaluates templates.
+func NewTemplatedSecretGetter(dependencies exec.DependencyGetter, t *api.Task) exec.SecretGetter {
+	return templatedSecretGetter{dependencies: dependencies, t: t}
+}
+
+func (t templatedSecretGetter) Get(secretID string) (*api.Secret, error) {
+	if t.dependencies == nil {
+		return nil, errors.New("no secret provider available")
+	}
+
+	secrets := t.dependencies.Secrets()
+	if secrets == nil {
+		return nil, errors.New("no secret provider available")
+	}
+
+	secret, err := secrets.Get(secretID)
+	if err != nil {
+		return secret, err
+	}
+
+	newSpec, err := ExpandSecretSpec(secret, t.t, t.dependencies)
+	if err != nil {
+		return secret, errors.Wrapf(err, "failed to expand templated secret %s", secretID)
+	}
+
+	secretCopy := *secret
+	secretCopy.Spec = *newSpec
+	return &secretCopy, nil
+}
+
+type templatedConfigGetter struct {
+	dependencies exec.DependencyGetter
+	t            *api.Task
+}
+
+// NewTemplatedConfigGetter returns a ConfigGetter that evaluates templates.
+func NewTemplatedConfigGetter(dependencies exec.DependencyGetter, t *api.Task) exec.ConfigGetter {
+	return templatedConfigGetter{dependencies: dependencies, t: t}
+}
+
+func (t templatedConfigGetter) Get(configID string) (*api.Config, error) {
+	if t.dependencies == nil {
+		return nil, errors.New("no config provider available")
+	}
+
+	configs := t.dependencies.Configs()
+	if configs == nil {
+		return nil, errors.New("no config provider available")
+	}
+
+	config, err := configs.Get(configID)
+	if err != nil {
+		return config, err
+	}
+
+	newSpec, err := ExpandConfigSpec(config, t.t, t.dependencies)
+	if err != nil {
+		return config, errors.Wrapf(err, "failed to expand templated config %s", configID)
+	}
+
+	configCopy := *config
+	configCopy.Spec = *newSpec
+	return &configCopy, nil
+}
+
+type templatedDependencyGetter struct {
+	secrets exec.SecretGetter
+	configs exec.ConfigGetter
+}
+
+// NewTemplatedDependencyGetter returns a DependencyGetter that evaluates templates.
+func NewTemplatedDependencyGetter(dependencies exec.DependencyGetter, t *api.Task) exec.DependencyGetter {
+	return templatedDependencyGetter{
+		secrets: NewTemplatedSecretGetter(dependencies, t),
+		configs: NewTemplatedConfigGetter(dependencies, t),
+	}
+}
+
+func (t templatedDependencyGetter) Secrets() exec.SecretGetter {
+	return t.secrets
+}
+
+func (t templatedDependencyGetter) Configs() exec.ConfigGetter {
+	return t.configs
+}
diff --git a/components/engine/vendor/github.com/docker/swarmkit/template/template.go b/components/engine/vendor/github.com/docker/swarmkit/template/template.go
index 9f1517c662..fc375b819c 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/template/template.go
+++ b/components/engine/vendor/github.com/docker/swarmkit/template/template.go
@@ -13,6 +13,10 @@ var funcMap = template.FuncMap{
 	},
 }
 
-func newTemplate(s string) (*template.Template, error) {
-	return template.New("expansion").Option("missingkey=error").Funcs(funcMap).Parse(s)
+func newTemplate(s string, extraFuncs template.FuncMap) (*template.Template, error) {
+	tmpl := template.New("expansion").Option("missingkey=error").Funcs(funcMap)
+	if len(extraFuncs) != 0 {
+		tmpl = tmpl.Funcs(extraFuncs)
+	}
+	return tmpl.Parse(s)
 }
diff --git a/components/engine/vendor/github.com/docker/swarmkit/vendor.conf b/components/engine/vendor/github.com/docker/swarmkit/vendor.conf
index 0fdffeb0d5..4f5d293b8b 100644
--- a/components/engine/vendor/github.com/docker/swarmkit/vendor.conf
+++ b/components/engine/vendor/github.com/docker/swarmkit/vendor.conf
@@ -1,8 +1,9 @@
 # grpc and protobuf
-google.golang.org/grpc v1.0.4
+google.golang.org/grpc v1.3.0
 github.com/gogo/protobuf v0.4
-github.com/golang/protobuf 8ee79997227bf9b34611aee7946ae64735e6fd93
+github.com/golang/protobuf 7a211bcf3bce0e3f1d74f9894916e6f116ae83b4
 github.com/matttproud/golang_protobuf_extensions v1.0.0
+google.golang.org/genproto d80a6e20e776b0b17a324d0ba1ab50a39c8e8944
 
 # metrics
 github.com/grpc-ecosystem/go-grpc-prometheus 6b7015e65d366bf3f19b2b2a000a831940f0f7e0
@@ -29,6 +30,14 @@ github.com/opencontainers/runc b6b70e53451794e8333e9b602cc096b47a20bd0f
 github.com/opencontainers/go-digest a6d0ee40d4207ea02364bd3b9e8e77b9159ba1eb
 github.com/opencontainers/image-spec f03dbe35d449c54915d235f1a3cf8f585a24babe
 
+# containerd executor
+github.com/containerd/containerd 7fc91b05917e93d474fab9465547d44eacd10ce3
+github.com/containerd/continuity f4ad4294c92f596c9241947c416d1297f9faf3ea
+github.com/containerd/fifo 69b99525e472735860a5269b75af1970142b3062
+github.com/opencontainers/runtime-spec v1.0.0-rc5
+github.com/nightlyone/lockfile 1d49c987357a327b5b03aa84cbddd582c328615d
+golang.org/x/sync 450f422ab23cf9881c94e2db30cac0eb1b7cf80c
+
 github.com/davecgh/go-spew 5215b55f46b2b919f50a1df0eaa5886afe4e3b3d
 github.com/Microsoft/go-winio f778f05015353be65d242f3fedc18695756153bb
 github.com/Sirupsen/logrus v0.11.0
@@ -50,7 +59,7 @@ github.com/spf13/cobra 8e91712f174ced10270cf66615e0a9127e7c4de5
 github.com/spf13/pflag 7f60f83a2c81bc3c3c0d5297f61ddfa68da9d3b7
 github.com/stretchr/testify v1.1.4
 golang.org/x/crypto 3fbbcd23f1cb824e69491a5930cfeff09b12f4d2
-golang.org/x/net c427ad74c6d7a814201695e9ffde0c5d400a7674
+golang.org/x/net 7dcfb8076726a3fdd9353b6b8a1f1b6be6811bd6
 golang.org/x/sys 5eaf0df67e70d6997a9fe0ed24383fa1b01638d3
 golang.org/x/text f72d8390a633d5dfb0cc84043294db9f6c935756
 golang.org/x/time a4bde12657593d5e90d0533a3e4fd95e635124cb
diff --git a/components/engine/vendor/github.com/golang/protobuf/README.md b/components/engine/vendor/github.com/golang/protobuf/README.md
index 037fc7c8e2..aa933d7884 100644
--- a/components/engine/vendor/github.com/golang/protobuf/README.md
+++ b/components/engine/vendor/github.com/golang/protobuf/README.md
@@ -22,7 +22,7 @@ To use this software, you must:
   for details or, if you are using gccgo, follow the instructions at
 	https://golang.org/doc/install/gccgo
 - Grab the code from the repository and install the proto package.
-  The simplest way is to run `go get -u github.com/golang/protobuf/{proto,protoc-gen-go}`.
+  The simplest way is to run `go get -u github.com/golang/protobuf/protoc-gen-go`.
   The compiler plugin, protoc-gen-go, will be installed in $GOBIN,
   defaulting to $GOPATH/bin.  It must be in your $PATH for the protocol
   compiler, protoc, to find it.
diff --git a/components/engine/vendor/github.com/golang/protobuf/protoc-gen-go/descriptor/descriptor.pb.go b/components/engine/vendor/github.com/golang/protobuf/protoc-gen-go/descriptor/descriptor.pb.go
index a1d8a764f2..63cf2c80aa 100644
--- a/components/engine/vendor/github.com/golang/protobuf/protoc-gen-go/descriptor/descriptor.pb.go
+++ b/components/engine/vendor/github.com/golang/protobuf/protoc-gen-go/descriptor/descriptor.pb.go
@@ -1,6 +1,5 @@
-// Code generated by protoc-gen-go.
+// Code generated by protoc-gen-go. DO NOT EDIT.
 // source: google/protobuf/descriptor.proto
-// DO NOT EDIT!
 
 /*
 Package descriptor is a generated protocol buffer package.
@@ -65,6 +64,10 @@ const (
 	FieldDescriptorProto_TYPE_FIXED32 FieldDescriptorProto_Type = 7
 	FieldDescriptorProto_TYPE_BOOL    FieldDescriptorProto_Type = 8
 	FieldDescriptorProto_TYPE_STRING  FieldDescriptorProto_Type = 9
+	// Tag-delimited aggregate.
+	// Group type is deprecated and not supported in proto3. However, Proto3
+	// implementations should still be able to parse the group wire format and
+	// treat group fields as unknown fields.
 	FieldDescriptorProto_TYPE_GROUP   FieldDescriptorProto_Type = 10
 	FieldDescriptorProto_TYPE_MESSAGE FieldDescriptorProto_Type = 11
 	// New in version 2.
@@ -293,6 +296,48 @@ func (x *FieldOptions_JSType) UnmarshalJSON(data []byte) error {
 }
 func (FieldOptions_JSType) EnumDescriptor() ([]byte, []int) { return fileDescriptor0, []int{11, 1} }
 
+// Is this method side-effect-free (or safe in HTTP parlance), or idempotent,
+// or neither? HTTP based RPC implementation may choose GET verb for safe
+// methods, and PUT verb for idempotent methods instead of the default POST.
+type MethodOptions_IdempotencyLevel int32
+
+const (
+	MethodOptions_IDEMPOTENCY_UNKNOWN MethodOptions_IdempotencyLevel = 0
+	MethodOptions_NO_SIDE_EFFECTS     MethodOptions_IdempotencyLevel = 1
+	MethodOptions_IDEMPOTENT          MethodOptions_IdempotencyLevel = 2
+)
+
+var MethodOptions_IdempotencyLevel_name = map[int32]string{
+	0: "IDEMPOTENCY_UNKNOWN",
+	1: "NO_SIDE_EFFECTS",
+	2: "IDEMPOTENT",
+}
+var MethodOptions_IdempotencyLevel_value = map[string]int32{
+	"IDEMPOTENCY_UNKNOWN": 0,
+	"NO_SIDE_EFFECTS":     1,
+	"IDEMPOTENT":          2,
+}
+
+func (x MethodOptions_IdempotencyLevel) Enum() *MethodOptions_IdempotencyLevel {
+	p := new(MethodOptions_IdempotencyLevel)
+	*p = x
+	return p
+}
+func (x MethodOptions_IdempotencyLevel) String() string {
+	return proto.EnumName(MethodOptions_IdempotencyLevel_name, int32(x))
+}
+func (x *MethodOptions_IdempotencyLevel) UnmarshalJSON(data []byte) error {
+	value, err := proto.UnmarshalJSONEnum(MethodOptions_IdempotencyLevel_value, data, "MethodOptions_IdempotencyLevel")
+	if err != nil {
+		return err
+	}
+	*x = MethodOptions_IdempotencyLevel(value)
+	return nil
+}
+func (MethodOptions_IdempotencyLevel) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptor0, []int{16, 0}
+}
+
 // The protocol compiler can output a FileDescriptorSet containing the .proto
 // files it parses.
 type FileDescriptorSet struct {
@@ -942,6 +987,14 @@ type FileOptions struct {
 	ObjcClassPrefix *string `protobuf:"bytes,36,opt,name=objc_class_prefix,json=objcClassPrefix" json:"objc_class_prefix,omitempty"`
 	// Namespace for generated classes; defaults to the package.
 	CsharpNamespace *string `protobuf:"bytes,37,opt,name=csharp_namespace,json=csharpNamespace" json:"csharp_namespace,omitempty"`
+	// By default Swift generators will take the proto package and CamelCase it
+	// replacing '.' with underscore and use that to prefix the types/symbols
+	// defined. When this options is provided, they will use this value instead
+	// to prefix the types/symbols defined.
+	SwiftPrefix *string `protobuf:"bytes,39,opt,name=swift_prefix,json=swiftPrefix" json:"swift_prefix,omitempty"`
+	// Sets the php class prefix which is prepended to all php generated classes
+	// from this .proto. Default is empty.
+	PhpClassPrefix *string `protobuf:"bytes,40,opt,name=php_class_prefix,json=phpClassPrefix" json:"php_class_prefix,omitempty"`
 	// The parser stores options it doesn't recognize here. See above.
 	UninterpretedOption          []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
 	proto.XXX_InternalExtensions `json:"-"`
@@ -1068,6 +1121,20 @@ func (m *FileOptions) GetCsharpNamespace() string {
 	return ""
 }
 
+func (m *FileOptions) GetSwiftPrefix() string {
+	if m != nil && m.SwiftPrefix != nil {
+		return *m.SwiftPrefix
+	}
+	return ""
+}
+
+func (m *FileOptions) GetPhpClassPrefix() string {
+	if m != nil && m.PhpClassPrefix != nil {
+		return *m.PhpClassPrefix
+	}
+	return ""
+}
+
 func (m *FileOptions) GetUninterpretedOption() []*UninterpretedOption {
 	if m != nil {
 		return m.UninterpretedOption
@@ -1481,7 +1548,8 @@ type MethodOptions struct {
 	// Depending on the target platform, this can emit Deprecated annotations
 	// for the method, or it will be completely ignored; in the very least,
 	// this is a formalization for deprecating methods.
-	Deprecated *bool `protobuf:"varint,33,opt,name=deprecated,def=0" json:"deprecated,omitempty"`
+	Deprecated       *bool                           `protobuf:"varint,33,opt,name=deprecated,def=0" json:"deprecated,omitempty"`
+	IdempotencyLevel *MethodOptions_IdempotencyLevel `protobuf:"varint,34,opt,name=idempotency_level,json=idempotencyLevel,enum=google.protobuf.MethodOptions_IdempotencyLevel,def=0" json:"idempotency_level,omitempty"`
 	// The parser stores options it doesn't recognize here. See above.
 	UninterpretedOption          []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
 	proto.XXX_InternalExtensions `json:"-"`
@@ -1502,6 +1570,7 @@ func (*MethodOptions) ExtensionRangeArray() []proto.ExtensionRange {
 }
 
 const Default_MethodOptions_Deprecated bool = false
+const Default_MethodOptions_IdempotencyLevel MethodOptions_IdempotencyLevel = MethodOptions_IDEMPOTENCY_UNKNOWN
 
 func (m *MethodOptions) GetDeprecated() bool {
 	if m != nil && m.Deprecated != nil {
@@ -1510,6 +1579,13 @@ func (m *MethodOptions) GetDeprecated() bool {
 	return Default_MethodOptions_Deprecated
 }
 
+func (m *MethodOptions) GetIdempotencyLevel() MethodOptions_IdempotencyLevel {
+	if m != nil && m.IdempotencyLevel != nil {
+		return *m.IdempotencyLevel
+	}
+	return Default_MethodOptions_IdempotencyLevel
+}
+
 func (m *MethodOptions) GetUninterpretedOption() []*UninterpretedOption {
 	if m != nil {
 		return m.UninterpretedOption
@@ -1912,154 +1988,165 @@ func init() {
 	proto.RegisterEnum("google.protobuf.FileOptions_OptimizeMode", FileOptions_OptimizeMode_name, FileOptions_OptimizeMode_value)
 	proto.RegisterEnum("google.protobuf.FieldOptions_CType", FieldOptions_CType_name, FieldOptions_CType_value)
 	proto.RegisterEnum("google.protobuf.FieldOptions_JSType", FieldOptions_JSType_name, FieldOptions_JSType_value)
+	proto.RegisterEnum("google.protobuf.MethodOptions_IdempotencyLevel", MethodOptions_IdempotencyLevel_name, MethodOptions_IdempotencyLevel_value)
 }
 
 func init() { proto.RegisterFile("google/protobuf/descriptor.proto", fileDescriptor0) }
 
 var fileDescriptor0 = []byte{
-	// 2295 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xcc, 0x59, 0x4f, 0x6f, 0x1b, 0xc7,
-	0x15, 0xcf, 0xf2, 0x9f, 0xc8, 0x47, 0x8a, 0x1a, 0x8d, 0x14, 0x67, 0xad, 0xfc, 0xb1, 0xcc, 0xd8,
-	0xb1, 0x6c, 0xb7, 0x74, 0x20, 0xff, 0x89, 0xa3, 0x14, 0x29, 0x28, 0x71, 0xad, 0xd0, 0x90, 0x44,
-	0x76, 0x29, 0xb5, 0x4e, 0x2e, 0x8b, 0xd1, 0xee, 0x90, 0x5a, 0x7b, 0x39, 0xbb, 0xdd, 0x5d, 0xda,
-	0x56, 0x4e, 0x06, 0x7a, 0xea, 0xa5, 0xe7, 0xa2, 0x2d, 0x7a, 0xc8, 0x25, 0x40, 0x3f, 0x40, 0x0f,
-	0xfd, 0x0a, 0x05, 0x0a, 0xf4, 0x2b, 0x14, 0x05, 0xda, 0x6f, 0xd0, 0x6b, 0x31, 0x33, 0xbb, 0xcb,
-	0x5d, 0xfe, 0x89, 0xd5, 0x00, 0x49, 0x7a, 0x12, 0xe7, 0xf7, 0x7e, 0xef, 0xcd, 0x9b, 0x37, 0x6f,
-	0xde, 0xbc, 0x1d, 0xc1, 0xe6, 0xd0, 0x75, 0x87, 0x0e, 0xbd, 0xe3, 0xf9, 0x6e, 0xe8, 0x9e, 0x8e,
-	0x07, 0x77, 0x2c, 0x1a, 0x98, 0xbe, 0xed, 0x85, 0xae, 0xdf, 0x14, 0x18, 0x5e, 0x91, 0x8c, 0x66,
-	0xcc, 0x68, 0x1c, 0xc2, 0xea, 0x23, 0xdb, 0xa1, 0xed, 0x84, 0xd8, 0xa7, 0x21, 0x7e, 0x08, 0x85,
-	0x81, 0xed, 0x50, 0x55, 0xd9, 0xcc, 0x6f, 0x55, 0xb7, 0xaf, 0x35, 0xa7, 0x94, 0x9a, 0x59, 0x8d,
-	0x1e, 0x87, 0x75, 0xa1, 0xd1, 0xf8, 0x67, 0x01, 0xd6, 0xe6, 0x48, 0x31, 0x86, 0x02, 0x23, 0x23,
-	0x6e, 0x51, 0xd9, 0xaa, 0xe8, 0xe2, 0x37, 0x56, 0x61, 0xc9, 0x23, 0xe6, 0x33, 0x32, 0xa4, 0x6a,
-	0x4e, 0xc0, 0xf1, 0x10, 0xbf, 0x07, 0x60, 0x51, 0x8f, 0x32, 0x8b, 0x32, 0xf3, 0x5c, 0xcd, 0x6f,
-	0xe6, 0xb7, 0x2a, 0x7a, 0x0a, 0xc1, 0xb7, 0x61, 0xd5, 0x1b, 0x9f, 0x3a, 0xb6, 0x69, 0xa4, 0x68,
-	0xb0, 0x99, 0xdf, 0x2a, 0xea, 0x48, 0x0a, 0xda, 0x13, 0xf2, 0x0d, 0x58, 0x79, 0x41, 0xc9, 0xb3,
-	0x34, 0xb5, 0x2a, 0xa8, 0x75, 0x0e, 0xa7, 0x88, 0x7b, 0x50, 0x1b, 0xd1, 0x20, 0x20, 0x43, 0x6a,
-	0x84, 0xe7, 0x1e, 0x55, 0x0b, 0x62, 0xf5, 0x9b, 0x33, 0xab, 0x9f, 0x5e, 0x79, 0x35, 0xd2, 0x3a,
-	0x3e, 0xf7, 0x28, 0x6e, 0x41, 0x85, 0xb2, 0xf1, 0x48, 0x5a, 0x28, 0x2e, 0x88, 0x9f, 0xc6, 0xc6,
-	0xa3, 0x69, 0x2b, 0x65, 0xae, 0x16, 0x99, 0x58, 0x0a, 0xa8, 0xff, 0xdc, 0x36, 0xa9, 0x5a, 0x12,
-	0x06, 0x6e, 0xcc, 0x18, 0xe8, 0x4b, 0xf9, 0xb4, 0x8d, 0x58, 0x0f, 0xef, 0x41, 0x85, 0xbe, 0x0c,
-	0x29, 0x0b, 0x6c, 0x97, 0xa9, 0x4b, 0xc2, 0xc8, 0xf5, 0x39, 0xbb, 0x48, 0x1d, 0x6b, 0xda, 0xc4,
-	0x44, 0x0f, 0x3f, 0x80, 0x25, 0xd7, 0x0b, 0x6d, 0x97, 0x05, 0x6a, 0x79, 0x53, 0xd9, 0xaa, 0x6e,
-	0xbf, 0x33, 0x37, 0x11, 0xba, 0x92, 0xa3, 0xc7, 0x64, 0xdc, 0x01, 0x14, 0xb8, 0x63, 0xdf, 0xa4,
-	0x86, 0xe9, 0x5a, 0xd4, 0xb0, 0xd9, 0xc0, 0x55, 0x2b, 0xc2, 0xc0, 0x95, 0xd9, 0x85, 0x08, 0xe2,
-	0x9e, 0x6b, 0xd1, 0x0e, 0x1b, 0xb8, 0x7a, 0x3d, 0xc8, 0x8c, 0xf1, 0x25, 0x28, 0x05, 0xe7, 0x2c,
-	0x24, 0x2f, 0xd5, 0x9a, 0xc8, 0x90, 0x68, 0xd4, 0xf8, 0x4f, 0x11, 0x56, 0x2e, 0x92, 0x62, 0x9f,
-	0x40, 0x71, 0xc0, 0x57, 0xa9, 0xe6, 0xfe, 0x97, 0x18, 0x48, 0x9d, 0x6c, 0x10, 0x4b, 0xdf, 0x32,
-	0x88, 0x2d, 0xa8, 0x32, 0x1a, 0x84, 0xd4, 0x92, 0x19, 0x91, 0xbf, 0x60, 0x4e, 0x81, 0x54, 0x9a,
-	0x4d, 0xa9, 0xc2, 0xb7, 0x4a, 0xa9, 0x27, 0xb0, 0x92, 0xb8, 0x64, 0xf8, 0x84, 0x0d, 0xe3, 0xdc,
-	0xbc, 0xf3, 0x3a, 0x4f, 0x9a, 0x5a, 0xac, 0xa7, 0x73, 0x35, 0xbd, 0x4e, 0x33, 0x63, 0xdc, 0x06,
-	0x70, 0x19, 0x75, 0x07, 0x86, 0x45, 0x4d, 0x47, 0x2d, 0x2f, 0x88, 0x52, 0x97, 0x53, 0x66, 0xa2,
-	0xe4, 0x4a, 0xd4, 0x74, 0xf0, 0xc7, 0x93, 0x54, 0x5b, 0x5a, 0x90, 0x29, 0x87, 0xf2, 0x90, 0xcd,
-	0x64, 0xdb, 0x09, 0xd4, 0x7d, 0xca, 0xf3, 0x9e, 0x5a, 0xd1, 0xca, 0x2a, 0xc2, 0x89, 0xe6, 0x6b,
-	0x57, 0xa6, 0x47, 0x6a, 0x72, 0x61, 0xcb, 0x7e, 0x7a, 0x88, 0xdf, 0x87, 0x04, 0x30, 0x44, 0x5a,
-	0x81, 0xa8, 0x42, 0xb5, 0x18, 0x3c, 0x22, 0x23, 0xba, 0xf1, 0x10, 0xea, 0xd9, 0xf0, 0xe0, 0x75,
-	0x28, 0x06, 0x21, 0xf1, 0x43, 0x91, 0x85, 0x45, 0x5d, 0x0e, 0x30, 0x82, 0x3c, 0x65, 0x96, 0xa8,
-	0x72, 0x45, 0x9d, 0xff, 0xdc, 0xf8, 0x08, 0x96, 0x33, 0xd3, 0x5f, 0x54, 0xb1, 0xf1, 0xdb, 0x12,
-	0xac, 0xcf, 0xcb, 0xb9, 0xb9, 0xe9, 0x7f, 0x09, 0x4a, 0x6c, 0x3c, 0x3a, 0xa5, 0xbe, 0x9a, 0x17,
-	0x16, 0xa2, 0x11, 0x6e, 0x41, 0xd1, 0x21, 0xa7, 0xd4, 0x51, 0x0b, 0x9b, 0xca, 0x56, 0x7d, 0xfb,
-	0xf6, 0x85, 0xb2, 0xba, 0x79, 0xc0, 0x55, 0x74, 0xa9, 0x89, 0x3f, 0x85, 0x42, 0x54, 0xe2, 0xb8,
-	0x85, 0x5b, 0x17, 0xb3, 0xc0, 0x73, 0x51, 0x17, 0x7a, 0xf8, 0x6d, 0xa8, 0xf0, 0xbf, 0x32, 0xb6,
-	0x25, 0xe1, 0x73, 0x99, 0x03, 0x3c, 0xae, 0x78, 0x03, 0xca, 0x22, 0xcd, 0x2c, 0x1a, 0x5f, 0x0d,
-	0xc9, 0x98, 0x6f, 0x8c, 0x45, 0x07, 0x64, 0xec, 0x84, 0xc6, 0x73, 0xe2, 0x8c, 0xa9, 0x48, 0x98,
-	0x8a, 0x5e, 0x8b, 0xc0, 0x9f, 0x73, 0x0c, 0x5f, 0x81, 0xaa, 0xcc, 0x4a, 0x9b, 0x59, 0xf4, 0xa5,
-	0xa8, 0x3e, 0x45, 0x5d, 0x26, 0x6a, 0x87, 0x23, 0x7c, 0xfa, 0xa7, 0x81, 0xcb, 0xe2, 0xad, 0x15,
-	0x53, 0x70, 0x40, 0x4c, 0xff, 0xd1, 0x74, 0xe1, 0x7b, 0x77, 0xfe, 0xf2, 0xa6, 0x73, 0xb1, 0xf1,
-	0xe7, 0x1c, 0x14, 0xc4, 0x79, 0x5b, 0x81, 0xea, 0xf1, 0xe7, 0x3d, 0xcd, 0x68, 0x77, 0x4f, 0x76,
-	0x0f, 0x34, 0xa4, 0xe0, 0x3a, 0x80, 0x00, 0x1e, 0x1d, 0x74, 0x5b, 0xc7, 0x28, 0x97, 0x8c, 0x3b,
-	0x47, 0xc7, 0x0f, 0xee, 0xa1, 0x7c, 0xa2, 0x70, 0x22, 0x81, 0x42, 0x9a, 0x70, 0x77, 0x1b, 0x15,
-	0x31, 0x82, 0x9a, 0x34, 0xd0, 0x79, 0xa2, 0xb5, 0x1f, 0xdc, 0x43, 0xa5, 0x2c, 0x72, 0x77, 0x1b,
-	0x2d, 0xe1, 0x65, 0xa8, 0x08, 0x64, 0xb7, 0xdb, 0x3d, 0x40, 0xe5, 0xc4, 0x66, 0xff, 0x58, 0xef,
-	0x1c, 0xed, 0xa3, 0x4a, 0x62, 0x73, 0x5f, 0xef, 0x9e, 0xf4, 0x10, 0x24, 0x16, 0x0e, 0xb5, 0x7e,
-	0xbf, 0xb5, 0xaf, 0xa1, 0x6a, 0xc2, 0xd8, 0xfd, 0xfc, 0x58, 0xeb, 0xa3, 0x5a, 0xc6, 0xad, 0xbb,
-	0xdb, 0x68, 0x39, 0x99, 0x42, 0x3b, 0x3a, 0x39, 0x44, 0x75, 0xbc, 0x0a, 0xcb, 0x72, 0x8a, 0xd8,
-	0x89, 0x95, 0x29, 0xe8, 0xc1, 0x3d, 0x84, 0x26, 0x8e, 0x48, 0x2b, 0xab, 0x19, 0xe0, 0xc1, 0x3d,
-	0x84, 0x1b, 0x7b, 0x50, 0x14, 0xd9, 0x85, 0x31, 0xd4, 0x0f, 0x5a, 0xbb, 0xda, 0x81, 0xd1, 0xed,
-	0x1d, 0x77, 0xba, 0x47, 0xad, 0x03, 0xa4, 0x4c, 0x30, 0x5d, 0xfb, 0xd9, 0x49, 0x47, 0xd7, 0xda,
-	0x28, 0x97, 0xc6, 0x7a, 0x5a, 0xeb, 0x58, 0x6b, 0xa3, 0x7c, 0xc3, 0x84, 0xf5, 0x79, 0x75, 0x66,
-	0xee, 0xc9, 0x48, 0x6d, 0x71, 0x6e, 0xc1, 0x16, 0x0b, 0x5b, 0x33, 0x5b, 0xfc, 0x95, 0x02, 0x6b,
-	0x73, 0x6a, 0xed, 0xdc, 0x49, 0x7e, 0x0a, 0x45, 0x99, 0xa2, 0xf2, 0xf6, 0xb9, 0x39, 0xb7, 0x68,
-	0x8b, 0x84, 0x9d, 0xb9, 0x81, 0x84, 0x5e, 0xfa, 0x06, 0xce, 0x2f, 0xb8, 0x81, 0xb9, 0x89, 0x19,
-	0x27, 0x7f, 0xa5, 0x80, 0xba, 0xc8, 0xf6, 0x6b, 0x0a, 0x45, 0x2e, 0x53, 0x28, 0x3e, 0x99, 0x76,
-	0xe0, 0xea, 0xe2, 0x35, 0xcc, 0x78, 0xf1, 0xb5, 0x02, 0x97, 0xe6, 0x37, 0x2a, 0x73, 0x7d, 0xf8,
-	0x14, 0x4a, 0x23, 0x1a, 0x9e, 0xb9, 0xf1, 0x65, 0xfd, 0xc1, 0x9c, 0x2b, 0x80, 0x8b, 0xa7, 0x63,
-	0x15, 0x69, 0xa5, 0xef, 0x90, 0xfc, 0xa2, 0x6e, 0x43, 0x7a, 0x33, 0xe3, 0xe9, 0xaf, 0x73, 0xf0,
-	0xe6, 0x5c, 0xe3, 0x73, 0x1d, 0x7d, 0x17, 0xc0, 0x66, 0xde, 0x38, 0x94, 0x17, 0xb2, 0xac, 0x4f,
-	0x15, 0x81, 0x88, 0xb3, 0xcf, 0x6b, 0xcf, 0x38, 0x4c, 0xe4, 0x79, 0x21, 0x07, 0x09, 0x09, 0xc2,
-	0xc3, 0x89, 0xa3, 0x05, 0xe1, 0xe8, 0x7b, 0x0b, 0x56, 0x3a, 0x73, 0xd7, 0x7d, 0x08, 0xc8, 0x74,
-	0x6c, 0xca, 0x42, 0x23, 0x08, 0x7d, 0x4a, 0x46, 0x36, 0x1b, 0x8a, 0x02, 0x5c, 0xde, 0x29, 0x0e,
-	0x88, 0x13, 0x50, 0x7d, 0x45, 0x8a, 0xfb, 0xb1, 0x94, 0x6b, 0x88, 0x5b, 0xc6, 0x4f, 0x69, 0x94,
-	0x32, 0x1a, 0x52, 0x9c, 0x68, 0x34, 0x7e, 0xb3, 0x04, 0xd5, 0x54, 0x5b, 0x87, 0xaf, 0x42, 0xed,
-	0x29, 0x79, 0x4e, 0x8c, 0xb8, 0x55, 0x97, 0x91, 0xa8, 0x72, 0xac, 0x17, 0xb5, 0xeb, 0x1f, 0xc2,
-	0xba, 0xa0, 0xb8, 0xe3, 0x90, 0xfa, 0x86, 0xe9, 0x90, 0x20, 0x10, 0x41, 0x2b, 0x0b, 0x2a, 0xe6,
-	0xb2, 0x2e, 0x17, 0xed, 0xc5, 0x12, 0x7c, 0x1f, 0xd6, 0x84, 0xc6, 0x68, 0xec, 0x84, 0xb6, 0xe7,
-	0x50, 0x83, 0x7f, 0x3c, 0x04, 0xa2, 0x10, 0x27, 0x9e, 0xad, 0x72, 0xc6, 0x61, 0x44, 0xe0, 0x1e,
-	0x05, 0xb8, 0x0d, 0xef, 0x0a, 0xb5, 0x21, 0x65, 0xd4, 0x27, 0x21, 0x35, 0xe8, 0x2f, 0xc7, 0xc4,
-	0x09, 0x0c, 0xc2, 0x2c, 0xe3, 0x8c, 0x04, 0x67, 0xea, 0x3a, 0x37, 0xb0, 0x9b, 0x53, 0x15, 0xfd,
-	0x32, 0x27, 0xee, 0x47, 0x3c, 0x4d, 0xd0, 0x5a, 0xcc, 0xfa, 0x8c, 0x04, 0x67, 0x78, 0x07, 0x2e,
-	0x09, 0x2b, 0x41, 0xe8, 0xdb, 0x6c, 0x68, 0x98, 0x67, 0xd4, 0x7c, 0x66, 0x8c, 0xc3, 0xc1, 0x43,
-	0xf5, 0xed, 0xf4, 0xfc, 0xc2, 0xc3, 0xbe, 0xe0, 0xec, 0x71, 0xca, 0x49, 0x38, 0x78, 0x88, 0xfb,
-	0x50, 0xe3, 0x9b, 0x31, 0xb2, 0xbf, 0xa4, 0xc6, 0xc0, 0xf5, 0xc5, 0xcd, 0x52, 0x9f, 0x73, 0xb2,
-	0x53, 0x11, 0x6c, 0x76, 0x23, 0x85, 0x43, 0xd7, 0xa2, 0x3b, 0xc5, 0x7e, 0x4f, 0xd3, 0xda, 0x7a,
-	0x35, 0xb6, 0xf2, 0xc8, 0xf5, 0x79, 0x42, 0x0d, 0xdd, 0x24, 0xc0, 0x55, 0x99, 0x50, 0x43, 0x37,
-	0x0e, 0xef, 0x7d, 0x58, 0x33, 0x4d, 0xb9, 0x66, 0xdb, 0x34, 0xa2, 0x16, 0x3f, 0x50, 0x51, 0x26,
-	0x58, 0xa6, 0xb9, 0x2f, 0x09, 0x51, 0x8e, 0x07, 0xf8, 0x63, 0x78, 0x73, 0x12, 0xac, 0xb4, 0xe2,
-	0xea, 0xcc, 0x2a, 0xa7, 0x55, 0xef, 0xc3, 0x9a, 0x77, 0x3e, 0xab, 0x88, 0x33, 0x33, 0x7a, 0xe7,
-	0xd3, 0x6a, 0xd7, 0xc5, 0x67, 0x9b, 0x4f, 0x4d, 0x12, 0x52, 0x4b, 0x7d, 0x2b, 0xcd, 0x4e, 0x09,
-	0xf0, 0x1d, 0x40, 0xa6, 0x69, 0x50, 0x46, 0x4e, 0x1d, 0x6a, 0x10, 0x9f, 0x32, 0x12, 0xa8, 0x57,
-	0xd2, 0xe4, 0xba, 0x69, 0x6a, 0x42, 0xda, 0x12, 0x42, 0x7c, 0x0b, 0x56, 0xdd, 0xd3, 0xa7, 0xa6,
-	0xcc, 0x2c, 0xc3, 0xf3, 0xe9, 0xc0, 0x7e, 0xa9, 0x5e, 0x13, 0x61, 0x5a, 0xe1, 0x02, 0x91, 0x57,
-	0x3d, 0x01, 0xe3, 0x9b, 0x80, 0xcc, 0xe0, 0x8c, 0xf8, 0x9e, 0xb8, 0xda, 0x03, 0x8f, 0x98, 0x54,
-	0xbd, 0x2e, 0xa9, 0x12, 0x3f, 0x8a, 0x61, 0xfc, 0x04, 0xd6, 0xc7, 0xcc, 0x66, 0x21, 0xf5, 0x3d,
-	0x9f, 0xf2, 0x0e, 0x5d, 0x1e, 0x33, 0xf5, 0x5f, 0x4b, 0x0b, 0x7a, 0xec, 0x93, 0x34, 0x5b, 0xee,
-	0xae, 0xbe, 0x36, 0x9e, 0x05, 0x1b, 0x3b, 0x50, 0x4b, 0x6f, 0x3a, 0xae, 0x80, 0xdc, 0x76, 0xa4,
-	0xf0, 0x0b, 0x74, 0xaf, 0xdb, 0xe6, 0x57, 0xdf, 0x17, 0x1a, 0xca, 0xf1, 0x2b, 0xf8, 0xa0, 0x73,
-	0xac, 0x19, 0xfa, 0xc9, 0xd1, 0x71, 0xe7, 0x50, 0x43, 0xf9, 0x5b, 0x95, 0xf2, 0xbf, 0x97, 0xd0,
-	0xab, 0x57, 0xaf, 0x5e, 0xe5, 0x1e, 0x17, 0xca, 0x1f, 0xa0, 0x1b, 0x8d, 0xbf, 0xe6, 0xa0, 0x9e,
-	0x6d, 0x7e, 0xf1, 0x4f, 0xe0, 0xad, 0xf8, 0x4b, 0x35, 0xa0, 0xa1, 0xf1, 0xc2, 0xf6, 0x45, 0x36,
-	0x8e, 0x88, 0x6c, 0x1f, 0x93, 0x40, 0xae, 0x47, 0xac, 0x3e, 0x0d, 0x7f, 0x61, 0xfb, 0x3c, 0xd7,
-	0x46, 0x24, 0xc4, 0x07, 0x70, 0x85, 0xb9, 0x46, 0x10, 0x12, 0x66, 0x11, 0xdf, 0x32, 0x26, 0x6f,
-	0x04, 0x06, 0x31, 0x4d, 0x1a, 0x04, 0xae, 0xbc, 0x05, 0x12, 0x2b, 0xef, 0x30, 0xb7, 0x1f, 0x91,
-	0x27, 0xe5, 0xb1, 0x15, 0x51, 0xa7, 0x36, 0x3d, 0xbf, 0x68, 0xd3, 0xdf, 0x86, 0xca, 0x88, 0x78,
-	0x06, 0x65, 0xa1, 0x7f, 0x2e, 0x5a, 0xb6, 0xb2, 0x5e, 0x1e, 0x11, 0x4f, 0xe3, 0xe3, 0xef, 0x6e,
-	0x27, 0xb2, 0xd1, 0x2c, 0xa3, 0x4a, 0xe3, 0x1f, 0x79, 0xa8, 0xa5, 0x9b, 0x37, 0xde, 0x0b, 0x9b,
-	0xa2, 0x50, 0x2b, 0xe2, 0x28, 0xbf, 0xff, 0x8d, 0xad, 0x5e, 0x73, 0x8f, 0x57, 0xf0, 0x9d, 0x92,
-	0x6c, 0xa9, 0x74, 0xa9, 0xc9, 0x6f, 0x4f, 0x7e, 0x78, 0xa9, 0x6c, 0xd4, 0xcb, 0x7a, 0x34, 0xc2,
-	0xfb, 0x50, 0x7a, 0x1a, 0x08, 0xdb, 0x25, 0x61, 0xfb, 0xda, 0x37, 0xdb, 0x7e, 0xdc, 0x17, 0xc6,
-	0x2b, 0x8f, 0xfb, 0xc6, 0x51, 0x57, 0x3f, 0x6c, 0x1d, 0xe8, 0x91, 0x3a, 0xbe, 0x0c, 0x05, 0x87,
-	0x7c, 0x79, 0x9e, 0xad, 0xf5, 0x02, 0xba, 0x68, 0xf8, 0x2f, 0x43, 0xe1, 0x05, 0x25, 0xcf, 0xb2,
-	0x15, 0x56, 0x40, 0xdf, 0xe1, 0x31, 0xb8, 0x03, 0x45, 0x11, 0x2f, 0x0c, 0x10, 0x45, 0x0c, 0xbd,
-	0x81, 0xcb, 0x50, 0xd8, 0xeb, 0xea, 0xfc, 0x28, 0x20, 0xa8, 0x49, 0xd4, 0xe8, 0x75, 0xb4, 0x3d,
-	0x0d, 0xe5, 0x1a, 0xf7, 0xa1, 0x24, 0x83, 0xc0, 0x8f, 0x49, 0x12, 0x06, 0xf4, 0x46, 0x34, 0x8c,
-	0x6c, 0x28, 0xb1, 0xf4, 0xe4, 0x70, 0x57, 0xd3, 0x51, 0x2e, 0xbb, 0xc9, 0x05, 0x54, 0x6c, 0x04,
-	0x50, 0x4b, 0x77, 0x6f, 0xdf, 0x4b, 0x7e, 0x35, 0xfe, 0xa2, 0x40, 0x35, 0xd5, 0x8d, 0xf1, 0x3e,
-	0x80, 0x38, 0x8e, 0xfb, 0xc2, 0x20, 0x8e, 0x4d, 0x82, 0x28, 0x35, 0x40, 0x40, 0x2d, 0x8e, 0x5c,
-	0x74, 0xeb, 0xbe, 0x17, 0xe7, 0xff, 0xa8, 0x00, 0x9a, 0xee, 0xe4, 0xa6, 0x1c, 0x54, 0x7e, 0x50,
-	0x07, 0xff, 0xa0, 0x40, 0x3d, 0xdb, 0xbe, 0x4d, 0xb9, 0x77, 0xf5, 0x07, 0x75, 0xef, 0xf7, 0x0a,
-	0x2c, 0x67, 0x9a, 0xb6, 0xff, 0x2b, 0xef, 0x7e, 0x97, 0x87, 0xb5, 0x39, 0x7a, 0xb8, 0x15, 0x75,
-	0xb7, 0xb2, 0xe1, 0xfe, 0xf1, 0x45, 0xe6, 0x6a, 0xf2, 0xfb, 0xb3, 0x47, 0xfc, 0x30, 0x6a, 0x86,
-	0x6f, 0x02, 0xb2, 0x2d, 0xca, 0x42, 0x7b, 0x60, 0x53, 0x3f, 0xfa, 0x22, 0x97, 0x2d, 0xef, 0xca,
-	0x04, 0x97, 0x1f, 0xe5, 0x3f, 0x02, 0xec, 0xb9, 0x81, 0x1d, 0xda, 0xcf, 0xa9, 0x61, 0xb3, 0xf8,
-	0xf3, 0x9d, 0xb7, 0xc0, 0x05, 0x1d, 0xc5, 0x92, 0x0e, 0x0b, 0x13, 0x36, 0xa3, 0x43, 0x32, 0xc5,
-	0xe6, 0x15, 0x30, 0xaf, 0xa3, 0x58, 0x92, 0xb0, 0xaf, 0x42, 0xcd, 0x72, 0xc7, 0xbc, 0xa1, 0x90,
-	0x3c, 0x5e, 0x70, 0x15, 0xbd, 0x2a, 0xb1, 0x84, 0x12, 0x75, 0x7c, 0x93, 0x77, 0x83, 0x9a, 0x5e,
-	0x95, 0x98, 0xa4, 0xdc, 0x80, 0x15, 0x32, 0x1c, 0xfa, 0xdc, 0x78, 0x6c, 0x48, 0xf6, 0xb0, 0xf5,
-	0x04, 0x16, 0xc4, 0x8d, 0xc7, 0x50, 0x8e, 0xe3, 0xc0, 0x6f, 0x36, 0x1e, 0x09, 0xc3, 0x93, 0xaf,
-	0x37, 0xb9, 0xad, 0x8a, 0x5e, 0x66, 0xb1, 0xf0, 0x2a, 0xd4, 0xec, 0xc0, 0x98, 0x3c, 0x23, 0xe6,
-	0x36, 0x73, 0x5b, 0x65, 0xbd, 0x6a, 0x07, 0xc9, 0xbb, 0x51, 0xe3, 0xeb, 0x1c, 0xd4, 0xb3, 0xcf,
-	0xa0, 0xb8, 0x0d, 0x65, 0xc7, 0x35, 0x89, 0x48, 0x04, 0xf9, 0x06, 0xbf, 0xf5, 0x9a, 0x97, 0xd3,
-	0xe6, 0x41, 0xc4, 0xd7, 0x13, 0xcd, 0x8d, 0xbf, 0x29, 0x50, 0x8e, 0x61, 0x7c, 0x09, 0x0a, 0x1e,
-	0x09, 0xcf, 0x84, 0xb9, 0xe2, 0x6e, 0x0e, 0x29, 0xba, 0x18, 0x73, 0x3c, 0xf0, 0x08, 0x13, 0x29,
-	0x10, 0xe1, 0x7c, 0xcc, 0xf7, 0xd5, 0xa1, 0xc4, 0x12, 0x0d, 0xb2, 0x3b, 0x1a, 0x51, 0x16, 0x06,
-	0xf1, 0xbe, 0x46, 0xf8, 0x5e, 0x04, 0xe3, 0xdb, 0xb0, 0x1a, 0xfa, 0xc4, 0x76, 0x32, 0xdc, 0x82,
-	0xe0, 0xa2, 0x58, 0x90, 0x90, 0x77, 0xe0, 0x72, 0x6c, 0xd7, 0xa2, 0x21, 0x31, 0xcf, 0xa8, 0x35,
-	0x51, 0x2a, 0x89, 0x37, 0xb6, 0xb7, 0x22, 0x42, 0x3b, 0x92, 0xc7, 0xba, 0x8d, 0xbf, 0x2b, 0xb0,
-	0x1a, 0xb7, 0xf4, 0x56, 0x12, 0xac, 0x43, 0x00, 0xc2, 0x98, 0x1b, 0xa6, 0xc3, 0x35, 0x9b, 0xca,
-	0x33, 0x7a, 0xcd, 0x56, 0xa2, 0xa4, 0xa7, 0x0c, 0x6c, 0x8c, 0x00, 0x26, 0x92, 0x85, 0x61, 0xbb,
-	0x02, 0xd5, 0xe8, 0x8d, 0x5b, 0xfc, 0xa3, 0x44, 0x7e, 0x04, 0x82, 0x84, 0x78, 0xef, 0x8f, 0xd7,
-	0xa1, 0x78, 0x4a, 0x87, 0x36, 0x8b, 0x5e, 0xde, 0xe4, 0x20, 0x7e, 0xcf, 0x2b, 0x24, 0xef, 0x79,
-	0xbb, 0x4f, 0x60, 0xcd, 0x74, 0x47, 0xd3, 0xee, 0xee, 0xa2, 0xa9, 0x0f, 0xd1, 0xe0, 0x33, 0xe5,
-	0x0b, 0x98, 0x74, 0x6a, 0x5f, 0xe5, 0xf2, 0xfb, 0xbd, 0xdd, 0x3f, 0xe5, 0x36, 0xf6, 0xa5, 0x5e,
-	0x2f, 0x5e, 0xa6, 0x4e, 0x07, 0x0e, 0x35, 0xb9, 0xeb, 0xff, 0x0d, 0x00, 0x00, 0xff, 0xff, 0x5f,
-	0x1c, 0x48, 0x4f, 0x0d, 0x1a, 0x00, 0x00,
+	// 2460 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xc4, 0x59, 0x5b, 0x6f, 0xdb, 0xc8,
+	0x15, 0x5e, 0x5d, 0x2d, 0x1d, 0xc9, 0xf2, 0x78, 0xec, 0x4d, 0x18, 0xef, 0x25, 0x8e, 0xf6, 0x12,
+	0x6f, 0xd2, 0xc8, 0x0b, 0xe7, 0xb2, 0x59, 0xa7, 0x48, 0x21, 0x4b, 0x8c, 0x57, 0xa9, 0x2c, 0xa9,
+	0x94, 0xdc, 0x4d, 0xf6, 0x85, 0x18, 0x93, 0x23, 0x99, 0x09, 0x45, 0x72, 0x49, 0x2a, 0x89, 0xf7,
+	0x29, 0x40, 0x9f, 0x0a, 0xf4, 0x07, 0x14, 0x45, 0xd1, 0x87, 0x7d, 0x59, 0xa0, 0x3f, 0xa0, 0xcf,
+	0xfd, 0x05, 0x05, 0xf6, 0xb9, 0x2f, 0x45, 0x51, 0xa0, 0xfd, 0x07, 0x7d, 0x2d, 0x66, 0x86, 0xa4,
+	0x48, 0x5d, 0x12, 0x77, 0x81, 0xec, 0x3e, 0xd9, 0x73, 0xce, 0x77, 0x0e, 0xcf, 0x9c, 0xf9, 0x66,
+	0xce, 0x99, 0x11, 0x6c, 0x8f, 0x6c, 0x7b, 0x64, 0xd2, 0x5d, 0xc7, 0xb5, 0x7d, 0xfb, 0x64, 0x32,
+	0xdc, 0xd5, 0xa9, 0xa7, 0xb9, 0x86, 0xe3, 0xdb, 0x6e, 0x8d, 0xcb, 0xf0, 0x9a, 0x40, 0xd4, 0x42,
+	0x44, 0xf5, 0x08, 0xd6, 0x1f, 0x18, 0x26, 0x6d, 0x46, 0xc0, 0x3e, 0xf5, 0xf1, 0x5d, 0xc8, 0x0e,
+	0x0d, 0x93, 0x4a, 0xa9, 0xed, 0xcc, 0x4e, 0x69, 0xef, 0xc3, 0xda, 0x8c, 0x51, 0x2d, 0x69, 0xd1,
+	0x63, 0x62, 0x85, 0x5b, 0x54, 0xff, 0x95, 0x85, 0x8d, 0x05, 0x5a, 0x8c, 0x21, 0x6b, 0x91, 0x31,
+	0xf3, 0x98, 0xda, 0x29, 0x2a, 0xfc, 0x7f, 0x2c, 0xc1, 0x8a, 0x43, 0xb4, 0xa7, 0x64, 0x44, 0xa5,
+	0x34, 0x17, 0x87, 0x43, 0xfc, 0x3e, 0x80, 0x4e, 0x1d, 0x6a, 0xe9, 0xd4, 0xd2, 0xce, 0xa4, 0xcc,
+	0x76, 0x66, 0xa7, 0xa8, 0xc4, 0x24, 0xf8, 0x3a, 0xac, 0x3b, 0x93, 0x13, 0xd3, 0xd0, 0xd4, 0x18,
+	0x0c, 0xb6, 0x33, 0x3b, 0x39, 0x05, 0x09, 0x45, 0x73, 0x0a, 0xbe, 0x0a, 0x6b, 0xcf, 0x29, 0x79,
+	0x1a, 0x87, 0x96, 0x38, 0xb4, 0xc2, 0xc4, 0x31, 0x60, 0x03, 0xca, 0x63, 0xea, 0x79, 0x64, 0x44,
+	0x55, 0xff, 0xcc, 0xa1, 0x52, 0x96, 0xcf, 0x7e, 0x7b, 0x6e, 0xf6, 0xb3, 0x33, 0x2f, 0x05, 0x56,
+	0x83, 0x33, 0x87, 0xe2, 0x3a, 0x14, 0xa9, 0x35, 0x19, 0x0b, 0x0f, 0xb9, 0x25, 0xf9, 0x93, 0xad,
+	0xc9, 0x78, 0xd6, 0x4b, 0x81, 0x99, 0x05, 0x2e, 0x56, 0x3c, 0xea, 0x3e, 0x33, 0x34, 0x2a, 0xe5,
+	0xb9, 0x83, 0xab, 0x73, 0x0e, 0xfa, 0x42, 0x3f, 0xeb, 0x23, 0xb4, 0xc3, 0x0d, 0x28, 0xd2, 0x17,
+	0x3e, 0xb5, 0x3c, 0xc3, 0xb6, 0xa4, 0x15, 0xee, 0xe4, 0xa3, 0x05, 0xab, 0x48, 0x4d, 0x7d, 0xd6,
+	0xc5, 0xd4, 0x0e, 0xdf, 0x81, 0x15, 0xdb, 0xf1, 0x0d, 0xdb, 0xf2, 0xa4, 0xc2, 0x76, 0x6a, 0xa7,
+	0xb4, 0xf7, 0xee, 0x42, 0x22, 0x74, 0x05, 0x46, 0x09, 0xc1, 0xb8, 0x05, 0xc8, 0xb3, 0x27, 0xae,
+	0x46, 0x55, 0xcd, 0xd6, 0xa9, 0x6a, 0x58, 0x43, 0x5b, 0x2a, 0x72, 0x07, 0x97, 0xe7, 0x27, 0xc2,
+	0x81, 0x0d, 0x5b, 0xa7, 0x2d, 0x6b, 0x68, 0x2b, 0x15, 0x2f, 0x31, 0xc6, 0x17, 0x20, 0xef, 0x9d,
+	0x59, 0x3e, 0x79, 0x21, 0x95, 0x39, 0x43, 0x82, 0x51, 0xf5, 0xbf, 0x39, 0x58, 0x3b, 0x0f, 0xc5,
+	0xee, 0x41, 0x6e, 0xc8, 0x66, 0x29, 0xa5, 0xff, 0x9f, 0x1c, 0x08, 0x9b, 0x64, 0x12, 0xf3, 0x3f,
+	0x30, 0x89, 0x75, 0x28, 0x59, 0xd4, 0xf3, 0xa9, 0x2e, 0x18, 0x91, 0x39, 0x27, 0xa7, 0x40, 0x18,
+	0xcd, 0x53, 0x2a, 0xfb, 0x83, 0x28, 0xf5, 0x08, 0xd6, 0xa2, 0x90, 0x54, 0x97, 0x58, 0xa3, 0x90,
+	0x9b, 0xbb, 0xaf, 0x8b, 0xa4, 0x26, 0x87, 0x76, 0x0a, 0x33, 0x53, 0x2a, 0x34, 0x31, 0xc6, 0x4d,
+	0x00, 0xdb, 0xa2, 0xf6, 0x50, 0xd5, 0xa9, 0x66, 0x4a, 0x85, 0x25, 0x59, 0xea, 0x32, 0xc8, 0x5c,
+	0x96, 0x6c, 0x21, 0xd5, 0x4c, 0xfc, 0xf9, 0x94, 0x6a, 0x2b, 0x4b, 0x98, 0x72, 0x24, 0x36, 0xd9,
+	0x1c, 0xdb, 0x8e, 0xa1, 0xe2, 0x52, 0xc6, 0x7b, 0xaa, 0x07, 0x33, 0x2b, 0xf2, 0x20, 0x6a, 0xaf,
+	0x9d, 0x99, 0x12, 0x98, 0x89, 0x89, 0xad, 0xba, 0xf1, 0x21, 0xfe, 0x00, 0x22, 0x81, 0xca, 0x69,
+	0x05, 0xfc, 0x14, 0x2a, 0x87, 0xc2, 0x0e, 0x19, 0xd3, 0xad, 0xbb, 0x50, 0x49, 0xa6, 0x07, 0x6f,
+	0x42, 0xce, 0xf3, 0x89, 0xeb, 0x73, 0x16, 0xe6, 0x14, 0x31, 0xc0, 0x08, 0x32, 0xd4, 0xd2, 0xf9,
+	0x29, 0x97, 0x53, 0xd8, 0xbf, 0x5b, 0x9f, 0xc1, 0x6a, 0xe2, 0xf3, 0xe7, 0x35, 0xac, 0xfe, 0x3e,
+	0x0f, 0x9b, 0x8b, 0x38, 0xb7, 0x90, 0xfe, 0x17, 0x20, 0x6f, 0x4d, 0xc6, 0x27, 0xd4, 0x95, 0x32,
+	0xdc, 0x43, 0x30, 0xc2, 0x75, 0xc8, 0x99, 0xe4, 0x84, 0x9a, 0x52, 0x76, 0x3b, 0xb5, 0x53, 0xd9,
+	0xbb, 0x7e, 0x2e, 0x56, 0xd7, 0xda, 0xcc, 0x44, 0x11, 0x96, 0xf8, 0x3e, 0x64, 0x83, 0x23, 0x8e,
+	0x79, 0xb8, 0x76, 0x3e, 0x0f, 0x8c, 0x8b, 0x0a, 0xb7, 0xc3, 0xef, 0x40, 0x91, 0xfd, 0x15, 0xb9,
+	0xcd, 0xf3, 0x98, 0x0b, 0x4c, 0xc0, 0xf2, 0x8a, 0xb7, 0xa0, 0xc0, 0x69, 0xa6, 0xd3, 0xb0, 0x34,
+	0x44, 0x63, 0xb6, 0x30, 0x3a, 0x1d, 0x92, 0x89, 0xe9, 0xab, 0xcf, 0x88, 0x39, 0xa1, 0x9c, 0x30,
+	0x45, 0xa5, 0x1c, 0x08, 0x7f, 0xcd, 0x64, 0xf8, 0x32, 0x94, 0x04, 0x2b, 0x0d, 0x4b, 0xa7, 0x2f,
+	0xf8, 0xe9, 0x93, 0x53, 0x04, 0x51, 0x5b, 0x4c, 0xc2, 0x3e, 0xff, 0xc4, 0xb3, 0xad, 0x70, 0x69,
+	0xf9, 0x27, 0x98, 0x80, 0x7f, 0xfe, 0xb3, 0xd9, 0x83, 0xef, 0xbd, 0xc5, 0xd3, 0x9b, 0xe5, 0x62,
+	0xf5, 0x2f, 0x69, 0xc8, 0xf2, 0xfd, 0xb6, 0x06, 0xa5, 0xc1, 0xe3, 0x9e, 0xac, 0x36, 0xbb, 0xc7,
+	0x07, 0x6d, 0x19, 0xa5, 0x70, 0x05, 0x80, 0x0b, 0x1e, 0xb4, 0xbb, 0xf5, 0x01, 0x4a, 0x47, 0xe3,
+	0x56, 0x67, 0x70, 0xe7, 0x16, 0xca, 0x44, 0x06, 0xc7, 0x42, 0x90, 0x8d, 0x03, 0x6e, 0xee, 0xa1,
+	0x1c, 0x46, 0x50, 0x16, 0x0e, 0x5a, 0x8f, 0xe4, 0xe6, 0x9d, 0x5b, 0x28, 0x9f, 0x94, 0xdc, 0xdc,
+	0x43, 0x2b, 0x78, 0x15, 0x8a, 0x5c, 0x72, 0xd0, 0xed, 0xb6, 0x51, 0x21, 0xf2, 0xd9, 0x1f, 0x28,
+	0xad, 0xce, 0x21, 0x2a, 0x46, 0x3e, 0x0f, 0x95, 0xee, 0x71, 0x0f, 0x41, 0xe4, 0xe1, 0x48, 0xee,
+	0xf7, 0xeb, 0x87, 0x32, 0x2a, 0x45, 0x88, 0x83, 0xc7, 0x03, 0xb9, 0x8f, 0xca, 0x89, 0xb0, 0x6e,
+	0xee, 0xa1, 0xd5, 0xe8, 0x13, 0x72, 0xe7, 0xf8, 0x08, 0x55, 0xf0, 0x3a, 0xac, 0x8a, 0x4f, 0x84,
+	0x41, 0xac, 0xcd, 0x88, 0xee, 0xdc, 0x42, 0x68, 0x1a, 0x88, 0xf0, 0xb2, 0x9e, 0x10, 0xdc, 0xb9,
+	0x85, 0x70, 0xb5, 0x01, 0x39, 0xce, 0x2e, 0x8c, 0xa1, 0xd2, 0xae, 0x1f, 0xc8, 0x6d, 0xb5, 0xdb,
+	0x1b, 0xb4, 0xba, 0x9d, 0x7a, 0x1b, 0xa5, 0xa6, 0x32, 0x45, 0xfe, 0xd5, 0x71, 0x4b, 0x91, 0x9b,
+	0x28, 0x1d, 0x97, 0xf5, 0xe4, 0xfa, 0x40, 0x6e, 0xa2, 0x4c, 0x55, 0x83, 0xcd, 0x45, 0xe7, 0xcc,
+	0xc2, 0x9d, 0x11, 0x5b, 0xe2, 0xf4, 0x92, 0x25, 0xe6, 0xbe, 0xe6, 0x96, 0xf8, 0xdb, 0x14, 0x6c,
+	0x2c, 0x38, 0x6b, 0x17, 0x7e, 0xe4, 0x17, 0x90, 0x13, 0x14, 0x15, 0xd5, 0xe7, 0x93, 0x85, 0x87,
+	0x36, 0x27, 0xec, 0x5c, 0x05, 0xe2, 0x76, 0xf1, 0x0a, 0x9c, 0x59, 0x52, 0x81, 0x99, 0x8b, 0xb9,
+	0x20, 0x7f, 0x93, 0x02, 0x69, 0x99, 0xef, 0xd7, 0x1c, 0x14, 0xe9, 0xc4, 0x41, 0x71, 0x6f, 0x36,
+	0x80, 0x2b, 0xcb, 0xe7, 0x30, 0x17, 0xc5, 0x77, 0x29, 0xb8, 0xb0, 0xb8, 0x51, 0x59, 0x18, 0xc3,
+	0x7d, 0xc8, 0x8f, 0xa9, 0x7f, 0x6a, 0x87, 0xc5, 0xfa, 0xe3, 0x05, 0x25, 0x80, 0xa9, 0x67, 0x73,
+	0x15, 0x58, 0xc5, 0x6b, 0x48, 0x66, 0x59, 0xb7, 0x21, 0xa2, 0x99, 0x8b, 0xf4, 0xb7, 0x69, 0x78,
+	0x7b, 0xa1, 0xf3, 0x85, 0x81, 0xbe, 0x07, 0x60, 0x58, 0xce, 0xc4, 0x17, 0x05, 0x59, 0x9c, 0x4f,
+	0x45, 0x2e, 0xe1, 0x7b, 0x9f, 0x9d, 0x3d, 0x13, 0x3f, 0xd2, 0x67, 0xb8, 0x1e, 0x84, 0x88, 0x03,
+	0xee, 0x4e, 0x03, 0xcd, 0xf2, 0x40, 0xdf, 0x5f, 0x32, 0xd3, 0xb9, 0x5a, 0xf7, 0x29, 0x20, 0xcd,
+	0x34, 0xa8, 0xe5, 0xab, 0x9e, 0xef, 0x52, 0x32, 0x36, 0xac, 0x11, 0x3f, 0x80, 0x0b, 0xfb, 0xb9,
+	0x21, 0x31, 0x3d, 0xaa, 0xac, 0x09, 0x75, 0x3f, 0xd4, 0x32, 0x0b, 0x5e, 0x65, 0xdc, 0x98, 0x45,
+	0x3e, 0x61, 0x21, 0xd4, 0x91, 0x45, 0xf5, 0xef, 0x2b, 0x50, 0x8a, 0xb5, 0x75, 0xf8, 0x0a, 0x94,
+	0x9f, 0x90, 0x67, 0x44, 0x0d, 0x5b, 0x75, 0x91, 0x89, 0x12, 0x93, 0xf5, 0x82, 0x76, 0xfd, 0x53,
+	0xd8, 0xe4, 0x10, 0x7b, 0xe2, 0x53, 0x57, 0xd5, 0x4c, 0xe2, 0x79, 0x3c, 0x69, 0x05, 0x0e, 0xc5,
+	0x4c, 0xd7, 0x65, 0xaa, 0x46, 0xa8, 0xc1, 0xb7, 0x61, 0x83, 0x5b, 0x8c, 0x27, 0xa6, 0x6f, 0x38,
+	0x26, 0x55, 0xd9, 0xe5, 0xc1, 0xe3, 0x07, 0x71, 0x14, 0xd9, 0x3a, 0x43, 0x1c, 0x05, 0x00, 0x16,
+	0x91, 0x87, 0x9b, 0xf0, 0x1e, 0x37, 0x1b, 0x51, 0x8b, 0xba, 0xc4, 0xa7, 0x2a, 0xfd, 0x7a, 0x42,
+	0x4c, 0x4f, 0x25, 0x96, 0xae, 0x9e, 0x12, 0xef, 0x54, 0xda, 0x64, 0x0e, 0x0e, 0xd2, 0x52, 0x4a,
+	0xb9, 0xc4, 0x80, 0x87, 0x01, 0x4e, 0xe6, 0xb0, 0xba, 0xa5, 0x7f, 0x41, 0xbc, 0x53, 0xbc, 0x0f,
+	0x17, 0xb8, 0x17, 0xcf, 0x77, 0x0d, 0x6b, 0xa4, 0x6a, 0xa7, 0x54, 0x7b, 0xaa, 0x4e, 0xfc, 0xe1,
+	0x5d, 0xe9, 0x9d, 0xf8, 0xf7, 0x79, 0x84, 0x7d, 0x8e, 0x69, 0x30, 0xc8, 0xb1, 0x3f, 0xbc, 0x8b,
+	0xfb, 0x50, 0x66, 0x8b, 0x31, 0x36, 0xbe, 0xa1, 0xea, 0xd0, 0x76, 0x79, 0x65, 0xa9, 0x2c, 0xd8,
+	0xd9, 0xb1, 0x0c, 0xd6, 0xba, 0x81, 0xc1, 0x91, 0xad, 0xd3, 0xfd, 0x5c, 0xbf, 0x27, 0xcb, 0x4d,
+	0xa5, 0x14, 0x7a, 0x79, 0x60, 0xbb, 0x8c, 0x50, 0x23, 0x3b, 0x4a, 0x70, 0x49, 0x10, 0x6a, 0x64,
+	0x87, 0xe9, 0xbd, 0x0d, 0x1b, 0x9a, 0x26, 0xe6, 0x6c, 0x68, 0x6a, 0xd0, 0xe2, 0x7b, 0x12, 0x4a,
+	0x24, 0x4b, 0xd3, 0x0e, 0x05, 0x20, 0xe0, 0xb8, 0x87, 0x3f, 0x87, 0xb7, 0xa7, 0xc9, 0x8a, 0x1b,
+	0xae, 0xcf, 0xcd, 0x72, 0xd6, 0xf4, 0x36, 0x6c, 0x38, 0x67, 0xf3, 0x86, 0x38, 0xf1, 0x45, 0xe7,
+	0x6c, 0xd6, 0xec, 0x23, 0x7e, 0x6d, 0x73, 0xa9, 0x46, 0x7c, 0xaa, 0x4b, 0x17, 0xe3, 0xe8, 0x98,
+	0x02, 0xef, 0x02, 0xd2, 0x34, 0x95, 0x5a, 0xe4, 0xc4, 0xa4, 0x2a, 0x71, 0xa9, 0x45, 0x3c, 0xe9,
+	0x72, 0x1c, 0x5c, 0xd1, 0x34, 0x99, 0x6b, 0xeb, 0x5c, 0x89, 0xaf, 0xc1, 0xba, 0x7d, 0xf2, 0x44,
+	0x13, 0xcc, 0x52, 0x1d, 0x97, 0x0e, 0x8d, 0x17, 0xd2, 0x87, 0x3c, 0x4d, 0x6b, 0x4c, 0xc1, 0x79,
+	0xd5, 0xe3, 0x62, 0xfc, 0x09, 0x20, 0xcd, 0x3b, 0x25, 0xae, 0xc3, 0x4b, 0xbb, 0xe7, 0x10, 0x8d,
+	0x4a, 0x1f, 0x09, 0xa8, 0x90, 0x77, 0x42, 0x31, 0x63, 0xb6, 0xf7, 0xdc, 0x18, 0xfa, 0xa1, 0xc7,
+	0xab, 0x82, 0xd9, 0x5c, 0x16, 0x78, 0xdb, 0x01, 0xe4, 0x9c, 0x3a, 0xc9, 0x0f, 0xef, 0x70, 0x58,
+	0xc5, 0x39, 0x75, 0xe2, 0xdf, 0x7d, 0x04, 0x9b, 0x13, 0xcb, 0xb0, 0x7c, 0xea, 0x3a, 0x2e, 0x65,
+	0xed, 0xbe, 0xd8, 0xb3, 0xd2, 0xbf, 0x57, 0x96, 0x34, 0xec, 0xc7, 0x71, 0xb4, 0xa0, 0x8a, 0xb2,
+	0x31, 0x99, 0x17, 0x56, 0xf7, 0xa1, 0x1c, 0x67, 0x10, 0x2e, 0x82, 0xe0, 0x10, 0x4a, 0xb1, 0x6a,
+	0xdc, 0xe8, 0x36, 0x59, 0x1d, 0xfd, 0x4a, 0x46, 0x69, 0x56, 0xcf, 0xdb, 0xad, 0x81, 0xac, 0x2a,
+	0xc7, 0x9d, 0x41, 0xeb, 0x48, 0x46, 0x99, 0x6b, 0xc5, 0xc2, 0x7f, 0x56, 0xd0, 0xcb, 0x97, 0x2f,
+	0x5f, 0xa6, 0x1f, 0x66, 0x0b, 0x1f, 0xa3, 0xab, 0xd5, 0xef, 0xd3, 0x50, 0x49, 0x76, 0xd2, 0xf8,
+	0xe7, 0x70, 0x31, 0xbc, 0xf6, 0x7a, 0xd4, 0x57, 0x9f, 0x1b, 0x2e, 0xa7, 0xf6, 0x98, 0x88, 0x5e,
+	0x34, 0x5a, 0x95, 0xcd, 0x00, 0xd5, 0xa7, 0xfe, 0x97, 0x86, 0xcb, 0x88, 0x3b, 0x26, 0x3e, 0x6e,
+	0xc3, 0x65, 0xcb, 0x56, 0x3d, 0x9f, 0x58, 0x3a, 0x71, 0x75, 0x75, 0xfa, 0xe0, 0xa0, 0x12, 0x4d,
+	0xa3, 0x9e, 0x67, 0x8b, 0x92, 0x12, 0x79, 0x79, 0xd7, 0xb2, 0xfb, 0x01, 0x78, 0x7a, 0xd6, 0xd6,
+	0x03, 0xe8, 0x0c, 0x83, 0x32, 0xcb, 0x18, 0xf4, 0x0e, 0x14, 0xc7, 0xc4, 0x51, 0xa9, 0xe5, 0xbb,
+	0x67, 0xbc, 0xff, 0x2b, 0x28, 0x85, 0x31, 0x71, 0x64, 0x36, 0x7e, 0x73, 0x2b, 0x91, 0xcc, 0x66,
+	0x01, 0x15, 0x1f, 0x66, 0x0b, 0x45, 0x04, 0xd5, 0x7f, 0x66, 0xa0, 0x1c, 0xef, 0x07, 0x59, 0x7b,
+	0xad, 0xf1, 0xb3, 0x3f, 0xc5, 0x4f, 0x87, 0x0f, 0x5e, 0xd9, 0x3d, 0xd6, 0x1a, 0xac, 0x28, 0xec,
+	0xe7, 0x45, 0x97, 0xa6, 0x08, 0x4b, 0x56, 0x90, 0xd9, 0x79, 0x40, 0x45, 0xef, 0x5f, 0x50, 0x82,
+	0x11, 0x3e, 0x84, 0xfc, 0x13, 0x8f, 0xfb, 0xce, 0x73, 0xdf, 0x1f, 0xbe, 0xda, 0xf7, 0xc3, 0x3e,
+	0x77, 0x5e, 0x7c, 0xd8, 0x57, 0x3b, 0x5d, 0xe5, 0xa8, 0xde, 0x56, 0x02, 0x73, 0x7c, 0x09, 0xb2,
+	0x26, 0xf9, 0xe6, 0x2c, 0x59, 0x3e, 0xb8, 0xe8, 0xbc, 0x8b, 0x70, 0x09, 0xb2, 0xcf, 0x29, 0x79,
+	0x9a, 0x3c, 0xb4, 0xb9, 0xe8, 0x0d, 0x6e, 0x86, 0x5d, 0xc8, 0xf1, 0x7c, 0x61, 0x80, 0x20, 0x63,
+	0xe8, 0x2d, 0x5c, 0x80, 0x6c, 0xa3, 0xab, 0xb0, 0x0d, 0x81, 0xa0, 0x2c, 0xa4, 0x6a, 0xaf, 0x25,
+	0x37, 0x64, 0x94, 0xae, 0xde, 0x86, 0xbc, 0x48, 0x02, 0xdb, 0x2c, 0x51, 0x1a, 0xd0, 0x5b, 0xc1,
+	0x30, 0xf0, 0x91, 0x0a, 0xb5, 0xc7, 0x47, 0x07, 0xb2, 0x82, 0xd2, 0xc9, 0xa5, 0xce, 0xa2, 0x5c,
+	0xd5, 0x83, 0x72, 0xbc, 0x21, 0xfc, 0x51, 0x58, 0x56, 0xfd, 0x6b, 0x0a, 0x4a, 0xb1, 0x06, 0x8f,
+	0xb5, 0x16, 0xc4, 0x34, 0xed, 0xe7, 0x2a, 0x31, 0x0d, 0xe2, 0x05, 0xd4, 0x00, 0x2e, 0xaa, 0x33,
+	0xc9, 0x79, 0x97, 0xee, 0x47, 0xda, 0x22, 0x39, 0x94, 0xaf, 0xfe, 0x29, 0x05, 0x68, 0xb6, 0x45,
+	0x9c, 0x09, 0x33, 0xf5, 0x53, 0x86, 0x59, 0xfd, 0x63, 0x0a, 0x2a, 0xc9, 0xbe, 0x70, 0x26, 0xbc,
+	0x2b, 0x3f, 0x69, 0x78, 0xff, 0x48, 0xc3, 0x6a, 0xa2, 0x1b, 0x3c, 0x6f, 0x74, 0x5f, 0xc3, 0xba,
+	0xa1, 0xd3, 0xb1, 0x63, 0xfb, 0xd4, 0xd2, 0xce, 0x54, 0x93, 0x3e, 0xa3, 0xa6, 0x54, 0xe5, 0x87,
+	0xc6, 0xee, 0xab, 0xfb, 0xcd, 0x5a, 0x6b, 0x6a, 0xd7, 0x66, 0x66, 0xfb, 0x1b, 0xad, 0xa6, 0x7c,
+	0xd4, 0xeb, 0x0e, 0xe4, 0x4e, 0xe3, 0xb1, 0x7a, 0xdc, 0xf9, 0x65, 0xa7, 0xfb, 0x65, 0x47, 0x41,
+	0xc6, 0x0c, 0xec, 0x0d, 0x6e, 0xfb, 0x1e, 0xa0, 0xd9, 0xa0, 0xf0, 0x45, 0x58, 0x14, 0x16, 0x7a,
+	0x0b, 0x6f, 0xc0, 0x5a, 0xa7, 0xab, 0xf6, 0x5b, 0x4d, 0x59, 0x95, 0x1f, 0x3c, 0x90, 0x1b, 0x83,
+	0xbe, 0xb8, 0x80, 0x47, 0xe8, 0x41, 0x62, 0x83, 0x57, 0xff, 0x90, 0x81, 0x8d, 0x05, 0x91, 0xe0,
+	0x7a, 0xd0, 0xfb, 0x8b, 0xeb, 0xc8, 0x8d, 0xf3, 0x44, 0x5f, 0x63, 0xdd, 0x45, 0x8f, 0xb8, 0x7e,
+	0x70, 0x55, 0xf8, 0x04, 0x58, 0x96, 0x2c, 0xdf, 0x18, 0x1a, 0xd4, 0x0d, 0xde, 0x2b, 0xc4, 0x85,
+	0x60, 0x6d, 0x2a, 0x17, 0x4f, 0x16, 0x3f, 0x03, 0xec, 0xd8, 0x9e, 0xe1, 0x1b, 0xcf, 0xa8, 0x6a,
+	0x58, 0xe1, 0xe3, 0x06, 0xbb, 0x20, 0x64, 0x15, 0x14, 0x6a, 0x5a, 0x96, 0x1f, 0xa1, 0x2d, 0x3a,
+	0x22, 0x33, 0x68, 0x76, 0x98, 0x67, 0x14, 0x14, 0x6a, 0x22, 0xf4, 0x15, 0x28, 0xeb, 0xf6, 0x84,
+	0xb5, 0x5b, 0x02, 0xc7, 0x6a, 0x47, 0x4a, 0x29, 0x09, 0x59, 0x04, 0x09, 0xfa, 0xe1, 0xe9, 0xab,
+	0x4a, 0x59, 0x29, 0x09, 0x99, 0x80, 0x5c, 0x85, 0x35, 0x32, 0x1a, 0xb9, 0xcc, 0x79, 0xe8, 0x48,
+	0x74, 0xf8, 0x95, 0x48, 0xcc, 0x81, 0x5b, 0x0f, 0xa1, 0x10, 0xe6, 0x81, 0x95, 0x6a, 0x96, 0x09,
+	0xd5, 0x11, 0x6f, 0x5b, 0xe9, 0x9d, 0xa2, 0x52, 0xb0, 0x42, 0xe5, 0x15, 0x28, 0x1b, 0x9e, 0x3a,
+	0x7d, 0x64, 0x4d, 0x6f, 0xa7, 0x77, 0x0a, 0x4a, 0xc9, 0xf0, 0xa2, 0x57, 0xb5, 0xea, 0x77, 0x69,
+	0xa8, 0x24, 0x1f, 0x89, 0x71, 0x13, 0x0a, 0xa6, 0xad, 0x11, 0x4e, 0x2d, 0xf1, 0x0b, 0xc5, 0xce,
+	0x6b, 0xde, 0x95, 0x6b, 0xed, 0x00, 0xaf, 0x44, 0x96, 0x5b, 0x7f, 0x4b, 0x41, 0x21, 0x14, 0xe3,
+	0x0b, 0x90, 0x75, 0x88, 0x7f, 0xca, 0xdd, 0xe5, 0x0e, 0xd2, 0x28, 0xa5, 0xf0, 0x31, 0x93, 0x7b,
+	0x0e, 0xb1, 0x38, 0x05, 0x02, 0x39, 0x1b, 0xb3, 0x75, 0x35, 0x29, 0xd1, 0xf9, 0xf5, 0xc1, 0x1e,
+	0x8f, 0xa9, 0xe5, 0x7b, 0xe1, 0xba, 0x06, 0xf2, 0x46, 0x20, 0xc6, 0xd7, 0x61, 0xdd, 0x77, 0x89,
+	0x61, 0x26, 0xb0, 0x59, 0x8e, 0x45, 0xa1, 0x22, 0x02, 0xef, 0xc3, 0xa5, 0xd0, 0xaf, 0x4e, 0x7d,
+	0xa2, 0x9d, 0x52, 0x7d, 0x6a, 0x94, 0xe7, 0x2f, 0x90, 0x17, 0x03, 0x40, 0x33, 0xd0, 0x87, 0xb6,
+	0xd5, 0xef, 0x53, 0xb0, 0x1e, 0x5e, 0x78, 0xf4, 0x28, 0x59, 0x47, 0x00, 0xc4, 0xb2, 0x6c, 0x3f,
+	0x9e, 0xae, 0x79, 0x2a, 0xcf, 0xd9, 0xd5, 0xea, 0x91, 0x91, 0x12, 0x73, 0xb0, 0x35, 0x06, 0x98,
+	0x6a, 0x96, 0xa6, 0xed, 0x32, 0x94, 0x82, 0x5f, 0x00, 0xf8, 0xcf, 0x48, 0xe2, 0x8a, 0x0c, 0x42,
+	0xc4, 0x6e, 0x46, 0x78, 0x13, 0x72, 0x27, 0x74, 0x64, 0x58, 0xc1, 0xbb, 0xa4, 0x18, 0x84, 0xaf,
+	0x9d, 0xd9, 0xe8, 0xb5, 0xf3, 0xe0, 0x77, 0x29, 0xd8, 0xd0, 0xec, 0xf1, 0x6c, 0xbc, 0x07, 0x68,
+	0xe6, 0x9e, 0xee, 0x7d, 0x91, 0xfa, 0xea, 0xfe, 0xc8, 0xf0, 0x4f, 0x27, 0x27, 0x35, 0xcd, 0x1e,
+	0xef, 0x8e, 0x6c, 0x93, 0x58, 0xa3, 0xe9, 0xef, 0x60, 0xfc, 0x1f, 0xed, 0xc6, 0x88, 0x5a, 0x37,
+	0x46, 0x76, 0xec, 0x57, 0xb1, 0x7b, 0xd3, 0x7f, 0xbf, 0x4d, 0x67, 0x0e, 0x7b, 0x07, 0x7f, 0x4e,
+	0x6f, 0x1d, 0x8a, 0x6f, 0xf5, 0xc2, 0xdc, 0x28, 0x74, 0x68, 0x52, 0x8d, 0xcd, 0xf7, 0x7f, 0x01,
+	0x00, 0x00, 0xff, 0xff, 0x8e, 0x54, 0xe7, 0xef, 0x60, 0x1b, 0x00, 0x00,
 }
diff --git a/components/engine/vendor/github.com/golang/protobuf/ptypes/any/any.pb.go b/components/engine/vendor/github.com/golang/protobuf/ptypes/any/any.pb.go
index f2c6906b91..1fbaa44caa 100644
--- a/components/engine/vendor/github.com/golang/protobuf/ptypes/any/any.pb.go
+++ b/components/engine/vendor/github.com/golang/protobuf/ptypes/any/any.pb.go
@@ -1,6 +1,5 @@
-// Code generated by protoc-gen-go.
+// Code generated by protoc-gen-go. DO NOT EDIT.
 // source: github.com/golang/protobuf/ptypes/any/any.proto
-// DO NOT EDIT!
 
 /*
 Package any is a generated protocol buffer package.
@@ -132,6 +131,20 @@ func (*Any) ProtoMessage()               {}
 func (*Any) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
 func (*Any) XXX_WellKnownType() string   { return "Any" }
 
+func (m *Any) GetTypeUrl() string {
+	if m != nil {
+		return m.TypeUrl
+	}
+	return ""
+}
+
+func (m *Any) GetValue() []byte {
+	if m != nil {
+		return m.Value
+	}
+	return nil
+}
+
 func init() {
 	proto.RegisterType((*Any)(nil), "google.protobuf.Any")
 }
@@ -139,17 +152,17 @@ func init() {
 func init() { proto.RegisterFile("github.com/golang/protobuf/ptypes/any/any.proto", fileDescriptor0) }
 
 var fileDescriptor0 = []byte{
-	// 187 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xe2, 0xd2, 0x4f, 0xcf, 0x2c, 0xc9,
+	// 184 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0xd2, 0x4f, 0xcf, 0x2c, 0xc9,
 	0x28, 0x4d, 0xd2, 0x4b, 0xce, 0xcf, 0xd5, 0x4f, 0xcf, 0xcf, 0x49, 0xcc, 0x4b, 0xd7, 0x2f, 0x28,
 	0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x2f, 0x28, 0xa9, 0x2c, 0x48, 0x2d, 0xd6, 0x4f, 0xcc,
 	0xab, 0x04, 0x61, 0x3d, 0xb0, 0xb8, 0x10, 0x7f, 0x7a, 0x7e, 0x7e, 0x7a, 0x4e, 0xaa, 0x1e, 0x4c,
 	0x95, 0x92, 0x19, 0x17, 0xb3, 0x63, 0x5e, 0xa5, 0x90, 0x24, 0x17, 0x07, 0x48, 0x79, 0x7c, 0x69,
 	0x51, 0x8e, 0x04, 0xa3, 0x02, 0xa3, 0x06, 0x67, 0x10, 0x3b, 0x88, 0x1f, 0x5a, 0x94, 0x23, 0x24,
 	0xc2, 0xc5, 0x5a, 0x96, 0x98, 0x53, 0x9a, 0x2a, 0xc1, 0xa4, 0xc0, 0xa8, 0xc1, 0x13, 0x04, 0xe1,
-	0x38, 0x15, 0x71, 0x09, 0x27, 0xe7, 0xe7, 0xea, 0xa1, 0x19, 0xe7, 0xc4, 0xe1, 0x98, 0x57, 0x19,
-	0x00, 0xe2, 0x04, 0x30, 0x46, 0xa9, 0x12, 0xe5, 0xb8, 0x05, 0x8c, 0x8c, 0x8b, 0x98, 0x98, 0xdd,
-	0x03, 0x9c, 0x56, 0x31, 0xc9, 0xb9, 0x43, 0x4c, 0x0b, 0x80, 0xaa, 0xd2, 0x0b, 0x4f, 0xcd, 0xc9,
-	0xf1, 0xce, 0xcb, 0x2f, 0xcf, 0x0b, 0x01, 0xa9, 0x4e, 0x62, 0x03, 0x6b, 0x37, 0x06, 0x04, 0x00,
-	0x00, 0xff, 0xff, 0xc6, 0x4d, 0x03, 0x23, 0xf6, 0x00, 0x00, 0x00,
+	0x38, 0xe5, 0x73, 0x09, 0x27, 0xe7, 0xe7, 0xea, 0xa1, 0x19, 0xe7, 0xc4, 0xe1, 0x98, 0x57, 0x19,
+	0x00, 0xe2, 0x04, 0x30, 0x46, 0xa9, 0x12, 0xe5, 0xb8, 0x45, 0x4c, 0xcc, 0xee, 0x01, 0x4e, 0xab,
+	0x98, 0xe4, 0xdc, 0x21, 0x46, 0x05, 0x40, 0x95, 0xe8, 0x85, 0xa7, 0xe6, 0xe4, 0x78, 0xe7, 0xe5,
+	0x97, 0xe7, 0x85, 0x80, 0x94, 0x26, 0xb1, 0x81, 0xf5, 0x1a, 0x03, 0x02, 0x00, 0x00, 0xff, 0xff,
+	0x45, 0x1f, 0x1a, 0xf2, 0xf3, 0x00, 0x00, 0x00,
 }
diff --git a/components/engine/vendor/github.com/golang/protobuf/ptypes/any/any.proto b/components/engine/vendor/github.com/golang/protobuf/ptypes/any/any.proto
index 81dcf46ccf..9bd3f50a45 100644
--- a/components/engine/vendor/github.com/golang/protobuf/ptypes/any/any.proto
+++ b/components/engine/vendor/github.com/golang/protobuf/ptypes/any/any.proto
@@ -37,7 +37,6 @@ option go_package = "github.com/golang/protobuf/ptypes/any";
 option java_package = "com.google.protobuf";
 option java_outer_classname = "AnyProto";
 option java_multiple_files = true;
-option java_generate_equals_and_hash = true;
 option objc_class_prefix = "GPB";
 
 // `Any` contains an arbitrary serialized protocol buffer message along with a
diff --git a/components/engine/vendor/github.com/golang/protobuf/ptypes/duration/duration.pb.go b/components/engine/vendor/github.com/golang/protobuf/ptypes/duration/duration.pb.go
index 569748346d..fe3350bed0 100644
--- a/components/engine/vendor/github.com/golang/protobuf/ptypes/duration/duration.pb.go
+++ b/components/engine/vendor/github.com/golang/protobuf/ptypes/duration/duration.pb.go
@@ -1,6 +1,5 @@
-// Code generated by protoc-gen-go.
+// Code generated by protoc-gen-go. DO NOT EDIT.
 // source: github.com/golang/protobuf/ptypes/duration/duration.proto
-// DO NOT EDIT!
 
 /*
 Package duration is a generated protocol buffer package.
@@ -35,6 +34,8 @@ const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
 // two Timestamp values is a Duration and it can be added or subtracted
 // from a Timestamp. Range is approximately +-10,000 years.
 //
+// # Examples
+//
 // Example 1: Compute Duration from two Timestamps in pseudo code.
 //
 //     Timestamp start = ...;
@@ -69,10 +70,27 @@ const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
 //       end.nanos -= 1000000000;
 //     }
 //
+// Example 3: Compute Duration from datetime.timedelta in Python.
+//
+//     td = datetime.timedelta(days=3, minutes=10)
+//     duration = Duration()
+//     duration.FromTimedelta(td)
+//
+// # JSON Mapping
+//
+// In JSON format, the Duration type is encoded as a string rather than an
+// object, where the string ends in the suffix "s" (indicating seconds) and
+// is preceded by the number of seconds, with nanoseconds expressed as
+// fractional seconds. For example, 3 seconds with 0 nanoseconds should be
+// encoded in JSON format as "3s", while 3 seconds and 1 nanosecond should
+// be expressed in JSON format as "3.000000001s", and 3 seconds and 1
+// microsecond should be expressed in JSON format as "3.000001s".
+//
 //
 type Duration struct {
 	// Signed seconds of the span of time. Must be from -315,576,000,000
-	// to +315,576,000,000 inclusive.
+	// to +315,576,000,000 inclusive. Note: these bounds are computed from:
+	// 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
 	Seconds int64 `protobuf:"varint,1,opt,name=seconds" json:"seconds,omitempty"`
 	// Signed fractions of a second at nanosecond resolution of the span
 	// of time. Durations less than one second are represented with a 0
@@ -89,6 +107,20 @@ func (*Duration) ProtoMessage()               {}
 func (*Duration) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
 func (*Duration) XXX_WellKnownType() string   { return "Duration" }
 
+func (m *Duration) GetSeconds() int64 {
+	if m != nil {
+		return m.Seconds
+	}
+	return 0
+}
+
+func (m *Duration) GetNanos() int32 {
+	if m != nil {
+		return m.Nanos
+	}
+	return 0
+}
+
 func init() {
 	proto.RegisterType((*Duration)(nil), "google.protobuf.Duration")
 }
@@ -99,7 +131,7 @@ func init() {
 
 var fileDescriptor0 = []byte{
 	// 189 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xe2, 0xb2, 0x4c, 0xcf, 0x2c, 0xc9,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0xb2, 0x4c, 0xcf, 0x2c, 0xc9,
 	0x28, 0x4d, 0xd2, 0x4b, 0xce, 0xcf, 0xd5, 0x4f, 0xcf, 0xcf, 0x49, 0xcc, 0x4b, 0xd7, 0x2f, 0x28,
 	0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x2f, 0x28, 0xa9, 0x2c, 0x48, 0x2d, 0xd6, 0x4f, 0x29,
 	0x2d, 0x4a, 0x2c, 0xc9, 0xcc, 0xcf, 0x83, 0x33, 0xf4, 0xc0, 0x2a, 0x84, 0xf8, 0xd3, 0xf3, 0xf3,
@@ -107,8 +139,8 @@ var fileDescriptor0 = []byte{
 	0xd8, 0x8b, 0x53, 0x93, 0xf3, 0xf3, 0x52, 0x8a, 0x25, 0x18, 0x15, 0x18, 0x35, 0x98, 0x83, 0x60,
 	0x5c, 0x21, 0x11, 0x2e, 0xd6, 0xbc, 0xc4, 0xbc, 0xfc, 0x62, 0x09, 0x26, 0x05, 0x46, 0x0d, 0xd6,
 	0x20, 0x08, 0xc7, 0xa9, 0x86, 0x4b, 0x38, 0x39, 0x3f, 0x57, 0x0f, 0xcd, 0x48, 0x27, 0x5e, 0x98,
-	0x81, 0x01, 0x20, 0x91, 0x00, 0xc6, 0x28, 0x2d, 0xe2, 0xdd, 0xbb, 0x80, 0x91, 0x71, 0x11, 0x13,
+	0x81, 0x01, 0x20, 0x91, 0x00, 0xc6, 0x28, 0x2d, 0xe2, 0xdd, 0xfb, 0x83, 0x91, 0x71, 0x11, 0x13,
 	0xb3, 0x7b, 0x80, 0xd3, 0x2a, 0x26, 0x39, 0x77, 0x88, 0xb9, 0x01, 0x50, 0xa5, 0x7a, 0xe1, 0xa9,
 	0x39, 0x39, 0xde, 0x79, 0xf9, 0xe5, 0x79, 0x21, 0x20, 0x2d, 0x49, 0x6c, 0x60, 0x33, 0x8c, 0x01,
-	0x01, 0x00, 0x00, 0xff, 0xff, 0x62, 0xfb, 0xb1, 0x51, 0x0e, 0x01, 0x00, 0x00,
+	0x01, 0x00, 0x00, 0xff, 0xff, 0x45, 0x5a, 0x81, 0x3d, 0x0e, 0x01, 0x00, 0x00,
 }
diff --git a/components/engine/vendor/github.com/golang/protobuf/ptypes/duration/duration.proto b/components/engine/vendor/github.com/golang/protobuf/ptypes/duration/duration.proto
index 96c1796d65..975fce41aa 100644
--- a/components/engine/vendor/github.com/golang/protobuf/ptypes/duration/duration.proto
+++ b/components/engine/vendor/github.com/golang/protobuf/ptypes/duration/duration.proto
@@ -33,11 +33,11 @@ syntax = "proto3";
 package google.protobuf;
 
 option csharp_namespace = "Google.Protobuf.WellKnownTypes";
+option cc_enable_arenas = true;
 option go_package = "github.com/golang/protobuf/ptypes/duration";
 option java_package = "com.google.protobuf";
 option java_outer_classname = "DurationProto";
 option java_multiple_files = true;
-option java_generate_equals_and_hash = true;
 option objc_class_prefix = "GPB";
 
 // A Duration represents a signed, fixed-length span of time represented
@@ -47,6 +47,8 @@ option objc_class_prefix = "GPB";
 // two Timestamp values is a Duration and it can be added or subtracted
 // from a Timestamp. Range is approximately +-10,000 years.
 //
+// # Examples
+//
 // Example 1: Compute Duration from two Timestamps in pseudo code.
 //
 //     Timestamp start = ...;
@@ -81,11 +83,28 @@ option objc_class_prefix = "GPB";
 //       end.nanos -= 1000000000;
 //     }
 //
+// Example 3: Compute Duration from datetime.timedelta in Python.
+//
+//     td = datetime.timedelta(days=3, minutes=10)
+//     duration = Duration()
+//     duration.FromTimedelta(td)
+//
+// # JSON Mapping
+//
+// In JSON format, the Duration type is encoded as a string rather than an
+// object, where the string ends in the suffix "s" (indicating seconds) and
+// is preceded by the number of seconds, with nanoseconds expressed as
+// fractional seconds. For example, 3 seconds with 0 nanoseconds should be
+// encoded in JSON format as "3s", while 3 seconds and 1 nanosecond should
+// be expressed in JSON format as "3.000000001s", and 3 seconds and 1
+// microsecond should be expressed in JSON format as "3.000001s".
+//
 //
 message Duration {
 
   // Signed seconds of the span of time. Must be from -315,576,000,000
-  // to +315,576,000,000 inclusive.
+  // to +315,576,000,000 inclusive. Note: these bounds are computed from:
+  // 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
   int64 seconds = 1;
 
   // Signed fractions of a second at nanosecond resolution of the span
diff --git a/components/engine/vendor/github.com/golang/protobuf/ptypes/empty/empty.pb.go b/components/engine/vendor/github.com/golang/protobuf/ptypes/empty/empty.pb.go
index 46c765a96e..ae15941446 100644
--- a/components/engine/vendor/github.com/golang/protobuf/ptypes/empty/empty.pb.go
+++ b/components/engine/vendor/github.com/golang/protobuf/ptypes/empty/empty.pb.go
@@ -1,6 +1,5 @@
-// Code generated by protoc-gen-go.
+// Code generated by protoc-gen-go. DO NOT EDIT.
 // source: github.com/golang/protobuf/ptypes/empty/empty.proto
-// DO NOT EDIT!
 
 /*
 Package empty is a generated protocol buffer package.
@@ -55,15 +54,15 @@ func init() {
 }
 
 var fileDescriptor0 = []byte{
-	// 150 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xe2, 0x32, 0x4e, 0xcf, 0x2c, 0xc9,
+	// 147 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x32, 0x4e, 0xcf, 0x2c, 0xc9,
 	0x28, 0x4d, 0xd2, 0x4b, 0xce, 0xcf, 0xd5, 0x4f, 0xcf, 0xcf, 0x49, 0xcc, 0x4b, 0xd7, 0x2f, 0x28,
 	0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x2f, 0x28, 0xa9, 0x2c, 0x48, 0x2d, 0xd6, 0x4f, 0xcd,
 	0x2d, 0x28, 0xa9, 0x84, 0x90, 0x7a, 0x60, 0x39, 0x21, 0xfe, 0xf4, 0xfc, 0xfc, 0xf4, 0x9c, 0x54,
-	0x3d, 0x98, 0x4a, 0x25, 0x76, 0x2e, 0x56, 0x57, 0x90, 0xbc, 0x53, 0x25, 0x97, 0x70, 0x72, 0x7e,
+	0x3d, 0x98, 0x4a, 0x25, 0x76, 0x2e, 0x56, 0x57, 0x90, 0xbc, 0x53, 0x19, 0x97, 0x70, 0x72, 0x7e,
 	0xae, 0x1e, 0x9a, 0xbc, 0x13, 0x17, 0x58, 0x36, 0x00, 0xc4, 0x0d, 0x60, 0x8c, 0x52, 0x27, 0xd2,
-	0xce, 0x05, 0x8c, 0x8c, 0x3f, 0x18, 0x19, 0x17, 0x31, 0x31, 0xbb, 0x07, 0x38, 0xad, 0x62, 0x92,
-	0x73, 0x87, 0x18, 0x1a, 0x00, 0x55, 0xaa, 0x17, 0x9e, 0x9a, 0x93, 0xe3, 0x9d, 0x97, 0x5f, 0x9e,
-	0x17, 0x02, 0xd2, 0x92, 0xc4, 0x06, 0x36, 0xc3, 0x18, 0x10, 0x00, 0x00, 0xff, 0xff, 0x7f, 0xbb,
-	0xf4, 0x0e, 0xd2, 0x00, 0x00, 0x00,
+	0xce, 0x1f, 0x8c, 0x8c, 0x8b, 0x98, 0x98, 0xdd, 0x03, 0x9c, 0x56, 0x31, 0xc9, 0xb9, 0x43, 0x4c,
+	0x0c, 0x80, 0xaa, 0xd3, 0x0b, 0x4f, 0xcd, 0xc9, 0xf1, 0xce, 0xcb, 0x2f, 0xcf, 0x0b, 0x01, 0xa9,
+	0x4f, 0x62, 0x03, 0x1b, 0x60, 0x0c, 0x08, 0x00, 0x00, 0xff, 0xff, 0x6e, 0x8e, 0x0a, 0x06, 0xcf,
+	0x00, 0x00, 0x00,
 }
diff --git a/components/engine/vendor/github.com/golang/protobuf/ptypes/empty/empty.proto b/components/engine/vendor/github.com/golang/protobuf/ptypes/empty/empty.proto
index 37f4cd10ee..03cacd2330 100644
--- a/components/engine/vendor/github.com/golang/protobuf/ptypes/empty/empty.proto
+++ b/components/engine/vendor/github.com/golang/protobuf/ptypes/empty/empty.proto
@@ -37,7 +37,6 @@ option go_package = "github.com/golang/protobuf/ptypes/empty";
 option java_package = "com.google.protobuf";
 option java_outer_classname = "EmptyProto";
 option java_multiple_files = true;
-option java_generate_equals_and_hash = true;
 option objc_class_prefix = "GPB";
 option cc_enable_arenas = true;
 
diff --git a/components/engine/vendor/github.com/golang/protobuf/ptypes/struct/struct.pb.go b/components/engine/vendor/github.com/golang/protobuf/ptypes/struct/struct.pb.go
index 197042ed52..35a8ec5994 100644
--- a/components/engine/vendor/github.com/golang/protobuf/ptypes/struct/struct.pb.go
+++ b/components/engine/vendor/github.com/golang/protobuf/ptypes/struct/struct.pb.go
@@ -1,6 +1,5 @@
-// Code generated by protoc-gen-go.
+// Code generated by protoc-gen-go. DO NOT EDIT.
 // source: github.com/golang/protobuf/ptypes/struct/struct.proto
-// DO NOT EDIT!
 
 /*
 Package structpb is a generated protocol buffer package.
@@ -352,31 +351,32 @@ func init() {
 }
 
 var fileDescriptor0 = []byte{
-	// 416 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x8c, 0x92, 0x41, 0x8b, 0xd3, 0x40,
+	// 417 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x92, 0x41, 0x8b, 0xd3, 0x40,
 	0x14, 0x80, 0x3b, 0xc9, 0x36, 0x98, 0x17, 0x59, 0x97, 0x11, 0xb4, 0xac, 0xa0, 0xa1, 0x7b, 0x09,
 	0x22, 0x09, 0x56, 0x04, 0x31, 0x5e, 0x0c, 0xac, 0xbb, 0x60, 0x58, 0x62, 0x74, 0x57, 0xf0, 0x52,
-	0x9a, 0x34, 0x8d, 0xa1, 0xd3, 0x99, 0x90, 0xcc, 0x28, 0x3d, 0xfa, 0x2f, 0x3c, 0x8a, 0x47, 0x8f,
-	0xfe, 0x42, 0x99, 0x99, 0x24, 0x4a, 0x4b, 0xc1, 0xd3, 0xf4, 0xbd, 0xf9, 0xde, 0x37, 0xef, 0xbd,
-	0x06, 0x9e, 0x97, 0x15, 0xff, 0x2c, 0x32, 0x3f, 0x67, 0x9b, 0xa0, 0x64, 0x64, 0x41, 0xcb, 0xa0,
-	0x6e, 0x18, 0x67, 0x99, 0x58, 0x05, 0x35, 0xdf, 0xd6, 0x45, 0x1b, 0xb4, 0xbc, 0x11, 0x39, 0xef,
-	0x0e, 0x5f, 0xdd, 0xe2, 0x3b, 0x25, 0x63, 0x25, 0x29, 0xfc, 0x9e, 0x9d, 0x7e, 0x47, 0x60, 0xbd,
-	0x57, 0x04, 0x0e, 0xc1, 0x5a, 0x55, 0x05, 0x59, 0xb6, 0x13, 0xe4, 0x9a, 0x9e, 0x33, 0x3b, 0xf3,
-	0x77, 0x60, 0x5f, 0x83, 0xfe, 0x1b, 0x45, 0x9d, 0x53, 0xde, 0x6c, 0xd3, 0xae, 0xe4, 0xf4, 0x1d,
-	0x38, 0xff, 0xa4, 0xf1, 0x09, 0x98, 0xeb, 0x62, 0x3b, 0x41, 0x2e, 0xf2, 0xec, 0x54, 0xfe, 0xc4,
-	0x4f, 0x60, 0xfc, 0x65, 0x41, 0x44, 0x31, 0x31, 0x5c, 0xe4, 0x39, 0xb3, 0x7b, 0x7b, 0xf2, 0x1b,
-	0x79, 0x9b, 0x6a, 0xe8, 0xa5, 0xf1, 0x02, 0x4d, 0x7f, 0x1b, 0x30, 0x56, 0x49, 0x1c, 0x02, 0x50,
-	0x41, 0xc8, 0x5c, 0x0b, 0xa4, 0xf4, 0x78, 0x76, 0xba, 0x27, 0xb8, 0x12, 0x84, 0x28, 0xfe, 0x72,
-	0x94, 0xda, 0xb4, 0x0f, 0xf0, 0x19, 0xdc, 0xa6, 0x62, 0x93, 0x15, 0xcd, 0xfc, 0xef, 0xfb, 0xe8,
-	0x72, 0x94, 0x3a, 0x3a, 0x3b, 0x40, 0x2d, 0x6f, 0x2a, 0x5a, 0x76, 0x90, 0x29, 0x1b, 0x97, 0x90,
-	0xce, 0x6a, 0xe8, 0x11, 0x40, 0xc6, 0x58, 0xdf, 0xc6, 0x91, 0x8b, 0xbc, 0x5b, 0xf2, 0x29, 0x99,
-	0xd3, 0xc0, 0x2b, 0x65, 0x11, 0x39, 0xef, 0x90, 0xb1, 0x1a, 0xf5, 0xfe, 0x81, 0x3d, 0x76, 0x7a,
-	0x91, 0xf3, 0x61, 0x4a, 0x52, 0xb5, 0x7d, 0xad, 0xa5, 0x6a, 0xf7, 0xa7, 0x8c, 0xab, 0x96, 0x0f,
-	0x53, 0x92, 0x3e, 0x88, 0x2c, 0x38, 0x5a, 0x57, 0x74, 0x39, 0x0d, 0xc1, 0x1e, 0x08, 0xec, 0x83,
-	0xa5, 0x64, 0xfd, 0x3f, 0x7a, 0x68, 0xe9, 0x1d, 0xf5, 0xf8, 0x01, 0xd8, 0xc3, 0x12, 0xf1, 0x31,
-	0xc0, 0xd5, 0x75, 0x1c, 0xcf, 0x6f, 0x5e, 0xc7, 0xd7, 0xe7, 0x27, 0xa3, 0xe8, 0x1b, 0x82, 0xbb,
-	0x39, 0xdb, 0xec, 0x2a, 0x22, 0x47, 0x4f, 0x93, 0xc8, 0x38, 0x41, 0x9f, 0x9e, 0xfe, 0xef, 0x87,
-	0x19, 0xea, 0xa3, 0xce, 0x7e, 0x20, 0xf4, 0xd3, 0x30, 0x2f, 0x92, 0xe8, 0x97, 0xf1, 0xf0, 0x42,
-	0xcb, 0x93, 0xbe, 0xbf, 0x8f, 0x05, 0x21, 0x6f, 0x29, 0xfb, 0x4a, 0x3f, 0xc8, 0xca, 0xcc, 0x52,
-	0xaa, 0x67, 0x7f, 0x02, 0x00, 0x00, 0xff, 0xff, 0xbc, 0xcf, 0x6d, 0x50, 0xfe, 0x02, 0x00, 0x00,
+	0x9a, 0x34, 0x8d, 0xa1, 0xd3, 0x99, 0x90, 0xcc, 0x28, 0x3d, 0xfa, 0x2f, 0x3c, 0x7b, 0xf4, 0xe8,
+	0xaf, 0xf3, 0x28, 0x33, 0x93, 0x44, 0x69, 0x29, 0x78, 0x9a, 0xbe, 0x37, 0xdf, 0xfb, 0xe6, 0xbd,
+	0xd7, 0xc0, 0xf3, 0xb2, 0xe2, 0x9f, 0x45, 0xe6, 0xe7, 0x6c, 0x13, 0x94, 0x8c, 0x2c, 0x68, 0x19,
+	0xd4, 0x0d, 0xe3, 0x2c, 0x13, 0xab, 0xa0, 0xe6, 0xdb, 0xba, 0x68, 0x83, 0x96, 0x37, 0x22, 0xe7,
+	0xdd, 0xe1, 0xab, 0x5b, 0x7c, 0xa7, 0x64, 0xac, 0x24, 0x85, 0xdf, 0xb3, 0xd3, 0xef, 0x08, 0xac,
+	0xf7, 0x8a, 0xc0, 0x21, 0x58, 0xab, 0xaa, 0x20, 0xcb, 0x76, 0x82, 0x5c, 0xd3, 0x73, 0x66, 0x67,
+	0xfe, 0x0e, 0xec, 0x6b, 0xd0, 0x7f, 0xa3, 0xa8, 0x73, 0xca, 0x9b, 0x6d, 0xda, 0x95, 0x9c, 0xbe,
+	0x03, 0xe7, 0x9f, 0x34, 0x3e, 0x01, 0x73, 0x5d, 0x6c, 0x27, 0xc8, 0x45, 0x9e, 0x9d, 0xca, 0x9f,
+	0xf8, 0x09, 0x8c, 0xbf, 0x2c, 0x88, 0x28, 0x26, 0x86, 0x8b, 0x3c, 0x67, 0x76, 0x6f, 0x4f, 0x7e,
+	0x23, 0x6f, 0x53, 0x0d, 0xbd, 0x34, 0x5e, 0xa0, 0xe9, 0x2f, 0x03, 0xc6, 0x2a, 0x89, 0x43, 0x00,
+	0x2a, 0x08, 0x99, 0x6b, 0x81, 0x94, 0x1e, 0xcf, 0x4e, 0xf7, 0x04, 0x57, 0x82, 0x10, 0xc5, 0x5f,
+	0x8e, 0x52, 0x9b, 0xf6, 0x01, 0x3e, 0x83, 0xdb, 0x54, 0x6c, 0xb2, 0xa2, 0x99, 0xff, 0x7d, 0x1f,
+	0x5d, 0x8e, 0x52, 0x47, 0x67, 0x07, 0xa8, 0xe5, 0x4d, 0x45, 0xcb, 0x0e, 0x32, 0x65, 0xe3, 0x12,
+	0xd2, 0x59, 0x0d, 0x3d, 0x02, 0xc8, 0x18, 0xeb, 0xdb, 0x38, 0x72, 0x91, 0x77, 0x4b, 0x3e, 0x25,
+	0x73, 0x1a, 0x78, 0xa5, 0x2c, 0x22, 0xe7, 0x1d, 0x32, 0x56, 0xa3, 0xde, 0x3f, 0xb0, 0xc7, 0x4e,
+	0x2f, 0x72, 0x3e, 0x4c, 0x49, 0xaa, 0xb6, 0xaf, 0xb5, 0x54, 0xed, 0xfe, 0x94, 0x71, 0xd5, 0xf2,
+	0x61, 0x4a, 0xd2, 0x07, 0x91, 0x05, 0x47, 0xeb, 0x8a, 0x2e, 0xa7, 0x21, 0xd8, 0x03, 0x81, 0x7d,
+	0xb0, 0x94, 0xac, 0xff, 0x47, 0x0f, 0x2d, 0xbd, 0xa3, 0x1e, 0x3f, 0x00, 0x7b, 0x58, 0x22, 0x3e,
+	0x06, 0xb8, 0xba, 0x8e, 0xe3, 0xf9, 0xcd, 0xeb, 0xf8, 0xfa, 0xfc, 0x64, 0x14, 0x7d, 0x43, 0x70,
+	0x37, 0x67, 0x9b, 0x5d, 0x45, 0xe4, 0xe8, 0x69, 0x12, 0x19, 0x27, 0xe8, 0xd3, 0xd3, 0xff, 0xfd,
+	0x30, 0x43, 0x7d, 0xd4, 0xd9, 0x6f, 0x84, 0x7e, 0x18, 0xe6, 0x45, 0x12, 0xfd, 0x34, 0x1e, 0x5e,
+	0x68, 0x79, 0xd2, 0xf7, 0xf7, 0xb1, 0x20, 0xe4, 0x2d, 0x65, 0x5f, 0xe9, 0x07, 0x59, 0x99, 0x59,
+	0x4a, 0xf5, 0xec, 0x4f, 0x00, 0x00, 0x00, 0xff, 0xff, 0x9b, 0x6e, 0x5d, 0x3c, 0xfe, 0x02, 0x00,
+	0x00,
 }
diff --git a/components/engine/vendor/github.com/golang/protobuf/ptypes/struct/struct.proto b/components/engine/vendor/github.com/golang/protobuf/ptypes/struct/struct.proto
index beeba81188..7d7808e7fb 100644
--- a/components/engine/vendor/github.com/golang/protobuf/ptypes/struct/struct.proto
+++ b/components/engine/vendor/github.com/golang/protobuf/ptypes/struct/struct.proto
@@ -33,11 +33,11 @@ syntax = "proto3";
 package google.protobuf;
 
 option csharp_namespace = "Google.Protobuf.WellKnownTypes";
+option cc_enable_arenas = true;
 option go_package = "github.com/golang/protobuf/ptypes/struct;structpb";
 option java_package = "com.google.protobuf";
 option java_outer_classname = "StructProto";
 option java_multiple_files = true;
-option java_generate_equals_and_hash = true;
 option objc_class_prefix = "GPB";
 
 
diff --git a/components/engine/vendor/github.com/golang/protobuf/ptypes/timestamp/timestamp.pb.go b/components/engine/vendor/github.com/golang/protobuf/ptypes/timestamp/timestamp.pb.go
index ffcc51594a..3b76261ec5 100644
--- a/components/engine/vendor/github.com/golang/protobuf/ptypes/timestamp/timestamp.pb.go
+++ b/components/engine/vendor/github.com/golang/protobuf/ptypes/timestamp/timestamp.pb.go
@@ -1,6 +1,5 @@
-// Code generated by protoc-gen-go.
+// Code generated by protoc-gen-go. DO NOT EDIT.
 // source: github.com/golang/protobuf/ptypes/timestamp/timestamp.proto
-// DO NOT EDIT!
 
 /*
 Package timestamp is a generated protocol buffer package.
@@ -40,6 +39,8 @@ const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
 // and from  RFC 3339 date strings.
 // See [https://www.ietf.org/rfc/rfc3339.txt](https://www.ietf.org/rfc/rfc3339.txt).
 //
+// # Examples
+//
 // Example 1: Compute Timestamp from POSIX `time()`.
 //
 //     Timestamp timestamp;
@@ -77,15 +78,36 @@ const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
 //
 // Example 5: Compute Timestamp from current time in Python.
 //
-//     now = time.time()
-//     seconds = int(now)
-//     nanos = int((now - seconds) * 10**9)
-//     timestamp = Timestamp(seconds=seconds, nanos=nanos)
+//     timestamp = Timestamp()
+//     timestamp.GetCurrentTime()
+//
+// # JSON Mapping
+//
+// In JSON format, the Timestamp type is encoded as a string in the
+// [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the
+// format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z"
+// where {year} is always expressed using four digits while {month}, {day},
+// {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional
+// seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),
+// are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone
+// is required, though only UTC (as indicated by "Z") is presently supported.
+//
+// For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past
+// 01:30 UTC on January 15, 2017.
+//
+// In JavaScript, one can convert a Date object to this format using the
+// standard [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString]
+// method. In Python, a standard `datetime.datetime` object can be converted
+// to this format using [`strftime`](https://docs.python.org/2/library/time.html#time.strftime)
+// with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one
+// can use the Joda Time's [`ISODateTimeFormat.dateTime()`](
+// http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime())
+// to obtain a formatter capable of generating timestamps in this format.
 //
 //
 type Timestamp struct {
 	// Represents seconds of UTC time since Unix epoch
-	// 1970-01-01T00:00:00Z. Must be from from 0001-01-01T00:00:00Z to
+	// 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
 	// 9999-12-31T23:59:59Z inclusive.
 	Seconds int64 `protobuf:"varint,1,opt,name=seconds" json:"seconds,omitempty"`
 	// Non-negative fractions of a second at nanosecond resolution. Negative
@@ -101,6 +123,20 @@ func (*Timestamp) ProtoMessage()               {}
 func (*Timestamp) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
 func (*Timestamp) XXX_WellKnownType() string   { return "Timestamp" }
 
+func (m *Timestamp) GetSeconds() int64 {
+	if m != nil {
+		return m.Seconds
+	}
+	return 0
+}
+
+func (m *Timestamp) GetNanos() int32 {
+	if m != nil {
+		return m.Nanos
+	}
+	return 0
+}
+
 func init() {
 	proto.RegisterType((*Timestamp)(nil), "google.protobuf.Timestamp")
 }
@@ -110,18 +146,17 @@ func init() {
 }
 
 var fileDescriptor0 = []byte{
-	// 194 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xe2, 0xb2, 0x4e, 0xcf, 0x2c, 0xc9,
+	// 190 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0xb2, 0x4e, 0xcf, 0x2c, 0xc9,
 	0x28, 0x4d, 0xd2, 0x4b, 0xce, 0xcf, 0xd5, 0x4f, 0xcf, 0xcf, 0x49, 0xcc, 0x4b, 0xd7, 0x2f, 0x28,
 	0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x2f, 0x28, 0xa9, 0x2c, 0x48, 0x2d, 0xd6, 0x2f, 0xc9,
 	0xcc, 0x4d, 0x2d, 0x2e, 0x49, 0xcc, 0x2d, 0x40, 0xb0, 0xf4, 0xc0, 0x6a, 0x84, 0xf8, 0xd3, 0xf3,
 	0xf3, 0xd3, 0x73, 0x52, 0xf5, 0x60, 0x3a, 0x94, 0xac, 0xb9, 0x38, 0x43, 0x60, 0x6a, 0x84, 0x24,
 	0xb8, 0xd8, 0x8b, 0x53, 0x93, 0xf3, 0xf3, 0x52, 0x8a, 0x25, 0x18, 0x15, 0x18, 0x35, 0x98, 0x83,
 	0x60, 0x5c, 0x21, 0x11, 0x2e, 0xd6, 0xbc, 0xc4, 0xbc, 0xfc, 0x62, 0x09, 0x26, 0x05, 0x46, 0x0d,
-	0xd6, 0x20, 0x08, 0xc7, 0xa9, 0x91, 0x91, 0x4b, 0x38, 0x39, 0x3f, 0x57, 0x0f, 0xcd, 0x50, 0x27,
-	0x3e, 0xb8, 0x91, 0x01, 0x20, 0xa1, 0x00, 0xc6, 0x28, 0x6d, 0x12, 0x1c, 0xbd, 0x80, 0x91, 0xf1,
-	0x07, 0x23, 0xe3, 0x22, 0x26, 0x66, 0xf7, 0x00, 0xa7, 0x55, 0x4c, 0x72, 0xee, 0x10, 0xc3, 0x03,
-	0xa0, 0xca, 0xf5, 0xc2, 0x53, 0x73, 0x72, 0xbc, 0xf3, 0xf2, 0xcb, 0xf3, 0x42, 0x40, 0xda, 0x92,
-	0xd8, 0xc0, 0xe6, 0x18, 0x03, 0x02, 0x00, 0x00, 0xff, 0xff, 0x17, 0x5f, 0xb7, 0xdc, 0x17, 0x01,
-	0x00, 0x00,
+	0xd6, 0x20, 0x08, 0xc7, 0xa9, 0x8e, 0x4b, 0x38, 0x39, 0x3f, 0x57, 0x0f, 0xcd, 0x4c, 0x27, 0x3e,
+	0xb8, 0x89, 0x01, 0x20, 0xa1, 0x00, 0xc6, 0x28, 0x6d, 0x12, 0xdc, 0xfc, 0x83, 0x91, 0x71, 0x11,
+	0x13, 0xb3, 0x7b, 0x80, 0xd3, 0x2a, 0x26, 0x39, 0x77, 0x88, 0xc9, 0x01, 0x50, 0xb5, 0x7a, 0xe1,
+	0xa9, 0x39, 0x39, 0xde, 0x79, 0xf9, 0xe5, 0x79, 0x21, 0x20, 0x3d, 0x49, 0x6c, 0x60, 0x43, 0x8c,
+	0x01, 0x01, 0x00, 0x00, 0xff, 0xff, 0x6b, 0x59, 0x0a, 0x4d, 0x13, 0x01, 0x00, 0x00,
 }
diff --git a/components/engine/vendor/github.com/golang/protobuf/ptypes/timestamp/timestamp.proto b/components/engine/vendor/github.com/golang/protobuf/ptypes/timestamp/timestamp.proto
index 7992a85886..b7cbd17502 100644
--- a/components/engine/vendor/github.com/golang/protobuf/ptypes/timestamp/timestamp.proto
+++ b/components/engine/vendor/github.com/golang/protobuf/ptypes/timestamp/timestamp.proto
@@ -38,7 +38,6 @@ option go_package = "github.com/golang/protobuf/ptypes/timestamp";
 option java_package = "com.google.protobuf";
 option java_outer_classname = "TimestampProto";
 option java_multiple_files = true;
-option java_generate_equals_and_hash = true;
 option objc_class_prefix = "GPB";
 
 // A Timestamp represents a point in time independent of any time zone
@@ -53,6 +52,8 @@ option objc_class_prefix = "GPB";
 // and from  RFC 3339 date strings.
 // See [https://www.ietf.org/rfc/rfc3339.txt](https://www.ietf.org/rfc/rfc3339.txt).
 //
+// # Examples
+//
 // Example 1: Compute Timestamp from POSIX `time()`.
 //
 //     Timestamp timestamp;
@@ -90,16 +91,37 @@ option objc_class_prefix = "GPB";
 //
 // Example 5: Compute Timestamp from current time in Python.
 //
-//     now = time.time()
-//     seconds = int(now)
-//     nanos = int((now - seconds) * 10**9)
-//     timestamp = Timestamp(seconds=seconds, nanos=nanos)
+//     timestamp = Timestamp()
+//     timestamp.GetCurrentTime()
+//
+// # JSON Mapping
+//
+// In JSON format, the Timestamp type is encoded as a string in the
+// [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the
+// format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z"
+// where {year} is always expressed using four digits while {month}, {day},
+// {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional
+// seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),
+// are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone
+// is required, though only UTC (as indicated by "Z") is presently supported.
+//
+// For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past
+// 01:30 UTC on January 15, 2017.
+//
+// In JavaScript, one can convert a Date object to this format using the
+// standard [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString]
+// method. In Python, a standard `datetime.datetime` object can be converted
+// to this format using [`strftime`](https://docs.python.org/2/library/time.html#time.strftime)
+// with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one
+// can use the Joda Time's [`ISODateTimeFormat.dateTime()`](
+// http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime())
+// to obtain a formatter capable of generating timestamps in this format.
 //
 //
 message Timestamp {
 
   // Represents seconds of UTC time since Unix epoch
-  // 1970-01-01T00:00:00Z. Must be from from 0001-01-01T00:00:00Z to
+  // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
   // 9999-12-31T23:59:59Z inclusive.
   int64 seconds = 1;
 
diff --git a/components/engine/vendor/github.com/jhowardmsft/opengcs/LICENSE b/components/engine/vendor/github.com/jhowardmsft/opengcs/LICENSE
new file mode 100644
index 0000000000..8739a025ea
--- /dev/null
+++ b/components/engine/vendor/github.com/jhowardmsft/opengcs/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 Microsoft
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
\ No newline at end of file
diff --git a/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/config.go b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/config.go
new file mode 100644
index 0000000000..830d37bef0
--- /dev/null
+++ b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/config.go
@@ -0,0 +1,237 @@
+// +build windows
+
+package client
+
+// TODO @jhowardmsft - This will move to Microsoft/opengcs soon
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/Microsoft/hcsshim"
+	"github.com/Sirupsen/logrus"
+)
+
+// Mode is the operational mode, both requested, and actual after verification
+type Mode uint
+
+const (
+	// Constants for the actual mode after validation
+
+	// ModeActualError means an error has occurred during validation
+	ModeActualError = iota
+	// ModeActualVhdx means that we are going to use VHDX boot after validation
+	ModeActualVhdx
+	// ModeActualKernelInitrd means that we are going to use kernel+initrd for boot after validation
+	ModeActualKernelInitrd
+
+	// Constants for the requested mode
+
+	// ModeRequestAuto means auto-select the boot mode for a utility VM
+	ModeRequestAuto = iota // VHDX will be priority over kernel+initrd
+	// ModeRequestVhdx means request VHDX boot if possible
+	ModeRequestVhdx
+	// ModeRequestKernelInitrd means request Kernel+initrd boot if possible
+	ModeRequestKernelInitrd
+
+	// defaultUvmTimeoutSeconds is the default time to wait for utility VM operations
+	defaultUvmTimeoutSeconds = 5 * 60
+
+	// DefaultSandboxSizeMB is the size of the default sandbox size in MB
+	DefaultSandboxSizeMB = 20 * 1024 * 1024
+)
+
+// Config is the structure used to configuring a utility VM to be used
+// as a service VM. There are two ways of starting. Either supply a VHD,
+// or a Kernel+Initrd. For the latter, both must be supplied, and both
+// must be in the same directory.
+//
+// VHD is the priority.
+type Config struct {
+	KirdPath          string            // Path to where kernel/initrd are found (defaults to c:\program files\lcow)
+	KernelFile        string            // Kernel for Utility VM (embedded in a UEFI bootloader) - does NOT include full path, just filename
+	InitrdFile        string            // Initrd image for Utility VM - does NOT include full path, just filename
+	Vhdx              string            // VHD for booting the utility VM - is a full path
+	Name              string            // Name of the utility VM
+	RequestedMode     Mode              // What mode is preferred when validating
+	ActualMode        Mode              // What mode was obtained during validation
+	UvmTimeoutSeconds int               // How long to wait for the utility VM to respond in seconds
+	Uvm               hcsshim.Container // The actual container
+}
+
+// GenerateDefault generates a default config from a set of options
+// If baseDir is not supplied, defaults to $env:ProgramFiles\lcow
+func (config *Config) GenerateDefault(options []string) error {
+	if config.UvmTimeoutSeconds < 0 {
+		return fmt.Errorf("opengcs: cannot generate a config when supplied a negative utility VM timeout")
+	}
+
+	envTimeoutSeconds := 0
+	optTimeoutSeconds := 0
+
+	if config.UvmTimeoutSeconds != 0 {
+		envTimeout := os.Getenv("OPENGCS_UVM_TIMEOUT_SECONDS")
+		if len(envTimeout) > 0 {
+			var err error
+			if envTimeoutSeconds, err = strconv.Atoi(envTimeout); err != nil {
+				return fmt.Errorf("opengcs: OPENGCS_UVM_TIMEOUT_SECONDS could not be interpreted as an integer")
+			}
+			if envTimeoutSeconds < 0 {
+				return fmt.Errorf("opengcs: OPENGCS_UVM_TIMEOUT_SECONDS cannot be negative")
+			}
+		}
+	}
+
+	for _, v := range options {
+		opt := strings.SplitN(v, "=", 2)
+		if len(opt) == 2 {
+			switch strings.ToLower(opt[0]) {
+			case "opengcskirdpath":
+				config.KirdPath = opt[1]
+			case "opengcskernel":
+				config.KernelFile = opt[1]
+			case "opengcsinitrd":
+				config.InitrdFile = opt[1]
+			case "opengcsvhdx":
+				config.Vhdx = opt[1]
+			case "opengcstimeoutsecs":
+				var err error
+				if optTimeoutSeconds, err = strconv.Atoi(opt[1]); err != nil {
+					return fmt.Errorf("opengcs: opengcstimeoutsecs option could not be interpreted as an integer")
+				}
+				if optTimeoutSeconds < 0 {
+					return fmt.Errorf("opengcs: opengcstimeoutsecs option cannot be negative")
+				}
+			}
+		}
+	}
+
+	if config.KirdPath == "" {
+		config.KirdPath = filepath.Join(os.Getenv("ProgramFiles"), "lcow")
+	}
+
+	if config.Vhdx == "" {
+		config.Vhdx = filepath.Join(config.KirdPath, `uvm.vhdx`)
+	}
+	if config.KernelFile == "" {
+		config.KernelFile = `bootx64.efi`
+	}
+	if config.InitrdFile == "" {
+		config.InitrdFile = `initrd.img`
+	}
+
+	// Which timeout are we going to take? If not through option or environment,
+	// then use the default constant, otherwise the maximum of the option or
+	// environment supplied setting. A requested on in the config supplied
+	// overrides all of this.
+	if config.UvmTimeoutSeconds == 0 {
+		config.UvmTimeoutSeconds = defaultUvmTimeoutSeconds
+		if optTimeoutSeconds != 0 || envTimeoutSeconds != 0 {
+			config.UvmTimeoutSeconds = optTimeoutSeconds
+			if envTimeoutSeconds > optTimeoutSeconds {
+				config.UvmTimeoutSeconds = envTimeoutSeconds
+			}
+		}
+	}
+
+	return nil
+}
+
+// validate validates a Config structure for starting a utility VM.
+func (config *Config) validate() error {
+	config.ActualMode = ModeActualError
+
+	if config.RequestedMode == ModeRequestVhdx && config.Vhdx == "" {
+		return fmt.Errorf("opengcs: config is invalid - request for VHDX mode did not supply a VHDX")
+	}
+	if config.RequestedMode == ModeRequestKernelInitrd && (config.KernelFile == "" || config.InitrdFile == "") {
+		return fmt.Errorf("opengcs: config is invalid - request for Kernel+Initrd mode must supply both kernel and initrd")
+	}
+
+	// Validate that if VHDX requested or auto, it exists.
+	if config.RequestedMode == ModeRequestAuto || config.RequestedMode == ModeRequestVhdx {
+		if _, err := os.Stat(config.Vhdx); os.IsNotExist(err) {
+			if config.RequestedMode == ModeRequestVhdx {
+				return fmt.Errorf("opengcs: mode requested was VHDX but '%s' could not be found", config.Vhdx)
+			}
+		} else {
+			config.ActualMode = ModeActualVhdx
+			return nil
+		}
+	}
+
+	// So must be kernel+initrd, or auto where we fallback as the VHDX doesn't exist
+	if config.InitrdFile == "" || config.KernelFile == "" {
+		if config.RequestedMode == ModeRequestKernelInitrd {
+			return fmt.Errorf("opengcs: both initrd and kernel options for utility VM boot must be supplied")
+		}
+		return fmt.Errorf("opengcs: configuration is invalid")
+	}
+
+	// Move to validation
+	//if _, err := os.Stat(baseDir); os.IsNotExist(err) {
+	//	return fmt.Errorf("opengcs: cannot create default utility VM configuration as directory '%s' was not found", baseDir)
+	//}
+
+	if _, err := os.Stat(filepath.Join(config.KirdPath, config.KernelFile)); os.IsNotExist(err) {
+		return fmt.Errorf("opengcs: kernel '%s' was not found", filepath.Join(config.KirdPath, config.KernelFile))
+	}
+	if _, err := os.Stat(filepath.Join(config.KirdPath, config.InitrdFile)); os.IsNotExist(err) {
+		return fmt.Errorf("opengcs: initrd '%s' was not found", filepath.Join(config.KirdPath, config.InitrdFile))
+	}
+
+	config.ActualMode = ModeActualKernelInitrd
+	return nil
+}
+
+// Create creates a utility VM from a configuration.
+func (config *Config) Create() error {
+	logrus.Debugf("opengcs Create: %+v", config)
+
+	if err := config.validate(); err != nil {
+		return err
+	}
+
+	configuration := &hcsshim.ContainerConfig{
+		HvPartition:                 true,
+		Name:                        config.Name,
+		SystemType:                  "container",
+		ContainerType:               "linux",
+		TerminateOnLastHandleClosed: true,
+	}
+
+	if config.ActualMode == ModeActualVhdx {
+		configuration.HvRuntime = &hcsshim.HvRuntime{
+			ImagePath: config.Vhdx,
+		}
+	} else {
+		configuration.HvRuntime = &hcsshim.HvRuntime{
+			ImagePath:       config.KirdPath,
+			LinuxInitrdFile: config.InitrdFile,
+			LinuxKernelFile: config.KernelFile,
+		}
+	}
+
+	configurationS, _ := json.Marshal(configuration)
+	logrus.Debugf("opengcs Create: calling HCS with '%s'", string(configurationS))
+	uvm, err := hcsshim.CreateContainer(config.Name, configuration)
+	if err != nil {
+		return err
+	}
+	logrus.Debugf("opengcs Create: uvm created, starting...")
+	err = uvm.Start()
+	if err != nil {
+		logrus.Debugf("opengcs Create: uvm failed to start: %s", err)
+		// Make sure we don't leave it laying around as it's been created in HCS
+		uvm.Terminate()
+		return err
+	}
+
+	config.Uvm = uvm
+	logrus.Debugf("opengcs Create: uvm %s is running", config.Name)
+	return nil
+}
diff --git a/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/createsandbox.go b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/createsandbox.go
new file mode 100644
index 0000000000..66ab703735
--- /dev/null
+++ b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/createsandbox.go
@@ -0,0 +1,78 @@
+// +build windows
+
+package client
+
+// TODO @jhowardmsft - This will move to Microsoft/opengcs soon
+
+import (
+	"fmt"
+	"os"
+	"sync"
+
+	"github.com/Sirupsen/logrus"
+)
+
+var sandboxCacheLock sync.Mutex
+
+// CreateSandbox does what it says on the tin. This is done by copying a prebuilt-sandbox from the ServiceVM
+// TODO: @jhowardmsft maxSizeInMB isn't hooked up in GCS. Needs a platform change which is in flight.
+func (config *Config) CreateSandbox(destFile string, maxSizeInMB uint32, cacheFile string) error {
+	// Smallest we can accept is the default sandbox size as we can't size down, only expand.
+	if maxSizeInMB < DefaultSandboxSizeMB {
+		maxSizeInMB = DefaultSandboxSizeMB
+	}
+
+	logrus.Debugf("opengcs: CreateSandbox: %s size:%dMB cache:%s", destFile, maxSizeInMB, cacheFile)
+
+	// Retrieve from cache if the default size and already on disk
+	if maxSizeInMB == DefaultSandboxSizeMB {
+		sandboxCacheLock.Lock()
+		if _, err := os.Stat(cacheFile); err == nil {
+			if err := copyFile(cacheFile, destFile); err != nil {
+				sandboxCacheLock.Unlock()
+				return fmt.Errorf("opengcs: CreateSandbox: Failed to copy cached sandbox '%s' to '%s': %s", cacheFile, destFile, err)
+			}
+			sandboxCacheLock.Unlock()
+			logrus.Debugf("opengcs: CreateSandbox: %s fulfilled from cache", destFile)
+			return nil
+		}
+		sandboxCacheLock.Unlock()
+	}
+
+	if config.Uvm == nil {
+		return fmt.Errorf("opengcs: CreateSandbox: No utility VM has been created")
+	}
+
+	// TODO @jhowardmsft - needs a platform change so that can specify size. eg fmt.Sprintf("createSandbox -size %d", maxSizeInMB))
+	process, err := config.createUtilsProcess("createSandbox")
+	if err != nil {
+		return fmt.Errorf("opengcs: CreateSandbox: %s: failed to create utils process: %s", destFile, err)
+	}
+
+	defer func() {
+		process.Process.Close()
+	}()
+
+	logrus.Debugf("opengcs: CreateSandbox: %s: writing from stdout", destFile)
+	// Get back the sandbox VHDx stream from the service VM and write it to file
+	resultSize, err := writeFileFromReader(destFile, process.Stdout, config.UvmTimeoutSeconds, fmt.Sprintf("createSandbox %s", destFile))
+	if err != nil {
+		return fmt.Errorf("opengcs: CreateSandbox: %s: failed writing %d bytes to target file: %s", destFile, resultSize, err)
+	}
+
+	// Populate the cache
+	if maxSizeInMB == DefaultSandboxSizeMB {
+		sandboxCacheLock.Lock()
+		// It may already exist due to being created on another thread, in which case no copy back needed.
+		if _, err := os.Stat(cacheFile); os.IsNotExist(err) {
+			if err := copyFile(destFile, cacheFile); err != nil {
+				sandboxCacheLock.Unlock()
+				return fmt.Errorf("opengcs: CreateSandbox: Failed to seed sandbox cache '%s' from '%s': %s", destFile, cacheFile, err)
+			}
+		}
+		sandboxCacheLock.Unlock()
+	}
+
+	logrus.Debugf("opengcs: CreateSandbox: %s created (non-cache)", destFile)
+	return nil
+}
diff --git a/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/hotaddvhd.go b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/hotaddvhd.go
new file mode 100644
index 0000000000..62de79016a
--- /dev/null
+++ b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/hotaddvhd.go
@@ -0,0 +1,41 @@
+// +build windows
+
+package client
+
+// TODO @jhowardmsft - This will move to Microsoft/opengcs soon
+
+import (
+	"fmt"
+
+	"github.com/Microsoft/hcsshim"
+	"github.com/Sirupsen/logrus"
+)
+
+// HotAddVhd hot-adds a VHD to a utility VM. This is used in the global one-utility-VM-
+// service-VM per host scenario. In order to do a graphdriver `Diff`, we hot-add the
+// sandbox to /mnt/<id> so that we can run `exportSandbox` inside the utility VM to
+// get a tar-stream of the sandboxes contents back to the daemon.
+func (config *Config) HotAddVhd(hostPath string, containerPath string) error {
+	logrus.Debugf("opengcs: HotAddVhd: %s: %s", hostPath, containerPath)
+
+	if config.Uvm == nil {
+		return fmt.Errorf("cannot hot-add VHD as no utility VM is in configuration")
+	}
+
+	modification := &hcsshim.ResourceModificationRequestResponse{
+		Resource: "MappedVirtualDisk",
+		Data: hcsshim.MappedVirtualDisk{
+			HostPath:          hostPath,
+			ContainerPath:     containerPath,
+			CreateInUtilityVM: true,
+			//ReadOnly:          true,
+		},
+		Request: "Add",
+	}
+	logrus.Debugf("opengcs: HotAddVhd: %s to %s", hostPath, containerPath)
+	if err := config.Uvm.Modify(modification); err != nil {
+		return fmt.Errorf("opengcs: HotAddVhd: failed: %s", err)
+	}
+	logrus.Debugf("opengcs: HotAddVhd: %s added successfully", hostPath)
+	return nil
+}
diff --git a/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/hotremovevhd.go b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/hotremovevhd.go
new file mode 100644
index 0000000000..71167d00ee
--- /dev/null
+++ b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/hotremovevhd.go
@@ -0,0 +1,36 @@
+// +build windows
+
+package client
+
+// TODO @jhowardmsft - This will move to Microsoft/opengcs soon
+
+import (
+	"fmt"
+
+	"github.com/Microsoft/hcsshim"
+	"github.com/Sirupsen/logrus"
+)
+
+// HotRemoveVhd hot-removes a VHD from a utility VM. This is used in the global one-utility-VM-
+// service-VM per host scenario.
+func (config *Config) HotRemoveVhd(hostPath string) error {
+	logrus.Debugf("opengcs: HotRemoveVhd: %s", hostPath)
+
+	if config.Uvm == nil {
+		return fmt.Errorf("cannot hot-add VHD as no utility VM is in configuration")
+	}
+
+	modification := &hcsshim.ResourceModificationRequestResponse{
+		Resource: "MappedVirtualDisk",
+		Data: hcsshim.MappedVirtualDisk{
+			HostPath:          hostPath,
+			CreateInUtilityVM: true,
+		},
+		Request: "Remove",
+	}
+	if err := config.Uvm.Modify(modification); err != nil {
+		return fmt.Errorf("opengcs: HotRemoveVhd: %s failed: %s", hostPath, err)
+	}
+	logrus.Debugf("opengcs: HotRemoveVhd: %s removed successfully", hostPath)
+	return nil
+}
diff --git a/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/layervhddetails.go b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/layervhddetails.go
new file mode 100644
index 0000000000..6ce29cdc56
--- /dev/null
+++ b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/layervhddetails.go
@@ -0,0 +1,33 @@
+// +build windows
+
+package client
+
+// TODO @jhowardmsft - This will move to Microsoft/opengcs soon
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// LayerVhdDetails is a utility for getting a file name, size and indication of
+// sandbox for a VHD(x) in a folder. A read-only layer will be layer.vhd. A
+// read-write layer will be sandbox.vhdx.
+func LayerVhdDetails(folder string) (string, int64, bool, error) {
+	var fileInfo os.FileInfo
+	isSandbox := false
+	filename := filepath.Join(folder, "layer.vhd")
+	var err error
+
+	if fileInfo, err = os.Stat(filename); err != nil {
+		filename = filepath.Join(folder, "sandbox.vhdx")
+		if fileInfo, err = os.Stat(filename); err != nil {
+			if os.IsNotExist(err) {
+				return "", 0, isSandbox, fmt.Errorf("could not find layer or sandbox in %s", folder)
+			}
+			return "", 0, isSandbox, fmt.Errorf("error locating layer or sandbox in %s: %s", folder, err)
+		}
+		isSandbox = true
+	}
+	return filename, fileInfo.Size(), isSandbox, nil
+}
diff --git a/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/process.go b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/process.go
new file mode 100644
index 0000000000..6592ab6a03
--- /dev/null
+++ b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/process.go
@@ -0,0 +1,61 @@
+// +build windows
+
+package client
+
+// TODO @jhowardmsft - This will move to Microsoft/opengcs soon
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/Microsoft/hcsshim"
+	"github.com/Sirupsen/logrus"
+)
+
+// Process is the structure pertaining to a process running in a utility VM.
+type process struct {
+	Process hcsshim.Process
+	Stdin   io.WriteCloser
+	Stdout  io.ReadCloser
+}
+
+// createUtilsProcess is a convenient wrapper for hcsshim.createUtilsProcess to use when
+// communicating with a utility VM.
+func (config *Config) createUtilsProcess(commandLine string) (process, error) {
+	logrus.Debugf("opengcs: createUtilsProcess")
+
+	if config.Uvm == nil {
+		return process{}, fmt.Errorf("cannot create utils process as no utility VM is in configuration")
+	}
+
+	var (
+		err  error
+		proc process
+	)
+
+	env := make(map[string]string)
+	env["PATH"] = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:"
+	processConfig := &hcsshim.ProcessConfig{
+		EmulateConsole:    false,
+		CreateStdInPipe:   true,
+		CreateStdOutPipe:  true,
+		CreateStdErrPipe:  true,
+		CreateInUtilityVm: true,
+		WorkingDirectory:  "/bin",
+		Environment:       env,
+		CommandLine:       commandLine,
+	}
+	proc.Process, err = config.Uvm.CreateProcess(processConfig)
+	if err != nil {
+		return process{}, fmt.Errorf("opengcs: createUtilsProcess: CreateProcess %+v failed %s", config, err)
+	}
+
+	if proc.Stdin, proc.Stdout, _, err = proc.Process.Stdio(); err != nil {
+		proc.Process.Kill() // Should this have a timeout?
+		proc.Process.Close()
+		return process{}, fmt.Errorf("opengcs: createUtilsProcess: failed to get Stdio pipes %s", err)
+	}
+
+	logrus.Debugf("opengcs: createUtilsProcess success: pid %d", proc.Process.Pid())
+	return proc, nil
+}
diff --git a/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/tartovhd.go b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/tartovhd.go
new file mode 100644
index 0000000000..8832e096e6
--- /dev/null
+++ b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/tartovhd.go
@@ -0,0 +1,44 @@
+// +build windows
+
+package client
+
+// TODO @jhowardmsft - This will move to Microsoft/opengcs soon
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/Sirupsen/logrus"
+)
+
+// TarToVhd streams a tarstream contained in an io.Reader to a fixed vhd file
+func (config *Config) TarToVhd(targetVHDFile string, reader io.Reader) (int64, error) {
+	logrus.Debugf("opengcs: TarToVhd: %s", targetVHDFile)
+
+	if config.Uvm == nil {
+		return 0, fmt.Errorf("cannot Tar2Vhd as no utility VM is in configuration")
+	}
+
+	process, err := config.createUtilsProcess("tar2vhd")
+	if err != nil {
+		return 0, fmt.Errorf("opengcs: TarToVhd: %s: failed to create utils process tar2vhd: %s", targetVHDFile, err)
+	}
+	defer process.Process.Close()
+
+	// Send the tarstream into the `tar2vhd`s stdin
+	if _, err = copyWithTimeout(process.Stdin, reader, 0, config.UvmTimeoutSeconds, fmt.Sprintf("send %s, to stdin of tar2vhd", targetVHDFile)); err != nil {
+		return 0, fmt.Errorf("opengcs: TarToVhd: %s: failed to send to tar2vhd in uvm: %s", targetVHDFile, err)
+	}
+
+	// Don't need stdin now we've sent everything. This signals GCS that we are finished sending data.
+	process.Process.CloseStdin()
+
+	// Write stdout contents of `tar2vhd` to the VHD file
+	payloadSize, err := writeFileFromReader(targetVHDFile, process.Stdout, config.UvmTimeoutSeconds, fmt.Sprintf("output of tar2vhd to %s", targetVHDFile))
+	if err != nil {
+		return 0, fmt.Errorf("opengcs: TarToVhd: %s: failed writing VHD file: %s", targetVHDFile, err)
+	}
+
+	logrus.Debugf("opengcs: TarToVhd: %s created, %d bytes", targetVHDFile, payloadSize)
+	return payloadSize, err
+}
diff --git a/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/unsupported.go b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/unsupported.go
new file mode 100644
index 0000000000..4a7abab3b0
--- /dev/null
+++ b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/unsupported.go
@@ -0,0 +1,5 @@
+// +build !windows
+
+package client
+
+// TODO @jhowardmsft - This will move to Microsoft/opengcs soon
diff --git a/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/utilities.go b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/utilities.go
new file mode 100644
index 0000000000..427cde7795
--- /dev/null
+++ b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/utilities.go
@@ -0,0 +1,110 @@
+// +build windows
+
+package client
+
+// TODO @jhowardmsft - This will move to Microsoft/opengcs soon
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"syscall"
+	"time"
+	"unsafe"
+
+	"github.com/Sirupsen/logrus"
+)
+
+var (
+	modkernel32   = syscall.NewLazyDLL("kernel32.dll")
+	procCopyFileW = modkernel32.NewProc("CopyFileW")
+)
+
+// writeFileFromReader writes an output file from an io.Reader
+func writeFileFromReader(path string, reader io.Reader, timeoutSeconds int, context string) (int64, error) {
+	outFile, err := os.Create(path)
+	if err != nil {
+		return 0, fmt.Errorf("opengcs: writeFileFromReader: failed to create %s: %s", path, err)
+	}
+	defer outFile.Close()
+	return copyWithTimeout(outFile, reader, 0, timeoutSeconds, context)
+}
+
+// copyWithTimeout is a wrapper for io.Copy using a timeout duration
+func copyWithTimeout(dst io.Writer, src io.Reader, size int64, timeoutSeconds int, context string) (int64, error) {
+	logrus.Debugf("opengcs: copywithtimeout: size %d: timeout %d: (%s)", size, timeoutSeconds, context)
+
+	type resultType struct {
+		err   error
+		bytes int64
+	}
+
+	done := make(chan resultType, 1)
+	go func() {
+		// TODO @jhowardmsft. Needs platform fix. Improve reliability by
+		// chunking the data. Ultimately can just use io.Copy instead with no loop
+		result := resultType{}
+		var copied int64
+		for {
+			copied, result.err = io.CopyN(dst, src, 1024)
+			result.bytes += copied
+			if copied == 0 {
+				done <- result
+				break
+			}
+			// TODO @jhowardmsft - next line is debugging only. Remove
+			//logrus.Debugf("%s: copied so far %d\n", context, result.bytes)
+		}
+	}()
+
+	var result resultType
+	timedout := time.After(time.Duration(timeoutSeconds) * time.Second)
+
+	select {
+	case <-timedout:
+		return 0, fmt.Errorf("opengcs: copyWithTimeout: timed out (%s)", context)
+	case result = <-done:
+		if result.err != nil && result.err != io.EOF {
+			// See https://github.com/golang/go/blob/f3f29d1dea525f48995c1693c609f5e67c046893/src/os/exec/exec_windows.go for a clue as to why we are doing this :)
+			if se, ok := result.err.(syscall.Errno); ok {
+				const (
+					errNoData     = syscall.Errno(232)
+					errBrokenPipe = syscall.Errno(109)
+				)
+				if se == errNoData || se == errBrokenPipe {
+					logrus.Debugf("opengcs: copyWithTimeout: hit NoData or BrokenPipe: %d: %s", se, context)
+					return result.bytes, nil
+				}
+			}
+			return 0, fmt.Errorf("opengcs: copyWithTimeout: error reading: '%s' after %d bytes (%s)", result.err, result.bytes, context)
+		}
+	}
+	logrus.Debugf("opengcs: copyWithTimeout: success - copied %d bytes (%s)", result.bytes, context)
+	return result.bytes, nil
+}
+
+// copyFile is a utility for copying a file - used for the sandbox cache.
+// Uses CopyFileW win32 API for performance
+func copyFile(srcFile, destFile string) error {
+	var bFailIfExists uint32 = 1
+
+	lpExistingFileName, err := syscall.UTF16PtrFromString(srcFile)
+	if err != nil {
+		return err
+	}
+	lpNewFileName, err := syscall.UTF16PtrFromString(destFile)
+	if err != nil {
+		return err
+	}
+	r1, _, err := syscall.Syscall(
+		procCopyFileW.Addr(),
+		3,
+		uintptr(unsafe.Pointer(lpExistingFileName)),
+		uintptr(unsafe.Pointer(lpNewFileName)),
+		uintptr(bFailIfExists))
+	if r1 == 0 {
+		return fmt.Errorf("failed CopyFileW Win32 call from '%s' to %s: %s", srcFile, destFile, err)
+	}
+	return nil
+
+}
diff --git a/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/vhdtotar.go b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/vhdtotar.go
new file mode 100644
index 0000000000..9504fb7c84
--- /dev/null
+++ b/components/engine/vendor/github.com/jhowardmsft/opengcs/gogcs/client/vhdtotar.go
@@ -0,0 +1,69 @@
+// +build windows
+
+package client
+
+// TODO @jhowardmsft - This will move to Microsoft/opengcs soon
+
+import (
+	"fmt"
+	"io"
+	"os"
+
+	"github.com/Sirupsen/logrus"
+)
+
+// VhdToTar does what is says - it exports a VHD in a specified
+// folder (either a read-only layer.vhd, or a read-write sandbox.vhd) to a
+// ReadCloser containing a tar-stream of the layers contents.
+func (config *Config) VhdToTar(vhdFile string, uvmMountPath string, isSandbox bool, vhdSize int64) (io.ReadCloser, error) {
+	logrus.Debugf("opengcs: VhdToTar: %s isSandbox: %t", vhdFile, isSandbox)
+
+	if config.Uvm == nil {
+		return nil, fmt.Errorf("cannot VhdToTar as no utility VM is in configuration")
+	}
+
+	vhdHandle, err := os.Open(vhdFile)
+	if err != nil {
+		return nil, fmt.Errorf("opengcs: VhdToTar: failed to open %s: %s", vhdFile, err)
+	}
+	defer vhdHandle.Close()
+	logrus.Debugf("opengcs: VhdToTar: exporting %s, size %d, isSandbox %t", vhdHandle.Name(), vhdSize, isSandbox)
+
+	// Different binary depending on whether a RO layer or a RW sandbox
+	command := "vhd2tar"
+	if isSandbox {
+		command = fmt.Sprintf("exportSandbox -path %s", uvmMountPath)
+	}
+
+	// Start the binary in the utility VM
+	process, err := config.createUtilsProcess(command)
+	if err != nil {
+		return nil, fmt.Errorf("opengcs: VhdToTar: %s: failed to create utils process %s: %s", vhdHandle.Name(), command, err)
+	}
+
+	if !isSandbox {
+		// Send the VHD contents to the utility VM processes stdin handle if not a sandbox
+		logrus.Debugf("opengcs: VhdToTar: copying the layer VHD into the utility VM")
+		if _, err = copyWithTimeout(process.Stdin, vhdHandle, vhdSize, config.UvmTimeoutSeconds, fmt.Sprintf("vhdtotarstream: sending %s to %s", vhdHandle.Name(), command)); err != nil {
+			process.Process.Close()
+			return nil, fmt.Errorf("opengcs: VhdToTar: %s: failed to copyWithTimeout on the stdin pipe (to utility VM): %s", vhdHandle.Name(), err)
+		}
+	}
+
+	// Start a goroutine which copies the stdout (ie the tar stream)
+	reader, writer := io.Pipe()
+	go func() {
+		defer writer.Close()
+		defer process.Process.Close()
+		logrus.Debugf("opengcs: VhdToTar: copying tar stream back from the utility VM")
+		bytes, err := copyWithTimeout(writer, process.Stdout, vhdSize, config.UvmTimeoutSeconds, fmt.Sprintf("vhdtotarstream: copy tarstream from %s", command))
+		if err != nil {
+			logrus.Errorf("opengcs: VhdToTar: %s:  copyWithTimeout on the stdout pipe (from utility VM) failed: %s", vhdHandle.Name(), err)
+		}
+		logrus.Debugf("opengcs: VhdToTar: copied %d bytes of the tarstream of %s from the utility VM", bytes, vhdHandle.Name())
+	}()
+
+	// Return the read-side of the pipe connected to the goroutine which is reading from the stdout of the process in the utility VM
+	return reader, nil
+
+}
diff --git a/components/engine/vendor/github.com/miekg/pkcs11/LICENSE b/components/engine/vendor/github.com/miekg/pkcs11/LICENSE
deleted file mode 100644
index ce25d13ab8..0000000000
--- a/components/engine/vendor/github.com/miekg/pkcs11/LICENSE
+++ /dev/null
@@ -1,27 +0,0 @@
-Copyright (c) 2013 Miek Gieben. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-   * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-   * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-   * Neither the name of Miek Gieben nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/components/engine/vendor/github.com/miekg/pkcs11/README.md b/components/engine/vendor/github.com/miekg/pkcs11/README.md
deleted file mode 100644
index f41c474394..0000000000
--- a/components/engine/vendor/github.com/miekg/pkcs11/README.md
+++ /dev/null
@@ -1,64 +0,0 @@
-# PKCS#11 [![Build Status](https://travis-ci.org/miekg/pkcs11.png?branch=master)](https://travis-ci.org/miekg/pkcs11)
-
-This is a Go implementation of the PKCS#11 API. It wraps the library closely, but uses Go idiom
-were it makes sense. It has been tested with SoftHSM.
-
-## SoftHSM
-
-* Make it use a custom configuration file `export SOFTHSM_CONF=$PWD/softhsm.conf`
-
-* Then use `softhsm` to init it
-
-        softhsm --init-token --slot 0 --label test --pin 1234
-
-* Then use `libsofthsm.so` as the pkcs11 module:
-
-        p := pkcs11.New("/usr/lib/softhsm/libsofthsm.so")
-
-## Examples
-
-A skeleton program would look somewhat like this (yes, pkcs#11 is verbose):
-
-    p := pkcs11.New("/usr/lib/softhsm/libsofthsm.so")
-    err := p.Initialize()
-    if err != nil {
-        panic(err)
-    }
-
-    defer p.Destroy()
-    defer p.Finalize()
-
-    slots, err := p.GetSlotList(true)
-    if err != nil {
-        panic(err)
-    }
-
-    session, err := p.OpenSession(slots[0], pkcs11.CKF_SERIAL_SESSION|pkcs11.CKF_RW_SESSION)
-    if err != nil {
-        panic(err)
-    }
-    defer p.CloseSession(session)
-
-    err = p.Login(session, pkcs11.CKU_USER, "1234")
-    if err != nil {
-        panic(err)
-    }
-    defer p.Logout(session)
-
-    p.DigestInit(session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_SHA_1, nil)})
-    hash, err := p.Digest(session, []byte("this is a string"))
-    if err != nil {
-        panic(err)
-    }
-
-    for _, d := range hash {
-            fmt.Printf("%x", d)
-    }
-    fmt.Println()
-
-Further examples are included in the tests.
-
-# TODO
-
-* Fix/double check endian stuff, see types.go NewAttribute()
-* Look at the memory copying in fast functions (sign, hash etc)
diff --git a/components/engine/vendor/github.com/miekg/pkcs11/const.go b/components/engine/vendor/github.com/miekg/pkcs11/const.go
deleted file mode 100644
index 5901b602cd..0000000000
--- a/components/engine/vendor/github.com/miekg/pkcs11/const.go
+++ /dev/null
@@ -1,565 +0,0 @@
-// Copyright 2013 Miek Gieben. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package pkcs11
-
-const (
-	CKU_SO               uint = 0
-	CKU_USER             uint = 1
-	CKU_CONTEXT_SPECIFIC uint = 2
-)
-
-const (
-	CKO_DATA              uint = 0x00000000
-	CKO_CERTIFICATE       uint = 0x00000001
-	CKO_PUBLIC_KEY        uint = 0x00000002
-	CKO_PRIVATE_KEY       uint = 0x00000003
-	CKO_SECRET_KEY        uint = 0x00000004
-	CKO_HW_FEATURE        uint = 0x00000005
-	CKO_DOMAIN_PARAMETERS uint = 0x00000006
-	CKO_MECHANISM         uint = 0x00000007
-	CKO_OTP_KEY           uint = 0x00000008
-	CKO_VENDOR_DEFINED    uint = 0x80000000
-)
-
-// Generated with: awk '/#define CK[AFKMRC]/{ print $2 "=" $3 }' pkcs11t.h
-
-// All the flag (CKF_), attribute (CKA_), error code (CKR_), key type (CKK_), certificate type (CKC_) and
-// mechanism (CKM_) constants as defined in PKCS#11.
-const (
-	CKF_TOKEN_PRESENT                    = 0x00000001
-	CKF_REMOVABLE_DEVICE                 = 0x00000002
-	CKF_HW_SLOT                          = 0x00000004
-	CKF_RNG                              = 0x00000001
-	CKF_WRITE_PROTECTED                  = 0x00000002
-	CKF_LOGIN_REQUIRED                   = 0x00000004
-	CKF_USER_PIN_INITIALIZED             = 0x00000008
-	CKF_RESTORE_KEY_NOT_NEEDED           = 0x00000020
-	CKF_CLOCK_ON_TOKEN                   = 0x00000040
-	CKF_PROTECTED_AUTHENTICATION_PATH    = 0x00000100
-	CKF_DUAL_CRYPTO_OPERATIONS           = 0x00000200
-	CKF_TOKEN_INITIALIZED                = 0x00000400
-	CKF_SECONDARY_AUTHENTICATION         = 0x00000800
-	CKF_USER_PIN_COUNT_LOW               = 0x00010000
-	CKF_USER_PIN_FINAL_TRY               = 0x00020000
-	CKF_USER_PIN_LOCKED                  = 0x00040000
-	CKF_USER_PIN_TO_BE_CHANGED           = 0x00080000
-	CKF_SO_PIN_COUNT_LOW                 = 0x00100000
-	CKF_SO_PIN_FINAL_TRY                 = 0x00200000
-	CKF_SO_PIN_LOCKED                    = 0x00400000
-	CKF_SO_PIN_TO_BE_CHANGED             = 0x00800000
-	CKF_RW_SESSION                       = 0x00000002
-	CKF_SERIAL_SESSION                   = 0x00000004
-	CKK_RSA                              = 0x00000000
-	CKK_DSA                              = 0x00000001
-	CKK_DH                               = 0x00000002
-	CKK_ECDSA                            = 0x00000003
-	CKK_EC                               = 0x00000003
-	CKK_X9_42_DH                         = 0x00000004
-	CKK_KEA                              = 0x00000005
-	CKK_GENERIC_SECRET                   = 0x00000010
-	CKK_RC2                              = 0x00000011
-	CKK_RC4                              = 0x00000012
-	CKK_DES                              = 0x00000013
-	CKK_DES2                             = 0x00000014
-	CKK_DES3                             = 0x00000015
-	CKK_CAST                             = 0x00000016
-	CKK_CAST3                            = 0x00000017
-	CKK_CAST5                            = 0x00000018
-	CKK_CAST128                          = 0x00000018
-	CKK_RC5                              = 0x00000019
-	CKK_IDEA                             = 0x0000001A
-	CKK_SKIPJACK                         = 0x0000001B
-	CKK_BATON                            = 0x0000001C
-	CKK_JUNIPER                          = 0x0000001D
-	CKK_CDMF                             = 0x0000001E
-	CKK_AES                              = 0x0000001F
-	CKK_BLOWFISH                         = 0x00000020
-	CKK_TWOFISH                          = 0x00000021
-	CKK_SECURID                          = 0x00000022
-	CKK_HOTP                             = 0x00000023
-	CKK_ACTI                             = 0x00000024
-	CKK_CAMELLIA                         = 0x00000025
-	CKK_ARIA                             = 0x00000026
-	CKK_VENDOR_DEFINED                   = 0x80000000
-	CKC_X_509                            = 0x00000000
-	CKC_X_509_ATTR_CERT                  = 0x00000001
-	CKC_WTLS                             = 0x00000002
-	CKC_VENDOR_DEFINED                   = 0x80000000
-	CKF_ARRAY_ATTRIBUTE                  = 0x40000000
-	CKA_CLASS                            = 0x00000000
-	CKA_TOKEN                            = 0x00000001
-	CKA_PRIVATE                          = 0x00000002
-	CKA_LABEL                            = 0x00000003
-	CKA_APPLICATION                      = 0x00000010
-	CKA_VALUE                            = 0x00000011
-	CKA_OBJECT_ID                        = 0x00000012
-	CKA_CERTIFICATE_TYPE                 = 0x00000080
-	CKA_ISSUER                           = 0x00000081
-	CKA_SERIAL_NUMBER                    = 0x00000082
-	CKA_AC_ISSUER                        = 0x00000083
-	CKA_OWNER                            = 0x00000084
-	CKA_ATTR_TYPES                       = 0x00000085
-	CKA_TRUSTED                          = 0x00000086
-	CKA_CERTIFICATE_CATEGORY             = 0x00000087
-	CKA_JAVA_MIDP_SECURITY_DOMAIN        = 0x00000088
-	CKA_URL                              = 0x00000089
-	CKA_HASH_OF_SUBJECT_PUBLIC_KEY       = 0x0000008A
-	CKA_HASH_OF_ISSUER_PUBLIC_KEY        = 0x0000008B
-	CKA_CHECK_VALUE                      = 0x00000090
-	CKA_KEY_TYPE                         = 0x00000100
-	CKA_SUBJECT                          = 0x00000101
-	CKA_ID                               = 0x00000102
-	CKA_SENSITIVE                        = 0x00000103
-	CKA_ENCRYPT                          = 0x00000104
-	CKA_DECRYPT                          = 0x00000105
-	CKA_WRAP                             = 0x00000106
-	CKA_UNWRAP                           = 0x00000107
-	CKA_SIGN                             = 0x00000108
-	CKA_SIGN_RECOVER                     = 0x00000109
-	CKA_VERIFY                           = 0x0000010A
-	CKA_VERIFY_RECOVER                   = 0x0000010B
-	CKA_DERIVE                           = 0x0000010C
-	CKA_START_DATE                       = 0x00000110
-	CKA_END_DATE                         = 0x00000111
-	CKA_MODULUS                          = 0x00000120
-	CKA_MODULUS_BITS                     = 0x00000121
-	CKA_PUBLIC_EXPONENT                  = 0x00000122
-	CKA_PRIVATE_EXPONENT                 = 0x00000123
-	CKA_PRIME_1                          = 0x00000124
-	CKA_PRIME_2                          = 0x00000125
-	CKA_EXPONENT_1                       = 0x00000126
-	CKA_EXPONENT_2                       = 0x00000127
-	CKA_COEFFICIENT                      = 0x00000128
-	CKA_PRIME                            = 0x00000130
-	CKA_SUBPRIME                         = 0x00000131
-	CKA_BASE                             = 0x00000132
-	CKA_PRIME_BITS                       = 0x00000133
-	CKA_SUBPRIME_BITS                    = 0x00000134
-	CKA_SUB_PRIME_BITS                   = CKA_SUBPRIME_BITS
-	CKA_VALUE_BITS                       = 0x00000160
-	CKA_VALUE_LEN                        = 0x00000161
-	CKA_EXTRACTABLE                      = 0x00000162
-	CKA_LOCAL                            = 0x00000163
-	CKA_NEVER_EXTRACTABLE                = 0x00000164
-	CKA_ALWAYS_SENSITIVE                 = 0x00000165
-	CKA_KEY_GEN_MECHANISM                = 0x00000166
-	CKA_MODIFIABLE                       = 0x00000170
-	CKA_ECDSA_PARAMS                     = 0x00000180
-	CKA_EC_PARAMS                        = 0x00000180
-	CKA_EC_POINT                         = 0x00000181
-	CKA_SECONDARY_AUTH                   = 0x00000200
-	CKA_AUTH_PIN_FLAGS                   = 0x00000201
-	CKA_ALWAYS_AUTHENTICATE              = 0x00000202
-	CKA_WRAP_WITH_TRUSTED                = 0x00000210
-	CKA_WRAP_TEMPLATE                    = (CKF_ARRAY_ATTRIBUTE | 0x00000211)
-	CKA_UNWRAP_TEMPLATE                  = (CKF_ARRAY_ATTRIBUTE | 0x00000212)
-	CKA_OTP_FORMAT                       = 0x00000220
-	CKA_OTP_LENGTH                       = 0x00000221
-	CKA_OTP_TIME_INTERVAL                = 0x00000222
-	CKA_OTP_USER_FRIENDLY_MODE           = 0x00000223
-	CKA_OTP_CHALLENGE_REQUIREMENT        = 0x00000224
-	CKA_OTP_TIME_REQUIREMENT             = 0x00000225
-	CKA_OTP_COUNTER_REQUIREMENT          = 0x00000226
-	CKA_OTP_PIN_REQUIREMENT              = 0x00000227
-	CKA_OTP_COUNTER                      = 0x0000022E
-	CKA_OTP_TIME                         = 0x0000022F
-	CKA_OTP_USER_IDENTIFIER              = 0x0000022A
-	CKA_OTP_SERVICE_IDENTIFIER           = 0x0000022B
-	CKA_OTP_SERVICE_LOGO                 = 0x0000022C
-	CKA_OTP_SERVICE_LOGO_TYPE            = 0x0000022D
-	CKA_HW_FEATURE_TYPE                  = 0x00000300
-	CKA_RESET_ON_INIT                    = 0x00000301
-	CKA_HAS_RESET                        = 0x00000302
-	CKA_PIXEL_X                          = 0x00000400
-	CKA_PIXEL_Y                          = 0x00000401
-	CKA_RESOLUTION                       = 0x00000402
-	CKA_CHAR_ROWS                        = 0x00000403
-	CKA_CHAR_COLUMNS                     = 0x00000404
-	CKA_COLOR                            = 0x00000405
-	CKA_BITS_PER_PIXEL                   = 0x00000406
-	CKA_CHAR_SETS                        = 0x00000480
-	CKA_ENCODING_METHODS                 = 0x00000481
-	CKA_MIME_TYPES                       = 0x00000482
-	CKA_MECHANISM_TYPE                   = 0x00000500
-	CKA_REQUIRED_CMS_ATTRIBUTES          = 0x00000501
-	CKA_DEFAULT_CMS_ATTRIBUTES           = 0x00000502
-	CKA_SUPPORTED_CMS_ATTRIBUTES         = 0x00000503
-	CKA_ALLOWED_MECHANISMS               = (CKF_ARRAY_ATTRIBUTE | 0x00000600)
-	CKA_VENDOR_DEFINED                   = 0x80000000
-	CKM_RSA_PKCS_KEY_PAIR_GEN            = 0x00000000
-	CKM_RSA_PKCS                         = 0x00000001
-	CKM_RSA_9796                         = 0x00000002
-	CKM_RSA_X_509                        = 0x00000003
-	CKM_MD2_RSA_PKCS                     = 0x00000004
-	CKM_MD5_RSA_PKCS                     = 0x00000005
-	CKM_SHA1_RSA_PKCS                    = 0x00000006
-	CKM_RIPEMD128_RSA_PKCS               = 0x00000007
-	CKM_RIPEMD160_RSA_PKCS               = 0x00000008
-	CKM_RSA_PKCS_OAEP                    = 0x00000009
-	CKM_RSA_X9_31_KEY_PAIR_GEN           = 0x0000000A
-	CKM_RSA_X9_31                        = 0x0000000B
-	CKM_SHA1_RSA_X9_31                   = 0x0000000C
-	CKM_RSA_PKCS_PSS                     = 0x0000000D
-	CKM_SHA1_RSA_PKCS_PSS                = 0x0000000E
-	CKM_DSA_KEY_PAIR_GEN                 = 0x00000010
-	CKM_DSA                              = 0x00000011
-	CKM_DSA_SHA1                         = 0x00000012
-	CKM_DH_PKCS_KEY_PAIR_GEN             = 0x00000020
-	CKM_DH_PKCS_DERIVE                   = 0x00000021
-	CKM_X9_42_DH_KEY_PAIR_GEN            = 0x00000030
-	CKM_X9_42_DH_DERIVE                  = 0x00000031
-	CKM_X9_42_DH_HYBRID_DERIVE           = 0x00000032
-	CKM_X9_42_MQV_DERIVE                 = 0x00000033
-	CKM_SHA256_RSA_PKCS                  = 0x00000040
-	CKM_SHA384_RSA_PKCS                  = 0x00000041
-	CKM_SHA512_RSA_PKCS                  = 0x00000042
-	CKM_SHA256_RSA_PKCS_PSS              = 0x00000043
-	CKM_SHA384_RSA_PKCS_PSS              = 0x00000044
-	CKM_SHA512_RSA_PKCS_PSS              = 0x00000045
-	CKM_SHA224_RSA_PKCS                  = 0x00000046
-	CKM_SHA224_RSA_PKCS_PSS              = 0x00000047
-	CKM_RC2_KEY_GEN                      = 0x00000100
-	CKM_RC2_ECB                          = 0x00000101
-	CKM_RC2_CBC                          = 0x00000102
-	CKM_RC2_MAC                          = 0x00000103
-	CKM_RC2_MAC_GENERAL                  = 0x00000104
-	CKM_RC2_CBC_PAD                      = 0x00000105
-	CKM_RC4_KEY_GEN                      = 0x00000110
-	CKM_RC4                              = 0x00000111
-	CKM_DES_KEY_GEN                      = 0x00000120
-	CKM_DES_ECB                          = 0x00000121
-	CKM_DES_CBC                          = 0x00000122
-	CKM_DES_MAC                          = 0x00000123
-	CKM_DES_MAC_GENERAL                  = 0x00000124
-	CKM_DES_CBC_PAD                      = 0x00000125
-	CKM_DES2_KEY_GEN                     = 0x00000130
-	CKM_DES3_KEY_GEN                     = 0x00000131
-	CKM_DES3_ECB                         = 0x00000132
-	CKM_DES3_CBC                         = 0x00000133
-	CKM_DES3_MAC                         = 0x00000134
-	CKM_DES3_MAC_GENERAL                 = 0x00000135
-	CKM_DES3_CBC_PAD                     = 0x00000136
-	CKM_CDMF_KEY_GEN                     = 0x00000140
-	CKM_CDMF_ECB                         = 0x00000141
-	CKM_CDMF_CBC                         = 0x00000142
-	CKM_CDMF_MAC                         = 0x00000143
-	CKM_CDMF_MAC_GENERAL                 = 0x00000144
-	CKM_CDMF_CBC_PAD                     = 0x00000145
-	CKM_DES_OFB64                        = 0x00000150
-	CKM_DES_OFB8                         = 0x00000151
-	CKM_DES_CFB64                        = 0x00000152
-	CKM_DES_CFB8                         = 0x00000153
-	CKM_MD2                              = 0x00000200
-	CKM_MD2_HMAC                         = 0x00000201
-	CKM_MD2_HMAC_GENERAL                 = 0x00000202
-	CKM_MD5                              = 0x00000210
-	CKM_MD5_HMAC                         = 0x00000211
-	CKM_MD5_HMAC_GENERAL                 = 0x00000212
-	CKM_SHA_1                            = 0x00000220
-	CKM_SHA_1_HMAC                       = 0x00000221
-	CKM_SHA_1_HMAC_GENERAL               = 0x00000222
-	CKM_RIPEMD128                        = 0x00000230
-	CKM_RIPEMD128_HMAC                   = 0x00000231
-	CKM_RIPEMD128_HMAC_GENERAL           = 0x00000232
-	CKM_RIPEMD160                        = 0x00000240
-	CKM_RIPEMD160_HMAC                   = 0x00000241
-	CKM_RIPEMD160_HMAC_GENERAL           = 0x00000242
-	CKM_SHA256                           = 0x00000250
-	CKM_SHA256_HMAC                      = 0x00000251
-	CKM_SHA256_HMAC_GENERAL              = 0x00000252
-	CKM_SHA224                           = 0x00000255
-	CKM_SHA224_HMAC                      = 0x00000256
-	CKM_SHA224_HMAC_GENERAL              = 0x00000257
-	CKM_SHA384                           = 0x00000260
-	CKM_SHA384_HMAC                      = 0x00000261
-	CKM_SHA384_HMAC_GENERAL              = 0x00000262
-	CKM_SHA512                           = 0x00000270
-	CKM_SHA512_HMAC                      = 0x00000271
-	CKM_SHA512_HMAC_GENERAL              = 0x00000272
-	CKM_SECURID_KEY_GEN                  = 0x00000280
-	CKM_SECURID                          = 0x00000282
-	CKM_HOTP_KEY_GEN                     = 0x00000290
-	CKM_HOTP                             = 0x00000291
-	CKM_ACTI                             = 0x000002A0
-	CKM_ACTI_KEY_GEN                     = 0x000002A1
-	CKM_CAST_KEY_GEN                     = 0x00000300
-	CKM_CAST_ECB                         = 0x00000301
-	CKM_CAST_CBC                         = 0x00000302
-	CKM_CAST_MAC                         = 0x00000303
-	CKM_CAST_MAC_GENERAL                 = 0x00000304
-	CKM_CAST_CBC_PAD                     = 0x00000305
-	CKM_CAST3_KEY_GEN                    = 0x00000310
-	CKM_CAST3_ECB                        = 0x00000311
-	CKM_CAST3_CBC                        = 0x00000312
-	CKM_CAST3_MAC                        = 0x00000313
-	CKM_CAST3_MAC_GENERAL                = 0x00000314
-	CKM_CAST3_CBC_PAD                    = 0x00000315
-	CKM_CAST5_KEY_GEN                    = 0x00000320
-	CKM_CAST128_KEY_GEN                  = 0x00000320
-	CKM_CAST5_ECB                        = 0x00000321
-	CKM_CAST128_ECB                      = 0x00000321
-	CKM_CAST5_CBC                        = 0x00000322
-	CKM_CAST128_CBC                      = 0x00000322
-	CKM_CAST5_MAC                        = 0x00000323
-	CKM_CAST128_MAC                      = 0x00000323
-	CKM_CAST5_MAC_GENERAL                = 0x00000324
-	CKM_CAST128_MAC_GENERAL              = 0x00000324
-	CKM_CAST5_CBC_PAD                    = 0x00000325
-	CKM_CAST128_CBC_PAD                  = 0x00000325
-	CKM_RC5_KEY_GEN                      = 0x00000330
-	CKM_RC5_ECB                          = 0x00000331
-	CKM_RC5_CBC                          = 0x00000332
-	CKM_RC5_MAC                          = 0x00000333
-	CKM_RC5_MAC_GENERAL                  = 0x00000334
-	CKM_RC5_CBC_PAD                      = 0x00000335
-	CKM_IDEA_KEY_GEN                     = 0x00000340
-	CKM_IDEA_ECB                         = 0x00000341
-	CKM_IDEA_CBC                         = 0x00000342
-	CKM_IDEA_MAC                         = 0x00000343
-	CKM_IDEA_MAC_GENERAL                 = 0x00000344
-	CKM_IDEA_CBC_PAD                     = 0x00000345
-	CKM_GENERIC_SECRET_KEY_GEN           = 0x00000350
-	CKM_CONCATENATE_BASE_AND_KEY         = 0x00000360
-	CKM_CONCATENATE_BASE_AND_DATA        = 0x00000362
-	CKM_CONCATENATE_DATA_AND_BASE        = 0x00000363
-	CKM_XOR_BASE_AND_DATA                = 0x00000364
-	CKM_EXTRACT_KEY_FROM_KEY             = 0x00000365
-	CKM_SSL3_PRE_MASTER_KEY_GEN          = 0x00000370
-	CKM_SSL3_MASTER_KEY_DERIVE           = 0x00000371
-	CKM_SSL3_KEY_AND_MAC_DERIVE          = 0x00000372
-	CKM_SSL3_MASTER_KEY_DERIVE_DH        = 0x00000373
-	CKM_TLS_PRE_MASTER_KEY_GEN           = 0x00000374
-	CKM_TLS_MASTER_KEY_DERIVE            = 0x00000375
-	CKM_TLS_KEY_AND_MAC_DERIVE           = 0x00000376
-	CKM_TLS_MASTER_KEY_DERIVE_DH         = 0x00000377
-	CKM_TLS_PRF                          = 0x00000378
-	CKM_SSL3_MD5_MAC                     = 0x00000380
-	CKM_SSL3_SHA1_MAC                    = 0x00000381
-	CKM_MD5_KEY_DERIVATION               = 0x00000390
-	CKM_MD2_KEY_DERIVATION               = 0x00000391
-	CKM_SHA1_KEY_DERIVATION              = 0x00000392
-	CKM_SHA256_KEY_DERIVATION            = 0x00000393
-	CKM_SHA384_KEY_DERIVATION            = 0x00000394
-	CKM_SHA512_KEY_DERIVATION            = 0x00000395
-	CKM_SHA224_KEY_DERIVATION            = 0x00000396
-	CKM_PBE_MD2_DES_CBC                  = 0x000003A0
-	CKM_PBE_MD5_DES_CBC                  = 0x000003A1
-	CKM_PBE_MD5_CAST_CBC                 = 0x000003A2
-	CKM_PBE_MD5_CAST3_CBC                = 0x000003A3
-	CKM_PBE_MD5_CAST5_CBC                = 0x000003A4
-	CKM_PBE_MD5_CAST128_CBC              = 0x000003A4
-	CKM_PBE_SHA1_CAST5_CBC               = 0x000003A5
-	CKM_PBE_SHA1_CAST128_CBC             = 0x000003A5
-	CKM_PBE_SHA1_RC4_128                 = 0x000003A6
-	CKM_PBE_SHA1_RC4_40                  = 0x000003A7
-	CKM_PBE_SHA1_DES3_EDE_CBC            = 0x000003A8
-	CKM_PBE_SHA1_DES2_EDE_CBC            = 0x000003A9
-	CKM_PBE_SHA1_RC2_128_CBC             = 0x000003AA
-	CKM_PBE_SHA1_RC2_40_CBC              = 0x000003AB
-	CKM_PKCS5_PBKD2                      = 0x000003B0
-	CKM_PBA_SHA1_WITH_SHA1_HMAC          = 0x000003C0
-	CKM_WTLS_PRE_MASTER_KEY_GEN          = 0x000003D0
-	CKM_WTLS_MASTER_KEY_DERIVE           = 0x000003D1
-	CKM_WTLS_MASTER_KEY_DERIVE_DH_ECC    = 0x000003D2
-	CKM_WTLS_PRF                         = 0x000003D3
-	CKM_WTLS_SERVER_KEY_AND_MAC_DERIVE   = 0x000003D4
-	CKM_WTLS_CLIENT_KEY_AND_MAC_DERIVE   = 0x000003D5
-	CKM_KEY_WRAP_LYNKS                   = 0x00000400
-	CKM_KEY_WRAP_SET_OAEP                = 0x00000401
-	CKM_CMS_SIG                          = 0x00000500
-	CKM_KIP_DERIVE                       = 0x00000510
-	CKM_KIP_WRAP                         = 0x00000511
-	CKM_KIP_MAC                          = 0x00000512
-	CKM_CAMELLIA_KEY_GEN                 = 0x00000550
-	CKM_CAMELLIA_ECB                     = 0x00000551
-	CKM_CAMELLIA_CBC                     = 0x00000552
-	CKM_CAMELLIA_MAC                     = 0x00000553
-	CKM_CAMELLIA_MAC_GENERAL             = 0x00000554
-	CKM_CAMELLIA_CBC_PAD                 = 0x00000555
-	CKM_CAMELLIA_ECB_ENCRYPT_DATA        = 0x00000556
-	CKM_CAMELLIA_CBC_ENCRYPT_DATA        = 0x00000557
-	CKM_CAMELLIA_CTR                     = 0x00000558
-	CKM_ARIA_KEY_GEN                     = 0x00000560
-	CKM_ARIA_ECB                         = 0x00000561
-	CKM_ARIA_CBC                         = 0x00000562
-	CKM_ARIA_MAC                         = 0x00000563
-	CKM_ARIA_MAC_GENERAL                 = 0x00000564
-	CKM_ARIA_CBC_PAD                     = 0x00000565
-	CKM_ARIA_ECB_ENCRYPT_DATA            = 0x00000566
-	CKM_ARIA_CBC_ENCRYPT_DATA            = 0x00000567
-	CKM_SKIPJACK_KEY_GEN                 = 0x00001000
-	CKM_SKIPJACK_ECB64                   = 0x00001001
-	CKM_SKIPJACK_CBC64                   = 0x00001002
-	CKM_SKIPJACK_OFB64                   = 0x00001003
-	CKM_SKIPJACK_CFB64                   = 0x00001004
-	CKM_SKIPJACK_CFB32                   = 0x00001005
-	CKM_SKIPJACK_CFB16                   = 0x00001006
-	CKM_SKIPJACK_CFB8                    = 0x00001007
-	CKM_SKIPJACK_WRAP                    = 0x00001008
-	CKM_SKIPJACK_PRIVATE_WRAP            = 0x00001009
-	CKM_SKIPJACK_RELAYX                  = 0x0000100a
-	CKM_KEA_KEY_PAIR_GEN                 = 0x00001010
-	CKM_KEA_KEY_DERIVE                   = 0x00001011
-	CKM_FORTEZZA_TIMESTAMP               = 0x00001020
-	CKM_BATON_KEY_GEN                    = 0x00001030
-	CKM_BATON_ECB128                     = 0x00001031
-	CKM_BATON_ECB96                      = 0x00001032
-	CKM_BATON_CBC128                     = 0x00001033
-	CKM_BATON_COUNTER                    = 0x00001034
-	CKM_BATON_SHUFFLE                    = 0x00001035
-	CKM_BATON_WRAP                       = 0x00001036
-	CKM_ECDSA_KEY_PAIR_GEN               = 0x00001040
-	CKM_EC_KEY_PAIR_GEN                  = 0x00001040
-	CKM_ECDSA                            = 0x00001041
-	CKM_ECDSA_SHA1                       = 0x00001042
-	CKM_ECDH1_DERIVE                     = 0x00001050
-	CKM_ECDH1_COFACTOR_DERIVE            = 0x00001051
-	CKM_ECMQV_DERIVE                     = 0x00001052
-	CKM_JUNIPER_KEY_GEN                  = 0x00001060
-	CKM_JUNIPER_ECB128                   = 0x00001061
-	CKM_JUNIPER_CBC128                   = 0x00001062
-	CKM_JUNIPER_COUNTER                  = 0x00001063
-	CKM_JUNIPER_SHUFFLE                  = 0x00001064
-	CKM_JUNIPER_WRAP                     = 0x00001065
-	CKM_FASTHASH                         = 0x00001070
-	CKM_AES_KEY_GEN                      = 0x00001080
-	CKM_AES_ECB                          = 0x00001081
-	CKM_AES_CBC                          = 0x00001082
-	CKM_AES_MAC                          = 0x00001083
-	CKM_AES_MAC_GENERAL                  = 0x00001084
-	CKM_AES_CBC_PAD                      = 0x00001085
-	CKM_AES_CTR                          = 0x00001086
-	CKM_BLOWFISH_KEY_GEN                 = 0x00001090
-	CKM_BLOWFISH_CBC                     = 0x00001091
-	CKM_TWOFISH_KEY_GEN                  = 0x00001092
-	CKM_TWOFISH_CBC                      = 0x00001093
-	CKM_DES_ECB_ENCRYPT_DATA             = 0x00001100
-	CKM_DES_CBC_ENCRYPT_DATA             = 0x00001101
-	CKM_DES3_ECB_ENCRYPT_DATA            = 0x00001102
-	CKM_DES3_CBC_ENCRYPT_DATA            = 0x00001103
-	CKM_AES_ECB_ENCRYPT_DATA             = 0x00001104
-	CKM_AES_CBC_ENCRYPT_DATA             = 0x00001105
-	CKM_DSA_PARAMETER_GEN                = 0x00002000
-	CKM_DH_PKCS_PARAMETER_GEN            = 0x00002001
-	CKM_X9_42_DH_PARAMETER_GEN           = 0x00002002
-	CKM_VENDOR_DEFINED                   = 0x80000000
-	CKF_HW                               = 0x00000001
-	CKF_ENCRYPT                          = 0x00000100
-	CKF_DECRYPT                          = 0x00000200
-	CKF_DIGEST                           = 0x00000400
-	CKF_SIGN                             = 0x00000800
-	CKF_SIGN_RECOVER                     = 0x00001000
-	CKF_VERIFY                           = 0x00002000
-	CKF_VERIFY_RECOVER                   = 0x00004000
-	CKF_GENERATE                         = 0x00008000
-	CKF_GENERATE_KEY_PAIR                = 0x00010000
-	CKF_WRAP                             = 0x00020000
-	CKF_UNWRAP                           = 0x00040000
-	CKF_DERIVE                           = 0x00080000
-	CKF_EC_F_P                           = 0x00100000
-	CKF_EC_F_2M                          = 0x00200000
-	CKF_EC_ECPARAMETERS                  = 0x00400000
-	CKF_EC_NAMEDCURVE                    = 0x00800000
-	CKF_EC_UNCOMPRESS                    = 0x01000000
-	CKF_EC_COMPRESS                      = 0x02000000
-	CKF_EXTENSION                        = 0x80000000
-	CKR_OK                               = 0x00000000
-	CKR_CANCEL                           = 0x00000001
-	CKR_HOST_MEMORY                      = 0x00000002
-	CKR_SLOT_ID_INVALID                  = 0x00000003
-	CKR_GENERAL_ERROR                    = 0x00000005
-	CKR_FUNCTION_FAILED                  = 0x00000006
-	CKR_ARGUMENTS_BAD                    = 0x00000007
-	CKR_NO_EVENT                         = 0x00000008
-	CKR_NEED_TO_CREATE_THREADS           = 0x00000009
-	CKR_CANT_LOCK                        = 0x0000000A
-	CKR_ATTRIBUTE_READ_ONLY              = 0x00000010
-	CKR_ATTRIBUTE_SENSITIVE              = 0x00000011
-	CKR_ATTRIBUTE_TYPE_INVALID           = 0x00000012
-	CKR_ATTRIBUTE_VALUE_INVALID          = 0x00000013
-	CKR_DATA_INVALID                     = 0x00000020
-	CKR_DATA_LEN_RANGE                   = 0x00000021
-	CKR_DEVICE_ERROR                     = 0x00000030
-	CKR_DEVICE_MEMORY                    = 0x00000031
-	CKR_DEVICE_REMOVED                   = 0x00000032
-	CKR_ENCRYPTED_DATA_INVALID           = 0x00000040
-	CKR_ENCRYPTED_DATA_LEN_RANGE         = 0x00000041
-	CKR_FUNCTION_CANCELED                = 0x00000050
-	CKR_FUNCTION_NOT_PARALLEL            = 0x00000051
-	CKR_FUNCTION_NOT_SUPPORTED           = 0x00000054
-	CKR_KEY_HANDLE_INVALID               = 0x00000060
-	CKR_KEY_SIZE_RANGE                   = 0x00000062
-	CKR_KEY_TYPE_INCONSISTENT            = 0x00000063
-	CKR_KEY_NOT_NEEDED                   = 0x00000064
-	CKR_KEY_CHANGED                      = 0x00000065
-	CKR_KEY_NEEDED                       = 0x00000066
-	CKR_KEY_INDIGESTIBLE                 = 0x00000067
-	CKR_KEY_FUNCTION_NOT_PERMITTED       = 0x00000068
-	CKR_KEY_NOT_WRAPPABLE                = 0x00000069
-	CKR_KEY_UNEXTRACTABLE                = 0x0000006A
-	CKR_MECHANISM_INVALID                = 0x00000070
-	CKR_MECHANISM_PARAM_INVALID          = 0x00000071
-	CKR_OBJECT_HANDLE_INVALID            = 0x00000082
-	CKR_OPERATION_ACTIVE                 = 0x00000090
-	CKR_OPERATION_NOT_INITIALIZED        = 0x00000091
-	CKR_PIN_INCORRECT                    = 0x000000A0
-	CKR_PIN_INVALID                      = 0x000000A1
-	CKR_PIN_LEN_RANGE                    = 0x000000A2
-	CKR_PIN_EXPIRED                      = 0x000000A3
-	CKR_PIN_LOCKED                       = 0x000000A4
-	CKR_SESSION_CLOSED                   = 0x000000B0
-	CKR_SESSION_COUNT                    = 0x000000B1
-	CKR_SESSION_HANDLE_INVALID           = 0x000000B3
-	CKR_SESSION_PARALLEL_NOT_SUPPORTED   = 0x000000B4
-	CKR_SESSION_READ_ONLY                = 0x000000B5
-	CKR_SESSION_EXISTS                   = 0x000000B6
-	CKR_SESSION_READ_ONLY_EXISTS         = 0x000000B7
-	CKR_SESSION_READ_WRITE_SO_EXISTS     = 0x000000B8
-	CKR_SIGNATURE_INVALID                = 0x000000C0
-	CKR_SIGNATURE_LEN_RANGE              = 0x000000C1
-	CKR_TEMPLATE_INCOMPLETE              = 0x000000D0
-	CKR_TEMPLATE_INCONSISTENT            = 0x000000D1
-	CKR_TOKEN_NOT_PRESENT                = 0x000000E0
-	CKR_TOKEN_NOT_RECOGNIZED             = 0x000000E1
-	CKR_TOKEN_WRITE_PROTECTED            = 0x000000E2
-	CKR_UNWRAPPING_KEY_HANDLE_INVALID    = 0x000000F0
-	CKR_UNWRAPPING_KEY_SIZE_RANGE        = 0x000000F1
-	CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT = 0x000000F2
-	CKR_USER_ALREADY_LOGGED_IN           = 0x00000100
-	CKR_USER_NOT_LOGGED_IN               = 0x00000101
-	CKR_USER_PIN_NOT_INITIALIZED         = 0x00000102
-	CKR_USER_TYPE_INVALID                = 0x00000103
-	CKR_USER_ANOTHER_ALREADY_LOGGED_IN   = 0x00000104
-	CKR_USER_TOO_MANY_TYPES              = 0x00000105
-	CKR_WRAPPED_KEY_INVALID              = 0x00000110
-	CKR_WRAPPED_KEY_LEN_RANGE            = 0x00000112
-	CKR_WRAPPING_KEY_HANDLE_INVALID      = 0x00000113
-	CKR_WRAPPING_KEY_SIZE_RANGE          = 0x00000114
-	CKR_WRAPPING_KEY_TYPE_INCONSISTENT   = 0x00000115
-	CKR_RANDOM_SEED_NOT_SUPPORTED        = 0x00000120
-	CKR_RANDOM_NO_RNG                    = 0x00000121
-	CKR_DOMAIN_PARAMS_INVALID            = 0x00000130
-	CKR_BUFFER_TOO_SMALL                 = 0x00000150
-	CKR_SAVED_STATE_INVALID              = 0x00000160
-	CKR_INFORMATION_SENSITIVE            = 0x00000170
-	CKR_STATE_UNSAVEABLE                 = 0x00000180
-	CKR_CRYPTOKI_NOT_INITIALIZED         = 0x00000190
-	CKR_CRYPTOKI_ALREADY_INITIALIZED     = 0x00000191
-	CKR_MUTEX_BAD                        = 0x000001A0
-	CKR_MUTEX_NOT_LOCKED                 = 0x000001A1
-	CKR_NEW_PIN_MODE                     = 0x000001B0
-	CKR_NEXT_OTP                         = 0x000001B1
-	CKR_FUNCTION_REJECTED                = 0x00000200
-	CKR_VENDOR_DEFINED                   = 0x80000000
-	CKF_LIBRARY_CANT_CREATE_OS_THREADS   = 0x00000001
-	CKF_OS_LOCKING_OK                    = 0x00000002
-	CKF_DONT_BLOCK                       = 1
-	CKF_NEXT_OTP                         = 0x00000001
-	CKF_EXCLUDE_TIME                     = 0x00000002
-	CKF_EXCLUDE_COUNTER                  = 0x00000004
-	CKF_EXCLUDE_CHALLENGE                = 0x00000008
-	CKF_EXCLUDE_PIN                      = 0x00000010
-	CKF_USER_FRIENDLY_OTP                = 0x00000020
-)
diff --git a/components/engine/vendor/github.com/miekg/pkcs11/error.go b/components/engine/vendor/github.com/miekg/pkcs11/error.go
deleted file mode 100644
index 7df0e93a6b..0000000000
--- a/components/engine/vendor/github.com/miekg/pkcs11/error.go
+++ /dev/null
@@ -1,98 +0,0 @@
-// Copyright 2013 Miek Gieben. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package pkcs11
-
-// awk '/#define CKR_/{ print $3":\""$2"\"," }' pkcs11t.h
-
-var strerror = map[uint]string{
-	0x00000000: "CKR_OK",
-	0x00000001: "CKR_CANCEL",
-	0x00000002: "CKR_HOST_MEMORY",
-	0x00000003: "CKR_SLOT_ID_INVALID",
-	0x00000005: "CKR_GENERAL_ERROR",
-	0x00000006: "CKR_FUNCTION_FAILED",
-	0x00000007: "CKR_ARGUMENTS_BAD",
-	0x00000008: "CKR_NO_EVENT",
-	0x00000009: "CKR_NEED_TO_CREATE_THREADS",
-	0x0000000A: "CKR_CANT_LOCK",
-	0x00000010: "CKR_ATTRIBUTE_READ_ONLY",
-	0x00000011: "CKR_ATTRIBUTE_SENSITIVE",
-	0x00000012: "CKR_ATTRIBUTE_TYPE_INVALID",
-	0x00000013: "CKR_ATTRIBUTE_VALUE_INVALID",
-	0x00000020: "CKR_DATA_INVALID",
-	0x00000021: "CKR_DATA_LEN_RANGE",
-	0x00000030: "CKR_DEVICE_ERROR",
-	0x00000031: "CKR_DEVICE_MEMORY",
-	0x00000032: "CKR_DEVICE_REMOVED",
-	0x00000040: "CKR_ENCRYPTED_DATA_INVALID",
-	0x00000041: "CKR_ENCRYPTED_DATA_LEN_RANGE",
-	0x00000050: "CKR_FUNCTION_CANCELED",
-	0x00000051: "CKR_FUNCTION_NOT_PARALLEL",
-	0x00000054: "CKR_FUNCTION_NOT_SUPPORTED",
-	0x00000060: "CKR_KEY_HANDLE_INVALID",
-	0x00000062: "CKR_KEY_SIZE_RANGE",
-	0x00000063: "CKR_KEY_TYPE_INCONSISTENT",
-	0x00000064: "CKR_KEY_NOT_NEEDED",
-	0x00000065: "CKR_KEY_CHANGED",
-	0x00000066: "CKR_KEY_NEEDED",
-	0x00000067: "CKR_KEY_INDIGESTIBLE",
-	0x00000068: "CKR_KEY_FUNCTION_NOT_PERMITTED",
-	0x00000069: "CKR_KEY_NOT_WRAPPABLE",
-	0x0000006A: "CKR_KEY_UNEXTRACTABLE",
-	0x00000070: "CKR_MECHANISM_INVALID",
-	0x00000071: "CKR_MECHANISM_PARAM_INVALID",
-	0x00000082: "CKR_OBJECT_HANDLE_INVALID",
-	0x00000090: "CKR_OPERATION_ACTIVE",
-	0x00000091: "CKR_OPERATION_NOT_INITIALIZED",
-	0x000000A0: "CKR_PIN_INCORRECT",
-	0x000000A1: "CKR_PIN_INVALID",
-	0x000000A2: "CKR_PIN_LEN_RANGE",
-	0x000000A3: "CKR_PIN_EXPIRED",
-	0x000000A4: "CKR_PIN_LOCKED",
-	0x000000B0: "CKR_SESSION_CLOSED",
-	0x000000B1: "CKR_SESSION_COUNT",
-	0x000000B3: "CKR_SESSION_HANDLE_INVALID",
-	0x000000B4: "CKR_SESSION_PARALLEL_NOT_SUPPORTED",
-	0x000000B5: "CKR_SESSION_READ_ONLY",
-	0x000000B6: "CKR_SESSION_EXISTS",
-	0x000000B7: "CKR_SESSION_READ_ONLY_EXISTS",
-	0x000000B8: "CKR_SESSION_READ_WRITE_SO_EXISTS",
-	0x000000C0: "CKR_SIGNATURE_INVALID",
-	0x000000C1: "CKR_SIGNATURE_LEN_RANGE",
-	0x000000D0: "CKR_TEMPLATE_INCOMPLETE",
-	0x000000D1: "CKR_TEMPLATE_INCONSISTENT",
-	0x000000E0: "CKR_TOKEN_NOT_PRESENT",
-	0x000000E1: "CKR_TOKEN_NOT_RECOGNIZED",
-	0x000000E2: "CKR_TOKEN_WRITE_PROTECTED",
-	0x000000F0: "CKR_UNWRAPPING_KEY_HANDLE_INVALID",
-	0x000000F1: "CKR_UNWRAPPING_KEY_SIZE_RANGE",
-	0x000000F2: "CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT",
-	0x00000100: "CKR_USER_ALREADY_LOGGED_IN",
-	0x00000101: "CKR_USER_NOT_LOGGED_IN",
-	0x00000102: "CKR_USER_PIN_NOT_INITIALIZED",
-	0x00000103: "CKR_USER_TYPE_INVALID",
-	0x00000104: "CKR_USER_ANOTHER_ALREADY_LOGGED_IN",
-	0x00000105: "CKR_USER_TOO_MANY_TYPES",
-	0x00000110: "CKR_WRAPPED_KEY_INVALID",
-	0x00000112: "CKR_WRAPPED_KEY_LEN_RANGE",
-	0x00000113: "CKR_WRAPPING_KEY_HANDLE_INVALID",
-	0x00000114: "CKR_WRAPPING_KEY_SIZE_RANGE",
-	0x00000115: "CKR_WRAPPING_KEY_TYPE_INCONSISTENT",
-	0x00000120: "CKR_RANDOM_SEED_NOT_SUPPORTED",
-	0x00000121: "CKR_RANDOM_NO_RNG",
-	0x00000130: "CKR_DOMAIN_PARAMS_INVALID",
-	0x00000150: "CKR_BUFFER_TOO_SMALL",
-	0x00000160: "CKR_SAVED_STATE_INVALID",
-	0x00000170: "CKR_INFORMATION_SENSITIVE",
-	0x00000180: "CKR_STATE_UNSAVEABLE",
-	0x00000190: "CKR_CRYPTOKI_NOT_INITIALIZED",
-	0x00000191: "CKR_CRYPTOKI_ALREADY_INITIALIZED",
-	0x000001A0: "CKR_MUTEX_BAD",
-	0x000001A1: "CKR_MUTEX_NOT_LOCKED",
-	0x000001B0: "CKR_NEW_PIN_MODE",
-	0x000001B1: "CKR_NEXT_OTP",
-	0x00000200: "CKR_FUNCTION_REJECTED",
-	0x80000000: "CKR_VENDOR_DEFINED",
-}
diff --git a/components/engine/vendor/github.com/miekg/pkcs11/pkcs11.go b/components/engine/vendor/github.com/miekg/pkcs11/pkcs11.go
deleted file mode 100644
index 424e74980a..0000000000
--- a/components/engine/vendor/github.com/miekg/pkcs11/pkcs11.go
+++ /dev/null
@@ -1,1575 +0,0 @@
-// Copyright 2013 Miek Gieben. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package pkcs11 is a wrapper around the PKCS#11 cryptographic library.
-package pkcs11
-
-// It is *assumed*, that:
-//
-// * Go's uint size == PKCS11's CK_ULONG size
-// * CK_ULONG never overflows an Go int
-
-/*
-#cgo LDFLAGS: -lltdl
-#define CK_PTR *
-#ifndef NULL_PTR
-#define NULL_PTR 0
-#endif
-#define CK_DEFINE_FUNCTION(returnType, name) returnType name
-#define CK_DECLARE_FUNCTION(returnType, name) returnType name
-#define CK_DECLARE_FUNCTION_POINTER(returnType, name) returnType (* name)
-#define CK_CALLBACK_FUNCTION(returnType, name) returnType (* name)
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <ltdl.h>
-#include <unistd.h>
-#include "pkcs11.h"
-
-struct ctx {
-	lt_dlhandle handle;
-	CK_FUNCTION_LIST_PTR sym;
-};
-
-// New initializes a ctx and fills the symbol table.
-struct ctx *New(const char *module)
-{
-	if (lt_dlinit() != 0) {
-		return NULL;
-	}
-	CK_C_GetFunctionList list;
-	struct ctx *c = calloc(1, sizeof(struct ctx));
-	c->handle = lt_dlopen(module);
-	if (c->handle == NULL) {
-		free(c);
-		return NULL;
-	}
-	list = (CK_C_GetFunctionList) lt_dlsym(c->handle, "C_GetFunctionList");
-	if (list == NULL) {
-		free(c);
-		return NULL;
-	}
-	list(&c->sym);
-	return c;
-}
-
-// Destroy cleans up a ctx.
-void Destroy(struct ctx *c)
-{
-	if (!c) {
-		return;
-	}
-	if (c->handle == NULL) {
-		return;
-	}
-	if (lt_dlclose(c->handle) < 0) {
-		return;
-	}
-	lt_dlexit();
-	free(c);
-}
-
-CK_RV Initialize(struct ctx * c, CK_VOID_PTR initArgs)
-{
-	return c->sym->C_Initialize(initArgs);
-}
-
-CK_RV Finalize(struct ctx * c)
-{
-	return c->sym->C_Finalize(NULL);
-}
-
-CK_RV GetInfo(struct ctx * c, CK_INFO_PTR info)
-{
-	return c->sym->C_GetInfo(info);
-}
-
-CK_RV GetSlotList(struct ctx * c, CK_BBOOL tokenPresent,
-		  CK_ULONG_PTR * slotList, CK_ULONG_PTR ulCount)
-{
-	CK_RV e = c->sym->C_GetSlotList(tokenPresent, NULL, ulCount);
-	if (e != CKR_OK) {
-		return e;
-	}
-	*slotList = calloc(*ulCount, sizeof(CK_SLOT_ID));
-	e = c->sym->C_GetSlotList(tokenPresent, *slotList, ulCount);
-	return e;
-}
-
-CK_RV GetSlotInfo(struct ctx * c, CK_ULONG slotID, CK_SLOT_INFO_PTR info)
-{
-	CK_RV e = c->sym->C_GetSlotInfo((CK_SLOT_ID) slotID, info);
-	return e;
-}
-
-CK_RV GetTokenInfo(struct ctx * c, CK_ULONG slotID, CK_TOKEN_INFO_PTR info)
-{
-	CK_RV e = c->sym->C_GetTokenInfo((CK_SLOT_ID) slotID, info);
-	return e;
-}
-
-CK_RV GetMechanismList(struct ctx * c, CK_ULONG slotID,
-		       CK_ULONG_PTR * mech, CK_ULONG_PTR mechlen)
-{
-	CK_RV e =
-	    c->sym->C_GetMechanismList((CK_SLOT_ID) slotID, NULL, mechlen);
-	if (e != CKR_OK) {
-		return e;
-	}
-	*mech = calloc(*mechlen, sizeof(CK_MECHANISM_TYPE));
-	e = c->sym->C_GetMechanismList((CK_SLOT_ID) slotID,
-				       (CK_MECHANISM_TYPE_PTR) * mech, mechlen);
-	return e;
-}
-
-CK_RV GetMechanismInfo(struct ctx * c, CK_ULONG slotID, CK_MECHANISM_TYPE mech,
-		       CK_MECHANISM_INFO_PTR info)
-{
-	CK_RV e = c->sym->C_GetMechanismInfo((CK_SLOT_ID) slotID, mech, info);
-	return e;
-}
-
-CK_RV InitToken(struct ctx * c, CK_ULONG slotID, char *pin, CK_ULONG pinlen,
-		char *label)
-{
-	CK_RV e =
-	    c->sym->C_InitToken((CK_SLOT_ID) slotID, (CK_UTF8CHAR_PTR) pin,
-				pinlen, (CK_UTF8CHAR_PTR) label);
-	return e;
-}
-
-CK_RV InitPIN(struct ctx * c, CK_SESSION_HANDLE sh, char *pin, CK_ULONG pinlen)
-{
-	CK_RV e = c->sym->C_InitPIN(sh, (CK_UTF8CHAR_PTR) pin, pinlen);
-	return e;
-}
-
-CK_RV SetPIN(struct ctx * c, CK_SESSION_HANDLE sh, char *oldpin,
-	     CK_ULONG oldpinlen, char *newpin, CK_ULONG newpinlen)
-{
-	CK_RV e = c->sym->C_SetPIN(sh, (CK_UTF8CHAR_PTR) oldpin, oldpinlen,
-				   (CK_UTF8CHAR_PTR) newpin, newpinlen);
-	return e;
-}
-
-CK_RV OpenSession(struct ctx * c, CK_ULONG slotID, CK_ULONG flags,
-		  CK_SESSION_HANDLE_PTR session)
-{
-	CK_RV e =
-	    c->sym->C_OpenSession((CK_SLOT_ID) slotID, (CK_FLAGS) flags, NULL,
-				  NULL, session);
-	return e;
-}
-
-CK_RV CloseSession(struct ctx * c, CK_SESSION_HANDLE session)
-{
-	CK_RV e = c->sym->C_CloseSession(session);
-	return e;
-}
-
-CK_RV CloseAllSessions(struct ctx * c, CK_ULONG slotID)
-{
-	CK_RV e = c->sym->C_CloseAllSessions(slotID);
-	return e;
-}
-
-CK_RV GetSessionInfo(struct ctx * c, CK_SESSION_HANDLE session,
-		     CK_SESSION_INFO_PTR info)
-{
-	CK_RV e = c->sym->C_GetSessionInfo(session, info);
-	return e;
-}
-
-CK_RV GetOperationState(struct ctx * c, CK_SESSION_HANDLE session,
-			CK_BYTE_PTR * state, CK_ULONG_PTR statelen)
-{
-	CK_RV rv = c->sym->C_GetOperationState(session, NULL, statelen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*state = calloc(*statelen, sizeof(CK_BYTE));
-	if (*state == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_GetOperationState(session, *state, statelen);
-	return rv;
-}
-
-CK_RV SetOperationState(struct ctx * c, CK_SESSION_HANDLE session,
-			CK_BYTE_PTR state, CK_ULONG statelen,
-			CK_OBJECT_HANDLE encryptkey, CK_OBJECT_HANDLE authkey)
-{
-	return c->sym->C_SetOperationState(session, state, statelen, encryptkey,
-					   authkey);
-}
-
-CK_RV Login(struct ctx *c, CK_SESSION_HANDLE session, CK_USER_TYPE userType,
-	    char *pin, CK_ULONG pinLen)
-{
-	if (pinLen == 0) {
-		pin = NULL;
-	}
-	CK_RV e =
-	    c->sym->C_Login(session, userType, (CK_UTF8CHAR_PTR) pin, pinLen);
-	return e;
-}
-
-CK_RV Logout(struct ctx * c, CK_SESSION_HANDLE session)
-{
-	CK_RV e = c->sym->C_Logout(session);
-	return e;
-}
-
-CK_RV CreateObject(struct ctx * c, CK_SESSION_HANDLE session,
-		   CK_ATTRIBUTE_PTR temp, CK_ULONG tempCount,
-		   CK_OBJECT_HANDLE_PTR obj)
-{
-	CK_RV e = c->sym->C_CreateObject(session, temp, tempCount, obj);
-	return e;
-}
-
-CK_RV CopyObject(struct ctx * c, CK_SESSION_HANDLE session, CK_OBJECT_HANDLE o,
-		 CK_ATTRIBUTE_PTR temp, CK_ULONG tempCount,
-		 CK_OBJECT_HANDLE_PTR obj)
-{
-	CK_RV e = c->sym->C_CopyObject(session, o, temp, tempCount, obj);
-	return e;
-}
-
-CK_RV DestroyObject(struct ctx * c, CK_SESSION_HANDLE session,
-		    CK_OBJECT_HANDLE object)
-{
-	CK_RV e = c->sym->C_DestroyObject(session, object);
-	return e;
-}
-
-CK_RV GetObjectSize(struct ctx * c, CK_SESSION_HANDLE session,
-		    CK_OBJECT_HANDLE object, CK_ULONG_PTR size)
-{
-	CK_RV e = c->sym->C_GetObjectSize(session, object, size);
-	return e;
-}
-
-CK_RV GetAttributeValue(struct ctx * c, CK_SESSION_HANDLE session,
-			CK_OBJECT_HANDLE object, CK_ATTRIBUTE_PTR temp,
-			CK_ULONG templen)
-{
-	// Call for the first time, check the returned ulValue in the attributes, then
-	// allocate enough space and try again.
-	CK_RV e = c->sym->C_GetAttributeValue(session, object, temp, templen);
-	if (e != CKR_OK) {
-		return e;
-	}
-	CK_ULONG i;
-	for (i = 0; i < templen; i++) {
-		if ((CK_LONG) temp[i].ulValueLen == -1) {
-			// either access denied or no such object
-			continue;
-		}
-		temp[i].pValue = calloc(temp[i].ulValueLen, sizeof(CK_BYTE));
-	}
-	e = c->sym->C_GetAttributeValue(session, object, temp, templen);
-	return e;
-}
-
-CK_RV SetAttributeValue(struct ctx * c, CK_SESSION_HANDLE session,
-			CK_OBJECT_HANDLE object, CK_ATTRIBUTE_PTR temp,
-			CK_ULONG templen)
-{
-	CK_RV e = c->sym->C_SetAttributeValue(session, object, temp, templen);
-	return e;
-}
-
-CK_RV FindObjectsInit(struct ctx * c, CK_SESSION_HANDLE session,
-		      CK_ATTRIBUTE_PTR temp, CK_ULONG tempCount)
-{
-	CK_RV e = c->sym->C_FindObjectsInit(session, temp, tempCount);
-	return e;
-}
-
-CK_RV FindObjects(struct ctx * c, CK_SESSION_HANDLE session,
-		  CK_OBJECT_HANDLE_PTR * obj, CK_ULONG max,
-		  CK_ULONG_PTR objCount)
-{
-	*obj = calloc(max, sizeof(CK_OBJECT_HANDLE));
-	CK_RV e = c->sym->C_FindObjects(session, *obj, max, objCount);
-	return e;
-}
-
-CK_RV FindObjectsFinal(struct ctx * c, CK_SESSION_HANDLE session)
-{
-	CK_RV e = c->sym->C_FindObjectsFinal(session);
-	return e;
-}
-
-CK_RV EncryptInit(struct ctx * c, CK_SESSION_HANDLE session,
-		  CK_MECHANISM_PTR mechanism, CK_OBJECT_HANDLE key)
-{
-	CK_RV e = c->sym->C_EncryptInit(session, mechanism, key);
-	return e;
-}
-
-CK_RV Encrypt(struct ctx * c, CK_SESSION_HANDLE session, CK_BYTE_PTR message,
-	      CK_ULONG mlen, CK_BYTE_PTR * enc, CK_ULONG_PTR enclen)
-{
-	CK_RV rv = c->sym->C_Encrypt(session, message, mlen, NULL, enclen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*enc = calloc(*enclen, sizeof(CK_BYTE));
-	if (*enc == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_Encrypt(session, message, mlen, *enc, enclen);
-	return rv;
-}
-
-CK_RV EncryptUpdate(struct ctx * c, CK_SESSION_HANDLE session,
-		    CK_BYTE_PTR plain, CK_ULONG plainlen, CK_BYTE_PTR * cipher,
-		    CK_ULONG_PTR cipherlen)
-{
-	CK_RV rv =
-	    c->sym->C_EncryptUpdate(session, plain, plainlen, NULL, cipherlen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*cipher = calloc(*cipherlen, sizeof(CK_BYTE));
-	if (*cipher == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_EncryptUpdate(session, plain, plainlen, *cipher,
-				     cipherlen);
-	return rv;
-}
-
-CK_RV EncryptFinal(struct ctx * c, CK_SESSION_HANDLE session,
-		   CK_BYTE_PTR * cipher, CK_ULONG_PTR cipherlen)
-{
-	CK_RV rv = c->sym->C_EncryptFinal(session, NULL, cipherlen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*cipher = calloc(*cipherlen, sizeof(CK_BYTE));
-	if (*cipher == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_EncryptFinal(session, *cipher, cipherlen);
-	return rv;
-}
-
-CK_RV DecryptInit(struct ctx * c, CK_SESSION_HANDLE session,
-		  CK_MECHANISM_PTR mechanism, CK_OBJECT_HANDLE key)
-{
-	CK_RV e = c->sym->C_DecryptInit(session, mechanism, key);
-	return e;
-}
-
-CK_RV Decrypt(struct ctx * c, CK_SESSION_HANDLE session, CK_BYTE_PTR cypher,
-	      CK_ULONG clen, CK_BYTE_PTR * plain, CK_ULONG_PTR plainlen)
-{
-	CK_RV e = c->sym->C_Decrypt(session, cypher, clen, NULL, plainlen);
-	if (e != CKR_OK) {
-		return e;
-	}
-	*plain = calloc(*plainlen, sizeof(CK_BYTE));
-	if (*plain == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	e = c->sym->C_Decrypt(session, cypher, clen, *plain, plainlen);
-	return e;
-}
-
-CK_RV DecryptUpdate(struct ctx * c, CK_SESSION_HANDLE session,
-		    CK_BYTE_PTR cipher, CK_ULONG cipherlen, CK_BYTE_PTR * part,
-		    CK_ULONG_PTR partlen)
-{
-	CK_RV rv =
-	    c->sym->C_DecryptUpdate(session, cipher, cipherlen, NULL, partlen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*part = calloc(*partlen, sizeof(CK_BYTE));
-	if (*part == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_DecryptUpdate(session, cipher, cipherlen, *part,
-				     partlen);
-	return rv;
-}
-
-CK_RV DecryptFinal(struct ctx * c, CK_SESSION_HANDLE session,
-		   CK_BYTE_PTR * plain, CK_ULONG_PTR plainlen)
-{
-	CK_RV rv = c->sym->C_DecryptFinal(session, NULL, plainlen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*plain = calloc(*plainlen, sizeof(CK_BYTE));
-	if (*plain == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_DecryptFinal(session, *plain, plainlen);
-	return rv;
-}
-
-CK_RV DigestInit(struct ctx * c, CK_SESSION_HANDLE session,
-		 CK_MECHANISM_PTR mechanism)
-{
-	CK_RV e = c->sym->C_DigestInit(session, mechanism);
-	return e;
-}
-
-CK_RV Digest(struct ctx * c, CK_SESSION_HANDLE session, CK_BYTE_PTR message,
-	     CK_ULONG mlen, CK_BYTE_PTR * hash, CK_ULONG_PTR hashlen)
-{
-	CK_RV rv = c->sym->C_Digest(session, message, mlen, NULL, hashlen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*hash = calloc(*hashlen, sizeof(CK_BYTE));
-	if (*hash == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_Digest(session, message, mlen, *hash, hashlen);
-	return rv;
-}
-
-CK_RV DigestUpdate(struct ctx * c, CK_SESSION_HANDLE session,
-		   CK_BYTE_PTR message, CK_ULONG mlen)
-{
-	CK_RV rv = c->sym->C_DigestUpdate(session, message, mlen);
-	return rv;
-}
-
-CK_RV DigestKey(struct ctx * c, CK_SESSION_HANDLE session, CK_OBJECT_HANDLE key)
-{
-	CK_RV rv = c->sym->C_DigestKey(session, key);
-	return rv;
-}
-
-CK_RV DigestFinal(struct ctx * c, CK_SESSION_HANDLE session, CK_BYTE_PTR * hash,
-		  CK_ULONG_PTR hashlen)
-{
-	CK_RV rv = c->sym->C_DigestFinal(session, NULL, hashlen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*hash = calloc(*hashlen, sizeof(CK_BYTE));
-	if (*hash == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_DigestFinal(session, *hash, hashlen);
-	return rv;
-}
-
-CK_RV SignInit(struct ctx * c, CK_SESSION_HANDLE session,
-	       CK_MECHANISM_PTR mechanism, CK_OBJECT_HANDLE key)
-{
-	CK_RV e = c->sym->C_SignInit(session, mechanism, key);
-	return e;
-}
-
-CK_RV Sign(struct ctx * c, CK_SESSION_HANDLE session, CK_BYTE_PTR message,
-	   CK_ULONG mlen, CK_BYTE_PTR * sig, CK_ULONG_PTR siglen)
-{
-	CK_RV rv = c->sym->C_Sign(session, message, mlen, NULL, siglen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*sig = calloc(*siglen, sizeof(CK_BYTE));
-	if (*sig == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_Sign(session, message, mlen, *sig, siglen);
-	return rv;
-}
-
-CK_RV SignUpdate(struct ctx * c, CK_SESSION_HANDLE session,
-		 CK_BYTE_PTR message, CK_ULONG mlen)
-{
-	CK_RV rv = c->sym->C_SignUpdate(session, message, mlen);
-	return rv;
-}
-
-CK_RV SignFinal(struct ctx * c, CK_SESSION_HANDLE session, CK_BYTE_PTR * sig,
-		CK_ULONG_PTR siglen)
-{
-	CK_RV rv = c->sym->C_SignFinal(session, NULL, siglen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*sig = calloc(*siglen, sizeof(CK_BYTE));
-	if (*sig == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_SignFinal(session, *sig, siglen);
-	return rv;
-}
-
-CK_RV SignRecoverInit(struct ctx * c, CK_SESSION_HANDLE session,
-		      CK_MECHANISM_PTR mech, CK_OBJECT_HANDLE key)
-{
-	CK_RV rv = c->sym->C_SignRecoverInit(session, mech, key);
-	return rv;
-}
-
-CK_RV SignRecover(struct ctx * c, CK_SESSION_HANDLE session, CK_BYTE_PTR data,
-		  CK_ULONG datalen, CK_BYTE_PTR * sig, CK_ULONG_PTR siglen)
-{
-	CK_RV rv = c->sym->C_SignRecover(session, data, datalen, NULL, siglen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*sig = calloc(*siglen, sizeof(CK_BYTE));
-	if (*sig == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_SignRecover(session, data, datalen, *sig, siglen);
-	return rv;
-}
-
-CK_RV VerifyInit(struct ctx * c, CK_SESSION_HANDLE session,
-		 CK_MECHANISM_PTR mech, CK_OBJECT_HANDLE key)
-{
-	CK_RV rv = c->sym->C_VerifyInit(session, mech, key);
-	return rv;
-}
-
-CK_RV Verify(struct ctx * c, CK_SESSION_HANDLE session, CK_BYTE_PTR message,
-	     CK_ULONG mesglen, CK_BYTE_PTR sig, CK_ULONG siglen)
-{
-	CK_RV rv = c->sym->C_Verify(session, message, mesglen, sig, siglen);
-	return rv;
-}
-
-CK_RV VerifyUpdate(struct ctx * c, CK_SESSION_HANDLE session,
-		   CK_BYTE_PTR part, CK_ULONG partlen)
-{
-	CK_RV rv = c->sym->C_VerifyUpdate(session, part, partlen);
-	return rv;
-}
-
-CK_RV VerifyFinal(struct ctx * c, CK_SESSION_HANDLE session, CK_BYTE_PTR sig,
-		  CK_ULONG siglen)
-{
-	CK_RV rv = c->sym->C_VerifyFinal(session, sig, siglen);
-	return rv;
-}
-
-CK_RV VerifyRecoverInit(struct ctx * c, CK_SESSION_HANDLE session,
-			CK_MECHANISM_PTR mech, CK_OBJECT_HANDLE key)
-{
-	CK_RV rv = c->sym->C_VerifyRecoverInit(session, mech, key);
-	return rv;
-}
-
-CK_RV VerifyRecover(struct ctx * c, CK_SESSION_HANDLE session, CK_BYTE_PTR sig,
-		    CK_ULONG siglen, CK_BYTE_PTR * data, CK_ULONG_PTR datalen)
-{
-	CK_RV rv = c->sym->C_VerifyRecover(session, sig, siglen, NULL, datalen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*data = calloc(*datalen, sizeof(CK_BYTE));
-	if (*data == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_VerifyRecover(session, sig, siglen, *data, datalen);
-	return rv;
-}
-
-CK_RV DigestEncryptUpdate(struct ctx * c, CK_SESSION_HANDLE session,
-			  CK_BYTE_PTR part, CK_ULONG partlen, CK_BYTE_PTR * enc,
-			  CK_ULONG_PTR enclen)
-{
-	CK_RV rv =
-	    c->sym->C_DigestEncryptUpdate(session, part, partlen, NULL, enclen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*enc = calloc(*enclen, sizeof(CK_BYTE));
-	if (*enc == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_DigestEncryptUpdate(session, part, partlen, *enc,
-					   enclen);
-	return rv;
-}
-
-CK_RV DecryptDigestUpdate(struct ctx * c, CK_SESSION_HANDLE session,
-			  CK_BYTE_PTR cipher, CK_ULONG cipherlen,
-			  CK_BYTE_PTR * part, CK_ULONG_PTR partlen)
-{
-	CK_RV rv =
-	    c->sym->C_DecryptDigestUpdate(session, cipher, cipherlen, NULL,
-					  partlen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*part = calloc(*partlen, sizeof(CK_BYTE));
-	if (*part == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_DecryptDigestUpdate(session, cipher, cipherlen, *part,
-					   partlen);
-	return rv;
-}
-
-CK_RV SignEncryptUpdate(struct ctx * c, CK_SESSION_HANDLE session,
-			CK_BYTE_PTR part, CK_ULONG partlen, CK_BYTE_PTR * enc,
-			CK_ULONG_PTR enclen)
-{
-	CK_RV rv =
-	    c->sym->C_SignEncryptUpdate(session, part, partlen, NULL, enclen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*enc = calloc(*enclen, sizeof(CK_BYTE));
-	if (*enc == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_SignEncryptUpdate(session, part, partlen, *enc, enclen);
-	return rv;
-}
-
-CK_RV DecryptVerifyUpdate(struct ctx * c, CK_SESSION_HANDLE session,
-			  CK_BYTE_PTR cipher, CK_ULONG cipherlen,
-			  CK_BYTE_PTR * part, CK_ULONG_PTR partlen)
-{
-	CK_RV rv =
-	    c->sym->C_DecryptVerifyUpdate(session, cipher, cipherlen, NULL,
-					  partlen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*part = calloc(*partlen, sizeof(CK_BYTE));
-	if (*part == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_DecryptVerifyUpdate(session, cipher, cipherlen, *part,
-					   partlen);
-	return rv;
-}
-
-CK_RV GenerateKey(struct ctx * c, CK_SESSION_HANDLE session,
-		  CK_MECHANISM_PTR mechanism, CK_ATTRIBUTE_PTR temp,
-		  CK_ULONG tempCount, CK_OBJECT_HANDLE_PTR key)
-{
-	CK_RV e =
-	    c->sym->C_GenerateKey(session, mechanism, temp, tempCount, key);
-	return e;
-}
-
-CK_RV GenerateKeyPair(struct ctx * c, CK_SESSION_HANDLE session,
-		      CK_MECHANISM_PTR mechanism, CK_ATTRIBUTE_PTR pub,
-		      CK_ULONG pubCount, CK_ATTRIBUTE_PTR priv,
-		      CK_ULONG privCount, CK_OBJECT_HANDLE_PTR pubkey,
-		      CK_OBJECT_HANDLE_PTR privkey)
-{
-	CK_RV e =
-	    c->sym->C_GenerateKeyPair(session, mechanism, pub, pubCount, priv,
-				      privCount,
-				      pubkey, privkey);
-	return e;
-}
-
-CK_RV WrapKey(struct ctx * c, CK_SESSION_HANDLE session,
-	      CK_MECHANISM_PTR mechanism, CK_OBJECT_HANDLE wrappingkey,
-	      CK_OBJECT_HANDLE key, CK_BYTE_PTR * wrapped,
-	      CK_ULONG_PTR wrappedlen)
-{
-	CK_RV rv = c->sym->C_WrapKey(session, mechanism, wrappingkey, key, NULL,
-				     wrappedlen);
-	if (rv != CKR_OK) {
-		return rv;
-	}
-	*wrapped = calloc(*wrappedlen, sizeof(CK_BYTE));
-	if (*wrapped == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	rv = c->sym->C_WrapKey(session, mechanism, wrappingkey, key, *wrapped,
-			       wrappedlen);
-	return rv;
-}
-
-CK_RV DeriveKey(struct ctx * c, CK_SESSION_HANDLE session,
-		CK_MECHANISM_PTR mech, CK_OBJECT_HANDLE basekey,
-		CK_ATTRIBUTE_PTR a, CK_ULONG alen, CK_OBJECT_HANDLE_PTR key)
-{
-	CK_RV e = c->sym->C_DeriveKey(session, mech, basekey, a, alen, key);
-	return e;
-}
-
-CK_RV UnwrapKey(struct ctx * c, CK_SESSION_HANDLE session,
-		CK_MECHANISM_PTR mech, CK_OBJECT_HANDLE unwrappingkey,
-		CK_BYTE_PTR wrappedkey, CK_ULONG wrappedkeylen,
-		CK_ATTRIBUTE_PTR a, CK_ULONG alen, CK_OBJECT_HANDLE_PTR key)
-{
-	CK_RV e = c->sym->C_UnwrapKey(session, mech, unwrappingkey, wrappedkey,
-				      wrappedkeylen, a, alen, key);
-	return e;
-}
-
-CK_RV SeedRandom(struct ctx * c, CK_SESSION_HANDLE session, CK_BYTE_PTR seed,
-		 CK_ULONG seedlen)
-{
-	CK_RV e = c->sym->C_SeedRandom(session, seed, seedlen);
-	return e;
-}
-
-CK_RV GenerateRandom(struct ctx * c, CK_SESSION_HANDLE session,
-		     CK_BYTE_PTR * rand, CK_ULONG length)
-{
-	*rand = calloc(length, sizeof(CK_BYTE));
-	if (*rand == NULL) {
-		return CKR_HOST_MEMORY;
-	}
-	CK_RV e = c->sym->C_GenerateRandom(session, *rand, length);
-	return e;
-}
-
-CK_RV WaitForSlotEvent(struct ctx * c, CK_FLAGS flags, CK_ULONG_PTR slot)
-{
-	CK_RV e =
-	    c->sym->C_WaitForSlotEvent(flags, (CK_SLOT_ID_PTR) slot, NULL);
-	return e;
-}
-*/
-import "C"
-import "strings"
-
-import "unsafe"
-
-// Ctx contains the current pkcs11 context.
-type Ctx struct {
-	ctx *C.struct_ctx
-}
-
-// New creates a new context and initializes the module/library for use.
-func New(module string) *Ctx {
-	c := new(Ctx)
-	mod := C.CString(module)
-	defer C.free(unsafe.Pointer(mod))
-	c.ctx = C.New(mod)
-	if c.ctx == nil {
-		return nil
-	}
-	return c
-}
-
-// Destroy unloads the module/library and frees any remaining memory.
-func (c *Ctx) Destroy() {
-	if c == nil || c.ctx == nil {
-		return
-	}
-	C.Destroy(c.ctx)
-	c.ctx = nil
-}
-
-/* Initialize initializes the Cryptoki library. */
-func (c *Ctx) Initialize() error {
-	args := &C.CK_C_INITIALIZE_ARGS{nil, nil, nil, nil, C.CKF_OS_LOCKING_OK, nil}
-	e := C.Initialize(c.ctx, C.CK_VOID_PTR(args))
-	return toError(e)
-}
-
-/* Finalize indicates that an application is done with the Cryptoki library. */
-func (c *Ctx) Finalize() error {
-	if c.ctx == nil {
-		return toError(CKR_CRYPTOKI_NOT_INITIALIZED)
-	}
-	e := C.Finalize(c.ctx)
-	return toError(e)
-}
-
-/* GetInfo returns general information about Cryptoki. */
-func (c *Ctx) GetInfo() (Info, error) {
-	var p C.CK_INFO
-	e := C.GetInfo(c.ctx, C.CK_INFO_PTR(&p))
-	i := Info{
-		CryptokiVersion:    toVersion(p.cryptokiVersion),
-		ManufacturerID:     strings.TrimRight(string(C.GoBytes(unsafe.Pointer(&p.manufacturerID[0]), 32)), " "),
-		Flags:              uint(p.flags),
-		LibraryDescription: strings.TrimRight(string(C.GoBytes(unsafe.Pointer(&p.libraryDescription[0]), 32)), " "),
-		LibraryVersion:     toVersion(p.libraryVersion),
-	}
-	return i, toError(e)
-}
-
-/* GetSlotList obtains a list of slots in the system. */
-func (c *Ctx) GetSlotList(tokenPresent bool) ([]uint, error) {
-	var (
-		slotList C.CK_ULONG_PTR
-		ulCount  C.CK_ULONG
-	)
-	e := C.GetSlotList(c.ctx, cBBool(tokenPresent), &slotList, &ulCount)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	l := toList(slotList, ulCount)
-	return l, nil
-}
-
-/* GetSlotInfo obtains information about a particular slot in the system. */
-func (c *Ctx) GetSlotInfo(slotID uint) (SlotInfo, error) {
-	var csi C.CK_SLOT_INFO
-	e := C.GetSlotInfo(c.ctx, C.CK_ULONG(slotID), &csi)
-	s := SlotInfo{
-		SlotDescription: strings.TrimRight(string(C.GoBytes(unsafe.Pointer(&csi.slotDescription[0]), 64)), " "),
-		ManufacturerID:  strings.TrimRight(string(C.GoBytes(unsafe.Pointer(&csi.manufacturerID[0]), 32)), " "),
-		Flags:           uint(csi.flags),
-		HardwareVersion: toVersion(csi.hardwareVersion),
-		FirmwareVersion: toVersion(csi.firmwareVersion),
-	}
-	return s, toError(e)
-}
-
-// GetTokenInfo obtains information about a particular token
-// in the system.
-func (c *Ctx) GetTokenInfo(slotID uint) (TokenInfo, error) {
-	var cti C.CK_TOKEN_INFO
-	e := C.GetTokenInfo(c.ctx, C.CK_ULONG(slotID), &cti)
-	s := TokenInfo{
-		Label:              strings.TrimRight(string(C.GoBytes(unsafe.Pointer(&cti.label[0]), 32)), " "),
-		ManufacturerID:     strings.TrimRight(string(C.GoBytes(unsafe.Pointer(&cti.manufacturerID[0]), 32)), " "),
-		Model:              strings.TrimRight(string(C.GoBytes(unsafe.Pointer(&cti.model[0]), 16)), " "),
-		SerialNumber:       strings.TrimRight(string(C.GoBytes(unsafe.Pointer(&cti.serialNumber[0]), 16)), " "),
-		Flags:              uint(cti.flags),
-		MaxSessionCount:    uint(cti.ulMaxSessionCount),
-		SessionCount:       uint(cti.ulSessionCount),
-		MaxRwSessionCount:  uint(cti.ulMaxRwSessionCount),
-		RwSessionCount:     uint(cti.ulRwSessionCount),
-		MaxPinLen:          uint(cti.ulMaxPinLen),
-		MinPinLen:          uint(cti.ulMinPinLen),
-		TotalPublicMemory:  uint(cti.ulTotalPublicMemory),
-		FreePublicMemory:   uint(cti.ulFreePublicMemory),
-		TotalPrivateMemory: uint(cti.ulTotalPrivateMemory),
-		FreePrivateMemory:  uint(cti.ulFreePrivateMemory),
-		HardwareVersion:    toVersion(cti.hardwareVersion),
-		FirmwareVersion:    toVersion(cti.firmwareVersion),
-		UTCTime:            strings.TrimRight(string(C.GoBytes(unsafe.Pointer(&cti.utcTime[0]), 16)), " "),
-	}
-	return s, toError(e)
-}
-
-/* GetMechanismList obtains a list of mechanism types supported by a token. */
-func (c *Ctx) GetMechanismList(slotID uint) ([]*Mechanism, error) {
-	var (
-		mech    C.CK_ULONG_PTR // in pkcs#11 we're all CK_ULONGs \o/
-		mechlen C.CK_ULONG
-	)
-	e := C.GetMechanismList(c.ctx, C.CK_ULONG(slotID), &mech, &mechlen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	// Although the function returns only type, cast them back into real
-	// attributes as this is used in other functions.
-	m := make([]*Mechanism, int(mechlen))
-	for i, typ := range toList(mech, mechlen) {
-		m[i] = NewMechanism(typ, nil)
-	}
-	return m, nil
-}
-
-// GetMechanismInfo obtains information about a particular
-// mechanism possibly supported by a token.
-func (c *Ctx) GetMechanismInfo(slotID uint, m []*Mechanism) (MechanismInfo, error) {
-	var cm C.CK_MECHANISM_INFO
-	e := C.GetMechanismInfo(c.ctx, C.CK_ULONG(slotID), C.CK_MECHANISM_TYPE(m[0].Mechanism),
-		C.CK_MECHANISM_INFO_PTR(&cm))
-	mi := MechanismInfo{
-		MinKeySize: uint(cm.ulMinKeySize),
-		MaxKeySize: uint(cm.ulMaxKeySize),
-		Flags:      uint(cm.flags),
-	}
-	return mi, toError(e)
-}
-
-// InitToken initializes a token. The label must be 32 characters
-// long, it is blank padded if it is not. If it is longer it is capped
-// to 32 characters.
-func (c *Ctx) InitToken(slotID uint, pin string, label string) error {
-	p := C.CString(pin)
-	defer C.free(unsafe.Pointer(p))
-	ll := len(label)
-	for ll < 32 {
-		label += " "
-		ll++
-	}
-	l := C.CString(label[:32])
-	defer C.free(unsafe.Pointer(l))
-	e := C.InitToken(c.ctx, C.CK_ULONG(slotID), p, C.CK_ULONG(len(pin)), l)
-	return toError(e)
-}
-
-/* InitPIN initializes the normal user's PIN. */
-func (c *Ctx) InitPIN(sh SessionHandle, pin string) error {
-	p := C.CString(pin)
-	defer C.free(unsafe.Pointer(p))
-	e := C.InitPIN(c.ctx, C.CK_SESSION_HANDLE(sh), p, C.CK_ULONG(len(pin)))
-	return toError(e)
-}
-
-/* SetPIN modifies the PIN of the user who is logged in. */
-func (c *Ctx) SetPIN(sh SessionHandle, oldpin string, newpin string) error {
-	old := C.CString(oldpin)
-	defer C.free(unsafe.Pointer(old))
-	new := C.CString(newpin)
-	defer C.free(unsafe.Pointer(new))
-	e := C.SetPIN(c.ctx, C.CK_SESSION_HANDLE(sh), old, C.CK_ULONG(len(oldpin)), new, C.CK_ULONG(len(newpin)))
-	return toError(e)
-}
-
-/* OpenSession opens a session between an application and a token. */
-func (c *Ctx) OpenSession(slotID uint, flags uint) (SessionHandle, error) {
-	var s C.CK_SESSION_HANDLE
-	e := C.OpenSession(c.ctx, C.CK_ULONG(slotID), C.CK_ULONG(flags), C.CK_SESSION_HANDLE_PTR(&s))
-	return SessionHandle(s), toError(e)
-}
-
-/* CloseSession closes a session between an application and a token. */
-func (c *Ctx) CloseSession(sh SessionHandle) error {
-	if c.ctx == nil {
-		return toError(CKR_CRYPTOKI_NOT_INITIALIZED)
-	}
-	e := C.CloseSession(c.ctx, C.CK_SESSION_HANDLE(sh))
-	return toError(e)
-}
-
-/* CloseAllSessions closes all sessions with a token. */
-func (c *Ctx) CloseAllSessions(slotID uint) error {
-	if c.ctx == nil {
-		return toError(CKR_CRYPTOKI_NOT_INITIALIZED)
-	}
-	e := C.CloseAllSessions(c.ctx, C.CK_ULONG(slotID))
-	return toError(e)
-}
-
-/* GetSessionInfo obtains information about the session. */
-func (c *Ctx) GetSessionInfo(sh SessionHandle) (SessionInfo, error) {
-	var csi C.CK_SESSION_INFO
-	e := C.GetSessionInfo(c.ctx, C.CK_SESSION_HANDLE(sh), &csi)
-	s := SessionInfo{SlotID: uint(csi.slotID),
-		State:       uint(csi.state),
-		Flags:       uint(csi.flags),
-		DeviceError: uint(csi.ulDeviceError),
-	}
-	return s, toError(e)
-}
-
-/* GetOperationState obtains the state of the cryptographic operation in a session. */
-func (c *Ctx) GetOperationState(sh SessionHandle) ([]byte, error) {
-	var (
-		state    C.CK_BYTE_PTR
-		statelen C.CK_ULONG
-	)
-	e := C.GetOperationState(c.ctx, C.CK_SESSION_HANDLE(sh), &state, &statelen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	b := C.GoBytes(unsafe.Pointer(state), C.int(statelen))
-	C.free(unsafe.Pointer(state))
-	return b, nil
-}
-
-/* SetOperationState restores the state of the cryptographic operation in a session. */
-func (c *Ctx) SetOperationState(sh SessionHandle, state []byte, encryptKey, authKey ObjectHandle) error {
-	e := C.SetOperationState(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&state[0])),
-		C.CK_ULONG(len(state)), C.CK_OBJECT_HANDLE(encryptKey), C.CK_OBJECT_HANDLE(authKey))
-	return toError(e)
-}
-
-/* Login logs a user into a token. */
-func (c *Ctx) Login(sh SessionHandle, userType uint, pin string) error {
-	p := C.CString(pin)
-	defer C.free(unsafe.Pointer(p))
-	e := C.Login(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_USER_TYPE(userType), p, C.CK_ULONG(len(pin)))
-	return toError(e)
-}
-
-/* Logout logs a user out from a token. */
-func (c *Ctx) Logout(sh SessionHandle) error {
-	if c.ctx == nil {
-		return toError(CKR_CRYPTOKI_NOT_INITIALIZED)
-	}
-	e := C.Logout(c.ctx, C.CK_SESSION_HANDLE(sh))
-	return toError(e)
-}
-
-/* CreateObject creates a new object. */
-func (c *Ctx) CreateObject(sh SessionHandle, temp []*Attribute) (ObjectHandle, error) {
-	var obj C.CK_OBJECT_HANDLE
-	arena, t, tcount := cAttributeList(temp)
-	defer arena.Free()
-	e := C.CreateObject(c.ctx, C.CK_SESSION_HANDLE(sh), t, tcount, C.CK_OBJECT_HANDLE_PTR(&obj))
-	e1 := toError(e)
-	if e1 == nil {
-		return ObjectHandle(obj), nil
-	}
-	return 0, e1
-}
-
-/* CopyObject copies an object, creating a new object for the copy. */
-func (c *Ctx) CopyObject(sh SessionHandle, o ObjectHandle, temp []*Attribute) (ObjectHandle, error) {
-	var obj C.CK_OBJECT_HANDLE
-	arena, t, tcount := cAttributeList(temp)
-	defer arena.Free()
-
-	e := C.CopyObject(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_OBJECT_HANDLE(o), t, tcount, C.CK_OBJECT_HANDLE_PTR(&obj))
-	e1 := toError(e)
-	if e1 == nil {
-		return ObjectHandle(obj), nil
-	}
-	return 0, e1
-}
-
-/* DestroyObject destroys an object. */
-func (c *Ctx) DestroyObject(sh SessionHandle, oh ObjectHandle) error {
-	e := C.DestroyObject(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_OBJECT_HANDLE(oh))
-	return toError(e)
-}
-
-/* GetObjectSize gets the size of an object in bytes. */
-func (c *Ctx) GetObjectSize(sh SessionHandle, oh ObjectHandle) (uint, error) {
-	var size C.CK_ULONG
-	e := C.GetObjectSize(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_OBJECT_HANDLE(oh), &size)
-	return uint(size), toError(e)
-}
-
-/* GetAttributeValue obtains the value of one or more object attributes. */
-func (c *Ctx) GetAttributeValue(sh SessionHandle, o ObjectHandle, a []*Attribute) ([]*Attribute, error) {
-	// copy the attribute list and make all the values nil, so that
-	// the C function can (allocate) fill them in
-	pa := make([]C.CK_ATTRIBUTE, len(a))
-	for i := 0; i < len(a); i++ {
-		pa[i]._type = C.CK_ATTRIBUTE_TYPE(a[i].Type)
-	}
-	e := C.GetAttributeValue(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_OBJECT_HANDLE(o), C.CK_ATTRIBUTE_PTR(&pa[0]), C.CK_ULONG(len(a)))
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	a1 := make([]*Attribute, len(a))
-	for i, c := range pa {
-		x := new(Attribute)
-		x.Type = uint(c._type)
-		if int(c.ulValueLen) != -1 {
-			x.Value = C.GoBytes(unsafe.Pointer(c.pValue), C.int(c.ulValueLen))
-			C.free(unsafe.Pointer(c.pValue))
-		}
-		a1[i] = x
-	}
-	return a1, nil
-}
-
-/* SetAttributeValue modifies the value of one or more object attributes */
-func (c *Ctx) SetAttributeValue(sh SessionHandle, o ObjectHandle, a []*Attribute) error {
-	arena, pa, palen := cAttributeList(a)
-	defer arena.Free()
-	e := C.SetAttributeValue(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_OBJECT_HANDLE(o), pa, palen)
-	return toError(e)
-}
-
-// FindObjectsInit initializes a search for token and session
-// objects that match a template.
-func (c *Ctx) FindObjectsInit(sh SessionHandle, temp []*Attribute) error {
-	arena, t, tcount := cAttributeList(temp)
-	defer arena.Free()
-	e := C.FindObjectsInit(c.ctx, C.CK_SESSION_HANDLE(sh), t, tcount)
-	return toError(e)
-}
-
-// FindObjects continues a search for token and session
-// objects that match a template, obtaining additional object
-// handles. The returned boolean indicates if the list would
-// have been larger than max.
-func (c *Ctx) FindObjects(sh SessionHandle, max int) ([]ObjectHandle, bool, error) {
-	var (
-		objectList C.CK_OBJECT_HANDLE_PTR
-		ulCount    C.CK_ULONG
-	)
-	e := C.FindObjects(c.ctx, C.CK_SESSION_HANDLE(sh), &objectList, C.CK_ULONG(max), &ulCount)
-	if toError(e) != nil {
-		return nil, false, toError(e)
-	}
-	l := toList(C.CK_ULONG_PTR(unsafe.Pointer(objectList)), ulCount)
-	// Make again a new list of the correct type.
-	// This is copying data, but this is not an often used function.
-	o := make([]ObjectHandle, len(l))
-	for i, v := range l {
-		o[i] = ObjectHandle(v)
-	}
-	return o, ulCount > C.CK_ULONG(max), nil
-}
-
-/* FindObjectsFinal finishes a search for token and session objects. */
-func (c *Ctx) FindObjectsFinal(sh SessionHandle) error {
-	e := C.FindObjectsFinal(c.ctx, C.CK_SESSION_HANDLE(sh))
-	return toError(e)
-}
-
-/* EncryptInit initializes an encryption operation. */
-func (c *Ctx) EncryptInit(sh SessionHandle, m []*Mechanism, o ObjectHandle) error {
-	arena, mech, _ := cMechanismList(m)
-	defer arena.Free()
-	e := C.EncryptInit(c.ctx, C.CK_SESSION_HANDLE(sh), mech, C.CK_OBJECT_HANDLE(o))
-	return toError(e)
-}
-
-/* Encrypt encrypts single-part data. */
-func (c *Ctx) Encrypt(sh SessionHandle, message []byte) ([]byte, error) {
-	var (
-		enc    C.CK_BYTE_PTR
-		enclen C.CK_ULONG
-	)
-	e := C.Encrypt(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&message[0])), C.CK_ULONG(len(message)), &enc, &enclen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	s := C.GoBytes(unsafe.Pointer(enc), C.int(enclen))
-	C.free(unsafe.Pointer(enc))
-	return s, nil
-}
-
-/* EncryptUpdate continues a multiple-part encryption operation. */
-func (c *Ctx) EncryptUpdate(sh SessionHandle, plain []byte) ([]byte, error) {
-	var (
-		part    C.CK_BYTE_PTR
-		partlen C.CK_ULONG
-	)
-	e := C.EncryptUpdate(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&plain[0])), C.CK_ULONG(len(plain)), &part, &partlen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	h := C.GoBytes(unsafe.Pointer(part), C.int(partlen))
-	C.free(unsafe.Pointer(part))
-	return h, nil
-}
-
-// EncryptFinal finishes a multiple-part encryption operation.
-func (c *Ctx) EncryptFinal(sh SessionHandle) ([]byte, error) {
-	var (
-		enc    C.CK_BYTE_PTR
-		enclen C.CK_ULONG
-	)
-	e := C.EncryptFinal(c.ctx, C.CK_SESSION_HANDLE(sh), &enc, &enclen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	h := C.GoBytes(unsafe.Pointer(enc), C.int(enclen))
-	C.free(unsafe.Pointer(enc))
-	return h, nil
-}
-
-/* DecryptInit initializes a decryption operation. */
-func (c *Ctx) DecryptInit(sh SessionHandle, m []*Mechanism, o ObjectHandle) error {
-	arena, mech, _ := cMechanismList(m)
-	defer arena.Free()
-	e := C.DecryptInit(c.ctx, C.CK_SESSION_HANDLE(sh), mech, C.CK_OBJECT_HANDLE(o))
-	return toError(e)
-}
-
-/* Decrypt decrypts encrypted data in a single part. */
-func (c *Ctx) Decrypt(sh SessionHandle, cypher []byte) ([]byte, error) {
-	var (
-		plain    C.CK_BYTE_PTR
-		plainlen C.CK_ULONG
-	)
-	e := C.Decrypt(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&cypher[0])), C.CK_ULONG(len(cypher)), &plain, &plainlen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	s := C.GoBytes(unsafe.Pointer(plain), C.int(plainlen))
-	C.free(unsafe.Pointer(plain))
-	return s, nil
-}
-
-/* DecryptUpdate continues a multiple-part decryption operation. */
-func (c *Ctx) DecryptUpdate(sh SessionHandle, cipher []byte) ([]byte, error) {
-	var (
-		part    C.CK_BYTE_PTR
-		partlen C.CK_ULONG
-	)
-	e := C.DecryptUpdate(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&cipher[0])), C.CK_ULONG(len(cipher)), &part, &partlen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	h := C.GoBytes(unsafe.Pointer(part), C.int(partlen))
-	C.free(unsafe.Pointer(part))
-	return h, nil
-}
-
-/* DecryptFinal finishes a multiple-part decryption operation. */
-func (c *Ctx) DecryptFinal(sh SessionHandle) ([]byte, error) {
-	var (
-		plain    C.CK_BYTE_PTR
-		plainlen C.CK_ULONG
-	)
-	e := C.DecryptFinal(c.ctx, C.CK_SESSION_HANDLE(sh), &plain, &plainlen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	h := C.GoBytes(unsafe.Pointer(plain), C.int(plainlen))
-	C.free(unsafe.Pointer(plain))
-	return h, nil
-}
-
-/* DigestInit initializes a message-digesting operation. */
-func (c *Ctx) DigestInit(sh SessionHandle, m []*Mechanism) error {
-	arena, mech, _ := cMechanismList(m)
-	defer arena.Free()
-	e := C.DigestInit(c.ctx, C.CK_SESSION_HANDLE(sh), mech)
-	return toError(e)
-}
-
-/* Digest digests message in a single part. */
-func (c *Ctx) Digest(sh SessionHandle, message []byte) ([]byte, error) {
-	var (
-		hash    C.CK_BYTE_PTR
-		hashlen C.CK_ULONG
-	)
-	e := C.Digest(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&message[0])), C.CK_ULONG(len(message)), &hash, &hashlen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	h := C.GoBytes(unsafe.Pointer(hash), C.int(hashlen))
-	C.free(unsafe.Pointer(hash))
-	return h, nil
-}
-
-/* DigestUpdate continues a multiple-part message-digesting operation. */
-func (c *Ctx) DigestUpdate(sh SessionHandle, message []byte) error {
-	e := C.DigestUpdate(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&message[0])), C.CK_ULONG(len(message)))
-	if toError(e) != nil {
-		return toError(e)
-	}
-	return nil
-}
-
-// DigestKey continues a multi-part message-digesting
-// operation, by digesting the value of a secret key as part of
-// the data already digested.
-func (c *Ctx) DigestKey(sh SessionHandle, key ObjectHandle) error {
-	e := C.DigestKey(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_OBJECT_HANDLE(key))
-	if toError(e) != nil {
-		return toError(e)
-	}
-	return nil
-}
-
-/* DigestFinal finishes a multiple-part message-digesting operation. */
-func (c *Ctx) DigestFinal(sh SessionHandle) ([]byte, error) {
-	var (
-		hash    C.CK_BYTE_PTR
-		hashlen C.CK_ULONG
-	)
-	e := C.DigestFinal(c.ctx, C.CK_SESSION_HANDLE(sh), &hash, &hashlen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	h := C.GoBytes(unsafe.Pointer(hash), C.int(hashlen))
-	C.free(unsafe.Pointer(hash))
-	return h, nil
-}
-
-// SignInit initializes a signature (private key encryption)
-// operation, where the signature is (will be) an appendix to
-// the data, and plaintext cannot be recovered from the
-// signature.
-func (c *Ctx) SignInit(sh SessionHandle, m []*Mechanism, o ObjectHandle) error {
-	arena, mech, _ := cMechanismList(m) // Only the first is used, but still use a list.
-	defer arena.Free()
-	e := C.SignInit(c.ctx, C.CK_SESSION_HANDLE(sh), mech, C.CK_OBJECT_HANDLE(o))
-	return toError(e)
-}
-
-// Sign signs (encrypts with private key) data in a single part, where the signature
-// is (will be) an appendix to the data, and plaintext cannot be recovered from the signature.
-func (c *Ctx) Sign(sh SessionHandle, message []byte) ([]byte, error) {
-	var (
-		sig    C.CK_BYTE_PTR
-		siglen C.CK_ULONG
-	)
-	e := C.Sign(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&message[0])), C.CK_ULONG(len(message)), &sig, &siglen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	s := C.GoBytes(unsafe.Pointer(sig), C.int(siglen))
-	C.free(unsafe.Pointer(sig))
-	return s, nil
-}
-
-// SignUpdate continues a multiple-part signature operation,
-// where the signature is (will be) an appendix to the data,
-// and plaintext cannot be recovered from the signature.
-func (c *Ctx) SignUpdate(sh SessionHandle, message []byte) error {
-	e := C.SignUpdate(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&message[0])), C.CK_ULONG(len(message)))
-	return toError(e)
-}
-
-/* SignFinal finishes a multiple-part signature operation returning the signature. */
-func (c *Ctx) SignFinal(sh SessionHandle) ([]byte, error) {
-	var (
-		sig    C.CK_BYTE_PTR
-		siglen C.CK_ULONG
-	)
-	e := C.SignFinal(c.ctx, C.CK_SESSION_HANDLE(sh), &sig, &siglen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	h := C.GoBytes(unsafe.Pointer(sig), C.int(siglen))
-	C.free(unsafe.Pointer(sig))
-	return h, nil
-}
-
-// SignRecoverInit initializes a signature operation, where
-// the data can be recovered from the signature.
-func (c *Ctx) SignRecoverInit(sh SessionHandle, m []*Mechanism, key ObjectHandle) error {
-	arena, mech, _ := cMechanismList(m)
-	defer arena.Free()
-	e := C.SignRecoverInit(c.ctx, C.CK_SESSION_HANDLE(sh), mech, C.CK_OBJECT_HANDLE(key))
-	return toError(e)
-}
-
-// SignRecover signs data in a single operation, where the
-// data can be recovered from the signature.
-func (c *Ctx) SignRecover(sh SessionHandle, data []byte) ([]byte, error) {
-	var (
-		sig    C.CK_BYTE_PTR
-		siglen C.CK_ULONG
-	)
-	e := C.SignRecover(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&data[0])), C.CK_ULONG(len(data)), &sig, &siglen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	h := C.GoBytes(unsafe.Pointer(sig), C.int(siglen))
-	C.free(unsafe.Pointer(sig))
-	return h, nil
-}
-
-// VerifyInit initializes a verification operation, where the
-// signature is an appendix to the data, and plaintext cannot
-// be recovered from the signature (e.g. DSA).
-func (c *Ctx) VerifyInit(sh SessionHandle, m []*Mechanism, key ObjectHandle) error {
-	arena, mech, _ := cMechanismList(m) // only use one here
-	defer arena.Free()
-	e := C.VerifyInit(c.ctx, C.CK_SESSION_HANDLE(sh), mech, C.CK_OBJECT_HANDLE(key))
-	return toError(e)
-}
-
-// Verify verifies a signature in a single-part operation,
-// where the signature is an appendix to the data, and plaintext
-// cannot be recovered from the signature.
-func (c *Ctx) Verify(sh SessionHandle, data []byte, signature []byte) error {
-	e := C.Verify(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&data[0])), C.CK_ULONG(len(data)), C.CK_BYTE_PTR(unsafe.Pointer(&signature[0])), C.CK_ULONG(len(signature)))
-	return toError(e)
-}
-
-// VerifyUpdate continues a multiple-part verification
-// operation, where the signature is an appendix to the data,
-// and plaintext cannot be recovered from the signature.
-func (c *Ctx) VerifyUpdate(sh SessionHandle, part []byte) error {
-	e := C.VerifyUpdate(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&part[0])), C.CK_ULONG(len(part)))
-	return toError(e)
-}
-
-// VerifyFinal finishes a multiple-part verification
-// operation, checking the signature.
-func (c *Ctx) VerifyFinal(sh SessionHandle, signature []byte) error {
-	e := C.VerifyFinal(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&signature[0])), C.CK_ULONG(len(signature)))
-	return toError(e)
-}
-
-// VerifyRecoverInit initializes a signature verification
-// operation, where the data is recovered from the signature.
-func (c *Ctx) VerifyRecoverInit(sh SessionHandle, m []*Mechanism, key ObjectHandle) error {
-	arena, mech, _ := cMechanismList(m)
-	defer arena.Free()
-	e := C.VerifyRecoverInit(c.ctx, C.CK_SESSION_HANDLE(sh), mech, C.CK_OBJECT_HANDLE(key))
-	return toError(e)
-}
-
-// VerifyRecover verifies a signature in a single-part
-// operation, where the data is recovered from the signature.
-func (c *Ctx) VerifyRecover(sh SessionHandle, signature []byte) ([]byte, error) {
-	var (
-		data    C.CK_BYTE_PTR
-		datalen C.CK_ULONG
-	)
-	e := C.DecryptVerifyUpdate(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&signature[0])), C.CK_ULONG(len(signature)), &data, &datalen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	h := C.GoBytes(unsafe.Pointer(data), C.int(datalen))
-	C.free(unsafe.Pointer(data))
-	return h, nil
-}
-
-// DigestEncryptUpdate continues a multiple-part digesting
-// and encryption operation.
-func (c *Ctx) DigestEncryptUpdate(sh SessionHandle, part []byte) ([]byte, error) {
-	var (
-		enc    C.CK_BYTE_PTR
-		enclen C.CK_ULONG
-	)
-	e := C.DigestEncryptUpdate(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&part[0])), C.CK_ULONG(len(part)), &enc, &enclen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	h := C.GoBytes(unsafe.Pointer(enc), C.int(enclen))
-	C.free(unsafe.Pointer(enc))
-	return h, nil
-}
-
-/* DecryptDigestUpdate continues a multiple-part decryption and digesting operation. */
-func (c *Ctx) DecryptDigestUpdate(sh SessionHandle, cipher []byte) ([]byte, error) {
-	var (
-		part    C.CK_BYTE_PTR
-		partlen C.CK_ULONG
-	)
-	e := C.DecryptDigestUpdate(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&cipher[0])), C.CK_ULONG(len(cipher)), &part, &partlen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	h := C.GoBytes(unsafe.Pointer(part), C.int(partlen))
-	C.free(unsafe.Pointer(part))
-	return h, nil
-}
-
-/* SignEncryptUpdate continues a multiple-part signing and encryption operation. */
-func (c *Ctx) SignEncryptUpdate(sh SessionHandle, part []byte) ([]byte, error) {
-	var (
-		enc    C.CK_BYTE_PTR
-		enclen C.CK_ULONG
-	)
-	e := C.SignEncryptUpdate(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&part[0])), C.CK_ULONG(len(part)), &enc, &enclen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	h := C.GoBytes(unsafe.Pointer(enc), C.int(enclen))
-	C.free(unsafe.Pointer(enc))
-	return h, nil
-}
-
-/* DecryptVerifyUpdate continues a multiple-part decryption and verify operation. */
-func (c *Ctx) DecryptVerifyUpdate(sh SessionHandle, cipher []byte) ([]byte, error) {
-	var (
-		part    C.CK_BYTE_PTR
-		partlen C.CK_ULONG
-	)
-	e := C.DecryptVerifyUpdate(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&cipher[0])), C.CK_ULONG(len(cipher)), &part, &partlen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	h := C.GoBytes(unsafe.Pointer(part), C.int(partlen))
-	C.free(unsafe.Pointer(part))
-	return h, nil
-}
-
-/* GenerateKey generates a secret key, creating a new key object. */
-func (c *Ctx) GenerateKey(sh SessionHandle, m []*Mechanism, temp []*Attribute) (ObjectHandle, error) {
-	var key C.CK_OBJECT_HANDLE
-	attrarena, t, tcount := cAttributeList(temp)
-	defer attrarena.Free()
-	mecharena, mech, _ := cMechanismList(m)
-	defer mecharena.Free()
-	e := C.GenerateKey(c.ctx, C.CK_SESSION_HANDLE(sh), mech, t, tcount, C.CK_OBJECT_HANDLE_PTR(&key))
-	e1 := toError(e)
-	if e1 == nil {
-		return ObjectHandle(key), nil
-	}
-	return 0, e1
-}
-
-/* GenerateKeyPair generates a public-key/private-key pair creating new key objects. */
-func (c *Ctx) GenerateKeyPair(sh SessionHandle, m []*Mechanism, public, private []*Attribute) (ObjectHandle, ObjectHandle, error) {
-	var (
-		pubkey  C.CK_OBJECT_HANDLE
-		privkey C.CK_OBJECT_HANDLE
-	)
-	pubarena, pub, pubcount := cAttributeList(public)
-	defer pubarena.Free()
-	privarena, priv, privcount := cAttributeList(private)
-	defer privarena.Free()
-	mecharena, mech, _ := cMechanismList(m)
-	defer mecharena.Free()
-	e := C.GenerateKeyPair(c.ctx, C.CK_SESSION_HANDLE(sh), mech, pub, pubcount, priv, privcount, C.CK_OBJECT_HANDLE_PTR(&pubkey), C.CK_OBJECT_HANDLE_PTR(&privkey))
-	e1 := toError(e)
-	if e1 == nil {
-		return ObjectHandle(pubkey), ObjectHandle(privkey), nil
-	}
-	return 0, 0, e1
-}
-
-/* WrapKey wraps (i.e., encrypts) a key. */
-func (c *Ctx) WrapKey(sh SessionHandle, m []*Mechanism, wrappingkey, key ObjectHandle) ([]byte, error) {
-	var (
-		wrappedkey    C.CK_BYTE_PTR
-		wrappedkeylen C.CK_ULONG
-	)
-	arena, mech, _ := cMechanismList(m)
-	defer arena.Free()
-	e := C.WrapKey(c.ctx, C.CK_SESSION_HANDLE(sh), mech, C.CK_OBJECT_HANDLE(wrappingkey), C.CK_OBJECT_HANDLE(key), &wrappedkey, &wrappedkeylen)
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	h := C.GoBytes(unsafe.Pointer(wrappedkey), C.int(wrappedkeylen))
-	C.free(unsafe.Pointer(wrappedkey))
-	return h, nil
-}
-
-/* UnwrapKey unwraps (decrypts) a wrapped key, creating a new key object. */
-func (c *Ctx) UnwrapKey(sh SessionHandle, m []*Mechanism, unwrappingkey ObjectHandle, wrappedkey []byte, a []*Attribute) (ObjectHandle, error) {
-	var key C.CK_OBJECT_HANDLE
-	attrarena, ac, aclen := cAttributeList(a)
-	defer attrarena.Free()
-	mecharena, mech, _ := cMechanismList(m)
-	defer mecharena.Free()
-	e := C.UnwrapKey(c.ctx, C.CK_SESSION_HANDLE(sh), mech, C.CK_OBJECT_HANDLE(unwrappingkey), C.CK_BYTE_PTR(unsafe.Pointer(&wrappedkey[0])), C.CK_ULONG(len(wrappedkey)), ac, aclen, &key)
-	return ObjectHandle(key), toError(e)
-}
-
-// DeriveKey derives a key from a base key, creating a new key object. */
-func (c *Ctx) DeriveKey(sh SessionHandle, m []*Mechanism, basekey ObjectHandle, a []*Attribute) (ObjectHandle, error) {
-	var key C.CK_OBJECT_HANDLE
-	attrarena, ac, aclen := cAttributeList(a)
-	defer attrarena.Free()
-	mecharena, mech, _ := cMechanismList(m)
-	defer mecharena.Free()
-	e := C.DeriveKey(c.ctx, C.CK_SESSION_HANDLE(sh), mech, C.CK_OBJECT_HANDLE(basekey), ac, aclen, &key)
-	return ObjectHandle(key), toError(e)
-}
-
-// SeedRandom mixes additional seed material into the token's
-// random number generator.
-func (c *Ctx) SeedRandom(sh SessionHandle, seed []byte) error {
-	e := C.SeedRandom(c.ctx, C.CK_SESSION_HANDLE(sh), C.CK_BYTE_PTR(unsafe.Pointer(&seed[0])), C.CK_ULONG(len(seed)))
-	return toError(e)
-}
-
-/* GenerateRandom generates random data. */
-func (c *Ctx) GenerateRandom(sh SessionHandle, length int) ([]byte, error) {
-	var rand C.CK_BYTE_PTR
-	e := C.GenerateRandom(c.ctx, C.CK_SESSION_HANDLE(sh), &rand, C.CK_ULONG(length))
-	if toError(e) != nil {
-		return nil, toError(e)
-	}
-	h := C.GoBytes(unsafe.Pointer(rand), C.int(length))
-	C.free(unsafe.Pointer(rand))
-	return h, nil
-}
-
-// WaitForSlotEvent returns a channel which returns a slot event
-// (token insertion, removal, etc.) when it occurs.
-func (c *Ctx) WaitForSlotEvent(flags uint) chan SlotEvent {
-	sl := make(chan SlotEvent, 1) // hold one element
-	go c.waitForSlotEventHelper(flags, sl)
-	return sl
-}
-
-func (c *Ctx) waitForSlotEventHelper(f uint, sl chan SlotEvent) {
-	var slotID C.CK_ULONG
-	C.WaitForSlotEvent(c.ctx, C.CK_FLAGS(f), &slotID)
-	sl <- SlotEvent{uint(slotID)}
-	close(sl) // TODO(miek): Sending and then closing ...?
-}
diff --git a/components/engine/vendor/github.com/miekg/pkcs11/pkcs11.h b/components/engine/vendor/github.com/miekg/pkcs11/pkcs11.h
deleted file mode 100644
index 9261e1e4c3..0000000000
--- a/components/engine/vendor/github.com/miekg/pkcs11/pkcs11.h
+++ /dev/null
@@ -1,299 +0,0 @@
-/* pkcs11.h include file for PKCS #11. */
-/* $Revision: 1.2 $ */
-
-/* License to copy and use this software is granted provided that it is
- * identified as "RSA Security Inc. PKCS #11 Cryptographic Token Interface
- * (Cryptoki)" in all material mentioning or referencing this software.
-
- * License is also granted to make and use derivative works provided that
- * such works are identified as "derived from the RSA Security Inc. PKCS #11
- * Cryptographic Token Interface (Cryptoki)" in all material mentioning or 
- * referencing the derived work.
-
- * RSA Security Inc. makes no representations concerning either the 
- * merchantability of this software or the suitability of this software for
- * any particular purpose. It is provided "as is" without express or implied
- * warranty of any kind.
- */
-
-#ifndef _PKCS11_H_
-#define _PKCS11_H_ 1
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/* Before including this file (pkcs11.h) (or pkcs11t.h by
- * itself), 6 platform-specific macros must be defined.  These
- * macros are described below, and typical definitions for them
- * are also given.  Be advised that these definitions can depend
- * on both the platform and the compiler used (and possibly also
- * on whether a Cryptoki library is linked statically or
- * dynamically).
- *
- * In addition to defining these 6 macros, the packing convention
- * for Cryptoki structures should be set.  The Cryptoki
- * convention on packing is that structures should be 1-byte
- * aligned.
- *
- * If you're using Microsoft Developer Studio 5.0 to produce
- * Win32 stuff, this might be done by using the following
- * preprocessor directive before including pkcs11.h or pkcs11t.h:
- *
- * #pragma pack(push, cryptoki, 1)
- *
- * and using the following preprocessor directive after including
- * pkcs11.h or pkcs11t.h:
- *
- * #pragma pack(pop, cryptoki)
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to produce Win16 stuff, this might be done by using
- * the following preprocessor directive before including
- * pkcs11.h or pkcs11t.h:
- *
- * #pragma pack(1)
- *
- * In a UNIX environment, you're on your own for this.  You might
- * not need to do (or be able to do!) anything.
- *
- *
- * Now for the macros:
- *
- *
- * 1. CK_PTR: The indirection string for making a pointer to an
- * object.  It can be used like this:
- *
- * typedef CK_BYTE CK_PTR CK_BYTE_PTR;
- *
- * If you're using Microsoft Developer Studio 5.0 to produce
- * Win32 stuff, it might be defined by:
- *
- * #define CK_PTR *
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to produce Win16 stuff, it might be defined by:
- *
- * #define CK_PTR far *
- *
- * In a typical UNIX environment, it might be defined by:
- *
- * #define CK_PTR *
- *
- *
- * 2. CK_DEFINE_FUNCTION(returnType, name): A macro which makes
- * an exportable Cryptoki library function definition out of a
- * return type and a function name.  It should be used in the
- * following fashion to define the exposed Cryptoki functions in
- * a Cryptoki library:
- *
- * CK_DEFINE_FUNCTION(CK_RV, C_Initialize)(
- *   CK_VOID_PTR pReserved
- * )
- * {
- *   ...
- * }
- *
- * If you're using Microsoft Developer Studio 5.0 to define a
- * function in a Win32 Cryptoki .dll, it might be defined by:
- *
- * #define CK_DEFINE_FUNCTION(returnType, name) \
- *   returnType __declspec(dllexport) name
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to define a function in a Win16 Cryptoki .dll, it
- * might be defined by:
- *
- * #define CK_DEFINE_FUNCTION(returnType, name) \
- *   returnType __export _far _pascal name
- *
- * In a UNIX environment, it might be defined by:
- *
- * #define CK_DEFINE_FUNCTION(returnType, name) \
- *   returnType name
- *
- *
- * 3. CK_DECLARE_FUNCTION(returnType, name): A macro which makes
- * an importable Cryptoki library function declaration out of a
- * return type and a function name.  It should be used in the
- * following fashion:
- *
- * extern CK_DECLARE_FUNCTION(CK_RV, C_Initialize)(
- *   CK_VOID_PTR pReserved
- * );
- *
- * If you're using Microsoft Developer Studio 5.0 to declare a
- * function in a Win32 Cryptoki .dll, it might be defined by:
- *
- * #define CK_DECLARE_FUNCTION(returnType, name) \
- *   returnType __declspec(dllimport) name
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to declare a function in a Win16 Cryptoki .dll, it
- * might be defined by:
- *
- * #define CK_DECLARE_FUNCTION(returnType, name) \
- *   returnType __export _far _pascal name
- *
- * In a UNIX environment, it might be defined by:
- *
- * #define CK_DECLARE_FUNCTION(returnType, name) \
- *   returnType name
- *
- *
- * 4. CK_DECLARE_FUNCTION_POINTER(returnType, name): A macro
- * which makes a Cryptoki API function pointer declaration or
- * function pointer type declaration out of a return type and a
- * function name.  It should be used in the following fashion:
- *
- * // Define funcPtr to be a pointer to a Cryptoki API function
- * // taking arguments args and returning CK_RV.
- * CK_DECLARE_FUNCTION_POINTER(CK_RV, funcPtr)(args);
- *
- * or
- *
- * // Define funcPtrType to be the type of a pointer to a
- * // Cryptoki API function taking arguments args and returning
- * // CK_RV, and then define funcPtr to be a variable of type
- * // funcPtrType.
- * typedef CK_DECLARE_FUNCTION_POINTER(CK_RV, funcPtrType)(args);
- * funcPtrType funcPtr;
- *
- * If you're using Microsoft Developer Studio 5.0 to access
- * functions in a Win32 Cryptoki .dll, in might be defined by:
- *
- * #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
- *   returnType __declspec(dllimport) (* name)
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to access functions in a Win16 Cryptoki .dll, it might
- * be defined by:
- *
- * #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
- *   returnType __export _far _pascal (* name)
- *
- * In a UNIX environment, it might be defined by:
- *
- * #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
- *   returnType (* name)
- *
- *
- * 5. CK_CALLBACK_FUNCTION(returnType, name): A macro which makes
- * a function pointer type for an application callback out of
- * a return type for the callback and a name for the callback.
- * It should be used in the following fashion:
- *
- * CK_CALLBACK_FUNCTION(CK_RV, myCallback)(args);
- *
- * to declare a function pointer, myCallback, to a callback
- * which takes arguments args and returns a CK_RV.  It can also
- * be used like this:
- *
- * typedef CK_CALLBACK_FUNCTION(CK_RV, myCallbackType)(args);
- * myCallbackType myCallback;
- *
- * If you're using Microsoft Developer Studio 5.0 to do Win32
- * Cryptoki development, it might be defined by:
- *
- * #define CK_CALLBACK_FUNCTION(returnType, name) \
- *   returnType (* name)
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to do Win16 development, it might be defined by:
- *
- * #define CK_CALLBACK_FUNCTION(returnType, name) \
- *   returnType _far _pascal (* name)
- *
- * In a UNIX environment, it might be defined by:
- *
- * #define CK_CALLBACK_FUNCTION(returnType, name) \
- *   returnType (* name)
- *
- *
- * 6. NULL_PTR: This macro is the value of a NULL pointer.
- *
- * In any ANSI/ISO C environment (and in many others as well),
- * this should best be defined by
- *
- * #ifndef NULL_PTR
- * #define NULL_PTR 0
- * #endif
- */
-
-
-/* All the various Cryptoki types and #define'd values are in the
- * file pkcs11t.h. */
-#include "pkcs11t.h"
-
-#define __PASTE(x,y)      x##y
-
-
-/* ==============================================================
- * Define the "extern" form of all the entry points.
- * ==============================================================
- */
-
-#define CK_NEED_ARG_LIST  1
-#define CK_PKCS11_FUNCTION_INFO(name) \
-  extern CK_DECLARE_FUNCTION(CK_RV, name)
-
-/* pkcs11f.h has all the information about the Cryptoki
- * function prototypes. */
-#include "pkcs11f.h"
-
-#undef CK_NEED_ARG_LIST
-#undef CK_PKCS11_FUNCTION_INFO
-
-
-/* ==============================================================
- * Define the typedef form of all the entry points.  That is, for
- * each Cryptoki function C_XXX, define a type CK_C_XXX which is
- * a pointer to that kind of function.
- * ==============================================================
- */
-
-#define CK_NEED_ARG_LIST  1
-#define CK_PKCS11_FUNCTION_INFO(name) \
-  typedef CK_DECLARE_FUNCTION_POINTER(CK_RV, __PASTE(CK_,name))
-
-/* pkcs11f.h has all the information about the Cryptoki
- * function prototypes. */
-#include "pkcs11f.h"
-
-#undef CK_NEED_ARG_LIST
-#undef CK_PKCS11_FUNCTION_INFO
-
-
-/* ==============================================================
- * Define structed vector of entry points.  A CK_FUNCTION_LIST
- * contains a CK_VERSION indicating a library's Cryptoki version
- * and then a whole slew of function pointers to the routines in
- * the library.  This type was declared, but not defined, in
- * pkcs11t.h.
- * ==============================================================
- */
-
-#define CK_PKCS11_FUNCTION_INFO(name) \
-  __PASTE(CK_,name) name;
-  
-struct CK_FUNCTION_LIST {
-
-  CK_VERSION    version;  /* Cryptoki version */
-
-/* Pile all the function pointers into the CK_FUNCTION_LIST. */
-/* pkcs11f.h has all the information about the Cryptoki
- * function prototypes. */
-#include "pkcs11f.h"
-
-};
-
-#undef CK_PKCS11_FUNCTION_INFO
-
-
-#undef __PASTE
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
diff --git a/components/engine/vendor/github.com/miekg/pkcs11/pkcs11f.h b/components/engine/vendor/github.com/miekg/pkcs11/pkcs11f.h
deleted file mode 100644
index ffbe010f64..0000000000
--- a/components/engine/vendor/github.com/miekg/pkcs11/pkcs11f.h
+++ /dev/null
@@ -1,910 +0,0 @@
-/* pkcs11f.h include file for PKCS #11. */
-/* $Revision: 1.2 $ */
-
-/* License to copy and use this software is granted provided that it is
- * identified as "RSA Security Inc. PKCS #11 Cryptographic Token Interface
- * (Cryptoki)" in all material mentioning or referencing this software.
-
- * License is also granted to make and use derivative works provided that
- * such works are identified as "derived from the RSA Security Inc. PKCS #11
- * Cryptographic Token Interface (Cryptoki)" in all material mentioning or 
- * referencing the derived work.
-
- * RSA Security Inc. makes no representations concerning either the 
- * merchantability of this software or the suitability of this software for
- * any particular purpose. It is provided "as is" without express or implied
- * warranty of any kind.
- */
-
-/* This header file contains pretty much everything about all the */
-/* Cryptoki function prototypes.  Because this information is */
-/* used for more than just declaring function prototypes, the */
-/* order of the functions appearing herein is important, and */
-/* should not be altered. */
-
-/* General-purpose */
-
-/* C_Initialize initializes the Cryptoki library. */
-CK_PKCS11_FUNCTION_INFO(C_Initialize)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_VOID_PTR   pInitArgs  /* if this is not NULL_PTR, it gets
-                            * cast to CK_C_INITIALIZE_ARGS_PTR
-                            * and dereferenced */
-);
-#endif
-
-
-/* C_Finalize indicates that an application is done with the
- * Cryptoki library. */
-CK_PKCS11_FUNCTION_INFO(C_Finalize)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_VOID_PTR   pReserved  /* reserved.  Should be NULL_PTR */
-);
-#endif
-
-
-/* C_GetInfo returns general information about Cryptoki. */
-CK_PKCS11_FUNCTION_INFO(C_GetInfo)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_INFO_PTR   pInfo  /* location that receives information */
-);
-#endif
-
-
-/* C_GetFunctionList returns the function list. */
-CK_PKCS11_FUNCTION_INFO(C_GetFunctionList)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_FUNCTION_LIST_PTR_PTR ppFunctionList  /* receives pointer to
-                                            * function list */
-);
-#endif
-
-
-
-/* Slot and token management */
-
-/* C_GetSlotList obtains a list of slots in the system. */
-CK_PKCS11_FUNCTION_INFO(C_GetSlotList)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_BBOOL       tokenPresent,  /* only slots with tokens? */
-  CK_SLOT_ID_PTR pSlotList,     /* receives array of slot IDs */
-  CK_ULONG_PTR   pulCount       /* receives number of slots */
-);
-#endif
-
-
-/* C_GetSlotInfo obtains information about a particular slot in
- * the system. */
-CK_PKCS11_FUNCTION_INFO(C_GetSlotInfo)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID       slotID,  /* the ID of the slot */
-  CK_SLOT_INFO_PTR pInfo    /* receives the slot information */
-);
-#endif
-
-
-/* C_GetTokenInfo obtains information about a particular token
- * in the system. */
-CK_PKCS11_FUNCTION_INFO(C_GetTokenInfo)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID        slotID,  /* ID of the token's slot */
-  CK_TOKEN_INFO_PTR pInfo    /* receives the token information */
-);
-#endif
-
-
-/* C_GetMechanismList obtains a list of mechanism types
- * supported by a token. */
-CK_PKCS11_FUNCTION_INFO(C_GetMechanismList)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID            slotID,          /* ID of token's slot */
-  CK_MECHANISM_TYPE_PTR pMechanismList,  /* gets mech. array */
-  CK_ULONG_PTR          pulCount         /* gets # of mechs. */
-);
-#endif
-
-
-/* C_GetMechanismInfo obtains information about a particular
- * mechanism possibly supported by a token. */
-CK_PKCS11_FUNCTION_INFO(C_GetMechanismInfo)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID            slotID,  /* ID of the token's slot */
-  CK_MECHANISM_TYPE     type,    /* type of mechanism */
-  CK_MECHANISM_INFO_PTR pInfo    /* receives mechanism info */
-);
-#endif
-
-
-/* C_InitToken initializes a token. */
-CK_PKCS11_FUNCTION_INFO(C_InitToken)
-#ifdef CK_NEED_ARG_LIST
-/* pLabel changed from CK_CHAR_PTR to CK_UTF8CHAR_PTR for v2.10 */
-(
-  CK_SLOT_ID      slotID,    /* ID of the token's slot */
-  CK_UTF8CHAR_PTR pPin,      /* the SO's initial PIN */
-  CK_ULONG        ulPinLen,  /* length in bytes of the PIN */
-  CK_UTF8CHAR_PTR pLabel     /* 32-byte token label (blank padded) */
-);
-#endif
-
-
-/* C_InitPIN initializes the normal user's PIN. */
-CK_PKCS11_FUNCTION_INFO(C_InitPIN)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_UTF8CHAR_PTR   pPin,      /* the normal user's PIN */
-  CK_ULONG          ulPinLen   /* length in bytes of the PIN */
-);
-#endif
-
-
-/* C_SetPIN modifies the PIN of the user who is logged in. */
-CK_PKCS11_FUNCTION_INFO(C_SetPIN)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_UTF8CHAR_PTR   pOldPin,   /* the old PIN */
-  CK_ULONG          ulOldLen,  /* length of the old PIN */
-  CK_UTF8CHAR_PTR   pNewPin,   /* the new PIN */
-  CK_ULONG          ulNewLen   /* length of the new PIN */
-);
-#endif
-
-
-
-/* Session management */
-
-/* C_OpenSession opens a session between an application and a
- * token. */
-CK_PKCS11_FUNCTION_INFO(C_OpenSession)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID            slotID,        /* the slot's ID */
-  CK_FLAGS              flags,         /* from CK_SESSION_INFO */
-  CK_VOID_PTR           pApplication,  /* passed to callback */
-  CK_NOTIFY             Notify,        /* callback function */
-  CK_SESSION_HANDLE_PTR phSession      /* gets session handle */
-);
-#endif
-
-
-/* C_CloseSession closes a session between an application and a
- * token. */
-CK_PKCS11_FUNCTION_INFO(C_CloseSession)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession  /* the session's handle */
-);
-#endif
-
-/* C_CloseAllSessions closes all sessions with a token. */
-CK_PKCS11_FUNCTION_INFO(C_CloseAllSessions)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID     slotID  /* the token's slot */
-);
-#endif
-
-
-/* C_GetSessionInfo obtains information about the session. */
-CK_PKCS11_FUNCTION_INFO(C_GetSessionInfo)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE   hSession,  /* the session's handle */
-  CK_SESSION_INFO_PTR pInfo      /* receives session info */
-);
-#endif
-
-
-/* C_GetOperationState obtains the state of the cryptographic operation
- * in a session. */
-CK_PKCS11_FUNCTION_INFO(C_GetOperationState)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,             /* session's handle */
-  CK_BYTE_PTR       pOperationState,      /* gets state */
-  CK_ULONG_PTR      pulOperationStateLen  /* gets state length */
-);
-#endif
-
-
-/* C_SetOperationState restores the state of the cryptographic
- * operation in a session. */
-CK_PKCS11_FUNCTION_INFO(C_SetOperationState)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR      pOperationState,      /* holds state */
-  CK_ULONG         ulOperationStateLen,  /* holds state length */
-  CK_OBJECT_HANDLE hEncryptionKey,       /* en/decryption key */
-  CK_OBJECT_HANDLE hAuthenticationKey    /* sign/verify key */
-);
-#endif
-
-
-/* C_Login logs a user into a token. */
-CK_PKCS11_FUNCTION_INFO(C_Login)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_USER_TYPE      userType,  /* the user type */
-  CK_UTF8CHAR_PTR   pPin,      /* the user's PIN */
-  CK_ULONG          ulPinLen   /* the length of the PIN */
-);
-#endif
-
-
-/* C_Logout logs a user out from a token. */
-CK_PKCS11_FUNCTION_INFO(C_Logout)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession  /* the session's handle */
-);
-#endif
-
-
-
-/* Object management */
-
-/* C_CreateObject creates a new object. */
-CK_PKCS11_FUNCTION_INFO(C_CreateObject)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_ATTRIBUTE_PTR  pTemplate,   /* the object's template */
-  CK_ULONG          ulCount,     /* attributes in template */
-  CK_OBJECT_HANDLE_PTR phObject  /* gets new object's handle. */
-);
-#endif
-
-/* C_CopyObject copies an object, creating a new object for the
- * copy. */
-CK_PKCS11_FUNCTION_INFO(C_CopyObject)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE    hSession,    /* the session's handle */
-  CK_OBJECT_HANDLE     hObject,     /* the object's handle */
-  CK_ATTRIBUTE_PTR     pTemplate,   /* template for new object */
-  CK_ULONG             ulCount,     /* attributes in template */
-  CK_OBJECT_HANDLE_PTR phNewObject  /* receives handle of copy */
-);
-#endif
-
-
-/* C_DestroyObject destroys an object. */
-CK_PKCS11_FUNCTION_INFO(C_DestroyObject)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_OBJECT_HANDLE  hObject    /* the object's handle */
-);
-#endif
-
-
-/* C_GetObjectSize gets the size of an object in bytes. */
-CK_PKCS11_FUNCTION_INFO(C_GetObjectSize)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_OBJECT_HANDLE  hObject,   /* the object's handle */
-  CK_ULONG_PTR      pulSize    /* receives size of object */
-);
-#endif
-
-
-/* C_GetAttributeValue obtains the value of one or more object
- * attributes. */
-CK_PKCS11_FUNCTION_INFO(C_GetAttributeValue)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,   /* the session's handle */
-  CK_OBJECT_HANDLE  hObject,    /* the object's handle */
-  CK_ATTRIBUTE_PTR  pTemplate,  /* specifies attrs; gets vals */
-  CK_ULONG          ulCount     /* attributes in template */
-);
-#endif
-
-
-/* C_SetAttributeValue modifies the value of one or more object
- * attributes */
-CK_PKCS11_FUNCTION_INFO(C_SetAttributeValue)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,   /* the session's handle */
-  CK_OBJECT_HANDLE  hObject,    /* the object's handle */
-  CK_ATTRIBUTE_PTR  pTemplate,  /* specifies attrs and values */
-  CK_ULONG          ulCount     /* attributes in template */
-);
-#endif
-
-
-/* C_FindObjectsInit initializes a search for token and session
- * objects that match a template. */
-CK_PKCS11_FUNCTION_INFO(C_FindObjectsInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,   /* the session's handle */
-  CK_ATTRIBUTE_PTR  pTemplate,  /* attribute values to match */
-  CK_ULONG          ulCount     /* attrs in search template */
-);
-#endif
-
-
-/* C_FindObjects continues a search for token and session
- * objects that match a template, obtaining additional object
- * handles. */
-CK_PKCS11_FUNCTION_INFO(C_FindObjects)
-#ifdef CK_NEED_ARG_LIST
-(
- CK_SESSION_HANDLE    hSession,          /* session's handle */
- CK_OBJECT_HANDLE_PTR phObject,          /* gets obj. handles */
- CK_ULONG             ulMaxObjectCount,  /* max handles to get */
- CK_ULONG_PTR         pulObjectCount     /* actual # returned */
-);
-#endif
-
-
-/* C_FindObjectsFinal finishes a search for token and session
- * objects. */
-CK_PKCS11_FUNCTION_INFO(C_FindObjectsFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession  /* the session's handle */
-);
-#endif
-
-
-
-/* Encryption and decryption */
-
-/* C_EncryptInit initializes an encryption operation. */
-CK_PKCS11_FUNCTION_INFO(C_EncryptInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,  /* the encryption mechanism */
-  CK_OBJECT_HANDLE  hKey         /* handle of encryption key */
-);
-#endif
-
-
-/* C_Encrypt encrypts single-part data. */
-CK_PKCS11_FUNCTION_INFO(C_Encrypt)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pData,               /* the plaintext data */
-  CK_ULONG          ulDataLen,           /* bytes of plaintext */
-  CK_BYTE_PTR       pEncryptedData,      /* gets ciphertext */
-  CK_ULONG_PTR      pulEncryptedDataLen  /* gets c-text size */
-);
-#endif
-
-
-/* C_EncryptUpdate continues a multiple-part encryption
- * operation. */
-CK_PKCS11_FUNCTION_INFO(C_EncryptUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,           /* session's handle */
-  CK_BYTE_PTR       pPart,              /* the plaintext data */
-  CK_ULONG          ulPartLen,          /* plaintext data len */
-  CK_BYTE_PTR       pEncryptedPart,     /* gets ciphertext */
-  CK_ULONG_PTR      pulEncryptedPartLen /* gets c-text size */
-);
-#endif
-
-
-/* C_EncryptFinal finishes a multiple-part encryption
- * operation. */
-CK_PKCS11_FUNCTION_INFO(C_EncryptFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,                /* session handle */
-  CK_BYTE_PTR       pLastEncryptedPart,      /* last c-text */
-  CK_ULONG_PTR      pulLastEncryptedPartLen  /* gets last size */
-);
-#endif
-
-
-/* C_DecryptInit initializes a decryption operation. */
-CK_PKCS11_FUNCTION_INFO(C_DecryptInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,  /* the decryption mechanism */
-  CK_OBJECT_HANDLE  hKey         /* handle of decryption key */
-);
-#endif
-
-
-/* C_Decrypt decrypts encrypted data in a single part. */
-CK_PKCS11_FUNCTION_INFO(C_Decrypt)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,           /* session's handle */
-  CK_BYTE_PTR       pEncryptedData,     /* ciphertext */
-  CK_ULONG          ulEncryptedDataLen, /* ciphertext length */
-  CK_BYTE_PTR       pData,              /* gets plaintext */
-  CK_ULONG_PTR      pulDataLen          /* gets p-text size */
-);
-#endif
-
-
-/* C_DecryptUpdate continues a multiple-part decryption
- * operation. */
-CK_PKCS11_FUNCTION_INFO(C_DecryptUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pEncryptedPart,      /* encrypted data */
-  CK_ULONG          ulEncryptedPartLen,  /* input length */
-  CK_BYTE_PTR       pPart,               /* gets plaintext */
-  CK_ULONG_PTR      pulPartLen           /* p-text size */
-);
-#endif
-
-
-/* C_DecryptFinal finishes a multiple-part decryption
- * operation. */
-CK_PKCS11_FUNCTION_INFO(C_DecryptFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,       /* the session's handle */
-  CK_BYTE_PTR       pLastPart,      /* gets plaintext */
-  CK_ULONG_PTR      pulLastPartLen  /* p-text size */
-);
-#endif
-
-
-
-/* Message digesting */
-
-/* C_DigestInit initializes a message-digesting operation. */
-CK_PKCS11_FUNCTION_INFO(C_DigestInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,   /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism  /* the digesting mechanism */
-);
-#endif
-
-
-/* C_Digest digests data in a single part. */
-CK_PKCS11_FUNCTION_INFO(C_Digest)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,     /* the session's handle */
-  CK_BYTE_PTR       pData,        /* data to be digested */
-  CK_ULONG          ulDataLen,    /* bytes of data to digest */
-  CK_BYTE_PTR       pDigest,      /* gets the message digest */
-  CK_ULONG_PTR      pulDigestLen  /* gets digest length */
-);
-#endif
-
-
-/* C_DigestUpdate continues a multiple-part message-digesting
- * operation. */
-CK_PKCS11_FUNCTION_INFO(C_DigestUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_BYTE_PTR       pPart,     /* data to be digested */
-  CK_ULONG          ulPartLen  /* bytes of data to be digested */
-);
-#endif
-
-
-/* C_DigestKey continues a multi-part message-digesting
- * operation, by digesting the value of a secret key as part of
- * the data already digested. */
-CK_PKCS11_FUNCTION_INFO(C_DigestKey)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_OBJECT_HANDLE  hKey       /* secret key to digest */
-);
-#endif
-
-
-/* C_DigestFinal finishes a multiple-part message-digesting
- * operation. */
-CK_PKCS11_FUNCTION_INFO(C_DigestFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,     /* the session's handle */
-  CK_BYTE_PTR       pDigest,      /* gets the message digest */
-  CK_ULONG_PTR      pulDigestLen  /* gets byte count of digest */
-);
-#endif
-
-
-
-/* Signing and MACing */
-
-/* C_SignInit initializes a signature (private key encryption)
- * operation, where the signature is (will be) an appendix to
- * the data, and plaintext cannot be recovered from the
- *signature. */
-CK_PKCS11_FUNCTION_INFO(C_SignInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,  /* the signature mechanism */
-  CK_OBJECT_HANDLE  hKey         /* handle of signature key */
-);
-#endif
-
-
-/* C_Sign signs (encrypts with private key) data in a single
- * part, where the signature is (will be) an appendix to the
- * data, and plaintext cannot be recovered from the signature. */
-CK_PKCS11_FUNCTION_INFO(C_Sign)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,        /* the session's handle */
-  CK_BYTE_PTR       pData,           /* the data to sign */
-  CK_ULONG          ulDataLen,       /* count of bytes to sign */
-  CK_BYTE_PTR       pSignature,      /* gets the signature */
-  CK_ULONG_PTR      pulSignatureLen  /* gets signature length */
-);
-#endif
-
-
-/* C_SignUpdate continues a multiple-part signature operation,
- * where the signature is (will be) an appendix to the data, 
- * and plaintext cannot be recovered from the signature. */
-CK_PKCS11_FUNCTION_INFO(C_SignUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_BYTE_PTR       pPart,     /* the data to sign */
-  CK_ULONG          ulPartLen  /* count of bytes to sign */
-);
-#endif
-
-
-/* C_SignFinal finishes a multiple-part signature operation, 
- * returning the signature. */
-CK_PKCS11_FUNCTION_INFO(C_SignFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,        /* the session's handle */
-  CK_BYTE_PTR       pSignature,      /* gets the signature */
-  CK_ULONG_PTR      pulSignatureLen  /* gets signature length */
-);
-#endif
-
-
-/* C_SignRecoverInit initializes a signature operation, where
- * the data can be recovered from the signature. */
-CK_PKCS11_FUNCTION_INFO(C_SignRecoverInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,   /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism, /* the signature mechanism */
-  CK_OBJECT_HANDLE  hKey        /* handle of the signature key */
-);
-#endif
-
-
-/* C_SignRecover signs data in a single operation, where the
- * data can be recovered from the signature. */
-CK_PKCS11_FUNCTION_INFO(C_SignRecover)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,        /* the session's handle */
-  CK_BYTE_PTR       pData,           /* the data to sign */
-  CK_ULONG          ulDataLen,       /* count of bytes to sign */
-  CK_BYTE_PTR       pSignature,      /* gets the signature */
-  CK_ULONG_PTR      pulSignatureLen  /* gets signature length */
-);
-#endif
-
-
-
-/* Verifying signatures and MACs */
-
-/* C_VerifyInit initializes a verification operation, where the
- * signature is an appendix to the data, and plaintext cannot
- *  cannot be recovered from the signature (e.g. DSA). */
-CK_PKCS11_FUNCTION_INFO(C_VerifyInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,  /* the verification mechanism */
-  CK_OBJECT_HANDLE  hKey         /* verification key */ 
-);
-#endif
-
-
-/* C_Verify verifies a signature in a single-part operation, 
- * where the signature is an appendix to the data, and plaintext
- * cannot be recovered from the signature. */
-CK_PKCS11_FUNCTION_INFO(C_Verify)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,       /* the session's handle */
-  CK_BYTE_PTR       pData,          /* signed data */
-  CK_ULONG          ulDataLen,      /* length of signed data */
-  CK_BYTE_PTR       pSignature,     /* signature */
-  CK_ULONG          ulSignatureLen  /* signature length*/
-);
-#endif
-
-
-/* C_VerifyUpdate continues a multiple-part verification
- * operation, where the signature is an appendix to the data, 
- * and plaintext cannot be recovered from the signature. */
-CK_PKCS11_FUNCTION_INFO(C_VerifyUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_BYTE_PTR       pPart,     /* signed data */
-  CK_ULONG          ulPartLen  /* length of signed data */
-);
-#endif
-
-
-/* C_VerifyFinal finishes a multiple-part verification
- * operation, checking the signature. */
-CK_PKCS11_FUNCTION_INFO(C_VerifyFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,       /* the session's handle */
-  CK_BYTE_PTR       pSignature,     /* signature to verify */
-  CK_ULONG          ulSignatureLen  /* signature length */
-);
-#endif
-
-
-/* C_VerifyRecoverInit initializes a signature verification
- * operation, where the data is recovered from the signature. */
-CK_PKCS11_FUNCTION_INFO(C_VerifyRecoverInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,  /* the verification mechanism */
-  CK_OBJECT_HANDLE  hKey         /* verification key */
-);
-#endif
-
-
-/* C_VerifyRecover verifies a signature in a single-part
- * operation, where the data is recovered from the signature. */
-CK_PKCS11_FUNCTION_INFO(C_VerifyRecover)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,        /* the session's handle */
-  CK_BYTE_PTR       pSignature,      /* signature to verify */
-  CK_ULONG          ulSignatureLen,  /* signature length */
-  CK_BYTE_PTR       pData,           /* gets signed data */
-  CK_ULONG_PTR      pulDataLen       /* gets signed data len */
-);
-#endif
-
-
-
-/* Dual-function cryptographic operations */
-
-/* C_DigestEncryptUpdate continues a multiple-part digesting
- * and encryption operation. */
-CK_PKCS11_FUNCTION_INFO(C_DigestEncryptUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pPart,               /* the plaintext data */
-  CK_ULONG          ulPartLen,           /* plaintext length */
-  CK_BYTE_PTR       pEncryptedPart,      /* gets ciphertext */
-  CK_ULONG_PTR      pulEncryptedPartLen  /* gets c-text length */
-);
-#endif
-
-
-/* C_DecryptDigestUpdate continues a multiple-part decryption and
- * digesting operation. */
-CK_PKCS11_FUNCTION_INFO(C_DecryptDigestUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pEncryptedPart,      /* ciphertext */
-  CK_ULONG          ulEncryptedPartLen,  /* ciphertext length */
-  CK_BYTE_PTR       pPart,               /* gets plaintext */
-  CK_ULONG_PTR      pulPartLen           /* gets plaintext len */
-);
-#endif
-
-
-/* C_SignEncryptUpdate continues a multiple-part signing and
- * encryption operation. */
-CK_PKCS11_FUNCTION_INFO(C_SignEncryptUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pPart,               /* the plaintext data */
-  CK_ULONG          ulPartLen,           /* plaintext length */
-  CK_BYTE_PTR       pEncryptedPart,      /* gets ciphertext */
-  CK_ULONG_PTR      pulEncryptedPartLen  /* gets c-text length */
-);
-#endif
-
-
-/* C_DecryptVerifyUpdate continues a multiple-part decryption and
- * verify operation. */
-CK_PKCS11_FUNCTION_INFO(C_DecryptVerifyUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pEncryptedPart,      /* ciphertext */
-  CK_ULONG          ulEncryptedPartLen,  /* ciphertext length */
-  CK_BYTE_PTR       pPart,               /* gets plaintext */
-  CK_ULONG_PTR      pulPartLen           /* gets p-text length */
-);
-#endif
-
-
-
-/* Key management */
-
-/* C_GenerateKey generates a secret key, creating a new key
- * object. */
-CK_PKCS11_FUNCTION_INFO(C_GenerateKey)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE    hSession,    /* the session's handle */
-  CK_MECHANISM_PTR     pMechanism,  /* key generation mech. */
-  CK_ATTRIBUTE_PTR     pTemplate,   /* template for new key */
-  CK_ULONG             ulCount,     /* # of attrs in template */
-  CK_OBJECT_HANDLE_PTR phKey        /* gets handle of new key */
-);
-#endif
-
-
-/* C_GenerateKeyPair generates a public-key/private-key pair, 
- * creating new key objects. */
-CK_PKCS11_FUNCTION_INFO(C_GenerateKeyPair)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE    hSession,                    /* session
-                                                     * handle */
-  CK_MECHANISM_PTR     pMechanism,                  /* key-gen
-                                                     * mech. */
-  CK_ATTRIBUTE_PTR     pPublicKeyTemplate,          /* template
-                                                     * for pub.
-                                                     * key */
-  CK_ULONG             ulPublicKeyAttributeCount,   /* # pub.
-                                                     * attrs. */
-  CK_ATTRIBUTE_PTR     pPrivateKeyTemplate,         /* template
-                                                     * for priv.
-                                                     * key */
-  CK_ULONG             ulPrivateKeyAttributeCount,  /* # priv.
-                                                     * attrs. */
-  CK_OBJECT_HANDLE_PTR phPublicKey,                 /* gets pub.
-                                                     * key
-                                                     * handle */
-  CK_OBJECT_HANDLE_PTR phPrivateKey                 /* gets
-                                                     * priv. key
-                                                     * handle */
-);
-#endif
-
-
-/* C_WrapKey wraps (i.e., encrypts) a key. */
-CK_PKCS11_FUNCTION_INFO(C_WrapKey)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,        /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,      /* the wrapping mechanism */
-  CK_OBJECT_HANDLE  hWrappingKey,    /* wrapping key */
-  CK_OBJECT_HANDLE  hKey,            /* key to be wrapped */
-  CK_BYTE_PTR       pWrappedKey,     /* gets wrapped key */
-  CK_ULONG_PTR      pulWrappedKeyLen /* gets wrapped key size */
-);
-#endif
-
-
-/* C_UnwrapKey unwraps (decrypts) a wrapped key, creating a new
- * key object. */
-CK_PKCS11_FUNCTION_INFO(C_UnwrapKey)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE    hSession,          /* session's handle */
-  CK_MECHANISM_PTR     pMechanism,        /* unwrapping mech. */
-  CK_OBJECT_HANDLE     hUnwrappingKey,    /* unwrapping key */
-  CK_BYTE_PTR          pWrappedKey,       /* the wrapped key */
-  CK_ULONG             ulWrappedKeyLen,   /* wrapped key len */
-  CK_ATTRIBUTE_PTR     pTemplate,         /* new key template */
-  CK_ULONG             ulAttributeCount,  /* template length */
-  CK_OBJECT_HANDLE_PTR phKey              /* gets new handle */
-);
-#endif
-
-
-/* C_DeriveKey derives a key from a base key, creating a new key
- * object. */
-CK_PKCS11_FUNCTION_INFO(C_DeriveKey)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE    hSession,          /* session's handle */
-  CK_MECHANISM_PTR     pMechanism,        /* key deriv. mech. */
-  CK_OBJECT_HANDLE     hBaseKey,          /* base key */
-  CK_ATTRIBUTE_PTR     pTemplate,         /* new key template */
-  CK_ULONG             ulAttributeCount,  /* template length */
-  CK_OBJECT_HANDLE_PTR phKey              /* gets new handle */
-);
-#endif
-
-
-
-/* Random number generation */
-
-/* C_SeedRandom mixes additional seed material into the token's
- * random number generator. */
-CK_PKCS11_FUNCTION_INFO(C_SeedRandom)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_BYTE_PTR       pSeed,     /* the seed material */
-  CK_ULONG          ulSeedLen  /* length of seed material */
-);
-#endif
-
-
-/* C_GenerateRandom generates random data. */
-CK_PKCS11_FUNCTION_INFO(C_GenerateRandom)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_BYTE_PTR       RandomData,  /* receives the random data */
-  CK_ULONG          ulRandomLen  /* # of bytes to generate */
-);
-#endif
-
-
-
-/* Parallel function management */
-
-/* C_GetFunctionStatus is a legacy function; it obtains an
- * updated status of a function running in parallel with an
- * application. */
-CK_PKCS11_FUNCTION_INFO(C_GetFunctionStatus)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession  /* the session's handle */
-);
-#endif
-
-
-/* C_CancelFunction is a legacy function; it cancels a function
- * running in parallel. */
-CK_PKCS11_FUNCTION_INFO(C_CancelFunction)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession  /* the session's handle */
-);
-#endif
-
-
-
-/* Functions added in for Cryptoki Version 2.01 or later */
-
-/* C_WaitForSlotEvent waits for a slot event (token insertion,
- * removal, etc.) to occur. */
-CK_PKCS11_FUNCTION_INFO(C_WaitForSlotEvent)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_FLAGS flags,        /* blocking/nonblocking flag */
-  CK_SLOT_ID_PTR pSlot,  /* location that receives the slot ID */
-  CK_VOID_PTR pRserved   /* reserved.  Should be NULL_PTR */
-);
-#endif
diff --git a/components/engine/vendor/github.com/miekg/pkcs11/pkcs11t.h b/components/engine/vendor/github.com/miekg/pkcs11/pkcs11t.h
deleted file mode 100644
index add49e4830..0000000000
--- a/components/engine/vendor/github.com/miekg/pkcs11/pkcs11t.h
+++ /dev/null
@@ -1,1885 +0,0 @@
-/* pkcs11t.h include file for PKCS #11. */
-/* $Revision: 1.2 $ */
-
-/* License to copy and use this software is granted provided that it is
- * identified as "RSA Security Inc. PKCS #11 Cryptographic Token Interface
- * (Cryptoki)" in all material mentioning or referencing this software.
-
- * License is also granted to make and use derivative works provided that
- * such works are identified as "derived from the RSA Security Inc. PKCS #11
- * Cryptographic Token Interface (Cryptoki)" in all material mentioning or
- * referencing the derived work.
-
- * RSA Security Inc. makes no representations concerning either the
- * merchantability of this software or the suitability of this software for
- * any particular purpose. It is provided "as is" without express or implied
- * warranty of any kind.
- */
-
-/* See top of pkcs11.h for information about the macros that
- * must be defined and the structure-packing conventions that
- * must be set before including this file. */
-
-#ifndef _PKCS11T_H_
-#define _PKCS11T_H_ 1
-
-#define CRYPTOKI_VERSION_MAJOR 2
-#define CRYPTOKI_VERSION_MINOR 20
-#define CRYPTOKI_VERSION_AMENDMENT 3
-
-#define CK_TRUE 1
-#define CK_FALSE 0
-
-#ifndef CK_DISABLE_TRUE_FALSE
-#ifndef FALSE
-#define FALSE CK_FALSE
-#endif
-
-#ifndef TRUE
-#define TRUE CK_TRUE
-#endif
-#endif
-
-/* an unsigned 8-bit value */
-typedef unsigned char     CK_BYTE;
-
-/* an unsigned 8-bit character */
-typedef CK_BYTE           CK_CHAR;
-
-/* an 8-bit UTF-8 character */
-typedef CK_BYTE           CK_UTF8CHAR;
-
-/* a BYTE-sized Boolean flag */
-typedef CK_BYTE           CK_BBOOL;
-
-/* an unsigned value, at least 32 bits long */
-typedef unsigned long int CK_ULONG;
-
-/* a signed value, the same size as a CK_ULONG */
-/* CK_LONG is new for v2.0 */
-typedef long int          CK_LONG;
-
-/* at least 32 bits; each bit is a Boolean flag */
-typedef CK_ULONG          CK_FLAGS;
-
-
-/* some special values for certain CK_ULONG variables */
-#define CK_UNAVAILABLE_INFORMATION (~0UL)
-#define CK_EFFECTIVELY_INFINITE    0
-
-
-typedef CK_BYTE     CK_PTR   CK_BYTE_PTR;
-typedef CK_CHAR     CK_PTR   CK_CHAR_PTR;
-typedef CK_UTF8CHAR CK_PTR   CK_UTF8CHAR_PTR;
-typedef CK_ULONG    CK_PTR   CK_ULONG_PTR;
-typedef void        CK_PTR   CK_VOID_PTR;
-
-/* Pointer to a CK_VOID_PTR-- i.e., pointer to pointer to void */
-typedef CK_VOID_PTR CK_PTR CK_VOID_PTR_PTR;
-
-
-/* The following value is always invalid if used as a session */
-/* handle or object handle */
-#define CK_INVALID_HANDLE 0
-
-
-typedef struct CK_VERSION {
-  CK_BYTE       major;  /* integer portion of version number */
-  CK_BYTE       minor;  /* 1/100ths portion of version number */
-} CK_VERSION;
-
-typedef CK_VERSION CK_PTR CK_VERSION_PTR;
-
-
-typedef struct CK_INFO {
-  /* manufacturerID and libraryDecription have been changed from
-   * CK_CHAR to CK_UTF8CHAR for v2.10 */
-  CK_VERSION    cryptokiVersion;     /* Cryptoki interface ver */
-  CK_UTF8CHAR   manufacturerID[32];  /* blank padded */
-  CK_FLAGS      flags;               /* must be zero */
-
-  /* libraryDescription and libraryVersion are new for v2.0 */
-  CK_UTF8CHAR   libraryDescription[32];  /* blank padded */
-  CK_VERSION    libraryVersion;          /* version of library */
-} CK_INFO;
-
-typedef CK_INFO CK_PTR    CK_INFO_PTR;
-
-
-/* CK_NOTIFICATION enumerates the types of notifications that
- * Cryptoki provides to an application */
-/* CK_NOTIFICATION has been changed from an enum to a CK_ULONG
- * for v2.0 */
-typedef CK_ULONG CK_NOTIFICATION;
-#define CKN_SURRENDER       0
-
-/* The following notification is new for PKCS #11 v2.20 amendment 3 */
-#define CKN_OTP_CHANGED     1
-
-
-typedef CK_ULONG          CK_SLOT_ID;
-
-typedef CK_SLOT_ID CK_PTR CK_SLOT_ID_PTR;
-
-
-/* CK_SLOT_INFO provides information about a slot */
-typedef struct CK_SLOT_INFO {
-  /* slotDescription and manufacturerID have been changed from
-   * CK_CHAR to CK_UTF8CHAR for v2.10 */
-  CK_UTF8CHAR   slotDescription[64];  /* blank padded */
-  CK_UTF8CHAR   manufacturerID[32];   /* blank padded */
-  CK_FLAGS      flags;
-
-  /* hardwareVersion and firmwareVersion are new for v2.0 */
-  CK_VERSION    hardwareVersion;  /* version of hardware */
-  CK_VERSION    firmwareVersion;  /* version of firmware */
-} CK_SLOT_INFO;
-
-/* flags: bit flags that provide capabilities of the slot
- *      Bit Flag              Mask        Meaning
- */
-#define CKF_TOKEN_PRESENT     0x00000001  /* a token is there */
-#define CKF_REMOVABLE_DEVICE  0x00000002  /* removable devices*/
-#define CKF_HW_SLOT           0x00000004  /* hardware slot */
-
-typedef CK_SLOT_INFO CK_PTR CK_SLOT_INFO_PTR;
-
-
-/* CK_TOKEN_INFO provides information about a token */
-typedef struct CK_TOKEN_INFO {
-  /* label, manufacturerID, and model have been changed from
-   * CK_CHAR to CK_UTF8CHAR for v2.10 */
-  CK_UTF8CHAR   label[32];           /* blank padded */
-  CK_UTF8CHAR   manufacturerID[32];  /* blank padded */
-  CK_UTF8CHAR   model[16];           /* blank padded */
-  CK_CHAR       serialNumber[16];    /* blank padded */
-  CK_FLAGS      flags;               /* see below */
-
-  /* ulMaxSessionCount, ulSessionCount, ulMaxRwSessionCount,
-   * ulRwSessionCount, ulMaxPinLen, and ulMinPinLen have all been
-   * changed from CK_USHORT to CK_ULONG for v2.0 */
-  CK_ULONG      ulMaxSessionCount;     /* max open sessions */
-  CK_ULONG      ulSessionCount;        /* sess. now open */
-  CK_ULONG      ulMaxRwSessionCount;   /* max R/W sessions */
-  CK_ULONG      ulRwSessionCount;      /* R/W sess. now open */
-  CK_ULONG      ulMaxPinLen;           /* in bytes */
-  CK_ULONG      ulMinPinLen;           /* in bytes */
-  CK_ULONG      ulTotalPublicMemory;   /* in bytes */
-  CK_ULONG      ulFreePublicMemory;    /* in bytes */
-  CK_ULONG      ulTotalPrivateMemory;  /* in bytes */
-  CK_ULONG      ulFreePrivateMemory;   /* in bytes */
-
-  /* hardwareVersion, firmwareVersion, and time are new for
-   * v2.0 */
-  CK_VERSION    hardwareVersion;       /* version of hardware */
-  CK_VERSION    firmwareVersion;       /* version of firmware */
-  CK_CHAR       utcTime[16];           /* time */
-} CK_TOKEN_INFO;
-
-/* The flags parameter is defined as follows:
- *      Bit Flag                    Mask        Meaning
- */
-#define CKF_RNG                     0x00000001  /* has random #
-                                                 * generator */
-#define CKF_WRITE_PROTECTED         0x00000002  /* token is
-                                                 * write-
-                                                 * protected */
-#define CKF_LOGIN_REQUIRED          0x00000004  /* user must
-                                                 * login */
-#define CKF_USER_PIN_INITIALIZED    0x00000008  /* normal user's
-                                                 * PIN is set */
-
-/* CKF_RESTORE_KEY_NOT_NEEDED is new for v2.0.  If it is set,
- * that means that *every* time the state of cryptographic
- * operations of a session is successfully saved, all keys
- * needed to continue those operations are stored in the state */
-#define CKF_RESTORE_KEY_NOT_NEEDED  0x00000020
-
-/* CKF_CLOCK_ON_TOKEN is new for v2.0.  If it is set, that means
- * that the token has some sort of clock.  The time on that
- * clock is returned in the token info structure */
-#define CKF_CLOCK_ON_TOKEN          0x00000040
-
-/* CKF_PROTECTED_AUTHENTICATION_PATH is new for v2.0.  If it is
- * set, that means that there is some way for the user to login
- * without sending a PIN through the Cryptoki library itself */
-#define CKF_PROTECTED_AUTHENTICATION_PATH 0x00000100
-
-/* CKF_DUAL_CRYPTO_OPERATIONS is new for v2.0.  If it is true,
- * that means that a single session with the token can perform
- * dual simultaneous cryptographic operations (digest and
- * encrypt; decrypt and digest; sign and encrypt; and decrypt
- * and sign) */
-#define CKF_DUAL_CRYPTO_OPERATIONS  0x00000200
-
-/* CKF_TOKEN_INITIALIZED if new for v2.10. If it is true, the
- * token has been initialized using C_InitializeToken or an
- * equivalent mechanism outside the scope of PKCS #11.
- * Calling C_InitializeToken when this flag is set will cause
- * the token to be reinitialized. */
-#define CKF_TOKEN_INITIALIZED       0x00000400
-
-/* CKF_SECONDARY_AUTHENTICATION if new for v2.10. If it is
- * true, the token supports secondary authentication for
- * private key objects. This flag is deprecated in v2.11 and
-   onwards. */
-#define CKF_SECONDARY_AUTHENTICATION  0x00000800
-
-/* CKF_USER_PIN_COUNT_LOW if new for v2.10. If it is true, an
- * incorrect user login PIN has been entered at least once
- * since the last successful authentication. */
-#define CKF_USER_PIN_COUNT_LOW       0x00010000
-
-/* CKF_USER_PIN_FINAL_TRY if new for v2.10. If it is true,
- * supplying an incorrect user PIN will it to become locked. */
-#define CKF_USER_PIN_FINAL_TRY       0x00020000
-
-/* CKF_USER_PIN_LOCKED if new for v2.10. If it is true, the
- * user PIN has been locked. User login to the token is not
- * possible. */
-#define CKF_USER_PIN_LOCKED          0x00040000
-
-/* CKF_USER_PIN_TO_BE_CHANGED if new for v2.10. If it is true,
- * the user PIN value is the default value set by token
- * initialization or manufacturing, or the PIN has been
- * expired by the card. */
-#define CKF_USER_PIN_TO_BE_CHANGED   0x00080000
-
-/* CKF_SO_PIN_COUNT_LOW if new for v2.10. If it is true, an
- * incorrect SO login PIN has been entered at least once since
- * the last successful authentication. */
-#define CKF_SO_PIN_COUNT_LOW         0x00100000
-
-/* CKF_SO_PIN_FINAL_TRY if new for v2.10. If it is true,
- * supplying an incorrect SO PIN will it to become locked. */
-#define CKF_SO_PIN_FINAL_TRY         0x00200000
-
-/* CKF_SO_PIN_LOCKED if new for v2.10. If it is true, the SO
- * PIN has been locked. SO login to the token is not possible.
- */
-#define CKF_SO_PIN_LOCKED            0x00400000
-
-/* CKF_SO_PIN_TO_BE_CHANGED if new for v2.10. If it is true,
- * the SO PIN value is the default value set by token
- * initialization or manufacturing, or the PIN has been
- * expired by the card. */
-#define CKF_SO_PIN_TO_BE_CHANGED     0x00800000
-
-typedef CK_TOKEN_INFO CK_PTR CK_TOKEN_INFO_PTR;
-
-
-/* CK_SESSION_HANDLE is a Cryptoki-assigned value that
- * identifies a session */
-typedef CK_ULONG          CK_SESSION_HANDLE;
-
-typedef CK_SESSION_HANDLE CK_PTR CK_SESSION_HANDLE_PTR;
-
-
-/* CK_USER_TYPE enumerates the types of Cryptoki users */
-/* CK_USER_TYPE has been changed from an enum to a CK_ULONG for
- * v2.0 */
-typedef CK_ULONG          CK_USER_TYPE;
-/* Security Officer */
-#define CKU_SO    0
-/* Normal user */
-#define CKU_USER  1
-/* Context specific (added in v2.20) */
-#define CKU_CONTEXT_SPECIFIC   2
-
-/* CK_STATE enumerates the session states */
-/* CK_STATE has been changed from an enum to a CK_ULONG for
- * v2.0 */
-typedef CK_ULONG          CK_STATE;
-#define CKS_RO_PUBLIC_SESSION  0
-#define CKS_RO_USER_FUNCTIONS  1
-#define CKS_RW_PUBLIC_SESSION  2
-#define CKS_RW_USER_FUNCTIONS  3
-#define CKS_RW_SO_FUNCTIONS    4
-
-
-/* CK_SESSION_INFO provides information about a session */
-typedef struct CK_SESSION_INFO {
-  CK_SLOT_ID    slotID;
-  CK_STATE      state;
-  CK_FLAGS      flags;          /* see below */
-
-  /* ulDeviceError was changed from CK_USHORT to CK_ULONG for
-   * v2.0 */
-  CK_ULONG      ulDeviceError;  /* device-dependent error code */
-} CK_SESSION_INFO;
-
-/* The flags are defined in the following table:
- *      Bit Flag                Mask        Meaning
- */
-#define CKF_RW_SESSION          0x00000002  /* session is r/w */
-#define CKF_SERIAL_SESSION      0x00000004  /* no parallel */
-
-typedef CK_SESSION_INFO CK_PTR CK_SESSION_INFO_PTR;
-
-
-/* CK_OBJECT_HANDLE is a token-specific identifier for an
- * object  */
-typedef CK_ULONG          CK_OBJECT_HANDLE;
-
-typedef CK_OBJECT_HANDLE CK_PTR CK_OBJECT_HANDLE_PTR;
-
-
-/* CK_OBJECT_CLASS is a value that identifies the classes (or
- * types) of objects that Cryptoki recognizes.  It is defined
- * as follows: */
-/* CK_OBJECT_CLASS was changed from CK_USHORT to CK_ULONG for
- * v2.0 */
-typedef CK_ULONG          CK_OBJECT_CLASS;
-
-/* The following classes of objects are defined: */
-/* CKO_HW_FEATURE is new for v2.10 */
-/* CKO_DOMAIN_PARAMETERS is new for v2.11 */
-/* CKO_MECHANISM is new for v2.20 */
-#define CKO_DATA              0x00000000
-#define CKO_CERTIFICATE       0x00000001
-#define CKO_PUBLIC_KEY        0x00000002
-#define CKO_PRIVATE_KEY       0x00000003
-#define CKO_SECRET_KEY        0x00000004
-#define CKO_HW_FEATURE        0x00000005
-#define CKO_DOMAIN_PARAMETERS 0x00000006
-#define CKO_MECHANISM         0x00000007
-
-/* CKO_OTP_KEY is new for PKCS #11 v2.20 amendment 1 */
-#define CKO_OTP_KEY           0x00000008
-
-#define CKO_VENDOR_DEFINED    0x80000000
-
-typedef CK_OBJECT_CLASS CK_PTR CK_OBJECT_CLASS_PTR;
-
-/* CK_HW_FEATURE_TYPE is new for v2.10. CK_HW_FEATURE_TYPE is a
- * value that identifies the hardware feature type of an object
- * with CK_OBJECT_CLASS equal to CKO_HW_FEATURE. */
-typedef CK_ULONG          CK_HW_FEATURE_TYPE;
-
-/* The following hardware feature types are defined */
-/* CKH_USER_INTERFACE is new for v2.20 */
-#define CKH_MONOTONIC_COUNTER  0x00000001
-#define CKH_CLOCK           0x00000002
-#define CKH_USER_INTERFACE  0x00000003
-#define CKH_VENDOR_DEFINED  0x80000000
-
-/* CK_KEY_TYPE is a value that identifies a key type */
-/* CK_KEY_TYPE was changed from CK_USHORT to CK_ULONG for v2.0 */
-typedef CK_ULONG          CK_KEY_TYPE;
-
-/* the following key types are defined: */
-#define CKK_RSA             0x00000000
-#define CKK_DSA             0x00000001
-#define CKK_DH              0x00000002
-
-/* CKK_ECDSA and CKK_KEA are new for v2.0 */
-/* CKK_ECDSA is deprecated in v2.11, CKK_EC is preferred. */
-#define CKK_ECDSA           0x00000003
-#define CKK_EC              0x00000003
-#define CKK_X9_42_DH        0x00000004
-#define CKK_KEA             0x00000005
-
-#define CKK_GENERIC_SECRET  0x00000010
-#define CKK_RC2             0x00000011
-#define CKK_RC4             0x00000012
-#define CKK_DES             0x00000013
-#define CKK_DES2            0x00000014
-#define CKK_DES3            0x00000015
-
-/* all these key types are new for v2.0 */
-#define CKK_CAST            0x00000016
-#define CKK_CAST3           0x00000017
-/* CKK_CAST5 is deprecated in v2.11, CKK_CAST128 is preferred. */
-#define CKK_CAST5           0x00000018
-#define CKK_CAST128         0x00000018
-#define CKK_RC5             0x00000019
-#define CKK_IDEA            0x0000001A
-#define CKK_SKIPJACK        0x0000001B
-#define CKK_BATON           0x0000001C
-#define CKK_JUNIPER         0x0000001D
-#define CKK_CDMF            0x0000001E
-#define CKK_AES             0x0000001F
-
-/* BlowFish and TwoFish are new for v2.20 */
-#define CKK_BLOWFISH        0x00000020
-#define CKK_TWOFISH         0x00000021
-
-/* SecurID, HOTP, and ACTI are new for PKCS #11 v2.20 amendment 1 */
-#define CKK_SECURID         0x00000022
-#define CKK_HOTP            0x00000023
-#define CKK_ACTI            0x00000024
-
-/* Camellia is new for PKCS #11 v2.20 amendment 3 */
-#define CKK_CAMELLIA                   0x00000025
-/* ARIA is new for PKCS #11 v2.20 amendment 3 */
-#define CKK_ARIA                       0x00000026
-
-
-#define CKK_VENDOR_DEFINED  0x80000000
-
-
-/* CK_CERTIFICATE_TYPE is a value that identifies a certificate
- * type */
-/* CK_CERTIFICATE_TYPE was changed from CK_USHORT to CK_ULONG
- * for v2.0 */
-typedef CK_ULONG          CK_CERTIFICATE_TYPE;
-
-/* The following certificate types are defined: */
-/* CKC_X_509_ATTR_CERT is new for v2.10 */
-/* CKC_WTLS is new for v2.20 */
-#define CKC_X_509           0x00000000
-#define CKC_X_509_ATTR_CERT 0x00000001
-#define CKC_WTLS            0x00000002
-#define CKC_VENDOR_DEFINED  0x80000000
-
-
-/* CK_ATTRIBUTE_TYPE is a value that identifies an attribute
- * type */
-/* CK_ATTRIBUTE_TYPE was changed from CK_USHORT to CK_ULONG for
- * v2.0 */
-typedef CK_ULONG          CK_ATTRIBUTE_TYPE;
-
-/* The CKF_ARRAY_ATTRIBUTE flag identifies an attribute which
-   consists of an array of values. */
-#define CKF_ARRAY_ATTRIBUTE    0x40000000
-
-/* The following OTP-related defines are new for PKCS #11 v2.20 amendment 1
-   and relates to the CKA_OTP_FORMAT attribute */
-#define CK_OTP_FORMAT_DECIMAL      0
-#define CK_OTP_FORMAT_HEXADECIMAL  1
-#define CK_OTP_FORMAT_ALPHANUMERIC 2
-#define CK_OTP_FORMAT_BINARY       3
-
-/* The following OTP-related defines are new for PKCS #11 v2.20 amendment 1
-   and relates to the CKA_OTP_..._REQUIREMENT attributes */
-#define CK_OTP_PARAM_IGNORED       0
-#define CK_OTP_PARAM_OPTIONAL      1
-#define CK_OTP_PARAM_MANDATORY     2
-
-/* The following attribute types are defined: */
-#define CKA_CLASS              0x00000000
-#define CKA_TOKEN              0x00000001
-#define CKA_PRIVATE            0x00000002
-#define CKA_LABEL              0x00000003
-#define CKA_APPLICATION        0x00000010
-#define CKA_VALUE              0x00000011
-
-/* CKA_OBJECT_ID is new for v2.10 */
-#define CKA_OBJECT_ID          0x00000012
-
-#define CKA_CERTIFICATE_TYPE   0x00000080
-#define CKA_ISSUER             0x00000081
-#define CKA_SERIAL_NUMBER      0x00000082
-
-/* CKA_AC_ISSUER, CKA_OWNER, and CKA_ATTR_TYPES are new
- * for v2.10 */
-#define CKA_AC_ISSUER          0x00000083
-#define CKA_OWNER              0x00000084
-#define CKA_ATTR_TYPES         0x00000085
-
-/* CKA_TRUSTED is new for v2.11 */
-#define CKA_TRUSTED            0x00000086
-
-/* CKA_CERTIFICATE_CATEGORY ...
- * CKA_CHECK_VALUE are new for v2.20 */
-#define CKA_CERTIFICATE_CATEGORY        0x00000087
-#define CKA_JAVA_MIDP_SECURITY_DOMAIN   0x00000088
-#define CKA_URL                         0x00000089
-#define CKA_HASH_OF_SUBJECT_PUBLIC_KEY  0x0000008A
-#define CKA_HASH_OF_ISSUER_PUBLIC_KEY   0x0000008B
-#define CKA_CHECK_VALUE                 0x00000090
-
-#define CKA_KEY_TYPE           0x00000100
-#define CKA_SUBJECT            0x00000101
-#define CKA_ID                 0x00000102
-#define CKA_SENSITIVE          0x00000103
-#define CKA_ENCRYPT            0x00000104
-#define CKA_DECRYPT            0x00000105
-#define CKA_WRAP               0x00000106
-#define CKA_UNWRAP             0x00000107
-#define CKA_SIGN               0x00000108
-#define CKA_SIGN_RECOVER       0x00000109
-#define CKA_VERIFY             0x0000010A
-#define CKA_VERIFY_RECOVER     0x0000010B
-#define CKA_DERIVE             0x0000010C
-#define CKA_START_DATE         0x00000110
-#define CKA_END_DATE           0x00000111
-#define CKA_MODULUS            0x00000120
-#define CKA_MODULUS_BITS       0x00000121
-#define CKA_PUBLIC_EXPONENT    0x00000122
-#define CKA_PRIVATE_EXPONENT   0x00000123
-#define CKA_PRIME_1            0x00000124
-#define CKA_PRIME_2            0x00000125
-#define CKA_EXPONENT_1         0x00000126
-#define CKA_EXPONENT_2         0x00000127
-#define CKA_COEFFICIENT        0x00000128
-#define CKA_PRIME              0x00000130
-#define CKA_SUBPRIME           0x00000131
-#define CKA_BASE               0x00000132
-
-/* CKA_PRIME_BITS and CKA_SUB_PRIME_BITS are new for v2.11 */
-#define CKA_PRIME_BITS         0x00000133
-#define CKA_SUBPRIME_BITS      0x00000134
-#define CKA_SUB_PRIME_BITS     CKA_SUBPRIME_BITS
-/* (To retain backwards-compatibility) */
-
-#define CKA_VALUE_BITS         0x00000160
-#define CKA_VALUE_LEN          0x00000161
-
-/* CKA_EXTRACTABLE, CKA_LOCAL, CKA_NEVER_EXTRACTABLE,
- * CKA_ALWAYS_SENSITIVE, CKA_MODIFIABLE, CKA_ECDSA_PARAMS,
- * and CKA_EC_POINT are new for v2.0 */
-#define CKA_EXTRACTABLE        0x00000162
-#define CKA_LOCAL              0x00000163
-#define CKA_NEVER_EXTRACTABLE  0x00000164
-#define CKA_ALWAYS_SENSITIVE   0x00000165
-
-/* CKA_KEY_GEN_MECHANISM is new for v2.11 */
-#define CKA_KEY_GEN_MECHANISM  0x00000166
-
-#define CKA_MODIFIABLE         0x00000170
-
-/* CKA_ECDSA_PARAMS is deprecated in v2.11,
- * CKA_EC_PARAMS is preferred. */
-#define CKA_ECDSA_PARAMS       0x00000180
-#define CKA_EC_PARAMS          0x00000180
-
-#define CKA_EC_POINT           0x00000181
-
-/* CKA_SECONDARY_AUTH, CKA_AUTH_PIN_FLAGS,
- * are new for v2.10. Deprecated in v2.11 and onwards. */
-#define CKA_SECONDARY_AUTH     0x00000200
-#define CKA_AUTH_PIN_FLAGS     0x00000201
-
-/* CKA_ALWAYS_AUTHENTICATE ...
- * CKA_UNWRAP_TEMPLATE are new for v2.20 */
-#define CKA_ALWAYS_AUTHENTICATE  0x00000202
-
-#define CKA_WRAP_WITH_TRUSTED    0x00000210
-#define CKA_WRAP_TEMPLATE        (CKF_ARRAY_ATTRIBUTE|0x00000211)
-#define CKA_UNWRAP_TEMPLATE      (CKF_ARRAY_ATTRIBUTE|0x00000212)
-
-/* CKA_OTP... atttributes are new for PKCS #11 v2.20 amendment 3. */
-#define CKA_OTP_FORMAT                0x00000220
-#define CKA_OTP_LENGTH                0x00000221
-#define CKA_OTP_TIME_INTERVAL         0x00000222
-#define CKA_OTP_USER_FRIENDLY_MODE    0x00000223
-#define CKA_OTP_CHALLENGE_REQUIREMENT 0x00000224
-#define CKA_OTP_TIME_REQUIREMENT      0x00000225
-#define CKA_OTP_COUNTER_REQUIREMENT   0x00000226
-#define CKA_OTP_PIN_REQUIREMENT       0x00000227
-#define CKA_OTP_COUNTER               0x0000022E
-#define CKA_OTP_TIME                  0x0000022F
-#define CKA_OTP_USER_IDENTIFIER       0x0000022A
-#define CKA_OTP_SERVICE_IDENTIFIER    0x0000022B
-#define CKA_OTP_SERVICE_LOGO          0x0000022C
-#define CKA_OTP_SERVICE_LOGO_TYPE     0x0000022D
-
-
-/* CKA_HW_FEATURE_TYPE, CKA_RESET_ON_INIT, and CKA_HAS_RESET
- * are new for v2.10 */
-#define CKA_HW_FEATURE_TYPE    0x00000300
-#define CKA_RESET_ON_INIT      0x00000301
-#define CKA_HAS_RESET          0x00000302
-
-/* The following attributes are new for v2.20 */
-#define CKA_PIXEL_X                     0x00000400
-#define CKA_PIXEL_Y                     0x00000401
-#define CKA_RESOLUTION                  0x00000402
-#define CKA_CHAR_ROWS                   0x00000403
-#define CKA_CHAR_COLUMNS                0x00000404
-#define CKA_COLOR                       0x00000405
-#define CKA_BITS_PER_PIXEL              0x00000406
-#define CKA_CHAR_SETS                   0x00000480
-#define CKA_ENCODING_METHODS            0x00000481
-#define CKA_MIME_TYPES                  0x00000482
-#define CKA_MECHANISM_TYPE              0x00000500
-#define CKA_REQUIRED_CMS_ATTRIBUTES     0x00000501
-#define CKA_DEFAULT_CMS_ATTRIBUTES      0x00000502
-#define CKA_SUPPORTED_CMS_ATTRIBUTES    0x00000503
-#define CKA_ALLOWED_MECHANISMS          (CKF_ARRAY_ATTRIBUTE|0x00000600)
-
-#define CKA_VENDOR_DEFINED     0x80000000
-
-/* CK_ATTRIBUTE is a structure that includes the type, length
- * and value of an attribute */
-typedef struct CK_ATTRIBUTE {
-  CK_ATTRIBUTE_TYPE type;
-  CK_VOID_PTR       pValue;
-
-  /* ulValueLen went from CK_USHORT to CK_ULONG for v2.0 */
-  CK_ULONG          ulValueLen;  /* in bytes */
-} CK_ATTRIBUTE;
-
-typedef CK_ATTRIBUTE CK_PTR CK_ATTRIBUTE_PTR;
-
-
-/* CK_DATE is a structure that defines a date */
-typedef struct CK_DATE{
-  CK_CHAR       year[4];   /* the year ("1900" - "9999") */
-  CK_CHAR       month[2];  /* the month ("01" - "12") */
-  CK_CHAR       day[2];    /* the day   ("01" - "31") */
-} CK_DATE;
-
-
-/* CK_MECHANISM_TYPE is a value that identifies a mechanism
- * type */
-/* CK_MECHANISM_TYPE was changed from CK_USHORT to CK_ULONG for
- * v2.0 */
-typedef CK_ULONG          CK_MECHANISM_TYPE;
-
-/* the following mechanism types are defined: */
-#define CKM_RSA_PKCS_KEY_PAIR_GEN      0x00000000
-#define CKM_RSA_PKCS                   0x00000001
-#define CKM_RSA_9796                   0x00000002
-#define CKM_RSA_X_509                  0x00000003
-
-/* CKM_MD2_RSA_PKCS, CKM_MD5_RSA_PKCS, and CKM_SHA1_RSA_PKCS
- * are new for v2.0.  They are mechanisms which hash and sign */
-#define CKM_MD2_RSA_PKCS               0x00000004
-#define CKM_MD5_RSA_PKCS               0x00000005
-#define CKM_SHA1_RSA_PKCS              0x00000006
-
-/* CKM_RIPEMD128_RSA_PKCS, CKM_RIPEMD160_RSA_PKCS, and
- * CKM_RSA_PKCS_OAEP are new for v2.10 */
-#define CKM_RIPEMD128_RSA_PKCS         0x00000007
-#define CKM_RIPEMD160_RSA_PKCS         0x00000008
-#define CKM_RSA_PKCS_OAEP              0x00000009
-
-/* CKM_RSA_X9_31_KEY_PAIR_GEN, CKM_RSA_X9_31, CKM_SHA1_RSA_X9_31,
- * CKM_RSA_PKCS_PSS, and CKM_SHA1_RSA_PKCS_PSS are new for v2.11 */
-#define CKM_RSA_X9_31_KEY_PAIR_GEN     0x0000000A
-#define CKM_RSA_X9_31                  0x0000000B
-#define CKM_SHA1_RSA_X9_31             0x0000000C
-#define CKM_RSA_PKCS_PSS               0x0000000D
-#define CKM_SHA1_RSA_PKCS_PSS          0x0000000E
-
-#define CKM_DSA_KEY_PAIR_GEN           0x00000010
-#define CKM_DSA                        0x00000011
-#define CKM_DSA_SHA1                   0x00000012
-#define CKM_DH_PKCS_KEY_PAIR_GEN       0x00000020
-#define CKM_DH_PKCS_DERIVE             0x00000021
-
-/* CKM_X9_42_DH_KEY_PAIR_GEN, CKM_X9_42_DH_DERIVE,
- * CKM_X9_42_DH_HYBRID_DERIVE, and CKM_X9_42_MQV_DERIVE are new for
- * v2.11 */
-#define CKM_X9_42_DH_KEY_PAIR_GEN      0x00000030
-#define CKM_X9_42_DH_DERIVE            0x00000031
-#define CKM_X9_42_DH_HYBRID_DERIVE     0x00000032
-#define CKM_X9_42_MQV_DERIVE           0x00000033
-
-/* CKM_SHA256/384/512 are new for v2.20 */
-#define CKM_SHA256_RSA_PKCS            0x00000040
-#define CKM_SHA384_RSA_PKCS            0x00000041
-#define CKM_SHA512_RSA_PKCS            0x00000042
-#define CKM_SHA256_RSA_PKCS_PSS        0x00000043
-#define CKM_SHA384_RSA_PKCS_PSS        0x00000044
-#define CKM_SHA512_RSA_PKCS_PSS        0x00000045
-
-/* SHA-224 RSA mechanisms are new for PKCS #11 v2.20 amendment 3 */
-#define CKM_SHA224_RSA_PKCS            0x00000046
-#define CKM_SHA224_RSA_PKCS_PSS        0x00000047
-
-#define CKM_RC2_KEY_GEN                0x00000100
-#define CKM_RC2_ECB                    0x00000101
-#define CKM_RC2_CBC                    0x00000102
-#define CKM_RC2_MAC                    0x00000103
-
-/* CKM_RC2_MAC_GENERAL and CKM_RC2_CBC_PAD are new for v2.0 */
-#define CKM_RC2_MAC_GENERAL            0x00000104
-#define CKM_RC2_CBC_PAD                0x00000105
-
-#define CKM_RC4_KEY_GEN                0x00000110
-#define CKM_RC4                        0x00000111
-#define CKM_DES_KEY_GEN                0x00000120
-#define CKM_DES_ECB                    0x00000121
-#define CKM_DES_CBC                    0x00000122
-#define CKM_DES_MAC                    0x00000123
-
-/* CKM_DES_MAC_GENERAL and CKM_DES_CBC_PAD are new for v2.0 */
-#define CKM_DES_MAC_GENERAL            0x00000124
-#define CKM_DES_CBC_PAD                0x00000125
-
-#define CKM_DES2_KEY_GEN               0x00000130
-#define CKM_DES3_KEY_GEN               0x00000131
-#define CKM_DES3_ECB                   0x00000132
-#define CKM_DES3_CBC                   0x00000133
-#define CKM_DES3_MAC                   0x00000134
-
-/* CKM_DES3_MAC_GENERAL, CKM_DES3_CBC_PAD, CKM_CDMF_KEY_GEN,
- * CKM_CDMF_ECB, CKM_CDMF_CBC, CKM_CDMF_MAC,
- * CKM_CDMF_MAC_GENERAL, and CKM_CDMF_CBC_PAD are new for v2.0 */
-#define CKM_DES3_MAC_GENERAL           0x00000135
-#define CKM_DES3_CBC_PAD               0x00000136
-#define CKM_CDMF_KEY_GEN               0x00000140
-#define CKM_CDMF_ECB                   0x00000141
-#define CKM_CDMF_CBC                   0x00000142
-#define CKM_CDMF_MAC                   0x00000143
-#define CKM_CDMF_MAC_GENERAL           0x00000144
-#define CKM_CDMF_CBC_PAD               0x00000145
-
-/* the following four DES mechanisms are new for v2.20 */
-#define CKM_DES_OFB64                  0x00000150
-#define CKM_DES_OFB8                   0x00000151
-#define CKM_DES_CFB64                  0x00000152
-#define CKM_DES_CFB8                   0x00000153
-
-#define CKM_MD2                        0x00000200
-
-/* CKM_MD2_HMAC and CKM_MD2_HMAC_GENERAL are new for v2.0 */
-#define CKM_MD2_HMAC                   0x00000201
-#define CKM_MD2_HMAC_GENERAL           0x00000202
-
-#define CKM_MD5                        0x00000210
-
-/* CKM_MD5_HMAC and CKM_MD5_HMAC_GENERAL are new for v2.0 */
-#define CKM_MD5_HMAC                   0x00000211
-#define CKM_MD5_HMAC_GENERAL           0x00000212
-
-#define CKM_SHA_1                      0x00000220
-
-/* CKM_SHA_1_HMAC and CKM_SHA_1_HMAC_GENERAL are new for v2.0 */
-#define CKM_SHA_1_HMAC                 0x00000221
-#define CKM_SHA_1_HMAC_GENERAL         0x00000222
-
-/* CKM_RIPEMD128, CKM_RIPEMD128_HMAC,
- * CKM_RIPEMD128_HMAC_GENERAL, CKM_RIPEMD160, CKM_RIPEMD160_HMAC,
- * and CKM_RIPEMD160_HMAC_GENERAL are new for v2.10 */
-#define CKM_RIPEMD128                  0x00000230
-#define CKM_RIPEMD128_HMAC             0x00000231
-#define CKM_RIPEMD128_HMAC_GENERAL     0x00000232
-#define CKM_RIPEMD160                  0x00000240
-#define CKM_RIPEMD160_HMAC             0x00000241
-#define CKM_RIPEMD160_HMAC_GENERAL     0x00000242
-
-/* CKM_SHA256/384/512 are new for v2.20 */
-#define CKM_SHA256                     0x00000250
-#define CKM_SHA256_HMAC                0x00000251
-#define CKM_SHA256_HMAC_GENERAL        0x00000252
-
-/* SHA-224 is new for PKCS #11 v2.20 amendment 3 */
-#define CKM_SHA224                     0x00000255
-#define CKM_SHA224_HMAC                0x00000256
-#define CKM_SHA224_HMAC_GENERAL        0x00000257
-
-#define CKM_SHA384                     0x00000260
-#define CKM_SHA384_HMAC                0x00000261
-#define CKM_SHA384_HMAC_GENERAL        0x00000262
-#define CKM_SHA512                     0x00000270
-#define CKM_SHA512_HMAC                0x00000271
-#define CKM_SHA512_HMAC_GENERAL        0x00000272
-
-/* SecurID is new for PKCS #11 v2.20 amendment 1 */
-#define CKM_SECURID_KEY_GEN            0x00000280
-#define CKM_SECURID                    0x00000282
-
-/* HOTP is new for PKCS #11 v2.20 amendment 1 */
-#define CKM_HOTP_KEY_GEN    0x00000290
-#define CKM_HOTP            0x00000291
-
-/* ACTI is new for PKCS #11 v2.20 amendment 1 */
-#define CKM_ACTI            0x000002A0
-#define CKM_ACTI_KEY_GEN    0x000002A1
-
-/* All of the following mechanisms are new for v2.0 */
-/* Note that CAST128 and CAST5 are the same algorithm */
-#define CKM_CAST_KEY_GEN               0x00000300
-#define CKM_CAST_ECB                   0x00000301
-#define CKM_CAST_CBC                   0x00000302
-#define CKM_CAST_MAC                   0x00000303
-#define CKM_CAST_MAC_GENERAL           0x00000304
-#define CKM_CAST_CBC_PAD               0x00000305
-#define CKM_CAST3_KEY_GEN              0x00000310
-#define CKM_CAST3_ECB                  0x00000311
-#define CKM_CAST3_CBC                  0x00000312
-#define CKM_CAST3_MAC                  0x00000313
-#define CKM_CAST3_MAC_GENERAL          0x00000314
-#define CKM_CAST3_CBC_PAD              0x00000315
-#define CKM_CAST5_KEY_GEN              0x00000320
-#define CKM_CAST128_KEY_GEN            0x00000320
-#define CKM_CAST5_ECB                  0x00000321
-#define CKM_CAST128_ECB                0x00000321
-#define CKM_CAST5_CBC                  0x00000322
-#define CKM_CAST128_CBC                0x00000322
-#define CKM_CAST5_MAC                  0x00000323
-#define CKM_CAST128_MAC                0x00000323
-#define CKM_CAST5_MAC_GENERAL          0x00000324
-#define CKM_CAST128_MAC_GENERAL        0x00000324
-#define CKM_CAST5_CBC_PAD              0x00000325
-#define CKM_CAST128_CBC_PAD            0x00000325
-#define CKM_RC5_KEY_GEN                0x00000330
-#define CKM_RC5_ECB                    0x00000331
-#define CKM_RC5_CBC                    0x00000332
-#define CKM_RC5_MAC                    0x00000333
-#define CKM_RC5_MAC_GENERAL            0x00000334
-#define CKM_RC5_CBC_PAD                0x00000335
-#define CKM_IDEA_KEY_GEN               0x00000340
-#define CKM_IDEA_ECB                   0x00000341
-#define CKM_IDEA_CBC                   0x00000342
-#define CKM_IDEA_MAC                   0x00000343
-#define CKM_IDEA_MAC_GENERAL           0x00000344
-#define CKM_IDEA_CBC_PAD               0x00000345
-#define CKM_GENERIC_SECRET_KEY_GEN     0x00000350
-#define CKM_CONCATENATE_BASE_AND_KEY   0x00000360
-#define CKM_CONCATENATE_BASE_AND_DATA  0x00000362
-#define CKM_CONCATENATE_DATA_AND_BASE  0x00000363
-#define CKM_XOR_BASE_AND_DATA          0x00000364
-#define CKM_EXTRACT_KEY_FROM_KEY       0x00000365
-#define CKM_SSL3_PRE_MASTER_KEY_GEN    0x00000370
-#define CKM_SSL3_MASTER_KEY_DERIVE     0x00000371
-#define CKM_SSL3_KEY_AND_MAC_DERIVE    0x00000372
-
-/* CKM_SSL3_MASTER_KEY_DERIVE_DH, CKM_TLS_PRE_MASTER_KEY_GEN,
- * CKM_TLS_MASTER_KEY_DERIVE, CKM_TLS_KEY_AND_MAC_DERIVE, and
- * CKM_TLS_MASTER_KEY_DERIVE_DH are new for v2.11 */
-#define CKM_SSL3_MASTER_KEY_DERIVE_DH  0x00000373
-#define CKM_TLS_PRE_MASTER_KEY_GEN     0x00000374
-#define CKM_TLS_MASTER_KEY_DERIVE      0x00000375
-#define CKM_TLS_KEY_AND_MAC_DERIVE     0x00000376
-#define CKM_TLS_MASTER_KEY_DERIVE_DH   0x00000377
-
-/* CKM_TLS_PRF is new for v2.20 */
-#define CKM_TLS_PRF                    0x00000378
-
-#define CKM_SSL3_MD5_MAC               0x00000380
-#define CKM_SSL3_SHA1_MAC              0x00000381
-#define CKM_MD5_KEY_DERIVATION         0x00000390
-#define CKM_MD2_KEY_DERIVATION         0x00000391
-#define CKM_SHA1_KEY_DERIVATION        0x00000392
-
-/* CKM_SHA256/384/512 are new for v2.20 */
-#define CKM_SHA256_KEY_DERIVATION      0x00000393
-#define CKM_SHA384_KEY_DERIVATION      0x00000394
-#define CKM_SHA512_KEY_DERIVATION      0x00000395
-
-/* SHA-224 key derivation is new for PKCS #11 v2.20 amendment 3 */
-#define CKM_SHA224_KEY_DERIVATION      0x00000396
-
-#define CKM_PBE_MD2_DES_CBC            0x000003A0
-#define CKM_PBE_MD5_DES_CBC            0x000003A1
-#define CKM_PBE_MD5_CAST_CBC           0x000003A2
-#define CKM_PBE_MD5_CAST3_CBC          0x000003A3
-#define CKM_PBE_MD5_CAST5_CBC          0x000003A4
-#define CKM_PBE_MD5_CAST128_CBC        0x000003A4
-#define CKM_PBE_SHA1_CAST5_CBC         0x000003A5
-#define CKM_PBE_SHA1_CAST128_CBC       0x000003A5
-#define CKM_PBE_SHA1_RC4_128           0x000003A6
-#define CKM_PBE_SHA1_RC4_40            0x000003A7
-#define CKM_PBE_SHA1_DES3_EDE_CBC      0x000003A8
-#define CKM_PBE_SHA1_DES2_EDE_CBC      0x000003A9
-#define CKM_PBE_SHA1_RC2_128_CBC       0x000003AA
-#define CKM_PBE_SHA1_RC2_40_CBC        0x000003AB
-
-/* CKM_PKCS5_PBKD2 is new for v2.10 */
-#define CKM_PKCS5_PBKD2                0x000003B0
-
-#define CKM_PBA_SHA1_WITH_SHA1_HMAC    0x000003C0
-
-/* WTLS mechanisms are new for v2.20 */
-#define CKM_WTLS_PRE_MASTER_KEY_GEN         0x000003D0
-#define CKM_WTLS_MASTER_KEY_DERIVE          0x000003D1
-#define CKM_WTLS_MASTER_KEY_DERIVE_DH_ECC   0x000003D2
-#define CKM_WTLS_PRF                        0x000003D3
-#define CKM_WTLS_SERVER_KEY_AND_MAC_DERIVE  0x000003D4
-#define CKM_WTLS_CLIENT_KEY_AND_MAC_DERIVE  0x000003D5
-
-#define CKM_KEY_WRAP_LYNKS             0x00000400
-#define CKM_KEY_WRAP_SET_OAEP          0x00000401
-
-/* CKM_CMS_SIG is new for v2.20 */
-#define CKM_CMS_SIG                    0x00000500
-
-/* CKM_KIP mechanisms are new for PKCS #11 v2.20 amendment 2 */
-#define CKM_KIP_DERIVE	               0x00000510
-#define CKM_KIP_WRAP	               0x00000511
-#define CKM_KIP_MAC	               0x00000512
-
-/* Camellia is new for PKCS #11 v2.20 amendment 3 */
-#define CKM_CAMELLIA_KEY_GEN           0x00000550
-#define CKM_CAMELLIA_ECB               0x00000551
-#define CKM_CAMELLIA_CBC               0x00000552
-#define CKM_CAMELLIA_MAC               0x00000553
-#define CKM_CAMELLIA_MAC_GENERAL       0x00000554
-#define CKM_CAMELLIA_CBC_PAD           0x00000555
-#define CKM_CAMELLIA_ECB_ENCRYPT_DATA  0x00000556
-#define CKM_CAMELLIA_CBC_ENCRYPT_DATA  0x00000557
-#define CKM_CAMELLIA_CTR               0x00000558
-
-/* ARIA is new for PKCS #11 v2.20 amendment 3 */
-#define CKM_ARIA_KEY_GEN               0x00000560
-#define CKM_ARIA_ECB                   0x00000561
-#define CKM_ARIA_CBC                   0x00000562
-#define CKM_ARIA_MAC                   0x00000563
-#define CKM_ARIA_MAC_GENERAL           0x00000564
-#define CKM_ARIA_CBC_PAD               0x00000565
-#define CKM_ARIA_ECB_ENCRYPT_DATA      0x00000566
-#define CKM_ARIA_CBC_ENCRYPT_DATA      0x00000567
-
-/* Fortezza mechanisms */
-#define CKM_SKIPJACK_KEY_GEN           0x00001000
-#define CKM_SKIPJACK_ECB64             0x00001001
-#define CKM_SKIPJACK_CBC64             0x00001002
-#define CKM_SKIPJACK_OFB64             0x00001003
-#define CKM_SKIPJACK_CFB64             0x00001004
-#define CKM_SKIPJACK_CFB32             0x00001005
-#define CKM_SKIPJACK_CFB16             0x00001006
-#define CKM_SKIPJACK_CFB8              0x00001007
-#define CKM_SKIPJACK_WRAP              0x00001008
-#define CKM_SKIPJACK_PRIVATE_WRAP      0x00001009
-#define CKM_SKIPJACK_RELAYX            0x0000100a
-#define CKM_KEA_KEY_PAIR_GEN           0x00001010
-#define CKM_KEA_KEY_DERIVE             0x00001011
-#define CKM_FORTEZZA_TIMESTAMP         0x00001020
-#define CKM_BATON_KEY_GEN              0x00001030
-#define CKM_BATON_ECB128               0x00001031
-#define CKM_BATON_ECB96                0x00001032
-#define CKM_BATON_CBC128               0x00001033
-#define CKM_BATON_COUNTER              0x00001034
-#define CKM_BATON_SHUFFLE              0x00001035
-#define CKM_BATON_WRAP                 0x00001036
-
-/* CKM_ECDSA_KEY_PAIR_GEN is deprecated in v2.11,
- * CKM_EC_KEY_PAIR_GEN is preferred */
-#define CKM_ECDSA_KEY_PAIR_GEN         0x00001040
-#define CKM_EC_KEY_PAIR_GEN            0x00001040
-
-#define CKM_ECDSA                      0x00001041
-#define CKM_ECDSA_SHA1                 0x00001042
-
-/* CKM_ECDH1_DERIVE, CKM_ECDH1_COFACTOR_DERIVE, and CKM_ECMQV_DERIVE
- * are new for v2.11 */
-#define CKM_ECDH1_DERIVE               0x00001050
-#define CKM_ECDH1_COFACTOR_DERIVE      0x00001051
-#define CKM_ECMQV_DERIVE               0x00001052
-
-#define CKM_JUNIPER_KEY_GEN            0x00001060
-#define CKM_JUNIPER_ECB128             0x00001061
-#define CKM_JUNIPER_CBC128             0x00001062
-#define CKM_JUNIPER_COUNTER            0x00001063
-#define CKM_JUNIPER_SHUFFLE            0x00001064
-#define CKM_JUNIPER_WRAP               0x00001065
-#define CKM_FASTHASH                   0x00001070
-
-/* CKM_AES_KEY_GEN, CKM_AES_ECB, CKM_AES_CBC, CKM_AES_MAC,
- * CKM_AES_MAC_GENERAL, CKM_AES_CBC_PAD, CKM_DSA_PARAMETER_GEN,
- * CKM_DH_PKCS_PARAMETER_GEN, and CKM_X9_42_DH_PARAMETER_GEN are
- * new for v2.11 */
-#define CKM_AES_KEY_GEN                0x00001080
-#define CKM_AES_ECB                    0x00001081
-#define CKM_AES_CBC                    0x00001082
-#define CKM_AES_MAC                    0x00001083
-#define CKM_AES_MAC_GENERAL            0x00001084
-#define CKM_AES_CBC_PAD                0x00001085
-
-/* AES counter mode is new for PKCS #11 v2.20 amendment 3 */
-#define CKM_AES_CTR                    0x00001086
-
-/* BlowFish and TwoFish are new for v2.20 */
-#define CKM_BLOWFISH_KEY_GEN           0x00001090
-#define CKM_BLOWFISH_CBC               0x00001091
-#define CKM_TWOFISH_KEY_GEN            0x00001092
-#define CKM_TWOFISH_CBC                0x00001093
-
-
-/* CKM_xxx_ENCRYPT_DATA mechanisms are new for v2.20 */
-#define CKM_DES_ECB_ENCRYPT_DATA       0x00001100
-#define CKM_DES_CBC_ENCRYPT_DATA       0x00001101
-#define CKM_DES3_ECB_ENCRYPT_DATA      0x00001102
-#define CKM_DES3_CBC_ENCRYPT_DATA      0x00001103
-#define CKM_AES_ECB_ENCRYPT_DATA       0x00001104
-#define CKM_AES_CBC_ENCRYPT_DATA       0x00001105
-
-#define CKM_DSA_PARAMETER_GEN          0x00002000
-#define CKM_DH_PKCS_PARAMETER_GEN      0x00002001
-#define CKM_X9_42_DH_PARAMETER_GEN     0x00002002
-
-#define CKM_VENDOR_DEFINED             0x80000000
-
-typedef CK_MECHANISM_TYPE CK_PTR CK_MECHANISM_TYPE_PTR;
-
-
-/* CK_MECHANISM is a structure that specifies a particular
- * mechanism  */
-typedef struct CK_MECHANISM {
-  CK_MECHANISM_TYPE mechanism;
-  CK_VOID_PTR       pParameter;
-
-  /* ulParameterLen was changed from CK_USHORT to CK_ULONG for
-   * v2.0 */
-  CK_ULONG          ulParameterLen;  /* in bytes */
-} CK_MECHANISM;
-
-typedef CK_MECHANISM CK_PTR CK_MECHANISM_PTR;
-
-
-/* CK_MECHANISM_INFO provides information about a particular
- * mechanism */
-typedef struct CK_MECHANISM_INFO {
-    CK_ULONG    ulMinKeySize;
-    CK_ULONG    ulMaxKeySize;
-    CK_FLAGS    flags;
-} CK_MECHANISM_INFO;
-
-/* The flags are defined as follows:
- *      Bit Flag               Mask        Meaning */
-#define CKF_HW                 0x00000001  /* performed by HW */
-
-/* The flags CKF_ENCRYPT, CKF_DECRYPT, CKF_DIGEST, CKF_SIGN,
- * CKG_SIGN_RECOVER, CKF_VERIFY, CKF_VERIFY_RECOVER,
- * CKF_GENERATE, CKF_GENERATE_KEY_PAIR, CKF_WRAP, CKF_UNWRAP,
- * and CKF_DERIVE are new for v2.0.  They specify whether or not
- * a mechanism can be used for a particular task */
-#define CKF_ENCRYPT            0x00000100
-#define CKF_DECRYPT            0x00000200
-#define CKF_DIGEST             0x00000400
-#define CKF_SIGN               0x00000800
-#define CKF_SIGN_RECOVER       0x00001000
-#define CKF_VERIFY             0x00002000
-#define CKF_VERIFY_RECOVER     0x00004000
-#define CKF_GENERATE           0x00008000
-#define CKF_GENERATE_KEY_PAIR  0x00010000
-#define CKF_WRAP               0x00020000
-#define CKF_UNWRAP             0x00040000
-#define CKF_DERIVE             0x00080000
-
-/* CKF_EC_F_P, CKF_EC_F_2M, CKF_EC_ECPARAMETERS, CKF_EC_NAMEDCURVE,
- * CKF_EC_UNCOMPRESS, and CKF_EC_COMPRESS are new for v2.11. They
- * describe a token's EC capabilities not available in mechanism
- * information. */
-#define CKF_EC_F_P             0x00100000
-#define CKF_EC_F_2M            0x00200000
-#define CKF_EC_ECPARAMETERS    0x00400000
-#define CKF_EC_NAMEDCURVE      0x00800000
-#define CKF_EC_UNCOMPRESS      0x01000000
-#define CKF_EC_COMPRESS        0x02000000
-
-#define CKF_EXTENSION          0x80000000 /* FALSE for this version */
-
-typedef CK_MECHANISM_INFO CK_PTR CK_MECHANISM_INFO_PTR;
-
-
-/* CK_RV is a value that identifies the return value of a
- * Cryptoki function */
-/* CK_RV was changed from CK_USHORT to CK_ULONG for v2.0 */
-typedef CK_ULONG          CK_RV;
-
-#define CKR_OK                                0x00000000
-#define CKR_CANCEL                            0x00000001
-#define CKR_HOST_MEMORY                       0x00000002
-#define CKR_SLOT_ID_INVALID                   0x00000003
-
-/* CKR_FLAGS_INVALID was removed for v2.0 */
-
-/* CKR_GENERAL_ERROR and CKR_FUNCTION_FAILED are new for v2.0 */
-#define CKR_GENERAL_ERROR                     0x00000005
-#define CKR_FUNCTION_FAILED                   0x00000006
-
-/* CKR_ARGUMENTS_BAD, CKR_NO_EVENT, CKR_NEED_TO_CREATE_THREADS,
- * and CKR_CANT_LOCK are new for v2.01 */
-#define CKR_ARGUMENTS_BAD                     0x00000007
-#define CKR_NO_EVENT                          0x00000008
-#define CKR_NEED_TO_CREATE_THREADS            0x00000009
-#define CKR_CANT_LOCK                         0x0000000A
-
-#define CKR_ATTRIBUTE_READ_ONLY               0x00000010
-#define CKR_ATTRIBUTE_SENSITIVE               0x00000011
-#define CKR_ATTRIBUTE_TYPE_INVALID            0x00000012
-#define CKR_ATTRIBUTE_VALUE_INVALID           0x00000013
-#define CKR_DATA_INVALID                      0x00000020
-#define CKR_DATA_LEN_RANGE                    0x00000021
-#define CKR_DEVICE_ERROR                      0x00000030
-#define CKR_DEVICE_MEMORY                     0x00000031
-#define CKR_DEVICE_REMOVED                    0x00000032
-#define CKR_ENCRYPTED_DATA_INVALID            0x00000040
-#define CKR_ENCRYPTED_DATA_LEN_RANGE          0x00000041
-#define CKR_FUNCTION_CANCELED                 0x00000050
-#define CKR_FUNCTION_NOT_PARALLEL             0x00000051
-
-/* CKR_FUNCTION_NOT_SUPPORTED is new for v2.0 */
-#define CKR_FUNCTION_NOT_SUPPORTED            0x00000054
-
-#define CKR_KEY_HANDLE_INVALID                0x00000060
-
-/* CKR_KEY_SENSITIVE was removed for v2.0 */
-
-#define CKR_KEY_SIZE_RANGE                    0x00000062
-#define CKR_KEY_TYPE_INCONSISTENT             0x00000063
-
-/* CKR_KEY_NOT_NEEDED, CKR_KEY_CHANGED, CKR_KEY_NEEDED,
- * CKR_KEY_INDIGESTIBLE, CKR_KEY_FUNCTION_NOT_PERMITTED,
- * CKR_KEY_NOT_WRAPPABLE, and CKR_KEY_UNEXTRACTABLE are new for
- * v2.0 */
-#define CKR_KEY_NOT_NEEDED                    0x00000064
-#define CKR_KEY_CHANGED                       0x00000065
-#define CKR_KEY_NEEDED                        0x00000066
-#define CKR_KEY_INDIGESTIBLE                  0x00000067
-#define CKR_KEY_FUNCTION_NOT_PERMITTED        0x00000068
-#define CKR_KEY_NOT_WRAPPABLE                 0x00000069
-#define CKR_KEY_UNEXTRACTABLE                 0x0000006A
-
-#define CKR_MECHANISM_INVALID                 0x00000070
-#define CKR_MECHANISM_PARAM_INVALID           0x00000071
-
-/* CKR_OBJECT_CLASS_INCONSISTENT and CKR_OBJECT_CLASS_INVALID
- * were removed for v2.0 */
-#define CKR_OBJECT_HANDLE_INVALID             0x00000082
-#define CKR_OPERATION_ACTIVE                  0x00000090
-#define CKR_OPERATION_NOT_INITIALIZED         0x00000091
-#define CKR_PIN_INCORRECT                     0x000000A0
-#define CKR_PIN_INVALID                       0x000000A1
-#define CKR_PIN_LEN_RANGE                     0x000000A2
-
-/* CKR_PIN_EXPIRED and CKR_PIN_LOCKED are new for v2.0 */
-#define CKR_PIN_EXPIRED                       0x000000A3
-#define CKR_PIN_LOCKED                        0x000000A4
-
-#define CKR_SESSION_CLOSED                    0x000000B0
-#define CKR_SESSION_COUNT                     0x000000B1
-#define CKR_SESSION_HANDLE_INVALID            0x000000B3
-#define CKR_SESSION_PARALLEL_NOT_SUPPORTED    0x000000B4
-#define CKR_SESSION_READ_ONLY                 0x000000B5
-#define CKR_SESSION_EXISTS                    0x000000B6
-
-/* CKR_SESSION_READ_ONLY_EXISTS and
- * CKR_SESSION_READ_WRITE_SO_EXISTS are new for v2.0 */
-#define CKR_SESSION_READ_ONLY_EXISTS          0x000000B7
-#define CKR_SESSION_READ_WRITE_SO_EXISTS      0x000000B8
-
-#define CKR_SIGNATURE_INVALID                 0x000000C0
-#define CKR_SIGNATURE_LEN_RANGE               0x000000C1
-#define CKR_TEMPLATE_INCOMPLETE               0x000000D0
-#define CKR_TEMPLATE_INCONSISTENT             0x000000D1
-#define CKR_TOKEN_NOT_PRESENT                 0x000000E0
-#define CKR_TOKEN_NOT_RECOGNIZED              0x000000E1
-#define CKR_TOKEN_WRITE_PROTECTED             0x000000E2
-#define CKR_UNWRAPPING_KEY_HANDLE_INVALID     0x000000F0
-#define CKR_UNWRAPPING_KEY_SIZE_RANGE         0x000000F1
-#define CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT  0x000000F2
-#define CKR_USER_ALREADY_LOGGED_IN            0x00000100
-#define CKR_USER_NOT_LOGGED_IN                0x00000101
-#define CKR_USER_PIN_NOT_INITIALIZED          0x00000102
-#define CKR_USER_TYPE_INVALID                 0x00000103
-
-/* CKR_USER_ANOTHER_ALREADY_LOGGED_IN and CKR_USER_TOO_MANY_TYPES
- * are new to v2.01 */
-#define CKR_USER_ANOTHER_ALREADY_LOGGED_IN    0x00000104
-#define CKR_USER_TOO_MANY_TYPES               0x00000105
-
-#define CKR_WRAPPED_KEY_INVALID               0x00000110
-#define CKR_WRAPPED_KEY_LEN_RANGE             0x00000112
-#define CKR_WRAPPING_KEY_HANDLE_INVALID       0x00000113
-#define CKR_WRAPPING_KEY_SIZE_RANGE           0x00000114
-#define CKR_WRAPPING_KEY_TYPE_INCONSISTENT    0x00000115
-#define CKR_RANDOM_SEED_NOT_SUPPORTED         0x00000120
-
-/* These are new to v2.0 */
-#define CKR_RANDOM_NO_RNG                     0x00000121
-
-/* These are new to v2.11 */
-#define CKR_DOMAIN_PARAMS_INVALID             0x00000130
-
-/* These are new to v2.0 */
-#define CKR_BUFFER_TOO_SMALL                  0x00000150
-#define CKR_SAVED_STATE_INVALID               0x00000160
-#define CKR_INFORMATION_SENSITIVE             0x00000170
-#define CKR_STATE_UNSAVEABLE                  0x00000180
-
-/* These are new to v2.01 */
-#define CKR_CRYPTOKI_NOT_INITIALIZED          0x00000190
-#define CKR_CRYPTOKI_ALREADY_INITIALIZED      0x00000191
-#define CKR_MUTEX_BAD                         0x000001A0
-#define CKR_MUTEX_NOT_LOCKED                  0x000001A1
-
-/* The following return values are new for PKCS #11 v2.20 amendment 3 */
-#define CKR_NEW_PIN_MODE                      0x000001B0
-#define CKR_NEXT_OTP                          0x000001B1
-
-/* This is new to v2.20 */
-#define CKR_FUNCTION_REJECTED                 0x00000200
-
-#define CKR_VENDOR_DEFINED                    0x80000000
-
-
-/* CK_NOTIFY is an application callback that processes events */
-typedef CK_CALLBACK_FUNCTION(CK_RV, CK_NOTIFY)(
-  CK_SESSION_HANDLE hSession,     /* the session's handle */
-  CK_NOTIFICATION   event,
-  CK_VOID_PTR       pApplication  /* passed to C_OpenSession */
-);
-
-
-/* CK_FUNCTION_LIST is a structure holding a Cryptoki spec
- * version and pointers of appropriate types to all the
- * Cryptoki functions */
-/* CK_FUNCTION_LIST is new for v2.0 */
-typedef struct CK_FUNCTION_LIST CK_FUNCTION_LIST;
-
-typedef CK_FUNCTION_LIST CK_PTR CK_FUNCTION_LIST_PTR;
-
-typedef CK_FUNCTION_LIST_PTR CK_PTR CK_FUNCTION_LIST_PTR_PTR;
-
-
-/* CK_CREATEMUTEX is an application callback for creating a
- * mutex object */
-typedef CK_CALLBACK_FUNCTION(CK_RV, CK_CREATEMUTEX)(
-  CK_VOID_PTR_PTR ppMutex  /* location to receive ptr to mutex */
-);
-
-
-/* CK_DESTROYMUTEX is an application callback for destroying a
- * mutex object */
-typedef CK_CALLBACK_FUNCTION(CK_RV, CK_DESTROYMUTEX)(
-  CK_VOID_PTR pMutex  /* pointer to mutex */
-);
-
-
-/* CK_LOCKMUTEX is an application callback for locking a mutex */
-typedef CK_CALLBACK_FUNCTION(CK_RV, CK_LOCKMUTEX)(
-  CK_VOID_PTR pMutex  /* pointer to mutex */
-);
-
-
-/* CK_UNLOCKMUTEX is an application callback for unlocking a
- * mutex */
-typedef CK_CALLBACK_FUNCTION(CK_RV, CK_UNLOCKMUTEX)(
-  CK_VOID_PTR pMutex  /* pointer to mutex */
-);
-
-
-/* CK_C_INITIALIZE_ARGS provides the optional arguments to
- * C_Initialize */
-typedef struct CK_C_INITIALIZE_ARGS {
-  CK_CREATEMUTEX CreateMutex;
-  CK_DESTROYMUTEX DestroyMutex;
-  CK_LOCKMUTEX LockMutex;
-  CK_UNLOCKMUTEX UnlockMutex;
-  CK_FLAGS flags;
-  CK_VOID_PTR pReserved;
-} CK_C_INITIALIZE_ARGS;
-
-/* flags: bit flags that provide capabilities of the slot
- *      Bit Flag                           Mask       Meaning
- */
-#define CKF_LIBRARY_CANT_CREATE_OS_THREADS 0x00000001
-#define CKF_OS_LOCKING_OK                  0x00000002
-
-typedef CK_C_INITIALIZE_ARGS CK_PTR CK_C_INITIALIZE_ARGS_PTR;
-
-
-/* additional flags for parameters to functions */
-
-/* CKF_DONT_BLOCK is for the function C_WaitForSlotEvent */
-#define CKF_DONT_BLOCK     1
-
-/* CK_RSA_PKCS_OAEP_MGF_TYPE is new for v2.10.
- * CK_RSA_PKCS_OAEP_MGF_TYPE  is used to indicate the Message
- * Generation Function (MGF) applied to a message block when
- * formatting a message block for the PKCS #1 OAEP encryption
- * scheme. */
-typedef CK_ULONG CK_RSA_PKCS_MGF_TYPE;
-
-typedef CK_RSA_PKCS_MGF_TYPE CK_PTR CK_RSA_PKCS_MGF_TYPE_PTR;
-
-/* The following MGFs are defined */
-/* CKG_MGF1_SHA256, CKG_MGF1_SHA384, and CKG_MGF1_SHA512
- * are new for v2.20 */
-#define CKG_MGF1_SHA1         0x00000001
-#define CKG_MGF1_SHA256       0x00000002
-#define CKG_MGF1_SHA384       0x00000003
-#define CKG_MGF1_SHA512       0x00000004
-/* SHA-224 is new for PKCS #11 v2.20 amendment 3 */
-#define CKG_MGF1_SHA224       0x00000005
-
-/* CK_RSA_PKCS_OAEP_SOURCE_TYPE is new for v2.10.
- * CK_RSA_PKCS_OAEP_SOURCE_TYPE  is used to indicate the source
- * of the encoding parameter when formatting a message block
- * for the PKCS #1 OAEP encryption scheme. */
-typedef CK_ULONG CK_RSA_PKCS_OAEP_SOURCE_TYPE;
-
-typedef CK_RSA_PKCS_OAEP_SOURCE_TYPE CK_PTR CK_RSA_PKCS_OAEP_SOURCE_TYPE_PTR;
-
-/* The following encoding parameter sources are defined */
-#define CKZ_DATA_SPECIFIED    0x00000001
-
-/* CK_RSA_PKCS_OAEP_PARAMS is new for v2.10.
- * CK_RSA_PKCS_OAEP_PARAMS provides the parameters to the
- * CKM_RSA_PKCS_OAEP mechanism. */
-typedef struct CK_RSA_PKCS_OAEP_PARAMS {
-        CK_MECHANISM_TYPE hashAlg;
-        CK_RSA_PKCS_MGF_TYPE mgf;
-        CK_RSA_PKCS_OAEP_SOURCE_TYPE source;
-        CK_VOID_PTR pSourceData;
-        CK_ULONG ulSourceDataLen;
-} CK_RSA_PKCS_OAEP_PARAMS;
-
-typedef CK_RSA_PKCS_OAEP_PARAMS CK_PTR CK_RSA_PKCS_OAEP_PARAMS_PTR;
-
-/* CK_RSA_PKCS_PSS_PARAMS is new for v2.11.
- * CK_RSA_PKCS_PSS_PARAMS provides the parameters to the
- * CKM_RSA_PKCS_PSS mechanism(s). */
-typedef struct CK_RSA_PKCS_PSS_PARAMS {
-        CK_MECHANISM_TYPE    hashAlg;
-        CK_RSA_PKCS_MGF_TYPE mgf;
-        CK_ULONG             sLen;
-} CK_RSA_PKCS_PSS_PARAMS;
-
-typedef CK_RSA_PKCS_PSS_PARAMS CK_PTR CK_RSA_PKCS_PSS_PARAMS_PTR;
-
-/* CK_EC_KDF_TYPE is new for v2.11. */
-typedef CK_ULONG CK_EC_KDF_TYPE;
-
-/* The following EC Key Derivation Functions are defined */
-#define CKD_NULL                 0x00000001
-#define CKD_SHA1_KDF             0x00000002
-
-/* CK_ECDH1_DERIVE_PARAMS is new for v2.11.
- * CK_ECDH1_DERIVE_PARAMS provides the parameters to the
- * CKM_ECDH1_DERIVE and CKM_ECDH1_COFACTOR_DERIVE mechanisms,
- * where each party contributes one key pair.
- */
-typedef struct CK_ECDH1_DERIVE_PARAMS {
-  CK_EC_KDF_TYPE kdf;
-  CK_ULONG ulSharedDataLen;
-  CK_BYTE_PTR pSharedData;
-  CK_ULONG ulPublicDataLen;
-  CK_BYTE_PTR pPublicData;
-} CK_ECDH1_DERIVE_PARAMS;
-
-typedef CK_ECDH1_DERIVE_PARAMS CK_PTR CK_ECDH1_DERIVE_PARAMS_PTR;
-
-
-/* CK_ECDH2_DERIVE_PARAMS is new for v2.11.
- * CK_ECDH2_DERIVE_PARAMS provides the parameters to the
- * CKM_ECMQV_DERIVE mechanism, where each party contributes two key pairs. */
-typedef struct CK_ECDH2_DERIVE_PARAMS {
-  CK_EC_KDF_TYPE kdf;
-  CK_ULONG ulSharedDataLen;
-  CK_BYTE_PTR pSharedData;
-  CK_ULONG ulPublicDataLen;
-  CK_BYTE_PTR pPublicData;
-  CK_ULONG ulPrivateDataLen;
-  CK_OBJECT_HANDLE hPrivateData;
-  CK_ULONG ulPublicDataLen2;
-  CK_BYTE_PTR pPublicData2;
-} CK_ECDH2_DERIVE_PARAMS;
-
-typedef CK_ECDH2_DERIVE_PARAMS CK_PTR CK_ECDH2_DERIVE_PARAMS_PTR;
-
-typedef struct CK_ECMQV_DERIVE_PARAMS {
-  CK_EC_KDF_TYPE kdf;
-  CK_ULONG ulSharedDataLen;
-  CK_BYTE_PTR pSharedData;
-  CK_ULONG ulPublicDataLen;
-  CK_BYTE_PTR pPublicData;
-  CK_ULONG ulPrivateDataLen;
-  CK_OBJECT_HANDLE hPrivateData;
-  CK_ULONG ulPublicDataLen2;
-  CK_BYTE_PTR pPublicData2;
-  CK_OBJECT_HANDLE publicKey;
-} CK_ECMQV_DERIVE_PARAMS;
-
-typedef CK_ECMQV_DERIVE_PARAMS CK_PTR CK_ECMQV_DERIVE_PARAMS_PTR;
-
-/* Typedefs and defines for the CKM_X9_42_DH_KEY_PAIR_GEN and the
- * CKM_X9_42_DH_PARAMETER_GEN mechanisms (new for PKCS #11 v2.11) */
-typedef CK_ULONG CK_X9_42_DH_KDF_TYPE;
-typedef CK_X9_42_DH_KDF_TYPE CK_PTR CK_X9_42_DH_KDF_TYPE_PTR;
-
-/* The following X9.42 DH key derivation functions are defined
-   (besides CKD_NULL already defined : */
-#define CKD_SHA1_KDF_ASN1        0x00000003
-#define CKD_SHA1_KDF_CONCATENATE 0x00000004
-
-/* CK_X9_42_DH1_DERIVE_PARAMS is new for v2.11.
- * CK_X9_42_DH1_DERIVE_PARAMS provides the parameters to the
- * CKM_X9_42_DH_DERIVE key derivation mechanism, where each party
- * contributes one key pair */
-typedef struct CK_X9_42_DH1_DERIVE_PARAMS {
-  CK_X9_42_DH_KDF_TYPE kdf;
-  CK_ULONG ulOtherInfoLen;
-  CK_BYTE_PTR pOtherInfo;
-  CK_ULONG ulPublicDataLen;
-  CK_BYTE_PTR pPublicData;
-} CK_X9_42_DH1_DERIVE_PARAMS;
-
-typedef struct CK_X9_42_DH1_DERIVE_PARAMS CK_PTR CK_X9_42_DH1_DERIVE_PARAMS_PTR;
-
-/* CK_X9_42_DH2_DERIVE_PARAMS is new for v2.11.
- * CK_X9_42_DH2_DERIVE_PARAMS provides the parameters to the
- * CKM_X9_42_DH_HYBRID_DERIVE and CKM_X9_42_MQV_DERIVE key derivation
- * mechanisms, where each party contributes two key pairs */
-typedef struct CK_X9_42_DH2_DERIVE_PARAMS {
-  CK_X9_42_DH_KDF_TYPE kdf;
-  CK_ULONG ulOtherInfoLen;
-  CK_BYTE_PTR pOtherInfo;
-  CK_ULONG ulPublicDataLen;
-  CK_BYTE_PTR pPublicData;
-  CK_ULONG ulPrivateDataLen;
-  CK_OBJECT_HANDLE hPrivateData;
-  CK_ULONG ulPublicDataLen2;
-  CK_BYTE_PTR pPublicData2;
-} CK_X9_42_DH2_DERIVE_PARAMS;
-
-typedef CK_X9_42_DH2_DERIVE_PARAMS CK_PTR CK_X9_42_DH2_DERIVE_PARAMS_PTR;
-
-typedef struct CK_X9_42_MQV_DERIVE_PARAMS {
-  CK_X9_42_DH_KDF_TYPE kdf;
-  CK_ULONG ulOtherInfoLen;
-  CK_BYTE_PTR pOtherInfo;
-  CK_ULONG ulPublicDataLen;
-  CK_BYTE_PTR pPublicData;
-  CK_ULONG ulPrivateDataLen;
-  CK_OBJECT_HANDLE hPrivateData;
-  CK_ULONG ulPublicDataLen2;
-  CK_BYTE_PTR pPublicData2;
-  CK_OBJECT_HANDLE publicKey;
-} CK_X9_42_MQV_DERIVE_PARAMS;
-
-typedef CK_X9_42_MQV_DERIVE_PARAMS CK_PTR CK_X9_42_MQV_DERIVE_PARAMS_PTR;
-
-/* CK_KEA_DERIVE_PARAMS provides the parameters to the
- * CKM_KEA_DERIVE mechanism */
-/* CK_KEA_DERIVE_PARAMS is new for v2.0 */
-typedef struct CK_KEA_DERIVE_PARAMS {
-  CK_BBOOL      isSender;
-  CK_ULONG      ulRandomLen;
-  CK_BYTE_PTR   pRandomA;
-  CK_BYTE_PTR   pRandomB;
-  CK_ULONG      ulPublicDataLen;
-  CK_BYTE_PTR   pPublicData;
-} CK_KEA_DERIVE_PARAMS;
-
-typedef CK_KEA_DERIVE_PARAMS CK_PTR CK_KEA_DERIVE_PARAMS_PTR;
-
-
-/* CK_RC2_PARAMS provides the parameters to the CKM_RC2_ECB and
- * CKM_RC2_MAC mechanisms.  An instance of CK_RC2_PARAMS just
- * holds the effective keysize */
-typedef CK_ULONG          CK_RC2_PARAMS;
-
-typedef CK_RC2_PARAMS CK_PTR CK_RC2_PARAMS_PTR;
-
-
-/* CK_RC2_CBC_PARAMS provides the parameters to the CKM_RC2_CBC
- * mechanism */
-typedef struct CK_RC2_CBC_PARAMS {
-  /* ulEffectiveBits was changed from CK_USHORT to CK_ULONG for
-   * v2.0 */
-  CK_ULONG      ulEffectiveBits;  /* effective bits (1-1024) */
-
-  CK_BYTE       iv[8];            /* IV for CBC mode */
-} CK_RC2_CBC_PARAMS;
-
-typedef CK_RC2_CBC_PARAMS CK_PTR CK_RC2_CBC_PARAMS_PTR;
-
-
-/* CK_RC2_MAC_GENERAL_PARAMS provides the parameters for the
- * CKM_RC2_MAC_GENERAL mechanism */
-/* CK_RC2_MAC_GENERAL_PARAMS is new for v2.0 */
-typedef struct CK_RC2_MAC_GENERAL_PARAMS {
-  CK_ULONG      ulEffectiveBits;  /* effective bits (1-1024) */
-  CK_ULONG      ulMacLength;      /* Length of MAC in bytes */
-} CK_RC2_MAC_GENERAL_PARAMS;
-
-typedef CK_RC2_MAC_GENERAL_PARAMS CK_PTR \
-  CK_RC2_MAC_GENERAL_PARAMS_PTR;
-
-
-/* CK_RC5_PARAMS provides the parameters to the CKM_RC5_ECB and
- * CKM_RC5_MAC mechanisms */
-/* CK_RC5_PARAMS is new for v2.0 */
-typedef struct CK_RC5_PARAMS {
-  CK_ULONG      ulWordsize;  /* wordsize in bits */
-  CK_ULONG      ulRounds;    /* number of rounds */
-} CK_RC5_PARAMS;
-
-typedef CK_RC5_PARAMS CK_PTR CK_RC5_PARAMS_PTR;
-
-
-/* CK_RC5_CBC_PARAMS provides the parameters to the CKM_RC5_CBC
- * mechanism */
-/* CK_RC5_CBC_PARAMS is new for v2.0 */
-typedef struct CK_RC5_CBC_PARAMS {
-  CK_ULONG      ulWordsize;  /* wordsize in bits */
-  CK_ULONG      ulRounds;    /* number of rounds */
-  CK_BYTE_PTR   pIv;         /* pointer to IV */
-  CK_ULONG      ulIvLen;     /* length of IV in bytes */
-} CK_RC5_CBC_PARAMS;
-
-typedef CK_RC5_CBC_PARAMS CK_PTR CK_RC5_CBC_PARAMS_PTR;
-
-
-/* CK_RC5_MAC_GENERAL_PARAMS provides the parameters for the
- * CKM_RC5_MAC_GENERAL mechanism */
-/* CK_RC5_MAC_GENERAL_PARAMS is new for v2.0 */
-typedef struct CK_RC5_MAC_GENERAL_PARAMS {
-  CK_ULONG      ulWordsize;   /* wordsize in bits */
-  CK_ULONG      ulRounds;     /* number of rounds */
-  CK_ULONG      ulMacLength;  /* Length of MAC in bytes */
-} CK_RC5_MAC_GENERAL_PARAMS;
-
-typedef CK_RC5_MAC_GENERAL_PARAMS CK_PTR \
-  CK_RC5_MAC_GENERAL_PARAMS_PTR;
-
-
-/* CK_MAC_GENERAL_PARAMS provides the parameters to most block
- * ciphers' MAC_GENERAL mechanisms.  Its value is the length of
- * the MAC */
-/* CK_MAC_GENERAL_PARAMS is new for v2.0 */
-typedef CK_ULONG          CK_MAC_GENERAL_PARAMS;
-
-typedef CK_MAC_GENERAL_PARAMS CK_PTR CK_MAC_GENERAL_PARAMS_PTR;
-
-/* CK_DES/AES_ECB/CBC_ENCRYPT_DATA_PARAMS are new for v2.20 */
-typedef struct CK_DES_CBC_ENCRYPT_DATA_PARAMS {
-  CK_BYTE      iv[8];
-  CK_BYTE_PTR  pData;
-  CK_ULONG     length;
-} CK_DES_CBC_ENCRYPT_DATA_PARAMS;
-
-typedef CK_DES_CBC_ENCRYPT_DATA_PARAMS CK_PTR CK_DES_CBC_ENCRYPT_DATA_PARAMS_PTR;
-
-typedef struct CK_AES_CBC_ENCRYPT_DATA_PARAMS {
-  CK_BYTE      iv[16];
-  CK_BYTE_PTR  pData;
-  CK_ULONG     length;
-} CK_AES_CBC_ENCRYPT_DATA_PARAMS;
-
-typedef CK_AES_CBC_ENCRYPT_DATA_PARAMS CK_PTR CK_AES_CBC_ENCRYPT_DATA_PARAMS_PTR;
-
-/* CK_SKIPJACK_PRIVATE_WRAP_PARAMS provides the parameters to the
- * CKM_SKIPJACK_PRIVATE_WRAP mechanism */
-/* CK_SKIPJACK_PRIVATE_WRAP_PARAMS is new for v2.0 */
-typedef struct CK_SKIPJACK_PRIVATE_WRAP_PARAMS {
-  CK_ULONG      ulPasswordLen;
-  CK_BYTE_PTR   pPassword;
-  CK_ULONG      ulPublicDataLen;
-  CK_BYTE_PTR   pPublicData;
-  CK_ULONG      ulPAndGLen;
-  CK_ULONG      ulQLen;
-  CK_ULONG      ulRandomLen;
-  CK_BYTE_PTR   pRandomA;
-  CK_BYTE_PTR   pPrimeP;
-  CK_BYTE_PTR   pBaseG;
-  CK_BYTE_PTR   pSubprimeQ;
-} CK_SKIPJACK_PRIVATE_WRAP_PARAMS;
-
-typedef CK_SKIPJACK_PRIVATE_WRAP_PARAMS CK_PTR \
-  CK_SKIPJACK_PRIVATE_WRAP_PTR;
-
-
-/* CK_SKIPJACK_RELAYX_PARAMS provides the parameters to the
- * CKM_SKIPJACK_RELAYX mechanism */
-/* CK_SKIPJACK_RELAYX_PARAMS is new for v2.0 */
-typedef struct CK_SKIPJACK_RELAYX_PARAMS {
-  CK_ULONG      ulOldWrappedXLen;
-  CK_BYTE_PTR   pOldWrappedX;
-  CK_ULONG      ulOldPasswordLen;
-  CK_BYTE_PTR   pOldPassword;
-  CK_ULONG      ulOldPublicDataLen;
-  CK_BYTE_PTR   pOldPublicData;
-  CK_ULONG      ulOldRandomLen;
-  CK_BYTE_PTR   pOldRandomA;
-  CK_ULONG      ulNewPasswordLen;
-  CK_BYTE_PTR   pNewPassword;
-  CK_ULONG      ulNewPublicDataLen;
-  CK_BYTE_PTR   pNewPublicData;
-  CK_ULONG      ulNewRandomLen;
-  CK_BYTE_PTR   pNewRandomA;
-} CK_SKIPJACK_RELAYX_PARAMS;
-
-typedef CK_SKIPJACK_RELAYX_PARAMS CK_PTR \
-  CK_SKIPJACK_RELAYX_PARAMS_PTR;
-
-
-typedef struct CK_PBE_PARAMS {
-  CK_BYTE_PTR      pInitVector;
-  CK_UTF8CHAR_PTR  pPassword;
-  CK_ULONG         ulPasswordLen;
-  CK_BYTE_PTR      pSalt;
-  CK_ULONG         ulSaltLen;
-  CK_ULONG         ulIteration;
-} CK_PBE_PARAMS;
-
-typedef CK_PBE_PARAMS CK_PTR CK_PBE_PARAMS_PTR;
-
-
-/* CK_KEY_WRAP_SET_OAEP_PARAMS provides the parameters to the
- * CKM_KEY_WRAP_SET_OAEP mechanism */
-/* CK_KEY_WRAP_SET_OAEP_PARAMS is new for v2.0 */
-typedef struct CK_KEY_WRAP_SET_OAEP_PARAMS {
-  CK_BYTE       bBC;     /* block contents byte */
-  CK_BYTE_PTR   pX;      /* extra data */
-  CK_ULONG      ulXLen;  /* length of extra data in bytes */
-} CK_KEY_WRAP_SET_OAEP_PARAMS;
-
-typedef CK_KEY_WRAP_SET_OAEP_PARAMS CK_PTR \
-  CK_KEY_WRAP_SET_OAEP_PARAMS_PTR;
-
-
-typedef struct CK_SSL3_RANDOM_DATA {
-  CK_BYTE_PTR  pClientRandom;
-  CK_ULONG     ulClientRandomLen;
-  CK_BYTE_PTR  pServerRandom;
-  CK_ULONG     ulServerRandomLen;
-} CK_SSL3_RANDOM_DATA;
-
-
-typedef struct CK_SSL3_MASTER_KEY_DERIVE_PARAMS {
-  CK_SSL3_RANDOM_DATA RandomInfo;
-  CK_VERSION_PTR pVersion;
-} CK_SSL3_MASTER_KEY_DERIVE_PARAMS;
-
-typedef struct CK_SSL3_MASTER_KEY_DERIVE_PARAMS CK_PTR \
-  CK_SSL3_MASTER_KEY_DERIVE_PARAMS_PTR;
-
-
-typedef struct CK_SSL3_KEY_MAT_OUT {
-  CK_OBJECT_HANDLE hClientMacSecret;
-  CK_OBJECT_HANDLE hServerMacSecret;
-  CK_OBJECT_HANDLE hClientKey;
-  CK_OBJECT_HANDLE hServerKey;
-  CK_BYTE_PTR      pIVClient;
-  CK_BYTE_PTR      pIVServer;
-} CK_SSL3_KEY_MAT_OUT;
-
-typedef CK_SSL3_KEY_MAT_OUT CK_PTR CK_SSL3_KEY_MAT_OUT_PTR;
-
-
-typedef struct CK_SSL3_KEY_MAT_PARAMS {
-  CK_ULONG                ulMacSizeInBits;
-  CK_ULONG                ulKeySizeInBits;
-  CK_ULONG                ulIVSizeInBits;
-  CK_BBOOL                bIsExport;
-  CK_SSL3_RANDOM_DATA     RandomInfo;
-  CK_SSL3_KEY_MAT_OUT_PTR pReturnedKeyMaterial;
-} CK_SSL3_KEY_MAT_PARAMS;
-
-typedef CK_SSL3_KEY_MAT_PARAMS CK_PTR CK_SSL3_KEY_MAT_PARAMS_PTR;
-
-/* CK_TLS_PRF_PARAMS is new for version 2.20 */
-typedef struct CK_TLS_PRF_PARAMS {
-  CK_BYTE_PTR  pSeed;
-  CK_ULONG     ulSeedLen;
-  CK_BYTE_PTR  pLabel;
-  CK_ULONG     ulLabelLen;
-  CK_BYTE_PTR  pOutput;
-  CK_ULONG_PTR pulOutputLen;
-} CK_TLS_PRF_PARAMS;
-
-typedef CK_TLS_PRF_PARAMS CK_PTR CK_TLS_PRF_PARAMS_PTR;
-
-/* WTLS is new for version 2.20 */
-typedef struct CK_WTLS_RANDOM_DATA {
-  CK_BYTE_PTR pClientRandom;
-  CK_ULONG    ulClientRandomLen;
-  CK_BYTE_PTR pServerRandom;
-  CK_ULONG    ulServerRandomLen;
-} CK_WTLS_RANDOM_DATA;
-
-typedef CK_WTLS_RANDOM_DATA CK_PTR CK_WTLS_RANDOM_DATA_PTR;
-
-typedef struct CK_WTLS_MASTER_KEY_DERIVE_PARAMS {
-  CK_MECHANISM_TYPE   DigestMechanism;
-  CK_WTLS_RANDOM_DATA RandomInfo;
-  CK_BYTE_PTR         pVersion;
-} CK_WTLS_MASTER_KEY_DERIVE_PARAMS;
-
-typedef CK_WTLS_MASTER_KEY_DERIVE_PARAMS CK_PTR \
-  CK_WTLS_MASTER_KEY_DERIVE_PARAMS_PTR;
-
-typedef struct CK_WTLS_PRF_PARAMS {
-  CK_MECHANISM_TYPE DigestMechanism;
-  CK_BYTE_PTR       pSeed;
-  CK_ULONG          ulSeedLen;
-  CK_BYTE_PTR       pLabel;
-  CK_ULONG          ulLabelLen;
-  CK_BYTE_PTR       pOutput;
-  CK_ULONG_PTR      pulOutputLen;
-} CK_WTLS_PRF_PARAMS;
-
-typedef CK_WTLS_PRF_PARAMS CK_PTR CK_WTLS_PRF_PARAMS_PTR;
-
-typedef struct CK_WTLS_KEY_MAT_OUT {
-  CK_OBJECT_HANDLE hMacSecret;
-  CK_OBJECT_HANDLE hKey;
-  CK_BYTE_PTR      pIV;
-} CK_WTLS_KEY_MAT_OUT;
-
-typedef CK_WTLS_KEY_MAT_OUT CK_PTR CK_WTLS_KEY_MAT_OUT_PTR;
-
-typedef struct CK_WTLS_KEY_MAT_PARAMS {
-  CK_MECHANISM_TYPE       DigestMechanism;
-  CK_ULONG                ulMacSizeInBits;
-  CK_ULONG                ulKeySizeInBits;
-  CK_ULONG                ulIVSizeInBits;
-  CK_ULONG                ulSequenceNumber;
-  CK_BBOOL                bIsExport;
-  CK_WTLS_RANDOM_DATA     RandomInfo;
-  CK_WTLS_KEY_MAT_OUT_PTR pReturnedKeyMaterial;
-} CK_WTLS_KEY_MAT_PARAMS;
-
-typedef CK_WTLS_KEY_MAT_PARAMS CK_PTR CK_WTLS_KEY_MAT_PARAMS_PTR;
-
-/* CMS is new for version 2.20 */
-typedef struct CK_CMS_SIG_PARAMS {
-  CK_OBJECT_HANDLE      certificateHandle;
-  CK_MECHANISM_PTR      pSigningMechanism;
-  CK_MECHANISM_PTR      pDigestMechanism;
-  CK_UTF8CHAR_PTR       pContentType;
-  CK_BYTE_PTR           pRequestedAttributes;
-  CK_ULONG              ulRequestedAttributesLen;
-  CK_BYTE_PTR           pRequiredAttributes;
-  CK_ULONG              ulRequiredAttributesLen;
-} CK_CMS_SIG_PARAMS;
-
-typedef CK_CMS_SIG_PARAMS CK_PTR CK_CMS_SIG_PARAMS_PTR;
-
-typedef struct CK_KEY_DERIVATION_STRING_DATA {
-  CK_BYTE_PTR pData;
-  CK_ULONG    ulLen;
-} CK_KEY_DERIVATION_STRING_DATA;
-
-typedef CK_KEY_DERIVATION_STRING_DATA CK_PTR \
-  CK_KEY_DERIVATION_STRING_DATA_PTR;
-
-
-/* The CK_EXTRACT_PARAMS is used for the
- * CKM_EXTRACT_KEY_FROM_KEY mechanism.  It specifies which bit
- * of the base key should be used as the first bit of the
- * derived key */
-/* CK_EXTRACT_PARAMS is new for v2.0 */
-typedef CK_ULONG CK_EXTRACT_PARAMS;
-
-typedef CK_EXTRACT_PARAMS CK_PTR CK_EXTRACT_PARAMS_PTR;
-
-/* CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE is new for v2.10.
- * CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE is used to
- * indicate the Pseudo-Random Function (PRF) used to generate
- * key bits using PKCS #5 PBKDF2. */
-typedef CK_ULONG CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE;
-
-typedef CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE CK_PTR CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE_PTR;
-
-/* The following PRFs are defined in PKCS #5 v2.0. */
-#define CKP_PKCS5_PBKD2_HMAC_SHA1 0x00000001
-
-
-/* CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE is new for v2.10.
- * CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE is used to indicate the
- * source of the salt value when deriving a key using PKCS #5
- * PBKDF2. */
-typedef CK_ULONG CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE;
-
-typedef CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE CK_PTR CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE_PTR;
-
-/* The following salt value sources are defined in PKCS #5 v2.0. */
-#define CKZ_SALT_SPECIFIED        0x00000001
-
-/* CK_PKCS5_PBKD2_PARAMS is new for v2.10.
- * CK_PKCS5_PBKD2_PARAMS is a structure that provides the
- * parameters to the CKM_PKCS5_PBKD2 mechanism. */
-typedef struct CK_PKCS5_PBKD2_PARAMS {
-        CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE           saltSource;
-        CK_VOID_PTR                                pSaltSourceData;
-        CK_ULONG                                   ulSaltSourceDataLen;
-        CK_ULONG                                   iterations;
-        CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE prf;
-        CK_VOID_PTR                                pPrfData;
-        CK_ULONG                                   ulPrfDataLen;
-        CK_UTF8CHAR_PTR                            pPassword;
-        CK_ULONG_PTR                               ulPasswordLen;
-} CK_PKCS5_PBKD2_PARAMS;
-
-typedef CK_PKCS5_PBKD2_PARAMS CK_PTR CK_PKCS5_PBKD2_PARAMS_PTR;
-
-/* All CK_OTP structs are new for PKCS #11 v2.20 amendment 3 */
-
-typedef CK_ULONG CK_OTP_PARAM_TYPE;
-typedef CK_OTP_PARAM_TYPE CK_PARAM_TYPE; /* B/w compatibility */
-
-typedef struct CK_OTP_PARAM {
-    CK_OTP_PARAM_TYPE type;
-    CK_VOID_PTR pValue;
-    CK_ULONG ulValueLen;
-} CK_OTP_PARAM;
-
-typedef CK_OTP_PARAM CK_PTR CK_OTP_PARAM_PTR;
-
-typedef struct CK_OTP_PARAMS {
-    CK_OTP_PARAM_PTR pParams;
-    CK_ULONG ulCount;
-} CK_OTP_PARAMS;
-
-typedef CK_OTP_PARAMS CK_PTR CK_OTP_PARAMS_PTR;
-
-typedef struct CK_OTP_SIGNATURE_INFO {
-    CK_OTP_PARAM_PTR pParams;
-    CK_ULONG ulCount;
-} CK_OTP_SIGNATURE_INFO;
-
-typedef CK_OTP_SIGNATURE_INFO CK_PTR CK_OTP_SIGNATURE_INFO_PTR;
-
-/* The following OTP-related defines are new for PKCS #11 v2.20 amendment 1 */
-#define CK_OTP_VALUE          0
-#define CK_OTP_PIN            1
-#define CK_OTP_CHALLENGE      2
-#define CK_OTP_TIME           3
-#define CK_OTP_COUNTER        4
-#define CK_OTP_FLAGS          5
-#define CK_OTP_OUTPUT_LENGTH  6
-#define CK_OTP_OUTPUT_FORMAT  7
-
-/* The following OTP-related defines are new for PKCS #11 v2.20 amendment 1 */
-#define CKF_NEXT_OTP          0x00000001
-#define CKF_EXCLUDE_TIME      0x00000002
-#define CKF_EXCLUDE_COUNTER   0x00000004
-#define CKF_EXCLUDE_CHALLENGE 0x00000008
-#define CKF_EXCLUDE_PIN       0x00000010
-#define CKF_USER_FRIENDLY_OTP 0x00000020
-
-/* CK_KIP_PARAMS is new for PKCS #11 v2.20 amendment 2 */
-typedef struct CK_KIP_PARAMS {
-    CK_MECHANISM_PTR  pMechanism;
-    CK_OBJECT_HANDLE  hKey;
-    CK_BYTE_PTR       pSeed;
-    CK_ULONG          ulSeedLen;
-} CK_KIP_PARAMS;
-
-typedef CK_KIP_PARAMS CK_PTR CK_KIP_PARAMS_PTR;
-
-/* CK_AES_CTR_PARAMS is new for PKCS #11 v2.20 amendment 3 */
-typedef struct CK_AES_CTR_PARAMS {
-    CK_ULONG ulCounterBits;
-    CK_BYTE cb[16];
-} CK_AES_CTR_PARAMS;
-
-typedef CK_AES_CTR_PARAMS CK_PTR CK_AES_CTR_PARAMS_PTR;
-
-/* CK_CAMELLIA_CTR_PARAMS is new for PKCS #11 v2.20 amendment 3 */
-typedef struct CK_CAMELLIA_CTR_PARAMS {
-    CK_ULONG ulCounterBits;
-    CK_BYTE cb[16];
-} CK_CAMELLIA_CTR_PARAMS;
-
-typedef CK_CAMELLIA_CTR_PARAMS CK_PTR CK_CAMELLIA_CTR_PARAMS_PTR;
-
-/* CK_CAMELLIA_CBC_ENCRYPT_DATA_PARAMS is new for PKCS #11 v2.20 amendment 3 */
-typedef struct CK_CAMELLIA_CBC_ENCRYPT_DATA_PARAMS {
-    CK_BYTE      iv[16];
-    CK_BYTE_PTR  pData;
-    CK_ULONG     length;
-} CK_CAMELLIA_CBC_ENCRYPT_DATA_PARAMS;
-
-typedef CK_CAMELLIA_CBC_ENCRYPT_DATA_PARAMS CK_PTR CK_CAMELLIA_CBC_ENCRYPT_DATA_PARAMS_PTR;
-
-/* CK_ARIA_CBC_ENCRYPT_DATA_PARAMS is new for PKCS #11 v2.20 amendment 3 */
-typedef struct CK_ARIA_CBC_ENCRYPT_DATA_PARAMS {
-    CK_BYTE      iv[16];
-    CK_BYTE_PTR  pData;
-    CK_ULONG     length;
-} CK_ARIA_CBC_ENCRYPT_DATA_PARAMS;
-
-typedef CK_ARIA_CBC_ENCRYPT_DATA_PARAMS CK_PTR CK_ARIA_CBC_ENCRYPT_DATA_PARAMS_PTR;
-
-#endif
diff --git a/components/engine/vendor/github.com/miekg/pkcs11/types.go b/components/engine/vendor/github.com/miekg/pkcs11/types.go
deleted file mode 100644
index e789bf1560..0000000000
--- a/components/engine/vendor/github.com/miekg/pkcs11/types.go
+++ /dev/null
@@ -1,267 +0,0 @@
-// Copyright 2013 Miek Gieben. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package pkcs11
-
-/*
-#define CK_PTR *
-#ifndef NULL_PTR
-#define NULL_PTR 0
-#endif
-#define CK_DEFINE_FUNCTION(returnType, name) returnType name
-#define CK_DECLARE_FUNCTION(returnType, name) returnType name
-#define CK_DECLARE_FUNCTION_POINTER(returnType, name) returnType (* name)
-#define CK_CALLBACK_FUNCTION(returnType, name) returnType (* name)
-
-#include <stdlib.h>
-#include <string.h>
-#include "pkcs11.h"
-
-CK_ULONG Index(CK_ULONG_PTR array, CK_ULONG i)
-{
-	return array[i];
-}
-*/
-import "C"
-
-import (
-	"fmt"
-	"time"
-	"unsafe"
-)
-
-type arena []unsafe.Pointer
-
-func (a *arena) Allocate(obj []byte) (C.CK_VOID_PTR, C.CK_ULONG) {
-	cobj := C.calloc(C.size_t(len(obj)), 1)
-	*a = append(*a, cobj)
-	C.memmove(cobj, unsafe.Pointer(&obj[0]), C.size_t(len(obj)))
-	return C.CK_VOID_PTR(cobj), C.CK_ULONG(len(obj))
-}
-
-func (a arena) Free() {
-	for _, p := range a {
-		C.free(p)
-	}
-}
-
-// toList converts from a C style array to a []uint.
-func toList(clist C.CK_ULONG_PTR, size C.CK_ULONG) []uint {
-	l := make([]uint, int(size))
-	for i := 0; i < len(l); i++ {
-		l[i] = uint(C.Index(clist, C.CK_ULONG(i)))
-	}
-	defer C.free(unsafe.Pointer(clist))
-	return l
-}
-
-// cBBool converts a bool to a CK_BBOOL.
-func cBBool(x bool) C.CK_BBOOL {
-	if x {
-		return C.CK_BBOOL(C.CK_TRUE)
-	}
-	return C.CK_BBOOL(C.CK_FALSE)
-}
-
-func uintToBytes(x uint64) []byte {
-	ul := C.CK_ULONG(x)
-	return C.GoBytes(unsafe.Pointer(&ul), C.int(unsafe.Sizeof(ul)))
-}
-
-// Error represents an PKCS#11 error.
-type Error uint
-
-func (e Error) Error() string {
-	return fmt.Sprintf("pkcs11: 0x%X: %s", uint(e), strerror[uint(e)])
-}
-
-func toError(e C.CK_RV) error {
-	if e == C.CKR_OK {
-		return nil
-	}
-	return Error(e)
-}
-
-/* SessionHandle is a Cryptoki-assigned value that identifies a session. */
-type SessionHandle uint
-
-/* ObjectHandle is a token-specific identifier for an object.  */
-type ObjectHandle uint
-
-// Version represents any version information from the library.
-type Version struct {
-	Major byte
-	Minor byte
-}
-
-func toVersion(version C.CK_VERSION) Version {
-	return Version{byte(version.major), byte(version.minor)}
-}
-
-// SlotEvent holds the SlotID which for which an slot event (token insertion,
-// removal, etc.) occurred.
-type SlotEvent struct {
-	SlotID uint
-}
-
-// Info provides information about the library and hardware used.
-type Info struct {
-	CryptokiVersion    Version
-	ManufacturerID     string
-	Flags              uint
-	LibraryDescription string
-	LibraryVersion     Version
-}
-
-/* SlotInfo provides information about a slot. */
-type SlotInfo struct {
-	SlotDescription string // 64 bytes.
-	ManufacturerID  string // 32 bytes.
-	Flags           uint
-	HardwareVersion Version
-	FirmwareVersion Version
-}
-
-/* TokenInfo provides information about a token. */
-type TokenInfo struct {
-	Label              string
-	ManufacturerID     string
-	Model              string
-	SerialNumber       string
-	Flags              uint
-	MaxSessionCount    uint
-	SessionCount       uint
-	MaxRwSessionCount  uint
-	RwSessionCount     uint
-	MaxPinLen          uint
-	MinPinLen          uint
-	TotalPublicMemory  uint
-	FreePublicMemory   uint
-	TotalPrivateMemory uint
-	FreePrivateMemory  uint
-	HardwareVersion    Version
-	FirmwareVersion    Version
-	UTCTime            string
-}
-
-/* SesionInfo provides information about a session. */
-type SessionInfo struct {
-	SlotID      uint
-	State       uint
-	Flags       uint
-	DeviceError uint
-}
-
-// Attribute holds an attribute type/value combination.
-type Attribute struct {
-	Type  uint
-	Value []byte
-}
-
-// NewAttribute allocates a Attribute and returns a pointer to it.
-// Note that this is merely a convience function, as values returned
-// from the HSM are not converted back to Go values, those are just raw
-// byte slices.
-func NewAttribute(typ uint, x interface{}) *Attribute {
-	// This function nicely transforms *to* an attribute, but there is
-	// no corresponding function that transform back *from* an attribute,
-	// which in PKCS#11 is just an byte array.
-	a := new(Attribute)
-	a.Type = typ
-	if x == nil {
-		return a
-	}
-	switch v := x.(type) {
-	case bool:
-		if v {
-			a.Value = []byte{1}
-		} else {
-			a.Value = []byte{0}
-		}
-	case int:
-		a.Value = uintToBytes(uint64(v))
-	case uint:
-		a.Value = uintToBytes(uint64(v))
-	case string:
-		a.Value = []byte(v)
-	case []byte:
-		a.Value = v
-	case time.Time: // for CKA_DATE
-		a.Value = cDate(v)
-	default:
-		panic("pkcs11: unhandled attribute type")
-	}
-	return a
-}
-
-// cAttribute returns the start address and the length of an attribute list.
-func cAttributeList(a []*Attribute) (arena, C.CK_ATTRIBUTE_PTR, C.CK_ULONG) {
-	var arena arena
-	if len(a) == 0 {
-		return nil, nil, 0
-	}
-	pa := make([]C.CK_ATTRIBUTE, len(a))
-	for i := 0; i < len(a); i++ {
-		pa[i]._type = C.CK_ATTRIBUTE_TYPE(a[i].Type)
-		if a[i].Value == nil {
-			continue
-		}
-		pa[i].pValue, pa[i].ulValueLen = arena.Allocate(a[i].Value)
-	}
-	return arena, C.CK_ATTRIBUTE_PTR(&pa[0]), C.CK_ULONG(len(a))
-}
-
-func cDate(t time.Time) []byte {
-	b := make([]byte, 8)
-	year, month, day := t.Date()
-	y := fmt.Sprintf("%4d", year)
-	m := fmt.Sprintf("%02d", month)
-	d1 := fmt.Sprintf("%02d", day)
-	b[0], b[1], b[2], b[3] = y[0], y[1], y[2], y[3]
-	b[4], b[5] = m[0], m[1]
-	b[6], b[7] = d1[0], d1[1]
-	return b
-}
-
-// Mechanism holds an mechanism type/value combination.
-type Mechanism struct {
-	Mechanism uint
-	Parameter []byte
-}
-
-func NewMechanism(mech uint, x interface{}) *Mechanism {
-	m := new(Mechanism)
-	m.Mechanism = mech
-	if x == nil {
-		return m
-	}
-
-	// Add any parameters passed (For now presume always bytes were passed in, is there another case?)
-	m.Parameter = x.([]byte)
-
-	return m
-}
-
-func cMechanismList(m []*Mechanism) (arena, C.CK_MECHANISM_PTR, C.CK_ULONG) {
-	var arena arena
-	if len(m) == 0 {
-		return nil, nil, 0
-	}
-	pm := make([]C.CK_MECHANISM, len(m))
-	for i := 0; i < len(m); i++ {
-		pm[i].mechanism = C.CK_MECHANISM_TYPE(m[i].Mechanism)
-		if m[i].Parameter == nil {
-			continue
-		}
-		pm[i].pParameter, pm[i].ulParameterLen = arena.Allocate(m[i].Parameter)
-	}
-	return arena, C.CK_MECHANISM_PTR(&pm[0]), C.CK_ULONG(len(m))
-}
-
-// MechanismInfo provides information about a particular mechanism.
-type MechanismInfo struct {
-	MinKeySize uint
-	MaxKeySize uint
-	Flags      uint
-}
diff --git a/components/engine/vendor/github.com/spf13/cobra/doc/man_docs.go b/components/engine/vendor/github.com/spf13/cobra/doc/man_docs.go
deleted file mode 100644
index ae44aaac78..0000000000
--- a/components/engine/vendor/github.com/spf13/cobra/doc/man_docs.go
+++ /dev/null
@@ -1,231 +0,0 @@
-// Copyright 2015 Red Hat Inc. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package doc
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-	"time"
-
-	mangen "github.com/cpuguy83/go-md2man/md2man"
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-)
-
-// GenManTree will generate a man page for this command and all descendants
-// in the directory given. The header may be nil. This function may not work
-// correctly if your command names have - in them. If you have `cmd` with two
-// subcmds, `sub` and `sub-third`. And `sub` has a subcommand called `third`
-// it is undefined which help output will be in the file `cmd-sub-third.1`.
-func GenManTree(cmd *cobra.Command, header *GenManHeader, dir string) error {
-	return GenManTreeFromOpts(cmd, GenManTreeOptions{
-		Header:           header,
-		Path:             dir,
-		CommandSeparator: "_",
-	})
-}
-
-// GenManTreeFromOpts generates a man page for the command and all descendants.
-// The pages are written to the opts.Path directory.
-func GenManTreeFromOpts(cmd *cobra.Command, opts GenManTreeOptions) error {
-	header := opts.Header
-	if header == nil {
-		header = &GenManHeader{}
-	}
-	for _, c := range cmd.Commands() {
-		if !c.IsAvailableCommand() || c.IsHelpCommand() {
-			continue
-		}
-		if err := GenManTreeFromOpts(c, opts); err != nil {
-			return err
-		}
-	}
-	section := "1"
-	if header.Section != "" {
-		section = header.Section
-	}
-
-	separator := "_"
-	if opts.CommandSeparator != "" {
-		separator = opts.CommandSeparator
-	}
-	basename := strings.Replace(cmd.CommandPath(), " ", separator, -1)
-	filename := filepath.Join(opts.Path, basename+"."+section)
-	f, err := os.Create(filename)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-
-	headerCopy := *header
-	return GenMan(cmd, &headerCopy, f)
-}
-
-type GenManTreeOptions struct {
-	Header           *GenManHeader
-	Path             string
-	CommandSeparator string
-}
-
-// GenManHeader is a lot like the .TH header at the start of man pages. These
-// include the title, section, date, source, and manual. We will use the
-// current time if Date if unset and will use "Auto generated by spf13/cobra"
-// if the Source is unset.
-type GenManHeader struct {
-	Title   string
-	Section string
-	Date    *time.Time
-	date    string
-	Source  string
-	Manual  string
-}
-
-// GenMan will generate a man page for the given command and write it to
-// w. The header argument may be nil, however obviously w may not.
-func GenMan(cmd *cobra.Command, header *GenManHeader, w io.Writer) error {
-	if header == nil {
-		header = &GenManHeader{}
-	}
-	fillHeader(header, cmd.CommandPath())
-
-	b := genMan(cmd, header)
-	_, err := w.Write(mangen.Render(b))
-	return err
-}
-
-func fillHeader(header *GenManHeader, name string) {
-	if header.Title == "" {
-		header.Title = strings.ToUpper(strings.Replace(name, " ", "\\-", -1))
-	}
-	if header.Section == "" {
-		header.Section = "1"
-	}
-	if header.Date == nil {
-		now := time.Now()
-		header.Date = &now
-	}
-	header.date = (*header.Date).Format("Jan 2006")
-	if header.Source == "" {
-		header.Source = "Auto generated by spf13/cobra"
-	}
-}
-
-func manPreamble(out io.Writer, header *GenManHeader, cmd *cobra.Command, dashedName string) {
-	description := cmd.Long
-	if len(description) == 0 {
-		description = cmd.Short
-	}
-
-	fmt.Fprintf(out, `%% %s(%s)%s
-%% %s
-%% %s
-# NAME
-`, header.Title, header.Section, header.date, header.Source, header.Manual)
-	fmt.Fprintf(out, "%s \\- %s\n\n", dashedName, cmd.Short)
-	fmt.Fprintf(out, "# SYNOPSIS\n")
-	fmt.Fprintf(out, "**%s**\n\n", cmd.UseLine())
-	fmt.Fprintf(out, "# DESCRIPTION\n")
-	fmt.Fprintf(out, "%s\n\n", description)
-}
-
-func manPrintFlags(out io.Writer, flags *pflag.FlagSet) {
-	flags.VisitAll(func(flag *pflag.Flag) {
-		if len(flag.Deprecated) > 0 || flag.Hidden {
-			return
-		}
-		format := ""
-		if len(flag.Shorthand) > 0 && len(flag.ShorthandDeprecated) == 0 {
-			format = fmt.Sprintf("**-%s**, **--%s**", flag.Shorthand, flag.Name)
-		} else {
-			format = fmt.Sprintf("**--%s**", flag.Name)
-		}
-		if len(flag.NoOptDefVal) > 0 {
-			format = format + "["
-		}
-		if flag.Value.Type() == "string" {
-			// put quotes on the value
-			format = format + "=%q"
-		} else {
-			format = format + "=%s"
-		}
-		if len(flag.NoOptDefVal) > 0 {
-			format = format + "]"
-		}
-		format = format + "\n\t%s\n\n"
-		fmt.Fprintf(out, format, flag.DefValue, flag.Usage)
-	})
-}
-
-func manPrintOptions(out io.Writer, command *cobra.Command) {
-	flags := command.NonInheritedFlags()
-	if flags.HasFlags() {
-		fmt.Fprintf(out, "# OPTIONS\n")
-		manPrintFlags(out, flags)
-		fmt.Fprintf(out, "\n")
-	}
-	flags = command.InheritedFlags()
-	if flags.HasFlags() {
-		fmt.Fprintf(out, "# OPTIONS INHERITED FROM PARENT COMMANDS\n")
-		manPrintFlags(out, flags)
-		fmt.Fprintf(out, "\n")
-	}
-}
-
-func genMan(cmd *cobra.Command, header *GenManHeader) []byte {
-	// something like `rootcmd-subcmd1-subcmd2`
-	dashCommandName := strings.Replace(cmd.CommandPath(), " ", "-", -1)
-
-	buf := new(bytes.Buffer)
-
-	manPreamble(buf, header, cmd, dashCommandName)
-	manPrintOptions(buf, cmd)
-	if len(cmd.Example) > 0 {
-		fmt.Fprintf(buf, "# EXAMPLE\n")
-		fmt.Fprintf(buf, "\n%s\n\n", cmd.Example)
-	}
-	if hasSeeAlso(cmd) {
-		fmt.Fprintf(buf, "# SEE ALSO\n")
-		seealsos := make([]string, 0)
-		if cmd.HasParent() {
-			parentPath := cmd.Parent().CommandPath()
-			dashParentPath := strings.Replace(parentPath, " ", "-", -1)
-			seealso := fmt.Sprintf("**%s(%s)**", dashParentPath, header.Section)
-			seealsos = append(seealsos, seealso)
-			cmd.VisitParents(func(c *cobra.Command) {
-				if c.DisableAutoGenTag {
-					cmd.DisableAutoGenTag = c.DisableAutoGenTag
-				}
-			})
-		}
-		children := cmd.Commands()
-		sort.Sort(byName(children))
-		for _, c := range children {
-			if !c.IsAvailableCommand() || c.IsHelpCommand() {
-				continue
-			}
-			seealso := fmt.Sprintf("**%s-%s(%s)**", dashCommandName, c.Name(), header.Section)
-			seealsos = append(seealsos, seealso)
-		}
-		fmt.Fprintf(buf, "%s\n", strings.Join(seealsos, ", "))
-	}
-	if !cmd.DisableAutoGenTag {
-		fmt.Fprintf(buf, "# HISTORY\n%s Auto generated by spf13/cobra\n", header.Date.Format("2-Jan-2006"))
-	}
-	return buf.Bytes()
-}
diff --git a/components/engine/vendor/github.com/spf13/cobra/doc/md_docs.go b/components/engine/vendor/github.com/spf13/cobra/doc/md_docs.go
deleted file mode 100644
index fa13631804..0000000000
--- a/components/engine/vendor/github.com/spf13/cobra/doc/md_docs.go
+++ /dev/null
@@ -1,175 +0,0 @@
-//Copyright 2015 Red Hat Inc. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package doc
-
-import (
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-	"time"
-
-	"github.com/spf13/cobra"
-)
-
-func printOptions(w io.Writer, cmd *cobra.Command, name string) error {
-	flags := cmd.NonInheritedFlags()
-	flags.SetOutput(w)
-	if flags.HasFlags() {
-		if _, err := fmt.Fprintf(w, "### Options\n\n```\n"); err != nil {
-			return err
-		}
-		flags.PrintDefaults()
-		if _, err := fmt.Fprintf(w, "```\n\n"); err != nil {
-			return err
-		}
-	}
-
-	parentFlags := cmd.InheritedFlags()
-	parentFlags.SetOutput(w)
-	if parentFlags.HasFlags() {
-		if _, err := fmt.Fprintf(w, "### Options inherited from parent commands\n\n```\n"); err != nil {
-			return err
-		}
-		parentFlags.PrintDefaults()
-		if _, err := fmt.Fprintf(w, "```\n\n"); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func GenMarkdown(cmd *cobra.Command, w io.Writer) error {
-	return GenMarkdownCustom(cmd, w, func(s string) string { return s })
-}
-
-func GenMarkdownCustom(cmd *cobra.Command, w io.Writer, linkHandler func(string) string) error {
-	name := cmd.CommandPath()
-
-	short := cmd.Short
-	long := cmd.Long
-	if len(long) == 0 {
-		long = short
-	}
-
-	if _, err := fmt.Fprintf(w, "## %s\n\n", name); err != nil {
-		return err
-	}
-	if _, err := fmt.Fprintf(w, "%s\n\n", short); err != nil {
-		return err
-	}
-	if _, err := fmt.Fprintf(w, "### Synopsis\n\n"); err != nil {
-		return err
-	}
-	if _, err := fmt.Fprintf(w, "\n%s\n\n", long); err != nil {
-		return err
-	}
-
-	if cmd.Runnable() {
-		if _, err := fmt.Fprintf(w, "```\n%s\n```\n\n", cmd.UseLine()); err != nil {
-			return err
-		}
-	}
-
-	if len(cmd.Example) > 0 {
-		if _, err := fmt.Fprintf(w, "### Examples\n\n"); err != nil {
-			return err
-		}
-		if _, err := fmt.Fprintf(w, "```\n%s\n```\n\n", cmd.Example); err != nil {
-			return err
-		}
-	}
-
-	if err := printOptions(w, cmd, name); err != nil {
-		return err
-	}
-	if hasSeeAlso(cmd) {
-		if _, err := fmt.Fprintf(w, "### SEE ALSO\n"); err != nil {
-			return err
-		}
-		if cmd.HasParent() {
-			parent := cmd.Parent()
-			pname := parent.CommandPath()
-			link := pname + ".md"
-			link = strings.Replace(link, " ", "_", -1)
-			if _, err := fmt.Fprintf(w, "* [%s](%s)\t - %s\n", pname, linkHandler(link), parent.Short); err != nil {
-				return err
-			}
-			cmd.VisitParents(func(c *cobra.Command) {
-				if c.DisableAutoGenTag {
-					cmd.DisableAutoGenTag = c.DisableAutoGenTag
-				}
-			})
-		}
-
-		children := cmd.Commands()
-		sort.Sort(byName(children))
-
-		for _, child := range children {
-			if !child.IsAvailableCommand() || child.IsHelpCommand() {
-				continue
-			}
-			cname := name + " " + child.Name()
-			link := cname + ".md"
-			link = strings.Replace(link, " ", "_", -1)
-			if _, err := fmt.Fprintf(w, "* [%s](%s)\t - %s\n", cname, linkHandler(link), child.Short); err != nil {
-				return err
-			}
-		}
-		if _, err := fmt.Fprintf(w, "\n"); err != nil {
-			return err
-		}
-	}
-	if !cmd.DisableAutoGenTag {
-		if _, err := fmt.Fprintf(w, "###### Auto generated by spf13/cobra on %s\n", time.Now().Format("2-Jan-2006")); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func GenMarkdownTree(cmd *cobra.Command, dir string) error {
-	identity := func(s string) string { return s }
-	emptyStr := func(s string) string { return "" }
-	return GenMarkdownTreeCustom(cmd, dir, emptyStr, identity)
-}
-
-func GenMarkdownTreeCustom(cmd *cobra.Command, dir string, filePrepender, linkHandler func(string) string) error {
-	for _, c := range cmd.Commands() {
-		if !c.IsAvailableCommand() || c.IsHelpCommand() {
-			continue
-		}
-		if err := GenMarkdownTreeCustom(c, dir, filePrepender, linkHandler); err != nil {
-			return err
-		}
-	}
-
-	basename := strings.Replace(cmd.CommandPath(), " ", "_", -1) + ".md"
-	filename := filepath.Join(dir, basename)
-	f, err := os.Create(filename)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-
-	if _, err := io.WriteString(f, filePrepender(filename)); err != nil {
-		return err
-	}
-	if err := GenMarkdownCustom(cmd, f, linkHandler); err != nil {
-		return err
-	}
-	return nil
-}
diff --git a/components/engine/vendor/github.com/spf13/cobra/doc/util.go b/components/engine/vendor/github.com/spf13/cobra/doc/util.go
deleted file mode 100644
index a1c6b89ba6..0000000000
--- a/components/engine/vendor/github.com/spf13/cobra/doc/util.go
+++ /dev/null
@@ -1,38 +0,0 @@
-// Copyright 2015 Red Hat Inc. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package doc
-
-import "github.com/spf13/cobra"
-
-// Test to see if we have a reason to print See Also information in docs
-// Basically this is a test for a parent commend or a subcommand which is
-// both not deprecated and not the autogenerated help command.
-func hasSeeAlso(cmd *cobra.Command) bool {
-	if cmd.HasParent() {
-		return true
-	}
-	for _, c := range cmd.Commands() {
-		if !c.IsAvailableCommand() || c.IsHelpCommand() {
-			continue
-		}
-		return true
-	}
-	return false
-}
-
-type byName []*cobra.Command
-
-func (s byName) Len() int           { return len(s) }
-func (s byName) Swap(i, j int)      { s[i], s[j] = s[j], s[i] }
-func (s byName) Less(i, j int) bool { return s[i].Name() < s[j].Name() }
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/LICENSE b/components/engine/vendor/github.com/stevvooe/continuity/LICENSE
new file mode 100644
index 0000000000..8f71f43fee
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/LICENSE
@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/README.md b/components/engine/vendor/github.com/stevvooe/continuity/README.md
new file mode 100644
index 0000000000..50b64c20f3
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/README.md
@@ -0,0 +1,19 @@
+# continuity
+
+[![GoDoc](https://godoc.org/github.com/containerd/continuity?status.svg)](https://godoc.org/github.com/containerd/continuity)
+[![Build Status](https://travis-ci.org/containerd/continuity.svg?branch=master)](https://travis-ci.org/containerd/continuity)
+
+A transport-agnostic, filesystem metadata manifest system
+
+This project is a staging area for experiments in providing transport agnostic
+metadata storage.
+
+Please see https://github.com/opencontainers/specs/issues/11 for more details.
+
+## Building Proto Package
+
+If you change the proto file you will need to rebuild the generated Go with `go generate`.
+
+```
+go generate ./proto
+```
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/asm.s b/components/engine/vendor/github.com/stevvooe/continuity/sysx/asm.s
new file mode 100644
index 0000000000..8ed2fdb94b
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/asm.s
@@ -0,0 +1,10 @@
+// Copyright 2014 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !gccgo
+
+#include "textflag.h"
+
+TEXT ·use(SB),NOSPLIT,$0
+	RET
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_darwin.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_darwin.go
new file mode 100644
index 0000000000..e3ae2b7bbf
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_darwin.go
@@ -0,0 +1,18 @@
+package sysx
+
+const (
+	// AtSymlinkNoFollow defined from AT_SYMLINK_NOFOLLOW in <sys/fcntl.h>
+	AtSymlinkNofollow = 0x20
+)
+
+const (
+
+	// SYS_FCHMODAT defined from golang.org/sys/unix
+	SYS_FCHMODAT = 467
+)
+
+// These functions will be generated by generate.sh
+//    $ GOOS=darwin GOARCH=386 ./generate.sh chmod
+//    $ GOOS=darwin GOARCH=amd64 ./generate.sh chmod
+
+//sys  Fchmodat(dirfd int, path string, mode uint32, flags int) (err error)
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_darwin_386.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_darwin_386.go
new file mode 100644
index 0000000000..5a8cf5b57d
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_darwin_386.go
@@ -0,0 +1,25 @@
+// mksyscall.pl -l32 chmod_darwin.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall6(SYS_FCHMODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	use(unsafe.Pointer(_p0))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_darwin_amd64.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_darwin_amd64.go
new file mode 100644
index 0000000000..3287d1d579
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_darwin_amd64.go
@@ -0,0 +1,25 @@
+// mksyscall.pl chmod_darwin.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall6(SYS_FCHMODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	use(unsafe.Pointer(_p0))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_freebsd.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_freebsd.go
new file mode 100644
index 0000000000..b64a708be1
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_freebsd.go
@@ -0,0 +1,17 @@
+package sysx
+
+const (
+	// AtSymlinkNoFollow defined from AT_SYMLINK_NOFOLLOW in <sys/fcntl.h>
+	AtSymlinkNofollow = 0x200
+)
+
+const (
+
+	// SYS_FCHMODAT defined from golang.org/sys/unix
+	SYS_FCHMODAT = 490
+)
+
+// These functions will be generated by generate.sh
+//    $ GOOS=freebsd GOARCH=amd64 ./generate.sh chmod
+
+//sys  Fchmodat(dirfd int, path string, mode uint32, flags int) (err error)
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_freebsd_amd64.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_freebsd_amd64.go
new file mode 100644
index 0000000000..5a271abb1e
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_freebsd_amd64.go
@@ -0,0 +1,25 @@
+// mksyscall.pl chmod_freebsd.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall6(SYS_FCHMODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	use(unsafe.Pointer(_p0))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_linux.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_linux.go
new file mode 100644
index 0000000000..89df6d38ef
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/chmod_linux.go
@@ -0,0 +1,12 @@
+package sysx
+
+import "syscall"
+
+const (
+	// AtSymlinkNoFollow defined from AT_SYMLINK_NOFOLLOW in /usr/include/linux/fcntl.h
+	AtSymlinkNofollow = 0x100
+)
+
+func Fchmodat(dirfd int, path string, mode uint32, flags int) error {
+	return syscall.Fchmodat(dirfd, path, mode, flags)
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/copy_linux.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/copy_linux.go
new file mode 100644
index 0000000000..d7ccbb26ee
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/copy_linux.go
@@ -0,0 +1,9 @@
+package sysx
+
+// These functions will be generated by generate.sh
+//    $ GOOS=linux GOARCH=386 ./generate.sh copy
+//    $ GOOS=linux GOARCH=amd64 ./generate.sh copy
+//    $ GOOS=linux GOARCH=arm ./generate.sh copy
+//    $ GOOS=linux GOARCH=arm64 ./generate.sh copy
+
+//sys CopyFileRange(fdin uintptr, offin *int64, fdout uintptr, offout *int64, len int, flags int) (n int, err error)
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/copy_linux_386.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/copy_linux_386.go
new file mode 100644
index 0000000000..c1368c5723
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/copy_linux_386.go
@@ -0,0 +1,20 @@
+// mksyscall.pl -l32 copy_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func CopyFileRange(fdin uintptr, offin *int64, fdout uintptr, offout *int64, len int, flags int) (n int, err error) {
+	r0, _, e1 := syscall.Syscall6(SYS_COPY_FILE_RANGE, uintptr(fdin), uintptr(unsafe.Pointer(offin)), uintptr(fdout), uintptr(unsafe.Pointer(offout)), uintptr(len), uintptr(flags))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/copy_linux_amd64.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/copy_linux_amd64.go
new file mode 100644
index 0000000000..9941b01f09
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/copy_linux_amd64.go
@@ -0,0 +1,20 @@
+// mksyscall.pl copy_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func CopyFileRange(fdin uintptr, offin *int64, fdout uintptr, offout *int64, len int, flags int) (n int, err error) {
+	r0, _, e1 := syscall.Syscall6(SYS_COPY_FILE_RANGE, uintptr(fdin), uintptr(unsafe.Pointer(offin)), uintptr(fdout), uintptr(unsafe.Pointer(offout)), uintptr(len), uintptr(flags))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/copy_linux_arm.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/copy_linux_arm.go
new file mode 100644
index 0000000000..c1368c5723
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/copy_linux_arm.go
@@ -0,0 +1,20 @@
+// mksyscall.pl -l32 copy_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func CopyFileRange(fdin uintptr, offin *int64, fdout uintptr, offout *int64, len int, flags int) (n int, err error) {
+	r0, _, e1 := syscall.Syscall6(SYS_COPY_FILE_RANGE, uintptr(fdin), uintptr(unsafe.Pointer(offin)), uintptr(fdout), uintptr(unsafe.Pointer(offout)), uintptr(len), uintptr(flags))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/copy_linux_arm64.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/copy_linux_arm64.go
new file mode 100644
index 0000000000..9941b01f09
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/copy_linux_arm64.go
@@ -0,0 +1,20 @@
+// mksyscall.pl copy_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func CopyFileRange(fdin uintptr, offin *int64, fdout uintptr, offout *int64, len int, flags int) (n int, err error) {
+	r0, _, e1 := syscall.Syscall6(SYS_COPY_FILE_RANGE, uintptr(fdin), uintptr(unsafe.Pointer(offin)), uintptr(fdout), uintptr(unsafe.Pointer(offout)), uintptr(len), uintptr(flags))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/nodata_linux.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/nodata_linux.go
new file mode 100644
index 0000000000..fc47ddb8dc
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/nodata_linux.go
@@ -0,0 +1,7 @@
+package sysx
+
+import (
+	"syscall"
+)
+
+const ENODATA = syscall.ENODATA
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/nodata_unix.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/nodata_unix.go
new file mode 100644
index 0000000000..7e6851209f
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/nodata_unix.go
@@ -0,0 +1,9 @@
+// +build darwin freebsd
+
+package sysx
+
+import (
+	"syscall"
+)
+
+const ENODATA = syscall.ENOATTR
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/sys.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/sys.go
new file mode 100644
index 0000000000..0bb1676283
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/sys.go
@@ -0,0 +1,37 @@
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+var _zero uintptr
+
+// use is a no-op, but the compiler cannot see that it is.
+// Calling use(p) ensures that p is kept live until that point.
+//go:noescape
+func use(p unsafe.Pointer)
+
+// Do the interface allocations only once for common
+// Errno values.
+var (
+	errEAGAIN error = syscall.EAGAIN
+	errEINVAL error = syscall.EINVAL
+	errENOENT error = syscall.ENOENT
+)
+
+// errnoErr returns common boxed Errno values, to prevent
+// allocations at runtime.
+func errnoErr(e syscall.Errno) error {
+	switch e {
+	case 0:
+		return nil
+	case syscall.EAGAIN:
+		return errEAGAIN
+	case syscall.EINVAL:
+		return errEINVAL
+	case syscall.ENOENT:
+		return errENOENT
+	}
+	return e
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/sysnum_linux_386.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/sysnum_linux_386.go
new file mode 100644
index 0000000000..0063f8a913
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/sysnum_linux_386.go
@@ -0,0 +1,7 @@
+package sysx
+
+const (
+	// SYS_COPYFILERANGE defined in Kernel 4.5+
+	// Number defined in /usr/include/asm/unistd_32.h
+	SYS_COPY_FILE_RANGE = 377
+)
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/sysnum_linux_amd64.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/sysnum_linux_amd64.go
new file mode 100644
index 0000000000..4170540c5d
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/sysnum_linux_amd64.go
@@ -0,0 +1,7 @@
+package sysx
+
+const (
+	// SYS_COPYFILERANGE defined in Kernel 4.5+
+	// Number defined in /usr/include/asm/unistd_64.h
+	SYS_COPY_FILE_RANGE = 326
+)
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/sysnum_linux_arm.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/sysnum_linux_arm.go
new file mode 100644
index 0000000000..a05dcbb5ef
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/sysnum_linux_arm.go
@@ -0,0 +1,7 @@
+package sysx
+
+const (
+	// SYS_COPY_FILE_RANGE defined in Kernel 4.5+
+	// Number defined in /usr/include/arm-linux-gnueabihf/asm/unistd.h
+	SYS_COPY_FILE_RANGE = 391
+)
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/sysnum_linux_arm64.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/sysnum_linux_arm64.go
new file mode 100644
index 0000000000..da31bbd908
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/sysnum_linux_arm64.go
@@ -0,0 +1,7 @@
+package sysx
+
+const (
+	// SYS_COPY_FILE_RANGE defined in Kernel 4.5+
+	// Number defined in /usr/include/asm-generic/unistd.h
+	SYS_COPY_FILE_RANGE = 285
+)
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr.go
new file mode 100644
index 0000000000..20937c2d4d
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr.go
@@ -0,0 +1,67 @@
+package sysx
+
+import (
+	"bytes"
+	"fmt"
+	"syscall"
+)
+
+const defaultXattrBufferSize = 5
+
+var ErrNotSupported = fmt.Errorf("not supported")
+
+type listxattrFunc func(path string, dest []byte) (int, error)
+
+func listxattrAll(path string, listFunc listxattrFunc) ([]string, error) {
+	var p []byte // nil on first execution
+
+	for {
+		n, err := listFunc(path, p) // first call gets buffer size.
+		if err != nil {
+			return nil, err
+		}
+
+		if n > len(p) {
+			p = make([]byte, n)
+			continue
+		}
+
+		p = p[:n]
+
+		ps := bytes.Split(bytes.TrimSuffix(p, []byte{0}), []byte{0})
+		var entries []string
+		for _, p := range ps {
+			s := string(p)
+			if s != "" {
+				entries = append(entries, s)
+			}
+		}
+
+		return entries, nil
+	}
+}
+
+type getxattrFunc func(string, string, []byte) (int, error)
+
+func getxattrAll(path, attr string, getFunc getxattrFunc) ([]byte, error) {
+	p := make([]byte, defaultXattrBufferSize)
+	for {
+		n, err := getFunc(path, attr, p)
+		if err != nil {
+			if errno, ok := err.(syscall.Errno); ok && errno == syscall.ERANGE {
+				p = make([]byte, len(p)*2) // this can't be ideal.
+				continue                   // try again!
+			}
+
+			return nil, err
+		}
+
+		// realloc to correct size and repeat
+		if n > len(p) {
+			p = make([]byte, n)
+			continue
+		}
+
+		return p[:n], nil
+	}
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_darwin.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_darwin.go
new file mode 100644
index 0000000000..1164a7d11c
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_darwin.go
@@ -0,0 +1,71 @@
+package sysx
+
+// These functions will be generated by generate.sh
+//    $ GOOS=darwin GOARCH=386 ./generate.sh xattr
+//    $ GOOS=darwin GOARCH=amd64 ./generate.sh xattr
+
+//sys  getxattr(path string, attr string, dest []byte, pos int, options int) (sz int, err error)
+//sys  setxattr(path string, attr string, data []byte, flags int) (err error)
+//sys  removexattr(path string, attr string, options int) (err error)
+//sys  listxattr(path string, dest []byte, options int) (sz int, err error)
+//sys  Fchmodat(dirfd int, path string, mode uint32, flags int) (err error)
+
+const (
+	xattrNoFollow = 0x01
+)
+
+func listxattrFollow(path string, dest []byte) (sz int, err error) {
+	return listxattr(path, dest, 0)
+}
+
+// Listxattr calls syscall getxattr
+func Listxattr(path string) ([]string, error) {
+	return listxattrAll(path, listxattrFollow)
+}
+
+// Removexattr calls syscall getxattr
+func Removexattr(path string, attr string) (err error) {
+	return removexattr(path, attr, 0)
+}
+
+// Setxattr calls syscall setxattr
+func Setxattr(path string, attr string, data []byte, flags int) (err error) {
+	return setxattr(path, attr, data, flags)
+}
+
+func getxattrFollow(path, attr string, dest []byte) (sz int, err error) {
+	return getxattr(path, attr, dest, 0, 0)
+}
+
+// Getxattr calls syscall getxattr
+func Getxattr(path, attr string) ([]byte, error) {
+	return getxattrAll(path, attr, getxattrFollow)
+}
+
+func listxattrNoFollow(path string, dest []byte) (sz int, err error) {
+	return listxattr(path, dest, xattrNoFollow)
+}
+
+// LListxattr calls syscall listxattr with XATTR_NOFOLLOW
+func LListxattr(path string) ([]string, error) {
+	return listxattrAll(path, listxattrNoFollow)
+}
+
+// LRemovexattr calls syscall removexattr with XATTR_NOFOLLOW
+func LRemovexattr(path string, attr string) (err error) {
+	return removexattr(path, attr, xattrNoFollow)
+}
+
+// Setxattr calls syscall setxattr with XATTR_NOFOLLOW
+func LSetxattr(path string, attr string, data []byte, flags int) (err error) {
+	return setxattr(path, attr, data, flags|xattrNoFollow)
+}
+
+func getxattrNoFollow(path, attr string, dest []byte) (sz int, err error) {
+	return getxattr(path, attr, dest, 0, xattrNoFollow)
+}
+
+// LGetxattr calls syscall getxattr with XATTR_NOFOLLOW
+func LGetxattr(path, attr string) ([]byte, error) {
+	return getxattrAll(path, attr, getxattrNoFollow)
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_darwin_386.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_darwin_386.go
new file mode 100644
index 0000000000..aa896b57fc
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_darwin_386.go
@@ -0,0 +1,111 @@
+// mksyscall.pl -l32 xattr_darwin.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getxattr(path string, attr string, dest []byte, pos int, options int) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_GETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), uintptr(pos), uintptr(options))
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func setxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_SETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func removexattr(path string, attr string, options int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_REMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(options))
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func listxattr(path string, dest []byte, options int) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)), uintptr(options), 0, 0)
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_darwin_amd64.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_darwin_amd64.go
new file mode 100644
index 0000000000..6ff27e2703
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_darwin_amd64.go
@@ -0,0 +1,111 @@
+// mksyscall.pl xattr_darwin.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getxattr(path string, attr string, dest []byte, pos int, options int) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_GETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), uintptr(pos), uintptr(options))
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func setxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_SETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func removexattr(path string, attr string, options int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_REMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(options))
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func listxattr(path string, dest []byte, options int) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)), uintptr(options), 0, 0)
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_freebsd.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_freebsd.go
new file mode 100644
index 0000000000..80dba49aa5
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_freebsd.go
@@ -0,0 +1,53 @@
+package sysx
+
+import (
+	"errors"
+)
+
+// Initial stub version for FreeBSD. FreeBSD has a different
+// syscall API from Darwin and Linux for extended attributes;
+// it is also not widely used. It is not exposed at all by the
+// Go syscall package, so we need to implement directly eventually.
+
+var unsupported error = errors.New("extended attributes unsupported on FreeBSD")
+
+// Listxattr calls syscall listxattr and reads all content
+// and returns a string array
+func Listxattr(path string) ([]string, error) {
+	return []string{}, nil
+}
+
+// Removexattr calls syscall removexattr
+func Removexattr(path string, attr string) (err error) {
+	return unsupported
+}
+
+// Setxattr calls syscall setxattr
+func Setxattr(path string, attr string, data []byte, flags int) (err error) {
+	return unsupported
+}
+
+// Getxattr calls syscall getxattr
+func Getxattr(path, attr string) ([]byte, error) {
+	return []byte{}, nil
+}
+
+// LListxattr lists xattrs, not following symlinks
+func LListxattr(path string) ([]string, error) {
+	return []string{}, nil
+}
+
+// LRemovexattr removes an xattr, not following symlinks
+func LRemovexattr(path string, attr string) (err error) {
+	return unsupported
+}
+
+// LSetxattr sets an xattr, not following symlinks
+func LSetxattr(path string, attr string, data []byte, flags int) (err error) {
+	return unsupported
+}
+
+// LGetxattr gets an xattr, not following symlinks
+func LGetxattr(path, attr string) ([]byte, error) {
+	return []byte{}, nil
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux.go
new file mode 100644
index 0000000000..cd18136343
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux.go
@@ -0,0 +1,61 @@
+package sysx
+
+import "syscall"
+
+// These functions will be generated by generate.sh
+//    $ GOOS=linux GOARCH=386 ./generate.sh xattr
+//    $ GOOS=linux GOARCH=amd64 ./generate.sh xattr
+//    $ GOOS=linux GOARCH=arm ./generate.sh xattr
+//    $ GOOS=linux GOARCH=arm64 ./generate.sh xattr
+//    $ GOOS=linux GOARCH=ppc64 ./generate.sh xattr
+//    $ GOOS=linux GOARCH=ppc64le ./generate.sh xattr
+//    $ GOOS=linux GOARCH=s390x ./generate.sh xattr
+
+// Listxattr calls syscall listxattr and reads all content
+// and returns a string array
+func Listxattr(path string) ([]string, error) {
+	return listxattrAll(path, syscall.Listxattr)
+}
+
+// Removexattr calls syscall removexattr
+func Removexattr(path string, attr string) (err error) {
+	return syscall.Removexattr(path, attr)
+}
+
+// Setxattr calls syscall setxattr
+func Setxattr(path string, attr string, data []byte, flags int) (err error) {
+	return syscall.Setxattr(path, attr, data, flags)
+}
+
+// Getxattr calls syscall getxattr
+func Getxattr(path, attr string) ([]byte, error) {
+	return getxattrAll(path, attr, syscall.Getxattr)
+}
+
+//sys llistxattr(path string, dest []byte) (sz int, err error)
+
+// LListxattr lists xattrs, not following symlinks
+func LListxattr(path string) ([]string, error) {
+	return listxattrAll(path, llistxattr)
+}
+
+//sys lremovexattr(path string, attr string) (err error)
+
+// LRemovexattr removes an xattr, not following symlinks
+func LRemovexattr(path string, attr string) (err error) {
+	return lremovexattr(path, attr)
+}
+
+//sys lsetxattr(path string, attr string, data []byte, flags int) (err error)
+
+// LSetxattr sets an xattr, not following symlinks
+func LSetxattr(path string, attr string, data []byte, flags int) (err error) {
+	return lsetxattr(path, attr, data, flags)
+}
+
+//sys lgetxattr(path string, attr string, dest []byte) (sz int, err error)
+
+// LGetxattr gets an xattr, not following symlinks
+func LGetxattr(path, attr string) ([]byte, error) {
+	return getxattrAll(path, attr, lgetxattr)
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_386.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_386.go
new file mode 100644
index 0000000000..c3e5c8e385
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_386.go
@@ -0,0 +1,111 @@
+// mksyscall.pl -l32 xattr_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func llistxattr(path string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall(syscall.SYS_LLISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)))
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lremovexattr(path string, attr string) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_LREMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lsetxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lgetxattr(path string, attr string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), 0, 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_amd64.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_amd64.go
new file mode 100644
index 0000000000..dec46faaaf
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_amd64.go
@@ -0,0 +1,111 @@
+// mksyscall.pl xattr_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func llistxattr(path string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall(syscall.SYS_LLISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)))
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lremovexattr(path string, attr string) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_LREMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lsetxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lgetxattr(path string, attr string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), 0, 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_arm.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_arm.go
new file mode 100644
index 0000000000..c3e5c8e385
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_arm.go
@@ -0,0 +1,111 @@
+// mksyscall.pl -l32 xattr_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func llistxattr(path string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall(syscall.SYS_LLISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)))
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lremovexattr(path string, attr string) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_LREMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lsetxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lgetxattr(path string, attr string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), 0, 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_arm64.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_arm64.go
new file mode 100644
index 0000000000..dec46faaaf
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_arm64.go
@@ -0,0 +1,111 @@
+// mksyscall.pl xattr_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func llistxattr(path string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall(syscall.SYS_LLISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)))
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lremovexattr(path string, attr string) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_LREMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lsetxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lgetxattr(path string, attr string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), 0, 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_ppc64.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_ppc64.go
new file mode 100644
index 0000000000..dec46faaaf
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_ppc64.go
@@ -0,0 +1,111 @@
+// mksyscall.pl xattr_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func llistxattr(path string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall(syscall.SYS_LLISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)))
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lremovexattr(path string, attr string) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_LREMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lsetxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lgetxattr(path string, attr string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), 0, 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_ppc64le.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_ppc64le.go
new file mode 100644
index 0000000000..dec46faaaf
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_ppc64le.go
@@ -0,0 +1,111 @@
+// mksyscall.pl xattr_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func llistxattr(path string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall(syscall.SYS_LLISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)))
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lremovexattr(path string, attr string) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_LREMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lsetxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lgetxattr(path string, attr string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), 0, 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_s390x.go b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_s390x.go
new file mode 100644
index 0000000000..dec46faaaf
--- /dev/null
+++ b/components/engine/vendor/github.com/stevvooe/continuity/sysx/xattr_linux_s390x.go
@@ -0,0 +1,111 @@
+// mksyscall.pl xattr_linux.go
+// MACHINE GENERATED BY THE COMMAND ABOVE; DO NOT EDIT
+
+package sysx
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func llistxattr(path string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(dest) > 0 {
+		_p1 = unsafe.Pointer(&dest[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall(syscall.SYS_LLISTXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(dest)))
+	use(unsafe.Pointer(_p0))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lremovexattr(path string, attr string) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall.Syscall(syscall.SYS_LREMOVEXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lsetxattr(path string, attr string, data []byte, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(data) > 0 {
+		_p2 = unsafe.Pointer(&data[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(data)), uintptr(flags), 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func lgetxattr(path string, attr string, dest []byte) (sz int, err error) {
+	var _p0 *byte
+	_p0, err = syscall.BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = syscall.BytePtrFromString(attr)
+	if err != nil {
+		return
+	}
+	var _p2 unsafe.Pointer
+	if len(dest) > 0 {
+		_p2 = unsafe.Pointer(&dest[0])
+	} else {
+		_p2 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(_p2), uintptr(len(dest)), 0, 0)
+	use(unsafe.Pointer(_p0))
+	use(unsafe.Pointer(_p1))
+	sz = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/LICENSE b/components/engine/vendor/github.com/tonistiigi/fsutil/LICENSE
new file mode 100644
index 0000000000..7df441d93e
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/LICENSE
@@ -0,0 +1,22 @@
+MIT
+
+Copyright 2017 Tõnis Tiigi <tonistiigi@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
\ No newline at end of file
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/diff.go b/components/engine/vendor/github.com/tonistiigi/fsutil/diff.go
new file mode 100644
index 0000000000..1530973784
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/diff.go
@@ -0,0 +1,37 @@
+package fsutil
+
+import (
+	"os"
+
+	"golang.org/x/net/context"
+)
+
+type walkerFn func(ctx context.Context, pathC chan<- *currentPath) error
+
+func Changes(ctx context.Context, a, b walkerFn, changeFn ChangeFunc) error {
+	return nil
+}
+
+type HandleChangeFn func(ChangeKind, string, os.FileInfo, error) error
+
+func GetWalkerFn(root string) walkerFn {
+	return func(ctx context.Context, pathC chan<- *currentPath) error {
+		return Walk(ctx, root, nil, func(path string, f os.FileInfo, err error) error {
+			if err != nil {
+				return err
+			}
+
+			p := &currentPath{
+				path: path,
+				f:    f,
+			}
+
+			select {
+			case <-ctx.Done():
+				return ctx.Err()
+			case pathC <- p:
+				return nil
+			}
+		})
+	}
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/diff_containerd.go b/components/engine/vendor/github.com/tonistiigi/fsutil/diff_containerd.go
new file mode 100644
index 0000000000..c7c9788e85
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/diff_containerd.go
@@ -0,0 +1,199 @@
+package fsutil
+
+import (
+	"os"
+	"strings"
+
+	"golang.org/x/net/context"
+	"golang.org/x/sync/errgroup"
+)
+
+// Everything below is copied from containerd/fs. TODO: remove duplication @dmcgowan
+
+// Const redefined because containerd/fs doesn't build on !linux
+
+// ChangeKind is the type of modification that
+// a change is making.
+type ChangeKind int
+
+const (
+	// ChangeKindAdd represents an addition of
+	// a file
+	ChangeKindAdd ChangeKind = iota
+
+	// ChangeKindModify represents a change to
+	// an existing file
+	ChangeKindModify
+
+	// ChangeKindDelete represents a delete of
+	// a file
+	ChangeKindDelete
+)
+
+// ChangeFunc is the type of function called for each change
+// computed during a directory changes calculation.
+type ChangeFunc func(ChangeKind, string, os.FileInfo, error) error
+
+type currentPath struct {
+	path string
+	f    os.FileInfo
+	//	fullPath string
+}
+
+// doubleWalkDiff walks both directories to create a diff
+func doubleWalkDiff(ctx context.Context, changeFn ChangeFunc, a, b walkerFn) (err error) {
+	g, ctx := errgroup.WithContext(ctx)
+
+	var (
+		c1 = make(chan *currentPath, 128)
+		c2 = make(chan *currentPath, 128)
+
+		f1, f2 *currentPath
+		rmdir  string
+	)
+	g.Go(func() error {
+		defer close(c1)
+		return a(ctx, c1)
+	})
+	g.Go(func() error {
+		defer close(c2)
+		return b(ctx, c2)
+	})
+	g.Go(func() error {
+	loop0:
+		for c1 != nil || c2 != nil {
+			if f1 == nil && c1 != nil {
+				f1, err = nextPath(ctx, c1)
+				if err != nil {
+					return err
+				}
+				if f1 == nil {
+					c1 = nil
+				}
+			}
+
+			if f2 == nil && c2 != nil {
+				f2, err = nextPath(ctx, c2)
+				if err != nil {
+					return err
+				}
+				if f2 == nil {
+					c2 = nil
+				}
+			}
+			if f1 == nil && f2 == nil {
+				continue
+			}
+
+			var f os.FileInfo
+			k, p := pathChange(f1, f2)
+			switch k {
+			case ChangeKindAdd:
+				if rmdir != "" {
+					rmdir = ""
+				}
+				f = f2.f
+				f2 = nil
+			case ChangeKindDelete:
+				// Check if this file is already removed by being
+				// under of a removed directory
+				if rmdir != "" && strings.HasPrefix(f1.path, rmdir) {
+					f1 = nil
+					continue
+				} else if rmdir == "" && f1.f.IsDir() {
+					rmdir = f1.path + string(os.PathSeparator)
+				} else if rmdir != "" {
+					rmdir = ""
+				}
+				f1 = nil
+			case ChangeKindModify:
+				same, err := sameFile(f1, f2)
+				if err != nil {
+					return err
+				}
+				if f1.f.IsDir() && !f2.f.IsDir() {
+					rmdir = f1.path + string(os.PathSeparator)
+				} else if rmdir != "" {
+					rmdir = ""
+				}
+				f = f2.f
+				f1 = nil
+				f2 = nil
+				if same {
+					continue loop0
+				}
+			}
+			if err := changeFn(k, p, f, nil); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+
+	return g.Wait()
+}
+
+func pathChange(lower, upper *currentPath) (ChangeKind, string) {
+	if lower == nil {
+		if upper == nil {
+			panic("cannot compare nil paths")
+		}
+		return ChangeKindAdd, upper.path
+	}
+	if upper == nil {
+		return ChangeKindDelete, lower.path
+	}
+
+	switch i := ComparePath(lower.path, upper.path); {
+	case i < 0:
+		// File in lower that is not in upper
+		return ChangeKindDelete, lower.path
+	case i > 0:
+		// File in upper that is not in lower
+		return ChangeKindAdd, upper.path
+	default:
+		return ChangeKindModify, upper.path
+	}
+}
+
+func sameFile(f1, f2 *currentPath) (same bool, retErr error) {
+	// If not a directory also check size, modtime, and content
+	if !f1.f.IsDir() {
+		if f1.f.Size() != f2.f.Size() {
+			return false, nil
+		}
+
+		t1 := f1.f.ModTime()
+		t2 := f2.f.ModTime()
+		if t1.UnixNano() != t2.UnixNano() {
+			return false, nil
+		}
+	}
+
+	ls1, ok := f1.f.Sys().(*Stat)
+	if !ok {
+		return false, nil
+	}
+	ls2, ok := f1.f.Sys().(*Stat)
+	if !ok {
+		return false, nil
+	}
+
+	return compareStat(ls1, ls2)
+}
+
+// compareStat returns whether the stats are equivalent,
+// whether the files are considered the same file, and
+// an error
+func compareStat(ls1, ls2 *Stat) (bool, error) {
+	return ls1.Mode == ls2.Mode && ls1.Uid == ls2.Uid && ls1.Gid == ls2.Gid && ls1.Devmajor == ls2.Devmajor && ls1.Devminor == ls2.Devminor && ls1.Linkname == ls2.Linkname, nil
+}
+
+func nextPath(ctx context.Context, pathC <-chan *currentPath) (*currentPath, error) {
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case p := <-pathC:
+		return p, nil
+	}
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/diff_containerd_linux.go b/components/engine/vendor/github.com/tonistiigi/fsutil/diff_containerd_linux.go
new file mode 100644
index 0000000000..3c9f078f5e
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/diff_containerd_linux.go
@@ -0,0 +1,37 @@
+package fsutil
+
+import (
+	"bytes"
+	"syscall"
+
+	"github.com/pkg/errors"
+	"github.com/stevvooe/continuity/sysx"
+)
+
+// compareSysStat returns whether the stats are equivalent,
+// whether the files are considered the same file, and
+// an error
+func compareSysStat(s1, s2 interface{}) (bool, error) {
+	ls1, ok := s1.(*syscall.Stat_t)
+	if !ok {
+		return false, nil
+	}
+	ls2, ok := s2.(*syscall.Stat_t)
+	if !ok {
+		return false, nil
+	}
+
+	return ls1.Mode == ls2.Mode && ls1.Uid == ls2.Uid && ls1.Gid == ls2.Gid && ls1.Rdev == ls2.Rdev, nil
+}
+
+func compareCapabilities(p1, p2 string) (bool, error) {
+	c1, err := sysx.LGetxattr(p1, "security.capability")
+	if err != nil && err != syscall.ENODATA {
+		return false, errors.Wrapf(err, "failed to get xattr for %s", p1)
+	}
+	c2, err := sysx.LGetxattr(p2, "security.capability")
+	if err != nil && err != syscall.ENODATA {
+		return false, errors.Wrapf(err, "failed to get xattr for %s", p2)
+	}
+	return bytes.Equal(c1, c2), nil
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/diskwriter.go b/components/engine/vendor/github.com/tonistiigi/fsutil/diskwriter.go
new file mode 100644
index 0000000000..a54b4a737a
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/diskwriter.go
@@ -0,0 +1,353 @@
+// +build linux windows
+
+package fsutil
+
+import (
+	"archive/tar"
+	"crypto/sha256"
+	"encoding/hex"
+	"hash"
+	"io"
+	"os"
+	"path/filepath"
+	"strconv"
+	"sync"
+	"time"
+
+	"github.com/docker/docker/pkg/archive"
+	"github.com/docker/docker/pkg/tarsum"
+	"github.com/pkg/errors"
+	"golang.org/x/net/context"
+	"golang.org/x/sync/errgroup"
+)
+
+type WriteToFunc func(context.Context, string, io.WriteCloser) error
+
+type DiskWriterOpt struct {
+	AsyncDataCb WriteToFunc
+	SyncDataCb  WriteToFunc
+	NotifyCb    func(ChangeKind, string, os.FileInfo, error) error
+}
+
+type DiskWriter struct {
+	opt  DiskWriterOpt
+	dest string
+
+	wg     sync.WaitGroup
+	ctx    context.Context
+	cancel func()
+	eg     *errgroup.Group
+}
+
+func NewDiskWriter(ctx context.Context, dest string, opt DiskWriterOpt) (*DiskWriter, error) {
+	if opt.SyncDataCb == nil && opt.AsyncDataCb == nil {
+		return nil, errors.New("no data callback specified")
+	}
+	if opt.SyncDataCb != nil && opt.AsyncDataCb != nil {
+		return nil, errors.New("can't specify both sync and async data callbacks")
+	}
+
+	ctx, cancel := context.WithCancel(ctx)
+	eg, ctx := errgroup.WithContext(ctx)
+
+	return &DiskWriter{
+		opt:    opt,
+		dest:   dest,
+		eg:     eg,
+		ctx:    ctx,
+		cancel: cancel,
+	}, nil
+}
+
+func (dw *DiskWriter) Wait(ctx context.Context) error {
+	return dw.eg.Wait()
+}
+
+func (dw *DiskWriter) HandleChange(kind ChangeKind, p string, fi os.FileInfo, err error) (retErr error) {
+	if err != nil {
+		return err
+	}
+
+	select {
+	case <-dw.ctx.Done():
+		return dw.ctx.Err()
+	default:
+	}
+
+	defer func() {
+		if retErr != nil {
+			dw.cancel()
+		}
+	}()
+
+	p = filepath.FromSlash(p)
+
+	destPath := filepath.Join(dw.dest, p)
+
+	if kind == ChangeKindDelete {
+		// todo: no need to validate if diff is trusted but is it always?
+		if err := os.RemoveAll(destPath); err != nil {
+			return errors.Wrapf(err, "failed to remove: %s", destPath)
+		}
+		if dw.opt.NotifyCb != nil {
+			if err := dw.opt.NotifyCb(kind, p, nil, nil); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+
+	stat, ok := fi.Sys().(*Stat)
+	if !ok {
+		return errors.Errorf("%s invalid change without stat information", p)
+	}
+
+	rename := true
+	oldFi, err := os.Lstat(destPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			if kind != ChangeKindAdd {
+				return errors.Wrapf(err, "invalid addition: %s", destPath)
+			}
+			rename = false
+		} else {
+			return errors.Wrapf(err, "failed to stat %s", destPath)
+		}
+	}
+
+	if oldFi != nil && fi.IsDir() && oldFi.IsDir() {
+		if err := rewriteMetadata(destPath, stat); err != nil {
+			return errors.Wrapf(err, "error setting dir metadata for %s", destPath)
+		}
+		return nil
+	}
+
+	newPath := destPath
+	if rename {
+		newPath = filepath.Join(filepath.Dir(destPath), ".tmp."+nextSuffix())
+	}
+
+	isRegularFile := false
+
+	switch {
+	case fi.IsDir():
+		if err := os.Mkdir(newPath, fi.Mode()); err != nil {
+			return errors.Wrapf(err, "failed to create dir %s", newPath)
+		}
+	case fi.Mode()&os.ModeDevice != 0 || fi.Mode()&os.ModeNamedPipe != 0:
+		if err := handleTarTypeBlockCharFifo(newPath, stat); err != nil {
+			return errors.Wrapf(err, "failed to create device %s", newPath)
+		}
+	case fi.Mode()&os.ModeSymlink != 0:
+		if err := os.Symlink(stat.Linkname, newPath); err != nil {
+			return errors.Wrapf(err, "failed to symlink %s", newPath)
+		}
+	case stat.Linkname != "":
+		if err := os.Link(filepath.Join(dw.dest, stat.Linkname), newPath); err != nil {
+			return errors.Wrapf(err, "failed to link %s to %s", newPath, stat.Linkname)
+		}
+	default:
+		isRegularFile = true
+		file, err := os.OpenFile(newPath, os.O_CREATE|os.O_WRONLY, fi.Mode()) //todo: windows
+		if err != nil {
+			return errors.Wrapf(err, "failed to create %s", newPath)
+		}
+		if dw.opt.SyncDataCb != nil {
+			if err := dw.processChange(ChangeKindAdd, p, fi, file); err != nil {
+				file.Close()
+				return err
+			}
+			break
+		}
+		if err := file.Close(); err != nil {
+			return errors.Wrapf(err, "failed to close %s", newPath)
+		}
+	}
+
+	if err := rewriteMetadata(newPath, stat); err != nil {
+		return errors.Wrapf(err, "error setting metadata for %s", newPath)
+	}
+
+	if rename {
+		if err := os.Rename(newPath, destPath); err != nil {
+			return errors.Wrapf(err, "failed to rename %s to %s", newPath, destPath)
+		}
+	}
+
+	if isRegularFile {
+		if dw.opt.AsyncDataCb != nil {
+			dw.requestAsyncFileData(p, destPath, fi)
+		}
+	} else {
+		return dw.processChange(kind, p, fi, nil)
+	}
+
+	return nil
+}
+
+func (dw *DiskWriter) requestAsyncFileData(p, dest string, fi os.FileInfo) {
+	// todo: limit worker threads
+	dw.eg.Go(func() error {
+		if err := dw.processChange(ChangeKindAdd, p, fi, &lazyFileWriter{
+			dest: dest,
+		}); err != nil {
+			return err
+		}
+		return chtimes(dest, fi.ModTime().UnixNano()) // TODO: parent dirs
+	})
+}
+
+func (dw *DiskWriter) processChange(kind ChangeKind, p string, fi os.FileInfo, w io.WriteCloser) error {
+	origw := w
+	var hw *hashedWriter
+	if dw.opt.NotifyCb != nil {
+		var err error
+		if hw, err = newHashWriter(p, fi, w); err != nil {
+			return err
+		}
+		w = hw
+	}
+	if origw != nil {
+		fn := dw.opt.SyncDataCb
+		if fn == nil && dw.opt.AsyncDataCb != nil {
+			fn = dw.opt.AsyncDataCb
+		}
+		if err := fn(dw.ctx, p, w); err != nil {
+			return err
+		}
+	} else {
+		if hw != nil {
+			hw.Close()
+		}
+	}
+	if hw != nil {
+		return dw.opt.NotifyCb(kind, p, hw, nil)
+	}
+	return nil
+}
+
+type hashedWriter struct {
+	os.FileInfo
+	io.Writer
+	h   hash.Hash
+	w   io.WriteCloser
+	sum string
+}
+
+func newHashWriter(p string, fi os.FileInfo, w io.WriteCloser) (*hashedWriter, error) {
+	h, err := NewTarsumHash(p, fi)
+	if err != nil {
+		return nil, err
+	}
+	hw := &hashedWriter{
+		FileInfo: fi,
+		Writer:   io.MultiWriter(w, h),
+		h:        h,
+		w:        w,
+	}
+	return hw, nil
+}
+
+func (hw *hashedWriter) Close() error {
+	hw.sum = string(hex.EncodeToString(hw.h.Sum(nil)))
+	if hw.w != nil {
+		return hw.w.Close()
+	}
+	return nil
+}
+
+func (hw *hashedWriter) Hash() string {
+	return hw.sum
+}
+
+type lazyFileWriter struct {
+	dest string
+	ctx  context.Context
+	f    *os.File
+}
+
+func (lfw *lazyFileWriter) Write(dt []byte) (int, error) {
+	if lfw.f == nil {
+		file, err := os.OpenFile(lfw.dest, os.O_WRONLY, 0) //todo: windows
+		if err != nil {
+			return 0, errors.Wrapf(err, "failed to open %s", lfw.dest)
+		}
+		lfw.f = file
+	}
+	return lfw.f.Write(dt)
+}
+
+func (lfw *lazyFileWriter) Close() error {
+	if lfw.f != nil {
+		return lfw.f.Close()
+	}
+	return nil
+}
+
+func mkdev(major int64, minor int64) uint32 {
+	return uint32(((minor & 0xfff00) << 12) | ((major & 0xfff) << 8) | (minor & 0xff))
+}
+
+// Random number state.
+// We generate random temporary file names so that there's a good
+// chance the file doesn't exist yet - keeps the number of tries in
+// TempFile to a minimum.
+var rand uint32
+var randmu sync.Mutex
+
+func reseed() uint32 {
+	return uint32(time.Now().UnixNano() + int64(os.Getpid()))
+}
+
+func nextSuffix() string {
+	randmu.Lock()
+	r := rand
+	if r == 0 {
+		r = reseed()
+	}
+	r = r*1664525 + 1013904223 // constants from Numerical Recipes
+	rand = r
+	randmu.Unlock()
+	return strconv.Itoa(int(1e9 + r%1e9))[1:]
+}
+
+func NewTarsumHash(p string, fi os.FileInfo) (hash.Hash, error) {
+	stat, ok := fi.Sys().(*Stat)
+	link := ""
+	if ok {
+		link = stat.Linkname
+	}
+	if fi.IsDir() {
+		p += string(os.PathSeparator)
+	}
+	h, err := archive.FileInfoHeader(p, fi, link)
+	if err != nil {
+		return nil, err
+	}
+	h.Name = p
+	if ok {
+		h.Uid = int(stat.Uid)
+		h.Gid = int(stat.Gid)
+		h.Linkname = stat.Linkname
+		if stat.Xattrs != nil {
+			h.Xattrs = make(map[string]string)
+			for k, v := range stat.Xattrs {
+				h.Xattrs[k] = string(v)
+			}
+		}
+	}
+	tsh := &tarsumHash{h: h, Hash: sha256.New()}
+	tsh.Reset()
+	return tsh, nil
+}
+
+// Reset resets the Hash to its initial state.
+func (tsh *tarsumHash) Reset() {
+	tsh.Hash.Reset()
+	tarsum.WriteV1Header(tsh.h, tsh.Hash)
+}
+
+type tarsumHash struct {
+	hash.Hash
+	h *tar.Header
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/diskwriter_linux.go b/components/engine/vendor/github.com/tonistiigi/fsutil/diskwriter_linux.go
new file mode 100644
index 0000000000..c6d97eb0a6
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/diskwriter_linux.go
@@ -0,0 +1,64 @@
+// +build linux
+
+package fsutil
+
+import (
+	"os"
+	"syscall"
+
+	"github.com/pkg/errors"
+	"github.com/stevvooe/continuity/sysx"
+	"golang.org/x/sys/unix"
+)
+
+func rewriteMetadata(p string, stat *Stat) error {
+	for key, value := range stat.Xattrs {
+		sysx.Setxattr(p, key, value, 0)
+	}
+
+	if err := os.Lchown(p, int(stat.Uid), int(stat.Gid)); err != nil {
+		return errors.Wrapf(err, "failed to lchown %s", p)
+	}
+
+	if os.FileMode(stat.Mode)&os.ModeSymlink == 0 {
+		if err := os.Chmod(p, os.FileMode(stat.Mode)); err != nil {
+			return errors.Wrapf(err, "failed to chown %s", p)
+		}
+	}
+
+	if err := chtimes(p, stat.ModTime); err != nil {
+		return errors.Wrapf(err, "failed to chtimes %s", p)
+	}
+
+	return nil
+}
+
+func chtimes(path string, un int64) error {
+	var utimes [2]unix.Timespec
+	utimes[0] = unix.NsecToTimespec(un)
+	utimes[1] = utimes[0]
+
+	if err := unix.UtimesNanoAt(unix.AT_FDCWD, path, utimes[0:], unix.AT_SYMLINK_NOFOLLOW); err != nil {
+		return errors.Wrap(err, "failed call to UtimesNanoAt")
+	}
+
+	return nil
+}
+
+// handleTarTypeBlockCharFifo is an OS-specific helper function used by
+// createTarFile to handle the following types of header: Block; Char; Fifo
+func handleTarTypeBlockCharFifo(path string, stat *Stat) error {
+	mode := uint32(stat.Mode & 07777)
+	if os.FileMode(stat.Mode)&os.ModeCharDevice != 0 {
+		mode |= syscall.S_IFCHR
+	} else if os.FileMode(stat.Mode)&os.ModeNamedPipe != 0 {
+		mode |= syscall.S_IFIFO
+	} else {
+		mode |= syscall.S_IFBLK
+	}
+
+	if err := syscall.Mknod(path, mode, int(mkdev(stat.Devmajor, stat.Devminor))); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/diskwriter_windows.go b/components/engine/vendor/github.com/tonistiigi/fsutil/diskwriter_windows.go
new file mode 100644
index 0000000000..16a26f01c5
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/diskwriter_windows.go
@@ -0,0 +1,25 @@
+// +build windows
+
+package fsutil
+
+import (
+	"os"
+	"time"
+
+	"github.com/pkg/errors"
+)
+
+func rewriteMetadata(p string, stat *Stat) error {
+	return chtimes(p, stat.ModTime)
+}
+
+func chtimes(path string, un int64) error {
+	mtime := time.Unix(0, un)
+	return os.Chtimes(path, mtime, mtime)
+}
+
+// handleTarTypeBlockCharFifo is an OS-specific helper function used by
+// createTarFile to handle the following types of header: Block; Char; Fifo
+func handleTarTypeBlockCharFifo(path string, stat *Stat) error {
+	return errors.New("Not implemented on windows")
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/generate.go b/components/engine/vendor/github.com/tonistiigi/fsutil/generate.go
new file mode 100644
index 0000000000..e433195669
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/generate.go
@@ -0,0 +1,3 @@
+package fsutil
+
+//go:generate protoc --gogoslick_out=. stat.proto wire.proto
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/hardlinks.go b/components/engine/vendor/github.com/tonistiigi/fsutil/hardlinks.go
new file mode 100644
index 0000000000..e598ead7e6
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/hardlinks.go
@@ -0,0 +1,46 @@
+package fsutil
+
+import (
+	"os"
+
+	"github.com/pkg/errors"
+)
+
+// Hardlinks validates that all targets for links were part of the changes
+
+type Hardlinks struct {
+	seenFiles map[string]struct{}
+}
+
+func (v *Hardlinks) HandleChange(kind ChangeKind, p string, fi os.FileInfo, err error) error {
+	if err != nil {
+		return err
+	}
+
+	if v.seenFiles == nil {
+		v.seenFiles = make(map[string]struct{})
+	}
+
+	if kind == ChangeKindDelete {
+		return nil
+	}
+
+	stat, ok := fi.Sys().(*Stat)
+	if !ok {
+		return errors.Errorf("invalid change without stat info: %s", p)
+	}
+
+	if fi.IsDir() || fi.Mode()&os.ModeSymlink != 0 {
+		return nil
+	}
+
+	if len(stat.Linkname) > 0 {
+		if _, ok := v.seenFiles[stat.Linkname]; !ok {
+			return errors.Errorf("invalid link %s to unknown path: %q", p, stat.Linkname)
+		}
+	} else {
+		v.seenFiles[p] = struct{}{}
+	}
+
+	return nil
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/readme.md b/components/engine/vendor/github.com/tonistiigi/fsutil/readme.md
new file mode 100644
index 0000000000..5ce685b7ed
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/readme.md
@@ -0,0 +1,45 @@
+Incremental file directory sync tools in golang.
+
+```
+BENCH_FILE_SIZE=10000 ./bench.test --test.bench .
+BenchmarkCopyWithTar10-4                	    2000	    995242 ns/op
+BenchmarkCopyWithTar50-4                	     300	   4710021 ns/op
+BenchmarkCopyWithTar200-4               	     100	  16627260 ns/op
+BenchmarkCopyWithTar1000-4              	      20	  60031459 ns/op
+BenchmarkCPA10-4                        	    1000	   1678367 ns/op
+BenchmarkCPA50-4                        	     500	   3690306 ns/op
+BenchmarkCPA200-4                       	     200	   9495066 ns/op
+BenchmarkCPA1000-4                      	      50	  29769289 ns/op
+BenchmarkDiffCopy10-4                   	    2000	    943889 ns/op
+BenchmarkDiffCopy50-4                   	     500	   3285950 ns/op
+BenchmarkDiffCopy200-4                  	     200	   8563792 ns/op
+BenchmarkDiffCopy1000-4                 	      50	  29511340 ns/op
+BenchmarkDiffCopyProto10-4              	    2000	    944615 ns/op
+BenchmarkDiffCopyProto50-4              	     500	   3334940 ns/op
+BenchmarkDiffCopyProto200-4             	     200	   9420038 ns/op
+BenchmarkDiffCopyProto1000-4            	      50	  30632429 ns/op
+BenchmarkIncrementalDiffCopy10-4        	    2000	    691993 ns/op
+BenchmarkIncrementalDiffCopy50-4        	    1000	   1304253 ns/op
+BenchmarkIncrementalDiffCopy200-4       	     500	   3306519 ns/op
+BenchmarkIncrementalDiffCopy1000-4      	     200	  10211343 ns/op
+BenchmarkIncrementalDiffCopy5000-4      	      20	  55194427 ns/op
+BenchmarkIncrementalDiffCopy10000-4     	      20	  91759289 ns/op
+BenchmarkIncrementalCopyWithTar10-4     	    2000	   1020258 ns/op
+BenchmarkIncrementalCopyWithTar50-4     	     300	   5348786 ns/op
+BenchmarkIncrementalCopyWithTar200-4    	     100	  19495000 ns/op
+BenchmarkIncrementalCopyWithTar1000-4   	      20	  70338507 ns/op
+BenchmarkIncrementalRsync10-4           	      30	  45215754 ns/op
+BenchmarkIncrementalRsync50-4           	      30	  45837260 ns/op
+BenchmarkIncrementalRsync200-4          	      30	  48780614 ns/op
+BenchmarkIncrementalRsync1000-4         	      20	  54801892 ns/op
+BenchmarkIncrementalRsync5000-4         	      20	  84782542 ns/op
+BenchmarkIncrementalRsync10000-4        	      10	 103355108 ns/op
+BenchmarkRsync10-4                      	      30	  46776470 ns/op
+BenchmarkRsync50-4                      	      30	  48601555 ns/op
+BenchmarkRsync200-4                     	      20	  59642691 ns/op
+BenchmarkRsync1000-4                    	      20	 101343010 ns/op
+BenchmarkGnuTar10-4                     	     500	   3171448 ns/op
+BenchmarkGnuTar50-4                     	     300	   5030296 ns/op
+BenchmarkGnuTar200-4                    	     100	  10464313 ns/op
+BenchmarkGnuTar1000-4                   	      50	  30375257 ns/op
+```
\ No newline at end of file
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/receive.go b/components/engine/vendor/github.com/tonistiigi/fsutil/receive.go
new file mode 100644
index 0000000000..e7cee2b7ce
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/receive.go
@@ -0,0 +1,210 @@
+// +build linux windows
+
+package fsutil
+
+import (
+	"io"
+	"os"
+	"sync"
+
+	"github.com/pkg/errors"
+	"golang.org/x/net/context"
+	"golang.org/x/sync/errgroup"
+)
+
+func Receive(ctx context.Context, conn Stream, dest string, notifyHashed ChangeFunc) error {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	r := &receiver{
+		conn:         &syncStream{Stream: conn},
+		dest:         dest,
+		files:        make(map[string]uint32),
+		pipes:        make(map[uint32]io.WriteCloser),
+		notifyHashed: notifyHashed,
+	}
+	return r.run(ctx)
+}
+
+type receiver struct {
+	dest    string
+	conn    Stream
+	files   map[string]uint32
+	pipes   map[uint32]io.WriteCloser
+	mu      sync.RWMutex
+	muPipes sync.RWMutex
+
+	notifyHashed   ChangeFunc
+	orderValidator Validator
+	hlValidator    Hardlinks
+}
+
+type dynamicWalker struct {
+	walkChan chan *currentPath
+	closed   bool
+}
+
+func newDynamicWalker() *dynamicWalker {
+	return &dynamicWalker{
+		walkChan: make(chan *currentPath, 128),
+	}
+}
+
+func (w *dynamicWalker) update(p *currentPath) error {
+	if w.closed {
+		return errors.New("walker is closed")
+	}
+	if p == nil {
+		close(w.walkChan)
+		return nil
+	}
+	w.walkChan <- p
+	return nil
+}
+
+func (w *dynamicWalker) fill(ctx context.Context, pathC chan<- *currentPath) error {
+	for {
+		select {
+		case p, ok := <-w.walkChan:
+			if !ok {
+				return nil
+			}
+			pathC <- p
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+	return nil
+}
+
+func (r *receiver) run(ctx context.Context) error {
+	g, ctx := errgroup.WithContext(ctx)
+
+	dw, err := NewDiskWriter(ctx, r.dest, DiskWriterOpt{
+		AsyncDataCb: r.asyncDataFunc,
+		NotifyCb:    r.notifyHashed,
+	})
+	if err != nil {
+		return err
+	}
+
+	w := newDynamicWalker()
+
+	g.Go(func() error {
+		err := doubleWalkDiff(ctx, dw.HandleChange, GetWalkerFn(r.dest), w.fill)
+		if err != nil {
+			return err
+		}
+		if err := dw.Wait(ctx); err != nil {
+			return err
+		}
+		r.conn.SendMsg(&Packet{Type: PACKET_FIN})
+		return nil
+	})
+
+	g.Go(func() error {
+		var i uint32 = 0
+
+		var p Packet
+		for {
+			p = Packet{Data: p.Data[:0]}
+			if err := r.conn.RecvMsg(&p); err != nil {
+				return err
+			}
+			switch p.Type {
+			case PACKET_STAT:
+				if p.Stat == nil {
+					if err := w.update(nil); err != nil {
+						return err
+					}
+					break
+				}
+				if fileCanRequestData(os.FileMode(p.Stat.Mode)) {
+					r.mu.Lock()
+					r.files[p.Stat.Path] = i
+					r.mu.Unlock()
+				}
+				i++
+				cp := &currentPath{path: p.Stat.Path, f: &StatInfo{p.Stat}}
+				if err := r.orderValidator.HandleChange(ChangeKindAdd, cp.path, cp.f, nil); err != nil {
+					return err
+				}
+				if err := r.hlValidator.HandleChange(ChangeKindAdd, cp.path, cp.f, nil); err != nil {
+					return err
+				}
+				if err := w.update(cp); err != nil {
+					return err
+				}
+			case PACKET_DATA:
+				r.muPipes.Lock()
+				pw, ok := r.pipes[p.ID]
+				r.muPipes.Unlock()
+				if !ok {
+					return errors.Errorf("invalid file request %s", p.ID)
+				}
+				if len(p.Data) == 0 {
+					if err := pw.Close(); err != nil {
+						return err
+					}
+				} else {
+					if _, err := pw.Write(p.Data); err != nil {
+						return err
+					}
+				}
+			case PACKET_FIN:
+				return nil
+			}
+		}
+	})
+	return g.Wait()
+}
+
+func (r *receiver) asyncDataFunc(ctx context.Context, p string, wc io.WriteCloser) error {
+	r.mu.Lock()
+	id, ok := r.files[p]
+	if !ok {
+		r.mu.Unlock()
+		return errors.Errorf("invalid file request %s", p)
+	}
+	delete(r.files, p)
+	r.mu.Unlock()
+
+	wwc := newWrappedWriteCloser(wc)
+	r.muPipes.Lock()
+	r.pipes[id] = wwc
+	r.muPipes.Unlock()
+	if err := r.conn.SendMsg(&Packet{Type: PACKET_REQ, ID: id}); err != nil {
+		return err
+	}
+	err := wwc.Wait(ctx)
+	r.muPipes.Lock()
+	delete(r.pipes, id)
+	r.muPipes.Unlock()
+	return err
+}
+
+type wrappedWriteCloser struct {
+	io.WriteCloser
+	err  error
+	once sync.Once
+	done chan struct{}
+}
+
+func newWrappedWriteCloser(wc io.WriteCloser) *wrappedWriteCloser {
+	return &wrappedWriteCloser{WriteCloser: wc, done: make(chan struct{})}
+}
+
+func (w *wrappedWriteCloser) Close() error {
+	w.err = w.WriteCloser.Close()
+	w.once.Do(func() { close(w.done) })
+	return w.err
+}
+
+func (w *wrappedWriteCloser) Wait(ctx context.Context) error {
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-w.done:
+		return w.err
+	}
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/receive_unsupported.go b/components/engine/vendor/github.com/tonistiigi/fsutil/receive_unsupported.go
new file mode 100644
index 0000000000..8e83342374
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/receive_unsupported.go
@@ -0,0 +1,14 @@
+// +build !linux,!windows
+
+package fsutil
+
+import (
+	"runtime"
+
+	"github.com/pkg/errors"
+	"golang.org/x/net/context"
+)
+
+func Receive(ctx context.Context, conn Stream, dest string, notifyHashed ChangeFunc) error {
+	return errors.Errorf("receive is unsupported in %s", runtime.GOOS)
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/send.go b/components/engine/vendor/github.com/tonistiigi/fsutil/send.go
new file mode 100644
index 0000000000..c7b6382c6c
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/send.go
@@ -0,0 +1,201 @@
+package fsutil
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"github.com/pkg/errors"
+	"golang.org/x/net/context"
+	"golang.org/x/sync/errgroup"
+)
+
+var bufPool = sync.Pool{
+	New: func() interface{} {
+		return make([]byte, 32*1<<10)
+	},
+}
+
+type Stream interface {
+	RecvMsg(interface{}) error
+	SendMsg(m interface{}) error
+	Context() context.Context
+}
+
+func Send(ctx context.Context, conn Stream, root string, opt *WalkOpt, progressCb func(int, bool)) error {
+	s := &sender{
+		conn:         &syncStream{Stream: conn},
+		root:         root,
+		opt:          opt,
+		files:        make(map[uint32]string),
+		progressCb:   progressCb,
+		sendpipeline: make(chan *sendHandle, 128),
+	}
+	return s.run(ctx)
+}
+
+type sendHandle struct {
+	id   uint32
+	path string
+}
+
+type sender struct {
+	conn            Stream
+	opt             *WalkOpt
+	root            string
+	files           map[uint32]string
+	mu              sync.RWMutex
+	progressCb      func(int, bool)
+	progressCurrent int
+	sendpipeline    chan *sendHandle
+}
+
+func (s *sender) run(ctx context.Context) error {
+	g, ctx := errgroup.WithContext(ctx)
+
+	defer s.updateProgress(0, true)
+
+	g.Go(func() error {
+		return s.walk(ctx)
+	})
+
+	for i := 0; i < 4; i++ {
+		g.Go(func() error {
+			for h := range s.sendpipeline {
+				select {
+				case <-ctx.Done():
+					return ctx.Err()
+				default:
+				}
+				if err := s.sendFile(h); err != nil {
+					return err
+				}
+			}
+			return nil
+		})
+	}
+
+	g.Go(func() error {
+		defer close(s.sendpipeline)
+
+		for {
+			select {
+			case <-ctx.Done():
+				return ctx.Err()
+			default:
+			}
+			var p Packet
+			if err := s.conn.RecvMsg(&p); err != nil {
+				return err
+			}
+			switch p.Type {
+			case PACKET_REQ:
+				if err := s.queue(p.ID); err != nil {
+					return err
+				}
+			case PACKET_FIN:
+				return s.conn.SendMsg(&Packet{Type: PACKET_FIN})
+			}
+		}
+	})
+
+	return g.Wait()
+}
+
+func (s *sender) updateProgress(size int, last bool) {
+	if s.progressCb != nil {
+		s.progressCurrent += size
+		s.progressCb(s.progressCurrent, last)
+	}
+}
+
+func (s *sender) queue(id uint32) error {
+	s.mu.Lock()
+	p, ok := s.files[id]
+	if !ok {
+		s.mu.Unlock()
+		return errors.Errorf("invalid file id %d", id)
+	}
+	delete(s.files, id)
+	s.mu.Unlock()
+	s.sendpipeline <- &sendHandle{id, p}
+	return nil
+}
+
+func (s *sender) sendFile(h *sendHandle) error {
+	f, err := os.Open(filepath.Join(s.root, h.path))
+	if err == nil {
+		buf := bufPool.Get().([]byte)
+		defer bufPool.Put(buf)
+		if _, err := io.CopyBuffer(&fileSender{sender: s, id: h.id}, f, buf); err != nil {
+			return err
+		}
+	}
+	return s.conn.SendMsg(&Packet{ID: h.id, Type: PACKET_DATA})
+}
+
+func (s *sender) walk(ctx context.Context) error {
+	var i uint32 = 0
+	err := Walk(ctx, s.root, s.opt, func(path string, fi os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		stat, ok := fi.Sys().(*Stat)
+		if !ok {
+			return errors.Wrapf(err, "invalid fileinfo without stat info: %s", path)
+		}
+
+		p := &Packet{
+			Type: PACKET_STAT,
+			Stat: stat,
+		}
+		if fileCanRequestData(os.FileMode(stat.Mode)) {
+			s.mu.Lock()
+			s.files[i] = stat.Path
+			s.mu.Unlock()
+		}
+		i++
+		s.updateProgress(p.Size(), false)
+		return errors.Wrapf(s.conn.SendMsg(p), "failed to send stat %s", path)
+	})
+	if err != nil {
+		return err
+	}
+	return errors.Wrapf(s.conn.SendMsg(&Packet{Type: PACKET_STAT}), "failed to send last stat")
+}
+
+func fileCanRequestData(m os.FileMode) bool {
+	// avoid updating this function as it needs to match between sender/receiver.
+	// version if needed
+	return m&os.ModeType == 0
+}
+
+type fileSender struct {
+	sender *sender
+	id     uint32
+}
+
+func (fs *fileSender) Write(dt []byte) (int, error) {
+	if len(dt) == 0 {
+		return 0, nil
+	}
+	p := &Packet{Type: PACKET_DATA, ID: fs.id, Data: dt}
+	if err := fs.sender.conn.SendMsg(p); err != nil {
+		return 0, err
+	}
+	fs.sender.updateProgress(p.Size(), false)
+	return len(dt), nil
+}
+
+type syncStream struct {
+	Stream
+	mu sync.Mutex
+}
+
+func (ss *syncStream) SendMsg(m interface{}) error {
+	ss.mu.Lock()
+	err := ss.Stream.SendMsg(m)
+	ss.mu.Unlock()
+	return err
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/stat.pb.go b/components/engine/vendor/github.com/tonistiigi/fsutil/stat.pb.go
new file mode 100644
index 0000000000..3f6925e4b0
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/stat.pb.go
@@ -0,0 +1,931 @@
+// Code generated by protoc-gen-gogo.
+// source: stat.proto
+// DO NOT EDIT!
+
+/*
+	Package fsutil is a generated protocol buffer package.
+
+	It is generated from these files:
+		stat.proto
+		wire.proto
+
+	It has these top-level messages:
+		Stat
+		Packet
+*/
+package fsutil
+
+import proto "github.com/gogo/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
+import bytes "bytes"
+
+import strings "strings"
+import reflect "reflect"
+import github_com_gogo_protobuf_sortkeys "github.com/gogo/protobuf/sortkeys"
+
+import io "io"
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+
+type Stat struct {
+	Path    string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
+	Mode    uint32 `protobuf:"varint,2,opt,name=mode,proto3" json:"mode,omitempty"`
+	Uid     uint32 `protobuf:"varint,3,opt,name=uid,proto3" json:"uid,omitempty"`
+	Gid     uint32 `protobuf:"varint,4,opt,name=gid,proto3" json:"gid,omitempty"`
+	Size_   int64  `protobuf:"varint,5,opt,name=size,proto3" json:"size,omitempty"`
+	ModTime int64  `protobuf:"varint,6,opt,name=modTime,proto3" json:"modTime,omitempty"`
+	// int32 typeflag = 7;
+	Linkname string            `protobuf:"bytes,7,opt,name=linkname,proto3" json:"linkname,omitempty"`
+	Devmajor int64             `protobuf:"varint,8,opt,name=devmajor,proto3" json:"devmajor,omitempty"`
+	Devminor int64             `protobuf:"varint,9,opt,name=devminor,proto3" json:"devminor,omitempty"`
+	Xattrs   map[string][]byte `protobuf:"bytes,10,rep,name=xattrs" json:"xattrs,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (m *Stat) Reset()                    { *m = Stat{} }
+func (*Stat) ProtoMessage()               {}
+func (*Stat) Descriptor() ([]byte, []int) { return fileDescriptorStat, []int{0} }
+
+func (m *Stat) GetPath() string {
+	if m != nil {
+		return m.Path
+	}
+	return ""
+}
+
+func (m *Stat) GetMode() uint32 {
+	if m != nil {
+		return m.Mode
+	}
+	return 0
+}
+
+func (m *Stat) GetUid() uint32 {
+	if m != nil {
+		return m.Uid
+	}
+	return 0
+}
+
+func (m *Stat) GetGid() uint32 {
+	if m != nil {
+		return m.Gid
+	}
+	return 0
+}
+
+func (m *Stat) GetSize_() int64 {
+	if m != nil {
+		return m.Size_
+	}
+	return 0
+}
+
+func (m *Stat) GetModTime() int64 {
+	if m != nil {
+		return m.ModTime
+	}
+	return 0
+}
+
+func (m *Stat) GetLinkname() string {
+	if m != nil {
+		return m.Linkname
+	}
+	return ""
+}
+
+func (m *Stat) GetDevmajor() int64 {
+	if m != nil {
+		return m.Devmajor
+	}
+	return 0
+}
+
+func (m *Stat) GetDevminor() int64 {
+	if m != nil {
+		return m.Devminor
+	}
+	return 0
+}
+
+func (m *Stat) GetXattrs() map[string][]byte {
+	if m != nil {
+		return m.Xattrs
+	}
+	return nil
+}
+
+func init() {
+	proto.RegisterType((*Stat)(nil), "fsutil.Stat")
+}
+func (this *Stat) Equal(that interface{}) bool {
+	if that == nil {
+		if this == nil {
+			return true
+		}
+		return false
+	}
+
+	that1, ok := that.(*Stat)
+	if !ok {
+		that2, ok := that.(Stat)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		if this == nil {
+			return true
+		}
+		return false
+	} else if this == nil {
+		return false
+	}
+	if this.Path != that1.Path {
+		return false
+	}
+	if this.Mode != that1.Mode {
+		return false
+	}
+	if this.Uid != that1.Uid {
+		return false
+	}
+	if this.Gid != that1.Gid {
+		return false
+	}
+	if this.Size_ != that1.Size_ {
+		return false
+	}
+	if this.ModTime != that1.ModTime {
+		return false
+	}
+	if this.Linkname != that1.Linkname {
+		return false
+	}
+	if this.Devmajor != that1.Devmajor {
+		return false
+	}
+	if this.Devminor != that1.Devminor {
+		return false
+	}
+	if len(this.Xattrs) != len(that1.Xattrs) {
+		return false
+	}
+	for i := range this.Xattrs {
+		if !bytes.Equal(this.Xattrs[i], that1.Xattrs[i]) {
+			return false
+		}
+	}
+	return true
+}
+func (this *Stat) GoString() string {
+	if this == nil {
+		return "nil"
+	}
+	s := make([]string, 0, 14)
+	s = append(s, "&fsutil.Stat{")
+	s = append(s, "Path: "+fmt.Sprintf("%#v", this.Path)+",\n")
+	s = append(s, "Mode: "+fmt.Sprintf("%#v", this.Mode)+",\n")
+	s = append(s, "Uid: "+fmt.Sprintf("%#v", this.Uid)+",\n")
+	s = append(s, "Gid: "+fmt.Sprintf("%#v", this.Gid)+",\n")
+	s = append(s, "Size_: "+fmt.Sprintf("%#v", this.Size_)+",\n")
+	s = append(s, "ModTime: "+fmt.Sprintf("%#v", this.ModTime)+",\n")
+	s = append(s, "Linkname: "+fmt.Sprintf("%#v", this.Linkname)+",\n")
+	s = append(s, "Devmajor: "+fmt.Sprintf("%#v", this.Devmajor)+",\n")
+	s = append(s, "Devminor: "+fmt.Sprintf("%#v", this.Devminor)+",\n")
+	keysForXattrs := make([]string, 0, len(this.Xattrs))
+	for k, _ := range this.Xattrs {
+		keysForXattrs = append(keysForXattrs, k)
+	}
+	github_com_gogo_protobuf_sortkeys.Strings(keysForXattrs)
+	mapStringForXattrs := "map[string][]byte{"
+	for _, k := range keysForXattrs {
+		mapStringForXattrs += fmt.Sprintf("%#v: %#v,", k, this.Xattrs[k])
+	}
+	mapStringForXattrs += "}"
+	if this.Xattrs != nil {
+		s = append(s, "Xattrs: "+mapStringForXattrs+",\n")
+	}
+	s = append(s, "}")
+	return strings.Join(s, "")
+}
+func valueToGoStringStat(v interface{}, typ string) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
+}
+func (m *Stat) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Stat) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.Path) > 0 {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintStat(dAtA, i, uint64(len(m.Path)))
+		i += copy(dAtA[i:], m.Path)
+	}
+	if m.Mode != 0 {
+		dAtA[i] = 0x10
+		i++
+		i = encodeVarintStat(dAtA, i, uint64(m.Mode))
+	}
+	if m.Uid != 0 {
+		dAtA[i] = 0x18
+		i++
+		i = encodeVarintStat(dAtA, i, uint64(m.Uid))
+	}
+	if m.Gid != 0 {
+		dAtA[i] = 0x20
+		i++
+		i = encodeVarintStat(dAtA, i, uint64(m.Gid))
+	}
+	if m.Size_ != 0 {
+		dAtA[i] = 0x28
+		i++
+		i = encodeVarintStat(dAtA, i, uint64(m.Size_))
+	}
+	if m.ModTime != 0 {
+		dAtA[i] = 0x30
+		i++
+		i = encodeVarintStat(dAtA, i, uint64(m.ModTime))
+	}
+	if len(m.Linkname) > 0 {
+		dAtA[i] = 0x3a
+		i++
+		i = encodeVarintStat(dAtA, i, uint64(len(m.Linkname)))
+		i += copy(dAtA[i:], m.Linkname)
+	}
+	if m.Devmajor != 0 {
+		dAtA[i] = 0x40
+		i++
+		i = encodeVarintStat(dAtA, i, uint64(m.Devmajor))
+	}
+	if m.Devminor != 0 {
+		dAtA[i] = 0x48
+		i++
+		i = encodeVarintStat(dAtA, i, uint64(m.Devminor))
+	}
+	if len(m.Xattrs) > 0 {
+		for k, _ := range m.Xattrs {
+			dAtA[i] = 0x52
+			i++
+			v := m.Xattrs[k]
+			byteSize := 0
+			if len(v) > 0 {
+				byteSize = 1 + len(v) + sovStat(uint64(len(v)))
+			}
+			mapSize := 1 + len(k) + sovStat(uint64(len(k))) + byteSize
+			i = encodeVarintStat(dAtA, i, uint64(mapSize))
+			dAtA[i] = 0xa
+			i++
+			i = encodeVarintStat(dAtA, i, uint64(len(k)))
+			i += copy(dAtA[i:], k)
+			if len(v) > 0 {
+				dAtA[i] = 0x12
+				i++
+				i = encodeVarintStat(dAtA, i, uint64(len(v)))
+				i += copy(dAtA[i:], v)
+			}
+		}
+	}
+	return i, nil
+}
+
+func encodeFixed64Stat(dAtA []byte, offset int, v uint64) int {
+	dAtA[offset] = uint8(v)
+	dAtA[offset+1] = uint8(v >> 8)
+	dAtA[offset+2] = uint8(v >> 16)
+	dAtA[offset+3] = uint8(v >> 24)
+	dAtA[offset+4] = uint8(v >> 32)
+	dAtA[offset+5] = uint8(v >> 40)
+	dAtA[offset+6] = uint8(v >> 48)
+	dAtA[offset+7] = uint8(v >> 56)
+	return offset + 8
+}
+func encodeFixed32Stat(dAtA []byte, offset int, v uint32) int {
+	dAtA[offset] = uint8(v)
+	dAtA[offset+1] = uint8(v >> 8)
+	dAtA[offset+2] = uint8(v >> 16)
+	dAtA[offset+3] = uint8(v >> 24)
+	return offset + 4
+}
+func encodeVarintStat(dAtA []byte, offset int, v uint64) int {
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return offset + 1
+}
+func (m *Stat) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.Path)
+	if l > 0 {
+		n += 1 + l + sovStat(uint64(l))
+	}
+	if m.Mode != 0 {
+		n += 1 + sovStat(uint64(m.Mode))
+	}
+	if m.Uid != 0 {
+		n += 1 + sovStat(uint64(m.Uid))
+	}
+	if m.Gid != 0 {
+		n += 1 + sovStat(uint64(m.Gid))
+	}
+	if m.Size_ != 0 {
+		n += 1 + sovStat(uint64(m.Size_))
+	}
+	if m.ModTime != 0 {
+		n += 1 + sovStat(uint64(m.ModTime))
+	}
+	l = len(m.Linkname)
+	if l > 0 {
+		n += 1 + l + sovStat(uint64(l))
+	}
+	if m.Devmajor != 0 {
+		n += 1 + sovStat(uint64(m.Devmajor))
+	}
+	if m.Devminor != 0 {
+		n += 1 + sovStat(uint64(m.Devminor))
+	}
+	if len(m.Xattrs) > 0 {
+		for k, v := range m.Xattrs {
+			_ = k
+			_ = v
+			l = 0
+			if len(v) > 0 {
+				l = 1 + len(v) + sovStat(uint64(len(v)))
+			}
+			mapEntrySize := 1 + len(k) + sovStat(uint64(len(k))) + l
+			n += mapEntrySize + 1 + sovStat(uint64(mapEntrySize))
+		}
+	}
+	return n
+}
+
+func sovStat(x uint64) (n int) {
+	for {
+		n++
+		x >>= 7
+		if x == 0 {
+			break
+		}
+	}
+	return n
+}
+func sozStat(x uint64) (n int) {
+	return sovStat(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *Stat) String() string {
+	if this == nil {
+		return "nil"
+	}
+	keysForXattrs := make([]string, 0, len(this.Xattrs))
+	for k, _ := range this.Xattrs {
+		keysForXattrs = append(keysForXattrs, k)
+	}
+	github_com_gogo_protobuf_sortkeys.Strings(keysForXattrs)
+	mapStringForXattrs := "map[string][]byte{"
+	for _, k := range keysForXattrs {
+		mapStringForXattrs += fmt.Sprintf("%v: %v,", k, this.Xattrs[k])
+	}
+	mapStringForXattrs += "}"
+	s := strings.Join([]string{`&Stat{`,
+		`Path:` + fmt.Sprintf("%v", this.Path) + `,`,
+		`Mode:` + fmt.Sprintf("%v", this.Mode) + `,`,
+		`Uid:` + fmt.Sprintf("%v", this.Uid) + `,`,
+		`Gid:` + fmt.Sprintf("%v", this.Gid) + `,`,
+		`Size_:` + fmt.Sprintf("%v", this.Size_) + `,`,
+		`ModTime:` + fmt.Sprintf("%v", this.ModTime) + `,`,
+		`Linkname:` + fmt.Sprintf("%v", this.Linkname) + `,`,
+		`Devmajor:` + fmt.Sprintf("%v", this.Devmajor) + `,`,
+		`Devminor:` + fmt.Sprintf("%v", this.Devminor) + `,`,
+		`Xattrs:` + mapStringForXattrs + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringStat(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *Stat) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowStat
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Stat: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Stat: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStat
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthStat
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Path = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Mode", wireType)
+			}
+			m.Mode = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStat
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Mode |= (uint32(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Uid", wireType)
+			}
+			m.Uid = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStat
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Uid |= (uint32(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Gid", wireType)
+			}
+			m.Gid = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStat
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Gid |= (uint32(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Size_", wireType)
+			}
+			m.Size_ = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStat
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Size_ |= (int64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ModTime", wireType)
+			}
+			m.ModTime = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStat
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ModTime |= (int64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Linkname", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStat
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthStat
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Linkname = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Devmajor", wireType)
+			}
+			m.Devmajor = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStat
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Devmajor |= (int64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Devminor", wireType)
+			}
+			m.Devminor = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStat
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Devminor |= (int64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Xattrs", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStat
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthStat
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var keykey uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStat
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				keykey |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			var stringLenmapkey uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowStat
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLenmapkey |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLenmapkey := int(stringLenmapkey)
+			if intStringLenmapkey < 0 {
+				return ErrInvalidLengthStat
+			}
+			postStringIndexmapkey := iNdEx + intStringLenmapkey
+			if postStringIndexmapkey > l {
+				return io.ErrUnexpectedEOF
+			}
+			mapkey := string(dAtA[iNdEx:postStringIndexmapkey])
+			iNdEx = postStringIndexmapkey
+			if m.Xattrs == nil {
+				m.Xattrs = make(map[string][]byte)
+			}
+			if iNdEx < postIndex {
+				var valuekey uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowStat
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					valuekey |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				var mapbyteLen uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowStat
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					mapbyteLen |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				intMapbyteLen := int(mapbyteLen)
+				if intMapbyteLen < 0 {
+					return ErrInvalidLengthStat
+				}
+				postbytesIndex := iNdEx + intMapbyteLen
+				if postbytesIndex > l {
+					return io.ErrUnexpectedEOF
+				}
+				mapvalue := make([]byte, mapbyteLen)
+				copy(mapvalue, dAtA[iNdEx:postbytesIndex])
+				iNdEx = postbytesIndex
+				m.Xattrs[mapkey] = mapvalue
+			} else {
+				var mapvalue []byte
+				m.Xattrs[mapkey] = mapvalue
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipStat(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthStat
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipStat(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowStat
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowStat
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+			return iNdEx, nil
+		case 1:
+			iNdEx += 8
+			return iNdEx, nil
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowStat
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			iNdEx += length
+			if length < 0 {
+				return 0, ErrInvalidLengthStat
+			}
+			return iNdEx, nil
+		case 3:
+			for {
+				var innerWire uint64
+				var start int = iNdEx
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return 0, ErrIntOverflowStat
+					}
+					if iNdEx >= l {
+						return 0, io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					innerWire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				innerWireType := int(innerWire & 0x7)
+				if innerWireType == 4 {
+					break
+				}
+				next, err := skipStat(dAtA[start:])
+				if err != nil {
+					return 0, err
+				}
+				iNdEx = start + next
+			}
+			return iNdEx, nil
+		case 4:
+			return iNdEx, nil
+		case 5:
+			iNdEx += 4
+			return iNdEx, nil
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+	}
+	panic("unreachable")
+}
+
+var (
+	ErrInvalidLengthStat = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowStat   = fmt.Errorf("proto: integer overflow")
+)
+
+func init() { proto.RegisterFile("stat.proto", fileDescriptorStat) }
+
+var fileDescriptorStat = []byte{
+	// 303 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x4c, 0x91, 0xb1, 0x4e, 0xf3, 0x30,
+	0x14, 0x85, 0x73, 0x9b, 0x36, 0x6d, 0xdd, 0xff, 0x97, 0x90, 0xc5, 0x70, 0xd5, 0xc1, 0x8a, 0x98,
+	0x32, 0xa0, 0x08, 0xc1, 0x02, 0x8c, 0x48, 0xbc, 0x40, 0x60, 0x60, 0x35, 0xb2, 0x29, 0xa6, 0x4d,
+	0x5c, 0x25, 0x4e, 0x45, 0x99, 0x78, 0x04, 0x1e, 0x83, 0xd7, 0x60, 0x63, 0xec, 0xc8, 0x48, 0xcc,
+	0xc2, 0xd8, 0x47, 0x40, 0x76, 0xda, 0xc2, 0x76, 0xce, 0x77, 0x7c, 0x65, 0x9d, 0x7b, 0x09, 0xa9,
+	0x0c, 0x37, 0xe9, 0xbc, 0xd4, 0x46, 0xd3, 0xe8, 0xae, 0xaa, 0x8d, 0x9a, 0x1d, 0xbc, 0x75, 0x48,
+	0xf7, 0xca, 0x70, 0x43, 0x29, 0xe9, 0xce, 0xb9, 0xb9, 0x47, 0x88, 0x21, 0x19, 0x66, 0x5e, 0x3b,
+	0x96, 0x6b, 0x21, 0xb1, 0x13, 0x43, 0xf2, 0x3f, 0xf3, 0x9a, 0xee, 0x91, 0xb0, 0x56, 0x02, 0x43,
+	0x8f, 0x9c, 0x74, 0x64, 0xa2, 0x04, 0x76, 0x5b, 0x32, 0x51, 0xc2, 0xcd, 0x55, 0xea, 0x49, 0x62,
+	0x2f, 0x86, 0x24, 0xcc, 0xbc, 0xa6, 0x48, 0xfa, 0xb9, 0x16, 0xd7, 0x2a, 0x97, 0x18, 0x79, 0xbc,
+	0xb5, 0x74, 0x4c, 0x06, 0x33, 0x55, 0x4c, 0x0b, 0x9e, 0x4b, 0xec, 0xfb, 0xdf, 0x77, 0xde, 0x65,
+	0x42, 0x2e, 0x72, 0xfe, 0xa0, 0x4b, 0x1c, 0xf8, 0xb1, 0x9d, 0xdf, 0x66, 0xaa, 0xd0, 0x25, 0x0e,
+	0x7f, 0x33, 0xe7, 0xe9, 0x11, 0x89, 0x1e, 0xb9, 0x31, 0x65, 0x85, 0x24, 0x0e, 0x93, 0xd1, 0x31,
+	0xa6, 0x6d, 0xdf, 0xd4, 0x75, 0x4d, 0x6f, 0x7c, 0x74, 0x59, 0x98, 0x72, 0x99, 0x6d, 0xde, 0x8d,
+	0xcf, 0xc8, 0xe8, 0x0f, 0x76, 0xa5, 0xa6, 0x72, 0xb9, 0xd9, 0x86, 0x93, 0x74, 0x9f, 0xf4, 0x16,
+	0x7c, 0x56, 0xb7, 0xdb, 0xf8, 0x97, 0xb5, 0xe6, 0xbc, 0x73, 0x0a, 0x17, 0x87, 0xab, 0x86, 0x05,
+	0x1f, 0x0d, 0x0b, 0xd6, 0x0d, 0x83, 0x67, 0xcb, 0xe0, 0xd5, 0x32, 0x78, 0xb7, 0x0c, 0x56, 0x96,
+	0xc1, 0xa7, 0x65, 0xf0, 0x6d, 0x59, 0xb0, 0xb6, 0x0c, 0x5e, 0xbe, 0x58, 0x70, 0x1b, 0xf9, 0x03,
+	0x9c, 0xfc, 0x04, 0x00, 0x00, 0xff, 0xff, 0x19, 0x97, 0x14, 0xf4, 0x8e, 0x01, 0x00, 0x00,
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/stat.proto b/components/engine/vendor/github.com/tonistiigi/fsutil/stat.proto
new file mode 100644
index 0000000000..e279413074
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/stat.proto
@@ -0,0 +1,17 @@
+syntax = "proto3";
+
+package fsutil;
+
+message Stat {
+  string path = 1;
+  uint32 mode = 2;
+  uint32 uid = 3;
+  uint32 gid = 4;
+  int64 size = 5;
+  int64 modTime = 6;
+  // int32 typeflag = 7;
+  string linkname = 7;
+  int64 devmajor = 8;
+  int64 devminor = 9;
+  map<string, bytes> xattrs = 10;
+}
\ No newline at end of file
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/validator.go b/components/engine/vendor/github.com/tonistiigi/fsutil/validator.go
new file mode 100644
index 0000000000..e4a5eba66b
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/validator.go
@@ -0,0 +1,88 @@
+package fsutil
+
+import (
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"github.com/pkg/errors"
+)
+
+type parent struct {
+	dir  string
+	last string
+}
+
+type Validator struct {
+	parentDirs []parent
+}
+
+func (v *Validator) HandleChange(kind ChangeKind, p string, fi os.FileInfo, err error) (retErr error) {
+	if err != nil {
+		return err
+	}
+	// test that all paths are in order and all parent dirs were present
+	if v.parentDirs == nil {
+		v.parentDirs = make([]parent, 1, 10)
+	}
+	if p != filepath.Clean(p) {
+		return errors.Errorf("invalid unclean path %s", p)
+	}
+	if filepath.IsAbs(p) {
+		return errors.Errorf("abolute path %s not allowed", p)
+	}
+	dir := filepath.Dir(p)
+	base := filepath.Base(p)
+	if dir == "." {
+		dir = ""
+	}
+	if dir == ".." || strings.HasPrefix(p, "../") {
+		return errors.Errorf("invalid path: %s", p)
+	}
+
+	// find a parent dir from saved records
+	i := sort.Search(len(v.parentDirs), func(i int) bool {
+		return ComparePath(v.parentDirs[len(v.parentDirs)-1-i].dir, dir) <= 0
+	})
+	i = len(v.parentDirs) - 1 - i
+	if i != len(v.parentDirs)-1 { // skipping back to grandparent
+		v.parentDirs = v.parentDirs[:i+1]
+	}
+
+	if dir != v.parentDirs[len(v.parentDirs)-1].dir || v.parentDirs[i].last >= base {
+		return errors.Errorf("changes out of order: %q %q", p, filepath.Join(v.parentDirs[i].dir, v.parentDirs[i].last))
+	}
+	v.parentDirs[i].last = base
+	if kind != ChangeKindDelete && fi.IsDir() {
+		v.parentDirs = append(v.parentDirs, parent{
+			dir:  filepath.Join(dir, base),
+			last: "",
+		})
+	}
+	// todo: validate invalid mode combinations
+	return err
+}
+
+func ComparePath(p1, p2 string) int {
+	// byte-by-byte comparison to be compatible with str<>str
+	min := min(len(p1), len(p2))
+	for i := 0; i < min; i++ {
+		switch {
+		case p1[i] == p2[i]:
+			continue
+		case p2[i] != '/' && p1[i] < p2[i] || p1[i] == '/':
+			return -1
+		default:
+			return 1
+		}
+	}
+	return len(p1) - len(p2)
+}
+
+func min(x, y int) int {
+	if x < y {
+		return x
+	}
+	return y
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/walker.go b/components/engine/vendor/github.com/tonistiigi/fsutil/walker.go
new file mode 100644
index 0000000000..bfec609b5a
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/walker.go
@@ -0,0 +1,170 @@
+package fsutil
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/docker/docker/pkg/fileutils"
+	"github.com/pkg/errors"
+	"golang.org/x/net/context"
+)
+
+type WalkOpt struct {
+	IncludePaths    []string // todo: remove?
+	ExcludePatterns []string
+}
+
+func Walk(ctx context.Context, p string, opt *WalkOpt, fn filepath.WalkFunc) error {
+	root, err := filepath.EvalSymlinks(p)
+	if err != nil {
+		return errors.Wrapf(err, "failed to resolve %s", root)
+	}
+	fi, err := os.Stat(root)
+	if err != nil {
+		return errors.Wrapf(err, "failed to stat: %s", root)
+	}
+	if !fi.IsDir() {
+		return errors.Errorf("%s is not a directory", root)
+	}
+
+	var pm *fileutils.PatternMatcher
+	if opt != nil && opt.ExcludePatterns != nil {
+		pm, err = fileutils.NewPatternMatcher(opt.ExcludePatterns)
+		if err != nil {
+			return errors.Wrapf(err, "invalid excludepaths %s", opt.ExcludePatterns)
+		}
+	}
+
+	seenFiles := make(map[uint64]string)
+	return filepath.Walk(root, func(path string, fi os.FileInfo, err error) error {
+		if err != nil {
+			if os.IsNotExist(err) {
+				return filepath.SkipDir
+			}
+			return err
+		}
+		origpath := path
+		path, err = filepath.Rel(root, path)
+		if err != nil {
+			return err
+		}
+		// Skip root
+		if path == "." {
+			return nil
+		}
+
+		if opt != nil {
+			if opt.IncludePaths != nil {
+				matched := false
+				for _, p := range opt.IncludePaths {
+					if m, _ := filepath.Match(p, path); m {
+						matched = true
+						break
+					}
+				}
+				if !matched {
+					if fi.IsDir() {
+						return filepath.SkipDir
+					}
+					return nil
+				}
+			}
+			if pm != nil {
+				m, err := pm.Matches(path)
+				if err != nil {
+					return errors.Wrap(err, "failed to match excludepatterns")
+				}
+
+				if m {
+					if fi.IsDir() {
+						if !pm.Exclusions() {
+							return filepath.SkipDir
+						}
+						dirSlash := path + string(filepath.Separator)
+						for _, pat := range pm.Patterns() {
+							if !pat.Exclusion() {
+								continue
+							}
+							patStr := pat.String() + string(filepath.Separator)
+							if strings.HasPrefix(patStr, dirSlash) {
+								goto passedFilter
+							}
+						}
+						return filepath.SkipDir
+					}
+					return nil
+				}
+			}
+		}
+
+	passedFilter:
+		path = filepath.ToSlash(path)
+
+		stat := &Stat{
+			Path:    path,
+			Mode:    uint32(fi.Mode()),
+			Size_:   fi.Size(),
+			ModTime: fi.ModTime().UnixNano(),
+		}
+
+		setUnixOpt(fi, stat, path, seenFiles)
+
+		if !fi.IsDir() {
+			if fi.Mode()&os.ModeSymlink != 0 {
+				link, err := os.Readlink(origpath)
+				if err != nil {
+					return errors.Wrapf(err, "failed to readlink %s", origpath)
+				}
+				stat.Linkname = link
+			}
+		}
+		if err := loadXattr(origpath, stat); err != nil {
+			return errors.Wrapf(err, "failed to xattr %s", path)
+		}
+
+		if runtime.GOOS == "windows" {
+			permPart := stat.Mode & uint32(os.ModePerm)
+			noPermPart := stat.Mode &^ uint32(os.ModePerm)
+			// Add the x bit: make everything +x from windows
+			permPart |= 0111
+			permPart &= 0755
+			stat.Mode = noPermPart | permPart
+		}
+
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+			if err := fn(path, &StatInfo{stat}, nil); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}
+
+type StatInfo struct {
+	*Stat
+}
+
+func (s *StatInfo) Name() string {
+	return filepath.Base(s.Stat.Path)
+}
+func (s *StatInfo) Size() int64 {
+	return s.Stat.Size_
+}
+func (s *StatInfo) Mode() os.FileMode {
+	return os.FileMode(s.Stat.Mode)
+}
+func (s *StatInfo) ModTime() time.Time {
+	return time.Unix(s.Stat.ModTime/1e9, s.Stat.ModTime%1e9)
+}
+func (s *StatInfo) IsDir() bool {
+	return s.Mode().IsDir()
+}
+func (s *StatInfo) Sys() interface{} {
+	return s.Stat
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/walker_unix.go b/components/engine/vendor/github.com/tonistiigi/fsutil/walker_unix.go
new file mode 100644
index 0000000000..6f13c956cb
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/walker_unix.go
@@ -0,0 +1,61 @@
+// +build !windows
+
+package fsutil
+
+import (
+	"os"
+	"syscall"
+
+	"github.com/pkg/errors"
+	"github.com/stevvooe/continuity/sysx"
+)
+
+func loadXattr(origpath string, stat *Stat) error {
+	xattrs, err := sysx.LListxattr(origpath)
+	if err != nil {
+		return errors.Wrapf(err, "failed to xattr %s", origpath)
+	}
+	if len(xattrs) > 0 {
+		m := make(map[string][]byte)
+		for _, key := range xattrs {
+			v, err := sysx.LGetxattr(origpath, key)
+			if err == nil {
+				m[key] = v
+			}
+		}
+		stat.Xattrs = m
+	}
+	return nil
+}
+
+func setUnixOpt(fi os.FileInfo, stat *Stat, path string, seenFiles map[uint64]string) {
+	s := fi.Sys().(*syscall.Stat_t)
+
+	stat.Uid = s.Uid
+	stat.Gid = s.Gid
+
+	if !fi.IsDir() {
+		if s.Mode&syscall.S_IFBLK != 0 ||
+			s.Mode&syscall.S_IFCHR != 0 {
+			stat.Devmajor = int64(major(uint64(s.Rdev)))
+			stat.Devminor = int64(minor(uint64(s.Rdev)))
+		}
+
+		ino := s.Ino
+		if s.Nlink > 1 {
+			if oldpath, ok := seenFiles[ino]; ok {
+				stat.Linkname = oldpath
+				stat.Size_ = 0
+			}
+		}
+		seenFiles[ino] = path
+	}
+}
+
+func major(device uint64) uint64 {
+	return (device >> 8) & 0xfff
+}
+
+func minor(device uint64) uint64 {
+	return (device & 0xff) | ((device >> 12) & 0xfff00)
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/walker_windows.go b/components/engine/vendor/github.com/tonistiigi/fsutil/walker_windows.go
new file mode 100644
index 0000000000..a1a2b45569
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/walker_windows.go
@@ -0,0 +1,14 @@
+// +build windows
+
+package fsutil
+
+import (
+	"os"
+)
+
+func loadXattr(_ string, _ *Stat) error {
+	return nil
+}
+
+func setUnixOpt(_ os.FileInfo, _ *Stat, _ string, _ map[uint64]string) {
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/wire.pb.go b/components/engine/vendor/github.com/tonistiigi/fsutil/wire.pb.go
new file mode 100644
index 0000000000..263fb126be
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/wire.pb.go
@@ -0,0 +1,563 @@
+// Code generated by protoc-gen-gogo.
+// source: wire.proto
+// DO NOT EDIT!
+
+package fsutil
+
+import proto "github.com/gogo/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
+import strconv "strconv"
+
+import bytes "bytes"
+
+import strings "strings"
+import reflect "reflect"
+
+import io "io"
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+type Packet_PacketType int32
+
+const (
+	PACKET_STAT Packet_PacketType = 0
+	PACKET_REQ  Packet_PacketType = 1
+	PACKET_DATA Packet_PacketType = 2
+	PACKET_FIN  Packet_PacketType = 3
+)
+
+var Packet_PacketType_name = map[int32]string{
+	0: "PACKET_STAT",
+	1: "PACKET_REQ",
+	2: "PACKET_DATA",
+	3: "PACKET_FIN",
+}
+var Packet_PacketType_value = map[string]int32{
+	"PACKET_STAT": 0,
+	"PACKET_REQ":  1,
+	"PACKET_DATA": 2,
+	"PACKET_FIN":  3,
+}
+
+func (Packet_PacketType) EnumDescriptor() ([]byte, []int) { return fileDescriptorWire, []int{0, 0} }
+
+type Packet struct {
+	Type Packet_PacketType `protobuf:"varint,1,opt,name=type,proto3,enum=fsutil.Packet_PacketType" json:"type,omitempty"`
+	Stat *Stat             `protobuf:"bytes,2,opt,name=stat" json:"stat,omitempty"`
+	ID   uint32            `protobuf:"varint,3,opt,name=ID,proto3" json:"ID,omitempty"`
+	Data []byte            `protobuf:"bytes,4,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (m *Packet) Reset()                    { *m = Packet{} }
+func (*Packet) ProtoMessage()               {}
+func (*Packet) Descriptor() ([]byte, []int) { return fileDescriptorWire, []int{0} }
+
+func (m *Packet) GetType() Packet_PacketType {
+	if m != nil {
+		return m.Type
+	}
+	return PACKET_STAT
+}
+
+func (m *Packet) GetStat() *Stat {
+	if m != nil {
+		return m.Stat
+	}
+	return nil
+}
+
+func (m *Packet) GetID() uint32 {
+	if m != nil {
+		return m.ID
+	}
+	return 0
+}
+
+func (m *Packet) GetData() []byte {
+	if m != nil {
+		return m.Data
+	}
+	return nil
+}
+
+func init() {
+	proto.RegisterType((*Packet)(nil), "fsutil.Packet")
+	proto.RegisterEnum("fsutil.Packet_PacketType", Packet_PacketType_name, Packet_PacketType_value)
+}
+func (x Packet_PacketType) String() string {
+	s, ok := Packet_PacketType_name[int32(x)]
+	if ok {
+		return s
+	}
+	return strconv.Itoa(int(x))
+}
+func (this *Packet) Equal(that interface{}) bool {
+	if that == nil {
+		if this == nil {
+			return true
+		}
+		return false
+	}
+
+	that1, ok := that.(*Packet)
+	if !ok {
+		that2, ok := that.(Packet)
+		if ok {
+			that1 = &that2
+		} else {
+			return false
+		}
+	}
+	if that1 == nil {
+		if this == nil {
+			return true
+		}
+		return false
+	} else if this == nil {
+		return false
+	}
+	if this.Type != that1.Type {
+		return false
+	}
+	if !this.Stat.Equal(that1.Stat) {
+		return false
+	}
+	if this.ID != that1.ID {
+		return false
+	}
+	if !bytes.Equal(this.Data, that1.Data) {
+		return false
+	}
+	return true
+}
+func (this *Packet) GoString() string {
+	if this == nil {
+		return "nil"
+	}
+	s := make([]string, 0, 8)
+	s = append(s, "&fsutil.Packet{")
+	s = append(s, "Type: "+fmt.Sprintf("%#v", this.Type)+",\n")
+	if this.Stat != nil {
+		s = append(s, "Stat: "+fmt.Sprintf("%#v", this.Stat)+",\n")
+	}
+	s = append(s, "ID: "+fmt.Sprintf("%#v", this.ID)+",\n")
+	s = append(s, "Data: "+fmt.Sprintf("%#v", this.Data)+",\n")
+	s = append(s, "}")
+	return strings.Join(s, "")
+}
+func valueToGoStringWire(v interface{}, typ string) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
+}
+func (m *Packet) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Packet) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if m.Type != 0 {
+		dAtA[i] = 0x8
+		i++
+		i = encodeVarintWire(dAtA, i, uint64(m.Type))
+	}
+	if m.Stat != nil {
+		dAtA[i] = 0x12
+		i++
+		i = encodeVarintWire(dAtA, i, uint64(m.Stat.Size()))
+		n1, err := m.Stat.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n1
+	}
+	if m.ID != 0 {
+		dAtA[i] = 0x18
+		i++
+		i = encodeVarintWire(dAtA, i, uint64(m.ID))
+	}
+	if len(m.Data) > 0 {
+		dAtA[i] = 0x22
+		i++
+		i = encodeVarintWire(dAtA, i, uint64(len(m.Data)))
+		i += copy(dAtA[i:], m.Data)
+	}
+	return i, nil
+}
+
+func encodeFixed64Wire(dAtA []byte, offset int, v uint64) int {
+	dAtA[offset] = uint8(v)
+	dAtA[offset+1] = uint8(v >> 8)
+	dAtA[offset+2] = uint8(v >> 16)
+	dAtA[offset+3] = uint8(v >> 24)
+	dAtA[offset+4] = uint8(v >> 32)
+	dAtA[offset+5] = uint8(v >> 40)
+	dAtA[offset+6] = uint8(v >> 48)
+	dAtA[offset+7] = uint8(v >> 56)
+	return offset + 8
+}
+func encodeFixed32Wire(dAtA []byte, offset int, v uint32) int {
+	dAtA[offset] = uint8(v)
+	dAtA[offset+1] = uint8(v >> 8)
+	dAtA[offset+2] = uint8(v >> 16)
+	dAtA[offset+3] = uint8(v >> 24)
+	return offset + 4
+}
+func encodeVarintWire(dAtA []byte, offset int, v uint64) int {
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return offset + 1
+}
+func (m *Packet) Size() (n int) {
+	var l int
+	_ = l
+	if m.Type != 0 {
+		n += 1 + sovWire(uint64(m.Type))
+	}
+	if m.Stat != nil {
+		l = m.Stat.Size()
+		n += 1 + l + sovWire(uint64(l))
+	}
+	if m.ID != 0 {
+		n += 1 + sovWire(uint64(m.ID))
+	}
+	l = len(m.Data)
+	if l > 0 {
+		n += 1 + l + sovWire(uint64(l))
+	}
+	return n
+}
+
+func sovWire(x uint64) (n int) {
+	for {
+		n++
+		x >>= 7
+		if x == 0 {
+			break
+		}
+	}
+	return n
+}
+func sozWire(x uint64) (n int) {
+	return sovWire(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *Packet) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Packet{`,
+		`Type:` + fmt.Sprintf("%v", this.Type) + `,`,
+		`Stat:` + strings.Replace(fmt.Sprintf("%v", this.Stat), "Stat", "Stat", 1) + `,`,
+		`ID:` + fmt.Sprintf("%v", this.ID) + `,`,
+		`Data:` + fmt.Sprintf("%v", this.Data) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringWire(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *Packet) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowWire
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Packet: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Packet: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			m.Type = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowWire
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Type |= (Packet_PacketType(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Stat", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowWire
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthWire
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Stat == nil {
+				m.Stat = &Stat{}
+			}
+			if err := m.Stat.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
+			}
+			m.ID = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowWire
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ID |= (uint32(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowWire
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthWire
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Data = append(m.Data[:0], dAtA[iNdEx:postIndex]...)
+			if m.Data == nil {
+				m.Data = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipWire(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthWire
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipWire(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowWire
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowWire
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+			return iNdEx, nil
+		case 1:
+			iNdEx += 8
+			return iNdEx, nil
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowWire
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			iNdEx += length
+			if length < 0 {
+				return 0, ErrInvalidLengthWire
+			}
+			return iNdEx, nil
+		case 3:
+			for {
+				var innerWire uint64
+				var start int = iNdEx
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return 0, ErrIntOverflowWire
+					}
+					if iNdEx >= l {
+						return 0, io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					innerWire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				innerWireType := int(innerWire & 0x7)
+				if innerWireType == 4 {
+					break
+				}
+				next, err := skipWire(dAtA[start:])
+				if err != nil {
+					return 0, err
+				}
+				iNdEx = start + next
+			}
+			return iNdEx, nil
+		case 4:
+			return iNdEx, nil
+		case 5:
+			iNdEx += 4
+			return iNdEx, nil
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+	}
+	panic("unreachable")
+}
+
+var (
+	ErrInvalidLengthWire = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowWire   = fmt.Errorf("proto: integer overflow")
+)
+
+func init() { proto.RegisterFile("wire.proto", fileDescriptorWire) }
+
+var fileDescriptorWire = []byte{
+	// 253 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xe2, 0xe2, 0x2a, 0xcf, 0x2c, 0x4a,
+	0xd5, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0x62, 0x4b, 0x2b, 0x2e, 0x2d, 0xc9, 0xcc, 0x91, 0xe2,
+	0x2a, 0x2e, 0x49, 0x2c, 0x81, 0x88, 0x29, 0x9d, 0x65, 0xe4, 0x62, 0x0b, 0x48, 0x4c, 0xce, 0x4e,
+	0x2d, 0x11, 0xd2, 0xe5, 0x62, 0x29, 0xa9, 0x2c, 0x48, 0x95, 0x60, 0x54, 0x60, 0xd4, 0xe0, 0x33,
+	0x92, 0xd4, 0x83, 0xa8, 0xd6, 0x83, 0xc8, 0x42, 0xa9, 0x90, 0xca, 0x82, 0xd4, 0x20, 0xb0, 0x32,
+	0x21, 0x05, 0x2e, 0x16, 0x90, 0x39, 0x12, 0x4c, 0x0a, 0x8c, 0x1a, 0xdc, 0x46, 0x3c, 0x30, 0xe5,
+	0xc1, 0x25, 0x89, 0x25, 0x41, 0x60, 0x19, 0x21, 0x3e, 0x2e, 0x26, 0x4f, 0x17, 0x09, 0x66, 0x05,
+	0x46, 0x0d, 0xde, 0x20, 0x26, 0x4f, 0x17, 0x21, 0x21, 0x2e, 0x96, 0x94, 0xc4, 0x92, 0x44, 0x09,
+	0x16, 0x05, 0x46, 0x0d, 0x9e, 0x20, 0x30, 0x5b, 0xc9, 0x8f, 0x8b, 0x0b, 0x61, 0xb2, 0x10, 0x3f,
+	0x17, 0x77, 0x80, 0xa3, 0xb3, 0xb7, 0x6b, 0x48, 0x7c, 0x70, 0x88, 0x63, 0x88, 0x00, 0x83, 0x10,
+	0x1f, 0x17, 0x17, 0x54, 0x20, 0xc8, 0x35, 0x50, 0x80, 0x11, 0x49, 0x81, 0x8b, 0x63, 0x88, 0xa3,
+	0x00, 0x13, 0x92, 0x02, 0x37, 0x4f, 0x3f, 0x01, 0x66, 0x27, 0x9d, 0x0b, 0x0f, 0xe5, 0x18, 0x6e,
+	0x3c, 0x94, 0x63, 0xf8, 0xf0, 0x50, 0x8e, 0xb1, 0xe1, 0x91, 0x1c, 0xe3, 0x8a, 0x47, 0x72, 0x8c,
+	0x27, 0x1e, 0xc9, 0x31, 0x5e, 0x78, 0x24, 0xc7, 0xf8, 0xe0, 0x91, 0x1c, 0xe3, 0x8b, 0x47, 0x72,
+	0x0c, 0x1f, 0x1e, 0xc9, 0x31, 0x4e, 0x78, 0x2c, 0xc7, 0x90, 0xc4, 0x06, 0x0e, 0x04, 0x63, 0x40,
+	0x00, 0x00, 0x00, 0xff, 0xff, 0xda, 0x30, 0x43, 0x22, 0x26, 0x01, 0x00, 0x00,
+}
diff --git a/components/engine/vendor/github.com/tonistiigi/fsutil/wire.proto b/components/engine/vendor/github.com/tonistiigi/fsutil/wire.proto
new file mode 100644
index 0000000000..d19432093f
--- /dev/null
+++ b/components/engine/vendor/github.com/tonistiigi/fsutil/wire.proto
@@ -0,0 +1,18 @@
+syntax = "proto3";
+
+package fsutil;
+
+import "stat.proto";
+
+message Packet {
+  enum PacketType {
+      PACKET_STAT = 0;
+      PACKET_REQ = 1;
+      PACKET_DATA = 2;
+      PACKET_FIN = 3;
+    }
+  PacketType type = 1;
+  Stat stat = 2;
+  uint32 ID = 3;
+  bytes data = 4;
+}
diff --git a/components/engine/vendor/github.com/vishvananda/netlink/addr.go b/components/engine/vendor/github.com/vishvananda/netlink/addr.go
index fe3e3d3668..f08c956969 100644
--- a/components/engine/vendor/github.com/vishvananda/netlink/addr.go
+++ b/components/engine/vendor/github.com/vishvananda/netlink/addr.go
@@ -10,11 +10,13 @@ import (
 // include a mask, so it stores the address as a net.IPNet.
 type Addr struct {
 	*net.IPNet
-	Label     string
-	Flags     int
-	Scope     int
-	Peer      *net.IPNet
-	Broadcast net.IP
+	Label       string
+	Flags       int
+	Scope       int
+	Peer        *net.IPNet
+	Broadcast   net.IP
+	PreferedLft int
+	ValidLft    int
 }
 
 // String returns $ip/$netmask $label
diff --git a/components/engine/vendor/github.com/vishvananda/netlink/addr_linux.go b/components/engine/vendor/github.com/vishvananda/netlink/addr_linux.go
index 220f0f22f1..f33242a7c2 100644
--- a/components/engine/vendor/github.com/vishvananda/netlink/addr_linux.go
+++ b/components/engine/vendor/github.com/vishvananda/netlink/addr_linux.go
@@ -195,10 +195,16 @@ func parseAddr(m []byte) (addr Addr, family, index int, err error) {
 				Mask: net.CIDRMask(int(msg.Prefixlen), 8*len(attr.Value)),
 			}
 			addr.IPNet = local
+		case syscall.IFA_BROADCAST:
+			addr.Broadcast = attr.Value
 		case syscall.IFA_LABEL:
 			addr.Label = string(attr.Value[:len(attr.Value)-1])
 		case IFA_FLAGS:
 			addr.Flags = int(native.Uint32(attr.Value[0:4]))
+		case nl.IFA_CACHEINFO:
+			ci := nl.DeserializeIfaCacheInfo(attr.Value)
+			addr.PreferedLft = int(ci.IfaPrefered)
+			addr.ValidLft = int(ci.IfaValid)
 		}
 	}
 
@@ -216,6 +222,10 @@ func parseAddr(m []byte) (addr Addr, family, index int, err error) {
 type AddrUpdate struct {
 	LinkAddress net.IPNet
 	LinkIndex   int
+	Flags       int
+	Scope       int
+	PreferedLft int
+	ValidLft    int
 	NewAddr     bool // true=added false=deleted
 }
 
@@ -263,7 +273,13 @@ func addrSubscribe(newNs, curNs netns.NsHandle, ch chan<- AddrUpdate, done <-cha
 					continue
 				}
 
-				ch <- AddrUpdate{LinkAddress: *addr.IPNet, LinkIndex: ifindex, NewAddr: msgType == syscall.RTM_NEWADDR}
+				ch <- AddrUpdate{LinkAddress: *addr.IPNet,
+					LinkIndex:   ifindex,
+					NewAddr:     msgType == syscall.RTM_NEWADDR,
+					Flags:       addr.Flags,
+					Scope:       addr.Scope,
+					PreferedLft: addr.PreferedLft,
+					ValidLft:    addr.ValidLft}
 			}
 		}
 	}()
diff --git a/components/engine/vendor/github.com/vishvananda/netlink/filter_linux.go b/components/engine/vendor/github.com/vishvananda/netlink/filter_linux.go
index eb1802c444..dc0f90af88 100644
--- a/components/engine/vendor/github.com/vishvananda/netlink/filter_linux.go
+++ b/components/engine/vendor/github.com/vishvananda/netlink/filter_linux.go
@@ -141,19 +141,19 @@ func (h *Handle) FilterAdd(filter Filter) error {
 		}
 
 		if native != networkOrder {
-			// Copy Tcu32Sel.
-			cSel := sel
+			// Copy TcU32Sel.
+			cSel := *sel
 			keys := make([]nl.TcU32Key, cap(sel.Keys))
 			copy(keys, sel.Keys)
 			cSel.Keys = keys
-			sel = cSel
+			sel = &cSel
 
 			// Handle the endianness of attributes
 			sel.Offmask = native.Uint16(htons(sel.Offmask))
 			sel.Hmask = native.Uint32(htonl(sel.Hmask))
-			for _, key := range sel.Keys {
-				key.Mask = native.Uint32(htonl(key.Mask))
-				key.Val = native.Uint32(htonl(key.Val))
+			for i, key := range sel.Keys {
+				sel.Keys[i].Mask = native.Uint32(htonl(key.Mask))
+				sel.Keys[i].Val = native.Uint32(htonl(key.Val))
 			}
 		}
 		sel.Nkeys = uint8(len(sel.Keys))
@@ -453,15 +453,11 @@ func parseU32Data(filter Filter, data []syscall.NetlinkRouteAttr) (bool, error)
 				// Handle the endianness of attributes
 				u32.Sel.Offmask = native.Uint16(htons(sel.Offmask))
 				u32.Sel.Hmask = native.Uint32(htonl(sel.Hmask))
-				for _, key := range u32.Sel.Keys {
-					key.Mask = native.Uint32(htonl(key.Mask))
-					key.Val = native.Uint32(htonl(key.Val))
+				for i, key := range u32.Sel.Keys {
+					u32.Sel.Keys[i].Mask = native.Uint32(htonl(key.Mask))
+					u32.Sel.Keys[i].Val = native.Uint32(htonl(key.Val))
 				}
 			}
-			// only parse if we have a very basic redirect
-			if sel.Flags&nl.TC_U32_TERMINAL == 0 || sel.Nkeys != 1 {
-				return detailed, nil
-			}
 		case nl.TCA_U32_ACT:
 			tables, err := nl.ParseRouteAttr(datum.Value)
 			if err != nil {
diff --git a/components/engine/vendor/github.com/vishvananda/netlink/genetlink_linux.go b/components/engine/vendor/github.com/vishvananda/netlink/genetlink_linux.go
new file mode 100644
index 0000000000..a388a87001
--- /dev/null
+++ b/components/engine/vendor/github.com/vishvananda/netlink/genetlink_linux.go
@@ -0,0 +1,167 @@
+package netlink
+
+import (
+	"fmt"
+	"syscall"
+
+	"github.com/vishvananda/netlink/nl"
+)
+
+type GenlOp struct {
+	ID    uint32
+	Flags uint32
+}
+
+type GenlMulticastGroup struct {
+	ID   uint32
+	Name string
+}
+
+type GenlFamily struct {
+	ID      uint16
+	HdrSize uint32
+	Name    string
+	Version uint32
+	MaxAttr uint32
+	Ops     []GenlOp
+	Groups  []GenlMulticastGroup
+}
+
+func parseOps(b []byte) ([]GenlOp, error) {
+	attrs, err := nl.ParseRouteAttr(b)
+	if err != nil {
+		return nil, err
+	}
+	ops := make([]GenlOp, 0, len(attrs))
+	for _, a := range attrs {
+		nattrs, err := nl.ParseRouteAttr(a.Value)
+		if err != nil {
+			return nil, err
+		}
+		var op GenlOp
+		for _, na := range nattrs {
+			switch na.Attr.Type {
+			case nl.GENL_CTRL_ATTR_OP_ID:
+				op.ID = native.Uint32(na.Value)
+			case nl.GENL_CTRL_ATTR_OP_FLAGS:
+				op.Flags = native.Uint32(na.Value)
+			}
+		}
+		ops = append(ops, op)
+	}
+	return ops, nil
+}
+
+func parseMulticastGroups(b []byte) ([]GenlMulticastGroup, error) {
+	attrs, err := nl.ParseRouteAttr(b)
+	if err != nil {
+		return nil, err
+	}
+	groups := make([]GenlMulticastGroup, 0, len(attrs))
+	for _, a := range attrs {
+		nattrs, err := nl.ParseRouteAttr(a.Value)
+		if err != nil {
+			return nil, err
+		}
+		var g GenlMulticastGroup
+		for _, na := range nattrs {
+			switch na.Attr.Type {
+			case nl.GENL_CTRL_ATTR_MCAST_GRP_NAME:
+				g.Name = nl.BytesToString(na.Value)
+			case nl.GENL_CTRL_ATTR_MCAST_GRP_ID:
+				g.ID = native.Uint32(na.Value)
+			}
+		}
+		groups = append(groups, g)
+	}
+	return groups, nil
+}
+
+func (f *GenlFamily) parseAttributes(attrs []syscall.NetlinkRouteAttr) error {
+	for _, a := range attrs {
+		switch a.Attr.Type {
+		case nl.GENL_CTRL_ATTR_FAMILY_NAME:
+			f.Name = nl.BytesToString(a.Value)
+		case nl.GENL_CTRL_ATTR_FAMILY_ID:
+			f.ID = native.Uint16(a.Value)
+		case nl.GENL_CTRL_ATTR_VERSION:
+			f.Version = native.Uint32(a.Value)
+		case nl.GENL_CTRL_ATTR_HDRSIZE:
+			f.HdrSize = native.Uint32(a.Value)
+		case nl.GENL_CTRL_ATTR_MAXATTR:
+			f.MaxAttr = native.Uint32(a.Value)
+		case nl.GENL_CTRL_ATTR_OPS:
+			ops, err := parseOps(a.Value)
+			if err != nil {
+				return err
+			}
+			f.Ops = ops
+		case nl.GENL_CTRL_ATTR_MCAST_GROUPS:
+			groups, err := parseMulticastGroups(a.Value)
+			if err != nil {
+				return err
+			}
+			f.Groups = groups
+		}
+	}
+
+	return nil
+}
+
+func parseFamilies(msgs [][]byte) ([]*GenlFamily, error) {
+	families := make([]*GenlFamily, 0, len(msgs))
+	for _, m := range msgs {
+		attrs, err := nl.ParseRouteAttr(m[nl.SizeofGenlmsg:])
+		if err != nil {
+			return nil, err
+		}
+		family := &GenlFamily{}
+		if err := family.parseAttributes(attrs); err != nil {
+			return nil, err
+		}
+
+		families = append(families, family)
+	}
+	return families, nil
+}
+
+func (h *Handle) GenlFamilyList() ([]*GenlFamily, error) {
+	msg := &nl.Genlmsg{
+		Command: nl.GENL_CTRL_CMD_GETFAMILY,
+		Version: nl.GENL_CTRL_VERSION,
+	}
+	req := h.newNetlinkRequest(nl.GENL_ID_CTRL, syscall.NLM_F_DUMP)
+	req.AddData(msg)
+	msgs, err := req.Execute(syscall.NETLINK_GENERIC, 0)
+	if err != nil {
+		return nil, err
+	}
+	return parseFamilies(msgs)
+}
+
+func GenlFamilyList() ([]*GenlFamily, error) {
+	return pkgHandle.GenlFamilyList()
+}
+
+func (h *Handle) GenlFamilyGet(name string) (*GenlFamily, error) {
+	msg := &nl.Genlmsg{
+		Command: nl.GENL_CTRL_CMD_GETFAMILY,
+		Version: nl.GENL_CTRL_VERSION,
+	}
+	req := h.newNetlinkRequest(nl.GENL_ID_CTRL, 0)
+	req.AddData(msg)
+	req.AddData(nl.NewRtAttr(nl.GENL_CTRL_ATTR_FAMILY_NAME, nl.ZeroTerminated(name)))
+	msgs, err := req.Execute(syscall.NETLINK_GENERIC, 0)
+	if err != nil {
+		return nil, err
+	}
+	families, err := parseFamilies(msgs)
+	if len(families) != 1 {
+		return nil, fmt.Errorf("invalid response for GENL_CTRL_CMD_GETFAMILY")
+	}
+	return families[0], nil
+}
+
+func GenlFamilyGet(name string) (*GenlFamily, error) {
+	return pkgHandle.GenlFamilyGet(name)
+}
diff --git a/components/engine/vendor/github.com/vishvananda/netlink/genetlink_unspecified.go b/components/engine/vendor/github.com/vishvananda/netlink/genetlink_unspecified.go
new file mode 100644
index 0000000000..0192b991e3
--- /dev/null
+++ b/components/engine/vendor/github.com/vishvananda/netlink/genetlink_unspecified.go
@@ -0,0 +1,25 @@
+// +build !linux
+
+package netlink
+
+type GenlOp struct{}
+
+type GenlMulticastGroup struct{}
+
+type GenlFamily struct{}
+
+func (h *Handle) GenlFamilyList() ([]*GenlFamily, error) {
+	return nil, ErrNotImplemented
+}
+
+func GenlFamilyList() ([]*GenlFamily, error) {
+	return nil, ErrNotImplemented
+}
+
+func (h *Handle) GenlFamilyGet(name string) (*GenlFamily, error) {
+	return nil, ErrNotImplemented
+}
+
+func GenlFamilyGet(name string) (*GenlFamily, error) {
+	return nil, ErrNotImplemented
+}
diff --git a/components/engine/vendor/github.com/vishvananda/netlink/gtp_linux.go b/components/engine/vendor/github.com/vishvananda/netlink/gtp_linux.go
new file mode 100644
index 0000000000..7331303ecb
--- /dev/null
+++ b/components/engine/vendor/github.com/vishvananda/netlink/gtp_linux.go
@@ -0,0 +1,238 @@
+package netlink
+
+import (
+	"fmt"
+	"net"
+	"strings"
+	"syscall"
+
+	"github.com/vishvananda/netlink/nl"
+)
+
+type PDP struct {
+	Version     uint32
+	TID         uint64
+	PeerAddress net.IP
+	MSAddress   net.IP
+	Flow        uint16
+	NetNSFD     uint32
+	ITEI        uint32
+	OTEI        uint32
+}
+
+func (pdp *PDP) String() string {
+	elems := []string{}
+	elems = append(elems, fmt.Sprintf("Version: %d", pdp.Version))
+	if pdp.Version == 0 {
+		elems = append(elems, fmt.Sprintf("TID: %d", pdp.TID))
+	} else if pdp.Version == 1 {
+		elems = append(elems, fmt.Sprintf("TEI: %d/%d", pdp.ITEI, pdp.OTEI))
+	}
+	elems = append(elems, fmt.Sprintf("MS-Address: %s", pdp.MSAddress))
+	elems = append(elems, fmt.Sprintf("Peer-Address: %s", pdp.PeerAddress))
+	return fmt.Sprintf("{%s}", strings.Join(elems, " "))
+}
+
+func (p *PDP) parseAttributes(attrs []syscall.NetlinkRouteAttr) error {
+	for _, a := range attrs {
+		switch a.Attr.Type {
+		case nl.GENL_GTP_ATTR_VERSION:
+			p.Version = native.Uint32(a.Value)
+		case nl.GENL_GTP_ATTR_TID:
+			p.TID = native.Uint64(a.Value)
+		case nl.GENL_GTP_ATTR_PEER_ADDRESS:
+			p.PeerAddress = net.IP(a.Value)
+		case nl.GENL_GTP_ATTR_MS_ADDRESS:
+			p.MSAddress = net.IP(a.Value)
+		case nl.GENL_GTP_ATTR_FLOW:
+			p.Flow = native.Uint16(a.Value)
+		case nl.GENL_GTP_ATTR_NET_NS_FD:
+			p.NetNSFD = native.Uint32(a.Value)
+		case nl.GENL_GTP_ATTR_I_TEI:
+			p.ITEI = native.Uint32(a.Value)
+		case nl.GENL_GTP_ATTR_O_TEI:
+			p.OTEI = native.Uint32(a.Value)
+		}
+	}
+	return nil
+}
+
+func parsePDP(msgs [][]byte) ([]*PDP, error) {
+	pdps := make([]*PDP, 0, len(msgs))
+	for _, m := range msgs {
+		attrs, err := nl.ParseRouteAttr(m[nl.SizeofGenlmsg:])
+		if err != nil {
+			return nil, err
+		}
+		pdp := &PDP{}
+		if err := pdp.parseAttributes(attrs); err != nil {
+			return nil, err
+		}
+		pdps = append(pdps, pdp)
+	}
+	return pdps, nil
+}
+
+func (h *Handle) GTPPDPList() ([]*PDP, error) {
+	f, err := h.GenlFamilyGet(nl.GENL_GTP_NAME)
+	if err != nil {
+		return nil, err
+	}
+	msg := &nl.Genlmsg{
+		Command: nl.GENL_GTP_CMD_GETPDP,
+		Version: nl.GENL_GTP_VERSION,
+	}
+	req := h.newNetlinkRequest(int(f.ID), syscall.NLM_F_DUMP)
+	req.AddData(msg)
+	msgs, err := req.Execute(syscall.NETLINK_GENERIC, 0)
+	if err != nil {
+		return nil, err
+	}
+	return parsePDP(msgs)
+}
+
+func GTPPDPList() ([]*PDP, error) {
+	return pkgHandle.GTPPDPList()
+}
+
+func gtpPDPGet(req *nl.NetlinkRequest) (*PDP, error) {
+	msgs, err := req.Execute(syscall.NETLINK_GENERIC, 0)
+	if err != nil {
+		return nil, err
+	}
+	pdps, err := parsePDP(msgs)
+	if err != nil {
+		return nil, err
+	}
+	if len(pdps) != 1 {
+		return nil, fmt.Errorf("invalid reqponse for GENL_GTP_CMD_GETPDP")
+	}
+	return pdps[0], nil
+}
+
+func (h *Handle) GTPPDPByTID(link Link, tid int) (*PDP, error) {
+	f, err := h.GenlFamilyGet(nl.GENL_GTP_NAME)
+	if err != nil {
+		return nil, err
+	}
+	msg := &nl.Genlmsg{
+		Command: nl.GENL_GTP_CMD_GETPDP,
+		Version: nl.GENL_GTP_VERSION,
+	}
+	req := h.newNetlinkRequest(int(f.ID), 0)
+	req.AddData(msg)
+	req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_VERSION, nl.Uint32Attr(0)))
+	req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_LINK, nl.Uint32Attr(uint32(link.Attrs().Index))))
+	req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_TID, nl.Uint64Attr(uint64(tid))))
+	return gtpPDPGet(req)
+}
+
+func GTPPDPByTID(link Link, tid int) (*PDP, error) {
+	return pkgHandle.GTPPDPByTID(link, tid)
+}
+
+func (h *Handle) GTPPDPByITEI(link Link, itei int) (*PDP, error) {
+	f, err := h.GenlFamilyGet(nl.GENL_GTP_NAME)
+	if err != nil {
+		return nil, err
+	}
+	msg := &nl.Genlmsg{
+		Command: nl.GENL_GTP_CMD_GETPDP,
+		Version: nl.GENL_GTP_VERSION,
+	}
+	req := h.newNetlinkRequest(int(f.ID), 0)
+	req.AddData(msg)
+	req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_VERSION, nl.Uint32Attr(1)))
+	req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_LINK, nl.Uint32Attr(uint32(link.Attrs().Index))))
+	req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_I_TEI, nl.Uint32Attr(uint32(itei))))
+	return gtpPDPGet(req)
+}
+
+func GTPPDPByITEI(link Link, itei int) (*PDP, error) {
+	return pkgHandle.GTPPDPByITEI(link, itei)
+}
+
+func (h *Handle) GTPPDPByMSAddress(link Link, addr net.IP) (*PDP, error) {
+	f, err := h.GenlFamilyGet(nl.GENL_GTP_NAME)
+	if err != nil {
+		return nil, err
+	}
+	msg := &nl.Genlmsg{
+		Command: nl.GENL_GTP_CMD_GETPDP,
+		Version: nl.GENL_GTP_VERSION,
+	}
+	req := h.newNetlinkRequest(int(f.ID), 0)
+	req.AddData(msg)
+	req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_VERSION, nl.Uint32Attr(0)))
+	req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_LINK, nl.Uint32Attr(uint32(link.Attrs().Index))))
+	req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_MS_ADDRESS, []byte(addr.To4())))
+	return gtpPDPGet(req)
+}
+
+func GTPPDPByMSAddress(link Link, addr net.IP) (*PDP, error) {
+	return pkgHandle.GTPPDPByMSAddress(link, addr)
+}
+
+func (h *Handle) GTPPDPAdd(link Link, pdp *PDP) error {
+	f, err := h.GenlFamilyGet(nl.GENL_GTP_NAME)
+	if err != nil {
+		return err
+	}
+	msg := &nl.Genlmsg{
+		Command: nl.GENL_GTP_CMD_NEWPDP,
+		Version: nl.GENL_GTP_VERSION,
+	}
+	req := h.newNetlinkRequest(int(f.ID), syscall.NLM_F_EXCL|syscall.NLM_F_ACK)
+	req.AddData(msg)
+	req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_VERSION, nl.Uint32Attr(pdp.Version)))
+	req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_LINK, nl.Uint32Attr(uint32(link.Attrs().Index))))
+	req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_PEER_ADDRESS, []byte(pdp.PeerAddress.To4())))
+	req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_MS_ADDRESS, []byte(pdp.MSAddress.To4())))
+
+	switch pdp.Version {
+	case 0:
+		req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_TID, nl.Uint64Attr(pdp.TID)))
+		req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_FLOW, nl.Uint16Attr(pdp.Flow)))
+	case 1:
+		req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_I_TEI, nl.Uint32Attr(pdp.ITEI)))
+		req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_O_TEI, nl.Uint32Attr(pdp.OTEI)))
+	default:
+		return fmt.Errorf("unsupported GTP version: %d", pdp.Version)
+	}
+	_, err = req.Execute(syscall.NETLINK_GENERIC, 0)
+	return err
+}
+
+func GTPPDPAdd(link Link, pdp *PDP) error {
+	return pkgHandle.GTPPDPAdd(link, pdp)
+}
+
+func (h *Handle) GTPPDPDel(link Link, pdp *PDP) error {
+	f, err := h.GenlFamilyGet(nl.GENL_GTP_NAME)
+	if err != nil {
+		return err
+	}
+	msg := &nl.Genlmsg{
+		Command: nl.GENL_GTP_CMD_DELPDP,
+		Version: nl.GENL_GTP_VERSION,
+	}
+	req := h.newNetlinkRequest(int(f.ID), syscall.NLM_F_EXCL|syscall.NLM_F_ACK)
+	req.AddData(msg)
+	req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_VERSION, nl.Uint32Attr(pdp.Version)))
+	req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_LINK, nl.Uint32Attr(uint32(link.Attrs().Index))))
+
+	switch pdp.Version {
+	case 0:
+		req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_TID, nl.Uint64Attr(pdp.TID)))
+	case 1:
+		req.AddData(nl.NewRtAttr(nl.GENL_GTP_ATTR_I_TEI, nl.Uint32Attr(pdp.ITEI)))
+	default:
+		return fmt.Errorf("unsupported GTP version: %d", pdp.Version)
+	}
+	_, err = req.Execute(syscall.NETLINK_GENERIC, 0)
+	return err
+}
+
+func GTPPDPDel(link Link, pdp *PDP) error {
+	return pkgHandle.GTPPDPDel(link, pdp)
+}
diff --git a/components/engine/vendor/github.com/vishvananda/netlink/link.go b/components/engine/vendor/github.com/vishvananda/netlink/link.go
index 924211cd48..547e92ec12 100644
--- a/components/engine/vendor/github.com/vishvananda/netlink/link.go
+++ b/components/engine/vendor/github.com/vishvananda/netlink/link.go
@@ -170,6 +170,7 @@ type LinkStatistics64 struct {
 type LinkXdp struct {
 	Fd       int
 	Attached bool
+	Flags    uint32
 }
 
 // Device links cannot be created via netlink. These links
@@ -215,6 +216,8 @@ func (ifb *Ifb) Type() string {
 // Bridge links are simple linux bridges
 type Bridge struct {
 	LinkAttrs
+	MulticastSnooping *bool
+	HelloTime         *uint32
 }
 
 func (bridge *Bridge) Attrs() *LinkAttrs {
@@ -590,7 +593,11 @@ type Bond struct {
 	LacpRate        BondLacpRate
 	AdSelect        BondAdSelect
 	// looking at iproute tool AdInfo can only be retrived. It can't be set.
-	AdInfo *BondAdInfo
+	AdInfo         *BondAdInfo
+	AdActorSysPrio int
+	AdUserPortKey  int
+	AdActorSystem  net.HardwareAddr
+	TlbDynamicLb   int
 }
 
 func NewLinkBond(atr LinkAttrs) *Bond {
@@ -618,6 +625,10 @@ func NewLinkBond(atr LinkAttrs) *Bond {
 		PackersPerSlave: -1,
 		LacpRate:        -1,
 		AdSelect:        -1,
+		AdActorSysPrio:  -1,
+		AdUserPortKey:   -1,
+		AdActorSystem:   nil,
+		TlbDynamicLb:    -1,
 	}
 }
 
@@ -731,8 +742,32 @@ func (vrf *Vrf) Type() string {
 	return "vrf"
 }
 
+type GTP struct {
+	LinkAttrs
+	FD0         int
+	FD1         int
+	Role        int
+	PDPHashsize int
+}
+
+func (gtp *GTP) Attrs() *LinkAttrs {
+	return &gtp.LinkAttrs
+}
+
+func (gtp *GTP) Type() string {
+	return "gtp"
+}
+
 // iproute2 supported devices;
 // vlan | veth | vcan | dummy | ifb | macvlan | macvtap |
 // bridge | bond | ipoib | ip6tnl | ipip | sit | vxlan |
 // gre | gretap | ip6gre | ip6gretap | vti | nlmon |
 // bond_slave | ipvlan
+
+// LinkNotFoundError wraps the various not found errors when
+// getting/reading links. This is intended for better error
+// handling by dependent code so that "not found error" can
+// be distinguished from other errors
+type LinkNotFoundError struct {
+	error
+}
diff --git a/components/engine/vendor/github.com/vishvananda/netlink/link_linux.go b/components/engine/vendor/github.com/vishvananda/netlink/link_linux.go
index 0c04d3adde..1c1bc52c4d 100644
--- a/components/engine/vendor/github.com/vishvananda/netlink/link_linux.go
+++ b/components/engine/vendor/github.com/vishvananda/netlink/link_linux.go
@@ -103,7 +103,7 @@ func (h *Handle) SetPromiscOn(link Link) error {
 
 	msg := nl.NewIfInfomsg(syscall.AF_UNSPEC)
 	msg.Change = syscall.IFF_PROMISC
-	msg.Flags = syscall.IFF_UP
+	msg.Flags = syscall.IFF_PROMISC
 	msg.Index = int32(base.Index)
 	req.AddData(msg)
 
@@ -111,6 +111,16 @@ func (h *Handle) SetPromiscOn(link Link) error {
 	return err
 }
 
+func BridgeSetMcastSnoop(link Link, on bool) error {
+	return pkgHandle.BridgeSetMcastSnoop(link, on)
+}
+
+func (h *Handle) BridgeSetMcastSnoop(link Link, on bool) error {
+	bridge := link.(*Bridge)
+	bridge.MulticastSnooping = &on
+	return h.linkModify(bridge, syscall.NLM_F_ACK)
+}
+
 func SetPromiscOn(link Link) error {
 	return pkgHandle.SetPromiscOn(link)
 }
@@ -122,7 +132,7 @@ func (h *Handle) SetPromiscOff(link Link) error {
 
 	msg := nl.NewIfInfomsg(syscall.AF_UNSPEC)
 	msg.Change = syscall.IFF_PROMISC
-	msg.Flags = 0 & ^syscall.IFF_UP
+	msg.Flags = 0 & ^syscall.IFF_PROMISC
 	msg.Index = int32(base.Index)
 	req.AddData(msg)
 
@@ -659,6 +669,18 @@ func addBondAttrs(bond *Bond, linkInfo *nl.RtAttr) {
 	if bond.AdSelect >= 0 {
 		nl.NewRtAttrChild(data, nl.IFLA_BOND_AD_SELECT, nl.Uint8Attr(uint8(bond.AdSelect)))
 	}
+	if bond.AdActorSysPrio >= 0 {
+		nl.NewRtAttrChild(data, nl.IFLA_BOND_AD_ACTOR_SYS_PRIO, nl.Uint16Attr(uint16(bond.AdActorSysPrio)))
+	}
+	if bond.AdUserPortKey >= 0 {
+		nl.NewRtAttrChild(data, nl.IFLA_BOND_AD_USER_PORT_KEY, nl.Uint16Attr(uint16(bond.AdUserPortKey)))
+	}
+	if bond.AdActorSystem != nil {
+		nl.NewRtAttrChild(data, nl.IFLA_BOND_AD_ACTOR_SYSTEM, []byte(bond.AdActorSystem))
+	}
+	if bond.TlbDynamicLb >= 0 {
+		nl.NewRtAttrChild(data, nl.IFLA_BOND_TLB_DYNAMIC_LB, nl.Uint8Attr(uint8(bond.TlbDynamicLb)))
+	}
 }
 
 // LinkAdd adds a new link device. The type and features of the device
@@ -672,7 +694,10 @@ func LinkAdd(link Link) error {
 // are taken fromt the parameters in the link object.
 // Equivalent to: `ip link add $link`
 func (h *Handle) LinkAdd(link Link) error {
-	// TODO: set mtu and hardware address
+	return h.linkModify(link, syscall.NLM_F_CREATE|syscall.NLM_F_EXCL|syscall.NLM_F_ACK)
+}
+
+func (h *Handle) linkModify(link Link, flags int) error {
 	// TODO: support extra data for macvlan
 	base := link.Attrs()
 
@@ -719,7 +744,7 @@ func (h *Handle) LinkAdd(link Link) error {
 		return nil
 	}
 
-	req := h.newNetlinkRequest(syscall.RTM_NEWLINK, syscall.NLM_F_CREATE|syscall.NLM_F_EXCL|syscall.NLM_F_ACK)
+	req := h.newNetlinkRequest(syscall.RTM_NEWLINK, flags)
 
 	msg := nl.NewIfInfomsg(syscall.AF_UNSPEC)
 	// TODO: make it shorter
@@ -767,6 +792,11 @@ func (h *Handle) LinkAdd(link Link) error {
 		req.AddData(qlen)
 	}
 
+	if base.HardwareAddr != nil {
+		hwaddr := nl.NewRtAttr(syscall.IFLA_ADDRESS, []byte(base.HardwareAddr))
+		req.AddData(hwaddr)
+	}
+
 	if base.Namespace != nil {
 		var attr *nl.RtAttr
 		switch base.Namespace.(type) {
@@ -830,6 +860,10 @@ func (h *Handle) LinkAdd(link Link) error {
 		addVtiAttrs(vti, linkInfo)
 	} else if vrf, ok := link.(*Vrf); ok {
 		addVrfAttrs(vrf, linkInfo)
+	} else if bridge, ok := link.(*Bridge); ok {
+		addBridgeAttrs(bridge, linkInfo)
+	} else if gtp, ok := link.(*GTP); ok {
+		addGTPAttrs(gtp, linkInfo)
 	}
 
 	req.AddData(linkInfo)
@@ -885,7 +919,7 @@ func (h *Handle) linkByNameDump(name string) (Link, error) {
 			return link, nil
 		}
 	}
-	return nil, fmt.Errorf("Link %s not found", name)
+	return nil, LinkNotFoundError{fmt.Errorf("Link %s not found", name)}
 }
 
 func (h *Handle) linkByAliasDump(alias string) (Link, error) {
@@ -899,7 +933,7 @@ func (h *Handle) linkByAliasDump(alias string) (Link, error) {
 			return link, nil
 		}
 	}
-	return nil, fmt.Errorf("Link alias %s not found", alias)
+	return nil, LinkNotFoundError{fmt.Errorf("Link alias %s not found", alias)}
 }
 
 // LinkByName finds a link by name and returns a pointer to the object.
@@ -985,7 +1019,7 @@ func execGetLink(req *nl.NetlinkRequest) (Link, error) {
 	if err != nil {
 		if errno, ok := err.(syscall.Errno); ok {
 			if errno == syscall.ENODEV {
-				return nil, fmt.Errorf("Link not found")
+				return nil, LinkNotFoundError{fmt.Errorf("Link not found")}
 			}
 		}
 		return nil, err
@@ -993,7 +1027,7 @@ func execGetLink(req *nl.NetlinkRequest) (Link, error) {
 
 	switch {
 	case len(msgs) == 0:
-		return nil, fmt.Errorf("Link not found")
+		return nil, LinkNotFoundError{fmt.Errorf("Link not found")}
 
 	case len(msgs) == 1:
 		return LinkDeserialize(nil, msgs[0])
@@ -1063,6 +1097,8 @@ func LinkDeserialize(hdr *syscall.NlMsghdr, m []byte) (Link, error) {
 						link = &Vti{}
 					case "vrf":
 						link = &Vrf{}
+					case "gtp":
+						link = &GTP{}
 					default:
 						link = &GenericLink{LinkType: linkType}
 					}
@@ -1092,6 +1128,10 @@ func LinkDeserialize(hdr *syscall.NlMsghdr, m []byte) (Link, error) {
 						parseVtiData(link, data)
 					case "vrf":
 						parseVrfData(link, data)
+					case "bridge":
+						parseBridgeData(link, data)
+					case "gtp":
+						parseGTPData(link, data)
 					}
 				}
 			}
@@ -1288,6 +1328,22 @@ func (h *Handle) LinkSetFlood(link Link, mode bool) error {
 	return h.setProtinfoAttr(link, mode, nl.IFLA_BRPORT_UNICAST_FLOOD)
 }
 
+func LinkSetBrProxyArp(link Link, mode bool) error {
+	return pkgHandle.LinkSetBrProxyArp(link, mode)
+}
+
+func (h *Handle) LinkSetBrProxyArp(link Link, mode bool) error {
+	return h.setProtinfoAttr(link, mode, nl.IFLA_BRPORT_PROXYARP)
+}
+
+func LinkSetBrProxyArpWiFi(link Link, mode bool) error {
+	return pkgHandle.LinkSetBrProxyArpWiFi(link, mode)
+}
+
+func (h *Handle) LinkSetBrProxyArpWiFi(link Link, mode bool) error {
+	return h.setProtinfoAttr(link, mode, nl.IFLA_BRPORT_PROXYARP_WIFI)
+}
+
 func (h *Handle) setProtinfoAttr(link Link, mode bool, attr int) error {
 	base := link.Attrs()
 	h.ensureIndex(base)
@@ -1370,7 +1426,7 @@ func parseVxlanData(link Link, data []syscall.NetlinkRouteAttr) {
 }
 
 func parseBondData(link Link, data []syscall.NetlinkRouteAttr) {
-	bond := NewLinkBond(NewLinkAttrs())
+	bond := link.(*Bond)
 	for i := range data {
 		switch data[i].Attr.Type {
 		case nl.IFLA_BOND_MODE:
@@ -1419,6 +1475,14 @@ func parseBondData(link Link, data []syscall.NetlinkRouteAttr) {
 			bond.AdSelect = BondAdSelect(data[i].Value[0])
 		case nl.IFLA_BOND_AD_INFO:
 			// TODO: implement
+		case nl.IFLA_BOND_AD_ACTOR_SYS_PRIO:
+			bond.AdActorSysPrio = int(native.Uint16(data[i].Value[0:2]))
+		case nl.IFLA_BOND_AD_USER_PORT_KEY:
+			bond.AdUserPortKey = int(native.Uint16(data[i].Value[0:2]))
+		case nl.IFLA_BOND_AD_ACTOR_SYSTEM:
+			bond.AdActorSystem = net.HardwareAddr(data[i].Value[0:6])
+		case nl.IFLA_BOND_TLB_DYNAMIC_LB:
+			bond.TlbDynamicLb = int(data[i].Value[0])
 		}
 	}
 }
@@ -1566,6 +1630,8 @@ func addXdpAttrs(xdp *LinkXdp, req *nl.NetlinkRequest) {
 	b := make([]byte, 4)
 	native.PutUint32(b, uint32(xdp.Fd))
 	nl.NewRtAttrChild(attrs, nl.IFLA_XDP_FD, b)
+	native.PutUint32(b, xdp.Flags)
+	nl.NewRtAttrChild(attrs, nl.IFLA_XDP_FLAGS, b)
 	req.AddData(attrs)
 }
 
@@ -1581,6 +1647,8 @@ func parseLinkXdp(data []byte) (*LinkXdp, error) {
 			xdp.Fd = int(native.Uint32(attr.Value[0:4]))
 		case nl.IFLA_XDP_ATTACHED:
 			xdp.Attached = attr.Value[0] != 0
+		case nl.IFLA_XDP_FLAGS:
+			xdp.Flags = native.Uint32(attr.Value[0:4])
 		}
 	}
 	return xdp, nil
@@ -1678,3 +1746,53 @@ func parseVrfData(link Link, data []syscall.NetlinkRouteAttr) {
 		}
 	}
 }
+
+func addBridgeAttrs(bridge *Bridge, linkInfo *nl.RtAttr) {
+	data := nl.NewRtAttrChild(linkInfo, nl.IFLA_INFO_DATA, nil)
+	if bridge.MulticastSnooping != nil {
+		nl.NewRtAttrChild(data, nl.IFLA_BR_MCAST_SNOOPING, boolToByte(*bridge.MulticastSnooping))
+	}
+	if bridge.HelloTime != nil {
+		nl.NewRtAttrChild(data, nl.IFLA_BR_HELLO_TIME, nl.Uint32Attr(*bridge.HelloTime))
+	}
+}
+
+func parseBridgeData(bridge Link, data []syscall.NetlinkRouteAttr) {
+	br := bridge.(*Bridge)
+	for _, datum := range data {
+		switch datum.Attr.Type {
+		case nl.IFLA_BR_HELLO_TIME:
+			helloTime := native.Uint32(datum.Value[0:4])
+			br.HelloTime = &helloTime
+		case nl.IFLA_BR_MCAST_SNOOPING:
+			mcastSnooping := datum.Value[0] == 1
+			br.MulticastSnooping = &mcastSnooping
+		}
+	}
+}
+
+func addGTPAttrs(gtp *GTP, linkInfo *nl.RtAttr) {
+	data := nl.NewRtAttrChild(linkInfo, nl.IFLA_INFO_DATA, nil)
+	nl.NewRtAttrChild(data, nl.IFLA_GTP_FD0, nl.Uint32Attr(uint32(gtp.FD0)))
+	nl.NewRtAttrChild(data, nl.IFLA_GTP_FD1, nl.Uint32Attr(uint32(gtp.FD1)))
+	nl.NewRtAttrChild(data, nl.IFLA_GTP_PDP_HASHSIZE, nl.Uint32Attr(131072))
+	if gtp.Role != nl.GTP_ROLE_GGSN {
+		nl.NewRtAttrChild(data, nl.IFLA_GTP_ROLE, nl.Uint32Attr(uint32(gtp.Role)))
+	}
+}
+
+func parseGTPData(link Link, data []syscall.NetlinkRouteAttr) {
+	gtp := link.(*GTP)
+	for _, datum := range data {
+		switch datum.Attr.Type {
+		case nl.IFLA_GTP_FD0:
+			gtp.FD0 = int(native.Uint32(datum.Value))
+		case nl.IFLA_GTP_FD1:
+			gtp.FD1 = int(native.Uint32(datum.Value))
+		case nl.IFLA_GTP_PDP_HASHSIZE:
+			gtp.PDPHashsize = int(native.Uint32(datum.Value))
+		case nl.IFLA_GTP_ROLE:
+			gtp.Role = int(native.Uint32(datum.Value))
+		}
+	}
+}
diff --git a/components/engine/vendor/github.com/vishvananda/netlink/nl/addr_linux.go b/components/engine/vendor/github.com/vishvananda/netlink/nl/addr_linux.go
index 17088fa0c0..fe362e9fa7 100644
--- a/components/engine/vendor/github.com/vishvananda/netlink/nl/addr_linux.go
+++ b/components/engine/vendor/github.com/vishvananda/netlink/nl/addr_linux.go
@@ -45,3 +45,32 @@ func (msg *IfAddrmsg) Serialize() []byte {
 func (msg *IfAddrmsg) Len() int {
 	return syscall.SizeofIfAddrmsg
 }
+
+// struct ifa_cacheinfo {
+// 	__u32	ifa_prefered;
+// 	__u32	ifa_valid;
+// 	__u32	cstamp; /* created timestamp, hundredths of seconds */
+// 	__u32	tstamp; /* updated timestamp, hundredths of seconds */
+// };
+
+const IFA_CACHEINFO = 6
+const SizeofIfaCacheInfo = 0x10
+
+type IfaCacheInfo struct {
+	IfaPrefered uint32
+	IfaValid    uint32
+	Cstamp      uint32
+	Tstamp      uint32
+}
+
+func (msg *IfaCacheInfo) Len() int {
+	return SizeofIfaCacheInfo
+}
+
+func DeserializeIfaCacheInfo(b []byte) *IfaCacheInfo {
+	return (*IfaCacheInfo)(unsafe.Pointer(&b[0:SizeofIfaCacheInfo][0]))
+}
+
+func (msg *IfaCacheInfo) Serialize() []byte {
+	return (*(*[SizeofIfaCacheInfo]byte)(unsafe.Pointer(msg)))[:]
+}
diff --git a/components/engine/vendor/github.com/vishvananda/netlink/nl/genetlink_linux.go b/components/engine/vendor/github.com/vishvananda/netlink/nl/genetlink_linux.go
new file mode 100644
index 0000000000..81b46f2c79
--- /dev/null
+++ b/components/engine/vendor/github.com/vishvananda/netlink/nl/genetlink_linux.go
@@ -0,0 +1,89 @@
+package nl
+
+import (
+	"unsafe"
+)
+
+const SizeofGenlmsg = 4
+
+const (
+	GENL_ID_CTRL      = 0x10
+	GENL_CTRL_VERSION = 2
+	GENL_CTRL_NAME    = "nlctrl"
+)
+
+const (
+	GENL_CTRL_CMD_GETFAMILY = 3
+)
+
+const (
+	GENL_CTRL_ATTR_UNSPEC = iota
+	GENL_CTRL_ATTR_FAMILY_ID
+	GENL_CTRL_ATTR_FAMILY_NAME
+	GENL_CTRL_ATTR_VERSION
+	GENL_CTRL_ATTR_HDRSIZE
+	GENL_CTRL_ATTR_MAXATTR
+	GENL_CTRL_ATTR_OPS
+	GENL_CTRL_ATTR_MCAST_GROUPS
+)
+
+const (
+	GENL_CTRL_ATTR_OP_UNSPEC = iota
+	GENL_CTRL_ATTR_OP_ID
+	GENL_CTRL_ATTR_OP_FLAGS
+)
+
+const (
+	GENL_ADMIN_PERM = 1 << iota
+	GENL_CMD_CAP_DO
+	GENL_CMD_CAP_DUMP
+	GENL_CMD_CAP_HASPOL
+)
+
+const (
+	GENL_CTRL_ATTR_MCAST_GRP_UNSPEC = iota
+	GENL_CTRL_ATTR_MCAST_GRP_NAME
+	GENL_CTRL_ATTR_MCAST_GRP_ID
+)
+
+const (
+	GENL_GTP_VERSION = 0
+	GENL_GTP_NAME    = "gtp"
+)
+
+const (
+	GENL_GTP_CMD_NEWPDP = iota
+	GENL_GTP_CMD_DELPDP
+	GENL_GTP_CMD_GETPDP
+)
+
+const (
+	GENL_GTP_ATTR_UNSPEC = iota
+	GENL_GTP_ATTR_LINK
+	GENL_GTP_ATTR_VERSION
+	GENL_GTP_ATTR_TID
+	GENL_GTP_ATTR_PEER_ADDRESS
+	GENL_GTP_ATTR_MS_ADDRESS
+	GENL_GTP_ATTR_FLOW
+	GENL_GTP_ATTR_NET_NS_FD
+	GENL_GTP_ATTR_I_TEI
+	GENL_GTP_ATTR_O_TEI
+	GENL_GTP_ATTR_PAD
+)
+
+type Genlmsg struct {
+	Command uint8
+	Version uint8
+}
+
+func (msg *Genlmsg) Len() int {
+	return SizeofGenlmsg
+}
+
+func DeserializeGenlmsg(b []byte) *Genlmsg {
+	return (*Genlmsg)(unsafe.Pointer(&b[0:SizeofGenlmsg][0]))
+}
+
+func (msg *Genlmsg) Serialize() []byte {
+	return (*(*[SizeofGenlmsg]byte)(unsafe.Pointer(msg)))[:]
+}
diff --git a/components/engine/vendor/github.com/vishvananda/netlink/nl/link_linux.go b/components/engine/vendor/github.com/vishvananda/netlink/nl/link_linux.go
index 6d9af56998..f7b9575919 100644
--- a/components/engine/vendor/github.com/vishvananda/netlink/nl/link_linux.go
+++ b/components/engine/vendor/github.com/vishvananda/netlink/nl/link_linux.go
@@ -102,7 +102,10 @@ const (
 	IFLA_BRPORT_FAST_LEAVE
 	IFLA_BRPORT_LEARNING
 	IFLA_BRPORT_UNICAST_FLOOD
-	IFLA_BRPORT_MAX = IFLA_BRPORT_UNICAST_FLOOD
+	IFLA_BRPORT_PROXYARP
+	IFLA_BRPORT_LEARNING_SYNC
+	IFLA_BRPORT_PROXYARP_WIFI
+	IFLA_BRPORT_MAX = IFLA_BRPORT_PROXYARP_WIFI
 )
 
 const (
@@ -151,6 +154,10 @@ const (
 	IFLA_BOND_AD_LACP_RATE
 	IFLA_BOND_AD_SELECT
 	IFLA_BOND_AD_INFO
+	IFLA_BOND_AD_ACTOR_SYS_PRIO
+	IFLA_BOND_AD_USER_PORT_KEY
+	IFLA_BOND_AD_ACTOR_SYSTEM
+	IFLA_BOND_TLB_DYNAMIC_LB
 )
 
 const (
@@ -416,7 +423,8 @@ const (
 	IFLA_XDP_UNSPEC   = iota
 	IFLA_XDP_FD       /* fd of xdp program to attach, or -1 to remove */
 	IFLA_XDP_ATTACHED /* read-only bool indicating if prog is attached */
-	IFLA_XDP_MAX      = IFLA_XDP_ATTACHED
+	IFLA_XDP_FLAGS    /* xdp prog related flags */
+	IFLA_XDP_MAX      = IFLA_XDP_FLAGS
 )
 
 const (
@@ -452,3 +460,65 @@ const (
 	IFLA_VRF_UNSPEC = iota
 	IFLA_VRF_TABLE
 )
+
+const (
+	IFLA_BR_UNSPEC = iota
+	IFLA_BR_FORWARD_DELAY
+	IFLA_BR_HELLO_TIME
+	IFLA_BR_MAX_AGE
+	IFLA_BR_AGEING_TIME
+	IFLA_BR_STP_STATE
+	IFLA_BR_PRIORITY
+	IFLA_BR_VLAN_FILTERING
+	IFLA_BR_VLAN_PROTOCOL
+	IFLA_BR_GROUP_FWD_MASK
+	IFLA_BR_ROOT_ID
+	IFLA_BR_BRIDGE_ID
+	IFLA_BR_ROOT_PORT
+	IFLA_BR_ROOT_PATH_COST
+	IFLA_BR_TOPOLOGY_CHANGE
+	IFLA_BR_TOPOLOGY_CHANGE_DETECTED
+	IFLA_BR_HELLO_TIMER
+	IFLA_BR_TCN_TIMER
+	IFLA_BR_TOPOLOGY_CHANGE_TIMER
+	IFLA_BR_GC_TIMER
+	IFLA_BR_GROUP_ADDR
+	IFLA_BR_FDB_FLUSH
+	IFLA_BR_MCAST_ROUTER
+	IFLA_BR_MCAST_SNOOPING
+	IFLA_BR_MCAST_QUERY_USE_IFADDR
+	IFLA_BR_MCAST_QUERIER
+	IFLA_BR_MCAST_HASH_ELASTICITY
+	IFLA_BR_MCAST_HASH_MAX
+	IFLA_BR_MCAST_LAST_MEMBER_CNT
+	IFLA_BR_MCAST_STARTUP_QUERY_CNT
+	IFLA_BR_MCAST_LAST_MEMBER_INTVL
+	IFLA_BR_MCAST_MEMBERSHIP_INTVL
+	IFLA_BR_MCAST_QUERIER_INTVL
+	IFLA_BR_MCAST_QUERY_INTVL
+	IFLA_BR_MCAST_QUERY_RESPONSE_INTVL
+	IFLA_BR_MCAST_STARTUP_QUERY_INTVL
+	IFLA_BR_NF_CALL_IPTABLES
+	IFLA_BR_NF_CALL_IP6TABLES
+	IFLA_BR_NF_CALL_ARPTABLES
+	IFLA_BR_VLAN_DEFAULT_PVID
+	IFLA_BR_PAD
+	IFLA_BR_VLAN_STATS_ENABLED
+	IFLA_BR_MCAST_STATS_ENABLED
+	IFLA_BR_MCAST_IGMP_VERSION
+	IFLA_BR_MCAST_MLD_VERSION
+	IFLA_BR_MAX = IFLA_BR_MCAST_MLD_VERSION
+)
+
+const (
+	IFLA_GTP_UNSPEC = iota
+	IFLA_GTP_FD0
+	IFLA_GTP_FD1
+	IFLA_GTP_PDP_HASHSIZE
+	IFLA_GTP_ROLE
+)
+
+const (
+	GTP_ROLE_GGSN = iota
+	GTP_ROLE_SGSN
+)
diff --git a/components/engine/vendor/github.com/vishvananda/netlink/nl/nl_linux.go b/components/engine/vendor/github.com/vishvananda/netlink/nl/nl_linux.go
index 5820e8422b..1329acd864 100644
--- a/components/engine/vendor/github.com/vishvananda/netlink/nl/nl_linux.go
+++ b/components/engine/vendor/github.com/vishvananda/netlink/nl/nl_linux.go
@@ -459,7 +459,7 @@ func NewNetlinkRequest(proto, flags int) *NetlinkRequest {
 }
 
 type NetlinkSocket struct {
-	fd  int
+	fd  int32
 	lsa syscall.SockaddrNetlink
 	sync.Mutex
 }
@@ -470,7 +470,7 @@ func getNetlinkSocket(protocol int) (*NetlinkSocket, error) {
 		return nil, err
 	}
 	s := &NetlinkSocket{
-		fd: fd,
+		fd: int32(fd),
 	}
 	s.lsa.Family = syscall.AF_NETLINK
 	if err := syscall.Bind(fd, &s.lsa); err != nil {
@@ -556,7 +556,7 @@ func Subscribe(protocol int, groups ...uint) (*NetlinkSocket, error) {
 		return nil, err
 	}
 	s := &NetlinkSocket{
-		fd: fd,
+		fd: int32(fd),
 	}
 	s.lsa.Family = syscall.AF_NETLINK
 
@@ -585,30 +585,32 @@ func SubscribeAt(newNs, curNs netns.NsHandle, protocol int, groups ...uint) (*Ne
 }
 
 func (s *NetlinkSocket) Close() {
-	syscall.Close(s.fd)
-	s.fd = -1
+	fd := int(atomic.SwapInt32(&s.fd, -1))
+	syscall.Close(fd)
 }
 
 func (s *NetlinkSocket) GetFd() int {
-	return s.fd
+	return int(atomic.LoadInt32(&s.fd))
 }
 
 func (s *NetlinkSocket) Send(request *NetlinkRequest) error {
-	if s.fd < 0 {
+	fd := int(atomic.LoadInt32(&s.fd))
+	if fd < 0 {
 		return fmt.Errorf("Send called on a closed socket")
 	}
-	if err := syscall.Sendto(s.fd, request.Serialize(), 0, &s.lsa); err != nil {
+	if err := syscall.Sendto(fd, request.Serialize(), 0, &s.lsa); err != nil {
 		return err
 	}
 	return nil
 }
 
 func (s *NetlinkSocket) Receive() ([]syscall.NetlinkMessage, error) {
-	if s.fd < 0 {
+	fd := int(atomic.LoadInt32(&s.fd))
+	if fd < 0 {
 		return nil, fmt.Errorf("Receive called on a closed socket")
 	}
 	rb := make([]byte, syscall.Getpagesize())
-	nr, _, err := syscall.Recvfrom(s.fd, rb, 0)
+	nr, _, err := syscall.Recvfrom(fd, rb, 0)
 	if err != nil {
 		return nil, err
 	}
@@ -620,7 +622,8 @@ func (s *NetlinkSocket) Receive() ([]syscall.NetlinkMessage, error) {
 }
 
 func (s *NetlinkSocket) GetPid() (uint32, error) {
-	lsa, err := syscall.Getsockname(s.fd)
+	fd := int(atomic.LoadInt32(&s.fd))
+	lsa, err := syscall.Getsockname(fd)
 	if err != nil {
 		return 0, err
 	}
diff --git a/components/engine/vendor/github.com/vishvananda/netlink/protinfo.go b/components/engine/vendor/github.com/vishvananda/netlink/protinfo.go
index ead3f2f15e..0087c4438b 100644
--- a/components/engine/vendor/github.com/vishvananda/netlink/protinfo.go
+++ b/components/engine/vendor/github.com/vishvananda/netlink/protinfo.go
@@ -6,12 +6,14 @@ import (
 
 // Protinfo represents bridge flags from netlink.
 type Protinfo struct {
-	Hairpin   bool
-	Guard     bool
-	FastLeave bool
-	RootBlock bool
-	Learning  bool
-	Flood     bool
+	Hairpin      bool
+	Guard        bool
+	FastLeave    bool
+	RootBlock    bool
+	Learning     bool
+	Flood        bool
+	ProxyArp     bool
+	ProxyArpWiFi bool
 }
 
 // String returns a list of enabled flags
@@ -35,6 +37,12 @@ func (prot *Protinfo) String() string {
 	if prot.Flood {
 		boolStrings = append(boolStrings, "Flood")
 	}
+	if prot.ProxyArp {
+		boolStrings = append(boolStrings, "ProxyArp")
+	}
+	if prot.ProxyArpWiFi {
+		boolStrings = append(boolStrings, "ProxyArpWiFi")
+	}
 	return strings.Join(boolStrings, " ")
 }
 
diff --git a/components/engine/vendor/github.com/vishvananda/netlink/protinfo_linux.go b/components/engine/vendor/github.com/vishvananda/netlink/protinfo_linux.go
index ea72695343..10dd0d5335 100644
--- a/components/engine/vendor/github.com/vishvananda/netlink/protinfo_linux.go
+++ b/components/engine/vendor/github.com/vishvananda/netlink/protinfo_linux.go
@@ -64,6 +64,10 @@ func parseProtinfo(infos []syscall.NetlinkRouteAttr) *Protinfo {
 			pi.Learning = byteToBool(info.Value[0])
 		case nl.IFLA_BRPORT_UNICAST_FLOOD:
 			pi.Flood = byteToBool(info.Value[0])
+		case nl.IFLA_BRPORT_PROXYARP:
+			pi.ProxyArp = byteToBool(info.Value[0])
+		case nl.IFLA_BRPORT_PROXYARP_WIFI:
+			pi.ProxyArpWiFi = byteToBool(info.Value[0])
 		}
 	}
 	return &pi
diff --git a/components/engine/vendor/github.com/vishvananda/netlink/route_linux.go b/components/engine/vendor/github.com/vishvananda/netlink/route_linux.go
index 9e0f1f932d..cd739e7146 100644
--- a/components/engine/vendor/github.com/vishvananda/netlink/route_linux.go
+++ b/components/engine/vendor/github.com/vishvananda/netlink/route_linux.go
@@ -401,7 +401,7 @@ func (h *Handle) RouteListFiltered(family int, filter *Route, filterMask uint64)
 		}
 		if filter != nil {
 			switch {
-			case filterMask&RT_FILTER_TABLE != 0 && route.Table != filter.Table:
+			case filterMask&RT_FILTER_TABLE != 0 && filter.Table != syscall.RT_TABLE_UNSPEC && route.Table != filter.Table:
 				continue
 			case filterMask&RT_FILTER_PROTOCOL != 0 && route.Protocol != filter.Protocol:
 				continue
diff --git a/components/engine/vendor/golang.org/x/net/context/context.go b/components/engine/vendor/golang.org/x/net/context/context.go
index 134654cf7e..f143ed6a1e 100644
--- a/components/engine/vendor/golang.org/x/net/context/context.go
+++ b/components/engine/vendor/golang.org/x/net/context/context.go
@@ -7,7 +7,7 @@
 // and between processes.
 //
 // Incoming requests to a server should create a Context, and outgoing calls to
-// servers should accept a Context.  The chain of function calls between must
+// servers should accept a Context. The chain of function calls between must
 // propagate the Context, optionally replacing it with a modified copy created
 // using WithDeadline, WithTimeout, WithCancel, or WithValue.
 //
@@ -16,14 +16,14 @@
 // propagation:
 //
 // Do not store Contexts inside a struct type; instead, pass a Context
-// explicitly to each function that needs it.  The Context should be the first
+// explicitly to each function that needs it. The Context should be the first
 // parameter, typically named ctx:
 //
 // 	func DoSomething(ctx context.Context, arg Arg) error {
 // 		// ... use ctx ...
 // 	}
 //
-// Do not pass a nil Context, even if a function permits it.  Pass context.TODO
+// Do not pass a nil Context, even if a function permits it. Pass context.TODO
 // if you are unsure about which Context to use.
 //
 // Use context Values only for request-scoped data that transits processes and
@@ -44,13 +44,13 @@ import "time"
 // Context's methods may be called by multiple goroutines simultaneously.
 type Context interface {
 	// Deadline returns the time when work done on behalf of this context
-	// should be canceled.  Deadline returns ok==false when no deadline is
-	// set.  Successive calls to Deadline return the same results.
+	// should be canceled. Deadline returns ok==false when no deadline is
+	// set. Successive calls to Deadline return the same results.
 	Deadline() (deadline time.Time, ok bool)
 
 	// Done returns a channel that's closed when work done on behalf of this
-	// context should be canceled.  Done may return nil if this context can
-	// never be canceled.  Successive calls to Done return the same value.
+	// context should be canceled. Done may return nil if this context can
+	// never be canceled. Successive calls to Done return the same value.
 	//
 	// WithCancel arranges for Done to be closed when cancel is called;
 	// WithDeadline arranges for Done to be closed when the deadline
@@ -79,24 +79,24 @@ type Context interface {
 	// a Done channel for cancelation.
 	Done() <-chan struct{}
 
-	// Err returns a non-nil error value after Done is closed.  Err returns
+	// Err returns a non-nil error value after Done is closed. Err returns
 	// Canceled if the context was canceled or DeadlineExceeded if the
-	// context's deadline passed.  No other values for Err are defined.
+	// context's deadline passed. No other values for Err are defined.
 	// After Done is closed, successive calls to Err return the same value.
 	Err() error
 
 	// Value returns the value associated with this context for key, or nil
-	// if no value is associated with key.  Successive calls to Value with
+	// if no value is associated with key. Successive calls to Value with
 	// the same key returns the same result.
 	//
 	// Use context values only for request-scoped data that transits
 	// processes and API boundaries, not for passing optional parameters to
 	// functions.
 	//
-	// A key identifies a specific value in a Context.  Functions that wish
+	// A key identifies a specific value in a Context. Functions that wish
 	// to store values in Context typically allocate a key in a global
 	// variable then use that key as the argument to context.WithValue and
-	// Context.Value.  A key can be any type that supports equality;
+	// Context.Value. A key can be any type that supports equality;
 	// packages should define keys as an unexported type to avoid
 	// collisions.
 	//
@@ -115,7 +115,7 @@ type Context interface {
 	// 	// This prevents collisions with keys defined in other packages.
 	// 	type key int
 	//
-	// 	// userKey is the key for user.User values in Contexts.  It is
+	// 	// userKey is the key for user.User values in Contexts. It is
 	// 	// unexported; clients use user.NewContext and user.FromContext
 	// 	// instead of using this key directly.
 	// 	var userKey key = 0
@@ -134,14 +134,14 @@ type Context interface {
 }
 
 // Background returns a non-nil, empty Context. It is never canceled, has no
-// values, and has no deadline.  It is typically used by the main function,
+// values, and has no deadline. It is typically used by the main function,
 // initialization, and tests, and as the top-level Context for incoming
 // requests.
 func Background() Context {
 	return background
 }
 
-// TODO returns a non-nil, empty Context.  Code should use context.TODO when
+// TODO returns a non-nil, empty Context. Code should use context.TODO when
 // it's unclear which Context to use or it is not yet available (because the
 // surrounding function has not yet been extended to accept a Context
 // parameter).  TODO is recognized by static analysis tools that determine
diff --git a/components/engine/vendor/golang.org/x/net/context/go17.go b/components/engine/vendor/golang.org/x/net/context/go17.go
index f8cda19ada..d20f52b7de 100644
--- a/components/engine/vendor/golang.org/x/net/context/go17.go
+++ b/components/engine/vendor/golang.org/x/net/context/go17.go
@@ -35,8 +35,8 @@ func WithCancel(parent Context) (ctx Context, cancel CancelFunc) {
 }
 
 // WithDeadline returns a copy of the parent context with the deadline adjusted
-// to be no later than d.  If the parent's deadline is already earlier than d,
-// WithDeadline(parent, d) is semantically equivalent to parent.  The returned
+// to be no later than d. If the parent's deadline is already earlier than d,
+// WithDeadline(parent, d) is semantically equivalent to parent. The returned
 // context's Done channel is closed when the deadline expires, when the returned
 // cancel function is called, or when the parent context's Done channel is
 // closed, whichever happens first.
diff --git a/components/engine/vendor/golang.org/x/net/context/pre_go17.go b/components/engine/vendor/golang.org/x/net/context/pre_go17.go
index 5a30acabd0..0f35592df5 100644
--- a/components/engine/vendor/golang.org/x/net/context/pre_go17.go
+++ b/components/engine/vendor/golang.org/x/net/context/pre_go17.go
@@ -13,7 +13,7 @@ import (
 	"time"
 )
 
-// An emptyCtx is never canceled, has no values, and has no deadline.  It is not
+// An emptyCtx is never canceled, has no values, and has no deadline. It is not
 // struct{}, since vars of this type must have distinct addresses.
 type emptyCtx int
 
@@ -104,7 +104,7 @@ func propagateCancel(parent Context, child canceler) {
 }
 
 // parentCancelCtx follows a chain of parent references until it finds a
-// *cancelCtx.  This function understands how each of the concrete types in this
+// *cancelCtx. This function understands how each of the concrete types in this
 // package represents its parent.
 func parentCancelCtx(parent Context) (*cancelCtx, bool) {
 	for {
@@ -134,14 +134,14 @@ func removeChild(parent Context, child canceler) {
 	p.mu.Unlock()
 }
 
-// A canceler is a context type that can be canceled directly.  The
+// A canceler is a context type that can be canceled directly. The
 // implementations are *cancelCtx and *timerCtx.
 type canceler interface {
 	cancel(removeFromParent bool, err error)
 	Done() <-chan struct{}
 }
 
-// A cancelCtx can be canceled.  When canceled, it also cancels any children
+// A cancelCtx can be canceled. When canceled, it also cancels any children
 // that implement canceler.
 type cancelCtx struct {
 	Context
@@ -193,8 +193,8 @@ func (c *cancelCtx) cancel(removeFromParent bool, err error) {
 }
 
 // WithDeadline returns a copy of the parent context with the deadline adjusted
-// to be no later than d.  If the parent's deadline is already earlier than d,
-// WithDeadline(parent, d) is semantically equivalent to parent.  The returned
+// to be no later than d. If the parent's deadline is already earlier than d,
+// WithDeadline(parent, d) is semantically equivalent to parent. The returned
 // context's Done channel is closed when the deadline expires, when the returned
 // cancel function is called, or when the parent context's Done channel is
 // closed, whichever happens first.
@@ -226,8 +226,8 @@ func WithDeadline(parent Context, deadline time.Time) (Context, CancelFunc) {
 	return c, func() { c.cancel(true, Canceled) }
 }
 
-// A timerCtx carries a timer and a deadline.  It embeds a cancelCtx to
-// implement Done and Err.  It implements cancel by stopping its timer then
+// A timerCtx carries a timer and a deadline. It embeds a cancelCtx to
+// implement Done and Err. It implements cancel by stopping its timer then
 // delegating to cancelCtx.cancel.
 type timerCtx struct {
 	*cancelCtx
@@ -281,7 +281,7 @@ func WithValue(parent Context, key interface{}, val interface{}) Context {
 	return &valueCtx{parent, key, val}
 }
 
-// A valueCtx carries a key-value pair.  It implements Value for that key and
+// A valueCtx carries a key-value pair. It implements Value for that key and
 // delegates all other calls to the embedded Context.
 type valueCtx struct {
 	Context
diff --git a/components/engine/vendor/golang.org/x/net/http2/ciphers.go b/components/engine/vendor/golang.org/x/net/http2/ciphers.go
new file mode 100644
index 0000000000..698860b777
--- /dev/null
+++ b/components/engine/vendor/golang.org/x/net/http2/ciphers.go
@@ -0,0 +1,641 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package http2
+
+// A list of the possible cipher suite ids. Taken from
+// http://www.iana.org/assignments/tls-parameters/tls-parameters.txt
+
+const (
+	cipher_TLS_NULL_WITH_NULL_NULL               uint16 = 0x0000
+	cipher_TLS_RSA_WITH_NULL_MD5                 uint16 = 0x0001
+	cipher_TLS_RSA_WITH_NULL_SHA                 uint16 = 0x0002
+	cipher_TLS_RSA_EXPORT_WITH_RC4_40_MD5        uint16 = 0x0003
+	cipher_TLS_RSA_WITH_RC4_128_MD5              uint16 = 0x0004
+	cipher_TLS_RSA_WITH_RC4_128_SHA              uint16 = 0x0005
+	cipher_TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5    uint16 = 0x0006
+	cipher_TLS_RSA_WITH_IDEA_CBC_SHA             uint16 = 0x0007
+	cipher_TLS_RSA_EXPORT_WITH_DES40_CBC_SHA     uint16 = 0x0008
+	cipher_TLS_RSA_WITH_DES_CBC_SHA              uint16 = 0x0009
+	cipher_TLS_RSA_WITH_3DES_EDE_CBC_SHA         uint16 = 0x000A
+	cipher_TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA  uint16 = 0x000B
+	cipher_TLS_DH_DSS_WITH_DES_CBC_SHA           uint16 = 0x000C
+	cipher_TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA      uint16 = 0x000D
+	cipher_TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA  uint16 = 0x000E
+	cipher_TLS_DH_RSA_WITH_DES_CBC_SHA           uint16 = 0x000F
+	cipher_TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA      uint16 = 0x0010
+	cipher_TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA uint16 = 0x0011
+	cipher_TLS_DHE_DSS_WITH_DES_CBC_SHA          uint16 = 0x0012
+	cipher_TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA     uint16 = 0x0013
+	cipher_TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA uint16 = 0x0014
+	cipher_TLS_DHE_RSA_WITH_DES_CBC_SHA          uint16 = 0x0015
+	cipher_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA     uint16 = 0x0016
+	cipher_TLS_DH_anon_EXPORT_WITH_RC4_40_MD5    uint16 = 0x0017
+	cipher_TLS_DH_anon_WITH_RC4_128_MD5          uint16 = 0x0018
+	cipher_TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA uint16 = 0x0019
+	cipher_TLS_DH_anon_WITH_DES_CBC_SHA          uint16 = 0x001A
+	cipher_TLS_DH_anon_WITH_3DES_EDE_CBC_SHA     uint16 = 0x001B
+	// Reserved uint16 =  0x001C-1D
+	cipher_TLS_KRB5_WITH_DES_CBC_SHA             uint16 = 0x001E
+	cipher_TLS_KRB5_WITH_3DES_EDE_CBC_SHA        uint16 = 0x001F
+	cipher_TLS_KRB5_WITH_RC4_128_SHA             uint16 = 0x0020
+	cipher_TLS_KRB5_WITH_IDEA_CBC_SHA            uint16 = 0x0021
+	cipher_TLS_KRB5_WITH_DES_CBC_MD5             uint16 = 0x0022
+	cipher_TLS_KRB5_WITH_3DES_EDE_CBC_MD5        uint16 = 0x0023
+	cipher_TLS_KRB5_WITH_RC4_128_MD5             uint16 = 0x0024
+	cipher_TLS_KRB5_WITH_IDEA_CBC_MD5            uint16 = 0x0025
+	cipher_TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA   uint16 = 0x0026
+	cipher_TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA   uint16 = 0x0027
+	cipher_TLS_KRB5_EXPORT_WITH_RC4_40_SHA       uint16 = 0x0028
+	cipher_TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5   uint16 = 0x0029
+	cipher_TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5   uint16 = 0x002A
+	cipher_TLS_KRB5_EXPORT_WITH_RC4_40_MD5       uint16 = 0x002B
+	cipher_TLS_PSK_WITH_NULL_SHA                 uint16 = 0x002C
+	cipher_TLS_DHE_PSK_WITH_NULL_SHA             uint16 = 0x002D
+	cipher_TLS_RSA_PSK_WITH_NULL_SHA             uint16 = 0x002E
+	cipher_TLS_RSA_WITH_AES_128_CBC_SHA          uint16 = 0x002F
+	cipher_TLS_DH_DSS_WITH_AES_128_CBC_SHA       uint16 = 0x0030
+	cipher_TLS_DH_RSA_WITH_AES_128_CBC_SHA       uint16 = 0x0031
+	cipher_TLS_DHE_DSS_WITH_AES_128_CBC_SHA      uint16 = 0x0032
+	cipher_TLS_DHE_RSA_WITH_AES_128_CBC_SHA      uint16 = 0x0033
+	cipher_TLS_DH_anon_WITH_AES_128_CBC_SHA      uint16 = 0x0034
+	cipher_TLS_RSA_WITH_AES_256_CBC_SHA          uint16 = 0x0035
+	cipher_TLS_DH_DSS_WITH_AES_256_CBC_SHA       uint16 = 0x0036
+	cipher_TLS_DH_RSA_WITH_AES_256_CBC_SHA       uint16 = 0x0037
+	cipher_TLS_DHE_DSS_WITH_AES_256_CBC_SHA      uint16 = 0x0038
+	cipher_TLS_DHE_RSA_WITH_AES_256_CBC_SHA      uint16 = 0x0039
+	cipher_TLS_DH_anon_WITH_AES_256_CBC_SHA      uint16 = 0x003A
+	cipher_TLS_RSA_WITH_NULL_SHA256              uint16 = 0x003B
+	cipher_TLS_RSA_WITH_AES_128_CBC_SHA256       uint16 = 0x003C
+	cipher_TLS_RSA_WITH_AES_256_CBC_SHA256       uint16 = 0x003D
+	cipher_TLS_DH_DSS_WITH_AES_128_CBC_SHA256    uint16 = 0x003E
+	cipher_TLS_DH_RSA_WITH_AES_128_CBC_SHA256    uint16 = 0x003F
+	cipher_TLS_DHE_DSS_WITH_AES_128_CBC_SHA256   uint16 = 0x0040
+	cipher_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA     uint16 = 0x0041
+	cipher_TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA  uint16 = 0x0042
+	cipher_TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA  uint16 = 0x0043
+	cipher_TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA uint16 = 0x0044
+	cipher_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA uint16 = 0x0045
+	cipher_TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA uint16 = 0x0046
+	// Reserved uint16 =  0x0047-4F
+	// Reserved uint16 =  0x0050-58
+	// Reserved uint16 =  0x0059-5C
+	// Unassigned uint16 =  0x005D-5F
+	// Reserved uint16 =  0x0060-66
+	cipher_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 uint16 = 0x0067
+	cipher_TLS_DH_DSS_WITH_AES_256_CBC_SHA256  uint16 = 0x0068
+	cipher_TLS_DH_RSA_WITH_AES_256_CBC_SHA256  uint16 = 0x0069
+	cipher_TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 uint16 = 0x006A
+	cipher_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 uint16 = 0x006B
+	cipher_TLS_DH_anon_WITH_AES_128_CBC_SHA256 uint16 = 0x006C
+	cipher_TLS_DH_anon_WITH_AES_256_CBC_SHA256 uint16 = 0x006D
+	// Unassigned uint16 =  0x006E-83
+	cipher_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA        uint16 = 0x0084
+	cipher_TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA     uint16 = 0x0085
+	cipher_TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA     uint16 = 0x0086
+	cipher_TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA    uint16 = 0x0087
+	cipher_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA    uint16 = 0x0088
+	cipher_TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA    uint16 = 0x0089
+	cipher_TLS_PSK_WITH_RC4_128_SHA                 uint16 = 0x008A
+	cipher_TLS_PSK_WITH_3DES_EDE_CBC_SHA            uint16 = 0x008B
+	cipher_TLS_PSK_WITH_AES_128_CBC_SHA             uint16 = 0x008C
+	cipher_TLS_PSK_WITH_AES_256_CBC_SHA             uint16 = 0x008D
+	cipher_TLS_DHE_PSK_WITH_RC4_128_SHA             uint16 = 0x008E
+	cipher_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA        uint16 = 0x008F
+	cipher_TLS_DHE_PSK_WITH_AES_128_CBC_SHA         uint16 = 0x0090
+	cipher_TLS_DHE_PSK_WITH_AES_256_CBC_SHA         uint16 = 0x0091
+	cipher_TLS_RSA_PSK_WITH_RC4_128_SHA             uint16 = 0x0092
+	cipher_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA        uint16 = 0x0093
+	cipher_TLS_RSA_PSK_WITH_AES_128_CBC_SHA         uint16 = 0x0094
+	cipher_TLS_RSA_PSK_WITH_AES_256_CBC_SHA         uint16 = 0x0095
+	cipher_TLS_RSA_WITH_SEED_CBC_SHA                uint16 = 0x0096
+	cipher_TLS_DH_DSS_WITH_SEED_CBC_SHA             uint16 = 0x0097
+	cipher_TLS_DH_RSA_WITH_SEED_CBC_SHA             uint16 = 0x0098
+	cipher_TLS_DHE_DSS_WITH_SEED_CBC_SHA            uint16 = 0x0099
+	cipher_TLS_DHE_RSA_WITH_SEED_CBC_SHA            uint16 = 0x009A
+	cipher_TLS_DH_anon_WITH_SEED_CBC_SHA            uint16 = 0x009B
+	cipher_TLS_RSA_WITH_AES_128_GCM_SHA256          uint16 = 0x009C
+	cipher_TLS_RSA_WITH_AES_256_GCM_SHA384          uint16 = 0x009D
+	cipher_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256      uint16 = 0x009E
+	cipher_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384      uint16 = 0x009F
+	cipher_TLS_DH_RSA_WITH_AES_128_GCM_SHA256       uint16 = 0x00A0
+	cipher_TLS_DH_RSA_WITH_AES_256_GCM_SHA384       uint16 = 0x00A1
+	cipher_TLS_DHE_DSS_WITH_AES_128_GCM_SHA256      uint16 = 0x00A2
+	cipher_TLS_DHE_DSS_WITH_AES_256_GCM_SHA384      uint16 = 0x00A3
+	cipher_TLS_DH_DSS_WITH_AES_128_GCM_SHA256       uint16 = 0x00A4
+	cipher_TLS_DH_DSS_WITH_AES_256_GCM_SHA384       uint16 = 0x00A5
+	cipher_TLS_DH_anon_WITH_AES_128_GCM_SHA256      uint16 = 0x00A6
+	cipher_TLS_DH_anon_WITH_AES_256_GCM_SHA384      uint16 = 0x00A7
+	cipher_TLS_PSK_WITH_AES_128_GCM_SHA256          uint16 = 0x00A8
+	cipher_TLS_PSK_WITH_AES_256_GCM_SHA384          uint16 = 0x00A9
+	cipher_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256      uint16 = 0x00AA
+	cipher_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384      uint16 = 0x00AB
+	cipher_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256      uint16 = 0x00AC
+	cipher_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384      uint16 = 0x00AD
+	cipher_TLS_PSK_WITH_AES_128_CBC_SHA256          uint16 = 0x00AE
+	cipher_TLS_PSK_WITH_AES_256_CBC_SHA384          uint16 = 0x00AF
+	cipher_TLS_PSK_WITH_NULL_SHA256                 uint16 = 0x00B0
+	cipher_TLS_PSK_WITH_NULL_SHA384                 uint16 = 0x00B1
+	cipher_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256      uint16 = 0x00B2
+	cipher_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384      uint16 = 0x00B3
+	cipher_TLS_DHE_PSK_WITH_NULL_SHA256             uint16 = 0x00B4
+	cipher_TLS_DHE_PSK_WITH_NULL_SHA384             uint16 = 0x00B5
+	cipher_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256      uint16 = 0x00B6
+	cipher_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384      uint16 = 0x00B7
+	cipher_TLS_RSA_PSK_WITH_NULL_SHA256             uint16 = 0x00B8
+	cipher_TLS_RSA_PSK_WITH_NULL_SHA384             uint16 = 0x00B9
+	cipher_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256     uint16 = 0x00BA
+	cipher_TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256  uint16 = 0x00BB
+	cipher_TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256  uint16 = 0x00BC
+	cipher_TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 uint16 = 0x00BD
+	cipher_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 uint16 = 0x00BE
+	cipher_TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 uint16 = 0x00BF
+	cipher_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256     uint16 = 0x00C0
+	cipher_TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256  uint16 = 0x00C1
+	cipher_TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256  uint16 = 0x00C2
+	cipher_TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 uint16 = 0x00C3
+	cipher_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 uint16 = 0x00C4
+	cipher_TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 uint16 = 0x00C5
+	// Unassigned uint16 =  0x00C6-FE
+	cipher_TLS_EMPTY_RENEGOTIATION_INFO_SCSV uint16 = 0x00FF
+	// Unassigned uint16 =  0x01-55,*
+	cipher_TLS_FALLBACK_SCSV uint16 = 0x5600
+	// Unassigned                                   uint16 = 0x5601 - 0xC000
+	cipher_TLS_ECDH_ECDSA_WITH_NULL_SHA                 uint16 = 0xC001
+	cipher_TLS_ECDH_ECDSA_WITH_RC4_128_SHA              uint16 = 0xC002
+	cipher_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA         uint16 = 0xC003
+	cipher_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA          uint16 = 0xC004
+	cipher_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA          uint16 = 0xC005
+	cipher_TLS_ECDHE_ECDSA_WITH_NULL_SHA                uint16 = 0xC006
+	cipher_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA             uint16 = 0xC007
+	cipher_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA        uint16 = 0xC008
+	cipher_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA         uint16 = 0xC009
+	cipher_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA         uint16 = 0xC00A
+	cipher_TLS_ECDH_RSA_WITH_NULL_SHA                   uint16 = 0xC00B
+	cipher_TLS_ECDH_RSA_WITH_RC4_128_SHA                uint16 = 0xC00C
+	cipher_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA           uint16 = 0xC00D
+	cipher_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA            uint16 = 0xC00E
+	cipher_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA            uint16 = 0xC00F
+	cipher_TLS_ECDHE_RSA_WITH_NULL_SHA                  uint16 = 0xC010
+	cipher_TLS_ECDHE_RSA_WITH_RC4_128_SHA               uint16 = 0xC011
+	cipher_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA          uint16 = 0xC012
+	cipher_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA           uint16 = 0xC013
+	cipher_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA           uint16 = 0xC014
+	cipher_TLS_ECDH_anon_WITH_NULL_SHA                  uint16 = 0xC015
+	cipher_TLS_ECDH_anon_WITH_RC4_128_SHA               uint16 = 0xC016
+	cipher_TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA          uint16 = 0xC017
+	cipher_TLS_ECDH_anon_WITH_AES_128_CBC_SHA           uint16 = 0xC018
+	cipher_TLS_ECDH_anon_WITH_AES_256_CBC_SHA           uint16 = 0xC019
+	cipher_TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA            uint16 = 0xC01A
+	cipher_TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA        uint16 = 0xC01B
+	cipher_TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA        uint16 = 0xC01C
+	cipher_TLS_SRP_SHA_WITH_AES_128_CBC_SHA             uint16 = 0xC01D
+	cipher_TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA         uint16 = 0xC01E
+	cipher_TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA         uint16 = 0xC01F
+	cipher_TLS_SRP_SHA_WITH_AES_256_CBC_SHA             uint16 = 0xC020
+	cipher_TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA         uint16 = 0xC021
+	cipher_TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA         uint16 = 0xC022
+	cipher_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256      uint16 = 0xC023
+	cipher_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384      uint16 = 0xC024
+	cipher_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256       uint16 = 0xC025
+	cipher_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384       uint16 = 0xC026
+	cipher_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256        uint16 = 0xC027
+	cipher_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384        uint16 = 0xC028
+	cipher_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256         uint16 = 0xC029
+	cipher_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384         uint16 = 0xC02A
+	cipher_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256      uint16 = 0xC02B
+	cipher_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384      uint16 = 0xC02C
+	cipher_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256       uint16 = 0xC02D
+	cipher_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384       uint16 = 0xC02E
+	cipher_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256        uint16 = 0xC02F
+	cipher_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384        uint16 = 0xC030
+	cipher_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256         uint16 = 0xC031
+	cipher_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384         uint16 = 0xC032
+	cipher_TLS_ECDHE_PSK_WITH_RC4_128_SHA               uint16 = 0xC033
+	cipher_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA          uint16 = 0xC034
+	cipher_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA           uint16 = 0xC035
+	cipher_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA           uint16 = 0xC036
+	cipher_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256        uint16 = 0xC037
+	cipher_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384        uint16 = 0xC038
+	cipher_TLS_ECDHE_PSK_WITH_NULL_SHA                  uint16 = 0xC039
+	cipher_TLS_ECDHE_PSK_WITH_NULL_SHA256               uint16 = 0xC03A
+	cipher_TLS_ECDHE_PSK_WITH_NULL_SHA384               uint16 = 0xC03B
+	cipher_TLS_RSA_WITH_ARIA_128_CBC_SHA256             uint16 = 0xC03C
+	cipher_TLS_RSA_WITH_ARIA_256_CBC_SHA384             uint16 = 0xC03D
+	cipher_TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256          uint16 = 0xC03E
+	cipher_TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384          uint16 = 0xC03F
+	cipher_TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256          uint16 = 0xC040
+	cipher_TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384          uint16 = 0xC041
+	cipher_TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256         uint16 = 0xC042
+	cipher_TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384         uint16 = 0xC043
+	cipher_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256         uint16 = 0xC044
+	cipher_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384         uint16 = 0xC045
+	cipher_TLS_DH_anon_WITH_ARIA_128_CBC_SHA256         uint16 = 0xC046
+	cipher_TLS_DH_anon_WITH_ARIA_256_CBC_SHA384         uint16 = 0xC047
+	cipher_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256     uint16 = 0xC048
+	cipher_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384     uint16 = 0xC049
+	cipher_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256      uint16 = 0xC04A
+	cipher_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384      uint16 = 0xC04B
+	cipher_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256       uint16 = 0xC04C
+	cipher_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384       uint16 = 0xC04D
+	cipher_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256        uint16 = 0xC04E
+	cipher_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384        uint16 = 0xC04F
+	cipher_TLS_RSA_WITH_ARIA_128_GCM_SHA256             uint16 = 0xC050
+	cipher_TLS_RSA_WITH_ARIA_256_GCM_SHA384             uint16 = 0xC051
+	cipher_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256         uint16 = 0xC052
+	cipher_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384         uint16 = 0xC053
+	cipher_TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256          uint16 = 0xC054
+	cipher_TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384          uint16 = 0xC055
+	cipher_TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256         uint16 = 0xC056
+	cipher_TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384         uint16 = 0xC057
+	cipher_TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256          uint16 = 0xC058
+	cipher_TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384          uint16 = 0xC059
+	cipher_TLS_DH_anon_WITH_ARIA_128_GCM_SHA256         uint16 = 0xC05A
+	cipher_TLS_DH_anon_WITH_ARIA_256_GCM_SHA384         uint16 = 0xC05B
+	cipher_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256     uint16 = 0xC05C
+	cipher_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384     uint16 = 0xC05D
+	cipher_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256      uint16 = 0xC05E
+	cipher_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384      uint16 = 0xC05F
+	cipher_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256       uint16 = 0xC060
+	cipher_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384       uint16 = 0xC061
+	cipher_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256        uint16 = 0xC062
+	cipher_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384        uint16 = 0xC063
+	cipher_TLS_PSK_WITH_ARIA_128_CBC_SHA256             uint16 = 0xC064
+	cipher_TLS_PSK_WITH_ARIA_256_CBC_SHA384             uint16 = 0xC065
+	cipher_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256         uint16 = 0xC066
+	cipher_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384         uint16 = 0xC067
+	cipher_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256         uint16 = 0xC068
+	cipher_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384         uint16 = 0xC069
+	cipher_TLS_PSK_WITH_ARIA_128_GCM_SHA256             uint16 = 0xC06A
+	cipher_TLS_PSK_WITH_ARIA_256_GCM_SHA384             uint16 = 0xC06B
+	cipher_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256         uint16 = 0xC06C
+	cipher_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384         uint16 = 0xC06D
+	cipher_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256         uint16 = 0xC06E
+	cipher_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384         uint16 = 0xC06F
+	cipher_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256       uint16 = 0xC070
+	cipher_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384       uint16 = 0xC071
+	cipher_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 uint16 = 0xC072
+	cipher_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 uint16 = 0xC073
+	cipher_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256  uint16 = 0xC074
+	cipher_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384  uint16 = 0xC075
+	cipher_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256   uint16 = 0xC076
+	cipher_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384   uint16 = 0xC077
+	cipher_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256    uint16 = 0xC078
+	cipher_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384    uint16 = 0xC079
+	cipher_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256         uint16 = 0xC07A
+	cipher_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384         uint16 = 0xC07B
+	cipher_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256     uint16 = 0xC07C
+	cipher_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384     uint16 = 0xC07D
+	cipher_TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256      uint16 = 0xC07E
+	cipher_TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384      uint16 = 0xC07F
+	cipher_TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256     uint16 = 0xC080
+	cipher_TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384     uint16 = 0xC081
+	cipher_TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256      uint16 = 0xC082
+	cipher_TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384      uint16 = 0xC083
+	cipher_TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256     uint16 = 0xC084
+	cipher_TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384     uint16 = 0xC085
+	cipher_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 uint16 = 0xC086
+	cipher_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 uint16 = 0xC087
+	cipher_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256  uint16 = 0xC088
+	cipher_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384  uint16 = 0xC089
+	cipher_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256   uint16 = 0xC08A
+	cipher_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384   uint16 = 0xC08B
+	cipher_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256    uint16 = 0xC08C
+	cipher_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384    uint16 = 0xC08D
+	cipher_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256         uint16 = 0xC08E
+	cipher_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384         uint16 = 0xC08F
+	cipher_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256     uint16 = 0xC090
+	cipher_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384     uint16 = 0xC091
+	cipher_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256     uint16 = 0xC092
+	cipher_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384     uint16 = 0xC093
+	cipher_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256         uint16 = 0xC094
+	cipher_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384         uint16 = 0xC095
+	cipher_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256     uint16 = 0xC096
+	cipher_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384     uint16 = 0xC097
+	cipher_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256     uint16 = 0xC098
+	cipher_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384     uint16 = 0xC099
+	cipher_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256   uint16 = 0xC09A
+	cipher_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384   uint16 = 0xC09B
+	cipher_TLS_RSA_WITH_AES_128_CCM                     uint16 = 0xC09C
+	cipher_TLS_RSA_WITH_AES_256_CCM                     uint16 = 0xC09D
+	cipher_TLS_DHE_RSA_WITH_AES_128_CCM                 uint16 = 0xC09E
+	cipher_TLS_DHE_RSA_WITH_AES_256_CCM                 uint16 = 0xC09F
+	cipher_TLS_RSA_WITH_AES_128_CCM_8                   uint16 = 0xC0A0
+	cipher_TLS_RSA_WITH_AES_256_CCM_8                   uint16 = 0xC0A1
+	cipher_TLS_DHE_RSA_WITH_AES_128_CCM_8               uint16 = 0xC0A2
+	cipher_TLS_DHE_RSA_WITH_AES_256_CCM_8               uint16 = 0xC0A3
+	cipher_TLS_PSK_WITH_AES_128_CCM                     uint16 = 0xC0A4
+	cipher_TLS_PSK_WITH_AES_256_CCM                     uint16 = 0xC0A5
+	cipher_TLS_DHE_PSK_WITH_AES_128_CCM                 uint16 = 0xC0A6
+	cipher_TLS_DHE_PSK_WITH_AES_256_CCM                 uint16 = 0xC0A7
+	cipher_TLS_PSK_WITH_AES_128_CCM_8                   uint16 = 0xC0A8
+	cipher_TLS_PSK_WITH_AES_256_CCM_8                   uint16 = 0xC0A9
+	cipher_TLS_PSK_DHE_WITH_AES_128_CCM_8               uint16 = 0xC0AA
+	cipher_TLS_PSK_DHE_WITH_AES_256_CCM_8               uint16 = 0xC0AB
+	cipher_TLS_ECDHE_ECDSA_WITH_AES_128_CCM             uint16 = 0xC0AC
+	cipher_TLS_ECDHE_ECDSA_WITH_AES_256_CCM             uint16 = 0xC0AD
+	cipher_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8           uint16 = 0xC0AE
+	cipher_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8           uint16 = 0xC0AF
+	// Unassigned uint16 =  0xC0B0-FF
+	// Unassigned uint16 =  0xC1-CB,*
+	// Unassigned uint16 =  0xCC00-A7
+	cipher_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256   uint16 = 0xCCA8
+	cipher_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 uint16 = 0xCCA9
+	cipher_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256     uint16 = 0xCCAA
+	cipher_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256         uint16 = 0xCCAB
+	cipher_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256   uint16 = 0xCCAC
+	cipher_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256     uint16 = 0xCCAD
+	cipher_TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256     uint16 = 0xCCAE
+)
+
+// isBadCipher reports whether the cipher is blacklisted by the HTTP/2 spec.
+// References:
+// https://tools.ietf.org/html/rfc7540#appendix-A
+// Reject cipher suites from Appendix A.
+// "This list includes those cipher suites that do not
+// offer an ephemeral key exchange and those that are
+// based on the TLS null, stream or block cipher type"
+func isBadCipher(cipher uint16) bool {
+	switch cipher {
+	case cipher_TLS_NULL_WITH_NULL_NULL,
+		cipher_TLS_RSA_WITH_NULL_MD5,
+		cipher_TLS_RSA_WITH_NULL_SHA,
+		cipher_TLS_RSA_EXPORT_WITH_RC4_40_MD5,
+		cipher_TLS_RSA_WITH_RC4_128_MD5,
+		cipher_TLS_RSA_WITH_RC4_128_SHA,
+		cipher_TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5,
+		cipher_TLS_RSA_WITH_IDEA_CBC_SHA,
+		cipher_TLS_RSA_EXPORT_WITH_DES40_CBC_SHA,
+		cipher_TLS_RSA_WITH_DES_CBC_SHA,
+		cipher_TLS_RSA_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA,
+		cipher_TLS_DH_DSS_WITH_DES_CBC_SHA,
+		cipher_TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA,
+		cipher_TLS_DH_RSA_WITH_DES_CBC_SHA,
+		cipher_TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA,
+		cipher_TLS_DHE_DSS_WITH_DES_CBC_SHA,
+		cipher_TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
+		cipher_TLS_DHE_RSA_WITH_DES_CBC_SHA,
+		cipher_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_DH_anon_EXPORT_WITH_RC4_40_MD5,
+		cipher_TLS_DH_anon_WITH_RC4_128_MD5,
+		cipher_TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA,
+		cipher_TLS_DH_anon_WITH_DES_CBC_SHA,
+		cipher_TLS_DH_anon_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_KRB5_WITH_DES_CBC_SHA,
+		cipher_TLS_KRB5_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_KRB5_WITH_RC4_128_SHA,
+		cipher_TLS_KRB5_WITH_IDEA_CBC_SHA,
+		cipher_TLS_KRB5_WITH_DES_CBC_MD5,
+		cipher_TLS_KRB5_WITH_3DES_EDE_CBC_MD5,
+		cipher_TLS_KRB5_WITH_RC4_128_MD5,
+		cipher_TLS_KRB5_WITH_IDEA_CBC_MD5,
+		cipher_TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA,
+		cipher_TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA,
+		cipher_TLS_KRB5_EXPORT_WITH_RC4_40_SHA,
+		cipher_TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5,
+		cipher_TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5,
+		cipher_TLS_KRB5_EXPORT_WITH_RC4_40_MD5,
+		cipher_TLS_PSK_WITH_NULL_SHA,
+		cipher_TLS_DHE_PSK_WITH_NULL_SHA,
+		cipher_TLS_RSA_PSK_WITH_NULL_SHA,
+		cipher_TLS_RSA_WITH_AES_128_CBC_SHA,
+		cipher_TLS_DH_DSS_WITH_AES_128_CBC_SHA,
+		cipher_TLS_DH_RSA_WITH_AES_128_CBC_SHA,
+		cipher_TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
+		cipher_TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
+		cipher_TLS_DH_anon_WITH_AES_128_CBC_SHA,
+		cipher_TLS_RSA_WITH_AES_256_CBC_SHA,
+		cipher_TLS_DH_DSS_WITH_AES_256_CBC_SHA,
+		cipher_TLS_DH_RSA_WITH_AES_256_CBC_SHA,
+		cipher_TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
+		cipher_TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
+		cipher_TLS_DH_anon_WITH_AES_256_CBC_SHA,
+		cipher_TLS_RSA_WITH_NULL_SHA256,
+		cipher_TLS_RSA_WITH_AES_128_CBC_SHA256,
+		cipher_TLS_RSA_WITH_AES_256_CBC_SHA256,
+		cipher_TLS_DH_DSS_WITH_AES_128_CBC_SHA256,
+		cipher_TLS_DH_RSA_WITH_AES_128_CBC_SHA256,
+		cipher_TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,
+		cipher_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,
+		cipher_TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
+		cipher_TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
+		cipher_TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
+		cipher_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
+		cipher_TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA,
+		cipher_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
+		cipher_TLS_DH_DSS_WITH_AES_256_CBC_SHA256,
+		cipher_TLS_DH_RSA_WITH_AES_256_CBC_SHA256,
+		cipher_TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,
+		cipher_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
+		cipher_TLS_DH_anon_WITH_AES_128_CBC_SHA256,
+		cipher_TLS_DH_anon_WITH_AES_256_CBC_SHA256,
+		cipher_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,
+		cipher_TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
+		cipher_TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
+		cipher_TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
+		cipher_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
+		cipher_TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA,
+		cipher_TLS_PSK_WITH_RC4_128_SHA,
+		cipher_TLS_PSK_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_PSK_WITH_AES_128_CBC_SHA,
+		cipher_TLS_PSK_WITH_AES_256_CBC_SHA,
+		cipher_TLS_DHE_PSK_WITH_RC4_128_SHA,
+		cipher_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_DHE_PSK_WITH_AES_128_CBC_SHA,
+		cipher_TLS_DHE_PSK_WITH_AES_256_CBC_SHA,
+		cipher_TLS_RSA_PSK_WITH_RC4_128_SHA,
+		cipher_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_RSA_PSK_WITH_AES_128_CBC_SHA,
+		cipher_TLS_RSA_PSK_WITH_AES_256_CBC_SHA,
+		cipher_TLS_RSA_WITH_SEED_CBC_SHA,
+		cipher_TLS_DH_DSS_WITH_SEED_CBC_SHA,
+		cipher_TLS_DH_RSA_WITH_SEED_CBC_SHA,
+		cipher_TLS_DHE_DSS_WITH_SEED_CBC_SHA,
+		cipher_TLS_DHE_RSA_WITH_SEED_CBC_SHA,
+		cipher_TLS_DH_anon_WITH_SEED_CBC_SHA,
+		cipher_TLS_RSA_WITH_AES_128_GCM_SHA256,
+		cipher_TLS_RSA_WITH_AES_256_GCM_SHA384,
+		cipher_TLS_DH_RSA_WITH_AES_128_GCM_SHA256,
+		cipher_TLS_DH_RSA_WITH_AES_256_GCM_SHA384,
+		cipher_TLS_DH_DSS_WITH_AES_128_GCM_SHA256,
+		cipher_TLS_DH_DSS_WITH_AES_256_GCM_SHA384,
+		cipher_TLS_DH_anon_WITH_AES_128_GCM_SHA256,
+		cipher_TLS_DH_anon_WITH_AES_256_GCM_SHA384,
+		cipher_TLS_PSK_WITH_AES_128_GCM_SHA256,
+		cipher_TLS_PSK_WITH_AES_256_GCM_SHA384,
+		cipher_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256,
+		cipher_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384,
+		cipher_TLS_PSK_WITH_AES_128_CBC_SHA256,
+		cipher_TLS_PSK_WITH_AES_256_CBC_SHA384,
+		cipher_TLS_PSK_WITH_NULL_SHA256,
+		cipher_TLS_PSK_WITH_NULL_SHA384,
+		cipher_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256,
+		cipher_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384,
+		cipher_TLS_DHE_PSK_WITH_NULL_SHA256,
+		cipher_TLS_DHE_PSK_WITH_NULL_SHA384,
+		cipher_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256,
+		cipher_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384,
+		cipher_TLS_RSA_PSK_WITH_NULL_SHA256,
+		cipher_TLS_RSA_PSK_WITH_NULL_SHA384,
+		cipher_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256,
+		cipher_TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256,
+		cipher_TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256,
+		cipher_TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256,
+		cipher_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
+		cipher_TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256,
+		cipher_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256,
+		cipher_TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256,
+		cipher_TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256,
+		cipher_TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256,
+		cipher_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
+		cipher_TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256,
+		cipher_TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
+		cipher_TLS_ECDH_ECDSA_WITH_NULL_SHA,
+		cipher_TLS_ECDH_ECDSA_WITH_RC4_128_SHA,
+		cipher_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
+		cipher_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
+		cipher_TLS_ECDHE_ECDSA_WITH_NULL_SHA,
+		cipher_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
+		cipher_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+		cipher_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+		cipher_TLS_ECDH_RSA_WITH_NULL_SHA,
+		cipher_TLS_ECDH_RSA_WITH_RC4_128_SHA,
+		cipher_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
+		cipher_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,
+		cipher_TLS_ECDHE_RSA_WITH_NULL_SHA,
+		cipher_TLS_ECDHE_RSA_WITH_RC4_128_SHA,
+		cipher_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+		cipher_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+		cipher_TLS_ECDH_anon_WITH_NULL_SHA,
+		cipher_TLS_ECDH_anon_WITH_RC4_128_SHA,
+		cipher_TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_ECDH_anon_WITH_AES_128_CBC_SHA,
+		cipher_TLS_ECDH_anon_WITH_AES_256_CBC_SHA,
+		cipher_TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_SRP_SHA_WITH_AES_128_CBC_SHA,
+		cipher_TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
+		cipher_TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
+		cipher_TLS_SRP_SHA_WITH_AES_256_CBC_SHA,
+		cipher_TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
+		cipher_TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
+		cipher_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
+		cipher_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
+		cipher_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,
+		cipher_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,
+		cipher_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
+		cipher_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
+		cipher_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,
+		cipher_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,
+		cipher_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
+		cipher_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
+		cipher_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,
+		cipher_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,
+		cipher_TLS_ECDHE_PSK_WITH_RC4_128_SHA,
+		cipher_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA,
+		cipher_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA,
+		cipher_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA,
+		cipher_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256,
+		cipher_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384,
+		cipher_TLS_ECDHE_PSK_WITH_NULL_SHA,
+		cipher_TLS_ECDHE_PSK_WITH_NULL_SHA256,
+		cipher_TLS_ECDHE_PSK_WITH_NULL_SHA384,
+		cipher_TLS_RSA_WITH_ARIA_128_CBC_SHA256,
+		cipher_TLS_RSA_WITH_ARIA_256_CBC_SHA384,
+		cipher_TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256,
+		cipher_TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384,
+		cipher_TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256,
+		cipher_TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384,
+		cipher_TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256,
+		cipher_TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384,
+		cipher_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256,
+		cipher_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384,
+		cipher_TLS_DH_anon_WITH_ARIA_128_CBC_SHA256,
+		cipher_TLS_DH_anon_WITH_ARIA_256_CBC_SHA384,
+		cipher_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256,
+		cipher_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384,
+		cipher_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256,
+		cipher_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384,
+		cipher_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256,
+		cipher_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384,
+		cipher_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256,
+		cipher_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384,
+		cipher_TLS_RSA_WITH_ARIA_128_GCM_SHA256,
+		cipher_TLS_RSA_WITH_ARIA_256_GCM_SHA384,
+		cipher_TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256,
+		cipher_TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384,
+		cipher_TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256,
+		cipher_TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384,
+		cipher_TLS_DH_anon_WITH_ARIA_128_GCM_SHA256,
+		cipher_TLS_DH_anon_WITH_ARIA_256_GCM_SHA384,
+		cipher_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256,
+		cipher_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384,
+		cipher_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256,
+		cipher_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384,
+		cipher_TLS_PSK_WITH_ARIA_128_CBC_SHA256,
+		cipher_TLS_PSK_WITH_ARIA_256_CBC_SHA384,
+		cipher_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256,
+		cipher_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384,
+		cipher_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256,
+		cipher_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384,
+		cipher_TLS_PSK_WITH_ARIA_128_GCM_SHA256,
+		cipher_TLS_PSK_WITH_ARIA_256_GCM_SHA384,
+		cipher_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256,
+		cipher_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384,
+		cipher_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256,
+		cipher_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384,
+		cipher_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,
+		cipher_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,
+		cipher_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,
+		cipher_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,
+		cipher_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
+		cipher_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384,
+		cipher_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256,
+		cipher_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384,
+		cipher_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256,
+		cipher_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384,
+		cipher_TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256,
+		cipher_TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384,
+		cipher_TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256,
+		cipher_TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384,
+		cipher_TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256,
+		cipher_TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384,
+		cipher_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256,
+		cipher_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384,
+		cipher_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256,
+		cipher_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384,
+		cipher_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256,
+		cipher_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384,
+		cipher_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256,
+		cipher_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384,
+		cipher_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256,
+		cipher_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384,
+		cipher_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
+		cipher_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
+		cipher_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256,
+		cipher_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384,
+		cipher_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
+		cipher_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
+		cipher_TLS_RSA_WITH_AES_128_CCM,
+		cipher_TLS_RSA_WITH_AES_256_CCM,
+		cipher_TLS_RSA_WITH_AES_128_CCM_8,
+		cipher_TLS_RSA_WITH_AES_256_CCM_8,
+		cipher_TLS_PSK_WITH_AES_128_CCM,
+		cipher_TLS_PSK_WITH_AES_256_CCM,
+		cipher_TLS_PSK_WITH_AES_128_CCM_8,
+		cipher_TLS_PSK_WITH_AES_256_CCM_8:
+		return true
+	default:
+		return false
+	}
+}
diff --git a/components/engine/vendor/golang.org/x/net/http2/client_conn_pool.go b/components/engine/vendor/golang.org/x/net/http2/client_conn_pool.go
index b13941258a..bdf5652b01 100644
--- a/components/engine/vendor/golang.org/x/net/http2/client_conn_pool.go
+++ b/components/engine/vendor/golang.org/x/net/http2/client_conn_pool.go
@@ -247,7 +247,7 @@ func filterOutClientConn(in []*ClientConn, exclude *ClientConn) []*ClientConn {
 }
 
 // noDialClientConnPool is an implementation of http2.ClientConnPool
-// which never dials.  We let the HTTP/1.1 client dial and use its TLS
+// which never dials. We let the HTTP/1.1 client dial and use its TLS
 // connection instead.
 type noDialClientConnPool struct{ *clientConnPool }
 
diff --git a/components/engine/vendor/golang.org/x/net/http2/databuffer.go b/components/engine/vendor/golang.org/x/net/http2/databuffer.go
new file mode 100644
index 0000000000..a3067f8de7
--- /dev/null
+++ b/components/engine/vendor/golang.org/x/net/http2/databuffer.go
@@ -0,0 +1,146 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package http2
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+)
+
+// Buffer chunks are allocated from a pool to reduce pressure on GC.
+// The maximum wasted space per dataBuffer is 2x the largest size class,
+// which happens when the dataBuffer has multiple chunks and there is
+// one unread byte in both the first and last chunks. We use a few size
+// classes to minimize overheads for servers that typically receive very
+// small request bodies.
+//
+// TODO: Benchmark to determine if the pools are necessary. The GC may have
+// improved enough that we can instead allocate chunks like this:
+// make([]byte, max(16<<10, expectedBytesRemaining))
+var (
+	dataChunkSizeClasses = []int{
+		1 << 10,
+		2 << 10,
+		4 << 10,
+		8 << 10,
+		16 << 10,
+	}
+	dataChunkPools = [...]sync.Pool{
+		{New: func() interface{} { return make([]byte, 1<<10) }},
+		{New: func() interface{} { return make([]byte, 2<<10) }},
+		{New: func() interface{} { return make([]byte, 4<<10) }},
+		{New: func() interface{} { return make([]byte, 8<<10) }},
+		{New: func() interface{} { return make([]byte, 16<<10) }},
+	}
+)
+
+func getDataBufferChunk(size int64) []byte {
+	i := 0
+	for ; i < len(dataChunkSizeClasses)-1; i++ {
+		if size <= int64(dataChunkSizeClasses[i]) {
+			break
+		}
+	}
+	return dataChunkPools[i].Get().([]byte)
+}
+
+func putDataBufferChunk(p []byte) {
+	for i, n := range dataChunkSizeClasses {
+		if len(p) == n {
+			dataChunkPools[i].Put(p)
+			return
+		}
+	}
+	panic(fmt.Sprintf("unexpected buffer len=%v", len(p)))
+}
+
+// dataBuffer is an io.ReadWriter backed by a list of data chunks.
+// Each dataBuffer is used to read DATA frames on a single stream.
+// The buffer is divided into chunks so the server can limit the
+// total memory used by a single connection without limiting the
+// request body size on any single stream.
+type dataBuffer struct {
+	chunks   [][]byte
+	r        int   // next byte to read is chunks[0][r]
+	w        int   // next byte to write is chunks[len(chunks)-1][w]
+	size     int   // total buffered bytes
+	expected int64 // we expect at least this many bytes in future Write calls (ignored if <= 0)
+}
+
+var errReadEmpty = errors.New("read from empty dataBuffer")
+
+// Read copies bytes from the buffer into p.
+// It is an error to read when no data is available.
+func (b *dataBuffer) Read(p []byte) (int, error) {
+	if b.size == 0 {
+		return 0, errReadEmpty
+	}
+	var ntotal int
+	for len(p) > 0 && b.size > 0 {
+		readFrom := b.bytesFromFirstChunk()
+		n := copy(p, readFrom)
+		p = p[n:]
+		ntotal += n
+		b.r += n
+		b.size -= n
+		// If the first chunk has been consumed, advance to the next chunk.
+		if b.r == len(b.chunks[0]) {
+			putDataBufferChunk(b.chunks[0])
+			end := len(b.chunks) - 1
+			copy(b.chunks[:end], b.chunks[1:])
+			b.chunks[end] = nil
+			b.chunks = b.chunks[:end]
+			b.r = 0
+		}
+	}
+	return ntotal, nil
+}
+
+func (b *dataBuffer) bytesFromFirstChunk() []byte {
+	if len(b.chunks) == 1 {
+		return b.chunks[0][b.r:b.w]
+	}
+	return b.chunks[0][b.r:]
+}
+
+// Len returns the number of bytes of the unread portion of the buffer.
+func (b *dataBuffer) Len() int {
+	return b.size
+}
+
+// Write appends p to the buffer.
+func (b *dataBuffer) Write(p []byte) (int, error) {
+	ntotal := len(p)
+	for len(p) > 0 {
+		// If the last chunk is empty, allocate a new chunk. Try to allocate
+		// enough to fully copy p plus any additional bytes we expect to
+		// receive. However, this may allocate less than len(p).
+		want := int64(len(p))
+		if b.expected > want {
+			want = b.expected
+		}
+		chunk := b.lastChunkOrAlloc(want)
+		n := copy(chunk[b.w:], p)
+		p = p[n:]
+		b.w += n
+		b.size += n
+		b.expected -= int64(n)
+	}
+	return ntotal, nil
+}
+
+func (b *dataBuffer) lastChunkOrAlloc(want int64) []byte {
+	if len(b.chunks) != 0 {
+		last := b.chunks[len(b.chunks)-1]
+		if b.w < len(last) {
+			return last
+		}
+	}
+	chunk := getDataBufferChunk(want)
+	b.chunks = append(b.chunks, chunk)
+	b.w = 0
+	return chunk
+}
diff --git a/components/engine/vendor/golang.org/x/net/http2/fixed_buffer.go b/components/engine/vendor/golang.org/x/net/http2/fixed_buffer.go
deleted file mode 100644
index 47da0f0bf7..0000000000
--- a/components/engine/vendor/golang.org/x/net/http2/fixed_buffer.go
+++ /dev/null
@@ -1,60 +0,0 @@
-// Copyright 2014 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package http2
-
-import (
-	"errors"
-)
-
-// fixedBuffer is an io.ReadWriter backed by a fixed size buffer.
-// It never allocates, but moves old data as new data is written.
-type fixedBuffer struct {
-	buf  []byte
-	r, w int
-}
-
-var (
-	errReadEmpty = errors.New("read from empty fixedBuffer")
-	errWriteFull = errors.New("write on full fixedBuffer")
-)
-
-// Read copies bytes from the buffer into p.
-// It is an error to read when no data is available.
-func (b *fixedBuffer) Read(p []byte) (n int, err error) {
-	if b.r == b.w {
-		return 0, errReadEmpty
-	}
-	n = copy(p, b.buf[b.r:b.w])
-	b.r += n
-	if b.r == b.w {
-		b.r = 0
-		b.w = 0
-	}
-	return n, nil
-}
-
-// Len returns the number of bytes of the unread portion of the buffer.
-func (b *fixedBuffer) Len() int {
-	return b.w - b.r
-}
-
-// Write copies bytes from p into the buffer.
-// It is an error to write more data than the buffer can hold.
-func (b *fixedBuffer) Write(p []byte) (n int, err error) {
-	// Slide existing data to beginning.
-	if b.r > 0 && len(p) > len(b.buf)-b.w {
-		copy(b.buf, b.buf[b.r:b.w])
-		b.w -= b.r
-		b.r = 0
-	}
-
-	// Write new data.
-	n = copy(b.buf[b.w:], p)
-	b.w += n
-	if n < len(p) {
-		err = errWriteFull
-	}
-	return n, err
-}
diff --git a/components/engine/vendor/golang.org/x/net/http2/frame.go b/components/engine/vendor/golang.org/x/net/http2/frame.go
index 358833fedf..3b14890728 100644
--- a/components/engine/vendor/golang.org/x/net/http2/frame.go
+++ b/components/engine/vendor/golang.org/x/net/http2/frame.go
@@ -122,7 +122,7 @@ var flagName = map[FrameType]map[Flags]string{
 // a frameParser parses a frame given its FrameHeader and payload
 // bytes. The length of payload will always equal fh.Length (which
 // might be 0).
-type frameParser func(fh FrameHeader, payload []byte) (Frame, error)
+type frameParser func(fc *frameCache, fh FrameHeader, payload []byte) (Frame, error)
 
 var frameParsers = map[FrameType]frameParser{
 	FrameData:         parseDataFrame,
@@ -312,7 +312,7 @@ type Framer struct {
 	MaxHeaderListSize uint32
 
 	// TODO: track which type of frame & with which flags was sent
-	// last.  Then return an error (unless AllowIllegalWrites) if
+	// last. Then return an error (unless AllowIllegalWrites) if
 	// we're in the middle of a header block and a
 	// non-Continuation or Continuation on a different stream is
 	// attempted to be written.
@@ -323,6 +323,8 @@ type Framer struct {
 	debugFramerBuf    *bytes.Buffer
 	debugReadLoggerf  func(string, ...interface{})
 	debugWriteLoggerf func(string, ...interface{})
+
+	frameCache *frameCache // nil if frames aren't reused (default)
 }
 
 func (fr *Framer) maxHeaderListSize() uint32 {
@@ -398,6 +400,27 @@ const (
 	maxFrameSize    = 1<<24 - 1
 )
 
+// SetReuseFrames allows the Framer to reuse Frames.
+// If called on a Framer, Frames returned by calls to ReadFrame are only
+// valid until the next call to ReadFrame.
+func (fr *Framer) SetReuseFrames() {
+	if fr.frameCache != nil {
+		return
+	}
+	fr.frameCache = &frameCache{}
+}
+
+type frameCache struct {
+	dataFrame DataFrame
+}
+
+func (fc *frameCache) getDataFrame() *DataFrame {
+	if fc == nil {
+		return &DataFrame{}
+	}
+	return &fc.dataFrame
+}
+
 // NewFramer returns a Framer that writes frames to w and reads them from r.
 func NewFramer(w io.Writer, r io.Reader) *Framer {
 	fr := &Framer{
@@ -477,7 +500,7 @@ func (fr *Framer) ReadFrame() (Frame, error) {
 	if _, err := io.ReadFull(fr.r, payload); err != nil {
 		return nil, err
 	}
-	f, err := typeFrameParser(fh.Type)(fh, payload)
+	f, err := typeFrameParser(fh.Type)(fr.frameCache, fh, payload)
 	if err != nil {
 		if ce, ok := err.(connError); ok {
 			return nil, fr.connError(ce.Code, ce.Reason)
@@ -565,7 +588,7 @@ func (f *DataFrame) Data() []byte {
 	return f.data
 }
 
-func parseDataFrame(fh FrameHeader, payload []byte) (Frame, error) {
+func parseDataFrame(fc *frameCache, fh FrameHeader, payload []byte) (Frame, error) {
 	if fh.StreamID == 0 {
 		// DATA frames MUST be associated with a stream. If a
 		// DATA frame is received whose stream identifier
@@ -574,9 +597,9 @@ func parseDataFrame(fh FrameHeader, payload []byte) (Frame, error) {
 		// PROTOCOL_ERROR.
 		return nil, connError{ErrCodeProtocol, "DATA frame with stream ID 0"}
 	}
-	f := &DataFrame{
-		FrameHeader: fh,
-	}
+	f := fc.getDataFrame()
+	f.FrameHeader = fh
+
 	var padSize byte
 	if fh.Flags.Has(FlagDataPadded) {
 		var err error
@@ -600,6 +623,7 @@ var (
 	errStreamID    = errors.New("invalid stream ID")
 	errDepStreamID = errors.New("invalid dependent stream ID")
 	errPadLength   = errors.New("pad length too large")
+	errPadBytes    = errors.New("padding bytes must all be zeros unless AllowIllegalWrites is enabled")
 )
 
 func validStreamIDOrZero(streamID uint32) bool {
@@ -623,6 +647,7 @@ func (f *Framer) WriteData(streamID uint32, endStream bool, data []byte) error {
 //
 // If pad is nil, the padding bit is not sent.
 // The length of pad must not exceed 255 bytes.
+// The bytes of pad must all be zero, unless f.AllowIllegalWrites is set.
 //
 // It will perform exactly one Write to the underlying Writer.
 // It is the caller's responsibility not to violate the maximum frame size
@@ -631,8 +656,18 @@ func (f *Framer) WriteDataPadded(streamID uint32, endStream bool, data, pad []by
 	if !validStreamID(streamID) && !f.AllowIllegalWrites {
 		return errStreamID
 	}
-	if len(pad) > 255 {
-		return errPadLength
+	if len(pad) > 0 {
+		if len(pad) > 255 {
+			return errPadLength
+		}
+		if !f.AllowIllegalWrites {
+			for _, b := range pad {
+				if b != 0 {
+					// "Padding octets MUST be set to zero when sending."
+					return errPadBytes
+				}
+			}
+		}
 	}
 	var flags Flags
 	if endStream {
@@ -660,10 +695,10 @@ type SettingsFrame struct {
 	p []byte
 }
 
-func parseSettingsFrame(fh FrameHeader, p []byte) (Frame, error) {
+func parseSettingsFrame(_ *frameCache, fh FrameHeader, p []byte) (Frame, error) {
 	if fh.Flags.Has(FlagSettingsAck) && fh.Length > 0 {
 		// When this (ACK 0x1) bit is set, the payload of the
-		// SETTINGS frame MUST be empty.  Receipt of a
+		// SETTINGS frame MUST be empty. Receipt of a
 		// SETTINGS frame with the ACK flag set and a length
 		// field value other than 0 MUST be treated as a
 		// connection error (Section 5.4.1) of type
@@ -672,7 +707,7 @@ func parseSettingsFrame(fh FrameHeader, p []byte) (Frame, error) {
 	}
 	if fh.StreamID != 0 {
 		// SETTINGS frames always apply to a connection,
-		// never a single stream.  The stream identifier for a
+		// never a single stream. The stream identifier for a
 		// SETTINGS frame MUST be zero (0x0).  If an endpoint
 		// receives a SETTINGS frame whose stream identifier
 		// field is anything other than 0x0, the endpoint MUST
@@ -762,7 +797,7 @@ type PingFrame struct {
 
 func (f *PingFrame) IsAck() bool { return f.Flags.Has(FlagPingAck) }
 
-func parsePingFrame(fh FrameHeader, payload []byte) (Frame, error) {
+func parsePingFrame(_ *frameCache, fh FrameHeader, payload []byte) (Frame, error) {
 	if len(payload) != 8 {
 		return nil, ConnectionError(ErrCodeFrameSize)
 	}
@@ -802,7 +837,7 @@ func (f *GoAwayFrame) DebugData() []byte {
 	return f.debugData
 }
 
-func parseGoAwayFrame(fh FrameHeader, p []byte) (Frame, error) {
+func parseGoAwayFrame(_ *frameCache, fh FrameHeader, p []byte) (Frame, error) {
 	if fh.StreamID != 0 {
 		return nil, ConnectionError(ErrCodeProtocol)
 	}
@@ -842,7 +877,7 @@ func (f *UnknownFrame) Payload() []byte {
 	return f.p
 }
 
-func parseUnknownFrame(fh FrameHeader, p []byte) (Frame, error) {
+func parseUnknownFrame(_ *frameCache, fh FrameHeader, p []byte) (Frame, error) {
 	return &UnknownFrame{fh, p}, nil
 }
 
@@ -853,7 +888,7 @@ type WindowUpdateFrame struct {
 	Increment uint32 // never read with high bit set
 }
 
-func parseWindowUpdateFrame(fh FrameHeader, p []byte) (Frame, error) {
+func parseWindowUpdateFrame(_ *frameCache, fh FrameHeader, p []byte) (Frame, error) {
 	if len(p) != 4 {
 		return nil, ConnectionError(ErrCodeFrameSize)
 	}
@@ -918,12 +953,12 @@ func (f *HeadersFrame) HasPriority() bool {
 	return f.FrameHeader.Flags.Has(FlagHeadersPriority)
 }
 
-func parseHeadersFrame(fh FrameHeader, p []byte) (_ Frame, err error) {
+func parseHeadersFrame(_ *frameCache, fh FrameHeader, p []byte) (_ Frame, err error) {
 	hf := &HeadersFrame{
 		FrameHeader: fh,
 	}
 	if fh.StreamID == 0 {
-		// HEADERS frames MUST be associated with a stream.  If a HEADERS frame
+		// HEADERS frames MUST be associated with a stream. If a HEADERS frame
 		// is received whose stream identifier field is 0x0, the recipient MUST
 		// respond with a connection error (Section 5.4.1) of type
 		// PROTOCOL_ERROR.
@@ -1045,7 +1080,7 @@ type PriorityParam struct {
 	Exclusive bool
 
 	// Weight is the stream's zero-indexed weight. It should be
-	// set together with StreamDep, or neither should be set.  Per
+	// set together with StreamDep, or neither should be set. Per
 	// the spec, "Add one to the value to obtain a weight between
 	// 1 and 256."
 	Weight uint8
@@ -1055,7 +1090,7 @@ func (p PriorityParam) IsZero() bool {
 	return p == PriorityParam{}
 }
 
-func parsePriorityFrame(fh FrameHeader, payload []byte) (Frame, error) {
+func parsePriorityFrame(_ *frameCache, fh FrameHeader, payload []byte) (Frame, error) {
 	if fh.StreamID == 0 {
 		return nil, connError{ErrCodeProtocol, "PRIORITY frame with stream ID 0"}
 	}
@@ -1102,7 +1137,7 @@ type RSTStreamFrame struct {
 	ErrCode ErrCode
 }
 
-func parseRSTStreamFrame(fh FrameHeader, p []byte) (Frame, error) {
+func parseRSTStreamFrame(_ *frameCache, fh FrameHeader, p []byte) (Frame, error) {
 	if len(p) != 4 {
 		return nil, ConnectionError(ErrCodeFrameSize)
 	}
@@ -1132,7 +1167,7 @@ type ContinuationFrame struct {
 	headerFragBuf []byte
 }
 
-func parseContinuationFrame(fh FrameHeader, p []byte) (Frame, error) {
+func parseContinuationFrame(_ *frameCache, fh FrameHeader, p []byte) (Frame, error) {
 	if fh.StreamID == 0 {
 		return nil, connError{ErrCodeProtocol, "CONTINUATION frame with stream ID 0"}
 	}
@@ -1182,7 +1217,7 @@ func (f *PushPromiseFrame) HeadersEnded() bool {
 	return f.FrameHeader.Flags.Has(FlagPushPromiseEndHeaders)
 }
 
-func parsePushPromise(fh FrameHeader, p []byte) (_ Frame, err error) {
+func parsePushPromise(_ *frameCache, fh FrameHeader, p []byte) (_ Frame, err error) {
 	pp := &PushPromiseFrame{
 		FrameHeader: fh,
 	}
diff --git a/components/engine/vendor/golang.org/x/net/http2/go16.go b/components/engine/vendor/golang.org/x/net/http2/go16.go
index 2b72855f55..00b2e9e3cf 100644
--- a/components/engine/vendor/golang.org/x/net/http2/go16.go
+++ b/components/engine/vendor/golang.org/x/net/http2/go16.go
@@ -7,7 +7,6 @@
 package http2
 
 import (
-	"crypto/tls"
 	"net/http"
 	"time"
 )
@@ -15,29 +14,3 @@ import (
 func transportExpectContinueTimeout(t1 *http.Transport) time.Duration {
 	return t1.ExpectContinueTimeout
 }
-
-// isBadCipher reports whether the cipher is blacklisted by the HTTP/2 spec.
-func isBadCipher(cipher uint16) bool {
-	switch cipher {
-	case tls.TLS_RSA_WITH_RC4_128_SHA,
-		tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
-		tls.TLS_RSA_WITH_AES_128_CBC_SHA,
-		tls.TLS_RSA_WITH_AES_256_CBC_SHA,
-		tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
-		tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
-		tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
-		tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-		tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-		tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,
-		tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
-		tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-		tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
-		// Reject cipher suites from Appendix A.
-		// "This list includes those cipher suites that do not
-		// offer an ephemeral key exchange and those that are
-		// based on the TLS null, stream or block cipher type"
-		return true
-	default:
-		return false
-	}
-}
diff --git a/components/engine/vendor/golang.org/x/net/http2/go18.go b/components/engine/vendor/golang.org/x/net/http2/go18.go
index 633202c39f..73cc2381f3 100644
--- a/components/engine/vendor/golang.org/x/net/http2/go18.go
+++ b/components/engine/vendor/golang.org/x/net/http2/go18.go
@@ -12,7 +12,11 @@ import (
 	"net/http"
 )
 
-func cloneTLSConfig(c *tls.Config) *tls.Config { return c.Clone() }
+func cloneTLSConfig(c *tls.Config) *tls.Config {
+	c2 := c.Clone()
+	c2.GetClientCertificate = c.GetClientCertificate // golang.org/issue/19264
+	return c2
+}
 
 var _ http.Pusher = (*responseWriter)(nil)
 
diff --git a/components/engine/vendor/golang.org/x/net/http2/go19.go b/components/engine/vendor/golang.org/x/net/http2/go19.go
new file mode 100644
index 0000000000..38124ba56e
--- /dev/null
+++ b/components/engine/vendor/golang.org/x/net/http2/go19.go
@@ -0,0 +1,16 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build go1.9
+
+package http2
+
+import (
+	"net/http"
+)
+
+func configureServer19(s *http.Server, conf *Server) error {
+	s.RegisterOnShutdown(conf.state.startGracefulShutdown)
+	return nil
+}
diff --git a/components/engine/vendor/golang.org/x/net/http2/hpack/encode.go b/components/engine/vendor/golang.org/x/net/http2/hpack/encode.go
index f9bb033984..54726c2a3c 100644
--- a/components/engine/vendor/golang.org/x/net/http2/hpack/encode.go
+++ b/components/engine/vendor/golang.org/x/net/http2/hpack/encode.go
@@ -39,13 +39,14 @@ func NewEncoder(w io.Writer) *Encoder {
 		tableSizeUpdate: false,
 		w:               w,
 	}
+	e.dynTab.table.init()
 	e.dynTab.setMaxSize(initialHeaderTableSize)
 	return e
 }
 
 // WriteField encodes f into a single Write to e's underlying Writer.
 // This function may also produce bytes for "Header Table Size Update"
-// if necessary.  If produced, it is done before encoding f.
+// if necessary. If produced, it is done before encoding f.
 func (e *Encoder) WriteField(f HeaderField) error {
 	e.buf = e.buf[:0]
 
@@ -88,29 +89,17 @@ func (e *Encoder) WriteField(f HeaderField) error {
 // only name matches, i points to that index and nameValueMatch
 // becomes false.
 func (e *Encoder) searchTable(f HeaderField) (i uint64, nameValueMatch bool) {
-	for idx, hf := range staticTable {
-		if !constantTimeStringCompare(hf.Name, f.Name) {
-			continue
-		}
-		if i == 0 {
-			i = uint64(idx + 1)
-		}
-		if f.Sensitive {
-			continue
-		}
-		if !constantTimeStringCompare(hf.Value, f.Value) {
-			continue
-		}
-		i = uint64(idx + 1)
-		nameValueMatch = true
-		return
+	i, nameValueMatch = staticTable.search(f)
+	if nameValueMatch {
+		return i, true
 	}
 
-	j, nameValueMatch := e.dynTab.search(f)
+	j, nameValueMatch := e.dynTab.table.search(f)
 	if nameValueMatch || (i == 0 && j != 0) {
-		i = j + uint64(len(staticTable))
+		return j + uint64(staticTable.len()), nameValueMatch
 	}
-	return
+
+	return i, false
 }
 
 // SetMaxDynamicTableSize changes the dynamic header table size to v.
diff --git a/components/engine/vendor/golang.org/x/net/http2/hpack/hpack.go b/components/engine/vendor/golang.org/x/net/http2/hpack/hpack.go
index 135b9f62cd..176644acda 100644
--- a/components/engine/vendor/golang.org/x/net/http2/hpack/hpack.go
+++ b/components/engine/vendor/golang.org/x/net/http2/hpack/hpack.go
@@ -61,7 +61,7 @@ func (hf HeaderField) String() string {
 func (hf HeaderField) Size() uint32 {
 	// http://http2.github.io/http2-spec/compression.html#rfc.section.4.1
 	// "The size of the dynamic table is the sum of the size of
-	// its entries.  The size of an entry is the sum of its name's
+	// its entries. The size of an entry is the sum of its name's
 	// length in octets (as defined in Section 5.2), its value's
 	// length in octets (see Section 5.2), plus 32.  The size of
 	// an entry is calculated using the length of the name and
@@ -102,6 +102,7 @@ func NewDecoder(maxDynamicTableSize uint32, emitFunc func(f HeaderField)) *Decod
 		emit:        emitFunc,
 		emitEnabled: true,
 	}
+	d.dynTab.table.init()
 	d.dynTab.allowedMaxSize = maxDynamicTableSize
 	d.dynTab.setMaxSize(maxDynamicTableSize)
 	return d
@@ -154,12 +155,9 @@ func (d *Decoder) SetAllowedMaxDynamicTableSize(v uint32) {
 }
 
 type dynamicTable struct {
-	// ents is the FIFO described at
 	// http://http2.github.io/http2-spec/compression.html#rfc.section.2.3.2
-	// The newest (low index) is append at the end, and items are
-	// evicted from the front.
-	ents           []HeaderField
-	size           uint32
+	table          headerFieldTable
+	size           uint32 // in bytes
 	maxSize        uint32 // current maxSize
 	allowedMaxSize uint32 // maxSize may go up to this, inclusive
 }
@@ -169,95 +167,45 @@ func (dt *dynamicTable) setMaxSize(v uint32) {
 	dt.evict()
 }
 
-// TODO: change dynamicTable to be a struct with a slice and a size int field,
-// per http://http2.github.io/http2-spec/compression.html#rfc.section.4.1:
-//
-//
-// Then make add increment the size. maybe the max size should move from Decoder to
-// dynamicTable and add should return an ok bool if there was enough space.
-//
-// Later we'll need a remove operation on dynamicTable.
-
 func (dt *dynamicTable) add(f HeaderField) {
-	dt.ents = append(dt.ents, f)
+	dt.table.addEntry(f)
 	dt.size += f.Size()
 	dt.evict()
 }
 
-// If we're too big, evict old stuff (front of the slice)
+// If we're too big, evict old stuff.
 func (dt *dynamicTable) evict() {
-	base := dt.ents // keep base pointer of slice
-	for dt.size > dt.maxSize {
-		dt.size -= dt.ents[0].Size()
-		dt.ents = dt.ents[1:]
+	var n int
+	for dt.size > dt.maxSize && n < dt.table.len() {
+		dt.size -= dt.table.ents[n].Size()
+		n++
 	}
-
-	// Shift slice contents down if we evicted things.
-	if len(dt.ents) != len(base) {
-		copy(base, dt.ents)
-		dt.ents = base[:len(dt.ents)]
-	}
-}
-
-// constantTimeStringCompare compares string a and b in a constant
-// time manner.
-func constantTimeStringCompare(a, b string) bool {
-	if len(a) != len(b) {
-		return false
-	}
-
-	c := byte(0)
-
-	for i := 0; i < len(a); i++ {
-		c |= a[i] ^ b[i]
-	}
-
-	return c == 0
-}
-
-// Search searches f in the table. The return value i is 0 if there is
-// no name match. If there is name match or name/value match, i is the
-// index of that entry (1-based). If both name and value match,
-// nameValueMatch becomes true.
-func (dt *dynamicTable) search(f HeaderField) (i uint64, nameValueMatch bool) {
-	l := len(dt.ents)
-	for j := l - 1; j >= 0; j-- {
-		ent := dt.ents[j]
-		if !constantTimeStringCompare(ent.Name, f.Name) {
-			continue
-		}
-		if i == 0 {
-			i = uint64(l - j)
-		}
-		if f.Sensitive {
-			continue
-		}
-		if !constantTimeStringCompare(ent.Value, f.Value) {
-			continue
-		}
-		i = uint64(l - j)
-		nameValueMatch = true
-		return
-	}
-	return
+	dt.table.evictOldest(n)
 }
 
 func (d *Decoder) maxTableIndex() int {
-	return len(d.dynTab.ents) + len(staticTable)
+	// This should never overflow. RFC 7540 Section 6.5.2 limits the size of
+	// the dynamic table to 2^32 bytes, where each entry will occupy more than
+	// one byte. Further, the staticTable has a fixed, small length.
+	return d.dynTab.table.len() + staticTable.len()
 }
 
 func (d *Decoder) at(i uint64) (hf HeaderField, ok bool) {
-	if i < 1 {
+	// See Section 2.3.3.
+	if i == 0 {
 		return
 	}
+	if i <= uint64(staticTable.len()) {
+		return staticTable.ents[i-1], true
+	}
 	if i > uint64(d.maxTableIndex()) {
 		return
 	}
-	if i <= uint64(len(staticTable)) {
-		return staticTable[i-1], true
-	}
-	dents := d.dynTab.ents
-	return dents[len(dents)-(int(i)-len(staticTable))], true
+	// In the dynamic table, newer entries have lower indices.
+	// However, dt.ents[0] is the oldest entry. Hence, dt.ents is
+	// the reversed dynamic table.
+	dt := d.dynTab.table
+	return dt.ents[dt.len()-(int(i)-staticTable.len())], true
 }
 
 // Decode decodes an entire block.
@@ -307,7 +255,7 @@ func (d *Decoder) Write(p []byte) (n int, err error) {
 		err = d.parseHeaderFieldRepr()
 		if err == errNeedMore {
 			// Extra paranoia, making sure saveBuf won't
-			// get too large.  All the varint and string
+			// get too large. All the varint and string
 			// reading code earlier should already catch
 			// overlong things and return ErrStringLength,
 			// but keep this as a last resort.
diff --git a/components/engine/vendor/golang.org/x/net/http2/hpack/tables.go b/components/engine/vendor/golang.org/x/net/http2/hpack/tables.go
index b9283a0233..a66cfbea69 100644
--- a/components/engine/vendor/golang.org/x/net/http2/hpack/tables.go
+++ b/components/engine/vendor/golang.org/x/net/http2/hpack/tables.go
@@ -4,73 +4,200 @@
 
 package hpack
 
-func pair(name, value string) HeaderField {
-	return HeaderField{Name: name, Value: value}
+import (
+	"fmt"
+)
+
+// headerFieldTable implements a list of HeaderFields.
+// This is used to implement the static and dynamic tables.
+type headerFieldTable struct {
+	// For static tables, entries are never evicted.
+	//
+	// For dynamic tables, entries are evicted from ents[0] and added to the end.
+	// Each entry has a unique id that starts at one and increments for each
+	// entry that is added. This unique id is stable across evictions, meaning
+	// it can be used as a pointer to a specific entry. As in hpack, unique ids
+	// are 1-based. The unique id for ents[k] is k + evictCount + 1.
+	//
+	// Zero is not a valid unique id.
+	//
+	// evictCount should not overflow in any remotely practical situation. In
+	// practice, we will have one dynamic table per HTTP/2 connection. If we
+	// assume a very powerful server that handles 1M QPS per connection and each
+	// request adds (then evicts) 100 entries from the table, it would still take
+	// 2M years for evictCount to overflow.
+	ents       []HeaderField
+	evictCount uint64
+
+	// byName maps a HeaderField name to the unique id of the newest entry with
+	// the same name. See above for a definition of "unique id".
+	byName map[string]uint64
+
+	// byNameValue maps a HeaderField name/value pair to the unique id of the newest
+	// entry with the same name and value. See above for a definition of "unique id".
+	byNameValue map[pairNameValue]uint64
+}
+
+type pairNameValue struct {
+	name, value string
+}
+
+func (t *headerFieldTable) init() {
+	t.byName = make(map[string]uint64)
+	t.byNameValue = make(map[pairNameValue]uint64)
+}
+
+// len reports the number of entries in the table.
+func (t *headerFieldTable) len() int {
+	return len(t.ents)
+}
+
+// addEntry adds a new entry.
+func (t *headerFieldTable) addEntry(f HeaderField) {
+	id := uint64(t.len()) + t.evictCount + 1
+	t.byName[f.Name] = id
+	t.byNameValue[pairNameValue{f.Name, f.Value}] = id
+	t.ents = append(t.ents, f)
+}
+
+// evictOldest evicts the n oldest entries in the table.
+func (t *headerFieldTable) evictOldest(n int) {
+	if n > t.len() {
+		panic(fmt.Sprintf("evictOldest(%v) on table with %v entries", n, t.len()))
+	}
+	for k := 0; k < n; k++ {
+		f := t.ents[k]
+		id := t.evictCount + uint64(k) + 1
+		if t.byName[f.Name] == id {
+			delete(t.byName, f.Name)
+		}
+		if p := (pairNameValue{f.Name, f.Value}); t.byNameValue[p] == id {
+			delete(t.byNameValue, p)
+		}
+	}
+	copy(t.ents, t.ents[n:])
+	for k := t.len() - n; k < t.len(); k++ {
+		t.ents[k] = HeaderField{} // so strings can be garbage collected
+	}
+	t.ents = t.ents[:t.len()-n]
+	if t.evictCount+uint64(n) < t.evictCount {
+		panic("evictCount overflow")
+	}
+	t.evictCount += uint64(n)
+}
+
+// search finds f in the table. If there is no match, i is 0.
+// If both name and value match, i is the matched index and nameValueMatch
+// becomes true. If only name matches, i points to that index and
+// nameValueMatch becomes false.
+//
+// The returned index is a 1-based HPACK index. For dynamic tables, HPACK says
+// that index 1 should be the newest entry, but t.ents[0] is the oldest entry,
+// meaning t.ents is reversed for dynamic tables. Hence, when t is a dynamic
+// table, the return value i actually refers to the entry t.ents[t.len()-i].
+//
+// All tables are assumed to be a dynamic tables except for the global
+// staticTable pointer.
+//
+// See Section 2.3.3.
+func (t *headerFieldTable) search(f HeaderField) (i uint64, nameValueMatch bool) {
+	if !f.Sensitive {
+		if id := t.byNameValue[pairNameValue{f.Name, f.Value}]; id != 0 {
+			return t.idToIndex(id), true
+		}
+	}
+	if id := t.byName[f.Name]; id != 0 {
+		return t.idToIndex(id), false
+	}
+	return 0, false
+}
+
+// idToIndex converts a unique id to an HPACK index.
+// See Section 2.3.3.
+func (t *headerFieldTable) idToIndex(id uint64) uint64 {
+	if id <= t.evictCount {
+		panic(fmt.Sprintf("id (%v) <= evictCount (%v)", id, t.evictCount))
+	}
+	k := id - t.evictCount - 1 // convert id to an index t.ents[k]
+	if t != staticTable {
+		return uint64(t.len()) - k // dynamic table
+	}
+	return k + 1
 }
 
 // http://tools.ietf.org/html/draft-ietf-httpbis-header-compression-07#appendix-B
-var staticTable = [...]HeaderField{
-	pair(":authority", ""), // index 1 (1-based)
-	pair(":method", "GET"),
-	pair(":method", "POST"),
-	pair(":path", "/"),
-	pair(":path", "/index.html"),
-	pair(":scheme", "http"),
-	pair(":scheme", "https"),
-	pair(":status", "200"),
-	pair(":status", "204"),
-	pair(":status", "206"),
-	pair(":status", "304"),
-	pair(":status", "400"),
-	pair(":status", "404"),
-	pair(":status", "500"),
-	pair("accept-charset", ""),
-	pair("accept-encoding", "gzip, deflate"),
-	pair("accept-language", ""),
-	pair("accept-ranges", ""),
-	pair("accept", ""),
-	pair("access-control-allow-origin", ""),
-	pair("age", ""),
-	pair("allow", ""),
-	pair("authorization", ""),
-	pair("cache-control", ""),
-	pair("content-disposition", ""),
-	pair("content-encoding", ""),
-	pair("content-language", ""),
-	pair("content-length", ""),
-	pair("content-location", ""),
-	pair("content-range", ""),
-	pair("content-type", ""),
-	pair("cookie", ""),
-	pair("date", ""),
-	pair("etag", ""),
-	pair("expect", ""),
-	pair("expires", ""),
-	pair("from", ""),
-	pair("host", ""),
-	pair("if-match", ""),
-	pair("if-modified-since", ""),
-	pair("if-none-match", ""),
-	pair("if-range", ""),
-	pair("if-unmodified-since", ""),
-	pair("last-modified", ""),
-	pair("link", ""),
-	pair("location", ""),
-	pair("max-forwards", ""),
-	pair("proxy-authenticate", ""),
-	pair("proxy-authorization", ""),
-	pair("range", ""),
-	pair("referer", ""),
-	pair("refresh", ""),
-	pair("retry-after", ""),
-	pair("server", ""),
-	pair("set-cookie", ""),
-	pair("strict-transport-security", ""),
-	pair("transfer-encoding", ""),
-	pair("user-agent", ""),
-	pair("vary", ""),
-	pair("via", ""),
-	pair("www-authenticate", ""),
+var staticTable = newStaticTable()
+var staticTableEntries = [...]HeaderField{
+	{Name: ":authority"},
+	{Name: ":method", Value: "GET"},
+	{Name: ":method", Value: "POST"},
+	{Name: ":path", Value: "/"},
+	{Name: ":path", Value: "/index.html"},
+	{Name: ":scheme", Value: "http"},
+	{Name: ":scheme", Value: "https"},
+	{Name: ":status", Value: "200"},
+	{Name: ":status", Value: "204"},
+	{Name: ":status", Value: "206"},
+	{Name: ":status", Value: "304"},
+	{Name: ":status", Value: "400"},
+	{Name: ":status", Value: "404"},
+	{Name: ":status", Value: "500"},
+	{Name: "accept-charset"},
+	{Name: "accept-encoding", Value: "gzip, deflate"},
+	{Name: "accept-language"},
+	{Name: "accept-ranges"},
+	{Name: "accept"},
+	{Name: "access-control-allow-origin"},
+	{Name: "age"},
+	{Name: "allow"},
+	{Name: "authorization"},
+	{Name: "cache-control"},
+	{Name: "content-disposition"},
+	{Name: "content-encoding"},
+	{Name: "content-language"},
+	{Name: "content-length"},
+	{Name: "content-location"},
+	{Name: "content-range"},
+	{Name: "content-type"},
+	{Name: "cookie"},
+	{Name: "date"},
+	{Name: "etag"},
+	{Name: "expect"},
+	{Name: "expires"},
+	{Name: "from"},
+	{Name: "host"},
+	{Name: "if-match"},
+	{Name: "if-modified-since"},
+	{Name: "if-none-match"},
+	{Name: "if-range"},
+	{Name: "if-unmodified-since"},
+	{Name: "last-modified"},
+	{Name: "link"},
+	{Name: "location"},
+	{Name: "max-forwards"},
+	{Name: "proxy-authenticate"},
+	{Name: "proxy-authorization"},
+	{Name: "range"},
+	{Name: "referer"},
+	{Name: "refresh"},
+	{Name: "retry-after"},
+	{Name: "server"},
+	{Name: "set-cookie"},
+	{Name: "strict-transport-security"},
+	{Name: "transfer-encoding"},
+	{Name: "user-agent"},
+	{Name: "vary"},
+	{Name: "via"},
+	{Name: "www-authenticate"},
+}
+
+func newStaticTable() *headerFieldTable {
+	t := &headerFieldTable{}
+	t.init()
+	for _, e := range staticTableEntries[:] {
+		t.addEntry(e)
+	}
+	return t
 }
 
 var huffmanCodes = [256]uint32{
diff --git a/components/engine/vendor/golang.org/x/net/http2/not_go16.go b/components/engine/vendor/golang.org/x/net/http2/not_go16.go
index efd2e1282c..508cebcc4d 100644
--- a/components/engine/vendor/golang.org/x/net/http2/not_go16.go
+++ b/components/engine/vendor/golang.org/x/net/http2/not_go16.go
@@ -7,7 +7,6 @@
 package http2
 
 import (
-	"crypto/tls"
 	"net/http"
 	"time"
 )
@@ -20,27 +19,3 @@ func transportExpectContinueTimeout(t1 *http.Transport) time.Duration {
 	return 0
 
 }
-
-// isBadCipher reports whether the cipher is blacklisted by the HTTP/2 spec.
-func isBadCipher(cipher uint16) bool {
-	switch cipher {
-	case tls.TLS_RSA_WITH_RC4_128_SHA,
-		tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
-		tls.TLS_RSA_WITH_AES_128_CBC_SHA,
-		tls.TLS_RSA_WITH_AES_256_CBC_SHA,
-		tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
-		tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-		tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-		tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,
-		tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
-		tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-		tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
-		// Reject cipher suites from Appendix A.
-		// "This list includes those cipher suites that do not
-		// offer an ephemeral key exchange and those that are
-		// based on the TLS null, stream or block cipher type"
-		return true
-	default:
-		return false
-	}
-}
diff --git a/components/engine/vendor/golang.org/x/net/http2/not_go19.go b/components/engine/vendor/golang.org/x/net/http2/not_go19.go
new file mode 100644
index 0000000000..5ae07726b7
--- /dev/null
+++ b/components/engine/vendor/golang.org/x/net/http2/not_go19.go
@@ -0,0 +1,16 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !go1.9
+
+package http2
+
+import (
+	"net/http"
+)
+
+func configureServer19(s *http.Server, conf *Server) error {
+	// not supported prior to go1.9
+	return nil
+}
diff --git a/components/engine/vendor/golang.org/x/net/http2/pipe.go b/components/engine/vendor/golang.org/x/net/http2/pipe.go
index 53b7a1daf6..0b9848be8c 100644
--- a/components/engine/vendor/golang.org/x/net/http2/pipe.go
+++ b/components/engine/vendor/golang.org/x/net/http2/pipe.go
@@ -10,13 +10,13 @@ import (
 	"sync"
 )
 
-// pipe is a goroutine-safe io.Reader/io.Writer pair.  It's like
+// pipe is a goroutine-safe io.Reader/io.Writer pair. It's like
 // io.Pipe except there are no PipeReader/PipeWriter halves, and the
 // underlying buffer is an interface. (io.Pipe is always unbuffered)
 type pipe struct {
 	mu       sync.Mutex
-	c        sync.Cond // c.L lazily initialized to &p.mu
-	b        pipeBuffer
+	c        sync.Cond     // c.L lazily initialized to &p.mu
+	b        pipeBuffer    // nil when done reading
 	err      error         // read error once empty. non-nil means closed.
 	breakErr error         // immediate read error (caller doesn't see rest of b)
 	donec    chan struct{} // closed on error
@@ -32,6 +32,9 @@ type pipeBuffer interface {
 func (p *pipe) Len() int {
 	p.mu.Lock()
 	defer p.mu.Unlock()
+	if p.b == nil {
+		return 0
+	}
 	return p.b.Len()
 }
 
@@ -55,6 +58,7 @@ func (p *pipe) Read(d []byte) (n int, err error) {
 				p.readFn()     // e.g. copy trailers
 				p.readFn = nil // not sticky like p.err
 			}
+			p.b = nil
 			return 0, p.err
 		}
 		p.c.Wait()
@@ -75,6 +79,9 @@ func (p *pipe) Write(d []byte) (n int, err error) {
 	if p.err != nil {
 		return 0, errClosedPipeWrite
 	}
+	if p.breakErr != nil {
+		return len(d), nil // discard when there is no reader
+	}
 	return p.b.Write(d)
 }
 
@@ -109,6 +116,9 @@ func (p *pipe) closeWithError(dst *error, err error, fn func()) {
 		return
 	}
 	p.readFn = fn
+	if dst == &p.breakErr {
+		p.b = nil
+	}
 	*dst = err
 	p.closeDoneLocked()
 }
diff --git a/components/engine/vendor/golang.org/x/net/http2/server.go b/components/engine/vendor/golang.org/x/net/http2/server.go
index 3c6b90ccd5..7367b31c57 100644
--- a/components/engine/vendor/golang.org/x/net/http2/server.go
+++ b/components/engine/vendor/golang.org/x/net/http2/server.go
@@ -110,9 +110,41 @@ type Server struct {
 	// activity for the purposes of IdleTimeout.
 	IdleTimeout time.Duration
 
+	// MaxUploadBufferPerConnection is the size of the initial flow
+	// control window for each connections. The HTTP/2 spec does not
+	// allow this to be smaller than 65535 or larger than 2^32-1.
+	// If the value is outside this range, a default value will be
+	// used instead.
+	MaxUploadBufferPerConnection int32
+
+	// MaxUploadBufferPerStream is the size of the initial flow control
+	// window for each stream. The HTTP/2 spec does not allow this to
+	// be larger than 2^32-1. If the value is zero or larger than the
+	// maximum, a default value will be used instead.
+	MaxUploadBufferPerStream int32
+
 	// NewWriteScheduler constructs a write scheduler for a connection.
 	// If nil, a default scheduler is chosen.
 	NewWriteScheduler func() WriteScheduler
+
+	// Internal state. This is a pointer (rather than embedded directly)
+	// so that we don't embed a Mutex in this struct, which will make the
+	// struct non-copyable, which might break some callers.
+	state *serverInternalState
+}
+
+func (s *Server) initialConnRecvWindowSize() int32 {
+	if s.MaxUploadBufferPerConnection > initialWindowSize {
+		return s.MaxUploadBufferPerConnection
+	}
+	return 1 << 20
+}
+
+func (s *Server) initialStreamRecvWindowSize() int32 {
+	if s.MaxUploadBufferPerStream > 0 {
+		return s.MaxUploadBufferPerStream
+	}
+	return 1 << 20
 }
 
 func (s *Server) maxReadFrameSize() uint32 {
@@ -129,6 +161,40 @@ func (s *Server) maxConcurrentStreams() uint32 {
 	return defaultMaxStreams
 }
 
+type serverInternalState struct {
+	mu          sync.Mutex
+	activeConns map[*serverConn]struct{}
+}
+
+func (s *serverInternalState) registerConn(sc *serverConn) {
+	if s == nil {
+		return // if the Server was used without calling ConfigureServer
+	}
+	s.mu.Lock()
+	s.activeConns[sc] = struct{}{}
+	s.mu.Unlock()
+}
+
+func (s *serverInternalState) unregisterConn(sc *serverConn) {
+	if s == nil {
+		return // if the Server was used without calling ConfigureServer
+	}
+	s.mu.Lock()
+	delete(s.activeConns, sc)
+	s.mu.Unlock()
+}
+
+func (s *serverInternalState) startGracefulShutdown() {
+	if s == nil {
+		return // if the Server was used without calling ConfigureServer
+	}
+	s.mu.Lock()
+	for sc := range s.activeConns {
+		sc.startGracefulShutdown()
+	}
+	s.mu.Unlock()
+}
+
 // ConfigureServer adds HTTP/2 support to a net/http Server.
 //
 // The configuration conf may be nil.
@@ -141,9 +207,13 @@ func ConfigureServer(s *http.Server, conf *Server) error {
 	if conf == nil {
 		conf = new(Server)
 	}
+	conf.state = &serverInternalState{activeConns: make(map[*serverConn]struct{})}
 	if err := configureServer18(s, conf); err != nil {
 		return err
 	}
+	if err := configureServer19(s, conf); err != nil {
+		return err
+	}
 
 	if s.TLSConfig == nil {
 		s.TLSConfig = new(tls.Config)
@@ -255,35 +325,37 @@ func (s *Server) ServeConn(c net.Conn, opts *ServeConnOpts) {
 	defer cancel()
 
 	sc := &serverConn{
-		srv:               s,
-		hs:                opts.baseConfig(),
-		conn:              c,
-		baseCtx:           baseCtx,
-		remoteAddrStr:     c.RemoteAddr().String(),
-		bw:                newBufferedWriter(c),
-		handler:           opts.handler(),
-		streams:           make(map[uint32]*stream),
-		readFrameCh:       make(chan readFrameResult),
-		wantWriteFrameCh:  make(chan FrameWriteRequest, 8),
-		wantStartPushCh:   make(chan startPushRequest, 8),
-		wroteFrameCh:      make(chan frameWriteResult, 1), // buffered; one send in writeFrameAsync
-		bodyReadCh:        make(chan bodyReadMsg),         // buffering doesn't matter either way
-		doneServing:       make(chan struct{}),
-		clientMaxStreams:  math.MaxUint32, // Section 6.5.2: "Initially, there is no limit to this value"
-		advMaxStreams:     s.maxConcurrentStreams(),
-		initialWindowSize: initialWindowSize,
-		maxFrameSize:      initialMaxFrameSize,
-		headerTableSize:   initialHeaderTableSize,
-		serveG:            newGoroutineLock(),
-		pushEnabled:       true,
+		srv:                         s,
+		hs:                          opts.baseConfig(),
+		conn:                        c,
+		baseCtx:                     baseCtx,
+		remoteAddrStr:               c.RemoteAddr().String(),
+		bw:                          newBufferedWriter(c),
+		handler:                     opts.handler(),
+		streams:                     make(map[uint32]*stream),
+		readFrameCh:                 make(chan readFrameResult),
+		wantWriteFrameCh:            make(chan FrameWriteRequest, 8),
+		serveMsgCh:                  make(chan interface{}, 8),
+		wroteFrameCh:                make(chan frameWriteResult, 1), // buffered; one send in writeFrameAsync
+		bodyReadCh:                  make(chan bodyReadMsg),         // buffering doesn't matter either way
+		doneServing:                 make(chan struct{}),
+		clientMaxStreams:            math.MaxUint32, // Section 6.5.2: "Initially, there is no limit to this value"
+		advMaxStreams:               s.maxConcurrentStreams(),
+		initialStreamSendWindowSize: initialWindowSize,
+		maxFrameSize:                initialMaxFrameSize,
+		headerTableSize:             initialHeaderTableSize,
+		serveG:                      newGoroutineLock(),
+		pushEnabled:                 true,
 	}
 
+	s.state.registerConn(sc)
+	defer s.state.unregisterConn(sc)
+
 	// The net/http package sets the write deadline from the
 	// http.Server.WriteTimeout during the TLS handshake, but then
-	// passes the connection off to us with the deadline already
-	// set. Disarm it here so that it is not applied to additional
-	// streams opened on this connection.
-	// TODO: implement WriteTimeout fully. See Issue 18437.
+	// passes the connection off to us with the deadline already set.
+	// Write deadlines are set per stream in serverConn.newStream.
+	// Disarm the net.Conn write deadline here.
 	if sc.hs.WriteTimeout != 0 {
 		sc.conn.SetWriteDeadline(time.Time{})
 	}
@@ -294,6 +366,9 @@ func (s *Server) ServeConn(c net.Conn, opts *ServeConnOpts) {
 		sc.writeSched = NewRandomWriteScheduler()
 	}
 
+	// These start at the RFC-specified defaults. If there is a higher
+	// configured value for inflow, that will be updated when we send a
+	// WINDOW_UPDATE shortly after sending SETTINGS.
 	sc.flow.add(initialWindowSize)
 	sc.inflow.add(initialWindowSize)
 	sc.hpackEncoder = hpack.NewEncoder(&sc.headerWriteBuf)
@@ -376,10 +451,9 @@ type serverConn struct {
 	doneServing      chan struct{}          // closed when serverConn.serve ends
 	readFrameCh      chan readFrameResult   // written by serverConn.readFrames
 	wantWriteFrameCh chan FrameWriteRequest // from handlers -> serve
-	wantStartPushCh  chan startPushRequest  // from handlers -> serve
 	wroteFrameCh     chan frameWriteResult  // from writeFrameAsync -> serve, tickles more frame writes
 	bodyReadCh       chan bodyReadMsg       // from handlers -> serve
-	testHookCh       chan func(int)         // code to run on the serve loop
+	serveMsgCh       chan interface{}       // misc messages & code to send to / run on the serve loop
 	flow             flow                   // conn-wide (not stream-specific) outbound flow control
 	inflow           flow                   // conn-wide inbound flow control
 	tlsState         *tls.ConnectionState   // shared by all handlers, like net/http
@@ -387,38 +461,39 @@ type serverConn struct {
 	writeSched       WriteScheduler
 
 	// Everything following is owned by the serve loop; use serveG.check():
-	serveG                goroutineLock // used to verify funcs are on serve()
-	pushEnabled           bool
-	sawFirstSettings      bool // got the initial SETTINGS frame after the preface
-	needToSendSettingsAck bool
-	unackedSettings       int    // how many SETTINGS have we sent without ACKs?
-	clientMaxStreams      uint32 // SETTINGS_MAX_CONCURRENT_STREAMS from client (our PUSH_PROMISE limit)
-	advMaxStreams         uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client
-	curClientStreams      uint32 // number of open streams initiated by the client
-	curPushedStreams      uint32 // number of open streams initiated by server push
-	maxClientStreamID     uint32 // max ever seen from client (odd), or 0 if there have been no client requests
-	maxPushPromiseID      uint32 // ID of the last push promise (even), or 0 if there have been no pushes
-	streams               map[uint32]*stream
-	initialWindowSize     int32
-	maxFrameSize          int32
-	headerTableSize       uint32
-	peerMaxHeaderListSize uint32            // zero means unknown (default)
-	canonHeader           map[string]string // http2-lower-case -> Go-Canonical-Case
-	writingFrame          bool              // started writing a frame (on serve goroutine or separate)
-	writingFrameAsync     bool              // started a frame on its own goroutine but haven't heard back on wroteFrameCh
-	needsFrameFlush       bool              // last frame write wasn't a flush
-	inGoAway              bool              // we've started to or sent GOAWAY
-	inFrameScheduleLoop   bool              // whether we're in the scheduleFrameWrite loop
-	needToSendGoAway      bool              // we need to schedule a GOAWAY frame write
-	goAwayCode            ErrCode
-	shutdownTimerCh       <-chan time.Time // nil until used
-	shutdownTimer         *time.Timer      // nil until used
-	idleTimer             *time.Timer      // nil if unused
-	idleTimerCh           <-chan time.Time // nil if unused
+	serveG                      goroutineLock // used to verify funcs are on serve()
+	pushEnabled                 bool
+	sawFirstSettings            bool // got the initial SETTINGS frame after the preface
+	needToSendSettingsAck       bool
+	unackedSettings             int    // how many SETTINGS have we sent without ACKs?
+	clientMaxStreams            uint32 // SETTINGS_MAX_CONCURRENT_STREAMS from client (our PUSH_PROMISE limit)
+	advMaxStreams               uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client
+	curClientStreams            uint32 // number of open streams initiated by the client
+	curPushedStreams            uint32 // number of open streams initiated by server push
+	maxClientStreamID           uint32 // max ever seen from client (odd), or 0 if there have been no client requests
+	maxPushPromiseID            uint32 // ID of the last push promise (even), or 0 if there have been no pushes
+	streams                     map[uint32]*stream
+	initialStreamSendWindowSize int32
+	maxFrameSize                int32
+	headerTableSize             uint32
+	peerMaxHeaderListSize       uint32            // zero means unknown (default)
+	canonHeader                 map[string]string // http2-lower-case -> Go-Canonical-Case
+	writingFrame                bool              // started writing a frame (on serve goroutine or separate)
+	writingFrameAsync           bool              // started a frame on its own goroutine but haven't heard back on wroteFrameCh
+	needsFrameFlush             bool              // last frame write wasn't a flush
+	inGoAway                    bool              // we've started to or sent GOAWAY
+	inFrameScheduleLoop         bool              // whether we're in the scheduleFrameWrite loop
+	needToSendGoAway            bool              // we need to schedule a GOAWAY frame write
+	goAwayCode                  ErrCode
+	shutdownTimer               *time.Timer // nil until used
+	idleTimer                   *time.Timer // nil if unused
 
 	// Owned by the writeFrameAsync goroutine:
 	headerWriteBuf bytes.Buffer
 	hpackEncoder   *hpack.Encoder
+
+	// Used by startGracefulShutdown.
+	shutdownOnce sync.Once
 }
 
 func (sc *serverConn) maxHeaderListSize() uint32 {
@@ -463,10 +538,10 @@ type stream struct {
 	numTrailerValues int64
 	weight           uint8
 	state            streamState
-	resetQueued      bool   // RST_STREAM queued for write; set by sc.resetStream
-	gotTrailerHeader bool   // HEADER frame for trailers was seen
-	wroteHeaders     bool   // whether we wrote headers (not status 100)
-	reqBuf           []byte // if non-nil, body pipe buffer to return later at EOF
+	resetQueued      bool        // RST_STREAM queued for write; set by sc.resetStream
+	gotTrailerHeader bool        // HEADER frame for trailers was seen
+	wroteHeaders     bool        // whether we wrote headers (not status 100)
+	writeDeadline    *time.Timer // nil if unused
 
 	trailer    http.Header // accumulated trailers
 	reqTrailer http.Header // handler's Request.Trailer
@@ -696,48 +771,48 @@ func (sc *serverConn) serve() {
 			{SettingMaxFrameSize, sc.srv.maxReadFrameSize()},
 			{SettingMaxConcurrentStreams, sc.advMaxStreams},
 			{SettingMaxHeaderListSize, sc.maxHeaderListSize()},
-
-			// TODO: more actual settings, notably
-			// SettingInitialWindowSize, but then we also
-			// want to bump up the conn window size the
-			// same amount here right after the settings
+			{SettingInitialWindowSize, uint32(sc.srv.initialStreamRecvWindowSize())},
 		},
 	})
 	sc.unackedSettings++
 
+	// Each connection starts with intialWindowSize inflow tokens.
+	// If a higher value is configured, we add more tokens.
+	if diff := sc.srv.initialConnRecvWindowSize() - initialWindowSize; diff > 0 {
+		sc.sendWindowUpdate(nil, int(diff))
+	}
+
 	if err := sc.readPreface(); err != nil {
 		sc.condlogf(err, "http2: server: error reading preface from client %v: %v", sc.conn.RemoteAddr(), err)
 		return
 	}
 	// Now that we've got the preface, get us out of the
-	// "StateNew" state.  We can't go directly to idle, though.
+	// "StateNew" state. We can't go directly to idle, though.
 	// Active means we read some data and anticipate a request. We'll
 	// do another Active when we get a HEADERS frame.
 	sc.setConnState(http.StateActive)
 	sc.setConnState(http.StateIdle)
 
 	if sc.srv.IdleTimeout != 0 {
-		sc.idleTimer = time.NewTimer(sc.srv.IdleTimeout)
+		sc.idleTimer = time.AfterFunc(sc.srv.IdleTimeout, sc.onIdleTimer)
 		defer sc.idleTimer.Stop()
-		sc.idleTimerCh = sc.idleTimer.C
-	}
-
-	var gracefulShutdownCh <-chan struct{}
-	if sc.hs != nil {
-		gracefulShutdownCh = h1ServerShutdownChan(sc.hs)
 	}
 
 	go sc.readFrames() // closed by defer sc.conn.Close above
 
-	settingsTimer := time.NewTimer(firstSettingsTimeout)
+	settingsTimer := time.AfterFunc(firstSettingsTimeout, sc.onSettingsTimer)
+	defer settingsTimer.Stop()
+
 	loopNum := 0
 	for {
 		loopNum++
 		select {
 		case wr := <-sc.wantWriteFrameCh:
+			if se, ok := wr.write.(StreamError); ok {
+				sc.resetStream(se)
+				break
+			}
 			sc.writeFrame(wr)
-		case spr := <-sc.wantStartPushCh:
-			sc.startPush(spr)
 		case res := <-sc.wroteFrameCh:
 			sc.wroteFrame(res)
 		case res := <-sc.readFrameCh:
@@ -745,26 +820,37 @@ func (sc *serverConn) serve() {
 				return
 			}
 			res.readMore()
-			if settingsTimer.C != nil {
+			if settingsTimer != nil {
 				settingsTimer.Stop()
-				settingsTimer.C = nil
+				settingsTimer = nil
 			}
 		case m := <-sc.bodyReadCh:
 			sc.noteBodyRead(m.st, m.n)
-		case <-settingsTimer.C:
-			sc.logf("timeout waiting for SETTINGS frames from %v", sc.conn.RemoteAddr())
-			return
-		case <-gracefulShutdownCh:
-			gracefulShutdownCh = nil
-			sc.startGracefulShutdown()
-		case <-sc.shutdownTimerCh:
-			sc.vlogf("GOAWAY close timer fired; closing conn from %v", sc.conn.RemoteAddr())
-			return
-		case <-sc.idleTimerCh:
-			sc.vlogf("connection is idle")
-			sc.goAway(ErrCodeNo)
-		case fn := <-sc.testHookCh:
-			fn(loopNum)
+		case msg := <-sc.serveMsgCh:
+			switch v := msg.(type) {
+			case func(int):
+				v(loopNum) // for testing
+			case *serverMessage:
+				switch v {
+				case settingsTimerMsg:
+					sc.logf("timeout waiting for SETTINGS frames from %v", sc.conn.RemoteAddr())
+					return
+				case idleTimerMsg:
+					sc.vlogf("connection is idle")
+					sc.goAway(ErrCodeNo)
+				case shutdownTimerMsg:
+					sc.vlogf("GOAWAY close timer fired; closing conn from %v", sc.conn.RemoteAddr())
+					return
+				case gracefulShutdownMsg:
+					sc.startGracefulShutdownInternal()
+				default:
+					panic("unknown timer")
+				}
+			case *startPushRequest:
+				sc.startPush(v)
+			default:
+				panic(fmt.Sprintf("unexpected type %T", v))
+			}
 		}
 
 		if sc.inGoAway && sc.curOpenStreams() == 0 && !sc.needToSendGoAway && !sc.writingFrame {
@@ -773,6 +859,36 @@ func (sc *serverConn) serve() {
 	}
 }
 
+func (sc *serverConn) awaitGracefulShutdown(sharedCh <-chan struct{}, privateCh chan struct{}) {
+	select {
+	case <-sc.doneServing:
+	case <-sharedCh:
+		close(privateCh)
+	}
+}
+
+type serverMessage int
+
+// Message values sent to serveMsgCh.
+var (
+	settingsTimerMsg    = new(serverMessage)
+	idleTimerMsg        = new(serverMessage)
+	shutdownTimerMsg    = new(serverMessage)
+	gracefulShutdownMsg = new(serverMessage)
+)
+
+func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) }
+func (sc *serverConn) onIdleTimer()     { sc.sendServeMsg(idleTimerMsg) }
+func (sc *serverConn) onShutdownTimer() { sc.sendServeMsg(shutdownTimerMsg) }
+
+func (sc *serverConn) sendServeMsg(msg interface{}) {
+	sc.serveG.checkNotOn() // NOT
+	select {
+	case sc.serveMsgCh <- msg:
+	case <-sc.doneServing:
+	}
+}
+
 // readPreface reads the ClientPreface greeting from the peer
 // or returns an error on timeout or an invalid greeting.
 func (sc *serverConn) readPreface() error {
@@ -1014,7 +1130,11 @@ func (sc *serverConn) wroteFrame(res frameWriteResult) {
 			// stateClosed after the RST_STREAM frame is
 			// written.
 			st.state = stateHalfClosedLocal
-			sc.resetStream(streamError(st.id, ErrCodeCancel))
+			// Section 8.1: a server MAY request that the client abort
+			// transmission of a request without error by sending a
+			// RST_STREAM with an error code of NO_ERROR after sending
+			// a complete response.
+			sc.resetStream(streamError(st.id, ErrCodeNo))
 		case stateHalfClosedRemote:
 			sc.closeStream(st, errHandlerComplete)
 		}
@@ -1086,10 +1206,19 @@ func (sc *serverConn) scheduleFrameWrite() {
 	sc.inFrameScheduleLoop = false
 }
 
-// startGracefulShutdown sends a GOAWAY with ErrCodeNo to tell the
-// client we're gracefully shutting down. The connection isn't closed
-// until all current streams are done.
+// startGracefulShutdown gracefully shuts down a connection. This
+// sends GOAWAY with ErrCodeNo to tell the client we're gracefully
+// shutting down. The connection isn't closed until all current
+// streams are done.
+//
+// startGracefulShutdown returns immediately; it does not wait until
+// the connection has shut down.
 func (sc *serverConn) startGracefulShutdown() {
+	sc.serveG.checkNotOn() // NOT
+	sc.shutdownOnce.Do(func() { sc.sendServeMsg(gracefulShutdownMsg) })
+}
+
+func (sc *serverConn) startGracefulShutdownInternal() {
 	sc.goAwayIn(ErrCodeNo, 0)
 }
 
@@ -1121,8 +1250,7 @@ func (sc *serverConn) goAwayIn(code ErrCode, forceCloseIn time.Duration) {
 
 func (sc *serverConn) shutDownIn(d time.Duration) {
 	sc.serveG.check()
-	sc.shutdownTimer = time.NewTimer(d)
-	sc.shutdownTimerCh = sc.shutdownTimer.C
+	sc.shutdownTimer = time.AfterFunc(d, sc.onShutdownTimer)
 }
 
 func (sc *serverConn) resetStream(se StreamError) {
@@ -1305,6 +1433,9 @@ func (sc *serverConn) closeStream(st *stream, err error) {
 		panic(fmt.Sprintf("invariant; can't close stream in state %v", st.state))
 	}
 	st.state = stateClosed
+	if st.writeDeadline != nil {
+		st.writeDeadline.Stop()
+	}
 	if st.isPushed() {
 		sc.curPushedStreams--
 	} else {
@@ -1317,7 +1448,7 @@ func (sc *serverConn) closeStream(st *stream, err error) {
 			sc.idleTimer.Reset(sc.srv.IdleTimeout)
 		}
 		if h1ServerKeepAlivesDisabled(sc.hs) {
-			sc.startGracefulShutdown()
+			sc.startGracefulShutdownInternal()
 		}
 	}
 	if p := st.body; p != nil {
@@ -1395,9 +1526,9 @@ func (sc *serverConn) processSettingInitialWindowSize(val uint32) error {
 	// adjust the size of all stream flow control windows that it
 	// maintains by the difference between the new value and the
 	// old value."
-	old := sc.initialWindowSize
-	sc.initialWindowSize = int32(val)
-	growth := sc.initialWindowSize - old // may be negative
+	old := sc.initialStreamSendWindowSize
+	sc.initialStreamSendWindowSize = int32(val)
+	growth := int32(val) - old // may be negative
 	for _, st := range sc.streams {
 		if !st.flow.add(growth) {
 			// 6.9.2 Initial Flow Control Window Size
@@ -1504,7 +1635,7 @@ func (sc *serverConn) processGoAway(f *GoAwayFrame) error {
 	} else {
 		sc.vlogf("http2: received GOAWAY %+v, starting graceful shutdown", f)
 	}
-	sc.startGracefulShutdown()
+	sc.startGracefulShutdownInternal()
 	// http://tools.ietf.org/html/rfc7540#section-6.8
 	// We should not create any new streams, which means we should disable push.
 	sc.pushEnabled = false
@@ -1543,6 +1674,12 @@ func (st *stream) copyTrailersToHandlerRequest() {
 	}
 }
 
+// onWriteTimeout is run on its own goroutine (from time.AfterFunc)
+// when the stream's WriteTimeout has fired.
+func (st *stream) onWriteTimeout() {
+	st.sc.writeFrameFromHandler(FrameWriteRequest{write: streamError(st.id, ErrCodeInternal)})
+}
+
 func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error {
 	sc.serveG.check()
 	id := f.StreamID
@@ -1719,9 +1856,12 @@ func (sc *serverConn) newStream(id, pusherID uint32, state streamState) *stream
 	}
 	st.cw.Init()
 	st.flow.conn = &sc.flow // link to conn-level counter
-	st.flow.add(sc.initialWindowSize)
-	st.inflow.conn = &sc.inflow      // link to conn-level counter
-	st.inflow.add(initialWindowSize) // TODO: update this when we send a higher initial window size in the initial settings
+	st.flow.add(sc.initialStreamSendWindowSize)
+	st.inflow.conn = &sc.inflow // link to conn-level counter
+	st.inflow.add(sc.srv.initialStreamRecvWindowSize())
+	if sc.hs.WriteTimeout != 0 {
+		st.writeDeadline = time.AfterFunc(sc.hs.WriteTimeout, st.onWriteTimeout)
+	}
 
 	sc.streams[id] = st
 	sc.writeSched.OpenStream(st.id, OpenStreamOptions{PusherID: pusherID})
@@ -1785,16 +1925,14 @@ func (sc *serverConn) newWriterAndRequest(st *stream, f *MetaHeadersFrame) (*res
 		return nil, nil, err
 	}
 	if bodyOpen {
-		st.reqBuf = getRequestBodyBuf()
-		req.Body.(*requestBody).pipe = &pipe{
-			b: &fixedBuffer{buf: st.reqBuf},
-		}
-
 		if vv, ok := rp.header["Content-Length"]; ok {
 			req.ContentLength, _ = strconv.ParseInt(vv[0], 10, 64)
 		} else {
 			req.ContentLength = -1
 		}
+		req.Body.(*requestBody).pipe = &pipe{
+			b: &dataBuffer{expected: req.ContentLength},
+		}
 	}
 	return rw, req, nil
 }
@@ -1890,24 +2028,6 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r
 	return rw, req, nil
 }
 
-var reqBodyCache = make(chan []byte, 8)
-
-func getRequestBodyBuf() []byte {
-	select {
-	case b := <-reqBodyCache:
-		return b
-	default:
-		return make([]byte, initialWindowSize)
-	}
-}
-
-func putRequestBodyBuf(b []byte) {
-	select {
-	case reqBodyCache <- b:
-	default:
-	}
-}
-
 // Run on its own goroutine.
 func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) {
 	didPanic := true
@@ -2003,12 +2123,6 @@ func (sc *serverConn) noteBodyReadFromHandler(st *stream, n int, err error) {
 		case <-sc.doneServing:
 		}
 	}
-	if err == io.EOF {
-		if buf := st.reqBuf; buf != nil {
-			st.reqBuf = nil // shouldn't matter; field unused by other
-			putRequestBodyBuf(buf)
-		}
-	}
 }
 
 func (sc *serverConn) noteBodyRead(st *stream, n int) {
@@ -2103,8 +2217,8 @@ func (b *requestBody) Read(p []byte) (n int, err error) {
 	return
 }
 
-// responseWriter is the http.ResponseWriter implementation.  It's
-// intentionally small (1 pointer wide) to minimize garbage.  The
+// responseWriter is the http.ResponseWriter implementation. It's
+// intentionally small (1 pointer wide) to minimize garbage. The
 // responseWriterState pointer inside is zeroed at the end of a
 // request (in handlerDone) and calls on the responseWriter thereafter
 // simply crash (caller's mistake), but the much larger responseWriterState
@@ -2278,7 +2392,7 @@ const TrailerPrefix = "Trailer:"
 // says you SHOULD (but not must) predeclare any trailers in the
 // header, the official ResponseWriter rules said trailers in Go must
 // be predeclared, and then we reuse the same ResponseWriter.Header()
-// map to mean both Headers and Trailers.  When it's time to write the
+// map to mean both Headers and Trailers. When it's time to write the
 // Trailers, we pick out the fields of Headers that were declared as
 // trailers. That worked for a while, until we found the first major
 // user of Trailers in the wild: gRPC (using them only over http2),
@@ -2514,7 +2628,7 @@ func (w *responseWriter) push(target string, opts pushOptions) error {
 		return fmt.Errorf("method %q must be GET or HEAD", opts.Method)
 	}
 
-	msg := startPushRequest{
+	msg := &startPushRequest{
 		parent: st,
 		method: opts.Method,
 		url:    u,
@@ -2527,7 +2641,7 @@ func (w *responseWriter) push(target string, opts pushOptions) error {
 		return errClientDisconnected
 	case <-st.cw:
 		return errStreamClosed
-	case sc.wantStartPushCh <- msg:
+	case sc.serveMsgCh <- msg:
 	}
 
 	select {
@@ -2549,7 +2663,7 @@ type startPushRequest struct {
 	done   chan error
 }
 
-func (sc *serverConn) startPush(msg startPushRequest) {
+func (sc *serverConn) startPush(msg *startPushRequest) {
 	sc.serveG.check()
 
 	// http://tools.ietf.org/html/rfc7540#section-6.6.
@@ -2588,7 +2702,7 @@ func (sc *serverConn) startPush(msg startPushRequest) {
 		// A server that is unable to establish a new stream identifier can send a GOAWAY
 		// frame so that the client is forced to open a new connection for new streams.
 		if sc.maxPushPromiseID+2 >= 1<<31 {
-			sc.startGracefulShutdown()
+			sc.startGracefulShutdownInternal()
 			return 0, ErrPushLimitReached
 		}
 		sc.maxPushPromiseID += 2
@@ -2713,31 +2827,6 @@ var badTrailer = map[string]bool{
 	"Www-Authenticate":    true,
 }
 
-// h1ServerShutdownChan returns a channel that will be closed when the
-// provided *http.Server wants to shut down.
-//
-// This is a somewhat hacky way to get at http1 innards. It works
-// when the http2 code is bundled into the net/http package in the
-// standard library. The alternatives ended up making the cmd/go tool
-// depend on http Servers. This is the lightest option for now.
-// This is tested via the TestServeShutdown* tests in net/http.
-func h1ServerShutdownChan(hs *http.Server) <-chan struct{} {
-	if fn := testh1ServerShutdownChan; fn != nil {
-		return fn(hs)
-	}
-	var x interface{} = hs
-	type I interface {
-		getDoneChan() <-chan struct{}
-	}
-	if hs, ok := x.(I); ok {
-		return hs.getDoneChan()
-	}
-	return nil
-}
-
-// optional test hook for h1ServerShutdownChan.
-var testh1ServerShutdownChan func(hs *http.Server) <-chan struct{}
-
 // h1ServerKeepAlivesDisabled reports whether hs has its keep-alives
 // disabled. See comments on h1ServerShutdownChan above for why
 // the code is written this way.
diff --git a/components/engine/vendor/golang.org/x/net/http2/transport.go b/components/engine/vendor/golang.org/x/net/http2/transport.go
index 0c7e859db1..3a85f25a20 100644
--- a/components/engine/vendor/golang.org/x/net/http2/transport.go
+++ b/components/engine/vendor/golang.org/x/net/http2/transport.go
@@ -575,7 +575,7 @@ func (cc *ClientConn) canTakeNewRequestLocked() bool {
 		cc.nextStreamID < math.MaxInt32
 }
 
-// onIdleTimeout is called from a time.AfterFunc goroutine.  It will
+// onIdleTimeout is called from a time.AfterFunc goroutine. It will
 // only be called when we're idle, but because we're coming from a new
 // goroutine, there could be a new request coming in at the same time,
 // so this simply calls the synchronized closeIfIdle to shut down this
@@ -809,8 +809,8 @@ func (cc *ClientConn) RoundTrip(req *http.Request) (*http.Response, error) {
 			// 2xx, however, then assume the server DOES potentially
 			// want our body (e.g. full-duplex streaming:
 			// golang.org/issue/13444). If it turns out the server
-			// doesn't, they'll RST_STREAM us soon enough.  This is a
-			// heuristic to avoid adding knobs to Transport.  Hopefully
+			// doesn't, they'll RST_STREAM us soon enough. This is a
+			// heuristic to avoid adding knobs to Transport. Hopefully
 			// we can keep it.
 			bodyWriter.cancel()
 			cs.abortRequestBodyWrite(errStopReqBodyWrite)
@@ -1528,8 +1528,7 @@ func (rl *clientConnReadLoop) handleResponse(cs *clientStream, f *MetaHeadersFra
 		return res, nil
 	}
 
-	buf := new(bytes.Buffer) // TODO(bradfitz): recycle this garbage
-	cs.bufPipe = pipe{b: buf}
+	cs.bufPipe = pipe{b: &dataBuffer{expected: res.ContentLength}}
 	cs.bytesRemain = res.ContentLength
 	res.Body = transportResponseBody{cs}
 	go cs.awaitRequestCancel(cs.req)
@@ -1656,6 +1655,7 @@ func (b transportResponseBody) Close() error {
 		cc.wmu.Lock()
 		if !serverSentStreamEnd {
 			cc.fr.WriteRSTStream(cs.ID, ErrCodeCancel)
+			cs.didReset = true
 		}
 		// Return connection-level flow control.
 		if unread > 0 {
@@ -1703,12 +1703,6 @@ func (rl *clientConnReadLoop) processData(f *DataFrame) error {
 		return nil
 	}
 	if f.Length > 0 {
-		if len(data) > 0 && cs.bufPipe.b == nil {
-			// Data frame after it's already closed?
-			cc.logf("http2: Transport received DATA frame for closed stream; closing connection")
-			return ConnectionError(ErrCodeProtocol)
-		}
-
 		// Check connection-level flow control.
 		cc.mu.Lock()
 		if cs.inflow.available() >= int32(f.Length) {
diff --git a/components/engine/vendor/golang.org/x/net/http2/writesched_priority.go b/components/engine/vendor/golang.org/x/net/http2/writesched_priority.go
index 01132721bd..848fed6ec7 100644
--- a/components/engine/vendor/golang.org/x/net/http2/writesched_priority.go
+++ b/components/engine/vendor/golang.org/x/net/http2/writesched_priority.go
@@ -53,7 +53,7 @@ type PriorityWriteSchedulerConfig struct {
 }
 
 // NewPriorityWriteScheduler constructs a WriteScheduler that schedules
-// frames by following HTTP/2 priorities as described in RFC 7340 Section 5.3.
+// frames by following HTTP/2 priorities as described in RFC 7540 Section 5.3.
 // If cfg is nil, default options are used.
 func NewPriorityWriteScheduler(cfg *PriorityWriteSchedulerConfig) WriteScheduler {
 	if cfg == nil {
diff --git a/components/engine/vendor/golang.org/x/net/idna/idna.go b/components/engine/vendor/golang.org/x/net/idna/idna.go
index 47466e947a..ee2dbda6d0 100644
--- a/components/engine/vendor/golang.org/x/net/idna/idna.go
+++ b/components/engine/vendor/golang.org/x/net/idna/idna.go
@@ -1,4 +1,4 @@
-// Copied from the golang.org/x/text repo; DO NOT EDIT
+// Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
 
 // Copyright 2016 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
@@ -39,27 +39,24 @@ import (
 //    error in the future.
 // I think Option 1 is best, but it is quite opinionated.
 
-// ToASCII converts a domain or domain label to its ASCII form. For example,
-// ToASCII("bücher.example.com") is "xn--bcher-kva.example.com", and
-// ToASCII("golang") is "golang". If an error is encountered it will return
-// an error and a (partially) processed result.
+// ToASCII is a wrapper for Punycode.ToASCII.
 func ToASCII(s string) (string, error) {
-	return Resolve.process(s, true)
+	return Punycode.process(s, true)
 }
 
-// ToUnicode converts a domain or domain label to its Unicode form. For example,
-// ToUnicode("xn--bcher-kva.example.com") is "bücher.example.com", and
-// ToUnicode("golang") is "golang". If an error is encountered it will return
-// an error and a (partially) processed result.
+// ToUnicode is a wrapper for Punycode.ToUnicode.
 func ToUnicode(s string) (string, error) {
-	return NonTransitional.process(s, false)
+	return Punycode.process(s, false)
 }
 
 // An Option configures a Profile at creation time.
 type Option func(*options)
 
-// Transitional sets a Profile to use the Transitional mapping as defined
-// in UTS #46.
+// Transitional sets a Profile to use the Transitional mapping as defined in UTS
+// #46. This will cause, for example, "ß" to be mapped to "ss". Using the
+// transitional mapping provides a compromise between IDNA2003 and IDNA2008
+// compatibility. It is used by most browsers when resolving domain names. This
+// option is only meaningful if combined with MapForLookup.
 func Transitional(transitional bool) Option {
 	return func(o *options) { o.transitional = true }
 }
@@ -70,19 +67,93 @@ func VerifyDNSLength(verify bool) Option {
 	return func(o *options) { o.verifyDNSLength = verify }
 }
 
-// IgnoreSTD3Rules sets whether ASCII characters outside the A-Z, a-z, 0-9 and
-// the hyphen should be allowed. By default this is not allowed, but IDNA2003,
-// and as a consequence UTS #46, allows this to be overridden to support
-// browsers that allow characters outside this range, for example a '_' (U+005F
-// LOW LINE). See http://www.rfc- editor.org/std/std3.txt for more details.
-func IgnoreSTD3Rules(ignore bool) Option {
-	return func(o *options) { o.ignoreSTD3Rules = ignore }
+// ValidateLabels sets whether to check the mandatory label validation criteria
+// as defined in Section 5.4 of RFC 5891. This includes testing for correct use
+// of hyphens ('-'), normalization, validity of runes, and the context rules.
+func ValidateLabels(enable bool) Option {
+	return func(o *options) {
+		// Don't override existing mappings, but set one that at least checks
+		// normalization if it is not set.
+		if o.mapping == nil && enable {
+			o.mapping = normalize
+		}
+		o.trie = trie
+		o.validateLabels = enable
+		o.fromPuny = validateFromPunycode
+	}
+}
+
+// StrictDomainName limits the set of permissable ASCII characters to those
+// allowed in domain names as defined in RFC 1034 (A-Z, a-z, 0-9 and the
+// hyphen). This is set by default for MapForLookup and ValidateForRegistration.
+//
+// This option is useful, for instance, for browsers that allow characters
+// outside this range, for example a '_' (U+005F LOW LINE). See
+// http://www.rfc-editor.org/std/std3.txt for more details This option
+// corresponds to the UseSTD3ASCIIRules option in UTS #46.
+func StrictDomainName(use bool) Option {
+	return func(o *options) {
+		o.trie = trie
+		o.useSTD3Rules = use
+		o.fromPuny = validateFromPunycode
+	}
+}
+
+// NOTE: the following options pull in tables. The tables should not be linked
+// in as long as the options are not used.
+
+// BidiRule enables the Bidi rule as defined in RFC 5893. Any application
+// that relies on proper validation of labels should include this rule.
+func BidiRule() Option {
+	return func(o *options) { o.bidirule = bidirule.ValidString }
+}
+
+// ValidateForRegistration sets validation options to verify that a given IDN is
+// properly formatted for registration as defined by Section 4 of RFC 5891.
+func ValidateForRegistration() Option {
+	return func(o *options) {
+		o.mapping = validateRegistration
+		StrictDomainName(true)(o)
+		ValidateLabels(true)(o)
+		VerifyDNSLength(true)(o)
+		BidiRule()(o)
+	}
+}
+
+// MapForLookup sets validation and mapping options such that a given IDN is
+// transformed for domain name lookup according to the requirements set out in
+// Section 5 of RFC 5891. The mappings follow the recommendations of RFC 5894,
+// RFC 5895 and UTS 46. It does not add the Bidi Rule. Use the BidiRule option
+// to add this check.
+//
+// The mappings include normalization and mapping case, width and other
+// compatibility mappings.
+func MapForLookup() Option {
+	return func(o *options) {
+		o.mapping = validateAndMap
+		StrictDomainName(true)(o)
+		ValidateLabels(true)(o)
+	}
 }
 
 type options struct {
 	transitional    bool
-	ignoreSTD3Rules bool
+	useSTD3Rules    bool
+	validateLabels  bool
 	verifyDNSLength bool
+
+	trie *idnaTrie
+
+	// fromPuny calls validation rules when converting A-labels to U-labels.
+	fromPuny func(p *Profile, s string) error
+
+	// mapping implements a validation and mapping step as defined in RFC 5895
+	// or UTS 46, tailored to, for example, domain registration or lookup.
+	mapping func(p *Profile, s string) (string, error)
+
+	// bidirule, if specified, checks whether s conforms to the Bidi Rule
+	// defined in RFC 5893.
+	bidirule func(s string) bool
 }
 
 // A Profile defines the configuration of a IDNA mapper.
@@ -97,8 +168,13 @@ func apply(o *options, opts []Option) {
 }
 
 // New creates a new Profile.
-// With no options, the returned profile is the non-transitional profile as
-// defined in UTS #46.
+//
+// With no options, the returned Profile is the most permissive and equals the
+// Punycode Profile. Options can be passed to further restrict the Profile. The
+// MapForLookup and ValidateForRegistration options set a collection of options,
+// for lookup and registration purposes respectively, which can be tailored by
+// adding more fine-grained options, where later options override earlier
+// options.
 func New(o ...Option) *Profile {
 	p := &Profile{}
 	apply(&p.options, o)
@@ -132,33 +208,67 @@ func (p *Profile) String() string {
 	} else {
 		s = "NonTransitional"
 	}
-	if p.ignoreSTD3Rules {
-		s += ":NoSTD3Rules"
+	if p.useSTD3Rules {
+		s += ":UseSTD3Rules"
+	}
+	if p.validateLabels {
+		s += ":ValidateLabels"
+	}
+	if p.verifyDNSLength {
+		s += ":VerifyDNSLength"
 	}
 	return s
 }
 
 var (
-	// Resolve is the recommended profile for resolving domain names.
-	// The configuration of this profile may change over time.
-	Resolve = resolve
+	// Punycode is a Profile that does raw punycode processing with a minimum
+	// of validation.
+	Punycode *Profile = punycode
+
+	// Lookup is the recommended profile for looking up domain names, according
+	// to Section 5 of RFC 5891. The exact configuration of this profile may
+	// change over time.
+	Lookup *Profile = lookup
 
 	// Display is the recommended profile for displaying domain names.
 	// The configuration of this profile may change over time.
-	Display = display
+	Display *Profile = display
 
-	// NonTransitional defines a profile that implements the Transitional
-	// mapping as defined in UTS #46 with no additional constraints.
-	NonTransitional = nonTransitional
+	// Registration is the recommended profile for checking whether a given
+	// IDN is valid for registration, according to Section 4 of RFC 5891.
+	Registration *Profile = registration
 
-	resolve         = &Profile{options{transitional: true}}
-	display         = &Profile{}
-	nonTransitional = &Profile{}
+	punycode = &Profile{}
+	lookup   = &Profile{options{
+		transitional:   true,
+		useSTD3Rules:   true,
+		validateLabels: true,
+		trie:           trie,
+		fromPuny:       validateFromPunycode,
+		mapping:        validateAndMap,
+		bidirule:       bidirule.ValidString,
+	}}
+	display = &Profile{options{
+		useSTD3Rules:   true,
+		validateLabels: true,
+		trie:           trie,
+		fromPuny:       validateFromPunycode,
+		mapping:        validateAndMap,
+		bidirule:       bidirule.ValidString,
+	}}
+	registration = &Profile{options{
+		useSTD3Rules:    true,
+		validateLabels:  true,
+		verifyDNSLength: true,
+		trie:            trie,
+		fromPuny:        validateFromPunycode,
+		mapping:         validateRegistration,
+		bidirule:        bidirule.ValidString,
+	}}
 
 	// TODO: profiles
-	// V2008: strict IDNA2008
-	// Register: recommended for approving domain names: nontransitional, but
-	// bundle or block deviation characters.
+	// Register: recommended for approving domain names: don't do any mappings
+	// but rather reject on invalid input. Bundle or block deviation characters.
 )
 
 type labelError struct{ label, code_ string }
@@ -178,12 +288,117 @@ func (e runeError) Error() string {
 // process implements the algorithm described in section 4 of UTS #46,
 // see http://www.unicode.org/reports/tr46.
 func (p *Profile) process(s string, toASCII bool) (string, error) {
+	var err error
+	if p.mapping != nil {
+		s, err = p.mapping(p, s)
+	}
+	// Remove leading empty labels.
+	for ; len(s) > 0 && s[0] == '.'; s = s[1:] {
+	}
+	// It seems like we should only create this error on ToASCII, but the
+	// UTS 46 conformance tests suggests we should always check this.
+	if err == nil && p.verifyDNSLength && s == "" {
+		err = &labelError{s, "A4"}
+	}
+	labels := labelIter{orig: s}
+	for ; !labels.done(); labels.next() {
+		label := labels.label()
+		if label == "" {
+			// Empty labels are not okay. The label iterator skips the last
+			// label if it is empty.
+			if err == nil && p.verifyDNSLength {
+				err = &labelError{s, "A4"}
+			}
+			continue
+		}
+		if strings.HasPrefix(label, acePrefix) {
+			u, err2 := decode(label[len(acePrefix):])
+			if err2 != nil {
+				if err == nil {
+					err = err2
+				}
+				// Spec says keep the old label.
+				continue
+			}
+			labels.set(u)
+			if err == nil && p.validateLabels {
+				err = p.fromPuny(p, u)
+			}
+			if err == nil {
+				// This should be called on NonTransitional, according to the
+				// spec, but that currently does not have any effect. Use the
+				// original profile to preserve options.
+				err = p.validateLabel(u)
+			}
+		} else if err == nil {
+			err = p.validateLabel(label)
+		}
+	}
+	if toASCII {
+		for labels.reset(); !labels.done(); labels.next() {
+			label := labels.label()
+			if !ascii(label) {
+				a, err2 := encode(acePrefix, label)
+				if err == nil {
+					err = err2
+				}
+				label = a
+				labels.set(a)
+			}
+			n := len(label)
+			if p.verifyDNSLength && err == nil && (n == 0 || n > 63) {
+				err = &labelError{label, "A4"}
+			}
+		}
+	}
+	s = labels.result()
+	if toASCII && p.verifyDNSLength && err == nil {
+		// Compute the length of the domain name minus the root label and its dot.
+		n := len(s)
+		if n > 0 && s[n-1] == '.' {
+			n--
+		}
+		if len(s) < 1 || n > 253 {
+			err = &labelError{s, "A4"}
+		}
+	}
+	return s, err
+}
+
+func normalize(p *Profile, s string) (string, error) {
+	return norm.NFC.String(s), nil
+}
+
+func validateRegistration(p *Profile, s string) (string, error) {
+	if !norm.NFC.IsNormalString(s) {
+		return s, &labelError{s, "V1"}
+	}
+	var err error
+	for i := 0; i < len(s); {
+		v, sz := trie.lookupString(s[i:])
+		i += sz
+		// Copy bytes not copied so far.
+		switch p.simplify(info(v).category()) {
+		// TODO: handle the NV8 defined in the Unicode idna data set to allow
+		// for strict conformance to IDNA2008.
+		case valid, deviation:
+		case disallowed, mapped, unknown, ignored:
+			if err == nil {
+				r, _ := utf8.DecodeRuneInString(s[i:])
+				err = runeError(r)
+			}
+		}
+	}
+	return s, err
+}
+
+func validateAndMap(p *Profile, s string) (string, error) {
 	var (
-		b    []byte
-		err  error
-		k, i int
+		err error
+		b   []byte
+		k   int
 	)
-	for i < len(s) {
+	for i := 0; i < len(s); {
 		v, sz := trie.lookupString(s[i:])
 		start := i
 		i += sz
@@ -220,71 +435,6 @@ func (p *Profile) process(s string, toASCII bool) (string, error) {
 		// TODO: the punycode converters require strings as input.
 		s = string(b)
 	}
-	// Remove leading empty labels
-	for ; len(s) > 0 && s[0] == '.'; s = s[1:] {
-	}
-	if s == "" {
-		return "", &labelError{s, "A4"}
-	}
-	labels := labelIter{orig: s}
-	for ; !labels.done(); labels.next() {
-		label := labels.label()
-		if label == "" {
-			// Empty labels are not okay. The label iterator skips the last
-			// label if it is empty.
-			if err == nil {
-				err = &labelError{s, "A4"}
-			}
-			continue
-		}
-		if strings.HasPrefix(label, acePrefix) {
-			u, err2 := decode(label[len(acePrefix):])
-			if err2 != nil {
-				if err == nil {
-					err = err2
-				}
-				// Spec says keep the old label.
-				continue
-			}
-			labels.set(u)
-			if err == nil {
-				err = p.validateFromPunycode(u)
-			}
-			if err == nil {
-				err = NonTransitional.validate(u)
-			}
-		} else if err == nil {
-			err = p.validate(label)
-		}
-	}
-	if toASCII {
-		for labels.reset(); !labels.done(); labels.next() {
-			label := labels.label()
-			if !ascii(label) {
-				a, err2 := encode(acePrefix, label)
-				if err == nil {
-					err = err2
-				}
-				label = a
-				labels.set(a)
-			}
-			n := len(label)
-			if p.verifyDNSLength && err == nil && (n == 0 || n > 63) {
-				err = &labelError{label, "A4"}
-			}
-		}
-	}
-	s = labels.result()
-	if toASCII && p.verifyDNSLength && err == nil {
-		// Compute the length of the domain name minus the root label and its dot.
-		n := len(s)
-		if n > 0 && s[n-1] == '.' {
-			n--
-		}
-		if len(s) < 1 || n > 253 {
-			err = &labelError{s, "A4"}
-		}
-	}
 	return s, err
 }
 
@@ -354,13 +504,13 @@ const acePrefix = "xn--"
 func (p *Profile) simplify(cat category) category {
 	switch cat {
 	case disallowedSTD3Mapped:
-		if !p.ignoreSTD3Rules {
+		if p.useSTD3Rules {
 			cat = disallowed
 		} else {
 			cat = mapped
 		}
 	case disallowedSTD3Valid:
-		if !p.ignoreSTD3Rules {
+		if p.useSTD3Rules {
 			cat = disallowed
 		} else {
 			cat = valid
@@ -376,7 +526,7 @@ func (p *Profile) simplify(cat category) category {
 	return cat
 }
 
-func (p *Profile) validateFromPunycode(s string) error {
+func validateFromPunycode(p *Profile, s string) error {
 	if !norm.NFC.IsNormalString(s) {
 		return &labelError{s, "V1"}
 	}
@@ -452,9 +602,22 @@ var joinStates = [][numJoinTypes]joinState{
 	},
 }
 
-// validate validates the criteria from Section 4.1. Item 1, 4, and 6 are
+// validateLabel validates the criteria from Section 4.1. Item 1, 4, and 6 are
 // already implicitly satisfied by the overall implementation.
-func (p *Profile) validate(s string) error {
+func (p *Profile) validateLabel(s string) error {
+	if s == "" {
+		if p.verifyDNSLength {
+			return &labelError{s, "A4"}
+		}
+		return nil
+	}
+	if p.bidirule != nil && !p.bidirule(s) {
+		return &labelError{s, "B"}
+	}
+	if !p.validateLabels {
+		return nil
+	}
+	trie := p.trie // p.validateLabels is only set if trie is set.
 	if len(s) > 4 && s[2] == '-' && s[3] == '-' {
 		return &labelError{s, "V2"}
 	}
@@ -467,9 +630,6 @@ func (p *Profile) validate(s string) error {
 	if x.isModifier() {
 		return &labelError{s, "V5"}
 	}
-	if !bidirule.ValidString(s) {
-		return &labelError{s, "B"}
-	}
 	// Quickly return in the absence of zero-width (non) joiners.
 	if strings.Index(s, zwj) == -1 && strings.Index(s, zwnj) == -1 {
 		return nil
diff --git a/components/engine/vendor/golang.org/x/net/idna/punycode.go b/components/engine/vendor/golang.org/x/net/idna/punycode.go
index df3411a5bc..02c7d59af3 100644
--- a/components/engine/vendor/golang.org/x/net/idna/punycode.go
+++ b/components/engine/vendor/golang.org/x/net/idna/punycode.go
@@ -1,4 +1,4 @@
-// Copied from the golang.org/x/text repo; DO NOT EDIT
+// Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
 
 // Copyright 2016 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
diff --git a/components/engine/vendor/golang.org/x/net/idna/tables.go b/components/engine/vendor/golang.org/x/net/idna/tables.go
index 663d73c531..d2819345fc 100644
--- a/components/engine/vendor/golang.org/x/net/idna/tables.go
+++ b/components/engine/vendor/golang.org/x/net/idna/tables.go
@@ -1,6 +1,4 @@
-// Copied from the golang.org/x/text repo; DO NOT EDIT
-
-// This file was generated by go generate; DO NOT EDIT
+// Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
 
 package idna
 
diff --git a/components/engine/vendor/golang.org/x/net/idna/trie.go b/components/engine/vendor/golang.org/x/net/idna/trie.go
index 6d37998f5d..c4ef847e7a 100644
--- a/components/engine/vendor/golang.org/x/net/idna/trie.go
+++ b/components/engine/vendor/golang.org/x/net/idna/trie.go
@@ -1,4 +1,4 @@
-// Copied from the golang.org/x/text repo; DO NOT EDIT
+// Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
 
 // Copyright 2016 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
@@ -44,7 +44,8 @@ var idnaSparse = sparseBlocks{
 	offset: idnaSparseOffset[:],
 }
 
-var trie = newIdnaTrie(0)
+// Don't use newIdnaTrie to avoid unconditional linking in of the table.
+var trie = &idnaTrie{}
 
 // lookup determines the type of block n and looks up the value for b.
 // For n < t.cutoff, the block is a simple lookup table. Otherwise, the block
diff --git a/components/engine/vendor/golang.org/x/net/idna/trieval.go b/components/engine/vendor/golang.org/x/net/idna/trieval.go
index d1b3256c8b..63cb03b59b 100644
--- a/components/engine/vendor/golang.org/x/net/idna/trieval.go
+++ b/components/engine/vendor/golang.org/x/net/idna/trieval.go
@@ -1,6 +1,4 @@
-// Copied from the golang.org/x/text repo; DO NOT EDIT
-
-// This file was generated by go generate; DO NOT EDIT
+// Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
 
 package idna
 
diff --git a/components/engine/vendor/golang.org/x/net/internal/timeseries/timeseries.go b/components/engine/vendor/golang.org/x/net/internal/timeseries/timeseries.go
index 1119f34482..685f0e7ea2 100644
--- a/components/engine/vendor/golang.org/x/net/internal/timeseries/timeseries.go
+++ b/components/engine/vendor/golang.org/x/net/internal/timeseries/timeseries.go
@@ -371,7 +371,7 @@ func (ts *timeSeries) ComputeRange(start, finish time.Time, num int) []Observabl
 		}
 	}
 
-	// Failed to find a level that covers the desired range.  So just
+	// Failed to find a level that covers the desired range. So just
 	// extract from the last level, even if it doesn't cover the entire
 	// desired range.
 	ts.extract(ts.levels[len(ts.levels)-1], start, finish, num, results)
diff --git a/components/engine/vendor/golang.org/x/net/proxy/socks5.go b/components/engine/vendor/golang.org/x/net/proxy/socks5.go
index 9b9628239a..973f57f197 100644
--- a/components/engine/vendor/golang.org/x/net/proxy/socks5.go
+++ b/components/engine/vendor/golang.org/x/net/proxy/socks5.go
@@ -72,24 +72,28 @@ func (s *socks5) Dial(network, addr string) (net.Conn, error) {
 	if err != nil {
 		return nil, err
 	}
-	closeConn := &conn
-	defer func() {
-		if closeConn != nil {
-			(*closeConn).Close()
-		}
-	}()
-
-	host, portStr, err := net.SplitHostPort(addr)
-	if err != nil {
+	if err := s.connect(conn, addr); err != nil {
+		conn.Close()
 		return nil, err
 	}
+	return conn, nil
+}
+
+// connect takes an existing connection to a socks5 proxy server,
+// and commands the server to extend that connection to target,
+// which must be a canonical address with a host and port.
+func (s *socks5) connect(conn net.Conn, target string) error {
+	host, portStr, err := net.SplitHostPort(target)
+	if err != nil {
+		return err
+	}
 
 	port, err := strconv.Atoi(portStr)
 	if err != nil {
-		return nil, errors.New("proxy: failed to parse port number: " + portStr)
+		return errors.New("proxy: failed to parse port number: " + portStr)
 	}
 	if port < 1 || port > 0xffff {
-		return nil, errors.New("proxy: port number out of range: " + portStr)
+		return errors.New("proxy: port number out of range: " + portStr)
 	}
 
 	// the size here is just an estimate
@@ -103,17 +107,17 @@ func (s *socks5) Dial(network, addr string) (net.Conn, error) {
 	}
 
 	if _, err := conn.Write(buf); err != nil {
-		return nil, errors.New("proxy: failed to write greeting to SOCKS5 proxy at " + s.addr + ": " + err.Error())
+		return errors.New("proxy: failed to write greeting to SOCKS5 proxy at " + s.addr + ": " + err.Error())
 	}
 
 	if _, err := io.ReadFull(conn, buf[:2]); err != nil {
-		return nil, errors.New("proxy: failed to read greeting from SOCKS5 proxy at " + s.addr + ": " + err.Error())
+		return errors.New("proxy: failed to read greeting from SOCKS5 proxy at " + s.addr + ": " + err.Error())
 	}
 	if buf[0] != 5 {
-		return nil, errors.New("proxy: SOCKS5 proxy at " + s.addr + " has unexpected version " + strconv.Itoa(int(buf[0])))
+		return errors.New("proxy: SOCKS5 proxy at " + s.addr + " has unexpected version " + strconv.Itoa(int(buf[0])))
 	}
 	if buf[1] == 0xff {
-		return nil, errors.New("proxy: SOCKS5 proxy at " + s.addr + " requires authentication")
+		return errors.New("proxy: SOCKS5 proxy at " + s.addr + " requires authentication")
 	}
 
 	if buf[1] == socks5AuthPassword {
@@ -125,15 +129,15 @@ func (s *socks5) Dial(network, addr string) (net.Conn, error) {
 		buf = append(buf, s.password...)
 
 		if _, err := conn.Write(buf); err != nil {
-			return nil, errors.New("proxy: failed to write authentication request to SOCKS5 proxy at " + s.addr + ": " + err.Error())
+			return errors.New("proxy: failed to write authentication request to SOCKS5 proxy at " + s.addr + ": " + err.Error())
 		}
 
 		if _, err := io.ReadFull(conn, buf[:2]); err != nil {
-			return nil, errors.New("proxy: failed to read authentication reply from SOCKS5 proxy at " + s.addr + ": " + err.Error())
+			return errors.New("proxy: failed to read authentication reply from SOCKS5 proxy at " + s.addr + ": " + err.Error())
 		}
 
 		if buf[1] != 0 {
-			return nil, errors.New("proxy: SOCKS5 proxy at " + s.addr + " rejected username/password")
+			return errors.New("proxy: SOCKS5 proxy at " + s.addr + " rejected username/password")
 		}
 	}
 
@@ -150,7 +154,7 @@ func (s *socks5) Dial(network, addr string) (net.Conn, error) {
 		buf = append(buf, ip...)
 	} else {
 		if len(host) > 255 {
-			return nil, errors.New("proxy: destination hostname too long: " + host)
+			return errors.New("proxy: destination hostname too long: " + host)
 		}
 		buf = append(buf, socks5Domain)
 		buf = append(buf, byte(len(host)))
@@ -159,11 +163,11 @@ func (s *socks5) Dial(network, addr string) (net.Conn, error) {
 	buf = append(buf, byte(port>>8), byte(port))
 
 	if _, err := conn.Write(buf); err != nil {
-		return nil, errors.New("proxy: failed to write connect request to SOCKS5 proxy at " + s.addr + ": " + err.Error())
+		return errors.New("proxy: failed to write connect request to SOCKS5 proxy at " + s.addr + ": " + err.Error())
 	}
 
 	if _, err := io.ReadFull(conn, buf[:4]); err != nil {
-		return nil, errors.New("proxy: failed to read connect reply from SOCKS5 proxy at " + s.addr + ": " + err.Error())
+		return errors.New("proxy: failed to read connect reply from SOCKS5 proxy at " + s.addr + ": " + err.Error())
 	}
 
 	failure := "unknown error"
@@ -172,7 +176,7 @@ func (s *socks5) Dial(network, addr string) (net.Conn, error) {
 	}
 
 	if len(failure) > 0 {
-		return nil, errors.New("proxy: SOCKS5 proxy at " + s.addr + " failed to connect: " + failure)
+		return errors.New("proxy: SOCKS5 proxy at " + s.addr + " failed to connect: " + failure)
 	}
 
 	bytesToDiscard := 0
@@ -184,11 +188,11 @@ func (s *socks5) Dial(network, addr string) (net.Conn, error) {
 	case socks5Domain:
 		_, err := io.ReadFull(conn, buf[:1])
 		if err != nil {
-			return nil, errors.New("proxy: failed to read domain length from SOCKS5 proxy at " + s.addr + ": " + err.Error())
+			return errors.New("proxy: failed to read domain length from SOCKS5 proxy at " + s.addr + ": " + err.Error())
 		}
 		bytesToDiscard = int(buf[0])
 	default:
-		return nil, errors.New("proxy: got unknown address type " + strconv.Itoa(int(buf[3])) + " from SOCKS5 proxy at " + s.addr)
+		return errors.New("proxy: got unknown address type " + strconv.Itoa(int(buf[3])) + " from SOCKS5 proxy at " + s.addr)
 	}
 
 	if cap(buf) < bytesToDiscard {
@@ -197,14 +201,13 @@ func (s *socks5) Dial(network, addr string) (net.Conn, error) {
 		buf = buf[:bytesToDiscard]
 	}
 	if _, err := io.ReadFull(conn, buf); err != nil {
-		return nil, errors.New("proxy: failed to read address from SOCKS5 proxy at " + s.addr + ": " + err.Error())
+		return errors.New("proxy: failed to read address from SOCKS5 proxy at " + s.addr + ": " + err.Error())
 	}
 
 	// Also need to discard the port number
 	if _, err := io.ReadFull(conn, buf[:2]); err != nil {
-		return nil, errors.New("proxy: failed to read port from SOCKS5 proxy at " + s.addr + ": " + err.Error())
+		return errors.New("proxy: failed to read port from SOCKS5 proxy at " + s.addr + ": " + err.Error())
 	}
 
-	closeConn = nil
-	return conn, nil
+	return nil
 }
diff --git a/components/engine/vendor/golang.org/x/net/trace/trace.go b/components/engine/vendor/golang.org/x/net/trace/trace.go
index 64f56a3736..3d9b646111 100644
--- a/components/engine/vendor/golang.org/x/net/trace/trace.go
+++ b/components/engine/vendor/golang.org/x/net/trace/trace.go
@@ -77,7 +77,6 @@ import (
 	"sync/atomic"
 	"time"
 
-	"golang.org/x/net/context"
 	"golang.org/x/net/internal/timeseries"
 )
 
@@ -271,18 +270,6 @@ type contextKeyT string
 
 var contextKey = contextKeyT("golang.org/x/net/trace.Trace")
 
-// NewContext returns a copy of the parent context
-// and associates it with a Trace.
-func NewContext(ctx context.Context, tr Trace) context.Context {
-	return context.WithValue(ctx, contextKey, tr)
-}
-
-// FromContext returns the Trace bound to the context, if any.
-func FromContext(ctx context.Context) (tr Trace, ok bool) {
-	tr, ok = ctx.Value(contextKey).(Trace)
-	return
-}
-
 // Trace represents an active request.
 type Trace interface {
 	// LazyLog adds x to the event log. It will be evaluated each time the
diff --git a/components/engine/vendor/golang.org/x/net/trace/trace_go16.go b/components/engine/vendor/golang.org/x/net/trace/trace_go16.go
new file mode 100644
index 0000000000..d608191185
--- /dev/null
+++ b/components/engine/vendor/golang.org/x/net/trace/trace_go16.go
@@ -0,0 +1,21 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !go1.7
+
+package trace
+
+import "golang.org/x/net/context"
+
+// NewContext returns a copy of the parent context
+// and associates it with a Trace.
+func NewContext(ctx context.Context, tr Trace) context.Context {
+	return context.WithValue(ctx, contextKey, tr)
+}
+
+// FromContext returns the Trace bound to the context, if any.
+func FromContext(ctx context.Context) (tr Trace, ok bool) {
+	tr, ok = ctx.Value(contextKey).(Trace)
+	return
+}
diff --git a/components/engine/vendor/golang.org/x/net/trace/trace_go17.go b/components/engine/vendor/golang.org/x/net/trace/trace_go17.go
new file mode 100644
index 0000000000..df6e1fba7c
--- /dev/null
+++ b/components/engine/vendor/golang.org/x/net/trace/trace_go17.go
@@ -0,0 +1,21 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build go1.7
+
+package trace
+
+import "context"
+
+// NewContext returns a copy of the parent context
+// and associates it with a Trace.
+func NewContext(ctx context.Context, tr Trace) context.Context {
+	return context.WithValue(ctx, contextKey, tr)
+}
+
+// FromContext returns the Trace bound to the context, if any.
+func FromContext(ctx context.Context) (tr Trace, ok bool) {
+	tr, ok = ctx.Value(contextKey).(Trace)
+	return
+}
diff --git a/components/engine/vendor/golang.org/x/sync/errgroup/errgroup.go b/components/engine/vendor/golang.org/x/sync/errgroup/errgroup.go
new file mode 100644
index 0000000000..533438d91c
--- /dev/null
+++ b/components/engine/vendor/golang.org/x/sync/errgroup/errgroup.go
@@ -0,0 +1,67 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package errgroup provides synchronization, error propagation, and Context
+// cancelation for groups of goroutines working on subtasks of a common task.
+package errgroup
+
+import (
+	"sync"
+
+	"golang.org/x/net/context"
+)
+
+// A Group is a collection of goroutines working on subtasks that are part of
+// the same overall task.
+//
+// A zero Group is valid and does not cancel on error.
+type Group struct {
+	cancel func()
+
+	wg sync.WaitGroup
+
+	errOnce sync.Once
+	err     error
+}
+
+// WithContext returns a new Group and an associated Context derived from ctx.
+//
+// The derived Context is canceled the first time a function passed to Go
+// returns a non-nil error or the first time Wait returns, whichever occurs
+// first.
+func WithContext(ctx context.Context) (*Group, context.Context) {
+	ctx, cancel := context.WithCancel(ctx)
+	return &Group{cancel: cancel}, ctx
+}
+
+// Wait blocks until all function calls from the Go method have returned, then
+// returns the first non-nil error (if any) from them.
+func (g *Group) Wait() error {
+	g.wg.Wait()
+	if g.cancel != nil {
+		g.cancel()
+	}
+	return g.err
+}
+
+// Go calls the given function in a new goroutine.
+//
+// The first call to return a non-nil error cancels the group; its error will be
+// returned by Wait.
+func (g *Group) Go(f func() error) {
+	g.wg.Add(1)
+
+	go func() {
+		defer g.wg.Done()
+
+		if err := f(); err != nil {
+			g.errOnce.Do(func() {
+				g.err = err
+				if g.cancel != nil {
+					g.cancel()
+				}
+			})
+		}
+	}()
+}
diff --git a/components/engine/vendor/golang.org/x/sync/singleflight/singleflight.go b/components/engine/vendor/golang.org/x/sync/singleflight/singleflight.go
new file mode 100644
index 0000000000..9a4f8d59e0
--- /dev/null
+++ b/components/engine/vendor/golang.org/x/sync/singleflight/singleflight.go
@@ -0,0 +1,111 @@
+// Copyright 2013 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package singleflight provides a duplicate function call suppression
+// mechanism.
+package singleflight // import "golang.org/x/sync/singleflight"
+
+import "sync"
+
+// call is an in-flight or completed singleflight.Do call
+type call struct {
+	wg sync.WaitGroup
+
+	// These fields are written once before the WaitGroup is done
+	// and are only read after the WaitGroup is done.
+	val interface{}
+	err error
+
+	// These fields are read and written with the singleflight
+	// mutex held before the WaitGroup is done, and are read but
+	// not written after the WaitGroup is done.
+	dups  int
+	chans []chan<- Result
+}
+
+// Group represents a class of work and forms a namespace in
+// which units of work can be executed with duplicate suppression.
+type Group struct {
+	mu sync.Mutex       // protects m
+	m  map[string]*call // lazily initialized
+}
+
+// Result holds the results of Do, so they can be passed
+// on a channel.
+type Result struct {
+	Val    interface{}
+	Err    error
+	Shared bool
+}
+
+// Do executes and returns the results of the given function, making
+// sure that only one execution is in-flight for a given key at a
+// time. If a duplicate comes in, the duplicate caller waits for the
+// original to complete and receives the same results.
+// The return value shared indicates whether v was given to multiple callers.
+func (g *Group) Do(key string, fn func() (interface{}, error)) (v interface{}, err error, shared bool) {
+	g.mu.Lock()
+	if g.m == nil {
+		g.m = make(map[string]*call)
+	}
+	if c, ok := g.m[key]; ok {
+		c.dups++
+		g.mu.Unlock()
+		c.wg.Wait()
+		return c.val, c.err, true
+	}
+	c := new(call)
+	c.wg.Add(1)
+	g.m[key] = c
+	g.mu.Unlock()
+
+	g.doCall(c, key, fn)
+	return c.val, c.err, c.dups > 0
+}
+
+// DoChan is like Do but returns a channel that will receive the
+// results when they are ready.
+func (g *Group) DoChan(key string, fn func() (interface{}, error)) <-chan Result {
+	ch := make(chan Result, 1)
+	g.mu.Lock()
+	if g.m == nil {
+		g.m = make(map[string]*call)
+	}
+	if c, ok := g.m[key]; ok {
+		c.dups++
+		c.chans = append(c.chans, ch)
+		g.mu.Unlock()
+		return ch
+	}
+	c := &call{chans: []chan<- Result{ch}}
+	c.wg.Add(1)
+	g.m[key] = c
+	g.mu.Unlock()
+
+	go g.doCall(c, key, fn)
+
+	return ch
+}
+
+// doCall handles the single call for a key.
+func (g *Group) doCall(c *call, key string, fn func() (interface{}, error)) {
+	c.val, c.err = fn()
+	c.wg.Done()
+
+	g.mu.Lock()
+	delete(g.m, key)
+	for _, ch := range c.chans {
+		ch <- Result{c.val, c.err, c.dups > 0}
+	}
+	g.mu.Unlock()
+}
+
+// Forget tells the singleflight to forget about a key.  Future calls
+// to Do for this key will call the function rather than waiting for
+// an earlier call to complete.
+func (g *Group) Forget(key string) {
+	g.mu.Lock()
+	delete(g.m, key)
+	g.mu.Unlock()
+}
diff --git a/components/engine/vendor/google.golang.org/genproto/googleapis/api/distribution/distribution.pb.go b/components/engine/vendor/google.golang.org/genproto/googleapis/api/distribution/distribution.pb.go
new file mode 100644
index 0000000000..1ff5823f8c
--- /dev/null
+++ b/components/engine/vendor/google.golang.org/genproto/googleapis/api/distribution/distribution.pb.go
@@ -0,0 +1,507 @@
+// Code generated by protoc-gen-go.
+// source: google/api/distribution.proto
+// DO NOT EDIT!
+
+/*
+Package distribution is a generated protocol buffer package.
+
+It is generated from these files:
+	google/api/distribution.proto
+
+It has these top-level messages:
+	Distribution
+*/
+package distribution
+
+import proto "github.com/golang/protobuf/proto"
+import fmt "fmt"
+import math "math"
+import _ "google.golang.org/genproto/googleapis/api/annotations"
+import _ "github.com/golang/protobuf/ptypes/any"
+import _ "github.com/golang/protobuf/ptypes/timestamp"
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
+
+// Distribution contains summary statistics for a population of values and,
+// optionally, a histogram representing the distribution of those values across
+// a specified set of histogram buckets.
+//
+// The summary statistics are the count, mean, sum of the squared deviation from
+// the mean, the minimum, and the maximum of the set of population of values.
+//
+// The histogram is based on a sequence of buckets and gives a count of values
+// that fall into each bucket.  The boundaries of the buckets are given either
+// explicitly or by specifying parameters for a method of computing them
+// (buckets of fixed width or buckets of exponentially increasing width).
+//
+// Although it is not forbidden, it is generally a bad idea to include
+// non-finite values (infinities or NaNs) in the population of values, as this
+// will render the `mean` and `sum_of_squared_deviation` fields meaningless.
+type Distribution struct {
+	// The number of values in the population. Must be non-negative.
+	Count int64 `protobuf:"varint,1,opt,name=count" json:"count,omitempty"`
+	// The arithmetic mean of the values in the population. If `count` is zero
+	// then this field must be zero.
+	Mean float64 `protobuf:"fixed64,2,opt,name=mean" json:"mean,omitempty"`
+	// The sum of squared deviations from the mean of the values in the
+	// population.  For values x_i this is:
+	//
+	//     Sum[i=1..n]((x_i - mean)^2)
+	//
+	// Knuth, "The Art of Computer Programming", Vol. 2, page 323, 3rd edition
+	// describes Welford's method for accumulating this sum in one pass.
+	//
+	// If `count` is zero then this field must be zero.
+	SumOfSquaredDeviation float64 `protobuf:"fixed64,3,opt,name=sum_of_squared_deviation,json=sumOfSquaredDeviation" json:"sum_of_squared_deviation,omitempty"`
+	// If specified, contains the range of the population values. The field
+	// must not be present if the `count` is zero.
+	Range *Distribution_Range `protobuf:"bytes,4,opt,name=range" json:"range,omitempty"`
+	// Defines the histogram bucket boundaries.
+	BucketOptions *Distribution_BucketOptions `protobuf:"bytes,6,opt,name=bucket_options,json=bucketOptions" json:"bucket_options,omitempty"`
+	// If `bucket_options` is given, then the sum of the values in `bucket_counts`
+	// must equal the value in `count`.  If `bucket_options` is not given, no
+	// `bucket_counts` fields may be given.
+	//
+	// Bucket counts are given in order under the numbering scheme described
+	// above (the underflow bucket has number 0; the finite buckets, if any,
+	// have numbers 1 through N-2; the overflow bucket has number N-1).
+	//
+	// The size of `bucket_counts` must be no greater than N as defined in
+	// `bucket_options`.
+	//
+	// Any suffix of trailing zero bucket_count fields may be omitted.
+	BucketCounts []int64 `protobuf:"varint,7,rep,packed,name=bucket_counts,json=bucketCounts" json:"bucket_counts,omitempty"`
+}
+
+func (m *Distribution) Reset()                    { *m = Distribution{} }
+func (m *Distribution) String() string            { return proto.CompactTextString(m) }
+func (*Distribution) ProtoMessage()               {}
+func (*Distribution) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
+
+func (m *Distribution) GetCount() int64 {
+	if m != nil {
+		return m.Count
+	}
+	return 0
+}
+
+func (m *Distribution) GetMean() float64 {
+	if m != nil {
+		return m.Mean
+	}
+	return 0
+}
+
+func (m *Distribution) GetSumOfSquaredDeviation() float64 {
+	if m != nil {
+		return m.SumOfSquaredDeviation
+	}
+	return 0
+}
+
+func (m *Distribution) GetRange() *Distribution_Range {
+	if m != nil {
+		return m.Range
+	}
+	return nil
+}
+
+func (m *Distribution) GetBucketOptions() *Distribution_BucketOptions {
+	if m != nil {
+		return m.BucketOptions
+	}
+	return nil
+}
+
+func (m *Distribution) GetBucketCounts() []int64 {
+	if m != nil {
+		return m.BucketCounts
+	}
+	return nil
+}
+
+// The range of the population values.
+type Distribution_Range struct {
+	// The minimum of the population values.
+	Min float64 `protobuf:"fixed64,1,opt,name=min" json:"min,omitempty"`
+	// The maximum of the population values.
+	Max float64 `protobuf:"fixed64,2,opt,name=max" json:"max,omitempty"`
+}
+
+func (m *Distribution_Range) Reset()                    { *m = Distribution_Range{} }
+func (m *Distribution_Range) String() string            { return proto.CompactTextString(m) }
+func (*Distribution_Range) ProtoMessage()               {}
+func (*Distribution_Range) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0, 0} }
+
+func (m *Distribution_Range) GetMin() float64 {
+	if m != nil {
+		return m.Min
+	}
+	return 0
+}
+
+func (m *Distribution_Range) GetMax() float64 {
+	if m != nil {
+		return m.Max
+	}
+	return 0
+}
+
+// A Distribution may optionally contain a histogram of the values in the
+// population.  The histogram is given in `bucket_counts` as counts of values
+// that fall into one of a sequence of non-overlapping buckets.  The sequence
+// of buckets is described by `bucket_options`.
+//
+// A bucket specifies an inclusive lower bound and exclusive upper bound for
+// the values that are counted for that bucket.  The upper bound of a bucket
+// is strictly greater than the lower bound.
+//
+// The sequence of N buckets for a Distribution consists of an underflow
+// bucket (number 0), zero or more finite buckets (number 1 through N - 2) and
+// an overflow bucket (number N - 1).  The buckets are contiguous:  the lower
+// bound of bucket i (i > 0) is the same as the upper bound of bucket i - 1.
+// The buckets span the whole range of finite values: lower bound of the
+// underflow bucket is -infinity and the upper bound of the overflow bucket is
+// +infinity.  The finite buckets are so-called because both bounds are
+// finite.
+//
+// `BucketOptions` describes bucket boundaries in one of three ways.  Two
+// describe the boundaries by giving parameters for a formula to generate
+// boundaries and one gives the bucket boundaries explicitly.
+//
+// If `bucket_boundaries` is not given, then no `bucket_counts` may be given.
+type Distribution_BucketOptions struct {
+	// Exactly one of these three fields must be set.
+	//
+	// Types that are valid to be assigned to Options:
+	//	*Distribution_BucketOptions_LinearBuckets
+	//	*Distribution_BucketOptions_ExponentialBuckets
+	//	*Distribution_BucketOptions_ExplicitBuckets
+	Options isDistribution_BucketOptions_Options `protobuf_oneof:"options"`
+}
+
+func (m *Distribution_BucketOptions) Reset()                    { *m = Distribution_BucketOptions{} }
+func (m *Distribution_BucketOptions) String() string            { return proto.CompactTextString(m) }
+func (*Distribution_BucketOptions) ProtoMessage()               {}
+func (*Distribution_BucketOptions) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0, 1} }
+
+type isDistribution_BucketOptions_Options interface {
+	isDistribution_BucketOptions_Options()
+}
+
+type Distribution_BucketOptions_LinearBuckets struct {
+	LinearBuckets *Distribution_BucketOptions_Linear `protobuf:"bytes,1,opt,name=linear_buckets,json=linearBuckets,oneof"`
+}
+type Distribution_BucketOptions_ExponentialBuckets struct {
+	ExponentialBuckets *Distribution_BucketOptions_Exponential `protobuf:"bytes,2,opt,name=exponential_buckets,json=exponentialBuckets,oneof"`
+}
+type Distribution_BucketOptions_ExplicitBuckets struct {
+	ExplicitBuckets *Distribution_BucketOptions_Explicit `protobuf:"bytes,3,opt,name=explicit_buckets,json=explicitBuckets,oneof"`
+}
+
+func (*Distribution_BucketOptions_LinearBuckets) isDistribution_BucketOptions_Options()      {}
+func (*Distribution_BucketOptions_ExponentialBuckets) isDistribution_BucketOptions_Options() {}
+func (*Distribution_BucketOptions_ExplicitBuckets) isDistribution_BucketOptions_Options()    {}
+
+func (m *Distribution_BucketOptions) GetOptions() isDistribution_BucketOptions_Options {
+	if m != nil {
+		return m.Options
+	}
+	return nil
+}
+
+func (m *Distribution_BucketOptions) GetLinearBuckets() *Distribution_BucketOptions_Linear {
+	if x, ok := m.GetOptions().(*Distribution_BucketOptions_LinearBuckets); ok {
+		return x.LinearBuckets
+	}
+	return nil
+}
+
+func (m *Distribution_BucketOptions) GetExponentialBuckets() *Distribution_BucketOptions_Exponential {
+	if x, ok := m.GetOptions().(*Distribution_BucketOptions_ExponentialBuckets); ok {
+		return x.ExponentialBuckets
+	}
+	return nil
+}
+
+func (m *Distribution_BucketOptions) GetExplicitBuckets() *Distribution_BucketOptions_Explicit {
+	if x, ok := m.GetOptions().(*Distribution_BucketOptions_ExplicitBuckets); ok {
+		return x.ExplicitBuckets
+	}
+	return nil
+}
+
+// XXX_OneofFuncs is for the internal use of the proto package.
+func (*Distribution_BucketOptions) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
+	return _Distribution_BucketOptions_OneofMarshaler, _Distribution_BucketOptions_OneofUnmarshaler, _Distribution_BucketOptions_OneofSizer, []interface{}{
+		(*Distribution_BucketOptions_LinearBuckets)(nil),
+		(*Distribution_BucketOptions_ExponentialBuckets)(nil),
+		(*Distribution_BucketOptions_ExplicitBuckets)(nil),
+	}
+}
+
+func _Distribution_BucketOptions_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
+	m := msg.(*Distribution_BucketOptions)
+	// options
+	switch x := m.Options.(type) {
+	case *Distribution_BucketOptions_LinearBuckets:
+		b.EncodeVarint(1<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.LinearBuckets); err != nil {
+			return err
+		}
+	case *Distribution_BucketOptions_ExponentialBuckets:
+		b.EncodeVarint(2<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.ExponentialBuckets); err != nil {
+			return err
+		}
+	case *Distribution_BucketOptions_ExplicitBuckets:
+		b.EncodeVarint(3<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.ExplicitBuckets); err != nil {
+			return err
+		}
+	case nil:
+	default:
+		return fmt.Errorf("Distribution_BucketOptions.Options has unexpected type %T", x)
+	}
+	return nil
+}
+
+func _Distribution_BucketOptions_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
+	m := msg.(*Distribution_BucketOptions)
+	switch tag {
+	case 1: // options.linear_buckets
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(Distribution_BucketOptions_Linear)
+		err := b.DecodeMessage(msg)
+		m.Options = &Distribution_BucketOptions_LinearBuckets{msg}
+		return true, err
+	case 2: // options.exponential_buckets
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(Distribution_BucketOptions_Exponential)
+		err := b.DecodeMessage(msg)
+		m.Options = &Distribution_BucketOptions_ExponentialBuckets{msg}
+		return true, err
+	case 3: // options.explicit_buckets
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(Distribution_BucketOptions_Explicit)
+		err := b.DecodeMessage(msg)
+		m.Options = &Distribution_BucketOptions_ExplicitBuckets{msg}
+		return true, err
+	default:
+		return false, nil
+	}
+}
+
+func _Distribution_BucketOptions_OneofSizer(msg proto.Message) (n int) {
+	m := msg.(*Distribution_BucketOptions)
+	// options
+	switch x := m.Options.(type) {
+	case *Distribution_BucketOptions_LinearBuckets:
+		s := proto.Size(x.LinearBuckets)
+		n += proto.SizeVarint(1<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *Distribution_BucketOptions_ExponentialBuckets:
+		s := proto.Size(x.ExponentialBuckets)
+		n += proto.SizeVarint(2<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *Distribution_BucketOptions_ExplicitBuckets:
+		s := proto.Size(x.ExplicitBuckets)
+		n += proto.SizeVarint(3<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case nil:
+	default:
+		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
+	}
+	return n
+}
+
+// Specify a sequence of buckets that all have the same width (except
+// overflow and underflow).  Each bucket represents a constant absolute
+// uncertainty on the specific value in the bucket.
+//
+// Defines `num_finite_buckets + 2` (= N) buckets with these boundaries for
+// bucket `i`:
+//
+//    Upper bound (0 <= i < N-1):     offset + (width * i).
+//    Lower bound (1 <= i < N):       offset + (width * (i - 1)).
+type Distribution_BucketOptions_Linear struct {
+	// Must be greater than 0.
+	NumFiniteBuckets int32 `protobuf:"varint,1,opt,name=num_finite_buckets,json=numFiniteBuckets" json:"num_finite_buckets,omitempty"`
+	// Must be greater than 0.
+	Width float64 `protobuf:"fixed64,2,opt,name=width" json:"width,omitempty"`
+	// Lower bound of the first bucket.
+	Offset float64 `protobuf:"fixed64,3,opt,name=offset" json:"offset,omitempty"`
+}
+
+func (m *Distribution_BucketOptions_Linear) Reset()         { *m = Distribution_BucketOptions_Linear{} }
+func (m *Distribution_BucketOptions_Linear) String() string { return proto.CompactTextString(m) }
+func (*Distribution_BucketOptions_Linear) ProtoMessage()    {}
+func (*Distribution_BucketOptions_Linear) Descriptor() ([]byte, []int) {
+	return fileDescriptor0, []int{0, 1, 0}
+}
+
+func (m *Distribution_BucketOptions_Linear) GetNumFiniteBuckets() int32 {
+	if m != nil {
+		return m.NumFiniteBuckets
+	}
+	return 0
+}
+
+func (m *Distribution_BucketOptions_Linear) GetWidth() float64 {
+	if m != nil {
+		return m.Width
+	}
+	return 0
+}
+
+func (m *Distribution_BucketOptions_Linear) GetOffset() float64 {
+	if m != nil {
+		return m.Offset
+	}
+	return 0
+}
+
+// Specify a sequence of buckets that have a width that is proportional to
+// the value of the lower bound.  Each bucket represents a constant relative
+// uncertainty on a specific value in the bucket.
+//
+// Defines `num_finite_buckets + 2` (= N) buckets with these boundaries for
+// bucket i:
+//
+//    Upper bound (0 <= i < N-1):     scale * (growth_factor ^ i).
+//    Lower bound (1 <= i < N):       scale * (growth_factor ^ (i - 1)).
+type Distribution_BucketOptions_Exponential struct {
+	// Must be greater than 0.
+	NumFiniteBuckets int32 `protobuf:"varint,1,opt,name=num_finite_buckets,json=numFiniteBuckets" json:"num_finite_buckets,omitempty"`
+	// Must be greater than 1.
+	GrowthFactor float64 `protobuf:"fixed64,2,opt,name=growth_factor,json=growthFactor" json:"growth_factor,omitempty"`
+	// Must be greater than 0.
+	Scale float64 `protobuf:"fixed64,3,opt,name=scale" json:"scale,omitempty"`
+}
+
+func (m *Distribution_BucketOptions_Exponential) Reset() {
+	*m = Distribution_BucketOptions_Exponential{}
+}
+func (m *Distribution_BucketOptions_Exponential) String() string { return proto.CompactTextString(m) }
+func (*Distribution_BucketOptions_Exponential) ProtoMessage()    {}
+func (*Distribution_BucketOptions_Exponential) Descriptor() ([]byte, []int) {
+	return fileDescriptor0, []int{0, 1, 1}
+}
+
+func (m *Distribution_BucketOptions_Exponential) GetNumFiniteBuckets() int32 {
+	if m != nil {
+		return m.NumFiniteBuckets
+	}
+	return 0
+}
+
+func (m *Distribution_BucketOptions_Exponential) GetGrowthFactor() float64 {
+	if m != nil {
+		return m.GrowthFactor
+	}
+	return 0
+}
+
+func (m *Distribution_BucketOptions_Exponential) GetScale() float64 {
+	if m != nil {
+		return m.Scale
+	}
+	return 0
+}
+
+// A set of buckets with arbitrary widths.
+//
+// Defines `size(bounds) + 1` (= N) buckets with these boundaries for
+// bucket i:
+//
+//    Upper bound (0 <= i < N-1):     bounds[i]
+//    Lower bound (1 <= i < N);       bounds[i - 1]
+//
+// There must be at least one element in `bounds`.  If `bounds` has only one
+// element, there are no finite buckets, and that single element is the
+// common boundary of the overflow and underflow buckets.
+type Distribution_BucketOptions_Explicit struct {
+	// The values must be monotonically increasing.
+	Bounds []float64 `protobuf:"fixed64,1,rep,packed,name=bounds" json:"bounds,omitempty"`
+}
+
+func (m *Distribution_BucketOptions_Explicit) Reset()         { *m = Distribution_BucketOptions_Explicit{} }
+func (m *Distribution_BucketOptions_Explicit) String() string { return proto.CompactTextString(m) }
+func (*Distribution_BucketOptions_Explicit) ProtoMessage()    {}
+func (*Distribution_BucketOptions_Explicit) Descriptor() ([]byte, []int) {
+	return fileDescriptor0, []int{0, 1, 2}
+}
+
+func (m *Distribution_BucketOptions_Explicit) GetBounds() []float64 {
+	if m != nil {
+		return m.Bounds
+	}
+	return nil
+}
+
+func init() {
+	proto.RegisterType((*Distribution)(nil), "google.api.Distribution")
+	proto.RegisterType((*Distribution_Range)(nil), "google.api.Distribution.Range")
+	proto.RegisterType((*Distribution_BucketOptions)(nil), "google.api.Distribution.BucketOptions")
+	proto.RegisterType((*Distribution_BucketOptions_Linear)(nil), "google.api.Distribution.BucketOptions.Linear")
+	proto.RegisterType((*Distribution_BucketOptions_Exponential)(nil), "google.api.Distribution.BucketOptions.Exponential")
+	proto.RegisterType((*Distribution_BucketOptions_Explicit)(nil), "google.api.Distribution.BucketOptions.Explicit")
+}
+
+func init() { proto.RegisterFile("google/api/distribution.proto", fileDescriptor0) }
+
+var fileDescriptor0 = []byte{
+	// 544 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x54, 0x5d, 0x6f, 0xd3, 0x30,
+	0x14, 0x5d, 0x96, 0xb5, 0x85, 0xdb, 0x0f, 0x8a, 0x19, 0x28, 0x44, 0x7c, 0x54, 0x9b, 0x84, 0x2a,
+	0x01, 0x89, 0x54, 0x90, 0x78, 0xe0, 0xad, 0x1b, 0x53, 0x1f, 0x40, 0x9b, 0x8c, 0xc4, 0x03, 0x42,
+	0x8a, 0x9c, 0xc4, 0xc9, 0x0c, 0x89, 0x1d, 0x62, 0x67, 0x2b, 0xef, 0xfc, 0x29, 0xfe, 0x1d, 0x8a,
+	0xed, 0x6e, 0x19, 0x08, 0xa9, 0xbc, 0xf9, 0xde, 0x73, 0x7c, 0xce, 0xb9, 0x57, 0x71, 0xe0, 0x71,
+	0x2e, 0x44, 0x5e, 0xd0, 0x90, 0x54, 0x2c, 0x4c, 0x99, 0x54, 0x35, 0x8b, 0x1b, 0xc5, 0x04, 0x0f,
+	0xaa, 0x5a, 0x28, 0x81, 0xc0, 0xc0, 0x01, 0xa9, 0x98, 0xff, 0xa8, 0x43, 0x25, 0x9c, 0x0b, 0x45,
+	0x5a, 0xa2, 0x34, 0x4c, 0xff, 0xa1, 0x45, 0x75, 0x15, 0x37, 0x59, 0x48, 0xf8, 0x0f, 0x0b, 0x3d,
+	0xfd, 0x13, 0x52, 0xac, 0xa4, 0x52, 0x91, 0xb2, 0x32, 0x84, 0x83, 0x9f, 0x03, 0x18, 0x1d, 0x77,
+	0xcc, 0xd1, 0x3e, 0xf4, 0x12, 0xd1, 0x70, 0xe5, 0x39, 0x33, 0x67, 0xee, 0x62, 0x53, 0x20, 0x04,
+	0x7b, 0x25, 0x25, 0xdc, 0xdb, 0x9d, 0x39, 0x73, 0x07, 0xeb, 0x33, 0x7a, 0x03, 0x9e, 0x6c, 0xca,
+	0x48, 0x64, 0x91, 0xfc, 0xde, 0x90, 0x9a, 0xa6, 0x51, 0x4a, 0x2f, 0x98, 0x4e, 0xe6, 0xb9, 0x9a,
+	0x77, 0x5f, 0x36, 0xe5, 0x69, 0xf6, 0xd1, 0xa0, 0xc7, 0x1b, 0x10, 0xbd, 0x86, 0x5e, 0x4d, 0x78,
+	0x4e, 0xbd, 0xbd, 0x99, 0x33, 0x1f, 0x2e, 0x9e, 0x04, 0xd7, 0x93, 0x06, 0xdd, 0x2c, 0x01, 0x6e,
+	0x59, 0xd8, 0x90, 0xd1, 0x07, 0x98, 0xc4, 0x4d, 0xf2, 0x8d, 0xaa, 0x48, 0x54, 0x7a, 0x7a, 0xaf,
+	0xaf, 0xaf, 0x3f, 0xfb, 0xe7, 0xf5, 0xa5, 0xa6, 0x9f, 0x1a, 0x36, 0x1e, 0xc7, 0xdd, 0x12, 0x1d,
+	0x82, 0x6d, 0x44, 0x7a, 0x42, 0xe9, 0x0d, 0x66, 0xee, 0xdc, 0xc5, 0x23, 0xd3, 0x3c, 0xd2, 0x3d,
+	0xff, 0x39, 0xf4, 0x74, 0x06, 0x34, 0x05, 0xb7, 0x64, 0x5c, 0xef, 0xc4, 0xc1, 0xed, 0x51, 0x77,
+	0xc8, 0xda, 0x2e, 0xa4, 0x3d, 0xfa, 0xbf, 0xf6, 0x60, 0x7c, 0xc3, 0x12, 0x7d, 0x82, 0x49, 0xc1,
+	0x38, 0x25, 0x75, 0x64, 0x54, 0xa5, 0x16, 0x18, 0x2e, 0x5e, 0x6e, 0x17, 0x39, 0x78, 0xaf, 0x2f,
+	0xaf, 0x76, 0xf0, 0xd8, 0xc8, 0x18, 0x54, 0x22, 0x0a, 0xf7, 0xe8, 0xba, 0x12, 0x9c, 0x72, 0xc5,
+	0x48, 0x71, 0x25, 0xbe, 0xab, 0xc5, 0x17, 0x5b, 0x8a, 0xbf, 0xbb, 0x56, 0x58, 0xed, 0x60, 0xd4,
+	0x11, 0xdc, 0xd8, 0x7c, 0x81, 0x29, 0x5d, 0x57, 0x05, 0x4b, 0x98, 0xba, 0xf2, 0x70, 0xb5, 0x47,
+	0xb8, 0xbd, 0x87, 0xbe, 0xbe, 0xda, 0xc1, 0x77, 0x36, 0x52, 0x56, 0xdd, 0x4f, 0xa1, 0x6f, 0xe6,
+	0x43, 0x2f, 0x00, 0xf1, 0xa6, 0x8c, 0x32, 0xc6, 0x99, 0xa2, 0x37, 0x56, 0xd5, 0xc3, 0x53, 0xde,
+	0x94, 0x27, 0x1a, 0xd8, 0xa4, 0xda, 0x87, 0xde, 0x25, 0x4b, 0xd5, 0xb9, 0x5d, 0xbd, 0x29, 0xd0,
+	0x03, 0xe8, 0x8b, 0x2c, 0x93, 0x54, 0xd9, 0x4f, 0xcf, 0x56, 0xfe, 0x05, 0x0c, 0x3b, 0x83, 0xfe,
+	0xa7, 0xd5, 0x21, 0x8c, 0xf3, 0x5a, 0x5c, 0xaa, 0xf3, 0x28, 0x23, 0x89, 0x12, 0xb5, 0xb5, 0x1c,
+	0x99, 0xe6, 0x89, 0xee, 0xb5, 0x79, 0x64, 0x42, 0x0a, 0x6a, 0x8d, 0x4d, 0xe1, 0x1f, 0xc0, 0xad,
+	0xcd, 0xf0, 0x6d, 0xb6, 0x58, 0x34, 0x3c, 0x6d, 0x8d, 0xdc, 0x36, 0x9b, 0xa9, 0x96, 0xb7, 0x61,
+	0x60, 0x3f, 0xe5, 0xe5, 0x57, 0x98, 0x24, 0xa2, 0xec, 0x6c, 0x75, 0x79, 0xb7, 0xbb, 0xd6, 0xb3,
+	0xf6, 0xad, 0x9e, 0x39, 0x9f, 0x8f, 0x2c, 0x21, 0x17, 0x05, 0xe1, 0x79, 0x20, 0xea, 0x3c, 0xcc,
+	0x29, 0xd7, 0x2f, 0x39, 0x34, 0x10, 0xa9, 0x98, 0xfc, 0xeb, 0x8f, 0xf2, 0xb6, 0x5b, 0xc4, 0x7d,
+	0xcd, 0x7f, 0xf5, 0x3b, 0x00, 0x00, 0xff, 0xff, 0x88, 0x8e, 0xc5, 0x4b, 0x80, 0x04, 0x00, 0x00,
+}
diff --git a/components/engine/vendor/google.golang.org/genproto/googleapis/api/metric/metric.pb.go b/components/engine/vendor/google.golang.org/genproto/googleapis/api/metric/metric.pb.go
new file mode 100644
index 0000000000..738ff43e03
--- /dev/null
+++ b/components/engine/vendor/google.golang.org/genproto/googleapis/api/metric/metric.pb.go
@@ -0,0 +1,359 @@
+// Code generated by protoc-gen-go.
+// source: google/api/metric.proto
+// DO NOT EDIT!
+
+/*
+Package metric is a generated protocol buffer package.
+
+It is generated from these files:
+	google/api/metric.proto
+
+It has these top-level messages:
+	MetricDescriptor
+	Metric
+*/
+package metric
+
+import proto "github.com/golang/protobuf/proto"
+import fmt "fmt"
+import math "math"
+import google_api "google.golang.org/genproto/googleapis/api/label"
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
+
+// The kind of measurement. It describes how the data is reported.
+type MetricDescriptor_MetricKind int32
+
+const (
+	// Do not use this default value.
+	MetricDescriptor_METRIC_KIND_UNSPECIFIED MetricDescriptor_MetricKind = 0
+	// An instantaneous measurement of a value.
+	MetricDescriptor_GAUGE MetricDescriptor_MetricKind = 1
+	// The change in a value during a time interval.
+	MetricDescriptor_DELTA MetricDescriptor_MetricKind = 2
+	// A value accumulated over a time interval.  Cumulative
+	// measurements in a time series should have the same start time
+	// and increasing end times, until an event resets the cumulative
+	// value to zero and sets a new start time for the following
+	// points.
+	MetricDescriptor_CUMULATIVE MetricDescriptor_MetricKind = 3
+)
+
+var MetricDescriptor_MetricKind_name = map[int32]string{
+	0: "METRIC_KIND_UNSPECIFIED",
+	1: "GAUGE",
+	2: "DELTA",
+	3: "CUMULATIVE",
+}
+var MetricDescriptor_MetricKind_value = map[string]int32{
+	"METRIC_KIND_UNSPECIFIED": 0,
+	"GAUGE":                   1,
+	"DELTA":                   2,
+	"CUMULATIVE":              3,
+}
+
+func (x MetricDescriptor_MetricKind) String() string {
+	return proto.EnumName(MetricDescriptor_MetricKind_name, int32(x))
+}
+func (MetricDescriptor_MetricKind) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptor0, []int{0, 0}
+}
+
+// The value type of a metric.
+type MetricDescriptor_ValueType int32
+
+const (
+	// Do not use this default value.
+	MetricDescriptor_VALUE_TYPE_UNSPECIFIED MetricDescriptor_ValueType = 0
+	// The value is a boolean.
+	// This value type can be used only if the metric kind is `GAUGE`.
+	MetricDescriptor_BOOL MetricDescriptor_ValueType = 1
+	// The value is a signed 64-bit integer.
+	MetricDescriptor_INT64 MetricDescriptor_ValueType = 2
+	// The value is a double precision floating point number.
+	MetricDescriptor_DOUBLE MetricDescriptor_ValueType = 3
+	// The value is a text string.
+	// This value type can be used only if the metric kind is `GAUGE`.
+	MetricDescriptor_STRING MetricDescriptor_ValueType = 4
+	// The value is a [`Distribution`][google.api.Distribution].
+	MetricDescriptor_DISTRIBUTION MetricDescriptor_ValueType = 5
+	// The value is money.
+	MetricDescriptor_MONEY MetricDescriptor_ValueType = 6
+)
+
+var MetricDescriptor_ValueType_name = map[int32]string{
+	0: "VALUE_TYPE_UNSPECIFIED",
+	1: "BOOL",
+	2: "INT64",
+	3: "DOUBLE",
+	4: "STRING",
+	5: "DISTRIBUTION",
+	6: "MONEY",
+}
+var MetricDescriptor_ValueType_value = map[string]int32{
+	"VALUE_TYPE_UNSPECIFIED": 0,
+	"BOOL":         1,
+	"INT64":        2,
+	"DOUBLE":       3,
+	"STRING":       4,
+	"DISTRIBUTION": 5,
+	"MONEY":        6,
+}
+
+func (x MetricDescriptor_ValueType) String() string {
+	return proto.EnumName(MetricDescriptor_ValueType_name, int32(x))
+}
+func (MetricDescriptor_ValueType) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptor0, []int{0, 1}
+}
+
+// Defines a metric type and its schema. Once a metric descriptor is created,
+// deleting or altering it stops data collection and makes the metric type's
+// existing data unusable.
+type MetricDescriptor struct {
+	// The resource name of the metric descriptor. Depending on the
+	// implementation, the name typically includes: (1) the parent resource name
+	// that defines the scope of the metric type or of its data; and (2) the
+	// metric's URL-encoded type, which also appears in the `type` field of this
+	// descriptor. For example, following is the resource name of a custom
+	// metric within the GCP project `my-project-id`:
+	//
+	//     "projects/my-project-id/metricDescriptors/custom.googleapis.com%2Finvoice%2Fpaid%2Famount"
+	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+	// The metric type, including its DNS name prefix. The type is not
+	// URL-encoded.  All user-defined custom metric types have the DNS name
+	// `custom.googleapis.com`.  Metric types should use a natural hierarchical
+	// grouping. For example:
+	//
+	//     "custom.googleapis.com/invoice/paid/amount"
+	//     "appengine.googleapis.com/http/server/response_latencies"
+	Type string `protobuf:"bytes,8,opt,name=type" json:"type,omitempty"`
+	// The set of labels that can be used to describe a specific
+	// instance of this metric type. For example, the
+	// `appengine.googleapis.com/http/server/response_latencies` metric
+	// type has a label for the HTTP response code, `response_code`, so
+	// you can look at latencies for successful responses or just
+	// for responses that failed.
+	Labels []*google_api.LabelDescriptor `protobuf:"bytes,2,rep,name=labels" json:"labels,omitempty"`
+	// Whether the metric records instantaneous values, changes to a value, etc.
+	// Some combinations of `metric_kind` and `value_type` might not be supported.
+	MetricKind MetricDescriptor_MetricKind `protobuf:"varint,3,opt,name=metric_kind,json=metricKind,enum=google.api.MetricDescriptor_MetricKind" json:"metric_kind,omitempty"`
+	// Whether the measurement is an integer, a floating-point number, etc.
+	// Some combinations of `metric_kind` and `value_type` might not be supported.
+	ValueType MetricDescriptor_ValueType `protobuf:"varint,4,opt,name=value_type,json=valueType,enum=google.api.MetricDescriptor_ValueType" json:"value_type,omitempty"`
+	// The unit in which the metric value is reported. It is only applicable
+	// if the `value_type` is `INT64`, `DOUBLE`, or `DISTRIBUTION`. The
+	// supported units are a subset of [The Unified Code for Units of
+	// Measure](http://unitsofmeasure.org/ucum.html) standard:
+	//
+	// **Basic units (UNIT)**
+	//
+	// * `bit`   bit
+	// * `By`    byte
+	// * `s`     second
+	// * `min`   minute
+	// * `h`     hour
+	// * `d`     day
+	//
+	// **Prefixes (PREFIX)**
+	//
+	// * `k`     kilo    (10**3)
+	// * `M`     mega    (10**6)
+	// * `G`     giga    (10**9)
+	// * `T`     tera    (10**12)
+	// * `P`     peta    (10**15)
+	// * `E`     exa     (10**18)
+	// * `Z`     zetta   (10**21)
+	// * `Y`     yotta   (10**24)
+	// * `m`     milli   (10**-3)
+	// * `u`     micro   (10**-6)
+	// * `n`     nano    (10**-9)
+	// * `p`     pico    (10**-12)
+	// * `f`     femto   (10**-15)
+	// * `a`     atto    (10**-18)
+	// * `z`     zepto   (10**-21)
+	// * `y`     yocto   (10**-24)
+	// * `Ki`    kibi    (2**10)
+	// * `Mi`    mebi    (2**20)
+	// * `Gi`    gibi    (2**30)
+	// * `Ti`    tebi    (2**40)
+	//
+	// **Grammar**
+	//
+	// The grammar includes the dimensionless unit `1`, such as `1/s`.
+	//
+	// The grammar also includes these connectors:
+	//
+	// * `/`    division (as an infix operator, e.g. `1/s`).
+	// * `.`    multiplication (as an infix operator, e.g. `GBy.d`)
+	//
+	// The grammar for a unit is as follows:
+	//
+	//     Expression = Component { "." Component } { "/" Component } ;
+	//
+	//     Component = [ PREFIX ] UNIT [ Annotation ]
+	//               | Annotation
+	//               | "1"
+	//               ;
+	//
+	//     Annotation = "{" NAME "}" ;
+	//
+	// Notes:
+	//
+	// * `Annotation` is just a comment if it follows a `UNIT` and is
+	//    equivalent to `1` if it is used alone. For examples,
+	//    `{requests}/s == 1/s`, `By{transmitted}/s == By/s`.
+	// * `NAME` is a sequence of non-blank printable ASCII characters not
+	//    containing '{' or '}'.
+	Unit string `protobuf:"bytes,5,opt,name=unit" json:"unit,omitempty"`
+	// A detailed description of the metric, which can be used in documentation.
+	Description string `protobuf:"bytes,6,opt,name=description" json:"description,omitempty"`
+	// A concise name for the metric, which can be displayed in user interfaces.
+	// Use sentence case without an ending period, for example "Request count".
+	DisplayName string `protobuf:"bytes,7,opt,name=display_name,json=displayName" json:"display_name,omitempty"`
+}
+
+func (m *MetricDescriptor) Reset()                    { *m = MetricDescriptor{} }
+func (m *MetricDescriptor) String() string            { return proto.CompactTextString(m) }
+func (*MetricDescriptor) ProtoMessage()               {}
+func (*MetricDescriptor) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
+
+func (m *MetricDescriptor) GetName() string {
+	if m != nil {
+		return m.Name
+	}
+	return ""
+}
+
+func (m *MetricDescriptor) GetType() string {
+	if m != nil {
+		return m.Type
+	}
+	return ""
+}
+
+func (m *MetricDescriptor) GetLabels() []*google_api.LabelDescriptor {
+	if m != nil {
+		return m.Labels
+	}
+	return nil
+}
+
+func (m *MetricDescriptor) GetMetricKind() MetricDescriptor_MetricKind {
+	if m != nil {
+		return m.MetricKind
+	}
+	return MetricDescriptor_METRIC_KIND_UNSPECIFIED
+}
+
+func (m *MetricDescriptor) GetValueType() MetricDescriptor_ValueType {
+	if m != nil {
+		return m.ValueType
+	}
+	return MetricDescriptor_VALUE_TYPE_UNSPECIFIED
+}
+
+func (m *MetricDescriptor) GetUnit() string {
+	if m != nil {
+		return m.Unit
+	}
+	return ""
+}
+
+func (m *MetricDescriptor) GetDescription() string {
+	if m != nil {
+		return m.Description
+	}
+	return ""
+}
+
+func (m *MetricDescriptor) GetDisplayName() string {
+	if m != nil {
+		return m.DisplayName
+	}
+	return ""
+}
+
+// A specific metric, identified by specifying values for all of the
+// labels of a [`MetricDescriptor`][google.api.MetricDescriptor].
+type Metric struct {
+	// An existing metric type, see [google.api.MetricDescriptor][google.api.MetricDescriptor].
+	// For example, `custom.googleapis.com/invoice/paid/amount`.
+	Type string `protobuf:"bytes,3,opt,name=type" json:"type,omitempty"`
+	// The set of label values that uniquely identify this metric. All
+	// labels listed in the `MetricDescriptor` must be assigned values.
+	Labels map[string]string `protobuf:"bytes,2,rep,name=labels" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+}
+
+func (m *Metric) Reset()                    { *m = Metric{} }
+func (m *Metric) String() string            { return proto.CompactTextString(m) }
+func (*Metric) ProtoMessage()               {}
+func (*Metric) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{1} }
+
+func (m *Metric) GetType() string {
+	if m != nil {
+		return m.Type
+	}
+	return ""
+}
+
+func (m *Metric) GetLabels() map[string]string {
+	if m != nil {
+		return m.Labels
+	}
+	return nil
+}
+
+func init() {
+	proto.RegisterType((*MetricDescriptor)(nil), "google.api.MetricDescriptor")
+	proto.RegisterType((*Metric)(nil), "google.api.Metric")
+	proto.RegisterEnum("google.api.MetricDescriptor_MetricKind", MetricDescriptor_MetricKind_name, MetricDescriptor_MetricKind_value)
+	proto.RegisterEnum("google.api.MetricDescriptor_ValueType", MetricDescriptor_ValueType_name, MetricDescriptor_ValueType_value)
+}
+
+func init() { proto.RegisterFile("google/api/metric.proto", fileDescriptor0) }
+
+var fileDescriptor0 = []byte{
+	// 506 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x7c, 0x53, 0x4d, 0x6f, 0xda, 0x40,
+	0x10, 0xad, 0x3f, 0x70, 0xc3, 0x10, 0xa1, 0xd5, 0xaa, 0x4a, 0x2c, 0x22, 0x55, 0x94, 0x43, 0xcb,
+	0x09, 0xa4, 0xa4, 0x4a, 0xbf, 0x4e, 0x80, 0xb7, 0xd4, 0x8a, 0xb1, 0x91, 0x63, 0x23, 0xa5, 0x17,
+	0xcb, 0x81, 0x95, 0x65, 0xc5, 0xd8, 0xae, 0x71, 0x22, 0xf9, 0x57, 0xf4, 0x17, 0xf4, 0xd2, 0x5f,
+	0x5a, 0xed, 0xae, 0x03, 0x16, 0x95, 0x72, 0xe2, 0xed, 0x9b, 0x37, 0x6f, 0x67, 0x96, 0x67, 0x38,
+	0x8f, 0xb2, 0x2c, 0x4a, 0xe8, 0x38, 0xcc, 0xe3, 0xf1, 0x96, 0x96, 0x45, 0xbc, 0x1e, 0xe5, 0x45,
+	0x56, 0x66, 0x18, 0x44, 0x61, 0x14, 0xe6, 0x71, 0xef, 0xac, 0x21, 0x4a, 0xc2, 0x7b, 0x9a, 0x08,
+	0xcd, 0xe0, 0x8f, 0x0a, 0x68, 0xc1, 0x9b, 0x0c, 0xba, 0x5b, 0x17, 0x71, 0x5e, 0x66, 0x05, 0xc6,
+	0xa0, 0xa6, 0xe1, 0x96, 0xea, 0x52, 0x5f, 0x1a, 0xb6, 0x5d, 0x8e, 0x19, 0x57, 0x56, 0x39, 0xd5,
+	0x4f, 0x04, 0xc7, 0x30, 0xbe, 0x02, 0x8d, 0x7b, 0xed, 0x74, 0xb9, 0xaf, 0x0c, 0x3b, 0x97, 0x17,
+	0xa3, 0xc3, 0x8d, 0x23, 0x8b, 0x55, 0x0e, 0xa6, 0x6e, 0x2d, 0xc5, 0x3f, 0xa0, 0x23, 0xa6, 0x0c,
+	0x1e, 0xe2, 0x74, 0xa3, 0x2b, 0x7d, 0x69, 0xd8, 0xbd, 0xfc, 0xd0, 0xec, 0x3c, 0x9e, 0xa7, 0x26,
+	0x6e, 0xe2, 0x74, 0xe3, 0xc2, 0x76, 0x8f, 0x31, 0x01, 0x78, 0x0a, 0x93, 0x47, 0x1a, 0xf0, 0xc1,
+	0x54, 0x6e, 0xf4, 0xfe, 0x45, 0xa3, 0x15, 0x93, 0x7b, 0x55, 0x4e, 0xdd, 0xf6, 0xd3, 0x33, 0x64,
+	0x9b, 0x3d, 0xa6, 0x71, 0xa9, 0xb7, 0xc4, 0x66, 0x0c, 0xe3, 0x3e, 0x74, 0x36, 0x75, 0x5b, 0x9c,
+	0xa5, 0xba, 0xc6, 0x4b, 0x4d, 0x0a, 0xbf, 0x83, 0xd3, 0x4d, 0xbc, 0xcb, 0x93, 0xb0, 0x0a, 0xf8,
+	0x5b, 0xbd, 0xae, 0x25, 0x82, 0xb3, 0xc3, 0x2d, 0x1d, 0x38, 0x00, 0x87, 0xc9, 0xf1, 0x05, 0x9c,
+	0x2f, 0x88, 0xe7, 0x9a, 0xb3, 0xe0, 0xc6, 0xb4, 0x8d, 0xc0, 0xb7, 0x6f, 0x97, 0x64, 0x66, 0x7e,
+	0x37, 0x89, 0x81, 0x5e, 0xe1, 0x36, 0xb4, 0xe6, 0x13, 0x7f, 0x4e, 0x90, 0xc4, 0xa0, 0x41, 0x2c,
+	0x6f, 0x82, 0x64, 0xdc, 0x05, 0x98, 0xf9, 0x0b, 0xdf, 0x9a, 0x78, 0xe6, 0x8a, 0x20, 0x65, 0xf0,
+	0x0b, 0xda, 0xfb, 0x0d, 0x70, 0x0f, 0xce, 0x56, 0x13, 0xcb, 0x27, 0x81, 0x77, 0xb7, 0x24, 0x47,
+	0x76, 0x27, 0xa0, 0x4e, 0x1d, 0xc7, 0x12, 0x6e, 0xa6, 0xed, 0x5d, 0x7f, 0x44, 0x32, 0x06, 0xd0,
+	0x0c, 0xc7, 0x9f, 0x5a, 0x04, 0x29, 0x0c, 0xdf, 0x7a, 0xae, 0x69, 0xcf, 0x91, 0x8a, 0x11, 0x9c,
+	0x1a, 0x26, 0x3b, 0x4d, 0x7d, 0xcf, 0x74, 0x6c, 0xd4, 0x62, 0x4d, 0x0b, 0xc7, 0x26, 0x77, 0x48,
+	0x1b, 0xfc, 0x96, 0x40, 0x13, 0x4b, 0xec, 0x13, 0xa0, 0x34, 0x12, 0x70, 0x7d, 0x94, 0x80, 0xb7,
+	0xff, 0x3f, 0xbf, 0x08, 0xc2, 0x8e, 0xa4, 0x65, 0x51, 0x3d, 0x87, 0xa0, 0xf7, 0x05, 0x3a, 0x0d,
+	0x1a, 0x23, 0x50, 0x1e, 0x68, 0x55, 0xe7, 0x8d, 0x41, 0xfc, 0x06, 0x5a, 0xfc, 0x1f, 0xd2, 0x65,
+	0xce, 0x89, 0xc3, 0x57, 0xf9, 0xb3, 0x34, 0x0d, 0xa0, 0xbb, 0xce, 0xb6, 0x8d, 0x7b, 0xa6, 0x1d,
+	0x71, 0xd1, 0x92, 0x05, 0x7a, 0x29, 0xfd, 0xfc, 0x54, 0x97, 0xa2, 0x2c, 0x09, 0xd3, 0x68, 0x94,
+	0x15, 0xd1, 0x38, 0xa2, 0x29, 0x8f, 0xfb, 0x58, 0x94, 0xc2, 0x3c, 0xde, 0x35, 0x3e, 0x97, 0x6f,
+	0xe2, 0xe7, 0xaf, 0xac, 0xce, 0x27, 0x4b, 0xf3, 0x5e, 0xe3, 0xd2, 0xab, 0x7f, 0x01, 0x00, 0x00,
+	0xff, 0xff, 0x18, 0x04, 0x05, 0x82, 0x58, 0x03, 0x00, 0x00,
+}
diff --git a/components/engine/vendor/google.golang.org/genproto/googleapis/logging/v2/log_entry.pb.go b/components/engine/vendor/google.golang.org/genproto/googleapis/logging/v2/log_entry.pb.go
index be85190cd6..d81b52c4b8 100644
--- a/components/engine/vendor/google.golang.org/genproto/googleapis/logging/v2/log_entry.pb.go
+++ b/components/engine/vendor/google.golang.org/genproto/googleapis/logging/v2/log_entry.pb.go
@@ -18,6 +18,7 @@ It has these top-level messages:
 	DeleteLogRequest
 	WriteLogEntriesRequest
 	WriteLogEntriesResponse
+	WriteLogEntriesPartialErrors
 	ListLogEntriesRequest
 	ListLogEntriesResponse
 	ListMonitoredResourceDescriptorsRequest
@@ -69,6 +70,8 @@ type LogEntry struct {
 	//
 	//     "projects/[PROJECT_ID]/logs/[LOG_ID]"
 	//     "organizations/[ORGANIZATION_ID]/logs/[LOG_ID]"
+	//     "billingAccounts/[BILLING_ACCOUNT_ID]/logs/[LOG_ID]"
+	//     "folders/[FOLDER_ID]/logs/[LOG_ID]"
 	//
 	// `[LOG_ID]` must be URL-encoded within `log_name`. Example:
 	// `"organizations/1234567890/logs/cloudresourcemanager.googleapis.com%2Factivity"`.
@@ -95,16 +98,22 @@ type LogEntry struct {
 	//	*LogEntry_JsonPayload
 	Payload isLogEntry_Payload `protobuf_oneof:"payload"`
 	// Optional. The time the event described by the log entry occurred.  If
-	// omitted, Stackdriver Logging will use the time the log entry is received.
+	// omitted in a new log entry, Stackdriver Logging will insert the time the
+	// log entry is received.  Stackdriver Logging might reject log entries whose
+	// time stamps are more than a couple of hours in the future. Log entries
+	// with time stamps in the past are accepted.
 	Timestamp *google_protobuf4.Timestamp `protobuf:"bytes,9,opt,name=timestamp" json:"timestamp,omitempty"`
+	// Output only. The time the log entry was received by Stackdriver Logging.
+	ReceiveTimestamp *google_protobuf4.Timestamp `protobuf:"bytes,24,opt,name=receive_timestamp,json=receiveTimestamp" json:"receive_timestamp,omitempty"`
 	// Optional. The severity of the log entry. The default value is
 	// `LogSeverity.DEFAULT`.
 	Severity google_logging_type1.LogSeverity `protobuf:"varint,10,opt,name=severity,enum=google.logging.type.LogSeverity" json:"severity,omitempty"`
-	// Optional. A unique ID for the log entry. If you provide this
-	// field, the logging service considers other log entries in the
-	// same project with the same ID as duplicates which can be removed.  If
-	// omitted, Stackdriver Logging will generate a unique ID for this
-	// log entry.
+	// Optional. A unique identifier for the log entry. If you provide a value,
+	// then Stackdriver Logging considers other log entries in the same project,
+	// with the same `timestamp`, and with the same `insert_id` to be duplicates
+	// which can be removed.  If omitted in new log entries, then Stackdriver
+	// Logging will insert its own unique identifier. The `insert_id` is used
+	// to order log entries that have the same `timestamp` value.
 	InsertId string `protobuf:"bytes,4,opt,name=insert_id,json=insertId" json:"insert_id,omitempty"`
 	// Optional. Information about the HTTP request associated with this
 	// log entry, if applicable.
@@ -197,6 +206,13 @@ func (m *LogEntry) GetTimestamp() *google_protobuf4.Timestamp {
 	return nil
 }
 
+func (m *LogEntry) GetReceiveTimestamp() *google_protobuf4.Timestamp {
+	if m != nil {
+		return m.ReceiveTimestamp
+	}
+	return nil
+}
+
 func (m *LogEntry) GetSeverity() google_logging_type1.LogSeverity {
 	if m != nil {
 		return m.Severity
@@ -437,48 +453,49 @@ func init() {
 func init() { proto.RegisterFile("google/logging/v2/log_entry.proto", fileDescriptor0) }
 
 var fileDescriptor0 = []byte{
-	// 679 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x7c, 0x94, 0xd1, 0x6e, 0xd3, 0x3c,
-	0x14, 0xc7, 0x97, 0x76, 0x5f, 0x97, 0xba, 0xdd, 0xf6, 0xcd, 0x1a, 0x5b, 0x56, 0x86, 0x28, 0x1b,
-	0x82, 0x72, 0x93, 0x4a, 0xe5, 0x66, 0x63, 0x93, 0x10, 0x9d, 0x10, 0x43, 0x2a, 0x30, 0x79, 0x88,
-	0x0b, 0x84, 0x54, 0x79, 0x89, 0x9b, 0x19, 0x52, 0x3b, 0x38, 0x4e, 0x45, 0xaf, 0x78, 0x04, 0xde,
-	0x83, 0x27, 0xe4, 0x12, 0xf9, 0xd8, 0xe9, 0x4a, 0x3b, 0xed, 0xee, 0x9c, 0xfa, 0xf7, 0x3f, 0xff,
-	0xe3, 0xe3, 0x93, 0xa2, 0x47, 0x89, 0x94, 0x49, 0xca, 0xba, 0xa9, 0x4c, 0x12, 0x2e, 0x92, 0xee,
-	0xa4, 0x67, 0xc2, 0x21, 0x13, 0x5a, 0x4d, 0xc3, 0x4c, 0x49, 0x2d, 0xf1, 0x96, 0x45, 0x42, 0x87,
-	0x84, 0x93, 0x5e, 0x6b, 0xdf, 0xa9, 0x68, 0xc6, 0xbb, 0x54, 0x08, 0xa9, 0xa9, 0xe6, 0x52, 0xe4,
-	0x56, 0xd0, 0x3a, 0x9c, 0x3b, 0x1d, 0x4b, 0xc1, 0xb5, 0x54, 0x2c, 0x1e, 0x2a, 0x96, 0xcb, 0x42,
-	0x45, 0xcc, 0x41, 0x4f, 0x16, 0x8c, 0xf5, 0x34, 0x63, 0xdd, 0x6b, 0xad, 0xb3, 0xa1, 0x62, 0xdf,
-	0x0b, 0x96, 0xeb, 0xbb, 0x38, 0xd3, 0x62, 0xce, 0x26, 0x4c, 0x71, 0xed, 0xba, 0x6c, 0xed, 0x39,
-	0x0e, 0xb2, 0xab, 0x62, 0xd4, 0xa5, 0xa2, 0x3c, 0xda, 0x5f, 0x3c, 0xca, 0xb5, 0x2a, 0xa2, 0xd2,
-	0xe0, 0xe1, 0xe2, 0xa9, 0xe6, 0x63, 0x96, 0x6b, 0x3a, 0xce, 0x2c, 0x70, 0xf0, 0xab, 0x86, 0xfc,
-	0x81, 0x4c, 0x5e, 0x9b, 0x91, 0xe0, 0x3d, 0xe4, 0x1b, 0x73, 0x41, 0xc7, 0x2c, 0x68, 0xb6, 0xbd,
-	0x4e, 0x9d, 0xac, 0xa5, 0x32, 0x79, 0x4f, 0xc7, 0x0c, 0x1f, 0x23, 0xbf, 0xbc, 0x63, 0xe0, 0xb7,
-	0xbd, 0x4e, 0xa3, 0xf7, 0x20, 0x74, 0xa3, 0xa3, 0x19, 0x0f, 0xdf, 0x95, 0x93, 0x20, 0x0e, 0x22,
-	0x33, 0x1c, 0x9f, 0xa0, 0x75, 0xf0, 0x1a, 0x66, 0x74, 0x9a, 0x4a, 0x1a, 0x07, 0x15, 0xd0, 0x6f,
-	0x97, 0xfa, 0xb2, 0xb7, 0xf0, 0x95, 0x98, 0x9e, 0xaf, 0x90, 0x26, 0xe4, 0x17, 0x96, 0xc5, 0x87,
-	0xa8, 0xa9, 0xd9, 0x0f, 0x3d, 0xd3, 0x56, 0x4d, 0x5b, 0xe7, 0x2b, 0xa4, 0x61, 0x7e, 0x2d, 0xa1,
-	0x53, 0xd4, 0xfc, 0x9a, 0x4b, 0x31, 0x83, 0x6a, 0x60, 0xb0, 0xbb, 0x64, 0x70, 0x09, 0xa3, 0x31,
-	0x6a, 0x83, 0x97, 0xea, 0x23, 0x54, 0x9f, 0x4d, 0x25, 0xa8, 0x83, 0xb4, 0xb5, 0x24, 0xfd, 0x58,
-	0x12, 0xe4, 0x06, 0xc6, 0xa7, 0xc8, 0x2f, 0x1f, 0x2a, 0x40, 0x6d, 0xaf, 0xb3, 0xd1, 0x6b, 0x87,
-	0x0b, 0xfb, 0x64, 0x5e, 0x34, 0x1c, 0xc8, 0xe4, 0xd2, 0x71, 0x64, 0xa6, 0xc0, 0xf7, 0x51, 0x9d,
-	0x8b, 0x9c, 0x29, 0x3d, 0xe4, 0x71, 0xb0, 0x0a, 0xe3, 0xf6, 0xed, 0x0f, 0x6f, 0x63, 0x7c, 0x86,
-	0x9a, 0xf3, 0xfb, 0x12, 0xac, 0x41, 0x5f, 0xb7, 0x97, 0x3f, 0xd7, 0x3a, 0x23, 0x96, 0x23, 0x8d,
-	0xeb, 0x9b, 0x04, 0xbf, 0x44, 0xb5, 0x94, 0x5e, 0xb1, 0x34, 0x0f, 0x1a, 0xed, 0x6a, 0xa7, 0xd1,
-	0x7b, 0x1a, 0x2e, 0x6d, 0x7b, 0x58, 0x3e, 0x7e, 0x38, 0x00, 0x12, 0x62, 0xe2, 0x64, 0xb8, 0x8f,
-	0xea, 0x32, 0x63, 0x0a, 0x3e, 0x80, 0x60, 0x13, 0x5a, 0x78, 0x7c, 0x47, 0x8d, 0x0f, 0x25, 0x4b,
-	0x6e, 0x64, 0x78, 0x1b, 0xfd, 0xa7, 0x15, 0x8d, 0x58, 0xb0, 0x03, 0x57, 0xb4, 0x09, 0x26, 0x68,
-	0xd3, 0xae, 0xc7, 0x30, 0x95, 0x91, 0xad, 0xbf, 0x0b, 0xf5, 0x9f, 0xdd, 0x51, 0xff, 0x12, 0x14,
-	0x03, 0x27, 0x20, 0x1b, 0xf9, 0x3f, 0x79, 0xeb, 0x18, 0x35, 0xe6, 0x2e, 0x81, 0xff, 0x47, 0xd5,
-	0x6f, 0x6c, 0x1a, 0x78, 0x60, 0x6b, 0x42, 0xd3, 0xca, 0x84, 0xa6, 0x05, 0x83, 0x0d, 0xac, 0x13,
-	0x9b, 0xbc, 0xa8, 0x1c, 0x79, 0xfd, 0x3a, 0x5a, 0x73, 0xcb, 0x73, 0xc0, 0xd1, 0xd6, 0xd2, 0x7d,
-	0xf0, 0x06, 0xaa, 0xf0, 0xd8, 0x95, 0xaa, 0xf0, 0x18, 0xb7, 0x90, 0x9f, 0x29, 0x19, 0x17, 0x11,
-	0x53, 0xae, 0xd8, 0x2c, 0x37, 0x2e, 0x23, 0xae, 0x72, 0x0d, 0xbb, 0xea, 0x13, 0x9b, 0x60, 0x8c,
-	0x56, 0x53, 0x9a, 0x6b, 0x78, 0x68, 0x9f, 0x40, 0x7c, 0xf0, 0x05, 0xed, 0xdc, 0x7e, 0x35, 0x43,
-	0x8f, 0x78, 0xca, 0x9c, 0x23, 0xc4, 0x50, 0x81, 0x0b, 0xdb, 0x7c, 0x95, 0x40, 0x6c, 0xfa, 0x18,
-	0x15, 0x22, 0x82, 0xf9, 0x55, 0x6d, 0x1f, 0x65, 0xde, 0xff, 0x89, 0xee, 0x45, 0x72, 0xbc, 0x3c,
-	0xce, 0xfe, 0x7a, 0x69, 0x7a, 0x01, 0x5f, 0x9a, 0xf7, 0xf9, 0xc8, 0x31, 0x89, 0x4c, 0xa9, 0x48,
-	0x42, 0xa9, 0x92, 0x6e, 0xc2, 0x04, 0xec, 0x7e, 0xd7, 0x1e, 0xd1, 0x8c, 0xe7, 0x73, 0x7f, 0xa3,
-	0x27, 0x2e, 0xfc, 0xe3, 0x79, 0xbf, 0x2b, 0xbb, 0x6f, 0xac, 0xfa, 0x2c, 0x95, 0x45, 0x6c, 0xde,
-	0x0a, 0x7c, 0x3e, 0xf5, 0xae, 0x6a, 0x50, 0xe1, 0xf9, 0xdf, 0x00, 0x00, 0x00, 0xff, 0xff, 0x34,
-	0x32, 0x8a, 0x87, 0x87, 0x05, 0x00, 0x00,
+	// 699 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x84, 0x54, 0x5f, 0x6f, 0xdb, 0x36,
+	0x10, 0x8f, 0xec, 0xcc, 0x91, 0x69, 0xe7, 0x1f, 0x91, 0x25, 0x8a, 0x97, 0x61, 0x5e, 0x32, 0x6c,
+	0xde, 0x8b, 0x0c, 0x78, 0x2f, 0xc9, 0x12, 0xa0, 0xa8, 0x83, 0x22, 0x29, 0xe0, 0xb6, 0x01, 0x53,
+	0xf4, 0xa1, 0x28, 0x60, 0x30, 0x12, 0xad, 0xb0, 0x95, 0x49, 0x95, 0xa2, 0x8c, 0xfa, 0xa9, 0xdf,
+	0xa7, 0x9f, 0xa8, 0x1f, 0xa5, 0x8f, 0x05, 0x8f, 0x94, 0xed, 0xda, 0x41, 0xfa, 0x76, 0x27, 0xfe,
+	0xfe, 0xdc, 0x1d, 0x8f, 0x42, 0x7f, 0x26, 0x52, 0x26, 0x29, 0xeb, 0xa6, 0x32, 0x49, 0xb8, 0x48,
+	0xba, 0x93, 0x9e, 0x09, 0x87, 0x4c, 0x68, 0x35, 0x0d, 0x33, 0x25, 0xb5, 0xc4, 0xbb, 0x16, 0x12,
+	0x3a, 0x48, 0x38, 0xe9, 0xb5, 0x8e, 0x1c, 0x8b, 0x66, 0xbc, 0x4b, 0x85, 0x90, 0x9a, 0x6a, 0x2e,
+	0x45, 0x6e, 0x09, 0xad, 0x93, 0x85, 0xd3, 0xb1, 0x14, 0x5c, 0x4b, 0xc5, 0xe2, 0xa1, 0x62, 0xb9,
+	0x2c, 0x54, 0xc4, 0x1c, 0xe8, 0xef, 0x25, 0x63, 0x3d, 0xcd, 0x58, 0xf7, 0x5e, 0xeb, 0x6c, 0xa8,
+	0xd8, 0xc7, 0x82, 0xe5, 0xfa, 0x31, 0x9c, 0x29, 0x31, 0x67, 0x13, 0xa6, 0xb8, 0x76, 0x55, 0xb6,
+	0x0e, 0x1d, 0x0e, 0xb2, 0xbb, 0x62, 0xd4, 0xa5, 0xa2, 0x3c, 0x3a, 0x5a, 0x3e, 0xca, 0xb5, 0x2a,
+	0xa2, 0xd2, 0xe0, 0x8f, 0xe5, 0x53, 0xcd, 0xc7, 0x2c, 0xd7, 0x74, 0x9c, 0x59, 0xc0, 0xf1, 0xd7,
+	0x1a, 0xf2, 0x07, 0x32, 0x79, 0x66, 0x46, 0x82, 0x0f, 0x91, 0x6f, 0xcc, 0x05, 0x1d, 0xb3, 0xa0,
+	0xd9, 0xf6, 0x3a, 0x75, 0xb2, 0x91, 0xca, 0xe4, 0x25, 0x1d, 0x33, 0x7c, 0x86, 0xfc, 0xb2, 0xc7,
+	0xc0, 0x6f, 0x7b, 0x9d, 0x46, 0xef, 0xf7, 0xd0, 0x8d, 0x8e, 0x66, 0x3c, 0x7c, 0x51, 0x4e, 0x82,
+	0x38, 0x10, 0x99, 0xc1, 0xf1, 0x39, 0xda, 0x04, 0xaf, 0x61, 0x46, 0xa7, 0xa9, 0xa4, 0x71, 0x50,
+	0x01, 0xfe, 0x5e, 0xc9, 0x2f, 0x6b, 0x0b, 0x9f, 0x8a, 0xe9, 0xf5, 0x1a, 0x69, 0x42, 0x7e, 0x63,
+	0xb1, 0xf8, 0x04, 0x35, 0x35, 0xfb, 0xa4, 0x67, 0xdc, 0xaa, 0x29, 0xeb, 0x7a, 0x8d, 0x34, 0xcc,
+	0xd7, 0x12, 0x74, 0x81, 0x9a, 0xef, 0x73, 0x29, 0x66, 0xa0, 0x1a, 0x18, 0x1c, 0xac, 0x18, 0xdc,
+	0xc2, 0x68, 0x0c, 0xdb, 0xc0, 0x4b, 0xf6, 0x29, 0xaa, 0xcf, 0xa6, 0x12, 0xd4, 0x81, 0xda, 0x5a,
+	0xa1, 0xbe, 0x2e, 0x11, 0x64, 0x0e, 0xc6, 0x57, 0x68, 0x57, 0xb1, 0x88, 0xf1, 0x09, 0x1b, 0xce,
+	0x15, 0x82, 0x9f, 0x2a, 0xec, 0x38, 0xd2, 0xec, 0x0b, 0xbe, 0x40, 0x7e, 0x79, 0xe3, 0x01, 0x6a,
+	0x7b, 0x9d, 0xad, 0x5e, 0x3b, 0x5c, 0x5a, 0x4c, 0xb3, 0x1a, 0xe1, 0x40, 0x26, 0xb7, 0x0e, 0x47,
+	0x66, 0x0c, 0xfc, 0x1b, 0xaa, 0x73, 0x91, 0x33, 0xa5, 0x87, 0x3c, 0x0e, 0xd6, 0xe1, 0xde, 0x7c,
+	0xfb, 0xe1, 0x79, 0x8c, 0x2f, 0x51, 0x73, 0x71, 0xf1, 0x82, 0x0d, 0x28, 0xef, 0x61, 0xf9, 0x6b,
+	0xad, 0x33, 0x62, 0x71, 0xa4, 0x71, 0x3f, 0x4f, 0xf0, 0x13, 0x54, 0x4b, 0xe9, 0x1d, 0x4b, 0xf3,
+	0xa0, 0xd1, 0xae, 0x76, 0x1a, 0xbd, 0x7f, 0xc2, 0x95, 0x67, 0x13, 0x96, 0x5b, 0x14, 0x0e, 0x00,
+	0x09, 0x31, 0x71, 0x34, 0xdc, 0x47, 0x75, 0x99, 0x31, 0x05, 0x2f, 0x29, 0xd8, 0x86, 0x12, 0xfe,
+	0x7a, 0x44, 0xe3, 0x55, 0x89, 0x25, 0x73, 0x1a, 0xde, 0x43, 0xbf, 0x68, 0x45, 0x23, 0x16, 0xec,
+	0x43, 0x8b, 0x36, 0xc1, 0x04, 0x6d, 0xdb, 0x3d, 0x1b, 0xa6, 0x32, 0xb2, 0xfa, 0x07, 0xa0, 0xff,
+	0xef, 0x23, 0xfa, 0xb7, 0xc0, 0x18, 0x38, 0x02, 0xd9, 0xca, 0x7f, 0xc8, 0x5b, 0x67, 0xa8, 0xb1,
+	0xd0, 0x04, 0xde, 0x41, 0xd5, 0x0f, 0x6c, 0x1a, 0x78, 0x60, 0x6b, 0x42, 0x53, 0xca, 0x84, 0xa6,
+	0x05, 0x83, 0x55, 0xae, 0x13, 0x9b, 0xfc, 0x5f, 0x39, 0xf5, 0xfa, 0x75, 0xb4, 0xe1, 0xb6, 0xf0,
+	0x98, 0xa3, 0xdd, 0x95, 0x7e, 0xf0, 0x16, 0xaa, 0xf0, 0xd8, 0x49, 0x55, 0x78, 0x8c, 0x5b, 0xc8,
+	0xcf, 0x94, 0x8c, 0x8b, 0x88, 0x29, 0x27, 0x36, 0xcb, 0x8d, 0xcb, 0x88, 0xab, 0x5c, 0xc3, 0xd2,
+	0xfb, 0xc4, 0x26, 0x18, 0xa3, 0xf5, 0x94, 0xe6, 0x1a, 0x2e, 0xda, 0x27, 0x10, 0x1f, 0xbf, 0x43,
+	0xfb, 0x0f, 0xb7, 0x66, 0xd0, 0x23, 0x9e, 0x32, 0xe7, 0x08, 0x31, 0x28, 0x70, 0x61, 0x8b, 0xaf,
+	0x12, 0x88, 0x4d, 0x1d, 0xa3, 0x42, 0x44, 0x30, 0xbf, 0xaa, 0xad, 0xa3, 0xcc, 0xfb, 0x9f, 0xd1,
+	0xaf, 0x91, 0x1c, 0xaf, 0x8e, 0xb3, 0xbf, 0x59, 0x9a, 0xde, 0xc0, 0x93, 0xf5, 0xde, 0x9e, 0x3a,
+	0x4c, 0x22, 0x53, 0x2a, 0x92, 0x50, 0xaa, 0xa4, 0x9b, 0x30, 0x01, 0x4f, 0xa0, 0x6b, 0x8f, 0x68,
+	0xc6, 0xf3, 0x85, 0xff, 0xf1, 0xb9, 0x0b, 0xbf, 0x79, 0xde, 0x97, 0xca, 0xc1, 0x95, 0x65, 0x5f,
+	0xa6, 0xb2, 0x88, 0xcd, 0x5d, 0x81, 0xcf, 0x9b, 0xde, 0x5d, 0x0d, 0x14, 0xfe, 0xfb, 0x1e, 0x00,
+	0x00, 0xff, 0xff, 0xa9, 0x61, 0x44, 0xa8, 0xd0, 0x05, 0x00, 0x00,
 }
diff --git a/components/engine/vendor/google.golang.org/genproto/googleapis/logging/v2/logging.pb.go b/components/engine/vendor/google.golang.org/genproto/googleapis/logging/v2/logging.pb.go
index 4e443f630b..06eeb2350b 100644
--- a/components/engine/vendor/google.golang.org/genproto/googleapis/logging/v2/logging.pb.go
+++ b/components/engine/vendor/google.golang.org/genproto/googleapis/logging/v2/logging.pb.go
@@ -12,7 +12,7 @@ import google_api3 "google.golang.org/genproto/googleapis/api/monitoredres"
 import _ "github.com/golang/protobuf/ptypes/duration"
 import google_protobuf5 "github.com/golang/protobuf/ptypes/empty"
 import _ "github.com/golang/protobuf/ptypes/timestamp"
-import _ "google.golang.org/genproto/googleapis/rpc/status"
+import google_rpc "google.golang.org/genproto/googleapis/rpc/status"
 
 import (
 	context "golang.org/x/net/context"
@@ -30,6 +30,8 @@ type DeleteLogRequest struct {
 	//
 	//     "projects/[PROJECT_ID]/logs/[LOG_ID]"
 	//     "organizations/[ORGANIZATION_ID]/logs/[LOG_ID]"
+	//     "billingAccounts/[BILLING_ACCOUNT_ID]/logs/[LOG_ID]"
+	//     "folders/[FOLDER_ID]/logs/[LOG_ID]"
 	//
 	// `[LOG_ID]` must be URL-encoded. For example,
 	// `"projects/my-project-id/logs/syslog"`,
@@ -58,6 +60,8 @@ type WriteLogEntriesRequest struct {
 	//
 	//     "projects/[PROJECT_ID]/logs/[LOG_ID]"
 	//     "organizations/[ORGANIZATION_ID]/logs/[LOG_ID]"
+	//     "billingAccounts/[BILLING_ACCOUNT_ID]/logs/[LOG_ID]"
+	//     "folders/[FOLDER_ID]/logs/[LOG_ID]"
 	//
 	// `[LOG_ID]` must be URL-encoded. For example,
 	// `"projects/my-project-id/logs/syslog"` or
@@ -79,10 +83,16 @@ type WriteLogEntriesRequest struct {
 	// as a label in this parameter, then the log entry's label is not changed.
 	// See [LogEntry][google.logging.v2.LogEntry].
 	Labels map[string]string `protobuf:"bytes,3,rep,name=labels" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
-	// Required. The log entries to write. Values supplied for the fields
+	// Required.  The log entries to write. Values supplied for the fields
 	// `log_name`, `resource`, and `labels` in this `entries.write` request are
-	// added to those log entries that do not provide their own values for the
-	// fields.
+	// inserted into those log entries in this list that do not provide their own
+	// values.
+	//
+	// Stackdriver Logging also creates and inserts values for `timestamp` and
+	// `insert_id` if the entries do not provide them. The created `insert_id` for
+	// the N'th entry in this list will be greater than earlier entries and less
+	// than later entries.  Otherwise, the order of log entries in this list does
+	// not matter.
 	//
 	// To improve throughput and to avoid exceeding the
 	// [quota limit](/logging/quota-policy) for calls to `entries.write`,
@@ -91,9 +101,9 @@ type WriteLogEntriesRequest struct {
 	Entries []*LogEntry `protobuf:"bytes,4,rep,name=entries" json:"entries,omitempty"`
 	// Optional. Whether valid entries should be written even if some other
 	// entries fail due to INVALID_ARGUMENT or PERMISSION_DENIED errors. If any
-	// entry is not written, the response status will be the error associated
-	// with one of the failed entries and include error details in the form of
-	// WriteLogEntriesPartialErrors.
+	// entry is not written, then the response status is the error associated
+	// with one of the failed entries and the response includes error details
+	// keyed by the entries' zero-based index in the `entries.write` method.
 	PartialSuccess bool `protobuf:"varint,5,opt,name=partial_success,json=partialSuccess" json:"partial_success,omitempty"`
 }
 
@@ -147,6 +157,29 @@ func (m *WriteLogEntriesResponse) String() string            { return proto.Comp
 func (*WriteLogEntriesResponse) ProtoMessage()               {}
 func (*WriteLogEntriesResponse) Descriptor() ([]byte, []int) { return fileDescriptor1, []int{2} }
 
+// Error details for WriteLogEntries with partial success.
+type WriteLogEntriesPartialErrors struct {
+	// When `WriteLogEntriesRequest.partial_success` is true, records the error
+	// status for entries that were not written due to a permanent error, keyed
+	// by the entry's zero-based index in `WriteLogEntriesRequest.entries`.
+	//
+	// Failed requests for which no entries are written will not include
+	// per-entry errors.
+	LogEntryErrors map[int32]*google_rpc.Status `protobuf:"bytes,1,rep,name=log_entry_errors,json=logEntryErrors" json:"log_entry_errors,omitempty" protobuf_key:"varint,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+}
+
+func (m *WriteLogEntriesPartialErrors) Reset()                    { *m = WriteLogEntriesPartialErrors{} }
+func (m *WriteLogEntriesPartialErrors) String() string            { return proto.CompactTextString(m) }
+func (*WriteLogEntriesPartialErrors) ProtoMessage()               {}
+func (*WriteLogEntriesPartialErrors) Descriptor() ([]byte, []int) { return fileDescriptor1, []int{3} }
+
+func (m *WriteLogEntriesPartialErrors) GetLogEntryErrors() map[int32]*google_rpc.Status {
+	if m != nil {
+		return m.LogEntryErrors
+	}
+	return nil
+}
+
 // The parameters to `ListLogEntries`.
 type ListLogEntriesRequest struct {
 	// Deprecated. Use `resource_names` instead.  One or more project identifiers
@@ -155,11 +188,13 @@ type ListLogEntriesRequest struct {
 	// resource name format and added to the list of resources in
 	// `resource_names`.
 	ProjectIds []string `protobuf:"bytes,1,rep,name=project_ids,json=projectIds" json:"project_ids,omitempty"`
-	// Required. Names of one or more resources from which to retrieve log
-	// entries:
+	// Required. Names of one or more parent resources from which to
+	// retrieve log entries:
 	//
 	//     "projects/[PROJECT_ID]"
 	//     "organizations/[ORGANIZATION_ID]"
+	//     "billingAccounts/[BILLING_ACCOUNT_ID]"
+	//     "folders/[FOLDER_ID]"
 	//
 	// Projects listed in the `project_ids` field are added to this list.
 	ResourceNames []string `protobuf:"bytes,8,rep,name=resource_names,json=resourceNames" json:"resource_names,omitempty"`
@@ -176,15 +211,15 @@ type ListLogEntriesRequest struct {
 	// option returns entries in order of increasing values of
 	// `LogEntry.timestamp` (oldest first), and the second option returns entries
 	// in order of decreasing timestamps (newest first).  Entries with equal
-	// timestamps are returned in order of `LogEntry.insertId`.
+	// timestamps are returned in order of their `insert_id` values.
 	OrderBy string `protobuf:"bytes,3,opt,name=order_by,json=orderBy" json:"order_by,omitempty"`
 	// Optional. The maximum number of results to return from this request.
-	// Non-positive values are ignored.  The presence of `nextPageToken` in the
+	// Non-positive values are ignored.  The presence of `next_page_token` in the
 	// response indicates that more results might be available.
 	PageSize int32 `protobuf:"varint,4,opt,name=page_size,json=pageSize" json:"page_size,omitempty"`
 	// Optional. If present, then retrieve the next batch of results from the
-	// preceding call to this method.  `pageToken` must be the value of
-	// `nextPageToken` from the previous response.  The values of other method
+	// preceding call to this method.  `page_token` must be the value of
+	// `next_page_token` from the previous response.  The values of other method
 	// parameters should be identical to those in the previous call.
 	PageToken string `protobuf:"bytes,5,opt,name=page_token,json=pageToken" json:"page_token,omitempty"`
 }
@@ -192,7 +227,7 @@ type ListLogEntriesRequest struct {
 func (m *ListLogEntriesRequest) Reset()                    { *m = ListLogEntriesRequest{} }
 func (m *ListLogEntriesRequest) String() string            { return proto.CompactTextString(m) }
 func (*ListLogEntriesRequest) ProtoMessage()               {}
-func (*ListLogEntriesRequest) Descriptor() ([]byte, []int) { return fileDescriptor1, []int{3} }
+func (*ListLogEntriesRequest) Descriptor() ([]byte, []int) { return fileDescriptor1, []int{4} }
 
 func (m *ListLogEntriesRequest) GetProjectIds() []string {
 	if m != nil {
@@ -256,7 +291,7 @@ type ListLogEntriesResponse struct {
 func (m *ListLogEntriesResponse) Reset()                    { *m = ListLogEntriesResponse{} }
 func (m *ListLogEntriesResponse) String() string            { return proto.CompactTextString(m) }
 func (*ListLogEntriesResponse) ProtoMessage()               {}
-func (*ListLogEntriesResponse) Descriptor() ([]byte, []int) { return fileDescriptor1, []int{4} }
+func (*ListLogEntriesResponse) Descriptor() ([]byte, []int) { return fileDescriptor1, []int{5} }
 
 func (m *ListLogEntriesResponse) GetEntries() []*LogEntry {
 	if m != nil {
@@ -291,7 +326,7 @@ func (m *ListMonitoredResourceDescriptorsRequest) Reset() {
 func (m *ListMonitoredResourceDescriptorsRequest) String() string { return proto.CompactTextString(m) }
 func (*ListMonitoredResourceDescriptorsRequest) ProtoMessage()    {}
 func (*ListMonitoredResourceDescriptorsRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor1, []int{5}
+	return fileDescriptor1, []int{6}
 }
 
 func (m *ListMonitoredResourceDescriptorsRequest) GetPageSize() int32 {
@@ -324,7 +359,7 @@ func (m *ListMonitoredResourceDescriptorsResponse) Reset() {
 func (m *ListMonitoredResourceDescriptorsResponse) String() string { return proto.CompactTextString(m) }
 func (*ListMonitoredResourceDescriptorsResponse) ProtoMessage()    {}
 func (*ListMonitoredResourceDescriptorsResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor1, []int{6}
+	return fileDescriptor1, []int{7}
 }
 
 func (m *ListMonitoredResourceDescriptorsResponse) GetResourceDescriptors() []*google_api3.MonitoredResourceDescriptor {
@@ -347,6 +382,8 @@ type ListLogsRequest struct {
 	//
 	//     "projects/[PROJECT_ID]"
 	//     "organizations/[ORGANIZATION_ID]"
+	//     "billingAccounts/[BILLING_ACCOUNT_ID]"
+	//     "folders/[FOLDER_ID]"
 	Parent string `protobuf:"bytes,1,opt,name=parent" json:"parent,omitempty"`
 	// Optional. The maximum number of results to return from this request.
 	// Non-positive values are ignored.  The presence of `nextPageToken` in the
@@ -362,7 +399,7 @@ type ListLogsRequest struct {
 func (m *ListLogsRequest) Reset()                    { *m = ListLogsRequest{} }
 func (m *ListLogsRequest) String() string            { return proto.CompactTextString(m) }
 func (*ListLogsRequest) ProtoMessage()               {}
-func (*ListLogsRequest) Descriptor() ([]byte, []int) { return fileDescriptor1, []int{7} }
+func (*ListLogsRequest) Descriptor() ([]byte, []int) { return fileDescriptor1, []int{8} }
 
 func (m *ListLogsRequest) GetParent() string {
 	if m != nil {
@@ -400,7 +437,7 @@ type ListLogsResponse struct {
 func (m *ListLogsResponse) Reset()                    { *m = ListLogsResponse{} }
 func (m *ListLogsResponse) String() string            { return proto.CompactTextString(m) }
 func (*ListLogsResponse) ProtoMessage()               {}
-func (*ListLogsResponse) Descriptor() ([]byte, []int) { return fileDescriptor1, []int{8} }
+func (*ListLogsResponse) Descriptor() ([]byte, []int) { return fileDescriptor1, []int{9} }
 
 func (m *ListLogsResponse) GetLogNames() []string {
 	if m != nil {
@@ -420,6 +457,7 @@ func init() {
 	proto.RegisterType((*DeleteLogRequest)(nil), "google.logging.v2.DeleteLogRequest")
 	proto.RegisterType((*WriteLogEntriesRequest)(nil), "google.logging.v2.WriteLogEntriesRequest")
 	proto.RegisterType((*WriteLogEntriesResponse)(nil), "google.logging.v2.WriteLogEntriesResponse")
+	proto.RegisterType((*WriteLogEntriesPartialErrors)(nil), "google.logging.v2.WriteLogEntriesPartialErrors")
 	proto.RegisterType((*ListLogEntriesRequest)(nil), "google.logging.v2.ListLogEntriesRequest")
 	proto.RegisterType((*ListLogEntriesResponse)(nil), "google.logging.v2.ListLogEntriesResponse")
 	proto.RegisterType((*ListMonitoredResourceDescriptorsRequest)(nil), "google.logging.v2.ListMonitoredResourceDescriptorsRequest")
@@ -441,9 +479,10 @@ const _ = grpc.SupportPackageIsVersion4
 type LoggingServiceV2Client interface {
 	// Deletes all the log entries in a log.
 	// The log reappears if it receives new entries.
+	// Log entries written shortly before the delete operation might not be
+	// deleted.
 	DeleteLog(ctx context.Context, in *DeleteLogRequest, opts ...grpc.CallOption) (*google_protobuf5.Empty, error)
-	// Writes log entries to Stackdriver Logging.  All log entries are
-	// written by this method.
+	// Writes log entries to Stackdriver Logging.
 	WriteLogEntries(ctx context.Context, in *WriteLogEntriesRequest, opts ...grpc.CallOption) (*WriteLogEntriesResponse, error)
 	// Lists log entries.  Use this method to retrieve log entries from
 	// Stackdriver Logging.  For ways to export log entries, see
@@ -452,7 +491,7 @@ type LoggingServiceV2Client interface {
 	// Lists the descriptors for monitored resource types used by Stackdriver
 	// Logging.
 	ListMonitoredResourceDescriptors(ctx context.Context, in *ListMonitoredResourceDescriptorsRequest, opts ...grpc.CallOption) (*ListMonitoredResourceDescriptorsResponse, error)
-	// Lists the logs in projects or organizations.
+	// Lists the logs in projects, organizations, folders, or billing accounts.
 	// Only logs that have entries are listed.
 	ListLogs(ctx context.Context, in *ListLogsRequest, opts ...grpc.CallOption) (*ListLogsResponse, error)
 }
@@ -515,9 +554,10 @@ func (c *loggingServiceV2Client) ListLogs(ctx context.Context, in *ListLogsReque
 type LoggingServiceV2Server interface {
 	// Deletes all the log entries in a log.
 	// The log reappears if it receives new entries.
+	// Log entries written shortly before the delete operation might not be
+	// deleted.
 	DeleteLog(context.Context, *DeleteLogRequest) (*google_protobuf5.Empty, error)
-	// Writes log entries to Stackdriver Logging.  All log entries are
-	// written by this method.
+	// Writes log entries to Stackdriver Logging.
 	WriteLogEntries(context.Context, *WriteLogEntriesRequest) (*WriteLogEntriesResponse, error)
 	// Lists log entries.  Use this method to retrieve log entries from
 	// Stackdriver Logging.  For ways to export log entries, see
@@ -526,7 +566,7 @@ type LoggingServiceV2Server interface {
 	// Lists the descriptors for monitored resource types used by Stackdriver
 	// Logging.
 	ListMonitoredResourceDescriptors(context.Context, *ListMonitoredResourceDescriptorsRequest) (*ListMonitoredResourceDescriptorsResponse, error)
-	// Lists the logs in projects or organizations.
+	// Lists the logs in projects, organizations, folders, or billing accounts.
 	// Only logs that have entries are listed.
 	ListLogs(context.Context, *ListLogsRequest) (*ListLogsResponse, error)
 }
@@ -657,62 +697,66 @@ var _LoggingServiceV2_serviceDesc = grpc.ServiceDesc{
 func init() { proto.RegisterFile("google/logging/v2/logging.proto", fileDescriptor1) }
 
 var fileDescriptor1 = []byte{
-	// 912 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x56, 0x4f, 0x6f, 0x1b, 0x45,
-	0x14, 0xd7, 0xd8, 0x4d, 0x6a, 0xbf, 0xd0, 0xc4, 0x1d, 0x1a, 0xc7, 0xb5, 0xd3, 0xc6, 0x6c, 0x28,
-	0xd9, 0x5a, 0xea, 0xae, 0x30, 0xaa, 0xd4, 0xa6, 0xe2, 0x12, 0x5a, 0x21, 0xa4, 0x14, 0x45, 0x1b,
-	0xd4, 0x4a, 0xbd, 0x58, 0x6b, 0xfb, 0x75, 0x35, 0x74, 0xbd, 0xb3, 0xcc, 0x8c, 0x1d, 0xdc, 0xaa,
-	0x1c, 0x7a, 0xe0, 0x0b, 0xf0, 0x2d, 0x38, 0xf0, 0x2d, 0xb8, 0x72, 0xe1, 0xc2, 0x81, 0x23, 0x1f,
-	0x82, 0x23, 0x9a, 0xd9, 0x59, 0xc7, 0xb1, 0x5d, 0xc7, 0xe5, 0xb6, 0xf3, 0xe6, 0x37, 0xef, 0xfd,
-	0xde, 0xef, 0xfd, 0xb1, 0x61, 0x2f, 0xe2, 0x3c, 0x8a, 0xd1, 0x8f, 0x79, 0x14, 0xb1, 0x24, 0xf2,
-	0x47, 0xed, 0xfc, 0xd3, 0x4b, 0x05, 0x57, 0x9c, 0x5e, 0xcf, 0x00, 0x5e, 0x6e, 0x1d, 0xb5, 0xeb,
-	0xbb, 0xf6, 0x4d, 0x98, 0x32, 0x3f, 0x4c, 0x12, 0xae, 0x42, 0xc5, 0x78, 0x22, 0xb3, 0x07, 0xf5,
-	0xfd, 0xa9, 0xdb, 0x01, 0x4f, 0x98, 0xe2, 0x02, 0xfb, 0x1d, 0x81, 0x92, 0x0f, 0x45, 0x0f, 0x2d,
-	0xe8, 0x93, 0x85, 0x61, 0x3b, 0x98, 0x28, 0x31, 0xb6, 0x90, 0xdb, 0x16, 0x62, 0x4e, 0xdd, 0xe1,
-	0x4b, 0xbf, 0x3f, 0x14, 0x26, 0x90, 0xbd, 0x6f, 0xcc, 0xde, 0xe3, 0x20, 0x55, 0xf9, 0xe3, 0xbd,
-	0xd9, 0x4b, 0xc5, 0x06, 0x28, 0x55, 0x38, 0x48, 0x2d, 0x60, 0xc7, 0x02, 0x44, 0xda, 0xf3, 0xa5,
-	0x0a, 0xd5, 0xd0, 0xd2, 0x77, 0xee, 0x41, 0xe5, 0x31, 0xc6, 0xa8, 0xf0, 0x98, 0x47, 0x01, 0xfe,
-	0x30, 0x44, 0xa9, 0xe8, 0x4d, 0x28, 0x69, 0x76, 0x49, 0x38, 0xc0, 0x1a, 0x69, 0x12, 0xb7, 0x1c,
-	0x5c, 0x8d, 0x79, 0xf4, 0x6d, 0x38, 0x40, 0xe7, 0xaf, 0x02, 0x54, 0x9f, 0x0b, 0x66, 0xe0, 0x4f,
-	0x12, 0x25, 0x18, 0xca, 0xcb, 0x5f, 0xd1, 0x87, 0x50, 0xca, 0x05, 0xa9, 0x15, 0x9a, 0xc4, 0xdd,
-	0x68, 0xdf, 0xf2, 0xac, 0xce, 0x61, 0xca, 0xbc, 0xa7, 0xb9, 0x6c, 0x81, 0x05, 0x05, 0x13, 0x38,
-	0x7d, 0x0a, 0xeb, 0x71, 0xd8, 0xc5, 0x58, 0xd6, 0x8a, 0xcd, 0xa2, 0xbb, 0xd1, 0xbe, 0xef, 0xcd,
-	0x15, 0xc8, 0x5b, 0x4c, 0xc8, 0x3b, 0x36, 0xef, 0xb4, 0x71, 0x1c, 0x58, 0x27, 0xf4, 0x3e, 0x5c,
-	0xc5, 0x0c, 0x55, 0xbb, 0x62, 0xfc, 0x35, 0x16, 0xf8, 0xb3, 0xae, 0xc6, 0x41, 0x8e, 0xa5, 0x07,
-	0xb0, 0x95, 0x86, 0x42, 0xb1, 0x30, 0xee, 0xc8, 0x61, 0xaf, 0x87, 0x52, 0xd6, 0xd6, 0x9a, 0xc4,
-	0x2d, 0x05, 0x9b, 0xd6, 0x7c, 0x9a, 0x59, 0xeb, 0x0f, 0x61, 0x63, 0x2a, 0x2c, 0xad, 0x40, 0xf1,
-	0x15, 0x8e, 0xad, 0x1c, 0xfa, 0x93, 0xde, 0x80, 0xb5, 0x51, 0x18, 0x0f, 0x33, 0x1d, 0xca, 0x41,
-	0x76, 0x38, 0x2c, 0x3c, 0x20, 0xce, 0x4d, 0xd8, 0x99, 0x4b, 0x44, 0xa6, 0x3c, 0x91, 0xe8, 0xfc,
-	0x41, 0x60, 0xfb, 0x98, 0x49, 0x35, 0x2f, 0xfa, 0x1e, 0x6c, 0xa4, 0x82, 0x7f, 0x8f, 0x3d, 0xd5,
-	0x61, 0x7d, 0x59, 0x23, 0xcd, 0xa2, 0x5b, 0x0e, 0xc0, 0x9a, 0xbe, 0xe9, 0x4b, 0x7a, 0x07, 0x36,
-	0x73, 0x2d, 0x4d, 0x69, 0x64, 0xad, 0x64, 0x30, 0xd7, 0x72, 0xab, 0x2e, 0x90, 0xa4, 0x55, 0x58,
-	0x7f, 0xc9, 0x62, 0x85, 0xc2, 0xf2, 0xb2, 0x27, 0x5d, 0x54, 0x2e, 0xfa, 0x28, 0x3a, 0xdd, 0x71,
-	0xad, 0x98, 0x15, 0xd5, 0x9c, 0x8f, 0xc6, 0xb4, 0x01, 0xe5, 0x34, 0x8c, 0xb0, 0x23, 0xd9, 0x6b,
-	0xac, 0x5d, 0x69, 0x12, 0x77, 0x2d, 0x28, 0x69, 0xc3, 0x29, 0x7b, 0x8d, 0xf4, 0x16, 0x80, 0xb9,
-	0x54, 0xfc, 0x15, 0x26, 0x46, 0xab, 0x72, 0x60, 0xe0, 0xdf, 0x69, 0x83, 0x73, 0x06, 0xd5, 0xd9,
-	0x7c, 0xb2, 0x54, 0xa7, 0x0b, 0x44, 0x3e, 0xa0, 0x40, 0x9f, 0xc1, 0x56, 0x82, 0x3f, 0xaa, 0xce,
-	0x54, 0xd0, 0x2c, 0x91, 0x6b, 0xda, 0x7c, 0x32, 0x09, 0x8c, 0x70, 0xa0, 0x03, 0xcf, 0x75, 0xdc,
-	0x63, 0x94, 0x3d, 0xc1, 0x52, 0xc5, 0xc5, 0x44, 0xda, 0x0b, 0xf9, 0x91, 0xa5, 0xf9, 0x15, 0x66,
-	0xf3, 0xfb, 0x8d, 0x80, 0x7b, 0x79, 0x1c, 0x9b, 0xf2, 0x0b, 0xb8, 0x31, 0x29, 0x51, 0xff, 0xfc,
-	0xde, 0xe6, 0x7f, 0xb0, 0x74, 0x52, 0xce, 0xfd, 0x05, 0x1f, 0x8b, 0xf9, 0x18, 0x1f, 0xa0, 0xcb,
-	0x96, 0x2d, 0xc8, 0x24, 0xff, 0x2a, 0xac, 0xa7, 0xa1, 0xc0, 0x44, 0xd9, 0xf6, 0xb5, 0xa7, 0x8b,
-	0xba, 0x14, 0x96, 0xea, 0x52, 0x9c, 0xd5, 0xe5, 0x39, 0x54, 0xce, 0xc3, 0xd8, 0xf4, 0x1b, 0x50,
-	0xce, 0xf7, 0x46, 0x36, 0xe4, 0xe5, 0xa0, 0x64, 0x17, 0xc7, 0xca, 0xfc, 0xdb, 0x7f, 0xaf, 0x41,
-	0xe5, 0x38, 0x6b, 0x90, 0x53, 0x14, 0x23, 0xd6, 0xc3, 0x67, 0x6d, 0x7a, 0x06, 0xe5, 0xc9, 0x6e,
-	0xa3, 0xfb, 0x0b, 0xfa, 0x68, 0x76, 0xf3, 0xd5, 0xab, 0x39, 0x28, 0x5f, 0xa4, 0xde, 0x13, 0xbd,
-	0x65, 0x9d, 0x7b, 0xef, 0xfe, 0xfc, 0xe7, 0x97, 0xc2, 0x41, 0xeb, 0x8e, 0x3f, 0x6a, 0x77, 0x51,
-	0x85, 0x9f, 0xfb, 0x6f, 0x72, 0xce, 0x5f, 0xda, 0x61, 0x93, 0x7e, 0x4b, 0xef, 0x74, 0xe9, 0xb7,
-	0xde, 0xd2, 0x9f, 0x09, 0x6c, 0xcd, 0xcc, 0x32, 0xbd, 0xbb, 0xf2, 0xe2, 0xaa, 0xb7, 0x56, 0x81,
-	0xda, 0xd5, 0xb0, 0x6b, 0x98, 0x55, 0x9d, 0xeb, 0xfa, 0x37, 0xc5, 0x4e, 0xc3, 0xe1, 0x99, 0x06,
-	0x1f, 0x92, 0x16, 0x7d, 0x47, 0x60, 0xf3, 0xe2, 0xa0, 0x51, 0x77, 0xd1, 0x3c, 0x2d, 0xda, 0x2d,
-	0xf5, 0xbb, 0x2b, 0x20, 0x2d, 0x8b, 0x86, 0x61, 0xb1, 0xed, 0x54, 0xa6, 0x59, 0xc4, 0x4c, 0x2a,
-	0x4d, 0xe2, 0x77, 0x02, 0xcd, 0xcb, 0x86, 0x81, 0x1e, 0xbe, 0x27, 0xd8, 0x0a, 0x93, 0x5a, 0x7f,
-	0xf4, 0xbf, 0xde, 0x5a, 0xea, 0xae, 0xa1, 0xee, 0xd0, 0xa6, 0xa6, 0x3e, 0x58, 0x46, 0x71, 0x0c,
-	0xa5, 0xbc, 0x79, 0xa9, 0xf3, 0x7e, 0x6d, 0x26, 0xb4, 0xf6, 0x97, 0x62, 0x6c, 0xf8, 0x4f, 0x4d,
-	0xf8, 0xdb, 0x74, 0x57, 0x87, 0x7f, 0x93, 0x8d, 0xd8, 0x54, 0x4b, 0xbd, 0x35, 0x3d, 0x75, 0xf4,
-	0x13, 0x6c, 0xf7, 0xf8, 0x60, 0xde, 0xdf, 0xd1, 0x47, 0xb6, 0xe9, 0x4f, 0x74, 0xbf, 0x9e, 0x90,
-	0x17, 0x0f, 0x2c, 0x24, 0xe2, 0x71, 0x98, 0x44, 0x1e, 0x17, 0x91, 0x1f, 0x61, 0x62, 0xba, 0xd9,
-	0xcf, 0xae, 0xc2, 0x94, 0xc9, 0xa9, 0xff, 0x21, 0x8f, 0xec, 0xe7, 0xbf, 0x84, 0xfc, 0x5a, 0xd8,
-	0xf9, 0x3a, 0x7b, 0xfd, 0x55, 0xcc, 0x87, 0x7d, 0xcf, 0xba, 0xf6, 0x9e, 0xb5, 0xbb, 0xeb, 0xc6,
-	0xc3, 0x17, 0xff, 0x05, 0x00, 0x00, 0xff, 0xff, 0x9a, 0x9f, 0x7c, 0xe8, 0x3f, 0x09, 0x00, 0x00,
+	// 975 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x56, 0xcd, 0x6e, 0xdb, 0x46,
+	0x10, 0x06, 0xa5, 0xd8, 0x91, 0x46, 0x8d, 0xad, 0x6c, 0x62, 0x59, 0x91, 0x9c, 0x58, 0xa5, 0x9b,
+	0x5a, 0x11, 0x10, 0x12, 0x55, 0x11, 0x20, 0x71, 0xd0, 0x8b, 0x13, 0xa3, 0x28, 0xe0, 0x14, 0x06,
+	0xdd, 0x26, 0x40, 0x2e, 0x02, 0x25, 0x4d, 0x88, 0x6d, 0x28, 0x2e, 0xbb, 0xbb, 0x92, 0xab, 0x04,
+	0xe9, 0x21, 0x87, 0xbe, 0x40, 0xdf, 0xa2, 0x87, 0xbe, 0x45, 0xaf, 0xbd, 0xf4, 0xd2, 0x43, 0x8f,
+	0x79, 0x88, 0x1e, 0x0b, 0xee, 0x2e, 0x65, 0xea, 0x27, 0xb2, 0xdc, 0x9b, 0x76, 0xe6, 0xdb, 0x99,
+	0xf9, 0x86, 0xdf, 0xcc, 0x0a, 0x76, 0x03, 0xc6, 0x82, 0x10, 0xdd, 0x90, 0x05, 0x01, 0x8d, 0x02,
+	0x77, 0xd4, 0x4e, 0x7f, 0x3a, 0x31, 0x67, 0x92, 0x91, 0xeb, 0x1a, 0xe0, 0xa4, 0xd6, 0x51, 0xbb,
+	0xb6, 0x63, 0xee, 0xf8, 0x31, 0x75, 0xfd, 0x28, 0x62, 0xd2, 0x97, 0x94, 0x45, 0x42, 0x5f, 0xa8,
+	0xed, 0x65, 0xbc, 0x03, 0x16, 0x51, 0xc9, 0x38, 0xf6, 0x3b, 0x1c, 0x05, 0x1b, 0xf2, 0x1e, 0x1a,
+	0xd0, 0xa7, 0x0b, 0xd3, 0x76, 0x30, 0x92, 0x7c, 0x6c, 0x20, 0x77, 0x0c, 0x44, 0x9d, 0xba, 0xc3,
+	0x57, 0x6e, 0x7f, 0xc8, 0x55, 0x22, 0xe3, 0xaf, 0xcf, 0xfa, 0x71, 0x10, 0xcb, 0xf4, 0xf2, 0xee,
+	0xac, 0x53, 0xd2, 0x01, 0x0a, 0xe9, 0x0f, 0x62, 0x03, 0xd8, 0x36, 0x00, 0x1e, 0xf7, 0x5c, 0x21,
+	0x7d, 0x39, 0x34, 0xe5, 0xdb, 0xf7, 0xa1, 0xfc, 0x14, 0x43, 0x94, 0x78, 0xcc, 0x02, 0x0f, 0x7f,
+	0x1c, 0xa2, 0x90, 0xe4, 0x16, 0x14, 0x92, 0xea, 0x22, 0x7f, 0x80, 0x55, 0xab, 0x61, 0x35, 0x8b,
+	0xde, 0xd5, 0x90, 0x05, 0xdf, 0xfa, 0x03, 0xb4, 0xff, 0xce, 0x41, 0xe5, 0x05, 0xa7, 0x0a, 0x7e,
+	0x14, 0x49, 0x4e, 0x51, 0x5c, 0x7c, 0x8b, 0x3c, 0x82, 0x42, 0xda, 0x90, 0x6a, 0xae, 0x61, 0x35,
+	0x4b, 0xed, 0xdb, 0x8e, 0xe9, 0xb3, 0x1f, 0x53, 0xe7, 0x59, 0xda, 0x36, 0xcf, 0x80, 0xbc, 0x09,
+	0x9c, 0x3c, 0x83, 0xf5, 0xd0, 0xef, 0x62, 0x28, 0xaa, 0xf9, 0x46, 0xbe, 0x59, 0x6a, 0x3f, 0x70,
+	0xe6, 0x3e, 0x90, 0xb3, 0xb8, 0x20, 0xe7, 0x58, 0xdd, 0x4b, 0x8c, 0x63, 0xcf, 0x04, 0x21, 0x0f,
+	0xe0, 0x2a, 0x6a, 0x54, 0xf5, 0x8a, 0x8a, 0x57, 0x5f, 0x10, 0xcf, 0x84, 0x1a, 0x7b, 0x29, 0x96,
+	0xec, 0xc3, 0x66, 0xec, 0x73, 0x49, 0xfd, 0xb0, 0x23, 0x86, 0xbd, 0x1e, 0x0a, 0x51, 0x5d, 0x6b,
+	0x58, 0xcd, 0x82, 0xb7, 0x61, 0xcc, 0xa7, 0xda, 0x5a, 0x7b, 0x04, 0xa5, 0x4c, 0x5a, 0x52, 0x86,
+	0xfc, 0x6b, 0x1c, 0x9b, 0x76, 0x24, 0x3f, 0xc9, 0x4d, 0x58, 0x1b, 0xf9, 0xe1, 0x50, 0xf7, 0xa1,
+	0xe8, 0xe9, 0xc3, 0x41, 0xee, 0xa1, 0x65, 0xdf, 0x82, 0xed, 0x39, 0x22, 0x22, 0x66, 0x91, 0x40,
+	0xfb, 0x83, 0x05, 0x3b, 0x33, 0xbe, 0x13, 0x9d, 0xf7, 0x88, 0x73, 0xc6, 0x05, 0x19, 0x40, 0x79,
+	0xa2, 0xa7, 0x0e, 0x2a, 0x5b, 0xd5, 0x52, 0xfc, 0x9e, 0x5c, 0xdc, 0xaf, 0xa9, 0x50, 0x13, 0xf2,
+	0xfa, 0xa8, 0xfb, 0xb0, 0x11, 0x4e, 0x19, 0x6b, 0xdf, 0xc3, 0x8d, 0x05, 0xb0, 0x2c, 0xdb, 0x35,
+	0xcd, 0xb6, 0x99, 0x65, 0x5b, 0x6a, 0x93, 0xb4, 0x18, 0x1e, 0xf7, 0x9c, 0x53, 0x25, 0xc3, 0x6c,
+	0x07, 0xfe, 0xb4, 0x60, 0xeb, 0x98, 0x0a, 0x39, 0xaf, 0xad, 0x5d, 0x28, 0xc5, 0x9c, 0xfd, 0x80,
+	0x3d, 0xd9, 0xa1, 0x7d, 0x4d, 0xad, 0xe8, 0x81, 0x31, 0x7d, 0xd3, 0x17, 0xe4, 0x2e, 0x6c, 0xa4,
+	0x92, 0x51, 0x0a, 0x14, 0xd5, 0x82, 0xc2, 0x5c, 0x4b, 0xad, 0x89, 0x0e, 0x05, 0xa9, 0xc0, 0xfa,
+	0x2b, 0x1a, 0x4a, 0xe4, 0xa6, 0xfd, 0xe6, 0x94, 0x68, 0x97, 0xf1, 0x3e, 0xf2, 0x4e, 0x77, 0x5c,
+	0xcd, 0x6b, 0xed, 0xaa, 0xf3, 0xe1, 0x98, 0xd4, 0xa1, 0x18, 0xfb, 0x01, 0x76, 0x04, 0x7d, 0x83,
+	0xd5, 0x2b, 0x8a, 0x5a, 0x21, 0x31, 0x9c, 0xd2, 0x37, 0x48, 0x6e, 0x03, 0x28, 0xa7, 0x64, 0xaf,
+	0x31, 0x52, 0x92, 0x28, 0x7a, 0x0a, 0xfe, 0x5d, 0x62, 0xb0, 0xcf, 0xa0, 0x32, 0xcb, 0x47, 0x7f,
+	0xd1, 0xac, 0x0e, 0xad, 0x4b, 0xe8, 0xf0, 0x73, 0xd8, 0x8c, 0xf0, 0x27, 0xd9, 0xc9, 0x24, 0xd5,
+	0x44, 0xae, 0x25, 0xe6, 0x93, 0x49, 0x62, 0x84, 0xfd, 0x24, 0xf1, 0xdc, 0x60, 0x3d, 0x45, 0xd1,
+	0xe3, 0x34, 0x96, 0x8c, 0x4f, 0x5a, 0x3b, 0xc5, 0xcf, 0x5a, 0xca, 0x2f, 0x37, 0xcb, 0xef, 0x77,
+	0x0b, 0x9a, 0x17, 0xe7, 0x31, 0x94, 0x5f, 0xc2, 0xcd, 0xc9, 0x27, 0xea, 0x9f, 0xfb, 0x0d, 0xff,
+	0xfd, 0xa5, 0x0b, 0xe1, 0x3c, 0x9e, 0x77, 0x83, 0xcf, 0xe7, 0xb8, 0x44, 0x5f, 0x36, 0xcd, 0x07,
+	0x99, 0xf0, 0xaf, 0xc0, 0x7a, 0xec, 0x73, 0x8c, 0xa4, 0x99, 0x52, 0x73, 0x9a, 0xee, 0x4b, 0x6e,
+	0x69, 0x5f, 0xf2, 0xb3, 0x7d, 0x79, 0x01, 0xe5, 0xf3, 0x34, 0x86, 0x7e, 0x1d, 0x8a, 0xe9, 0x7a,
+	0xd4, 0xbb, 0xac, 0xe8, 0x15, 0xcc, 0x7e, 0x5c, 0xb9, 0xfe, 0xf6, 0x3f, 0x6b, 0x50, 0x3e, 0xd6,
+	0x02, 0x39, 0x45, 0x3e, 0xa2, 0x3d, 0x7c, 0xde, 0x26, 0x67, 0x50, 0x9c, 0xac, 0x70, 0xb2, 0xb7,
+	0x40, 0x47, 0xb3, 0x0b, 0xbe, 0x56, 0x49, 0x41, 0xe9, 0x7b, 0xe1, 0x1c, 0x25, 0x8f, 0x89, 0x7d,
+	0xff, 0xfd, 0x5f, 0x1f, 0x7e, 0xcd, 0xed, 0xb7, 0xee, 0xba, 0xa3, 0x76, 0x17, 0xa5, 0xff, 0x85,
+	0xfb, 0x36, 0xad, 0xf9, 0x2b, 0x33, 0x6c, 0xc2, 0x6d, 0x25, 0x4f, 0x97, 0x70, 0x5b, 0xef, 0xc8,
+	0x2f, 0x16, 0x6c, 0xce, 0xec, 0x12, 0x72, 0x6f, 0xe5, 0xfd, 0x5c, 0x6b, 0xad, 0x02, 0x35, 0x1b,
+	0x70, 0x47, 0x55, 0x56, 0xb1, 0xaf, 0x27, 0x4f, 0xa7, 0x99, 0x86, 0x83, 0xb3, 0x04, 0x7c, 0x60,
+	0xb5, 0xc8, 0x7b, 0x0b, 0x36, 0xa6, 0x07, 0x8d, 0x34, 0x17, 0xcd, 0xd3, 0xa2, 0xdd, 0x52, 0xbb,
+	0xb7, 0x02, 0xd2, 0x54, 0x51, 0x57, 0x55, 0x6c, 0xd9, 0xe5, 0x6c, 0x15, 0x21, 0x15, 0x32, 0x29,
+	0xe2, 0x0f, 0x0b, 0x1a, 0x17, 0x0d, 0x03, 0x39, 0xf8, 0x48, 0xb2, 0x15, 0x26, 0xb5, 0xf6, 0xf8,
+	0x7f, 0xdd, 0x35, 0xa5, 0x37, 0x55, 0xe9, 0x36, 0x69, 0x24, 0xa5, 0x0f, 0x96, 0x95, 0x38, 0x86,
+	0x42, 0x2a, 0x5e, 0x62, 0x7f, 0xbc, 0x37, 0x93, 0xb2, 0xf6, 0x96, 0x62, 0x4c, 0xfa, 0xcf, 0x54,
+	0xfa, 0x3b, 0x64, 0x27, 0x49, 0xff, 0x56, 0x8f, 0x58, 0x46, 0x52, 0xef, 0x94, 0xa6, 0x0e, 0x7f,
+	0x86, 0xad, 0x1e, 0x1b, 0xcc, 0xc7, 0x3b, 0xfc, 0xc4, 0x88, 0xfe, 0x24, 0xd1, 0xeb, 0x89, 0xf5,
+	0xf2, 0xa1, 0x81, 0x04, 0x2c, 0xf4, 0xa3, 0xc0, 0x61, 0x3c, 0x70, 0x03, 0x8c, 0x94, 0x9a, 0x5d,
+	0xed, 0xf2, 0x63, 0x2a, 0x32, 0x7f, 0xb7, 0x1e, 0x9b, 0x9f, 0xff, 0x5a, 0xd6, 0x6f, 0xb9, 0xed,
+	0xaf, 0xf5, 0xed, 0x27, 0x21, 0x1b, 0xf6, 0x1d, 0x13, 0xda, 0x79, 0xde, 0xee, 0xae, 0xab, 0x08,
+	0x5f, 0xfe, 0x17, 0x00, 0x00, 0xff, 0xff, 0xe2, 0xc4, 0xaa, 0x91, 0x26, 0x0a, 0x00, 0x00,
 }
diff --git a/components/engine/vendor/google.golang.org/genproto/googleapis/logging/v2/logging_config.pb.go b/components/engine/vendor/google.golang.org/genproto/googleapis/logging/v2/logging_config.pb.go
index c5cf56c522..f96a1a5bd5 100644
--- a/components/engine/vendor/google.golang.org/genproto/googleapis/logging/v2/logging_config.pb.go
+++ b/components/engine/vendor/google.golang.org/genproto/googleapis/logging/v2/logging_config.pb.go
@@ -54,7 +54,8 @@ func (LogSink_VersionFormat) EnumDescriptor() ([]byte, []int) { return fileDescr
 // Describes a sink used to export log entries to one of the following
 // destinations in any project: a Cloud Storage bucket, a BigQuery dataset, or a
 // Cloud Pub/Sub topic.  A logs filter controls which log entries are
-// exported. The sink must be created within a project or organization.
+// exported. The sink must be created within a project, organization, billing
+// account, or folder.
 type LogSink struct {
 	// Required. The client-assigned sink identifier, unique within the
 	// project. Example: `"my-syslog-errors-to-pubsub"`.  Sink identifiers are
@@ -102,6 +103,20 @@ type LogSink struct {
 	// Consult the destination service's documentation to determine the
 	// appropriate IAM roles to assign to the identity.
 	WriterIdentity string `protobuf:"bytes,8,opt,name=writer_identity,json=writerIdentity" json:"writer_identity,omitempty"`
+	// Optional. This field applies only to sinks owned by organizations and
+	// folders. If the field is false, the default, only the logs owned by the
+	// sink's parent resource are available for export. If the field is true, then
+	// logs from all the projects, folders, and billing accounts contained in the
+	// sink's parent resource are also available for export. Whether a particular
+	// log entry from the children is exported depends on the sink's filter
+	// expression. For example, if this field is true, then the filter
+	// `resource.type=gce_instance` would export all Compute Engine VM instance
+	// log entries from all projects in the sink's parent. To only export entries
+	// from certain child projects, filter on the project part of the log name:
+	//
+	//     logName:("projects/test-project1/" OR "projects/test-project2/") AND
+	//     resource.type=gce_instance
+	IncludeChildren bool `protobuf:"varint,9,opt,name=include_children,json=includeChildren" json:"include_children,omitempty"`
 	// Optional. The time at which this sink will begin exporting log entries.
 	// Log entries are exported only if their timestamp is not earlier than the
 	// start time.  The default value of this field is the time the sink is
@@ -155,6 +170,13 @@ func (m *LogSink) GetWriterIdentity() string {
 	return ""
 }
 
+func (m *LogSink) GetIncludeChildren() bool {
+	if m != nil {
+		return m.IncludeChildren
+	}
+	return false
+}
+
 func (m *LogSink) GetStartTime() *google_protobuf4.Timestamp {
 	if m != nil {
 		return m.StartTime
@@ -171,8 +193,12 @@ func (m *LogSink) GetEndTime() *google_protobuf4.Timestamp {
 
 // The parameters to `ListSinks`.
 type ListSinksRequest struct {
-	// Required. The parent resource whose sinks are to be listed.
-	// Examples: `"projects/my-logging-project"`, `"organizations/123456789"`.
+	// Required. The parent resource whose sinks are to be listed:
+	//
+	//     "projects/[PROJECT_ID]"
+	//     "organizations/[ORGANIZATION_ID]"
+	//     "billingAccounts/[BILLING_ACCOUNT_ID]"
+	//     "folders/[FOLDER_ID]"
 	Parent string `protobuf:"bytes,1,opt,name=parent" json:"parent,omitempty"`
 	// Optional. If present, then retrieve the next batch of results from the
 	// preceding call to this method.  `pageToken` must be the value of
@@ -242,10 +268,12 @@ func (m *ListSinksResponse) GetNextPageToken() string {
 
 // The parameters to `GetSink`.
 type GetSinkRequest struct {
-	// Required. The parent resource name of the sink:
+	// Required. The resource name of the sink:
 	//
 	//     "projects/[PROJECT_ID]/sinks/[SINK_ID]"
 	//     "organizations/[ORGANIZATION_ID]/sinks/[SINK_ID]"
+	//     "billingAccounts/[BILLING_ACCOUNT_ID]/sinks/[SINK_ID]"
+	//     "folders/[FOLDER_ID]/sinks/[SINK_ID]"
 	//
 	// Example: `"projects/my-project-id/sinks/my-sink-id"`.
 	SinkName string `protobuf:"bytes,1,opt,name=sink_name,json=sinkName" json:"sink_name,omitempty"`
@@ -269,6 +297,8 @@ type CreateSinkRequest struct {
 	//
 	//     "projects/[PROJECT_ID]"
 	//     "organizations/[ORGANIZATION_ID]"
+	//     "billingAccounts/[BILLING_ACCOUNT_ID]"
+	//     "folders/[FOLDER_ID]"
 	//
 	// Examples: `"projects/my-logging-project"`, `"organizations/123456789"`.
 	Parent string `protobuf:"bytes,1,opt,name=parent" json:"parent,omitempty"`
@@ -278,9 +308,9 @@ type CreateSinkRequest struct {
 	// Optional. Determines the kind of IAM identity returned as `writer_identity`
 	// in the new sink.  If this value is omitted or set to false, and if the
 	// sink's parent is a project, then the value returned as `writer_identity` is
-	// `cloud-logs@google.com`, the same identity used before the addition of
-	// writer identities to this API. The sink's destination must be in the same
-	// project as the sink itself.
+	// the same group or service account used by Stackdriver Logging before the
+	// addition of writer identities to this API. The sink's destination must be
+	// in the same project as the sink itself.
 	//
 	// If this field is set to true, or if the sink is owned by a non-project
 	// resource such as an organization, then the value of `writer_identity` will
@@ -322,6 +352,8 @@ type UpdateSinkRequest struct {
 	//
 	//     "projects/[PROJECT_ID]/sinks/[SINK_ID]"
 	//     "organizations/[ORGANIZATION_ID]/sinks/[SINK_ID]"
+	//     "billingAccounts/[BILLING_ACCOUNT_ID]/sinks/[SINK_ID]"
+	//     "folders/[FOLDER_ID]/sinks/[SINK_ID]"
 	//
 	// Example: `"projects/my-project-id/sinks/my-sink-id"`.
 	SinkName string `protobuf:"bytes,1,opt,name=sink_name,json=sinkName" json:"sink_name,omitempty"`
@@ -337,9 +369,9 @@ type UpdateSinkRequest struct {
 	//
 	// +   If the old and new values of this field are both false or both true,
 	//     then there is no change to the sink's `writer_identity`.
-	// +   If the old value was false and the new value is true, then
+	// +   If the old value is false and the new value is true, then
 	//     `writer_identity` is changed to a unique service account.
-	// +   It is an error if the old value was true and the new value is false.
+	// +   It is an error if the old value is true and the new value is false.
 	UniqueWriterIdentity bool `protobuf:"varint,3,opt,name=unique_writer_identity,json=uniqueWriterIdentity" json:"unique_writer_identity,omitempty"`
 }
 
@@ -376,10 +408,10 @@ type DeleteSinkRequest struct {
 	//
 	//     "projects/[PROJECT_ID]/sinks/[SINK_ID]"
 	//     "organizations/[ORGANIZATION_ID]/sinks/[SINK_ID]"
+	//     "billingAccounts/[BILLING_ACCOUNT_ID]/sinks/[SINK_ID]"
+	//     "folders/[FOLDER_ID]/sinks/[SINK_ID]"
 	//
-	// It is an error if the sink does not exist.  Example:
-	// `"projects/my-project-id/sinks/my-sink-id"`.  It is an error if
-	// the sink does not exist.
+	// Example: `"projects/my-project-id/sinks/my-sink-id"`.
 	SinkName string `protobuf:"bytes,1,opt,name=sink_name,json=sinkName" json:"sink_name,omitempty"`
 }
 
@@ -647,55 +679,57 @@ var _ConfigServiceV2_serviceDesc = grpc.ServiceDesc{
 func init() { proto.RegisterFile("google/logging/v2/logging_config.proto", fileDescriptor2) }
 
 var fileDescriptor2 = []byte{
-	// 787 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xbc, 0x55, 0xed, 0x4e, 0x33, 0x45,
-	0x14, 0x76, 0x0b, 0x94, 0xf6, 0x90, 0x17, 0xda, 0xd1, 0x17, 0x37, 0x8b, 0xaf, 0xd4, 0x15, 0xb0,
-	0xa9, 0x71, 0x17, 0x57, 0x4d, 0xfc, 0x88, 0x31, 0x52, 0x0a, 0x69, 0x82, 0xd0, 0x6c, 0xa1, 0x26,
-	0xc6, 0x64, 0xb3, 0xb4, 0xd3, 0xcd, 0x48, 0x77, 0x66, 0xd9, 0x9d, 0x56, 0x81, 0x90, 0xa8, 0x77,
-	0x40, 0x4c, 0xbc, 0x08, 0x6f, 0xc7, 0x5b, 0xf0, 0x3a, 0x8c, 0x99, 0x99, 0x2d, 0xb4, 0xdd, 0x5a,
-	0xf9, 0xe5, 0xaf, 0x9d, 0xf3, 0x35, 0xcf, 0x73, 0xce, 0x79, 0x32, 0x0b, 0x7b, 0x01, 0x63, 0xc1,
-	0x00, 0xdb, 0x03, 0x16, 0x04, 0x84, 0x06, 0xf6, 0xc8, 0x19, 0x1f, 0xbd, 0x2e, 0xa3, 0x7d, 0x12,
-	0x58, 0x51, 0xcc, 0x38, 0x43, 0x65, 0x95, 0x67, 0xa5, 0x41, 0x6b, 0xe4, 0x18, 0x6f, 0xa5, 0xa5,
-	0x7e, 0x44, 0x6c, 0x9f, 0x52, 0xc6, 0x7d, 0x4e, 0x18, 0x4d, 0x54, 0x81, 0xb1, 0x95, 0x46, 0xa5,
-	0x75, 0x39, 0xec, 0xdb, 0x38, 0x8c, 0xf8, 0x4d, 0x1a, 0xdc, 0x9e, 0x0d, 0x72, 0x12, 0xe2, 0x84,
-	0xfb, 0x61, 0xa4, 0x12, 0xcc, 0x87, 0x25, 0x58, 0x3d, 0x61, 0x41, 0x9b, 0xd0, 0x2b, 0x84, 0x60,
-	0x99, 0xfa, 0x21, 0xd6, 0xb5, 0x8a, 0x56, 0x2d, 0xba, 0xf2, 0x8c, 0x2a, 0xb0, 0xd6, 0xc3, 0x09,
-	0x27, 0x54, 0x62, 0xea, 0x4b, 0x32, 0x34, 0xe9, 0x42, 0x9b, 0x90, 0xef, 0x93, 0x01, 0xc7, 0xb1,
-	0xbe, 0x22, 0x83, 0xa9, 0x85, 0xbe, 0x87, 0x97, 0x6c, 0xc8, 0xa3, 0x21, 0xf7, 0x46, 0x38, 0x4e,
-	0x08, 0xa3, 0x5e, 0x9f, 0xc5, 0xa1, 0xcf, 0xf5, 0x7c, 0x45, 0xab, 0xae, 0x3b, 0x55, 0x2b, 0xd3,
-	0xa8, 0x95, 0x12, 0xb1, 0x3a, 0xaa, 0xe0, 0x48, 0xe6, 0xbb, 0xaf, 0xab, 0x6b, 0xa6, 0x9c, 0xe8,
-	0x3d, 0xd8, 0xf8, 0x31, 0x26, 0x1c, 0xc7, 0x1e, 0xe9, 0x61, 0xca, 0x09, 0xbf, 0xd1, 0x0b, 0x12,
-	0x7e, 0x5d, 0xb9, 0x9b, 0xa9, 0x17, 0x7d, 0x06, 0x90, 0x70, 0x3f, 0xe6, 0x9e, 0xe8, 0x5c, 0x87,
-	0x8a, 0x56, 0x5d, 0x73, 0x8c, 0x31, 0xf6, 0x78, 0x2c, 0xd6, 0xf9, 0x78, 0x2c, 0x6e, 0x51, 0x66,
-	0x0b, 0x1b, 0x7d, 0x02, 0x05, 0x4c, 0x7b, 0xaa, 0x70, 0xed, 0x3f, 0x0b, 0x57, 0x31, 0xed, 0x09,
-	0xcb, 0xfc, 0x0a, 0x5e, 0x4c, 0x73, 0x7d, 0x1b, 0x8c, 0x4e, 0xc3, 0x6d, 0x37, 0xcf, 0x4e, 0xbd,
-	0xa3, 0x33, 0xf7, 0x9b, 0xaf, 0xcf, 0xbd, 0x8b, 0xd3, 0x76, 0xab, 0x51, 0x6f, 0x1e, 0x35, 0x1b,
-	0x87, 0xa5, 0xd7, 0x50, 0x1e, 0x72, 0x1d, 0xa7, 0xa4, 0xc9, 0xef, 0x87, 0xa5, 0x9c, 0xd9, 0x87,
-	0xd2, 0x09, 0x49, 0xb8, 0x18, 0x45, 0xe2, 0xe2, 0xeb, 0x21, 0x4e, 0xb8, 0x98, 0x72, 0xe4, 0xc7,
-	0x98, 0xf2, 0x74, 0x3b, 0xa9, 0x85, 0x5e, 0x01, 0x44, 0x7e, 0x80, 0x3d, 0xce, 0xae, 0x30, 0xd5,
-	0x73, 0x32, 0x56, 0x14, 0x9e, 0x73, 0xe1, 0x40, 0x5b, 0x20, 0x0d, 0x2f, 0x21, 0xb7, 0x58, 0x2e,
-	0x6f, 0xc5, 0x2d, 0x08, 0x47, 0x9b, 0xdc, 0x62, 0x33, 0x84, 0xf2, 0x04, 0x4e, 0x12, 0x31, 0x9a,
-	0x60, 0xb4, 0x0f, 0x2b, 0x89, 0x70, 0xe8, 0x5a, 0x65, 0x69, 0xb2, 0xe3, 0xec, 0x9a, 0x5c, 0x95,
-	0x88, 0xf6, 0x60, 0x83, 0xe2, 0x9f, 0xb8, 0x97, 0xe1, 0xf1, 0x42, 0xb8, 0x5b, 0x63, 0x2e, 0xe6,
-	0x07, 0xb0, 0x7e, 0x8c, 0x25, 0xda, 0xb8, 0xa9, 0x2d, 0x28, 0x8a, 0x2b, 0xbc, 0x09, 0xd5, 0x15,
-	0x84, 0xe3, 0xd4, 0x0f, 0xb1, 0xf9, 0xa0, 0x41, 0xb9, 0x1e, 0x63, 0x9f, 0xe3, 0xc9, 0x92, 0x7f,
-	0x9b, 0x83, 0x05, 0xcb, 0xa2, 0x52, 0x22, 0x2f, 0x66, 0x2d, 0xf3, 0xd0, 0xc7, 0xb0, 0x39, 0xa4,
-	0xe4, 0x7a, 0x88, 0xbd, 0x59, 0x19, 0x89, 0x29, 0x15, 0xdc, 0x37, 0x54, 0xf4, 0xdb, 0x29, 0x31,
-	0x99, 0xbf, 0x6b, 0x50, 0xbe, 0x88, 0x7a, 0x33, 0x9c, 0x16, 0xb5, 0xf1, 0x3f, 0x11, 0xdb, 0x87,
-	0xf2, 0x21, 0x1e, 0xe0, 0xe7, 0xf3, 0x72, 0xfe, 0x5e, 0x86, 0x8d, 0xba, 0x7c, 0x78, 0xda, 0x38,
-	0x1e, 0x91, 0x2e, 0xee, 0x38, 0xe8, 0x1e, 0x8a, 0x8f, 0x82, 0x40, 0xef, 0xce, 0xa3, 0x3a, 0x23,
-	0x4b, 0x63, 0x67, 0x71, 0x92, 0xd2, 0x94, 0xb9, 0xfb, 0xeb, 0x9f, 0x7f, 0xfd, 0x96, 0xdb, 0x46,
-	0xaf, 0xc4, 0xab, 0x77, 0xa7, 0x36, 0xf6, 0x65, 0x14, 0xb3, 0x1f, 0x70, 0x97, 0x27, 0x76, 0xed,
-	0xde, 0x56, 0x42, 0xe2, 0xb0, 0x9a, 0x0a, 0x04, 0xbd, 0x33, 0xe7, 0xde, 0x69, 0xf1, 0x18, 0x0b,
-	0x46, 0x69, 0xd6, 0x24, 0xe0, 0x0e, 0x32, 0x25, 0xe0, 0xe3, 0x10, 0x26, 0x30, 0x15, 0xa4, 0x5d,
-	0xbb, 0x47, 0x77, 0x00, 0x4f, 0x32, 0x43, 0xf3, 0x1a, 0xca, 0xa8, 0x70, 0x21, 0xf6, 0xfb, 0x12,
-	0x7b, 0xd7, 0x5c, 0xdc, 0xec, 0xe7, 0x6a, 0xdb, 0x3f, 0x6b, 0x00, 0x4f, 0x82, 0x9a, 0x8b, 0x9e,
-	0xd1, 0xdb, 0x42, 0xf4, 0x7d, 0x89, 0x5e, 0x33, 0x9e, 0xd1, 0x79, 0x4a, 0x61, 0x04, 0xf0, 0x24,
-	0x9d, 0xb9, 0x0c, 0x32, 0xca, 0x32, 0x36, 0x33, 0xef, 0x60, 0x43, 0xfc, 0x74, 0xc6, 0x73, 0xaf,
-	0x3d, 0x03, 0xfd, 0xe0, 0x17, 0x0d, 0x5e, 0x76, 0x59, 0x98, 0xc5, 0x3b, 0x40, 0x27, 0xea, 0xac,
-	0xe4, 0xd9, 0x12, 0x10, 0x2d, 0xed, 0xbb, 0x4f, 0xd3, 0xc4, 0x80, 0x0d, 0x7c, 0x1a, 0x58, 0x2c,
-	0x0e, 0xec, 0x00, 0x53, 0x49, 0xc0, 0x56, 0x21, 0x3f, 0x22, 0xc9, 0xc4, 0xff, 0xf5, 0x8b, 0xf4,
-	0xf8, 0x47, 0xee, 0xcd, 0x63, 0x55, 0x5a, 0x1f, 0xb0, 0x61, 0xcf, 0x4a, 0x6f, 0xb7, 0x3a, 0xce,
-	0x65, 0x5e, 0x96, 0x7f, 0xf4, 0x4f, 0x00, 0x00, 0x00, 0xff, 0xff, 0xdc, 0x9e, 0xa5, 0xee, 0x9d,
-	0x07, 0x00, 0x00,
+	// 818 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xbc, 0x55, 0xff, 0x6e, 0xdb, 0x54,
+	0x14, 0xc6, 0xe9, 0xaf, 0xe4, 0x54, 0x6b, 0x93, 0x0b, 0x2b, 0x56, 0xca, 0x58, 0x30, 0xdb, 0x08,
+	0x41, 0xd8, 0x25, 0x80, 0xc4, 0x0f, 0x21, 0xc4, 0xb2, 0x76, 0xaa, 0x54, 0xba, 0xca, 0xe9, 0x82,
+	0x84, 0x90, 0x2c, 0x2f, 0x3e, 0x31, 0x97, 0xd9, 0xf7, 0x7a, 0xf6, 0x75, 0x60, 0x9b, 0x2a, 0x01,
+	0x6f, 0x80, 0x90, 0x78, 0x08, 0x9e, 0x81, 0xb7, 0xe0, 0x15, 0x78, 0x0e, 0x84, 0xee, 0x8f, 0xac,
+	0x69, 0x1d, 0x42, 0xff, 0xe2, 0xaf, 0xdc, 0xfb, 0x9d, 0x73, 0xee, 0xf7, 0x9d, 0x73, 0x3e, 0x39,
+	0x70, 0x27, 0xe6, 0x3c, 0x4e, 0xd0, 0x4b, 0x78, 0x1c, 0x53, 0x16, 0x7b, 0xd3, 0xfe, 0xec, 0x18,
+	0x8c, 0x39, 0x9b, 0xd0, 0xd8, 0xcd, 0x72, 0x2e, 0x38, 0x69, 0xe9, 0x3c, 0xd7, 0x04, 0xdd, 0x69,
+	0xbf, 0xfd, 0x9a, 0x29, 0x0d, 0x33, 0xea, 0x85, 0x8c, 0x71, 0x11, 0x0a, 0xca, 0x59, 0xa1, 0x0b,
+	0xda, 0xbb, 0x26, 0xaa, 0x6e, 0x8f, 0xca, 0x89, 0x87, 0x69, 0x26, 0x9e, 0x9a, 0xe0, 0xcd, 0xcb,
+	0x41, 0x41, 0x53, 0x2c, 0x44, 0x98, 0x66, 0x3a, 0xc1, 0xf9, 0x63, 0x05, 0x36, 0x8e, 0x78, 0x3c,
+	0xa4, 0xec, 0x31, 0x21, 0xb0, 0xca, 0xc2, 0x14, 0x6d, 0xab, 0x63, 0x75, 0x1b, 0xbe, 0x3a, 0x93,
+	0x0e, 0x6c, 0x46, 0x58, 0x08, 0xca, 0x14, 0xa7, 0xbd, 0xa2, 0x42, 0xf3, 0x10, 0xd9, 0x81, 0xf5,
+	0x09, 0x4d, 0x04, 0xe6, 0xf6, 0x9a, 0x0a, 0x9a, 0x1b, 0xf9, 0x06, 0xae, 0xf3, 0x52, 0x64, 0xa5,
+	0x08, 0xa6, 0x98, 0x17, 0x94, 0xb3, 0x60, 0xc2, 0xf3, 0x34, 0x14, 0xf6, 0x7a, 0xc7, 0xea, 0x6e,
+	0xf5, 0xbb, 0x6e, 0xa5, 0x51, 0xd7, 0x08, 0x71, 0x47, 0xba, 0xe0, 0x40, 0xe5, 0xfb, 0x2f, 0xeb,
+	0x67, 0x2e, 0x80, 0xe4, 0x2d, 0xd8, 0xfe, 0x3e, 0xa7, 0x02, 0xf3, 0x80, 0x46, 0xc8, 0x04, 0x15,
+	0x4f, 0xed, 0xba, 0xa2, 0xdf, 0xd2, 0xf0, 0xa1, 0x41, 0xc9, 0xdb, 0xd0, 0xa4, 0x6c, 0x9c, 0x94,
+	0x11, 0x06, 0xe3, 0x6f, 0x69, 0x12, 0xe5, 0xc8, 0xec, 0x46, 0xc7, 0xea, 0xd6, 0xfd, 0x6d, 0x83,
+	0x0f, 0x0c, 0x4c, 0x3e, 0x06, 0x28, 0x44, 0x98, 0x8b, 0x40, 0x0e, 0xc9, 0x86, 0x8e, 0xd5, 0xdd,
+	0xec, 0xb7, 0x67, 0x32, 0x67, 0x13, 0x74, 0x4f, 0x67, 0x13, 0xf4, 0x1b, 0x2a, 0x5b, 0xde, 0xc9,
+	0x87, 0x50, 0x47, 0x16, 0xe9, 0xc2, 0xcd, 0xff, 0x2c, 0xdc, 0x40, 0x16, 0xc9, 0x9b, 0xf3, 0x39,
+	0x5c, 0xbb, 0xd8, 0xd6, 0xeb, 0xd0, 0x1e, 0xed, 0xfb, 0xc3, 0xc3, 0x07, 0xc7, 0xc1, 0xc1, 0x03,
+	0xff, 0xcb, 0x2f, 0x4e, 0x83, 0x87, 0xc7, 0xc3, 0x93, 0xfd, 0xc1, 0xe1, 0xc1, 0xe1, 0xfe, 0xbd,
+	0xe6, 0x4b, 0x64, 0x1d, 0x6a, 0xa3, 0x7e, 0xd3, 0x52, 0xbf, 0xef, 0x35, 0x6b, 0xce, 0x04, 0x9a,
+	0x47, 0xb4, 0x10, 0x72, 0x6a, 0x85, 0x8f, 0x4f, 0x4a, 0x2c, 0x84, 0x5c, 0x48, 0x16, 0xe6, 0xc8,
+	0x84, 0x59, 0xa4, 0xb9, 0x91, 0x1b, 0x00, 0x59, 0x18, 0x63, 0x20, 0xf8, 0x63, 0x64, 0x76, 0x4d,
+	0xc5, 0x1a, 0x12, 0x39, 0x95, 0x00, 0xd9, 0x05, 0x75, 0x09, 0x0a, 0xfa, 0x0c, 0xd5, 0x9e, 0xd7,
+	0xfc, 0xba, 0x04, 0x86, 0xf4, 0x19, 0x3a, 0x29, 0xb4, 0xe6, 0x78, 0x8a, 0x8c, 0xb3, 0x02, 0xc9,
+	0x1e, 0xac, 0x15, 0x12, 0xb0, 0xad, 0xce, 0xca, 0x7c, 0xc7, 0xd5, 0x8d, 0xfa, 0x3a, 0x91, 0xdc,
+	0x81, 0x6d, 0x86, 0x3f, 0x88, 0xa0, 0xa2, 0xe3, 0x9a, 0x84, 0x4f, 0x66, 0x5a, 0x9c, 0x77, 0x61,
+	0xeb, 0x3e, 0x2a, 0xb6, 0x59, 0x53, 0xbb, 0xd0, 0x90, 0x4f, 0x04, 0x73, 0x06, 0xad, 0x4b, 0xe0,
+	0x38, 0x4c, 0xd1, 0xf9, 0xc5, 0x82, 0xd6, 0x20, 0xc7, 0x50, 0xe0, 0x7c, 0xc9, 0xbf, 0xcd, 0xc1,
+	0x85, 0x55, 0x59, 0xa9, 0x98, 0x97, 0xab, 0x56, 0x79, 0xe4, 0x03, 0xd8, 0x29, 0x19, 0x7d, 0x52,
+	0x62, 0x70, 0xd9, 0x71, 0x2b, 0xca, 0x47, 0xaf, 0xe8, 0xe8, 0x57, 0x17, 0x7c, 0xe7, 0xfc, 0x66,
+	0x41, 0xeb, 0x61, 0x16, 0x5d, 0xd2, 0xb4, 0xac, 0x8d, 0xff, 0x49, 0xd8, 0x1e, 0xb4, 0xee, 0x61,
+	0x82, 0x57, 0xd7, 0xd5, 0xff, 0x7b, 0x15, 0xb6, 0x07, 0xea, 0x1b, 0x35, 0xc4, 0x7c, 0x4a, 0xc7,
+	0x38, 0xea, 0x93, 0x33, 0x68, 0xbc, 0x30, 0x04, 0x79, 0x73, 0x91, 0xd4, 0x4b, 0xb6, 0x6c, 0xdf,
+	0x5a, 0x9e, 0xa4, 0x3d, 0xe5, 0xdc, 0xfe, 0xf9, 0xcf, 0xbf, 0x7e, 0xad, 0xdd, 0x24, 0x37, 0xe4,
+	0x07, 0xf2, 0xb9, 0xde, 0xd8, 0x67, 0x59, 0xce, 0xbf, 0xc3, 0xb1, 0x28, 0xbc, 0xde, 0x99, 0xa7,
+	0x8d, 0x24, 0x60, 0xc3, 0x18, 0x84, 0xbc, 0xb1, 0xe0, 0xdd, 0x8b, 0xe6, 0x69, 0x2f, 0x19, 0xa5,
+	0xd3, 0x53, 0x84, 0xb7, 0x88, 0xa3, 0x08, 0x5f, 0x0c, 0x61, 0x8e, 0x53, 0x53, 0x7a, 0xbd, 0x33,
+	0xf2, 0x1c, 0xe0, 0xdc, 0x66, 0x64, 0x51, 0x43, 0x15, 0x17, 0x2e, 0xe5, 0x7e, 0x47, 0x71, 0xdf,
+	0x76, 0x96, 0x37, 0xfb, 0x89, 0xde, 0xf6, 0x8f, 0x16, 0xc0, 0xb9, 0xa1, 0x16, 0xb2, 0x57, 0xfc,
+	0xb6, 0x94, 0x7d, 0x4f, 0xb1, 0xf7, 0xda, 0x57, 0xe8, 0xdc, 0x48, 0x98, 0x02, 0x9c, 0x5b, 0x67,
+	0xa1, 0x82, 0x8a, 0xb3, 0xda, 0x3b, 0x95, 0xef, 0xe0, 0xbe, 0xfc, 0x7f, 0x9a, 0xcd, 0xbd, 0x77,
+	0x05, 0xf6, 0xbb, 0x3f, 0x59, 0x70, 0x7d, 0xcc, 0xd3, 0x2a, 0xdf, 0x5d, 0x72, 0xa4, 0xcf, 0xda,
+	0x9e, 0x27, 0x92, 0xe2, 0xc4, 0xfa, 0xfa, 0x23, 0x93, 0x18, 0xf3, 0x24, 0x64, 0xb1, 0xcb, 0xf3,
+	0xd8, 0x8b, 0x91, 0x29, 0x01, 0x9e, 0x0e, 0x85, 0x19, 0x2d, 0xe6, 0xfe, 0x8a, 0x3f, 0x35, 0xc7,
+	0xdf, 0x6b, 0xaf, 0xde, 0xd7, 0xa5, 0x83, 0x84, 0x97, 0x91, 0x6b, 0x5e, 0x77, 0x47, 0xfd, 0x47,
+	0xeb, 0xaa, 0xfc, 0xfd, 0x7f, 0x02, 0x00, 0x00, 0xff, 0xff, 0xda, 0xa4, 0xe3, 0x1e, 0xc8, 0x07,
+	0x00, 0x00,
 }
diff --git a/components/engine/vendor/google.golang.org/genproto/googleapis/logging/v2/logging_metrics.pb.go b/components/engine/vendor/google.golang.org/genproto/googleapis/logging/v2/logging_metrics.pb.go
index ef047de752..24782649eb 100644
--- a/components/engine/vendor/google.golang.org/genproto/googleapis/logging/v2/logging_metrics.pb.go
+++ b/components/engine/vendor/google.golang.org/genproto/googleapis/logging/v2/logging_metrics.pb.go
@@ -8,6 +8,8 @@ import proto "github.com/golang/protobuf/proto"
 import fmt "fmt"
 import math "math"
 import _ "google.golang.org/genproto/googleapis/api/annotations"
+import _ "google.golang.org/genproto/googleapis/api/distribution"
+import _ "google.golang.org/genproto/googleapis/api/metric"
 import google_protobuf5 "github.com/golang/protobuf/ptypes/empty"
 
 import (
@@ -517,46 +519,47 @@ var _MetricsServiceV2_serviceDesc = grpc.ServiceDesc{
 func init() { proto.RegisterFile("google/logging/v2/logging_metrics.proto", fileDescriptor3) }
 
 var fileDescriptor3 = []byte{
-	// 646 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x55, 0x4f, 0x53, 0xd3, 0x40,
-	0x14, 0x77, 0x0b, 0x14, 0x79, 0x28, 0xc5, 0x65, 0x88, 0x9d, 0x80, 0x43, 0xcd, 0x01, 0x0a, 0x87,
-	0x44, 0xa3, 0xc3, 0xf8, 0x67, 0x3c, 0x00, 0x3a, 0x5c, 0xd0, 0xe9, 0x14, 0xed, 0xc1, 0x4b, 0x27,
-	0xb4, 0xaf, 0x99, 0x95, 0x34, 0x1b, 0x93, 0x6d, 0x07, 0x71, 0xb8, 0x30, 0xdc, 0x9c, 0xf1, 0xa0,
-	0xdf, 0xc2, 0x8f, 0xe0, 0xd7, 0xd0, 0x8f, 0xe0, 0x07, 0x71, 0xb2, 0xd9, 0x94, 0xd8, 0x46, 0xda,
-	0xe1, 0xd4, 0xdd, 0xf7, 0xef, 0xf7, 0x7b, 0xef, 0xfd, 0xba, 0x81, 0x0d, 0x97, 0x73, 0xd7, 0x43,
-	0xcb, 0xe3, 0xae, 0xcb, 0x7c, 0xd7, 0xea, 0xdb, 0xe9, 0xb1, 0xd9, 0x45, 0x11, 0xb2, 0x56, 0x64,
-	0x06, 0x21, 0x17, 0x9c, 0xde, 0x49, 0x02, 0x4d, 0xe5, 0x35, 0xfb, 0xb6, 0xbe, 0xaa, 0x72, 0x9d,
-	0x80, 0x59, 0x8e, 0xef, 0x73, 0xe1, 0x08, 0xc6, 0x7d, 0x95, 0xa0, 0xaf, 0x28, 0xaf, 0xbc, 0x1d,
-	0xf5, 0x3a, 0x16, 0x76, 0x03, 0xf1, 0x29, 0x71, 0x1a, 0x3f, 0x09, 0xcc, 0x1d, 0x70, 0xf7, 0xb5,
-	0x84, 0xa0, 0x14, 0xa6, 0x7d, 0xa7, 0x8b, 0x65, 0x52, 0x21, 0xd5, 0xb9, 0xba, 0x3c, 0xd3, 0x0a,
-	0xcc, 0xb7, 0x31, 0x6a, 0x85, 0x2c, 0x88, 0x8b, 0x96, 0x0b, 0xd2, 0x95, 0x35, 0x51, 0x0d, 0x8a,
-	0x1d, 0xe6, 0x09, 0x0c, 0xcb, 0x53, 0xd2, 0xa9, 0x6e, 0x74, 0x07, 0x66, 0xfb, 0x18, 0x46, 0x71,
-	0xd6, 0x74, 0x85, 0x54, 0x17, 0xec, 0x0d, 0x73, 0x84, 0xbb, 0x39, 0x00, 0x37, 0x77, 0x02, 0xd6,
-	0x48, 0xc2, 0xeb, 0x69, 0x9e, 0xb1, 0x0a, 0x70, 0x69, 0xa6, 0x45, 0x28, 0x34, 0xec, 0xc5, 0x1b,
-	0xf2, 0xf7, 0xe1, 0x22, 0x31, 0x8e, 0x61, 0xf9, 0x80, 0x45, 0x62, 0x50, 0x22, 0xaa, 0xe3, 0xc7,
-	0x1e, 0x46, 0x22, 0x66, 0x14, 0x38, 0x21, 0xfa, 0x42, 0x75, 0xa2, 0x6e, 0xf4, 0x1e, 0x40, 0xe0,
-	0xb8, 0xd8, 0x14, 0xfc, 0x18, 0xd3, 0x56, 0xe6, 0x62, 0xcb, 0xdb, 0xd8, 0x40, 0x57, 0x40, 0x5e,
-	0x9a, 0x11, 0x3b, 0x45, 0xd9, 0xcb, 0x4c, 0xfd, 0x66, 0x6c, 0x38, 0x64, 0xa7, 0x68, 0x9c, 0x80,
-	0x36, 0x0c, 0x16, 0x05, 0xdc, 0x8f, 0x90, 0x6e, 0xc3, 0xac, 0x5a, 0x51, 0x99, 0x54, 0xa6, 0xaa,
-	0xf3, 0xf6, 0xea, 0x55, 0x7d, 0xd6, 0xd3, 0x60, 0xba, 0x0e, 0x25, 0x1f, 0x4f, 0x44, 0x73, 0x84,
-	0xd2, 0xed, 0xd8, 0x5c, 0x4b, 0x69, 0x19, 0xdb, 0xb0, 0xb4, 0x8f, 0x97, 0xc0, 0x69, 0x93, 0x6b,
-	0x30, 0x9f, 0x54, 0x6a, 0x66, 0x76, 0x06, 0x89, 0xe9, 0x8d, 0xd3, 0x45, 0xa3, 0x03, 0xda, 0x5e,
-	0x88, 0x8e, 0xc0, 0x91, 0xd4, 0xff, 0xcd, 0xe7, 0x31, 0x14, 0x93, 0x7c, 0x49, 0x64, 0x5c, 0x23,
-	0x2a, 0xd6, 0xe0, 0xa0, 0xbd, 0x0b, 0xda, 0x79, 0x38, 0xe3, 0x28, 0x5e, 0x13, 0xf0, 0x29, 0x68,
-	0x2f, 0xd1, 0xc3, 0x6b, 0x00, 0xda, 0xbf, 0x67, 0x60, 0x51, 0xed, 0xef, 0x10, 0xc3, 0x3e, 0x6b,
-	0x61, 0xc3, 0xa6, 0x5f, 0x09, 0x2c, 0xfc, 0xbb, 0x5b, 0x5a, 0xcd, 0x23, 0x92, 0xa7, 0x35, 0x7d,
-	0x73, 0x82, 0xc8, 0x44, 0x28, 0xc6, 0xc6, 0xf9, 0xaf, 0x3f, 0xdf, 0x0b, 0xf7, 0xe9, 0x5a, 0xfc,
-	0xef, 0xfe, 0x9c, 0xcc, 0xfc, 0x45, 0x10, 0xf2, 0x0f, 0xd8, 0x12, 0x91, 0xb5, 0x75, 0x66, 0xa5,
-	0xca, 0xb8, 0x20, 0x70, 0x2b, 0xbb, 0x72, 0xba, 0x9e, 0x03, 0x92, 0xa3, 0x09, 0xfd, 0xca, 0xf9,
-	0x19, 0xa6, 0xc4, 0xaf, 0xd2, 0x75, 0x89, 0x9f, 0x19, 0x54, 0x86, 0x44, 0xca, 0xc1, 0xda, 0x3a,
-	0xa3, 0x5f, 0x08, 0x94, 0x86, 0x14, 0x44, 0xf3, 0xda, 0xcd, 0x57, 0xd9, 0x18, 0x32, 0x96, 0x24,
-	0xb3, 0x69, 0x8c, 0x1b, 0xc6, 0x33, 0xb5, 0x75, 0xfa, 0x8d, 0x40, 0x69, 0x48, 0x67, 0xb9, 0x6c,
-	0xf2, 0xb5, 0x38, 0x86, 0xcd, 0xb6, 0x64, 0xf3, 0x40, 0x9f, 0x70, 0x34, 0x03, 0x52, 0x17, 0x04,
-	0x4a, 0x43, 0x5a, 0xcc, 0x25, 0x95, 0xaf, 0x57, 0x5d, 0x4b, 0x43, 0xd3, 0xc7, 0xd9, 0x7c, 0x15,
-	0x3f, 0xce, 0xe9, 0xa6, 0xb6, 0x26, 0xa4, 0xb3, 0x7b, 0x4e, 0x60, 0xb9, 0xc5, 0xbb, 0xa3, 0xc0,
-	0xbb, 0x4b, 0x07, 0xc9, 0x59, 0x69, 0xb1, 0x16, 0xe3, 0xd4, 0xc8, 0xfb, 0x27, 0x2a, 0xd2, 0xe5,
-	0x9e, 0xe3, 0xbb, 0x26, 0x0f, 0x5d, 0xcb, 0x45, 0x5f, 0xb2, 0xb0, 0x12, 0x97, 0x13, 0xb0, 0x28,
-	0xf3, 0x35, 0x7a, 0xae, 0x8e, 0x3f, 0x0a, 0x77, 0xf7, 0x93, 0xd4, 0x3d, 0x8f, 0xf7, 0xda, 0xa6,
-	0x2a, 0x6f, 0x36, 0xec, 0xa3, 0xa2, 0x4c, 0x7f, 0xf4, 0x37, 0x00, 0x00, 0xff, 0xff, 0x52, 0x8b,
-	0x69, 0xfe, 0xcb, 0x06, 0x00, 0x00,
+	// 665 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x55, 0x4f, 0x4f, 0x13, 0x41,
+	0x14, 0x77, 0x0a, 0x14, 0x79, 0x28, 0xc5, 0x21, 0x94, 0xa6, 0x40, 0xa8, 0x7b, 0x80, 0xc2, 0x61,
+	0x57, 0x57, 0x43, 0xfc, 0x13, 0x0f, 0x80, 0x86, 0x0b, 0x1a, 0x52, 0xb4, 0x07, 0x2f, 0xcd, 0xd2,
+	0x3e, 0x36, 0x23, 0xed, 0xce, 0xba, 0x33, 0x6d, 0x10, 0xc3, 0x85, 0x70, 0x33, 0xf1, 0xa0, 0xdf,
+	0xc2, 0x8f, 0xe0, 0xd7, 0xd0, 0x8f, 0xe0, 0x07, 0x31, 0x3b, 0x33, 0x0b, 0x6b, 0xbb, 0xd2, 0x86,
+	0x53, 0x67, 0xde, 0xef, 0xbd, 0xfd, 0xfd, 0xde, 0x7b, 0xbf, 0x4c, 0x61, 0xcd, 0xe7, 0xdc, 0x6f,
+	0xa3, 0xd3, 0xe6, 0xbe, 0xcf, 0x02, 0xdf, 0xe9, 0xb9, 0xc9, 0xb1, 0xd1, 0x41, 0x19, 0xb1, 0xa6,
+	0xb0, 0xc3, 0x88, 0x4b, 0x4e, 0xef, 0xe9, 0x44, 0xdb, 0xa0, 0x76, 0xcf, 0x2d, 0x2f, 0x99, 0x5a,
+	0x2f, 0x64, 0x8e, 0x17, 0x04, 0x5c, 0x7a, 0x92, 0xf1, 0xc0, 0x14, 0x94, 0x97, 0x53, 0x68, 0x8b,
+	0x09, 0x19, 0xb1, 0xc3, 0x6e, 0x8c, 0x1b, 0x78, 0x21, 0x05, 0x6b, 0x26, 0x03, 0x2c, 0x1a, 0x40,
+	0xdd, 0x0e, 0xbb, 0x47, 0x0e, 0x76, 0x42, 0xf9, 0x49, 0x83, 0xd6, 0x4f, 0x02, 0x53, 0x7b, 0xdc,
+	0x7f, 0xad, 0x0a, 0x28, 0x85, 0xf1, 0xc0, 0xeb, 0x60, 0x89, 0x54, 0x48, 0x75, 0xaa, 0xa6, 0xce,
+	0xb4, 0x02, 0xd3, 0x2d, 0x14, 0xcd, 0x88, 0x85, 0x31, 0x59, 0x29, 0xa7, 0xa0, 0x74, 0x88, 0x16,
+	0x21, 0x7f, 0xc4, 0xda, 0x12, 0xa3, 0xd2, 0x98, 0x02, 0xcd, 0x8d, 0x6e, 0xc1, 0x64, 0x0f, 0x23,
+	0x11, 0x57, 0x8d, 0x57, 0x48, 0x75, 0xc6, 0x5d, 0xb3, 0x07, 0x7a, 0xb6, 0x2f, 0xc9, 0xed, 0xad,
+	0x90, 0xd5, 0x75, 0x7a, 0x2d, 0xa9, 0xb3, 0x96, 0x00, 0xae, 0xc2, 0x34, 0x0f, 0xb9, 0xba, 0x3b,
+	0x7b, 0x4b, 0xfd, 0x3e, 0x9c, 0x25, 0xd6, 0x31, 0xcc, 0xef, 0x31, 0x21, 0x2f, 0x3f, 0x21, 0x6a,
+	0xf8, 0xb1, 0x8b, 0x42, 0xc6, 0x8a, 0x42, 0x2f, 0xc2, 0x40, 0x9a, 0x4e, 0xcc, 0x8d, 0x2e, 0x03,
+	0x84, 0x9e, 0x8f, 0x0d, 0xc9, 0x8f, 0x31, 0x69, 0x65, 0x2a, 0x8e, 0xbc, 0x8d, 0x03, 0x74, 0x11,
+	0xd4, 0xa5, 0x21, 0xd8, 0x29, 0xaa, 0x5e, 0x26, 0x6a, 0xb7, 0xe3, 0xc0, 0x01, 0x3b, 0x45, 0xeb,
+	0x04, 0x8a, 0xfd, 0x64, 0x22, 0xe4, 0x81, 0x40, 0xba, 0x09, 0x93, 0x66, 0xb5, 0x25, 0x52, 0x19,
+	0xab, 0x4e, 0xbb, 0x4b, 0xd7, 0xf5, 0x59, 0x4b, 0x92, 0xe9, 0x2a, 0x14, 0x02, 0x3c, 0x91, 0x8d,
+	0x01, 0x49, 0x77, 0xe3, 0xf0, 0x7e, 0x22, 0xcb, 0xda, 0x84, 0xb9, 0x5d, 0xbc, 0x22, 0x4e, 0x9a,
+	0x5c, 0x81, 0x69, 0xfd, 0xa5, 0x46, 0x6a, 0x67, 0xa0, 0x43, 0x6f, 0xbc, 0x0e, 0x5a, 0x47, 0x50,
+	0xdc, 0x89, 0xd0, 0x93, 0x38, 0x50, 0xfa, 0xbf, 0xf9, 0x3c, 0x86, 0xbc, 0xae, 0x57, 0x42, 0x86,
+	0x35, 0x62, 0x72, 0x2d, 0x0e, 0xc5, 0x77, 0x61, 0x2b, 0x8b, 0x67, 0x98, 0xc4, 0x1b, 0x12, 0x3e,
+	0x85, 0xe2, 0x4b, 0x6c, 0xe3, 0x0d, 0x08, 0xdd, 0xdf, 0x13, 0x30, 0x6b, 0xf6, 0x77, 0x80, 0x51,
+	0x8f, 0x35, 0xb1, 0xee, 0xd2, 0xaf, 0x04, 0x66, 0xfe, 0xdd, 0x2d, 0xad, 0x66, 0x09, 0xc9, 0xf2,
+	0x5a, 0x79, 0x7d, 0x84, 0x4c, 0x6d, 0x14, 0x6b, 0xed, 0xfc, 0xd7, 0x9f, 0xef, 0xb9, 0xfb, 0x74,
+	0x25, 0x7e, 0x15, 0x3e, 0xeb, 0x99, 0xbf, 0x08, 0x23, 0xfe, 0x01, 0x9b, 0x52, 0x38, 0x1b, 0x67,
+	0x4e, 0xe2, 0x8c, 0x0b, 0x02, 0x77, 0xd2, 0x2b, 0xa7, 0xab, 0x19, 0x24, 0x19, 0x9e, 0x28, 0x5f,
+	0x3b, 0x3f, 0xcb, 0x56, 0xfc, 0x55, 0xba, 0xaa, 0xf8, 0x53, 0x83, 0x4a, 0x89, 0x48, 0x34, 0x38,
+	0x1b, 0x67, 0xf4, 0x0b, 0x81, 0x42, 0x9f, 0x83, 0x68, 0x56, 0xbb, 0xd9, 0x2e, 0x1b, 0x22, 0xc6,
+	0x51, 0x62, 0xd6, 0xad, 0x61, 0xc3, 0x78, 0x66, 0xb6, 0x4e, 0xbf, 0x11, 0x28, 0xf4, 0xf9, 0x2c,
+	0x53, 0x4d, 0xb6, 0x17, 0x87, 0xa8, 0xd9, 0x54, 0x6a, 0x1e, 0x94, 0x47, 0x1c, 0xcd, 0xa5, 0xa8,
+	0x0b, 0x02, 0x85, 0x3e, 0x2f, 0x66, 0x8a, 0xca, 0xf6, 0x6b, 0xb9, 0x98, 0xa4, 0x26, 0x8f, 0xb3,
+	0xfd, 0x2a, 0x7e, 0x9c, 0x93, 0x4d, 0x6d, 0x8c, 0x28, 0x67, 0xfb, 0x9c, 0xc0, 0x7c, 0x93, 0x77,
+	0x06, 0x89, 0xb7, 0xe7, 0xf6, 0xf4, 0xd9, 0x78, 0x71, 0x3f, 0xe6, 0xd9, 0x27, 0xef, 0x9f, 0x98,
+	0x4c, 0x9f, 0xb7, 0xbd, 0xc0, 0xb7, 0x79, 0xe4, 0x3b, 0x3e, 0x06, 0x4a, 0x85, 0xa3, 0x21, 0x2f,
+	0x64, 0x22, 0xf5, 0x2f, 0xf6, 0xdc, 0x1c, 0x7f, 0xe4, 0x16, 0x76, 0x75, 0xe9, 0x4e, 0x9b, 0x77,
+	0x5b, 0xb6, 0xf9, 0xbc, 0x5d, 0x77, 0x0f, 0xf3, 0xaa, 0xfc, 0xd1, 0xdf, 0x00, 0x00, 0x00, 0xff,
+	0xff, 0x22, 0xd3, 0x7f, 0x20, 0x03, 0x07, 0x00, 0x00,
 }
diff --git a/components/engine/vendor/google.golang.org/grpc/README.md b/components/engine/vendor/google.golang.org/grpc/README.md
index 110a8cf425..ae0236f92f 100644
--- a/components/engine/vendor/google.golang.org/grpc/README.md
+++ b/components/engine/vendor/google.golang.org/grpc/README.md
@@ -1,4 +1,4 @@
-#gRPC-Go
+# gRPC-Go
 
 [![Build Status](https://travis-ci.org/grpc/grpc-go.svg)](https://travis-ci.org/grpc/grpc-go) [![GoDoc](https://godoc.org/google.golang.org/grpc?status.svg)](https://godoc.org/google.golang.org/grpc)
 
@@ -16,7 +16,7 @@ $ go get google.golang.org/grpc
 Prerequisites
 -------------
 
-This requires Go 1.5 or later.
+This requires Go 1.6 or later.
 
 Constraints
 -----------
@@ -30,3 +30,12 @@ Status
 ------
 GA
 
+FAQ
+---
+
+#### Compiling error, undefined: grpc.SupportPackageIsVersion
+
+Please update proto package, gRPC package and rebuild the proto files:
+ - `go get -u github.com/golang/protobuf/{proto,protoc-gen-go}`
+ - `go get -u google.golang.org/grpc`
+ - `protoc --go_out=plugins=grpc:. *.proto`
diff --git a/components/engine/vendor/google.golang.org/grpc/call.go b/components/engine/vendor/google.golang.org/grpc/call.go
index 772c817edd..af34a71316 100644
--- a/components/engine/vendor/google.golang.org/grpc/call.go
+++ b/components/engine/vendor/google.golang.org/grpc/call.go
@@ -36,12 +36,14 @@ package grpc
 import (
 	"bytes"
 	"io"
-	"math"
 	"time"
 
 	"golang.org/x/net/context"
 	"golang.org/x/net/trace"
 	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/stats"
+	"google.golang.org/grpc/status"
 	"google.golang.org/grpc/transport"
 )
 
@@ -49,7 +51,8 @@ import (
 // On error, it returns the error and indicates whether the call should be retried.
 //
 // TODO(zhaoq): Check whether the received message sequence is valid.
-func recvResponse(dopts dialOptions, t transport.ClientTransport, c *callInfo, stream *transport.Stream, reply interface{}) (err error) {
+// TODO ctx is used for stats collection and processing. It is the context passed from the application.
+func recvResponse(ctx context.Context, dopts dialOptions, t transport.ClientTransport, c *callInfo, stream *transport.Stream, reply interface{}) (err error) {
 	// Try to acquire header metadata from the server if there is any.
 	defer func() {
 		if err != nil {
@@ -63,24 +66,34 @@ func recvResponse(dopts dialOptions, t transport.ClientTransport, c *callInfo, s
 		return
 	}
 	p := &parser{r: stream}
+	var inPayload *stats.InPayload
+	if dopts.copts.StatsHandler != nil {
+		inPayload = &stats.InPayload{
+			Client: true,
+		}
+	}
 	for {
-		if err = recv(p, dopts.codec, stream, dopts.dc, reply, math.MaxInt32); err != nil {
+		if err = recv(p, dopts.codec, stream, dopts.dc, reply, dopts.maxMsgSize, inPayload); err != nil {
 			if err == io.EOF {
 				break
 			}
 			return
 		}
 	}
+	if inPayload != nil && err == io.EOF && stream.Status().Code() == codes.OK {
+		// TODO in the current implementation, inTrailer may be handled before inPayload in some cases.
+		// Fix the order if necessary.
+		dopts.copts.StatsHandler.HandleRPC(ctx, inPayload)
+	}
 	c.trailerMD = stream.Trailer()
+	if peer, ok := peer.FromContext(stream.Context()); ok {
+		c.peer = peer
+	}
 	return nil
 }
 
 // sendRequest writes out various information of an RPC such as Context and Message.
-func sendRequest(ctx context.Context, codec Codec, compressor Compressor, callHdr *transport.CallHdr, t transport.ClientTransport, args interface{}, opts *transport.Options) (_ *transport.Stream, err error) {
-	stream, err := t.NewStream(ctx, callHdr)
-	if err != nil {
-		return nil, err
-	}
+func sendRequest(ctx context.Context, dopts dialOptions, compressor Compressor, callHdr *transport.CallHdr, stream *transport.Stream, t transport.ClientTransport, args interface{}, opts *transport.Options) (err error) {
 	defer func() {
 		if err != nil {
 			// If err is connection error, t will be closed, no need to close stream here.
@@ -89,23 +102,35 @@ func sendRequest(ctx context.Context, codec Codec, compressor Compressor, callHd
 			}
 		}
 	}()
-	var cbuf *bytes.Buffer
+	var (
+		cbuf       *bytes.Buffer
+		outPayload *stats.OutPayload
+	)
 	if compressor != nil {
 		cbuf = new(bytes.Buffer)
 	}
-	outBuf, err := encode(codec, args, compressor, cbuf)
+	if dopts.copts.StatsHandler != nil {
+		outPayload = &stats.OutPayload{
+			Client: true,
+		}
+	}
+	outBuf, err := encode(dopts.codec, args, compressor, cbuf, outPayload)
 	if err != nil {
-		return nil, Errorf(codes.Internal, "grpc: %v", err)
+		return Errorf(codes.Internal, "grpc: %v", err)
 	}
 	err = t.Write(stream, outBuf, opts)
+	if err == nil && outPayload != nil {
+		outPayload.SentTime = time.Now()
+		dopts.copts.StatsHandler.HandleRPC(ctx, outPayload)
+	}
 	// t.NewStream(...) could lead to an early rejection of the RPC (e.g., the service/method
 	// does not exist.) so that t.Write could get io.EOF from wait(...). Leave the following
 	// recvResponse to get the final status.
 	if err != nil && err != io.EOF {
-		return nil, err
+		return err
 	}
 	// Sent successfully.
-	return stream, nil
+	return nil
 }
 
 // Invoke sends the RPC request on the wire and returns after response is received.
@@ -118,8 +143,16 @@ func Invoke(ctx context.Context, method string, args, reply interface{}, cc *Cli
 	return invoke(ctx, method, args, reply, cc, opts...)
 }
 
-func invoke(ctx context.Context, method string, args, reply interface{}, cc *ClientConn, opts ...CallOption) (err error) {
+func invoke(ctx context.Context, method string, args, reply interface{}, cc *ClientConn, opts ...CallOption) (e error) {
 	c := defaultCallInfo
+	if mc, ok := cc.getMethodConfig(method); ok {
+		c.failFast = !mc.WaitForReady
+		if mc.Timeout > 0 {
+			var cancel context.CancelFunc
+			ctx, cancel = context.WithTimeout(ctx, mc.Timeout)
+			defer cancel()
+		}
+	}
 	for _, o := range opts {
 		if err := o.before(&c); err != nil {
 			return toRPCErr(err)
@@ -140,12 +173,33 @@ func invoke(ctx context.Context, method string, args, reply interface{}, cc *Cli
 		c.traceInfo.tr.LazyLog(&c.traceInfo.firstLine, false)
 		// TODO(dsymonds): Arrange for c.traceInfo.firstLine.remoteAddr to be set.
 		defer func() {
-			if err != nil {
-				c.traceInfo.tr.LazyLog(&fmtStringer{"%v", []interface{}{err}}, true)
+			if e != nil {
+				c.traceInfo.tr.LazyLog(&fmtStringer{"%v", []interface{}{e}}, true)
 				c.traceInfo.tr.SetError()
 			}
 		}()
 	}
+	ctx = newContextWithRPCInfo(ctx)
+	sh := cc.dopts.copts.StatsHandler
+	if sh != nil {
+		ctx = sh.TagRPC(ctx, &stats.RPCTagInfo{FullMethodName: method})
+		begin := &stats.Begin{
+			Client:    true,
+			BeginTime: time.Now(),
+			FailFast:  c.failFast,
+		}
+		sh.HandleRPC(ctx, begin)
+	}
+	defer func() {
+		if sh != nil {
+			end := &stats.End{
+				Client:  true,
+				EndTime: time.Now(),
+				Error:   e,
+			}
+			sh.HandleRPC(ctx, end)
+		}
+	}()
 	topts := &transport.Options{
 		Last:  true,
 		Delay: false,
@@ -167,13 +221,14 @@ func invoke(ctx context.Context, method string, args, reply interface{}, cc *Cli
 		if cc.dopts.cp != nil {
 			callHdr.SendCompress = cc.dopts.cp.Type()
 		}
+
 		gopts := BalancerGetOptions{
 			BlockingWait: !c.failFast,
 		}
 		t, put, err = cc.getTransport(ctx, gopts)
 		if err != nil {
 			// TODO(zhaoq): Probably revisit the error handling.
-			if _, ok := err.(*rpcError); ok {
+			if _, ok := status.FromError(err); ok {
 				return err
 			}
 			if err == errConnClosing || err == errConnUnavailable {
@@ -188,33 +243,49 @@ func invoke(ctx context.Context, method string, args, reply interface{}, cc *Cli
 		if c.traceInfo.tr != nil {
 			c.traceInfo.tr.LazyLog(&payload{sent: true, msg: args}, true)
 		}
-		stream, err = sendRequest(ctx, cc.dopts.codec, cc.dopts.cp, callHdr, t, args, topts)
+		stream, err = t.NewStream(ctx, callHdr)
 		if err != nil {
 			if put != nil {
-				put()
-				put = nil
-			}
-			// Retry a non-failfast RPC when
-			// i) there is a connection error; or
-			// ii) the server started to drain before this RPC was initiated.
-			if _, ok := err.(transport.ConnectionError); ok || err == transport.ErrStreamDrain {
-				if c.failFast {
-					return toRPCErr(err)
+				if _, ok := err.(transport.ConnectionError); ok {
+					// If error is connection error, transport was sending data on wire,
+					// and we are not sure if anything has been sent on wire.
+					// If error is not connection error, we are sure nothing has been sent.
+					updateRPCInfoInContext(ctx, rpcInfo{bytesSent: true, bytesReceived: false})
 				}
+				put()
+			}
+			if _, ok := err.(transport.ConnectionError); (ok || err == transport.ErrStreamDrain) && !c.failFast {
 				continue
 			}
 			return toRPCErr(err)
 		}
-		err = recvResponse(cc.dopts, t, &c, stream, reply)
+		err = sendRequest(ctx, cc.dopts, cc.dopts.cp, callHdr, stream, t, args, topts)
 		if err != nil {
 			if put != nil {
+				updateRPCInfoInContext(ctx, rpcInfo{
+					bytesSent:     stream.BytesSent(),
+					bytesReceived: stream.BytesReceived(),
+				})
 				put()
-				put = nil
 			}
-			if _, ok := err.(transport.ConnectionError); ok || err == transport.ErrStreamDrain {
-				if c.failFast {
-					return toRPCErr(err)
-				}
+			// Retry a non-failfast RPC when
+			// i) there is a connection error; or
+			// ii) the server started to drain before this RPC was initiated.
+			if _, ok := err.(transport.ConnectionError); (ok || err == transport.ErrStreamDrain) && !c.failFast {
+				continue
+			}
+			return toRPCErr(err)
+		}
+		err = recvResponse(ctx, cc.dopts, t, &c, stream, reply)
+		if err != nil {
+			if put != nil {
+				updateRPCInfoInContext(ctx, rpcInfo{
+					bytesSent:     stream.BytesSent(),
+					bytesReceived: stream.BytesReceived(),
+				})
+				put()
+			}
+			if _, ok := err.(transport.ConnectionError); (ok || err == transport.ErrStreamDrain) && !c.failFast {
 				continue
 			}
 			return toRPCErr(err)
@@ -224,9 +295,12 @@ func invoke(ctx context.Context, method string, args, reply interface{}, cc *Cli
 		}
 		t.CloseStream(stream, nil)
 		if put != nil {
+			updateRPCInfoInContext(ctx, rpcInfo{
+				bytesSent:     stream.BytesSent(),
+				bytesReceived: stream.BytesReceived(),
+			})
 			put()
-			put = nil
 		}
-		return Errorf(stream.StatusCode(), "%s", stream.StatusDesc())
+		return stream.Status().Err()
 	}
 }
diff --git a/components/engine/vendor/google.golang.org/grpc/clientconn.go b/components/engine/vendor/google.golang.org/grpc/clientconn.go
index 61674729a7..f542d8bd04 100644
--- a/components/engine/vendor/google.golang.org/grpc/clientconn.go
+++ b/components/engine/vendor/google.golang.org/grpc/clientconn.go
@@ -36,8 +36,8 @@ package grpc
 import (
 	"errors"
 	"fmt"
+	"math"
 	"net"
-	"strings"
 	"sync"
 	"time"
 
@@ -45,6 +45,8 @@ import (
 	"golang.org/x/net/trace"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/keepalive"
+	"google.golang.org/grpc/stats"
 	"google.golang.org/grpc/transport"
 )
 
@@ -54,6 +56,8 @@ var (
 	ErrClientConnClosing = errors.New("grpc: the client connection is closing")
 	// ErrClientConnTimeout indicates that the ClientConn cannot establish the
 	// underlying connections within the specified timeout.
+	// DEPRECATED: Please use context.DeadlineExceeded instead. This error will be
+	// removed in Q1 2017.
 	ErrClientConnTimeout = errors.New("grpc: timed out when dialing")
 
 	// errNoTransportSecurity indicates that there is no transport security
@@ -75,7 +79,6 @@ var (
 	errConnClosing = errors.New("grpc: the connection is closing")
 	// errConnUnavailable indicates that the connection is unavailable.
 	errConnUnavailable = errors.New("grpc: the connection is unavailable")
-	errNoAddr          = errors.New("grpc: there is no address available to dial")
 	// minimum time to give a connection to complete
 	minConnectTimeout = 20 * time.Second
 )
@@ -83,22 +86,33 @@ var (
 // dialOptions configure a Dial call. dialOptions are set by the DialOption
 // values passed to Dial.
 type dialOptions struct {
-	unaryInt  UnaryClientInterceptor
-	streamInt StreamClientInterceptor
-	codec     Codec
-	cp        Compressor
-	dc        Decompressor
-	bs        backoffStrategy
-	balancer  Balancer
-	block     bool
-	insecure  bool
-	timeout   time.Duration
-	copts     transport.ConnectOptions
+	unaryInt   UnaryClientInterceptor
+	streamInt  StreamClientInterceptor
+	codec      Codec
+	cp         Compressor
+	dc         Decompressor
+	bs         backoffStrategy
+	balancer   Balancer
+	block      bool
+	insecure   bool
+	timeout    time.Duration
+	scChan     <-chan ServiceConfig
+	copts      transport.ConnectOptions
+	maxMsgSize int
 }
 
+const defaultClientMaxMsgSize = math.MaxInt32
+
 // DialOption configures how we set up the connection.
 type DialOption func(*dialOptions)
 
+// WithMaxMsgSize returns a DialOption which sets the maximum message size the client can receive.
+func WithMaxMsgSize(s int) DialOption {
+	return func(o *dialOptions) {
+		o.maxMsgSize = s
+	}
+}
+
 // WithCodec returns a DialOption which sets a codec for message marshaling and unmarshaling.
 func WithCodec(c Codec) DialOption {
 	return func(o *dialOptions) {
@@ -129,6 +143,13 @@ func WithBalancer(b Balancer) DialOption {
 	}
 }
 
+// WithServiceConfig returns a DialOption which has a channel to read the service configuration.
+func WithServiceConfig(c <-chan ServiceConfig) DialOption {
+	return func(o *dialOptions) {
+		o.scChan = c
+	}
+}
+
 // WithBackoffMaxDelay configures the dialer to use the provided maximum delay
 // when backing off after failed connection attempts.
 func WithBackoffMaxDelay(md time.Duration) DialOption {
@@ -199,6 +220,8 @@ func WithTimeout(d time.Duration) DialOption {
 }
 
 // WithDialer returns a DialOption that specifies a function to use for dialing network addresses.
+// If FailOnNonTempDialError() is set to true, and an error is returned by f, gRPC checks the error's
+// Temporary() method to decide if it should try to reconnect to the network address.
 func WithDialer(f func(string, time.Duration) (net.Conn, error)) DialOption {
 	return func(o *dialOptions) {
 		o.copts.Dialer = func(ctx context.Context, addr string) (net.Conn, error) {
@@ -210,6 +233,25 @@ func WithDialer(f func(string, time.Duration) (net.Conn, error)) DialOption {
 	}
 }
 
+// WithStatsHandler returns a DialOption that specifies the stats handler
+// for all the RPCs and underlying network connections in this ClientConn.
+func WithStatsHandler(h stats.Handler) DialOption {
+	return func(o *dialOptions) {
+		o.copts.StatsHandler = h
+	}
+}
+
+// FailOnNonTempDialError returns a DialOption that specified if gRPC fails on non-temporary dial errors.
+// If f is true, and dialer returns a non-temporary error, gRPC will fail the connection to the network
+// address and won't try to reconnect.
+// The default value of FailOnNonTempDialError is false.
+// This is an EXPERIMENTAL API.
+func FailOnNonTempDialError(f bool) DialOption {
+	return func(o *dialOptions) {
+		o.copts.FailOnNonTempDialError = f
+	}
+}
+
 // WithUserAgent returns a DialOption that specifies a user agent string for all the RPCs.
 func WithUserAgent(s string) DialOption {
 	return func(o *dialOptions) {
@@ -217,6 +259,13 @@ func WithUserAgent(s string) DialOption {
 	}
 }
 
+// WithKeepaliveParams returns a DialOption that specifies keepalive paramaters for the client transport.
+func WithKeepaliveParams(kp keepalive.ClientParameters) DialOption {
+	return func(o *dialOptions) {
+		o.copts.KeepaliveParams = kp
+	}
+}
+
 // WithUnaryInterceptor returns a DialOption that specifies the interceptor for unary RPCs.
 func WithUnaryInterceptor(f UnaryClientInterceptor) DialOption {
 	return func(o *dialOptions) {
@@ -231,6 +280,15 @@ func WithStreamInterceptor(f StreamClientInterceptor) DialOption {
 	}
 }
 
+// WithAuthority returns a DialOption that specifies the value to be used as
+// the :authority pseudo-header. This value only works with WithInsecure and
+// has no effect if TransportCredentials are present.
+func WithAuthority(a string) DialOption {
+	return func(o *dialOptions) {
+		o.copts.Authority = a
+	}
+}
+
 // Dial creates a client connection to the given target.
 func Dial(target string, opts ...DialOption) (*ClientConn, error) {
 	return DialContext(context.Background(), target, opts...)
@@ -247,6 +305,32 @@ func DialContext(ctx context.Context, target string, opts ...DialOption) (conn *
 		conns:  make(map[Address]*addrConn),
 	}
 	cc.ctx, cc.cancel = context.WithCancel(context.Background())
+	cc.dopts.maxMsgSize = defaultClientMaxMsgSize
+	for _, opt := range opts {
+		opt(&cc.dopts)
+	}
+	cc.mkp = cc.dopts.copts.KeepaliveParams
+
+	if cc.dopts.copts.Dialer == nil {
+		cc.dopts.copts.Dialer = newProxyDialer(
+			func(ctx context.Context, addr string) (net.Conn, error) {
+				return dialContext(ctx, "tcp", addr)
+			},
+		)
+	}
+
+	if cc.dopts.copts.UserAgent != "" {
+		cc.dopts.copts.UserAgent += " " + grpcUA
+	} else {
+		cc.dopts.copts.UserAgent = grpcUA
+	}
+
+	if cc.dopts.timeout > 0 {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, cc.dopts.timeout)
+		defer cancel()
+	}
+
 	defer func() {
 		select {
 		case <-ctx.Done():
@@ -259,10 +343,17 @@ func DialContext(ctx context.Context, target string, opts ...DialOption) (conn *
 		}
 	}()
 
-	for _, opt := range opts {
-		opt(&cc.dopts)
+	if cc.dopts.scChan != nil {
+		// Wait for the initial service config.
+		select {
+		case sc, ok := <-cc.dopts.scChan:
+			if ok {
+				cc.sc = sc
+			}
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
 	}
-
 	// Set defaults.
 	if cc.dopts.codec == nil {
 		cc.dopts.codec = protoCodec{}
@@ -273,21 +364,18 @@ func DialContext(ctx context.Context, target string, opts ...DialOption) (conn *
 	creds := cc.dopts.copts.TransportCredentials
 	if creds != nil && creds.Info().ServerName != "" {
 		cc.authority = creds.Info().ServerName
+	} else if cc.dopts.insecure && cc.dopts.copts.Authority != "" {
+		cc.authority = cc.dopts.copts.Authority
 	} else {
-		colonPos := strings.LastIndex(target, ":")
-		if colonPos == -1 {
-			colonPos = len(target)
-		}
-		cc.authority = target[:colonPos]
+		cc.authority = target
 	}
-	var ok bool
 	waitC := make(chan error, 1)
 	go func() {
-		var addrs []Address
-		if cc.dopts.balancer == nil {
-			// Connect to target directly if balancer is nil.
-			addrs = append(addrs, Address{Addr: target})
-		} else {
+		defer close(waitC)
+		if cc.dopts.balancer == nil && cc.sc.LB != nil {
+			cc.dopts.balancer = cc.sc.LB
+		}
+		if cc.dopts.balancer != nil {
 			var credsClone credentials.TransportCredentials
 			if creds != nil {
 				credsClone = creds.Clone()
@@ -300,29 +388,23 @@ func DialContext(ctx context.Context, target string, opts ...DialOption) (conn *
 				return
 			}
 			ch := cc.dopts.balancer.Notify()
-			if ch == nil {
-				// There is no name resolver installed.
-				addrs = append(addrs, Address{Addr: target})
-			} else {
-				addrs, ok = <-ch
-				if !ok || len(addrs) == 0 {
-					waitC <- errNoAddr
-					return
+			if ch != nil {
+				if cc.dopts.block {
+					doneChan := make(chan struct{})
+					go cc.lbWatcher(doneChan)
+					<-doneChan
+				} else {
+					go cc.lbWatcher(nil)
 				}
-			}
-		}
-		for _, a := range addrs {
-			if err := cc.resetAddrConn(a, false, nil); err != nil {
-				waitC <- err
 				return
 			}
 		}
-		close(waitC)
+		// No balancer, or no resolver within the balancer.  Connect directly.
+		if err := cc.resetAddrConn(Address{Addr: target}, cc.dopts.block, nil); err != nil {
+			waitC <- err
+			return
+		}
 	}()
-	var timeoutCh <-chan time.Time
-	if cc.dopts.timeout > 0 {
-		timeoutCh = time.After(cc.dopts.timeout)
-	}
 	select {
 	case <-ctx.Done():
 		return nil, ctx.Err()
@@ -330,14 +412,12 @@ func DialContext(ctx context.Context, target string, opts ...DialOption) (conn *
 		if err != nil {
 			return nil, err
 		}
-	case <-timeoutCh:
-		return nil, ErrClientConnTimeout
 	}
-	// If balancer is nil or balancer.Notify() is nil, ok will be false here.
-	// The lbWatcher goroutine will not be created.
-	if ok {
-		go cc.lbWatcher()
+
+	if cc.dopts.scChan != nil {
+		go cc.scWatcher()
 	}
+
 	return cc, nil
 }
 
@@ -384,10 +464,16 @@ type ClientConn struct {
 	dopts     dialOptions
 
 	mu    sync.RWMutex
+	sc    ServiceConfig
 	conns map[Address]*addrConn
+	// Keepalive parameter can be udated if a GoAway is received.
+	mkp keepalive.ClientParameters
 }
 
-func (cc *ClientConn) lbWatcher() {
+// lbWatcher watches the Notify channel of the balancer in cc and manages
+// connections accordingly.  If doneChan is not nil, it is closed after the
+// first successfull connection is made.
+func (cc *ClientConn) lbWatcher(doneChan chan struct{}) {
 	for addrs := range cc.dopts.balancer.Notify() {
 		var (
 			add []Address   // Addresses need to setup connections.
@@ -414,7 +500,15 @@ func (cc *ClientConn) lbWatcher() {
 		}
 		cc.mu.Unlock()
 		for _, a := range add {
-			cc.resetAddrConn(a, true, nil)
+			if doneChan != nil {
+				err := cc.resetAddrConn(a, true, nil)
+				if err == nil {
+					close(doneChan)
+					doneChan = nil
+				}
+			} else {
+				cc.resetAddrConn(a, false, nil)
+			}
 		}
 		for _, c := range del {
 			c.tearDown(errConnDrain)
@@ -422,15 +516,36 @@ func (cc *ClientConn) lbWatcher() {
 	}
 }
 
+func (cc *ClientConn) scWatcher() {
+	for {
+		select {
+		case sc, ok := <-cc.dopts.scChan:
+			if !ok {
+				return
+			}
+			cc.mu.Lock()
+			// TODO: load balance policy runtime change is ignored.
+			// We may revist this decision in the future.
+			cc.sc = sc
+			cc.mu.Unlock()
+		case <-cc.ctx.Done():
+			return
+		}
+	}
+}
+
 // resetAddrConn creates an addrConn for addr and adds it to cc.conns.
 // If there is an old addrConn for addr, it will be torn down, using tearDownErr as the reason.
 // If tearDownErr is nil, errConnDrain will be used instead.
-func (cc *ClientConn) resetAddrConn(addr Address, skipWait bool, tearDownErr error) error {
+func (cc *ClientConn) resetAddrConn(addr Address, block bool, tearDownErr error) error {
 	ac := &addrConn{
 		cc:    cc,
 		addr:  addr,
 		dopts: cc.dopts,
 	}
+	cc.mu.RLock()
+	ac.dopts.copts.KeepaliveParams = cc.mkp
+	cc.mu.RUnlock()
 	ac.ctx, ac.cancel = context.WithCancel(cc.ctx)
 	ac.stateCV = sync.NewCond(&ac.mu)
 	if EnableTracing {
@@ -475,8 +590,7 @@ func (cc *ClientConn) resetAddrConn(addr Address, skipWait bool, tearDownErr err
 			stale.tearDown(tearDownErr)
 		}
 	}
-	// skipWait may overwrite the decision in ac.dopts.block.
-	if ac.dopts.block && !skipWait {
+	if block {
 		if err := ac.resetTransport(false); err != nil {
 			if err != errConnClosing {
 				// Tear down ac and delete it from cc.conns.
@@ -509,6 +623,14 @@ func (cc *ClientConn) resetAddrConn(addr Address, skipWait bool, tearDownErr err
 	return nil
 }
 
+// TODO: Avoid the locking here.
+func (cc *ClientConn) getMethodConfig(method string) (m MethodConfig, ok bool) {
+	cc.mu.RLock()
+	defer cc.mu.RUnlock()
+	m, ok = cc.sc.Methods[method]
+	return
+}
+
 func (cc *ClientConn) getTransport(ctx context.Context, opts BalancerGetOptions) (transport.ClientTransport, func(), error) {
 	var (
 		ac  *addrConn
@@ -547,6 +669,7 @@ func (cc *ClientConn) getTransport(ctx context.Context, opts BalancerGetOptions)
 	}
 	if !ok {
 		if put != nil {
+			updateRPCInfoInContext(ctx, rpcInfo{bytesSent: false, bytesReceived: false})
 			put()
 		}
 		return nil, nil, errConnClosing
@@ -554,6 +677,7 @@ func (cc *ClientConn) getTransport(ctx context.Context, opts BalancerGetOptions)
 	t, err := ac.wait(ctx, cc.dopts.balancer != nil, !opts.BlockingWait)
 	if err != nil {
 		if put != nil {
+			updateRPCInfoInContext(ctx, rpcInfo{bytesSent: false, bytesReceived: false})
 			put()
 		}
 		return nil, nil, err
@@ -605,6 +729,20 @@ type addrConn struct {
 	tearDownErr error
 }
 
+// adjustParams updates parameters used to create transports upon
+// receiving a GoAway.
+func (ac *addrConn) adjustParams(r transport.GoAwayReason) {
+	switch r {
+	case transport.TooManyPings:
+		v := 2 * ac.dopts.copts.KeepaliveParams.Time
+		ac.cc.mu.Lock()
+		if v > ac.cc.mkp.Time {
+			ac.cc.mkp.Time = v
+		}
+		ac.cc.mu.Unlock()
+	}
+}
+
 // printf records an event in ac's event log, unless ac has been closed.
 // REQUIRES ac.mu is held.
 func (ac *addrConn) printf(format string, a ...interface{}) {
@@ -689,6 +827,8 @@ func (ac *addrConn) resetTransport(closeTransport bool) error {
 			Metadata: ac.addr.Metadata,
 		}
 		newTransport, err := transport.NewClientTransport(ctx, sinfo, ac.dopts.copts)
+		// Don't call cancel in success path due to a race in Go 1.6:
+		// https://github.com/golang/go/issues/15078.
 		if err != nil {
 			cancel()
 
@@ -759,6 +899,7 @@ func (ac *addrConn) transportMonitor() {
 			}
 			return
 		case <-t.GoAway():
+			ac.adjustParams(t.GetGoAwayReason())
 			// If GoAway happens without any network I/O error, ac is closed without shutting down the
 			// underlying transport (the transport will be closed when all the pending RPCs finished or
 			// failed.).
@@ -767,9 +908,9 @@ func (ac *addrConn) transportMonitor() {
 			// In both cases, a new ac is created.
 			select {
 			case <-t.Error():
-				ac.cc.resetAddrConn(ac.addr, true, errNetworkIO)
+				ac.cc.resetAddrConn(ac.addr, false, errNetworkIO)
 			default:
-				ac.cc.resetAddrConn(ac.addr, true, errConnDrain)
+				ac.cc.resetAddrConn(ac.addr, false, errConnDrain)
 			}
 			return
 		case <-t.Error():
@@ -778,7 +919,8 @@ func (ac *addrConn) transportMonitor() {
 				t.Close()
 				return
 			case <-t.GoAway():
-				ac.cc.resetAddrConn(ac.addr, true, errNetworkIO)
+				ac.adjustParams(t.GetGoAwayReason())
+				ac.cc.resetAddrConn(ac.addr, false, errNetworkIO)
 				return
 			default:
 			}
diff --git a/components/engine/vendor/google.golang.org/grpc/codec.go b/components/engine/vendor/google.golang.org/grpc/codec.go
new file mode 100644
index 0000000000..bd76ebb7f1
--- /dev/null
+++ b/components/engine/vendor/google.golang.org/grpc/codec.go
@@ -0,0 +1,118 @@
+/*
+*
+ * Copyright 2014, Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+*/
+
+package grpc
+
+import (
+	"math"
+	"sync"
+
+	"github.com/golang/protobuf/proto"
+)
+
+// Codec defines the interface gRPC uses to encode and decode messages.
+// Note that implementations of this interface must be thread safe;
+// a Codec's methods can be called from concurrent goroutines.
+type Codec interface {
+	// Marshal returns the wire format of v.
+	Marshal(v interface{}) ([]byte, error)
+	// Unmarshal parses the wire format into v.
+	Unmarshal(data []byte, v interface{}) error
+	// String returns the name of the Codec implementation. The returned
+	// string will be used as part of content type in transmission.
+	String() string
+}
+
+// protoCodec is a Codec implementation with protobuf. It is the default codec for gRPC.
+type protoCodec struct {
+}
+
+type cachedProtoBuffer struct {
+	lastMarshaledSize uint32
+	proto.Buffer
+}
+
+func capToMaxInt32(val int) uint32 {
+	if val > math.MaxInt32 {
+		return uint32(math.MaxInt32)
+	}
+	return uint32(val)
+}
+
+func (p protoCodec) marshal(v interface{}, cb *cachedProtoBuffer) ([]byte, error) {
+	protoMsg := v.(proto.Message)
+	newSlice := make([]byte, 0, cb.lastMarshaledSize)
+
+	cb.SetBuf(newSlice)
+	cb.Reset()
+	if err := cb.Marshal(protoMsg); err != nil {
+		return nil, err
+	}
+	out := cb.Bytes()
+	cb.lastMarshaledSize = capToMaxInt32(len(out))
+	return out, nil
+}
+
+func (p protoCodec) Marshal(v interface{}) ([]byte, error) {
+	cb := protoBufferPool.Get().(*cachedProtoBuffer)
+	out, err := p.marshal(v, cb)
+
+	// put back buffer and lose the ref to the slice
+	cb.SetBuf(nil)
+	protoBufferPool.Put(cb)
+	return out, err
+}
+
+func (p protoCodec) Unmarshal(data []byte, v interface{}) error {
+	cb := protoBufferPool.Get().(*cachedProtoBuffer)
+	cb.SetBuf(data)
+	err := cb.Unmarshal(v.(proto.Message))
+	cb.SetBuf(nil)
+	protoBufferPool.Put(cb)
+	return err
+}
+
+func (protoCodec) String() string {
+	return "proto"
+}
+
+var (
+	protoBufferPool = &sync.Pool{
+		New: func() interface{} {
+			return &cachedProtoBuffer{
+				Buffer:            proto.Buffer{},
+				lastMarshaledSize: 16,
+			}
+		},
+	}
+)
diff --git a/components/engine/vendor/google.golang.org/grpc/credentials/credentials.go b/components/engine/vendor/google.golang.org/grpc/credentials/credentials.go
index 5555ef024f..a8114d6713 100644
--- a/components/engine/vendor/google.golang.org/grpc/credentials/credentials.go
+++ b/components/engine/vendor/google.golang.org/grpc/credentials/credentials.go
@@ -102,6 +102,10 @@ type TransportCredentials interface {
 	// authentication protocol on rawConn for clients. It returns the authenticated
 	// connection and the corresponding auth information about the connection.
 	// Implementations must use the provided context to implement timely cancellation.
+	// gRPC will try to reconnect if the error returned is a temporary error
+	// (io.EOF, context.DeadlineExceeded or err.Temporary() == true).
+	// If the returned error is a wrapper error, implementations should make sure that
+	// the error implements Temporary() to have the correct retry behaviors.
 	ClientHandshake(context.Context, string, net.Conn) (net.Conn, AuthInfo, error)
 	// ServerHandshake does the authentication handshake for servers. It returns
 	// the authenticated connection and the corresponding auth information about
@@ -165,9 +169,7 @@ func (c *tlsCreds) ClientHandshake(ctx context.Context, addr string, rawConn net
 	case <-ctx.Done():
 		return nil, nil, ctx.Err()
 	}
-	// TODO(zhaoq): Omit the auth info for client now. It is more for
-	// information than anything else.
-	return conn, nil, nil
+	return conn, TLSInfo{conn.ConnectionState()}, nil
 }
 
 func (c *tlsCreds) ServerHandshake(rawConn net.Conn) (net.Conn, AuthInfo, error) {
diff --git a/components/engine/vendor/google.golang.org/grpc/credentials/credentials_util_go17.go b/components/engine/vendor/google.golang.org/grpc/credentials/credentials_util_go17.go
index 9647b9ec83..7597b09e35 100644
--- a/components/engine/vendor/google.golang.org/grpc/credentials/credentials_util_go17.go
+++ b/components/engine/vendor/google.golang.org/grpc/credentials/credentials_util_go17.go
@@ -1,4 +1,5 @@
 // +build go1.7
+// +build !go1.8
 
 /*
  *
@@ -44,8 +45,6 @@ import (
 // contains a mutex and must not be copied.
 //
 // If cfg is nil, a new zero tls.Config is returned.
-//
-// TODO replace this function with official clone function.
 func cloneTLSConfig(cfg *tls.Config) *tls.Config {
 	if cfg == nil {
 		return &tls.Config{}
diff --git a/components/engine/vendor/google.golang.org/grpc/credentials/credentials_util_go18.go b/components/engine/vendor/google.golang.org/grpc/credentials/credentials_util_go18.go
new file mode 100644
index 0000000000..0ecf342da8
--- /dev/null
+++ b/components/engine/vendor/google.golang.org/grpc/credentials/credentials_util_go18.go
@@ -0,0 +1,53 @@
+// +build go1.8
+
+/*
+ *
+ * Copyright 2017, Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+package credentials
+
+import (
+	"crypto/tls"
+)
+
+// cloneTLSConfig returns a shallow clone of the exported
+// fields of cfg, ignoring the unexported sync.Once, which
+// contains a mutex and must not be copied.
+//
+// If cfg is nil, a new zero tls.Config is returned.
+func cloneTLSConfig(cfg *tls.Config) *tls.Config {
+	if cfg == nil {
+		return &tls.Config{}
+	}
+
+	return cfg.Clone()
+}
diff --git a/components/engine/vendor/google.golang.org/grpc/credentials/credentials_util_pre_go17.go b/components/engine/vendor/google.golang.org/grpc/credentials/credentials_util_pre_go17.go
index 09b8d12c79..cfd40dfa34 100644
--- a/components/engine/vendor/google.golang.org/grpc/credentials/credentials_util_pre_go17.go
+++ b/components/engine/vendor/google.golang.org/grpc/credentials/credentials_util_pre_go17.go
@@ -44,8 +44,6 @@ import (
 // contains a mutex and must not be copied.
 //
 // If cfg is nil, a new zero tls.Config is returned.
-//
-// TODO replace this function with official clone function.
 func cloneTLSConfig(cfg *tls.Config) *tls.Config {
 	if cfg == nil {
 		return &tls.Config{}
diff --git a/components/engine/vendor/google.golang.org/grpc/go16.go b/components/engine/vendor/google.golang.org/grpc/go16.go
new file mode 100644
index 0000000000..b61c57e88d
--- /dev/null
+++ b/components/engine/vendor/google.golang.org/grpc/go16.go
@@ -0,0 +1,56 @@
+// +build go1.6,!go1.7
+
+/*
+ * Copyright 2016, Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+package grpc
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+
+	"golang.org/x/net/context"
+)
+
+// dialContext connects to the address on the named network.
+func dialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	return (&net.Dialer{Cancel: ctx.Done()}).Dial(network, address)
+}
+
+func sendHTTPRequest(ctx context.Context, req *http.Request, conn net.Conn) error {
+	req.Cancel = ctx.Done()
+	if err := req.Write(conn); err != nil {
+		return fmt.Errorf("failed to write the HTTP request: %v", err)
+	}
+	return nil
+}
diff --git a/components/engine/vendor/google.golang.org/grpc/transport/pre_go16.go b/components/engine/vendor/google.golang.org/grpc/go17.go
similarity index 86%
rename from components/engine/vendor/google.golang.org/grpc/transport/pre_go16.go
rename to components/engine/vendor/google.golang.org/grpc/go17.go
index 33d91c17c4..844f0e1899 100644
--- a/components/engine/vendor/google.golang.org/grpc/transport/pre_go16.go
+++ b/components/engine/vendor/google.golang.org/grpc/go17.go
@@ -1,4 +1,4 @@
-// +build !go1.6
+// +build go1.7
 
 /*
  * Copyright 2016, Google Inc.
@@ -32,20 +32,24 @@
  *
  */
 
-package transport
+package grpc
 
 import (
 	"net"
-	"time"
+	"net/http"
 
 	"golang.org/x/net/context"
 )
 
 // dialContext connects to the address on the named network.
 func dialContext(ctx context.Context, network, address string) (net.Conn, error) {
-	var dialer net.Dialer
-	if deadline, ok := ctx.Deadline(); ok {
-		dialer.Timeout = deadline.Sub(time.Now())
-	}
-	return dialer.Dial(network, address)
+	return (&net.Dialer{}).DialContext(ctx, network, address)
+}
+
+func sendHTTPRequest(ctx context.Context, req *http.Request, conn net.Conn) error {
+	req = req.WithContext(ctx)
+	if err := req.Write(conn); err != nil {
+		return err
+	}
+	return nil
 }
diff --git a/components/engine/vendor/google.golang.org/grpc/grpclb.go b/components/engine/vendor/google.golang.org/grpc/grpclb.go
new file mode 100644
index 0000000000..524e429df3
--- /dev/null
+++ b/components/engine/vendor/google.golang.org/grpc/grpclb.go
@@ -0,0 +1,749 @@
+/*
+ *
+ * Copyright 2016, Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+package grpc
+
+import (
+	"errors"
+	"fmt"
+	"math/rand"
+	"net"
+	"sync"
+	"time"
+
+	"golang.org/x/net/context"
+	"google.golang.org/grpc/codes"
+	lbpb "google.golang.org/grpc/grpclb/grpc_lb_v1"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/naming"
+)
+
+// Client API for LoadBalancer service.
+// Mostly copied from generated pb.go file.
+// To avoid circular dependency.
+type loadBalancerClient struct {
+	cc *ClientConn
+}
+
+func (c *loadBalancerClient) BalanceLoad(ctx context.Context, opts ...CallOption) (*balanceLoadClientStream, error) {
+	desc := &StreamDesc{
+		StreamName:    "BalanceLoad",
+		ServerStreams: true,
+		ClientStreams: true,
+	}
+	stream, err := NewClientStream(ctx, desc, c.cc, "/grpc.lb.v1.LoadBalancer/BalanceLoad", opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &balanceLoadClientStream{stream}
+	return x, nil
+}
+
+type balanceLoadClientStream struct {
+	ClientStream
+}
+
+func (x *balanceLoadClientStream) Send(m *lbpb.LoadBalanceRequest) error {
+	return x.ClientStream.SendMsg(m)
+}
+
+func (x *balanceLoadClientStream) Recv() (*lbpb.LoadBalanceResponse, error) {
+	m := new(lbpb.LoadBalanceResponse)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// AddressType indicates the address type returned by name resolution.
+type AddressType uint8
+
+const (
+	// Backend indicates the server is a backend server.
+	Backend AddressType = iota
+	// GRPCLB indicates the server is a grpclb load balancer.
+	GRPCLB
+)
+
+// AddrMetadataGRPCLB contains the information the name resolution for grpclb should provide. The
+// name resolver used by grpclb balancer is required to provide this type of metadata in
+// its address updates.
+type AddrMetadataGRPCLB struct {
+	// AddrType is the type of server (grpc load balancer or backend).
+	AddrType AddressType
+	// ServerName is the name of the grpc load balancer. Used for authentication.
+	ServerName string
+}
+
+// NewGRPCLBBalancer creates a grpclb load balancer.
+func NewGRPCLBBalancer(r naming.Resolver) Balancer {
+	return &balancer{
+		r: r,
+	}
+}
+
+type remoteBalancerInfo struct {
+	addr string
+	// the server name used for authentication with the remote LB server.
+	name string
+}
+
+// grpclbAddrInfo consists of the information of a backend server.
+type grpclbAddrInfo struct {
+	addr      Address
+	connected bool
+	// dropForRateLimiting indicates whether this particular request should be
+	// dropped by the client for rate limiting.
+	dropForRateLimiting bool
+	// dropForLoadBalancing indicates whether this particular request should be
+	// dropped by the client for load balancing.
+	dropForLoadBalancing bool
+}
+
+type balancer struct {
+	r        naming.Resolver
+	target   string
+	mu       sync.Mutex
+	seq      int // a sequence number to make sure addrCh does not get stale addresses.
+	w        naming.Watcher
+	addrCh   chan []Address
+	rbs      []remoteBalancerInfo
+	addrs    []*grpclbAddrInfo
+	next     int
+	waitCh   chan struct{}
+	done     bool
+	expTimer *time.Timer
+	rand     *rand.Rand
+
+	clientStats lbpb.ClientStats
+}
+
+func (b *balancer) watchAddrUpdates(w naming.Watcher, ch chan []remoteBalancerInfo) error {
+	updates, err := w.Next()
+	if err != nil {
+		return err
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.done {
+		return ErrClientConnClosing
+	}
+	for _, update := range updates {
+		switch update.Op {
+		case naming.Add:
+			var exist bool
+			for _, v := range b.rbs {
+				// TODO: Is the same addr with different server name a different balancer?
+				if update.Addr == v.addr {
+					exist = true
+					break
+				}
+			}
+			if exist {
+				continue
+			}
+			md, ok := update.Metadata.(*AddrMetadataGRPCLB)
+			if !ok {
+				// TODO: Revisit the handling here and may introduce some fallback mechanism.
+				grpclog.Printf("The name resolution contains unexpected metadata %v", update.Metadata)
+				continue
+			}
+			switch md.AddrType {
+			case Backend:
+				// TODO: Revisit the handling here and may introduce some fallback mechanism.
+				grpclog.Printf("The name resolution does not give grpclb addresses")
+				continue
+			case GRPCLB:
+				b.rbs = append(b.rbs, remoteBalancerInfo{
+					addr: update.Addr,
+					name: md.ServerName,
+				})
+			default:
+				grpclog.Printf("Received unknow address type %d", md.AddrType)
+				continue
+			}
+		case naming.Delete:
+			for i, v := range b.rbs {
+				if update.Addr == v.addr {
+					copy(b.rbs[i:], b.rbs[i+1:])
+					b.rbs = b.rbs[:len(b.rbs)-1]
+					break
+				}
+			}
+		default:
+			grpclog.Println("Unknown update.Op ", update.Op)
+		}
+	}
+	// TODO: Fall back to the basic round-robin load balancing if the resulting address is
+	// not a load balancer.
+	select {
+	case <-ch:
+	default:
+	}
+	ch <- b.rbs
+	return nil
+}
+
+func (b *balancer) serverListExpire(seq int) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	// TODO: gRPC interanls do not clear the connections when the server list is stale.
+	// This means RPCs will keep using the existing server list until b receives new
+	// server list even though the list is expired. Revisit this behavior later.
+	if b.done || seq < b.seq {
+		return
+	}
+	b.next = 0
+	b.addrs = nil
+	// Ask grpc internals to close all the corresponding connections.
+	b.addrCh <- nil
+}
+
+func convertDuration(d *lbpb.Duration) time.Duration {
+	if d == nil {
+		return 0
+	}
+	return time.Duration(d.Seconds)*time.Second + time.Duration(d.Nanos)*time.Nanosecond
+}
+
+func (b *balancer) processServerList(l *lbpb.ServerList, seq int) {
+	if l == nil {
+		return
+	}
+	servers := l.GetServers()
+	expiration := convertDuration(l.GetExpirationInterval())
+	var (
+		sl    []*grpclbAddrInfo
+		addrs []Address
+	)
+	for _, s := range servers {
+		md := metadata.Pairs("lb-token", s.LoadBalanceToken)
+		addr := Address{
+			Addr:     fmt.Sprintf("%s:%d", net.IP(s.IpAddress), s.Port),
+			Metadata: &md,
+		}
+		sl = append(sl, &grpclbAddrInfo{
+			addr:                 addr,
+			dropForRateLimiting:  s.DropForRateLimiting,
+			dropForLoadBalancing: s.DropForLoadBalancing,
+		})
+		addrs = append(addrs, addr)
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.done || seq < b.seq {
+		return
+	}
+	if len(sl) > 0 {
+		// reset b.next to 0 when replacing the server list.
+		b.next = 0
+		b.addrs = sl
+		b.addrCh <- addrs
+		if b.expTimer != nil {
+			b.expTimer.Stop()
+			b.expTimer = nil
+		}
+		if expiration > 0 {
+			b.expTimer = time.AfterFunc(expiration, func() {
+				b.serverListExpire(seq)
+			})
+		}
+	}
+	return
+}
+
+func (b *balancer) sendLoadReport(s *balanceLoadClientStream, interval time.Duration, done <-chan struct{}) {
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ticker.C:
+		case <-done:
+			return
+		}
+		b.mu.Lock()
+		stats := b.clientStats
+		b.clientStats = lbpb.ClientStats{} // Clear the stats.
+		b.mu.Unlock()
+		t := time.Now()
+		stats.Timestamp = &lbpb.Timestamp{
+			Seconds: t.Unix(),
+			Nanos:   int32(t.Nanosecond()),
+		}
+		if err := s.Send(&lbpb.LoadBalanceRequest{
+			LoadBalanceRequestType: &lbpb.LoadBalanceRequest_ClientStats{
+				ClientStats: &stats,
+			},
+		}); err != nil {
+			return
+		}
+	}
+}
+
+func (b *balancer) callRemoteBalancer(lbc *loadBalancerClient, seq int) (retry bool) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	stream, err := lbc.BalanceLoad(ctx)
+	if err != nil {
+		grpclog.Printf("Failed to perform RPC to the remote balancer %v", err)
+		return
+	}
+	b.mu.Lock()
+	if b.done {
+		b.mu.Unlock()
+		return
+	}
+	b.mu.Unlock()
+	initReq := &lbpb.LoadBalanceRequest{
+		LoadBalanceRequestType: &lbpb.LoadBalanceRequest_InitialRequest{
+			InitialRequest: &lbpb.InitialLoadBalanceRequest{
+				Name: b.target,
+			},
+		},
+	}
+	if err := stream.Send(initReq); err != nil {
+		// TODO: backoff on retry?
+		return true
+	}
+	reply, err := stream.Recv()
+	if err != nil {
+		// TODO: backoff on retry?
+		return true
+	}
+	initResp := reply.GetInitialResponse()
+	if initResp == nil {
+		grpclog.Println("Failed to receive the initial response from the remote balancer.")
+		return
+	}
+	// TODO: Support delegation.
+	if initResp.LoadBalancerDelegate != "" {
+		// delegation
+		grpclog.Println("TODO: Delegation is not supported yet.")
+		return
+	}
+	streamDone := make(chan struct{})
+	defer close(streamDone)
+	b.mu.Lock()
+	b.clientStats = lbpb.ClientStats{} // Clear client stats.
+	b.mu.Unlock()
+	if d := convertDuration(initResp.ClientStatsReportInterval); d > 0 {
+		go b.sendLoadReport(stream, d, streamDone)
+	}
+	// Retrieve the server list.
+	for {
+		reply, err := stream.Recv()
+		if err != nil {
+			break
+		}
+		b.mu.Lock()
+		if b.done || seq < b.seq {
+			b.mu.Unlock()
+			return
+		}
+		b.seq++ // tick when receiving a new list of servers.
+		seq = b.seq
+		b.mu.Unlock()
+		if serverList := reply.GetServerList(); serverList != nil {
+			b.processServerList(serverList, seq)
+		}
+	}
+	return true
+}
+
+func (b *balancer) Start(target string, config BalancerConfig) error {
+	b.rand = rand.New(rand.NewSource(time.Now().Unix()))
+	// TODO: Fall back to the basic direct connection if there is no name resolver.
+	if b.r == nil {
+		return errors.New("there is no name resolver installed")
+	}
+	b.target = target
+	b.mu.Lock()
+	if b.done {
+		b.mu.Unlock()
+		return ErrClientConnClosing
+	}
+	b.addrCh = make(chan []Address)
+	w, err := b.r.Resolve(target)
+	if err != nil {
+		b.mu.Unlock()
+		return err
+	}
+	b.w = w
+	b.mu.Unlock()
+	balancerAddrsCh := make(chan []remoteBalancerInfo, 1)
+	// Spawn a goroutine to monitor the name resolution of remote load balancer.
+	go func() {
+		for {
+			if err := b.watchAddrUpdates(w, balancerAddrsCh); err != nil {
+				grpclog.Printf("grpc: the naming watcher stops working due to %v.\n", err)
+				close(balancerAddrsCh)
+				return
+			}
+		}
+	}()
+	// Spawn a goroutine to talk to the remote load balancer.
+	go func() {
+		var (
+			cc *ClientConn
+			// ccError is closed when there is an error in the current cc.
+			// A new rb should be picked from rbs and connected.
+			ccError chan struct{}
+			rb      *remoteBalancerInfo
+			rbs     []remoteBalancerInfo
+			rbIdx   int
+		)
+
+		defer func() {
+			if ccError != nil {
+				select {
+				case <-ccError:
+				default:
+					close(ccError)
+				}
+			}
+			if cc != nil {
+				cc.Close()
+			}
+		}()
+
+		for {
+			var ok bool
+			select {
+			case rbs, ok = <-balancerAddrsCh:
+				if !ok {
+					return
+				}
+				foundIdx := -1
+				if rb != nil {
+					for i, trb := range rbs {
+						if trb == *rb {
+							foundIdx = i
+							break
+						}
+					}
+				}
+				if foundIdx >= 0 {
+					if foundIdx >= 1 {
+						// Move the address in use to the beginning of the list.
+						b.rbs[0], b.rbs[foundIdx] = b.rbs[foundIdx], b.rbs[0]
+						rbIdx = 0
+					}
+					continue // If found, don't dial new cc.
+				} else if len(rbs) > 0 {
+					// Pick a random one from the list, instead of always using the first one.
+					if l := len(rbs); l > 1 && rb != nil {
+						tmpIdx := b.rand.Intn(l - 1)
+						b.rbs[0], b.rbs[tmpIdx] = b.rbs[tmpIdx], b.rbs[0]
+					}
+					rbIdx = 0
+					rb = &rbs[0]
+				} else {
+					// foundIdx < 0 && len(rbs) <= 0.
+					rb = nil
+				}
+			case <-ccError:
+				ccError = nil
+				if rbIdx < len(rbs)-1 {
+					rbIdx++
+					rb = &rbs[rbIdx]
+				} else {
+					rb = nil
+				}
+			}
+
+			if rb == nil {
+				continue
+			}
+
+			if cc != nil {
+				cc.Close()
+			}
+			// Talk to the remote load balancer to get the server list.
+			var err error
+			creds := config.DialCreds
+			ccError = make(chan struct{})
+			if creds == nil {
+				cc, err = Dial(rb.addr, WithInsecure())
+			} else {
+				if rb.name != "" {
+					if err := creds.OverrideServerName(rb.name); err != nil {
+						grpclog.Printf("Failed to override the server name in the credentials: %v", err)
+						continue
+					}
+				}
+				cc, err = Dial(rb.addr, WithTransportCredentials(creds))
+			}
+			if err != nil {
+				grpclog.Printf("Failed to setup a connection to the remote balancer %v: %v", rb.addr, err)
+				close(ccError)
+				continue
+			}
+			b.mu.Lock()
+			b.seq++ // tick when getting a new balancer address
+			seq := b.seq
+			b.next = 0
+			b.mu.Unlock()
+			go func(cc *ClientConn, ccError chan struct{}) {
+				lbc := &loadBalancerClient{cc}
+				b.callRemoteBalancer(lbc, seq)
+				cc.Close()
+				select {
+				case <-ccError:
+				default:
+					close(ccError)
+				}
+			}(cc, ccError)
+		}
+	}()
+	return nil
+}
+
+func (b *balancer) down(addr Address, err error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	for _, a := range b.addrs {
+		if addr == a.addr {
+			a.connected = false
+			break
+		}
+	}
+}
+
+func (b *balancer) Up(addr Address) func(error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.done {
+		return nil
+	}
+	var cnt int
+	for _, a := range b.addrs {
+		if a.addr == addr {
+			if a.connected {
+				return nil
+			}
+			a.connected = true
+		}
+		if a.connected && !a.dropForRateLimiting && !a.dropForLoadBalancing {
+			cnt++
+		}
+	}
+	// addr is the only one which is connected. Notify the Get() callers who are blocking.
+	if cnt == 1 && b.waitCh != nil {
+		close(b.waitCh)
+		b.waitCh = nil
+	}
+	return func(err error) {
+		b.down(addr, err)
+	}
+}
+
+func (b *balancer) Get(ctx context.Context, opts BalancerGetOptions) (addr Address, put func(), err error) {
+	var ch chan struct{}
+	b.mu.Lock()
+	if b.done {
+		b.mu.Unlock()
+		err = ErrClientConnClosing
+		return
+	}
+	seq := b.seq
+
+	defer func() {
+		if err != nil {
+			return
+		}
+		put = func() {
+			s, ok := rpcInfoFromContext(ctx)
+			if !ok {
+				return
+			}
+			b.mu.Lock()
+			defer b.mu.Unlock()
+			if b.done || seq < b.seq {
+				return
+			}
+			b.clientStats.NumCallsFinished++
+			if !s.bytesSent {
+				b.clientStats.NumCallsFinishedWithClientFailedToSend++
+			} else if s.bytesReceived {
+				b.clientStats.NumCallsFinishedKnownReceived++
+			}
+		}
+	}()
+
+	b.clientStats.NumCallsStarted++
+	if len(b.addrs) > 0 {
+		if b.next >= len(b.addrs) {
+			b.next = 0
+		}
+		next := b.next
+		for {
+			a := b.addrs[next]
+			next = (next + 1) % len(b.addrs)
+			if a.connected {
+				if !a.dropForRateLimiting && !a.dropForLoadBalancing {
+					addr = a.addr
+					b.next = next
+					b.mu.Unlock()
+					return
+				}
+				if !opts.BlockingWait {
+					b.next = next
+					if a.dropForLoadBalancing {
+						b.clientStats.NumCallsFinished++
+						b.clientStats.NumCallsFinishedWithDropForLoadBalancing++
+					} else if a.dropForRateLimiting {
+						b.clientStats.NumCallsFinished++
+						b.clientStats.NumCallsFinishedWithDropForRateLimiting++
+					}
+					b.mu.Unlock()
+					err = Errorf(codes.Unavailable, "%s drops requests", a.addr.Addr)
+					return
+				}
+			}
+			if next == b.next {
+				// Has iterated all the possible address but none is connected.
+				break
+			}
+		}
+	}
+	if !opts.BlockingWait {
+		if len(b.addrs) == 0 {
+			b.clientStats.NumCallsFinished++
+			b.clientStats.NumCallsFinishedWithClientFailedToSend++
+			b.mu.Unlock()
+			err = Errorf(codes.Unavailable, "there is no address available")
+			return
+		}
+		// Returns the next addr on b.addrs for a failfast RPC.
+		addr = b.addrs[b.next].addr
+		b.next++
+		b.mu.Unlock()
+		return
+	}
+	// Wait on b.waitCh for non-failfast RPCs.
+	if b.waitCh == nil {
+		ch = make(chan struct{})
+		b.waitCh = ch
+	} else {
+		ch = b.waitCh
+	}
+	b.mu.Unlock()
+	for {
+		select {
+		case <-ctx.Done():
+			b.mu.Lock()
+			b.clientStats.NumCallsFinished++
+			b.clientStats.NumCallsFinishedWithClientFailedToSend++
+			b.mu.Unlock()
+			err = ctx.Err()
+			return
+		case <-ch:
+			b.mu.Lock()
+			if b.done {
+				b.clientStats.NumCallsFinished++
+				b.clientStats.NumCallsFinishedWithClientFailedToSend++
+				b.mu.Unlock()
+				err = ErrClientConnClosing
+				return
+			}
+
+			if len(b.addrs) > 0 {
+				if b.next >= len(b.addrs) {
+					b.next = 0
+				}
+				next := b.next
+				for {
+					a := b.addrs[next]
+					next = (next + 1) % len(b.addrs)
+					if a.connected {
+						if !a.dropForRateLimiting && !a.dropForLoadBalancing {
+							addr = a.addr
+							b.next = next
+							b.mu.Unlock()
+							return
+						}
+						if !opts.BlockingWait {
+							b.next = next
+							if a.dropForLoadBalancing {
+								b.clientStats.NumCallsFinished++
+								b.clientStats.NumCallsFinishedWithDropForLoadBalancing++
+							} else if a.dropForRateLimiting {
+								b.clientStats.NumCallsFinished++
+								b.clientStats.NumCallsFinishedWithDropForRateLimiting++
+							}
+							b.mu.Unlock()
+							err = Errorf(codes.Unavailable, "drop requests for the addreess %s", a.addr.Addr)
+							return
+						}
+					}
+					if next == b.next {
+						// Has iterated all the possible address but none is connected.
+						break
+					}
+				}
+			}
+			// The newly added addr got removed by Down() again.
+			if b.waitCh == nil {
+				ch = make(chan struct{})
+				b.waitCh = ch
+			} else {
+				ch = b.waitCh
+			}
+			b.mu.Unlock()
+		}
+	}
+}
+
+func (b *balancer) Notify() <-chan []Address {
+	return b.addrCh
+}
+
+func (b *balancer) Close() error {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.done = true
+	if b.expTimer != nil {
+		b.expTimer.Stop()
+	}
+	if b.waitCh != nil {
+		close(b.waitCh)
+	}
+	if b.addrCh != nil {
+		close(b.addrCh)
+	}
+	if b.w != nil {
+		b.w.Close()
+	}
+	return nil
+}
diff --git a/components/engine/vendor/google.golang.org/grpc/grpclb/grpc_lb_v1/grpclb.pb.go b/components/engine/vendor/google.golang.org/grpc/grpclb/grpc_lb_v1/grpclb.pb.go
new file mode 100644
index 0000000000..f63941bd80
--- /dev/null
+++ b/components/engine/vendor/google.golang.org/grpc/grpclb/grpc_lb_v1/grpclb.pb.go
@@ -0,0 +1,629 @@
+// Code generated by protoc-gen-go.
+// source: grpclb.proto
+// DO NOT EDIT!
+
+/*
+Package grpc_lb_v1 is a generated protocol buffer package.
+
+It is generated from these files:
+	grpclb.proto
+
+It has these top-level messages:
+	Duration
+	Timestamp
+	LoadBalanceRequest
+	InitialLoadBalanceRequest
+	ClientStats
+	LoadBalanceResponse
+	InitialLoadBalanceResponse
+	ServerList
+	Server
+*/
+package grpc_lb_v1
+
+import proto "github.com/golang/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
+
+type Duration struct {
+	// Signed seconds of the span of time. Must be from -315,576,000,000
+	// to +315,576,000,000 inclusive.
+	Seconds int64 `protobuf:"varint,1,opt,name=seconds" json:"seconds,omitempty"`
+	// Signed fractions of a second at nanosecond resolution of the span
+	// of time. Durations less than one second are represented with a 0
+	// `seconds` field and a positive or negative `nanos` field. For durations
+	// of one second or more, a non-zero value for the `nanos` field must be
+	// of the same sign as the `seconds` field. Must be from -999,999,999
+	// to +999,999,999 inclusive.
+	Nanos int32 `protobuf:"varint,2,opt,name=nanos" json:"nanos,omitempty"`
+}
+
+func (m *Duration) Reset()                    { *m = Duration{} }
+func (m *Duration) String() string            { return proto.CompactTextString(m) }
+func (*Duration) ProtoMessage()               {}
+func (*Duration) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
+
+func (m *Duration) GetSeconds() int64 {
+	if m != nil {
+		return m.Seconds
+	}
+	return 0
+}
+
+func (m *Duration) GetNanos() int32 {
+	if m != nil {
+		return m.Nanos
+	}
+	return 0
+}
+
+type Timestamp struct {
+	// Represents seconds of UTC time since Unix epoch
+	// 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
+	// 9999-12-31T23:59:59Z inclusive.
+	Seconds int64 `protobuf:"varint,1,opt,name=seconds" json:"seconds,omitempty"`
+	// Non-negative fractions of a second at nanosecond resolution. Negative
+	// second values with fractions must still have non-negative nanos values
+	// that count forward in time. Must be from 0 to 999,999,999
+	// inclusive.
+	Nanos int32 `protobuf:"varint,2,opt,name=nanos" json:"nanos,omitempty"`
+}
+
+func (m *Timestamp) Reset()                    { *m = Timestamp{} }
+func (m *Timestamp) String() string            { return proto.CompactTextString(m) }
+func (*Timestamp) ProtoMessage()               {}
+func (*Timestamp) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{1} }
+
+func (m *Timestamp) GetSeconds() int64 {
+	if m != nil {
+		return m.Seconds
+	}
+	return 0
+}
+
+func (m *Timestamp) GetNanos() int32 {
+	if m != nil {
+		return m.Nanos
+	}
+	return 0
+}
+
+type LoadBalanceRequest struct {
+	// Types that are valid to be assigned to LoadBalanceRequestType:
+	//	*LoadBalanceRequest_InitialRequest
+	//	*LoadBalanceRequest_ClientStats
+	LoadBalanceRequestType isLoadBalanceRequest_LoadBalanceRequestType `protobuf_oneof:"load_balance_request_type"`
+}
+
+func (m *LoadBalanceRequest) Reset()                    { *m = LoadBalanceRequest{} }
+func (m *LoadBalanceRequest) String() string            { return proto.CompactTextString(m) }
+func (*LoadBalanceRequest) ProtoMessage()               {}
+func (*LoadBalanceRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{2} }
+
+type isLoadBalanceRequest_LoadBalanceRequestType interface {
+	isLoadBalanceRequest_LoadBalanceRequestType()
+}
+
+type LoadBalanceRequest_InitialRequest struct {
+	InitialRequest *InitialLoadBalanceRequest `protobuf:"bytes,1,opt,name=initial_request,json=initialRequest,oneof"`
+}
+type LoadBalanceRequest_ClientStats struct {
+	ClientStats *ClientStats `protobuf:"bytes,2,opt,name=client_stats,json=clientStats,oneof"`
+}
+
+func (*LoadBalanceRequest_InitialRequest) isLoadBalanceRequest_LoadBalanceRequestType() {}
+func (*LoadBalanceRequest_ClientStats) isLoadBalanceRequest_LoadBalanceRequestType()    {}
+
+func (m *LoadBalanceRequest) GetLoadBalanceRequestType() isLoadBalanceRequest_LoadBalanceRequestType {
+	if m != nil {
+		return m.LoadBalanceRequestType
+	}
+	return nil
+}
+
+func (m *LoadBalanceRequest) GetInitialRequest() *InitialLoadBalanceRequest {
+	if x, ok := m.GetLoadBalanceRequestType().(*LoadBalanceRequest_InitialRequest); ok {
+		return x.InitialRequest
+	}
+	return nil
+}
+
+func (m *LoadBalanceRequest) GetClientStats() *ClientStats {
+	if x, ok := m.GetLoadBalanceRequestType().(*LoadBalanceRequest_ClientStats); ok {
+		return x.ClientStats
+	}
+	return nil
+}
+
+// XXX_OneofFuncs is for the internal use of the proto package.
+func (*LoadBalanceRequest) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
+	return _LoadBalanceRequest_OneofMarshaler, _LoadBalanceRequest_OneofUnmarshaler, _LoadBalanceRequest_OneofSizer, []interface{}{
+		(*LoadBalanceRequest_InitialRequest)(nil),
+		(*LoadBalanceRequest_ClientStats)(nil),
+	}
+}
+
+func _LoadBalanceRequest_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
+	m := msg.(*LoadBalanceRequest)
+	// load_balance_request_type
+	switch x := m.LoadBalanceRequestType.(type) {
+	case *LoadBalanceRequest_InitialRequest:
+		b.EncodeVarint(1<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.InitialRequest); err != nil {
+			return err
+		}
+	case *LoadBalanceRequest_ClientStats:
+		b.EncodeVarint(2<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.ClientStats); err != nil {
+			return err
+		}
+	case nil:
+	default:
+		return fmt.Errorf("LoadBalanceRequest.LoadBalanceRequestType has unexpected type %T", x)
+	}
+	return nil
+}
+
+func _LoadBalanceRequest_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
+	m := msg.(*LoadBalanceRequest)
+	switch tag {
+	case 1: // load_balance_request_type.initial_request
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(InitialLoadBalanceRequest)
+		err := b.DecodeMessage(msg)
+		m.LoadBalanceRequestType = &LoadBalanceRequest_InitialRequest{msg}
+		return true, err
+	case 2: // load_balance_request_type.client_stats
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(ClientStats)
+		err := b.DecodeMessage(msg)
+		m.LoadBalanceRequestType = &LoadBalanceRequest_ClientStats{msg}
+		return true, err
+	default:
+		return false, nil
+	}
+}
+
+func _LoadBalanceRequest_OneofSizer(msg proto.Message) (n int) {
+	m := msg.(*LoadBalanceRequest)
+	// load_balance_request_type
+	switch x := m.LoadBalanceRequestType.(type) {
+	case *LoadBalanceRequest_InitialRequest:
+		s := proto.Size(x.InitialRequest)
+		n += proto.SizeVarint(1<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *LoadBalanceRequest_ClientStats:
+		s := proto.Size(x.ClientStats)
+		n += proto.SizeVarint(2<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case nil:
+	default:
+		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
+	}
+	return n
+}
+
+type InitialLoadBalanceRequest struct {
+	// Name of load balanced service (IE, balancer.service.com)
+	// length should be less than 256 bytes.
+	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
+}
+
+func (m *InitialLoadBalanceRequest) Reset()                    { *m = InitialLoadBalanceRequest{} }
+func (m *InitialLoadBalanceRequest) String() string            { return proto.CompactTextString(m) }
+func (*InitialLoadBalanceRequest) ProtoMessage()               {}
+func (*InitialLoadBalanceRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{3} }
+
+func (m *InitialLoadBalanceRequest) GetName() string {
+	if m != nil {
+		return m.Name
+	}
+	return ""
+}
+
+// Contains client level statistics that are useful to load balancing. Each
+// count except the timestamp should be reset to zero after reporting the stats.
+type ClientStats struct {
+	// The timestamp of generating the report.
+	Timestamp *Timestamp `protobuf:"bytes,1,opt,name=timestamp" json:"timestamp,omitempty"`
+	// The total number of RPCs that started.
+	NumCallsStarted int64 `protobuf:"varint,2,opt,name=num_calls_started,json=numCallsStarted" json:"num_calls_started,omitempty"`
+	// The total number of RPCs that finished.
+	NumCallsFinished int64 `protobuf:"varint,3,opt,name=num_calls_finished,json=numCallsFinished" json:"num_calls_finished,omitempty"`
+	// The total number of RPCs that were dropped by the client because of rate
+	// limiting.
+	NumCallsFinishedWithDropForRateLimiting int64 `protobuf:"varint,4,opt,name=num_calls_finished_with_drop_for_rate_limiting,json=numCallsFinishedWithDropForRateLimiting" json:"num_calls_finished_with_drop_for_rate_limiting,omitempty"`
+	// The total number of RPCs that were dropped by the client because of load
+	// balancing.
+	NumCallsFinishedWithDropForLoadBalancing int64 `protobuf:"varint,5,opt,name=num_calls_finished_with_drop_for_load_balancing,json=numCallsFinishedWithDropForLoadBalancing" json:"num_calls_finished_with_drop_for_load_balancing,omitempty"`
+	// The total number of RPCs that failed to reach a server except dropped RPCs.
+	NumCallsFinishedWithClientFailedToSend int64 `protobuf:"varint,6,opt,name=num_calls_finished_with_client_failed_to_send,json=numCallsFinishedWithClientFailedToSend" json:"num_calls_finished_with_client_failed_to_send,omitempty"`
+	// The total number of RPCs that finished and are known to have been received
+	// by a server.
+	NumCallsFinishedKnownReceived int64 `protobuf:"varint,7,opt,name=num_calls_finished_known_received,json=numCallsFinishedKnownReceived" json:"num_calls_finished_known_received,omitempty"`
+}
+
+func (m *ClientStats) Reset()                    { *m = ClientStats{} }
+func (m *ClientStats) String() string            { return proto.CompactTextString(m) }
+func (*ClientStats) ProtoMessage()               {}
+func (*ClientStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{4} }
+
+func (m *ClientStats) GetTimestamp() *Timestamp {
+	if m != nil {
+		return m.Timestamp
+	}
+	return nil
+}
+
+func (m *ClientStats) GetNumCallsStarted() int64 {
+	if m != nil {
+		return m.NumCallsStarted
+	}
+	return 0
+}
+
+func (m *ClientStats) GetNumCallsFinished() int64 {
+	if m != nil {
+		return m.NumCallsFinished
+	}
+	return 0
+}
+
+func (m *ClientStats) GetNumCallsFinishedWithDropForRateLimiting() int64 {
+	if m != nil {
+		return m.NumCallsFinishedWithDropForRateLimiting
+	}
+	return 0
+}
+
+func (m *ClientStats) GetNumCallsFinishedWithDropForLoadBalancing() int64 {
+	if m != nil {
+		return m.NumCallsFinishedWithDropForLoadBalancing
+	}
+	return 0
+}
+
+func (m *ClientStats) GetNumCallsFinishedWithClientFailedToSend() int64 {
+	if m != nil {
+		return m.NumCallsFinishedWithClientFailedToSend
+	}
+	return 0
+}
+
+func (m *ClientStats) GetNumCallsFinishedKnownReceived() int64 {
+	if m != nil {
+		return m.NumCallsFinishedKnownReceived
+	}
+	return 0
+}
+
+type LoadBalanceResponse struct {
+	// Types that are valid to be assigned to LoadBalanceResponseType:
+	//	*LoadBalanceResponse_InitialResponse
+	//	*LoadBalanceResponse_ServerList
+	LoadBalanceResponseType isLoadBalanceResponse_LoadBalanceResponseType `protobuf_oneof:"load_balance_response_type"`
+}
+
+func (m *LoadBalanceResponse) Reset()                    { *m = LoadBalanceResponse{} }
+func (m *LoadBalanceResponse) String() string            { return proto.CompactTextString(m) }
+func (*LoadBalanceResponse) ProtoMessage()               {}
+func (*LoadBalanceResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{5} }
+
+type isLoadBalanceResponse_LoadBalanceResponseType interface {
+	isLoadBalanceResponse_LoadBalanceResponseType()
+}
+
+type LoadBalanceResponse_InitialResponse struct {
+	InitialResponse *InitialLoadBalanceResponse `protobuf:"bytes,1,opt,name=initial_response,json=initialResponse,oneof"`
+}
+type LoadBalanceResponse_ServerList struct {
+	ServerList *ServerList `protobuf:"bytes,2,opt,name=server_list,json=serverList,oneof"`
+}
+
+func (*LoadBalanceResponse_InitialResponse) isLoadBalanceResponse_LoadBalanceResponseType() {}
+func (*LoadBalanceResponse_ServerList) isLoadBalanceResponse_LoadBalanceResponseType()      {}
+
+func (m *LoadBalanceResponse) GetLoadBalanceResponseType() isLoadBalanceResponse_LoadBalanceResponseType {
+	if m != nil {
+		return m.LoadBalanceResponseType
+	}
+	return nil
+}
+
+func (m *LoadBalanceResponse) GetInitialResponse() *InitialLoadBalanceResponse {
+	if x, ok := m.GetLoadBalanceResponseType().(*LoadBalanceResponse_InitialResponse); ok {
+		return x.InitialResponse
+	}
+	return nil
+}
+
+func (m *LoadBalanceResponse) GetServerList() *ServerList {
+	if x, ok := m.GetLoadBalanceResponseType().(*LoadBalanceResponse_ServerList); ok {
+		return x.ServerList
+	}
+	return nil
+}
+
+// XXX_OneofFuncs is for the internal use of the proto package.
+func (*LoadBalanceResponse) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
+	return _LoadBalanceResponse_OneofMarshaler, _LoadBalanceResponse_OneofUnmarshaler, _LoadBalanceResponse_OneofSizer, []interface{}{
+		(*LoadBalanceResponse_InitialResponse)(nil),
+		(*LoadBalanceResponse_ServerList)(nil),
+	}
+}
+
+func _LoadBalanceResponse_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
+	m := msg.(*LoadBalanceResponse)
+	// load_balance_response_type
+	switch x := m.LoadBalanceResponseType.(type) {
+	case *LoadBalanceResponse_InitialResponse:
+		b.EncodeVarint(1<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.InitialResponse); err != nil {
+			return err
+		}
+	case *LoadBalanceResponse_ServerList:
+		b.EncodeVarint(2<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.ServerList); err != nil {
+			return err
+		}
+	case nil:
+	default:
+		return fmt.Errorf("LoadBalanceResponse.LoadBalanceResponseType has unexpected type %T", x)
+	}
+	return nil
+}
+
+func _LoadBalanceResponse_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
+	m := msg.(*LoadBalanceResponse)
+	switch tag {
+	case 1: // load_balance_response_type.initial_response
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(InitialLoadBalanceResponse)
+		err := b.DecodeMessage(msg)
+		m.LoadBalanceResponseType = &LoadBalanceResponse_InitialResponse{msg}
+		return true, err
+	case 2: // load_balance_response_type.server_list
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(ServerList)
+		err := b.DecodeMessage(msg)
+		m.LoadBalanceResponseType = &LoadBalanceResponse_ServerList{msg}
+		return true, err
+	default:
+		return false, nil
+	}
+}
+
+func _LoadBalanceResponse_OneofSizer(msg proto.Message) (n int) {
+	m := msg.(*LoadBalanceResponse)
+	// load_balance_response_type
+	switch x := m.LoadBalanceResponseType.(type) {
+	case *LoadBalanceResponse_InitialResponse:
+		s := proto.Size(x.InitialResponse)
+		n += proto.SizeVarint(1<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *LoadBalanceResponse_ServerList:
+		s := proto.Size(x.ServerList)
+		n += proto.SizeVarint(2<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case nil:
+	default:
+		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
+	}
+	return n
+}
+
+type InitialLoadBalanceResponse struct {
+	// This is an application layer redirect that indicates the client should use
+	// the specified server for load balancing. When this field is non-empty in
+	// the response, the client should open a separate connection to the
+	// load_balancer_delegate and call the BalanceLoad method. Its length should
+	// be less than 64 bytes.
+	LoadBalancerDelegate string `protobuf:"bytes,1,opt,name=load_balancer_delegate,json=loadBalancerDelegate" json:"load_balancer_delegate,omitempty"`
+	// This interval defines how often the client should send the client stats
+	// to the load balancer. Stats should only be reported when the duration is
+	// positive.
+	ClientStatsReportInterval *Duration `protobuf:"bytes,2,opt,name=client_stats_report_interval,json=clientStatsReportInterval" json:"client_stats_report_interval,omitempty"`
+}
+
+func (m *InitialLoadBalanceResponse) Reset()                    { *m = InitialLoadBalanceResponse{} }
+func (m *InitialLoadBalanceResponse) String() string            { return proto.CompactTextString(m) }
+func (*InitialLoadBalanceResponse) ProtoMessage()               {}
+func (*InitialLoadBalanceResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{6} }
+
+func (m *InitialLoadBalanceResponse) GetLoadBalancerDelegate() string {
+	if m != nil {
+		return m.LoadBalancerDelegate
+	}
+	return ""
+}
+
+func (m *InitialLoadBalanceResponse) GetClientStatsReportInterval() *Duration {
+	if m != nil {
+		return m.ClientStatsReportInterval
+	}
+	return nil
+}
+
+type ServerList struct {
+	// Contains a list of servers selected by the load balancer. The list will
+	// be updated when server resolutions change or as needed to balance load
+	// across more servers. The client should consume the server list in order
+	// unless instructed otherwise via the client_config.
+	Servers []*Server `protobuf:"bytes,1,rep,name=servers" json:"servers,omitempty"`
+	// Indicates the amount of time that the client should consider this server
+	// list as valid. It may be considered stale after waiting this interval of
+	// time after receiving the list. If the interval is not positive, the
+	// client can assume the list is valid until the next list is received.
+	ExpirationInterval *Duration `protobuf:"bytes,3,opt,name=expiration_interval,json=expirationInterval" json:"expiration_interval,omitempty"`
+}
+
+func (m *ServerList) Reset()                    { *m = ServerList{} }
+func (m *ServerList) String() string            { return proto.CompactTextString(m) }
+func (*ServerList) ProtoMessage()               {}
+func (*ServerList) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7} }
+
+func (m *ServerList) GetServers() []*Server {
+	if m != nil {
+		return m.Servers
+	}
+	return nil
+}
+
+func (m *ServerList) GetExpirationInterval() *Duration {
+	if m != nil {
+		return m.ExpirationInterval
+	}
+	return nil
+}
+
+// Contains server information. When none of the [drop_for_*] fields are true,
+// use the other fields. When drop_for_rate_limiting is true, ignore all other
+// fields. Use drop_for_load_balancing only when it is true and
+// drop_for_rate_limiting is false.
+type Server struct {
+	// A resolved address for the server, serialized in network-byte-order. It may
+	// either be an IPv4 or IPv6 address.
+	IpAddress []byte `protobuf:"bytes,1,opt,name=ip_address,json=ipAddress,proto3" json:"ip_address,omitempty"`
+	// A resolved port number for the server.
+	Port int32 `protobuf:"varint,2,opt,name=port" json:"port,omitempty"`
+	// An opaque but printable token given to the frontend for each pick. All
+	// frontend requests for that pick must include the token in its initial
+	// metadata. The token is used by the backend to verify the request and to
+	// allow the backend to report load to the gRPC LB system.
+	//
+	// Its length is variable but less than 50 bytes.
+	LoadBalanceToken string `protobuf:"bytes,3,opt,name=load_balance_token,json=loadBalanceToken" json:"load_balance_token,omitempty"`
+	// Indicates whether this particular request should be dropped by the client
+	// for rate limiting.
+	DropForRateLimiting bool `protobuf:"varint,4,opt,name=drop_for_rate_limiting,json=dropForRateLimiting" json:"drop_for_rate_limiting,omitempty"`
+	// Indicates whether this particular request should be dropped by the client
+	// for load balancing.
+	DropForLoadBalancing bool `protobuf:"varint,5,opt,name=drop_for_load_balancing,json=dropForLoadBalancing" json:"drop_for_load_balancing,omitempty"`
+}
+
+func (m *Server) Reset()                    { *m = Server{} }
+func (m *Server) String() string            { return proto.CompactTextString(m) }
+func (*Server) ProtoMessage()               {}
+func (*Server) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{8} }
+
+func (m *Server) GetIpAddress() []byte {
+	if m != nil {
+		return m.IpAddress
+	}
+	return nil
+}
+
+func (m *Server) GetPort() int32 {
+	if m != nil {
+		return m.Port
+	}
+	return 0
+}
+
+func (m *Server) GetLoadBalanceToken() string {
+	if m != nil {
+		return m.LoadBalanceToken
+	}
+	return ""
+}
+
+func (m *Server) GetDropForRateLimiting() bool {
+	if m != nil {
+		return m.DropForRateLimiting
+	}
+	return false
+}
+
+func (m *Server) GetDropForLoadBalancing() bool {
+	if m != nil {
+		return m.DropForLoadBalancing
+	}
+	return false
+}
+
+func init() {
+	proto.RegisterType((*Duration)(nil), "grpc.lb.v1.Duration")
+	proto.RegisterType((*Timestamp)(nil), "grpc.lb.v1.Timestamp")
+	proto.RegisterType((*LoadBalanceRequest)(nil), "grpc.lb.v1.LoadBalanceRequest")
+	proto.RegisterType((*InitialLoadBalanceRequest)(nil), "grpc.lb.v1.InitialLoadBalanceRequest")
+	proto.RegisterType((*ClientStats)(nil), "grpc.lb.v1.ClientStats")
+	proto.RegisterType((*LoadBalanceResponse)(nil), "grpc.lb.v1.LoadBalanceResponse")
+	proto.RegisterType((*InitialLoadBalanceResponse)(nil), "grpc.lb.v1.InitialLoadBalanceResponse")
+	proto.RegisterType((*ServerList)(nil), "grpc.lb.v1.ServerList")
+	proto.RegisterType((*Server)(nil), "grpc.lb.v1.Server")
+}
+
+func init() { proto.RegisterFile("grpclb.proto", fileDescriptor0) }
+
+var fileDescriptor0 = []byte{
+	// 733 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x55, 0xdd, 0x4e, 0x1b, 0x39,
+	0x14, 0x66, 0x36, 0xfc, 0xe5, 0x24, 0x5a, 0x58, 0x93, 0x85, 0xc0, 0xc2, 0x2e, 0x1b, 0xa9, 0x34,
+	0xaa, 0x68, 0x68, 0x43, 0x7b, 0xd1, 0x9f, 0x9b, 0x02, 0x45, 0x41, 0xe5, 0xa2, 0x72, 0xa8, 0x7a,
+	0x55, 0x59, 0x4e, 0xc6, 0x80, 0xc5, 0xc4, 0x9e, 0xda, 0x4e, 0x68, 0x2f, 0x7b, 0xd9, 0x47, 0xe9,
+	0x63, 0x54, 0x7d, 0x86, 0xbe, 0x4f, 0x65, 0x7b, 0x26, 0x33, 0x90, 0x1f, 0xd4, 0xbb, 0xf1, 0xf1,
+	0x77, 0xbe, 0xf3, 0xf9, 0xd8, 0xdf, 0x19, 0x28, 0x5f, 0xa8, 0xb8, 0x1b, 0x75, 0x1a, 0xb1, 0x92,
+	0x46, 0x22, 0xb0, 0xab, 0x46, 0xd4, 0x69, 0x0c, 0x1e, 0xd7, 0x9e, 0xc3, 0xe2, 0x51, 0x5f, 0x51,
+	0xc3, 0xa5, 0x40, 0x55, 0x58, 0xd0, 0xac, 0x2b, 0x45, 0xa8, 0xab, 0xc1, 0x76, 0x50, 0x2f, 0xe0,
+	0x74, 0x89, 0x2a, 0x30, 0x27, 0xa8, 0x90, 0xba, 0xfa, 0xc7, 0x76, 0x50, 0x9f, 0xc3, 0x7e, 0x51,
+	0x7b, 0x01, 0xc5, 0x33, 0xde, 0x63, 0xda, 0xd0, 0x5e, 0xfc, 0xdb, 0xc9, 0xdf, 0x03, 0x40, 0xa7,
+	0x92, 0x86, 0x07, 0x34, 0xa2, 0xa2, 0xcb, 0x30, 0xfb, 0xd8, 0x67, 0xda, 0xa0, 0xb7, 0xb0, 0xc4,
+	0x05, 0x37, 0x9c, 0x46, 0x44, 0xf9, 0x90, 0xa3, 0x2b, 0x35, 0xef, 0x35, 0x32, 0xd5, 0x8d, 0x13,
+	0x0f, 0x19, 0xcd, 0x6f, 0xcd, 0xe0, 0x3f, 0x93, 0xfc, 0x94, 0xf1, 0x25, 0x94, 0xbb, 0x11, 0x67,
+	0xc2, 0x10, 0x6d, 0xa8, 0xf1, 0x2a, 0x4a, 0xcd, 0xb5, 0x3c, 0xdd, 0xa1, 0xdb, 0x6f, 0xdb, 0xed,
+	0xd6, 0x0c, 0x2e, 0x75, 0xb3, 0xe5, 0xc1, 0x3f, 0xb0, 0x1e, 0x49, 0x1a, 0x92, 0x8e, 0x2f, 0x93,
+	0x8a, 0x22, 0xe6, 0x73, 0xcc, 0x6a, 0x7b, 0xb0, 0x3e, 0x51, 0x09, 0x42, 0x30, 0x2b, 0x68, 0x8f,
+	0x39, 0xf9, 0x45, 0xec, 0xbe, 0x6b, 0x5f, 0x67, 0xa1, 0x94, 0x2b, 0x86, 0xf6, 0xa1, 0x68, 0xd2,
+	0x0e, 0x26, 0xe7, 0xfc, 0x3b, 0x2f, 0x6c, 0xd8, 0x5e, 0x9c, 0xe1, 0xd0, 0x03, 0xf8, 0x4b, 0xf4,
+	0x7b, 0xa4, 0x4b, 0xa3, 0x48, 0xdb, 0x33, 0x29, 0xc3, 0x42, 0x77, 0xaa, 0x02, 0x5e, 0x12, 0xfd,
+	0xde, 0xa1, 0x8d, 0xb7, 0x7d, 0x18, 0xed, 0x02, 0xca, 0xb0, 0xe7, 0x5c, 0x70, 0x7d, 0xc9, 0xc2,
+	0x6a, 0xc1, 0x81, 0x97, 0x53, 0xf0, 0x71, 0x12, 0x47, 0x04, 0x1a, 0xa3, 0x68, 0x72, 0xcd, 0xcd,
+	0x25, 0x09, 0x95, 0x8c, 0xc9, 0xb9, 0x54, 0x44, 0x51, 0xc3, 0x48, 0xc4, 0x7b, 0xdc, 0x70, 0x71,
+	0x51, 0x9d, 0x75, 0x4c, 0xf7, 0x6f, 0x33, 0xbd, 0xe7, 0xe6, 0xf2, 0x48, 0xc9, 0xf8, 0x58, 0x2a,
+	0x4c, 0x0d, 0x3b, 0x4d, 0xe0, 0x88, 0xc2, 0xde, 0x9d, 0x05, 0x72, 0xed, 0xb6, 0x15, 0xe6, 0x5c,
+	0x85, 0xfa, 0x94, 0x0a, 0x59, 0xef, 0x6d, 0x89, 0x0f, 0xf0, 0x70, 0x52, 0x89, 0xe4, 0x19, 0x9c,
+	0x53, 0x1e, 0xb1, 0x90, 0x18, 0x49, 0x34, 0x13, 0x61, 0x75, 0xde, 0x15, 0xd8, 0x19, 0x57, 0xc0,
+	0x5f, 0xd5, 0xb1, 0xc3, 0x9f, 0xc9, 0x36, 0x13, 0x21, 0x6a, 0xc1, 0xff, 0x63, 0xe8, 0xaf, 0x84,
+	0xbc, 0x16, 0x44, 0xb1, 0x2e, 0xe3, 0x03, 0x16, 0x56, 0x17, 0x1c, 0xe5, 0xd6, 0x6d, 0xca, 0x37,
+	0x16, 0x85, 0x13, 0x50, 0xed, 0x47, 0x00, 0x2b, 0x37, 0x9e, 0x8d, 0x8e, 0xa5, 0xd0, 0x0c, 0xb5,
+	0x61, 0x39, 0x73, 0x80, 0x8f, 0x25, 0x4f, 0x63, 0xe7, 0x2e, 0x0b, 0x78, 0x74, 0x6b, 0x06, 0x2f,
+	0x0d, 0x3d, 0x90, 0x90, 0x3e, 0x83, 0x92, 0x66, 0x6a, 0xc0, 0x14, 0x89, 0xb8, 0x36, 0x89, 0x07,
+	0x56, 0xf3, 0x7c, 0x6d, 0xb7, 0x7d, 0xca, 0x9d, 0x87, 0x40, 0x0f, 0x57, 0x07, 0x9b, 0xb0, 0x71,
+	0xcb, 0x01, 0x9e, 0xd3, 0x5b, 0xe0, 0x5b, 0x00, 0x1b, 0x93, 0xa5, 0xa0, 0x27, 0xb0, 0x9a, 0x4f,
+	0x56, 0x24, 0x64, 0x11, 0xbb, 0xa0, 0x26, 0xb5, 0x45, 0x25, 0xca, 0x92, 0xd4, 0x51, 0xb2, 0x87,
+	0xde, 0xc1, 0x66, 0xde, 0xb2, 0x44, 0xb1, 0x58, 0x2a, 0x43, 0xb8, 0x30, 0x4c, 0x0d, 0x68, 0x94,
+	0xc8, 0xaf, 0xe4, 0xe5, 0xa7, 0x43, 0x0c, 0xaf, 0xe7, 0xdc, 0x8b, 0x5d, 0xde, 0x49, 0x92, 0x56,
+	0xfb, 0x12, 0x00, 0x64, 0xc7, 0x44, 0xbb, 0x76, 0x62, 0xd9, 0x95, 0x9d, 0x58, 0x85, 0x7a, 0xa9,
+	0x89, 0x46, 0xfb, 0x81, 0x53, 0x08, 0x7a, 0x0d, 0x2b, 0xec, 0x53, 0xcc, 0x7d, 0x95, 0x4c, 0x4a,
+	0x61, 0x8a, 0x14, 0x94, 0x25, 0x0c, 0x35, 0xfc, 0x0c, 0x60, 0xde, 0x53, 0xa3, 0x2d, 0x00, 0x1e,
+	0x13, 0x1a, 0x86, 0x8a, 0x69, 0x3f, 0x34, 0xcb, 0xb8, 0xc8, 0xe3, 0x57, 0x3e, 0x60, 0xe7, 0x87,
+	0x55, 0x9f, 0x4c, 0x4d, 0xf7, 0x6d, 0xed, 0x7c, 0xe3, 0x2e, 0x8c, 0xbc, 0x62, 0xc2, 0x69, 0x28,
+	0xe2, 0xe5, 0x5c, 0x2b, 0xcf, 0x6c, 0x1c, 0xed, 0xc3, 0xea, 0x14, 0xdb, 0x2e, 0xe2, 0x95, 0x70,
+	0x8c, 0x45, 0x9f, 0xc2, 0xda, 0x34, 0x2b, 0x2e, 0xe2, 0x4a, 0x38, 0xc6, 0x76, 0xcd, 0x0e, 0x94,
+	0x73, 0xf7, 0xaf, 0x10, 0x86, 0x52, 0xf2, 0x6d, 0xc3, 0xe8, 0xdf, 0x7c, 0x83, 0x46, 0x87, 0xe5,
+	0xc6, 0x7f, 0x13, 0xf7, 0xfd, 0x43, 0xaa, 0x07, 0x8f, 0x82, 0xce, 0xbc, 0xfb, 0x7d, 0xed, 0xff,
+	0x0a, 0x00, 0x00, 0xff, 0xff, 0x64, 0xbf, 0xda, 0x5e, 0xce, 0x06, 0x00, 0x00,
+}
diff --git a/components/engine/vendor/google.golang.org/grpc/grpclb/grpc_lb_v1/grpclb.proto b/components/engine/vendor/google.golang.org/grpc/grpclb/grpc_lb_v1/grpclb.proto
new file mode 100644
index 0000000000..a2502fb284
--- /dev/null
+++ b/components/engine/vendor/google.golang.org/grpc/grpclb/grpc_lb_v1/grpclb.proto
@@ -0,0 +1,179 @@
+// Copyright 2016, Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+syntax = "proto3";
+
+package grpc.lb.v1;
+
+message Duration {
+  // Signed seconds of the span of time. Must be from -315,576,000,000
+  // to +315,576,000,000 inclusive.
+  int64 seconds = 1;
+
+  // Signed fractions of a second at nanosecond resolution of the span
+  // of time. Durations less than one second are represented with a 0
+  // `seconds` field and a positive or negative `nanos` field. For durations
+  // of one second or more, a non-zero value for the `nanos` field must be
+  // of the same sign as the `seconds` field. Must be from -999,999,999
+  // to +999,999,999 inclusive.
+  int32 nanos = 2;
+}
+
+message Timestamp {
+
+  // Represents seconds of UTC time since Unix epoch
+  // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
+  // 9999-12-31T23:59:59Z inclusive.
+  int64 seconds = 1;
+
+  // Non-negative fractions of a second at nanosecond resolution. Negative
+  // second values with fractions must still have non-negative nanos values
+  // that count forward in time. Must be from 0 to 999,999,999
+  // inclusive.
+  int32 nanos = 2;
+}
+
+service LoadBalancer {
+  // Bidirectional rpc to get a list of servers.
+  rpc BalanceLoad(stream LoadBalanceRequest)
+      returns (stream LoadBalanceResponse);
+}
+
+message LoadBalanceRequest {
+  oneof load_balance_request_type {
+    // This message should be sent on the first request to the load balancer.
+    InitialLoadBalanceRequest initial_request = 1;
+
+    // The client stats should be periodically reported to the load balancer
+    // based on the duration defined in the InitialLoadBalanceResponse.
+    ClientStats client_stats = 2;
+  }
+}
+
+message InitialLoadBalanceRequest {
+  // Name of load balanced service (IE, balancer.service.com)
+  // length should be less than 256 bytes.
+  string name = 1;
+}
+
+// Contains client level statistics that are useful to load balancing. Each
+// count except the timestamp should be reset to zero after reporting the stats.
+message ClientStats {
+  // The timestamp of generating the report.
+  Timestamp timestamp = 1;
+
+  // The total number of RPCs that started.
+  int64 num_calls_started = 2;
+
+  // The total number of RPCs that finished.
+  int64 num_calls_finished = 3;
+
+  // The total number of RPCs that were dropped by the client because of rate
+  // limiting.
+  int64 num_calls_finished_with_drop_for_rate_limiting = 4;
+
+  // The total number of RPCs that were dropped by the client because of load
+  // balancing.
+  int64 num_calls_finished_with_drop_for_load_balancing = 5;
+
+  // The total number of RPCs that failed to reach a server except dropped RPCs.
+  int64 num_calls_finished_with_client_failed_to_send = 6;
+
+  // The total number of RPCs that finished and are known to have been received
+  // by a server.
+  int64 num_calls_finished_known_received = 7;
+}
+
+message LoadBalanceResponse {
+  oneof load_balance_response_type {
+    // This message should be sent on the first response to the client.
+    InitialLoadBalanceResponse initial_response = 1;
+
+    // Contains the list of servers selected by the load balancer. The client
+    // should send requests to these servers in the specified order.
+    ServerList server_list = 2;
+  }
+}
+
+message InitialLoadBalanceResponse {
+  // This is an application layer redirect that indicates the client should use
+  // the specified server for load balancing. When this field is non-empty in
+  // the response, the client should open a separate connection to the
+  // load_balancer_delegate and call the BalanceLoad method. Its length should
+  // be less than 64 bytes.
+  string load_balancer_delegate = 1;
+
+  // This interval defines how often the client should send the client stats
+  // to the load balancer. Stats should only be reported when the duration is
+  // positive.
+  Duration client_stats_report_interval = 2;
+}
+
+message ServerList {
+  // Contains a list of servers selected by the load balancer. The list will
+  // be updated when server resolutions change or as needed to balance load
+  // across more servers. The client should consume the server list in order
+  // unless instructed otherwise via the client_config.
+  repeated Server servers = 1;
+
+  // Indicates the amount of time that the client should consider this server
+  // list as valid. It may be considered stale after waiting this interval of
+  // time after receiving the list. If the interval is not positive, the
+  // client can assume the list is valid until the next list is received.
+  Duration expiration_interval = 3;
+}
+
+// Contains server information. When none of the [drop_for_*] fields are true,
+// use the other fields. When drop_for_rate_limiting is true, ignore all other
+// fields. Use drop_for_load_balancing only when it is true and
+// drop_for_rate_limiting is false.
+message Server {
+  // A resolved address for the server, serialized in network-byte-order. It may
+  // either be an IPv4 or IPv6 address.
+  bytes ip_address = 1;
+
+  // A resolved port number for the server.
+  int32 port = 2;
+
+  // An opaque but printable token given to the frontend for each pick. All
+  // frontend requests for that pick must include the token in its initial
+  // metadata. The token is used by the backend to verify the request and to
+  // allow the backend to report load to the gRPC LB system.
+  //
+  // Its length is variable but less than 50 bytes.
+  string load_balance_token = 3;
+
+  // Indicates whether this particular request should be dropped by the client
+  // for rate limiting.
+  bool drop_for_rate_limiting = 4;
+
+  // Indicates whether this particular request should be dropped by the client
+  // for load balancing.
+  bool drop_for_load_balancing = 5;
+}
diff --git a/components/engine/vendor/google.golang.org/grpc/health/health.go b/components/engine/vendor/google.golang.org/grpc/health/health.go
new file mode 100644
index 0000000000..342552986e
--- /dev/null
+++ b/components/engine/vendor/google.golang.org/grpc/health/health.go
@@ -0,0 +1,52 @@
+// Package health provides some utility functions to health-check a server. The implementation
+// is based on protobuf. Users need to write their own implementations if other IDLs are used.
+package health
+
+import (
+	"sync"
+
+	"golang.org/x/net/context"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	healthpb "google.golang.org/grpc/health/grpc_health_v1"
+)
+
+// Server implements `service Health`.
+type Server struct {
+	mu sync.Mutex
+	// statusMap stores the serving status of the services this Server monitors.
+	statusMap map[string]healthpb.HealthCheckResponse_ServingStatus
+}
+
+// NewServer returns a new Server.
+func NewServer() *Server {
+	return &Server{
+		statusMap: make(map[string]healthpb.HealthCheckResponse_ServingStatus),
+	}
+}
+
+// Check implements `service Health`.
+func (s *Server) Check(ctx context.Context, in *healthpb.HealthCheckRequest) (*healthpb.HealthCheckResponse, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if in.Service == "" {
+		// check the server overall health status.
+		return &healthpb.HealthCheckResponse{
+			Status: healthpb.HealthCheckResponse_SERVING,
+		}, nil
+	}
+	if status, ok := s.statusMap[in.Service]; ok {
+		return &healthpb.HealthCheckResponse{
+			Status: status,
+		}, nil
+	}
+	return nil, grpc.Errorf(codes.NotFound, "unknown service")
+}
+
+// SetServingStatus is called when need to reset the serving status of a service
+// or insert a new service entry into the statusMap.
+func (s *Server) SetServingStatus(service string, status healthpb.HealthCheckResponse_ServingStatus) {
+	s.mu.Lock()
+	s.statusMap[service] = status
+	s.mu.Unlock()
+}
diff --git a/components/engine/vendor/google.golang.org/grpc/interceptor.go b/components/engine/vendor/google.golang.org/grpc/interceptor.go
index 8d932efed7..a692161457 100644
--- a/components/engine/vendor/google.golang.org/grpc/interceptor.go
+++ b/components/engine/vendor/google.golang.org/grpc/interceptor.go
@@ -40,7 +40,7 @@ import (
 // UnaryInvoker is called by UnaryClientInterceptor to complete RPCs.
 type UnaryInvoker func(ctx context.Context, method string, req, reply interface{}, cc *ClientConn, opts ...CallOption) error
 
-// UnaryClientInterceptor intercepts the execution of a unary RPC on the client. inovker is the handler to complete the RPC
+// UnaryClientInterceptor intercepts the execution of a unary RPC on the client. invoker is the handler to complete the RPC
 // and it is the responsibility of the interceptor to call it.
 // This is the EXPERIMENTAL API.
 type UnaryClientInterceptor func(ctx context.Context, method string, req, reply interface{}, cc *ClientConn, invoker UnaryInvoker, opts ...CallOption) error
diff --git a/components/engine/vendor/google.golang.org/grpc/keepalive/keepalive.go b/components/engine/vendor/google.golang.org/grpc/keepalive/keepalive.go
new file mode 100644
index 0000000000..d492589c96
--- /dev/null
+++ b/components/engine/vendor/google.golang.org/grpc/keepalive/keepalive.go
@@ -0,0 +1,80 @@
+/*
+ *
+ * Copyright 2017, Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+// Package keepalive defines configurable parameters for point-to-point healthcheck.
+package keepalive
+
+import (
+	"time"
+)
+
+// ClientParameters is used to set keepalive parameters on the client-side.
+// These configure how the client will actively probe to notice when a connection broken
+// and to cause activity so intermediaries are aware the connection is still in use.
+// Make sure these parameters are set in coordination with the keepalive policy on the server,
+// as incompatible settings can result in closing of connection.
+type ClientParameters struct {
+	// After a duration of this time if the client doesn't see any activity it pings the server to see if the transport is still alive.
+	Time time.Duration // The current default value is infinity.
+	// After having pinged for keepalive check, the client waits for a duration of Timeout and if no activity is seen even after that
+	// the connection is closed.
+	Timeout time.Duration // The current default value is 20 seconds.
+	// If true, client runs keepalive checks even with no active RPCs.
+	PermitWithoutStream bool // false by default.
+}
+
+// ServerParameters is used to set keepalive and max-age parameters on the server-side.
+type ServerParameters struct {
+	// MaxConnectionIdle is a duration for the amount of time after which an idle connection would be closed by sending a GoAway.
+	// Idleness duration is defined since the most recent time the number of outstanding RPCs became zero or the connection establishment.
+	MaxConnectionIdle time.Duration // The current default value is infinity.
+	// MaxConnectionAge is a duration for the maximum amount of time a connection may exist before it will be closed by sending a GoAway.
+	// A random jitter of +/-10% will be added to MaxConnectionAge to spread out connection storms.
+	MaxConnectionAge time.Duration // The current default value is infinity.
+	// MaxConnectinoAgeGrace is an additive period after MaxConnectionAge after which the connection will be forcibly closed.
+	MaxConnectionAgeGrace time.Duration // The current default value is infinity.
+	// After a duration of this time if the server doesn't see any activity it pings the client to see if the transport is still alive.
+	Time time.Duration // The current default value is 2 hours.
+	// After having pinged for keepalive check, the server waits for a duration of Timeout and if no activity is seen even after that
+	// the connection is closed.
+	Timeout time.Duration // The current default value is 20 seconds.
+}
+
+// EnforcementPolicy is used to set keepalive enforcement policy on the server-side.
+// Server will close connection with a client that violates this policy.
+type EnforcementPolicy struct {
+	// MinTime is the minimum amount of time a client should wait before sending a keepalive ping.
+	MinTime time.Duration // The current default value is 5 minutes.
+	// If true, server expects keepalive pings even when there are no active streams(RPCs).
+	PermitWithoutStream bool // false by default.
+}
diff --git a/components/engine/vendor/google.golang.org/grpc/metadata/metadata.go b/components/engine/vendor/google.golang.org/grpc/metadata/metadata.go
index 3c0ca7a36c..5395ca8200 100644
--- a/components/engine/vendor/google.golang.org/grpc/metadata/metadata.go
+++ b/components/engine/vendor/google.golang.org/grpc/metadata/metadata.go
@@ -32,49 +32,19 @@
  */
 
 // Package metadata define the structure of the metadata supported by gRPC library.
+// Please refer to http://www.grpc.io/docs/guides/wire.html for more information about custom-metadata.
 package metadata // import "google.golang.org/grpc/metadata"
 
 import (
-	"encoding/base64"
 	"fmt"
 	"strings"
 
 	"golang.org/x/net/context"
 )
 
-const (
-	binHdrSuffix = "-bin"
-)
-
-// encodeKeyValue encodes key and value qualified for transmission via gRPC.
-// Transmitting binary headers violates HTTP/2 spec.
-// TODO(zhaoq): Maybe check if k is ASCII also.
-func encodeKeyValue(k, v string) (string, string) {
-	k = strings.ToLower(k)
-	if strings.HasSuffix(k, binHdrSuffix) {
-		val := base64.StdEncoding.EncodeToString([]byte(v))
-		v = string(val)
-	}
-	return k, v
-}
-
-// DecodeKeyValue returns the original key and value corresponding to the
-// encoded data in k, v.
-// If k is a binary header and v contains comma, v is split on comma before decoded,
-// and the decoded v will be joined with comma before returned.
+// DecodeKeyValue returns k, v, nil.  It is deprecated and should not be used.
 func DecodeKeyValue(k, v string) (string, string, error) {
-	if !strings.HasSuffix(k, binHdrSuffix) {
-		return k, v, nil
-	}
-	vvs := strings.Split(v, ",")
-	for i, vv := range vvs {
-		val, err := base64.StdEncoding.DecodeString(vv)
-		if err != nil {
-			return "", "", err
-		}
-		vvs[i] = string(val)
-	}
-	return k, strings.Join(vvs, ","), nil
+	return k, v, nil
 }
 
 // MD is a mapping from metadata keys to values. Users should use the following
@@ -82,10 +52,11 @@ func DecodeKeyValue(k, v string) (string, string, error) {
 type MD map[string][]string
 
 // New creates a MD from given key-value map.
+// Keys are automatically converted to lowercase.
 func New(m map[string]string) MD {
 	md := MD{}
-	for k, v := range m {
-		key, val := encodeKeyValue(k, v)
+	for k, val := range m {
+		key := strings.ToLower(k)
 		md[key] = append(md[key], val)
 	}
 	return md
@@ -93,19 +64,19 @@ func New(m map[string]string) MD {
 
 // Pairs returns an MD formed by the mapping of key, value ...
 // Pairs panics if len(kv) is odd.
+// Keys are automatically converted to lowercase.
 func Pairs(kv ...string) MD {
 	if len(kv)%2 == 1 {
 		panic(fmt.Sprintf("metadata: Pairs got the odd number of input pairs for metadata: %d", len(kv)))
 	}
 	md := MD{}
-	var k string
+	var key string
 	for i, s := range kv {
 		if i%2 == 0 {
-			k = s
+			key = strings.ToLower(s)
 			continue
 		}
-		key, val := encodeKeyValue(k, s)
-		md[key] = append(md[key], val)
+		md[key] = append(md[key], s)
 	}
 	return md
 }
@@ -133,15 +104,41 @@ func Join(mds ...MD) MD {
 	return out
 }
 
-type mdKey struct{}
+type mdIncomingKey struct{}
+type mdOutgoingKey struct{}
 
-// NewContext creates a new context with md attached.
+// NewContext is a wrapper for NewOutgoingContext(ctx, md).  Deprecated.
 func NewContext(ctx context.Context, md MD) context.Context {
-	return context.WithValue(ctx, mdKey{}, md)
+	return NewOutgoingContext(ctx, md)
 }
 
-// FromContext returns the MD in ctx if it exists.
+// NewIncomingContext creates a new context with incoming md attached.
+func NewIncomingContext(ctx context.Context, md MD) context.Context {
+	return context.WithValue(ctx, mdIncomingKey{}, md)
+}
+
+// NewOutgoingContext creates a new context with outgoing md attached.
+func NewOutgoingContext(ctx context.Context, md MD) context.Context {
+	return context.WithValue(ctx, mdOutgoingKey{}, md)
+}
+
+// FromContext is a wrapper for FromIncomingContext(ctx).  Deprecated.
 func FromContext(ctx context.Context) (md MD, ok bool) {
-	md, ok = ctx.Value(mdKey{}).(MD)
+	return FromIncomingContext(ctx)
+}
+
+// FromIncomingContext returns the incoming MD in ctx if it exists.  The
+// returned md should be immutable, writing to it may cause races.
+// Modification should be made to the copies of the returned md.
+func FromIncomingContext(ctx context.Context) (md MD, ok bool) {
+	md, ok = ctx.Value(mdIncomingKey{}).(MD)
+	return
+}
+
+// FromOutgoingContext returns the outgoing MD in ctx if it exists.  The
+// returned md should be immutable, writing to it may cause races.
+// Modification should be made to the copies of the returned md.
+func FromOutgoingContext(ctx context.Context) (md MD, ok bool) {
+	md, ok = ctx.Value(mdOutgoingKey{}).(MD)
 	return
 }
diff --git a/components/engine/vendor/google.golang.org/grpc/proxy.go b/components/engine/vendor/google.golang.org/grpc/proxy.go
new file mode 100644
index 0000000000..10188dc343
--- /dev/null
+++ b/components/engine/vendor/google.golang.org/grpc/proxy.go
@@ -0,0 +1,145 @@
+/*
+ *
+ * Copyright 2017, Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+package grpc
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+
+	"golang.org/x/net/context"
+)
+
+var (
+	// errDisabled indicates that proxy is disabled for the address.
+	errDisabled = errors.New("proxy is disabled for the address")
+	// The following variable will be overwritten in the tests.
+	httpProxyFromEnvironment = http.ProxyFromEnvironment
+)
+
+func mapAddress(ctx context.Context, address string) (string, error) {
+	req := &http.Request{
+		URL: &url.URL{
+			Scheme: "https",
+			Host:   address,
+		},
+	}
+	url, err := httpProxyFromEnvironment(req)
+	if err != nil {
+		return "", err
+	}
+	if url == nil {
+		return "", errDisabled
+	}
+	return url.Host, nil
+}
+
+// To read a response from a net.Conn, http.ReadResponse() takes a bufio.Reader.
+// It's possible that this reader reads more than what's need for the response and stores
+// those bytes in the buffer.
+// bufConn wraps the original net.Conn and the bufio.Reader to make sure we don't lose the
+// bytes in the buffer.
+type bufConn struct {
+	net.Conn
+	r io.Reader
+}
+
+func (c *bufConn) Read(b []byte) (int, error) {
+	return c.r.Read(b)
+}
+
+func doHTTPConnectHandshake(ctx context.Context, conn net.Conn, addr string) (_ net.Conn, err error) {
+	defer func() {
+		if err != nil {
+			conn.Close()
+		}
+	}()
+
+	req := (&http.Request{
+		Method: http.MethodConnect,
+		URL:    &url.URL{Host: addr},
+		Header: map[string][]string{"User-Agent": {grpcUA}},
+	})
+
+	if err := sendHTTPRequest(ctx, req, conn); err != nil {
+		return nil, fmt.Errorf("failed to write the HTTP request: %v", err)
+	}
+
+	r := bufio.NewReader(conn)
+	resp, err := http.ReadResponse(r, req)
+	if err != nil {
+		return nil, fmt.Errorf("reading server HTTP response: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		dump, err := httputil.DumpResponse(resp, true)
+		if err != nil {
+			return nil, fmt.Errorf("failed to do connect handshake, status code: %s", resp.Status)
+		}
+		return nil, fmt.Errorf("failed to do connect handshake, response: %q", dump)
+	}
+
+	return &bufConn{Conn: conn, r: r}, nil
+}
+
+// newProxyDialer returns a dialer that connects to proxy first if necessary.
+// The returned dialer checks if a proxy is necessary, dial to the proxy with the
+// provided dialer, does HTTP CONNECT handshake and returns the connection.
+func newProxyDialer(dialer func(context.Context, string) (net.Conn, error)) func(context.Context, string) (net.Conn, error) {
+	return func(ctx context.Context, addr string) (conn net.Conn, err error) {
+		var skipHandshake bool
+		newAddr, err := mapAddress(ctx, addr)
+		if err != nil {
+			if err != errDisabled {
+				return nil, err
+			}
+			skipHandshake = true
+			newAddr = addr
+		}
+
+		conn, err = dialer(ctx, newAddr)
+		if err != nil {
+			return
+		}
+		if !skipHandshake {
+			conn, err = doHTTPConnectHandshake(ctx, conn, addr)
+		}
+		return
+	}
+}
diff --git a/components/engine/vendor/google.golang.org/grpc/rpc_util.go b/components/engine/vendor/google.golang.org/grpc/rpc_util.go
index a25eaa8a28..34e1ad03b9 100644
--- a/components/engine/vendor/google.golang.org/grpc/rpc_util.go
+++ b/components/engine/vendor/google.golang.org/grpc/rpc_util.go
@@ -37,45 +37,21 @@ import (
 	"bytes"
 	"compress/gzip"
 	"encoding/binary"
-	"fmt"
 	"io"
 	"io/ioutil"
 	"math"
 	"os"
+	"time"
 
-	"github.com/golang/protobuf/proto"
 	"golang.org/x/net/context"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/stats"
+	"google.golang.org/grpc/status"
 	"google.golang.org/grpc/transport"
 )
 
-// Codec defines the interface gRPC uses to encode and decode messages.
-type Codec interface {
-	// Marshal returns the wire format of v.
-	Marshal(v interface{}) ([]byte, error)
-	// Unmarshal parses the wire format into v.
-	Unmarshal(data []byte, v interface{}) error
-	// String returns the name of the Codec implementation. The returned
-	// string will be used as part of content type in transmission.
-	String() string
-}
-
-// protoCodec is a Codec implementation with protobuf. It is the default codec for gRPC.
-type protoCodec struct{}
-
-func (protoCodec) Marshal(v interface{}) ([]byte, error) {
-	return proto.Marshal(v.(proto.Message))
-}
-
-func (protoCodec) Unmarshal(data []byte, v interface{}) error {
-	return proto.Unmarshal(data, v.(proto.Message))
-}
-
-func (protoCodec) String() string {
-	return "proto"
-}
-
 // Compressor defines the interface gRPC uses to compress a message.
 type Compressor interface {
 	// Do compresses p into w.
@@ -138,6 +114,7 @@ type callInfo struct {
 	failFast  bool
 	headerMD  metadata.MD
 	trailerMD metadata.MD
+	peer      *peer.Peer
 	traceInfo traceInfo // in trace.go
 }
 
@@ -181,12 +158,22 @@ func Trailer(md *metadata.MD) CallOption {
 	})
 }
 
+// Peer returns a CallOption that retrieves peer information for a
+// unary RPC.
+func Peer(peer *peer.Peer) CallOption {
+	return afterCall(func(c *callInfo) {
+		if c.peer != nil {
+			*peer = *c.peer
+		}
+	})
+}
+
 // FailFast configures the action to take when an RPC is attempted on broken
 // connections or unreachable servers. If failfast is true, the RPC will fail
 // immediately. Otherwise, the RPC client will block the call until a
 // connection is available (or the call is canceled or times out) and will retry
 // the call if it fails due to a transient error. Please refer to
-// https://github.com/grpc/grpc/blob/master/doc/fail_fast.md
+// https://github.com/grpc/grpc/blob/master/doc/fail_fast.md. Note: failFast is default to true.
 func FailFast(failFast bool) CallOption {
 	return beforeCall(func(c *callInfo) error {
 		c.failFast = failFast
@@ -255,9 +242,11 @@ func (p *parser) recvMsg(maxMsgSize int) (pf payloadFormat, msg []byte, err erro
 
 // encode serializes msg and prepends the message header. If msg is nil, it
 // generates the message header of 0 message length.
-func encode(c Codec, msg interface{}, cp Compressor, cbuf *bytes.Buffer) ([]byte, error) {
-	var b []byte
-	var length uint
+func encode(c Codec, msg interface{}, cp Compressor, cbuf *bytes.Buffer, outPayload *stats.OutPayload) ([]byte, error) {
+	var (
+		b      []byte
+		length uint
+	)
 	if msg != nil {
 		var err error
 		// TODO(zhaoq): optimize to reduce memory alloc and copying.
@@ -265,6 +254,12 @@ func encode(c Codec, msg interface{}, cp Compressor, cbuf *bytes.Buffer) ([]byte
 		if err != nil {
 			return nil, err
 		}
+		if outPayload != nil {
+			outPayload.Payload = msg
+			// TODO truncate large payload.
+			outPayload.Data = b
+			outPayload.Length = len(b)
+		}
 		if cp != nil {
 			if err := cp.Do(cbuf, b); err != nil {
 				return nil, err
@@ -295,6 +290,10 @@ func encode(c Codec, msg interface{}, cp Compressor, cbuf *bytes.Buffer) ([]byte
 	// Copy encoded msg to buf
 	copy(buf[5:], b)
 
+	if outPayload != nil {
+		outPayload.WireLength = len(buf)
+	}
+
 	return buf, nil
 }
 
@@ -311,11 +310,14 @@ func checkRecvPayload(pf payloadFormat, recvCompress string, dc Decompressor) er
 	return nil
 }
 
-func recv(p *parser, c Codec, s *transport.Stream, dc Decompressor, m interface{}, maxMsgSize int) error {
+func recv(p *parser, c Codec, s *transport.Stream, dc Decompressor, m interface{}, maxMsgSize int, inPayload *stats.InPayload) error {
 	pf, d, err := p.recvMsg(maxMsgSize)
 	if err != nil {
 		return err
 	}
+	if inPayload != nil {
+		inPayload.WireLength = len(d)
+	}
 	if err := checkRecvPayload(pf, s.RecvCompress(), dc); err != nil {
 		return err
 	}
@@ -333,91 +335,90 @@ func recv(p *parser, c Codec, s *transport.Stream, dc Decompressor, m interface{
 	if err := c.Unmarshal(d, m); err != nil {
 		return Errorf(codes.Internal, "grpc: failed to unmarshal the received message %v", err)
 	}
+	if inPayload != nil {
+		inPayload.RecvTime = time.Now()
+		inPayload.Payload = m
+		// TODO truncate large payload.
+		inPayload.Data = d
+		inPayload.Length = len(d)
+	}
 	return nil
 }
 
-// rpcError defines the status from an RPC.
-type rpcError struct {
-	code codes.Code
-	desc string
+type rpcInfo struct {
+	bytesSent     bool
+	bytesReceived bool
 }
 
-func (e *rpcError) Error() string {
-	return fmt.Sprintf("rpc error: code = %d desc = %s", e.code, e.desc)
+type rpcInfoContextKey struct{}
+
+func newContextWithRPCInfo(ctx context.Context) context.Context {
+	return context.WithValue(ctx, rpcInfoContextKey{}, &rpcInfo{})
+}
+
+func rpcInfoFromContext(ctx context.Context) (s *rpcInfo, ok bool) {
+	s, ok = ctx.Value(rpcInfoContextKey{}).(*rpcInfo)
+	return
+}
+
+func updateRPCInfoInContext(ctx context.Context, s rpcInfo) {
+	if ss, ok := rpcInfoFromContext(ctx); ok {
+		*ss = s
+	}
+	return
 }
 
 // Code returns the error code for err if it was produced by the rpc system.
 // Otherwise, it returns codes.Unknown.
+//
+// Deprecated; use status.FromError and Code method instead.
 func Code(err error) codes.Code {
-	if err == nil {
-		return codes.OK
-	}
-	if e, ok := err.(*rpcError); ok {
-		return e.code
+	if s, ok := status.FromError(err); ok {
+		return s.Code()
 	}
 	return codes.Unknown
 }
 
 // ErrorDesc returns the error description of err if it was produced by the rpc system.
 // Otherwise, it returns err.Error() or empty string when err is nil.
+//
+// Deprecated; use status.FromError and Message method instead.
 func ErrorDesc(err error) string {
-	if err == nil {
-		return ""
-	}
-	if e, ok := err.(*rpcError); ok {
-		return e.desc
+	if s, ok := status.FromError(err); ok {
+		return s.Message()
 	}
 	return err.Error()
 }
 
 // Errorf returns an error containing an error code and a description;
 // Errorf returns nil if c is OK.
+//
+// Deprecated; use status.Errorf instead.
 func Errorf(c codes.Code, format string, a ...interface{}) error {
-	if c == codes.OK {
-		return nil
-	}
-	return &rpcError{
-		code: c,
-		desc: fmt.Sprintf(format, a...),
-	}
+	return status.Errorf(c, format, a...)
 }
 
-// toRPCErr converts an error into a rpcError.
+// toRPCErr converts an error into an error from the status package.
 func toRPCErr(err error) error {
-	switch e := err.(type) {
-	case *rpcError:
+	if _, ok := status.FromError(err); ok {
 		return err
+	}
+	switch e := err.(type) {
 	case transport.StreamError:
-		return &rpcError{
-			code: e.Code,
-			desc: e.Desc,
-		}
+		return status.Error(e.Code, e.Desc)
 	case transport.ConnectionError:
-		return &rpcError{
-			code: codes.Internal,
-			desc: e.Desc,
-		}
+		return status.Error(codes.Internal, e.Desc)
 	default:
 		switch err {
 		case context.DeadlineExceeded:
-			return &rpcError{
-				code: codes.DeadlineExceeded,
-				desc: err.Error(),
-			}
+			return status.Error(codes.DeadlineExceeded, err.Error())
 		case context.Canceled:
-			return &rpcError{
-				code: codes.Canceled,
-				desc: err.Error(),
-			}
+			return status.Error(codes.Canceled, err.Error())
 		case ErrClientConnClosing:
-			return &rpcError{
-				code: codes.FailedPrecondition,
-				desc: err.Error(),
-			}
+			return status.Error(codes.FailedPrecondition, err.Error())
 		}
-
 	}
-	return Errorf(codes.Unknown, "%v", err)
+	return status.Error(codes.Unknown, err.Error())
 }
 
 // convertCode converts a standard Go error into its canonical code. Note that
@@ -448,6 +449,44 @@ func convertCode(err error) codes.Code {
 	return codes.Unknown
 }
 
+// MethodConfig defines the configuration recommended by the service providers for a
+// particular method.
+// This is EXPERIMENTAL and subject to change.
+type MethodConfig struct {
+	// WaitForReady indicates whether RPCs sent to this method should wait until
+	// the connection is ready by default (!failfast). The value specified via the
+	// gRPC client API will override the value set here.
+	WaitForReady bool
+	// Timeout is the default timeout for RPCs sent to this method. The actual
+	// deadline used will be the minimum of the value specified here and the value
+	// set by the application via the gRPC client API.  If either one is not set,
+	// then the other will be used.  If neither is set, then the RPC has no deadline.
+	Timeout time.Duration
+	// MaxReqSize is the maximum allowed payload size for an individual request in a
+	// stream (client->server) in bytes. The size which is measured is the serialized
+	// payload after per-message compression (but before stream compression) in bytes.
+	// The actual value used is the minumum of the value specified here and the value set
+	// by the application via the gRPC client API. If either one is not set, then the other
+	// will be used.  If neither is set, then the built-in default is used.
+	// TODO: support this.
+	MaxReqSize uint32
+	// MaxRespSize is the maximum allowed payload size for an individual response in a
+	// stream (server->client) in bytes.
+	// TODO: support this.
+	MaxRespSize uint32
+}
+
+// ServiceConfig is provided by the service provider and contains parameters for how
+// clients that connect to the service should behave.
+// This is EXPERIMENTAL and subject to change.
+type ServiceConfig struct {
+	// LB is the load balancer the service providers recommends. The balancer specified
+	// via grpc.WithBalancer will override this.
+	LB Balancer
+	// Methods contains a map for the methods in this service.
+	Methods map[string]MethodConfig
+}
+
 // SupportPackageIsVersion4 is referenced from generated protocol buffer files
 // to assert that that code is compatible with this version of the grpc package.
 //
@@ -455,3 +494,8 @@ func convertCode(err error) codes.Code {
 // requires a synchronised update of grpc-go and protoc-gen-go. This constant
 // should not be referenced from any other code.
 const SupportPackageIsVersion4 = true
+
+// Version is the current grpc version.
+const Version = "1.3.0"
+
+const grpcUA = "grpc-go/" + Version
diff --git a/components/engine/vendor/google.golang.org/grpc/server.go b/components/engine/vendor/google.golang.org/grpc/server.go
index e0bb187ef9..b15f71c6c1 100644
--- a/components/engine/vendor/google.golang.org/grpc/server.go
+++ b/components/engine/vendor/google.golang.org/grpc/server.go
@@ -53,7 +53,11 @@ import (
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/grpclog"
 	"google.golang.org/grpc/internal"
+	"google.golang.org/grpc/keepalive"
 	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/stats"
+	"google.golang.org/grpc/status"
+	"google.golang.org/grpc/tap"
 	"google.golang.org/grpc/transport"
 )
 
@@ -110,8 +114,13 @@ type options struct {
 	maxMsgSize           int
 	unaryInt             UnaryServerInterceptor
 	streamInt            StreamServerInterceptor
+	inTapHandle          tap.ServerInHandle
+	statsHandler         stats.Handler
 	maxConcurrentStreams uint32
 	useHandlerImpl       bool // use http.Handler-based server
+	unknownStreamDesc    *StreamDesc
+	keepaliveParams      keepalive.ServerParameters
+	keepalivePolicy      keepalive.EnforcementPolicy
 }
 
 var defaultMaxMsgSize = 1024 * 1024 * 4 // use 4MB as the default message size limit
@@ -119,6 +128,20 @@ var defaultMaxMsgSize = 1024 * 1024 * 4 // use 4MB as the default message size l
 // A ServerOption sets options.
 type ServerOption func(*options)
 
+// KeepaliveParams returns a ServerOption that sets keepalive and max-age parameters for the server.
+func KeepaliveParams(kp keepalive.ServerParameters) ServerOption {
+	return func(o *options) {
+		o.keepaliveParams = kp
+	}
+}
+
+// KeepaliveEnforcementPolicy returns a ServerOption that sets keepalive enforcement policy for the server.
+func KeepaliveEnforcementPolicy(kep keepalive.EnforcementPolicy) ServerOption {
+	return func(o *options) {
+		o.keepalivePolicy = kep
+	}
+}
+
 // CustomCodec returns a ServerOption that sets a codec for message marshaling and unmarshaling.
 func CustomCodec(codec Codec) ServerOption {
 	return func(o *options) {
@@ -186,6 +209,42 @@ func StreamInterceptor(i StreamServerInterceptor) ServerOption {
 	}
 }
 
+// InTapHandle returns a ServerOption that sets the tap handle for all the server
+// transport to be created. Only one can be installed.
+func InTapHandle(h tap.ServerInHandle) ServerOption {
+	return func(o *options) {
+		if o.inTapHandle != nil {
+			panic("The tap handle has been set.")
+		}
+		o.inTapHandle = h
+	}
+}
+
+// StatsHandler returns a ServerOption that sets the stats handler for the server.
+func StatsHandler(h stats.Handler) ServerOption {
+	return func(o *options) {
+		o.statsHandler = h
+	}
+}
+
+// UnknownServiceHandler returns a ServerOption that allows for adding a custom
+// unknown service handler. The provided method is a bidi-streaming RPC service
+// handler that will be invoked instead of returning the the "unimplemented" gRPC
+// error whenever a request is received for an unregistered service or method.
+// The handling function has full access to the Context of the request and the
+// stream, and the invocation passes through interceptors.
+func UnknownServiceHandler(streamHandler StreamHandler) ServerOption {
+	return func(o *options) {
+		o.unknownStreamDesc = &StreamDesc{
+			StreamName: "unknown_service_handler",
+			Handler:    streamHandler,
+			// We need to assume that the users of the streamHandler will want to use both.
+			ClientStreams: true,
+			ServerStreams: true,
+		}
+	}
+}
+
 // NewServer creates a gRPC server which has no service registered and has not
 // started to accept requests yet.
 func NewServer(opt ...ServerOption) *Server {
@@ -329,6 +388,7 @@ func (s *Server) useTransportAuthenticator(rawConn net.Conn) (net.Conn, credenti
 // read gRPC requests and then call the registered handlers to reply to them.
 // Serve returns when lis.Accept fails with fatal errors.  lis will be closed when
 // this method returns.
+// Serve always returns non-nil error.
 func (s *Server) Serve(lis net.Listener) error {
 	s.mu.Lock()
 	s.printf("serving")
@@ -412,17 +472,25 @@ func (s *Server) handleRawConn(rawConn net.Conn) {
 	if s.opts.useHandlerImpl {
 		s.serveUsingHandler(conn)
 	} else {
-		s.serveNewHTTP2Transport(conn, authInfo)
+		s.serveHTTP2Transport(conn, authInfo)
 	}
 }
 
-// serveNewHTTP2Transport sets up a new http/2 transport (using the
+// serveHTTP2Transport sets up a http/2 transport (using the
 // gRPC http2 server transport in transport/http2_server.go) and
 // serves streams on it.
 // This is run in its own goroutine (it does network I/O in
 // transport.NewServerTransport).
-func (s *Server) serveNewHTTP2Transport(c net.Conn, authInfo credentials.AuthInfo) {
-	st, err := transport.NewServerTransport("http2", c, s.opts.maxConcurrentStreams, authInfo)
+func (s *Server) serveHTTP2Transport(c net.Conn, authInfo credentials.AuthInfo) {
+	config := &transport.ServerConfig{
+		MaxStreams:      s.opts.maxConcurrentStreams,
+		AuthInfo:        authInfo,
+		InTapHandle:     s.opts.inTapHandle,
+		StatsHandler:    s.opts.statsHandler,
+		KeepaliveParams: s.opts.keepaliveParams,
+		KeepalivePolicy: s.opts.keepalivePolicy,
+	}
+	st, err := transport.NewServerTransport("http2", c, config)
 	if err != nil {
 		s.mu.Lock()
 		s.errorf("NewServerTransport(%q) failed: %v", c.RemoteAddr(), err)
@@ -448,6 +516,12 @@ func (s *Server) serveStreams(st transport.ServerTransport) {
 			defer wg.Done()
 			s.handleStream(st, stream, s.traceInfo(st, stream))
 		}()
+	}, func(ctx context.Context, method string) context.Context {
+		if !EnableTracing {
+			return ctx
+		}
+		tr := trace.New("grpc.Recv."+methodFamily(method), method)
+		return trace.NewContext(ctx, tr)
 	})
 	wg.Wait()
 }
@@ -497,15 +571,17 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 // traceInfo returns a traceInfo and associates it with stream, if tracing is enabled.
 // If tracing is not enabled, it returns nil.
 func (s *Server) traceInfo(st transport.ServerTransport, stream *transport.Stream) (trInfo *traceInfo) {
-	if !EnableTracing {
+	tr, ok := trace.FromContext(stream.Context())
+	if !ok {
 		return nil
 	}
+
 	trInfo = &traceInfo{
-		tr: trace.New("grpc.Recv."+methodFamily(stream.Method()), stream.Method()),
+		tr: tr,
 	}
 	trInfo.firstLine.client = false
 	trInfo.firstLine.remoteAddr = st.RemoteAddr()
-	stream.TraceContext(trInfo.tr)
+
 	if dl, ok := stream.Context().Deadline(); ok {
 		trInfo.firstLine.deadline = dl.Sub(time.Now())
 	}
@@ -532,11 +608,17 @@ func (s *Server) removeConn(c io.Closer) {
 }
 
 func (s *Server) sendResponse(t transport.ServerTransport, stream *transport.Stream, msg interface{}, cp Compressor, opts *transport.Options) error {
-	var cbuf *bytes.Buffer
+	var (
+		cbuf       *bytes.Buffer
+		outPayload *stats.OutPayload
+	)
 	if cp != nil {
 		cbuf = new(bytes.Buffer)
 	}
-	p, err := encode(s.opts.codec, msg, cp, cbuf)
+	if s.opts.statsHandler != nil {
+		outPayload = &stats.OutPayload{}
+	}
+	p, err := encode(s.opts.codec, msg, cp, cbuf, outPayload)
 	if err != nil {
 		// This typically indicates a fatal issue (e.g., memory
 		// corruption or hardware faults) the application program
@@ -547,10 +629,33 @@ func (s *Server) sendResponse(t transport.ServerTransport, stream *transport.Str
 		// the optimal option.
 		grpclog.Fatalf("grpc: Server failed to encode response %v", err)
 	}
-	return t.Write(stream, p, opts)
+	err = t.Write(stream, p, opts)
+	if err == nil && outPayload != nil {
+		outPayload.SentTime = time.Now()
+		s.opts.statsHandler.HandleRPC(stream.Context(), outPayload)
+	}
+	return err
 }
 
 func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.Stream, srv *service, md *MethodDesc, trInfo *traceInfo) (err error) {
+	sh := s.opts.statsHandler
+	if sh != nil {
+		begin := &stats.Begin{
+			BeginTime: time.Now(),
+		}
+		sh.HandleRPC(stream.Context(), begin)
+	}
+	defer func() {
+		if sh != nil {
+			end := &stats.End{
+				EndTime: time.Now(),
+			}
+			if err != nil && err != io.EOF {
+				end.Error = toRPCErr(err)
+			}
+			sh.HandleRPC(stream.Context(), end)
+		}
+	}()
 	if trInfo != nil {
 		defer trInfo.tr.Finish()
 		trInfo.firstLine.client = false
@@ -567,7 +672,7 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 		stream.SetSendCompress(s.opts.cp.Type())
 	}
 	p := &parser{r: stream}
-	for {
+	for { // TODO: delete
 		pf, req, err := p.recvMsg(s.opts.maxMsgSize)
 		if err == io.EOF {
 			// The entire stream is done (for unary RPC only).
@@ -577,58 +682,68 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 			err = Errorf(codes.Internal, io.ErrUnexpectedEOF.Error())
 		}
 		if err != nil {
-			switch err := err.(type) {
-			case *rpcError:
-				if err := t.WriteStatus(stream, err.code, err.desc); err != nil {
-					grpclog.Printf("grpc: Server.processUnaryRPC failed to write status %v", err)
+			if st, ok := status.FromError(err); ok {
+				if e := t.WriteStatus(stream, st); e != nil {
+					grpclog.Printf("grpc: Server.processUnaryRPC failed to write status %v", e)
 				}
-			case transport.ConnectionError:
-				// Nothing to do here.
-			case transport.StreamError:
-				if err := t.WriteStatus(stream, err.Code, err.Desc); err != nil {
-					grpclog.Printf("grpc: Server.processUnaryRPC failed to write status %v", err)
+			} else {
+				switch st := err.(type) {
+				case transport.ConnectionError:
+					// Nothing to do here.
+				case transport.StreamError:
+					if e := t.WriteStatus(stream, status.New(st.Code, st.Desc)); e != nil {
+						grpclog.Printf("grpc: Server.processUnaryRPC failed to write status %v", e)
+					}
+				default:
+					panic(fmt.Sprintf("grpc: Unexpected error (%T) from recvMsg: %v", st, st))
 				}
-			default:
-				panic(fmt.Sprintf("grpc: Unexpected error (%T) from recvMsg: %v", err, err))
 			}
 			return err
 		}
 
 		if err := checkRecvPayload(pf, stream.RecvCompress(), s.opts.dc); err != nil {
-			switch err := err.(type) {
-			case *rpcError:
-				if err := t.WriteStatus(stream, err.code, err.desc); err != nil {
-					grpclog.Printf("grpc: Server.processUnaryRPC failed to write status %v", err)
+			if st, ok := status.FromError(err); ok {
+				if e := t.WriteStatus(stream, st); e != nil {
+					grpclog.Printf("grpc: Server.processUnaryRPC failed to write status %v", e)
 				}
-			default:
-				if err := t.WriteStatus(stream, codes.Internal, err.Error()); err != nil {
-					grpclog.Printf("grpc: Server.processUnaryRPC failed to write status %v", err)
-				}
-
+				return err
+			}
+			if e := t.WriteStatus(stream, status.New(codes.Internal, err.Error())); e != nil {
+				grpclog.Printf("grpc: Server.processUnaryRPC failed to write status %v", e)
+			}
+
+			// TODO checkRecvPayload always return RPC error. Add a return here if necessary.
+		}
+		var inPayload *stats.InPayload
+		if sh != nil {
+			inPayload = &stats.InPayload{
+				RecvTime: time.Now(),
 			}
-			return err
 		}
-		statusCode := codes.OK
-		statusDesc := ""
 		df := func(v interface{}) error {
+			if inPayload != nil {
+				inPayload.WireLength = len(req)
+			}
 			if pf == compressionMade {
 				var err error
 				req, err = s.opts.dc.Do(bytes.NewReader(req))
 				if err != nil {
-					if err := t.WriteStatus(stream, codes.Internal, err.Error()); err != nil {
-						grpclog.Printf("grpc: Server.processUnaryRPC failed to write status %v", err)
-					}
-					return err
+					return Errorf(codes.Internal, err.Error())
 				}
 			}
 			if len(req) > s.opts.maxMsgSize {
 				// TODO: Revisit the error code. Currently keep it consistent with
 				// java implementation.
-				statusCode = codes.Internal
-				statusDesc = fmt.Sprintf("grpc: server received a message of %d bytes exceeding %d limit", len(req), s.opts.maxMsgSize)
+				return status.Errorf(codes.Internal, "grpc: server received a message of %d bytes exceeding %d limit", len(req), s.opts.maxMsgSize)
 			}
 			if err := s.opts.codec.Unmarshal(req, v); err != nil {
-				return err
+				return status.Errorf(codes.Internal, "grpc: error unmarshalling request: %v", err)
+			}
+			if inPayload != nil {
+				inPayload.Payload = v
+				inPayload.Data = req
+				inPayload.Length = len(req)
+				sh.HandleRPC(stream.Context(), inPayload)
 			}
 			if trInfo != nil {
 				trInfo.tr.LazyLog(&payload{sent: false, msg: v}, true)
@@ -637,22 +752,20 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 		}
 		reply, appErr := md.Handler(srv.server, stream.Context(), df, s.opts.unaryInt)
 		if appErr != nil {
-			if err, ok := appErr.(*rpcError); ok {
-				statusCode = err.code
-				statusDesc = err.desc
-			} else {
-				statusCode = convertCode(appErr)
-				statusDesc = appErr.Error()
+			appStatus, ok := status.FromError(appErr)
+			if !ok {
+				// Convert appErr if it is not a grpc status error.
+				appErr = status.Error(convertCode(appErr), appErr.Error())
+				appStatus, _ = status.FromError(appErr)
 			}
-			if trInfo != nil && statusCode != codes.OK {
-				trInfo.tr.LazyLog(stringer(statusDesc), true)
+			if trInfo != nil {
+				trInfo.tr.LazyLog(stringer(appStatus.Message()), true)
 				trInfo.tr.SetError()
 			}
-			if err := t.WriteStatus(stream, statusCode, statusDesc); err != nil {
-				grpclog.Printf("grpc: Server.processUnaryRPC failed to write status: %v", err)
-				return err
+			if e := t.WriteStatus(stream, appStatus); e != nil {
+				grpclog.Printf("grpc: Server.processUnaryRPC failed to write status: %v", e)
 			}
-			return nil
+			return appErr
 		}
 		if trInfo != nil {
 			trInfo.tr.LazyLog(stringer("OK"), false)
@@ -662,38 +775,70 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 			Delay: false,
 		}
 		if err := s.sendResponse(t, stream, reply, s.opts.cp, opts); err != nil {
-			switch err := err.(type) {
-			case transport.ConnectionError:
-				// Nothing to do here.
-			case transport.StreamError:
-				statusCode = err.Code
-				statusDesc = err.Desc
-			default:
-				statusCode = codes.Unknown
-				statusDesc = err.Error()
+			if err == io.EOF {
+				// The entire stream is done (for unary RPC only).
+				return err
+			}
+			if s, ok := status.FromError(err); ok {
+				if e := t.WriteStatus(stream, s); e != nil {
+					grpclog.Printf("grpc: Server.processUnaryRPC failed to write status: %v", e)
+				}
+			} else {
+				switch st := err.(type) {
+				case transport.ConnectionError:
+					// Nothing to do here.
+				case transport.StreamError:
+					if e := t.WriteStatus(stream, status.New(st.Code, st.Desc)); e != nil {
+						grpclog.Printf("grpc: Server.processUnaryRPC failed to write status %v", e)
+					}
+				default:
+					panic(fmt.Sprintf("grpc: Unexpected error (%T) from sendResponse: %v", st, st))
+				}
 			}
 			return err
 		}
 		if trInfo != nil {
 			trInfo.tr.LazyLog(&payload{sent: true, msg: reply}, true)
 		}
-		return t.WriteStatus(stream, statusCode, statusDesc)
+		// TODO: Should we be logging if writing status failed here, like above?
+		// Should the logging be in WriteStatus?  Should we ignore the WriteStatus
+		// error or allow the stats handler to see it?
+		return t.WriteStatus(stream, status.New(codes.OK, ""))
 	}
 }
 
 func (s *Server) processStreamingRPC(t transport.ServerTransport, stream *transport.Stream, srv *service, sd *StreamDesc, trInfo *traceInfo) (err error) {
+	sh := s.opts.statsHandler
+	if sh != nil {
+		begin := &stats.Begin{
+			BeginTime: time.Now(),
+		}
+		sh.HandleRPC(stream.Context(), begin)
+	}
+	defer func() {
+		if sh != nil {
+			end := &stats.End{
+				EndTime: time.Now(),
+			}
+			if err != nil && err != io.EOF {
+				end.Error = toRPCErr(err)
+			}
+			sh.HandleRPC(stream.Context(), end)
+		}
+	}()
 	if s.opts.cp != nil {
 		stream.SetSendCompress(s.opts.cp.Type())
 	}
 	ss := &serverStream{
-		t:          t,
-		s:          stream,
-		p:          &parser{r: stream},
-		codec:      s.opts.codec,
-		cp:         s.opts.cp,
-		dc:         s.opts.dc,
-		maxMsgSize: s.opts.maxMsgSize,
-		trInfo:     trInfo,
+		t:            t,
+		s:            stream,
+		p:            &parser{r: stream},
+		codec:        s.opts.codec,
+		cp:           s.opts.cp,
+		dc:           s.opts.dc,
+		maxMsgSize:   s.opts.maxMsgSize,
+		trInfo:       trInfo,
+		statsHandler: sh,
 	}
 	if ss.cp != nil {
 		ss.cbuf = new(bytes.Buffer)
@@ -712,39 +857,47 @@ func (s *Server) processStreamingRPC(t transport.ServerTransport, stream *transp
 		}()
 	}
 	var appErr error
+	var server interface{}
+	if srv != nil {
+		server = srv.server
+	}
 	if s.opts.streamInt == nil {
-		appErr = sd.Handler(srv.server, ss)
+		appErr = sd.Handler(server, ss)
 	} else {
 		info := &StreamServerInfo{
 			FullMethod:     stream.Method(),
 			IsClientStream: sd.ClientStreams,
 			IsServerStream: sd.ServerStreams,
 		}
-		appErr = s.opts.streamInt(srv.server, ss, info, sd.Handler)
+		appErr = s.opts.streamInt(server, ss, info, sd.Handler)
 	}
 	if appErr != nil {
-		if err, ok := appErr.(*rpcError); ok {
-			ss.statusCode = err.code
-			ss.statusDesc = err.desc
-		} else if err, ok := appErr.(transport.StreamError); ok {
-			ss.statusCode = err.Code
-			ss.statusDesc = err.Desc
-		} else {
-			ss.statusCode = convertCode(appErr)
-			ss.statusDesc = appErr.Error()
+		appStatus, ok := status.FromError(appErr)
+		if !ok {
+			switch err := appErr.(type) {
+			case transport.StreamError:
+				appStatus = status.New(err.Code, err.Desc)
+			default:
+				appStatus = status.New(convertCode(appErr), appErr.Error())
+			}
+			appErr = appStatus.Err()
 		}
+		if trInfo != nil {
+			ss.mu.Lock()
+			ss.trInfo.tr.LazyLog(stringer(appStatus.Message()), true)
+			ss.trInfo.tr.SetError()
+			ss.mu.Unlock()
+		}
+		t.WriteStatus(ss.s, appStatus)
+		// TODO: Should we log an error from WriteStatus here and below?
+		return appErr
 	}
 	if trInfo != nil {
 		ss.mu.Lock()
-		if ss.statusCode != codes.OK {
-			ss.trInfo.tr.LazyLog(stringer(ss.statusDesc), true)
-			ss.trInfo.tr.SetError()
-		} else {
-			ss.trInfo.tr.LazyLog(stringer("OK"), false)
-		}
+		ss.trInfo.tr.LazyLog(stringer("OK"), false)
 		ss.mu.Unlock()
 	}
-	return t.WriteStatus(ss.s, ss.statusCode, ss.statusDesc)
+	return t.WriteStatus(ss.s, status.New(codes.OK, ""))
 
 }
 
@@ -759,7 +912,8 @@ func (s *Server) handleStream(t transport.ServerTransport, stream *transport.Str
 			trInfo.tr.LazyLog(&fmtStringer{"Malformed method name %q", []interface{}{sm}}, true)
 			trInfo.tr.SetError()
 		}
-		if err := t.WriteStatus(stream, codes.InvalidArgument, fmt.Sprintf("malformed method name: %q", stream.Method())); err != nil {
+		errDesc := fmt.Sprintf("malformed method name: %q", stream.Method())
+		if err := t.WriteStatus(stream, status.New(codes.InvalidArgument, errDesc)); err != nil {
 			if trInfo != nil {
 				trInfo.tr.LazyLog(&fmtStringer{"%v", []interface{}{err}}, true)
 				trInfo.tr.SetError()
@@ -775,11 +929,16 @@ func (s *Server) handleStream(t transport.ServerTransport, stream *transport.Str
 	method := sm[pos+1:]
 	srv, ok := s.m[service]
 	if !ok {
+		if unknownDesc := s.opts.unknownStreamDesc; unknownDesc != nil {
+			s.processStreamingRPC(t, stream, nil, unknownDesc, trInfo)
+			return
+		}
 		if trInfo != nil {
 			trInfo.tr.LazyLog(&fmtStringer{"Unknown service %v", []interface{}{service}}, true)
 			trInfo.tr.SetError()
 		}
-		if err := t.WriteStatus(stream, codes.Unimplemented, fmt.Sprintf("unknown service %v", service)); err != nil {
+		errDesc := fmt.Sprintf("unknown service %v", service)
+		if err := t.WriteStatus(stream, status.New(codes.Unimplemented, errDesc)); err != nil {
 			if trInfo != nil {
 				trInfo.tr.LazyLog(&fmtStringer{"%v", []interface{}{err}}, true)
 				trInfo.tr.SetError()
@@ -804,7 +963,12 @@ func (s *Server) handleStream(t transport.ServerTransport, stream *transport.Str
 		trInfo.tr.LazyLog(&fmtStringer{"Unknown method %v", []interface{}{method}}, true)
 		trInfo.tr.SetError()
 	}
-	if err := t.WriteStatus(stream, codes.Unimplemented, fmt.Sprintf("unknown method %v", method)); err != nil {
+	if unknownDesc := s.opts.unknownStreamDesc; unknownDesc != nil {
+		s.processStreamingRPC(t, stream, nil, unknownDesc, trInfo)
+		return
+	}
+	errDesc := fmt.Sprintf("unknown method %v", method)
+	if err := t.WriteStatus(stream, status.New(codes.Unimplemented, errDesc)); err != nil {
 		if trInfo != nil {
 			trInfo.tr.LazyLog(&fmtStringer{"%v", []interface{}{err}}, true)
 			trInfo.tr.SetError()
diff --git a/components/engine/vendor/google.golang.org/grpc/stats/handlers.go b/components/engine/vendor/google.golang.org/grpc/stats/handlers.go
new file mode 100644
index 0000000000..26e1a8e2f0
--- /dev/null
+++ b/components/engine/vendor/google.golang.org/grpc/stats/handlers.go
@@ -0,0 +1,76 @@
+/*
+ *
+ * Copyright 2016, Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+package stats
+
+import (
+	"net"
+
+	"golang.org/x/net/context"
+)
+
+// ConnTagInfo defines the relevant information needed by connection context tagger.
+type ConnTagInfo struct {
+	// RemoteAddr is the remote address of the corresponding connection.
+	RemoteAddr net.Addr
+	// LocalAddr is the local address of the corresponding connection.
+	LocalAddr net.Addr
+	// TODO add QOS related fields.
+}
+
+// RPCTagInfo defines the relevant information needed by RPC context tagger.
+type RPCTagInfo struct {
+	// FullMethodName is the RPC method in the format of /package.service/method.
+	FullMethodName string
+}
+
+// Handler defines the interface for the related stats handling (e.g., RPCs, connections).
+type Handler interface {
+	// TagRPC can attach some information to the given context.
+	// The returned context is used in the rest lifetime of the RPC.
+	TagRPC(context.Context, *RPCTagInfo) context.Context
+	// HandleRPC processes the RPC stats.
+	HandleRPC(context.Context, RPCStats)
+
+	// TagConn can attach some information to the given context.
+	// The returned context will be used for stats handling.
+	// For conn stats handling, the context used in HandleConn for this
+	// connection will be derived from the context returned.
+	// For RPC stats handling,
+	//  - On server side, the context used in HandleRPC for all RPCs on this
+	// connection will be derived from the context returned.
+	//  - On client side, the context is not derived from the context returned.
+	TagConn(context.Context, *ConnTagInfo) context.Context
+	// HandleConn processes the Conn stats.
+	HandleConn(context.Context, ConnStats)
+}
diff --git a/components/engine/vendor/google.golang.org/grpc/stats/stats.go b/components/engine/vendor/google.golang.org/grpc/stats/stats.go
new file mode 100644
index 0000000000..43d6f0054d
--- /dev/null
+++ b/components/engine/vendor/google.golang.org/grpc/stats/stats.go
@@ -0,0 +1,223 @@
+/*
+ *
+ * Copyright 2016, Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+// Package stats is for collecting and reporting various network and RPC stats.
+// This package is for monitoring purpose only. All fields are read-only.
+// All APIs are experimental.
+package stats // import "google.golang.org/grpc/stats"
+
+import (
+	"net"
+	"time"
+)
+
+// RPCStats contains stats information about RPCs.
+type RPCStats interface {
+	isRPCStats()
+	// IsClient returns true if this RPCStats is from client side.
+	IsClient() bool
+}
+
+// Begin contains stats when an RPC begins.
+// FailFast are only valid if Client is true.
+type Begin struct {
+	// Client is true if this Begin is from client side.
+	Client bool
+	// BeginTime is the time when the RPC begins.
+	BeginTime time.Time
+	// FailFast indicates if this RPC is failfast.
+	FailFast bool
+}
+
+// IsClient indicates if this is from client side.
+func (s *Begin) IsClient() bool { return s.Client }
+
+func (s *Begin) isRPCStats() {}
+
+// InPayload contains the information for an incoming payload.
+type InPayload struct {
+	// Client is true if this InPayload is from client side.
+	Client bool
+	// Payload is the payload with original type.
+	Payload interface{}
+	// Data is the serialized message payload.
+	Data []byte
+	// Length is the length of uncompressed data.
+	Length int
+	// WireLength is the length of data on wire (compressed, signed, encrypted).
+	WireLength int
+	// RecvTime is the time when the payload is received.
+	RecvTime time.Time
+}
+
+// IsClient indicates if this is from client side.
+func (s *InPayload) IsClient() bool { return s.Client }
+
+func (s *InPayload) isRPCStats() {}
+
+// InHeader contains stats when a header is received.
+// FullMethod, addresses and Compression are only valid if Client is false.
+type InHeader struct {
+	// Client is true if this InHeader is from client side.
+	Client bool
+	// WireLength is the wire length of header.
+	WireLength int
+
+	// FullMethod is the full RPC method string, i.e., /package.service/method.
+	FullMethod string
+	// RemoteAddr is the remote address of the corresponding connection.
+	RemoteAddr net.Addr
+	// LocalAddr is the local address of the corresponding connection.
+	LocalAddr net.Addr
+	// Compression is the compression algorithm used for the RPC.
+	Compression string
+}
+
+// IsClient indicates if this is from client side.
+func (s *InHeader) IsClient() bool { return s.Client }
+
+func (s *InHeader) isRPCStats() {}
+
+// InTrailer contains stats when a trailer is received.
+type InTrailer struct {
+	// Client is true if this InTrailer is from client side.
+	Client bool
+	// WireLength is the wire length of trailer.
+	WireLength int
+}
+
+// IsClient indicates if this is from client side.
+func (s *InTrailer) IsClient() bool { return s.Client }
+
+func (s *InTrailer) isRPCStats() {}
+
+// OutPayload contains the information for an outgoing payload.
+type OutPayload struct {
+	// Client is true if this OutPayload is from client side.
+	Client bool
+	// Payload is the payload with original type.
+	Payload interface{}
+	// Data is the serialized message payload.
+	Data []byte
+	// Length is the length of uncompressed data.
+	Length int
+	// WireLength is the length of data on wire (compressed, signed, encrypted).
+	WireLength int
+	// SentTime is the time when the payload is sent.
+	SentTime time.Time
+}
+
+// IsClient indicates if this is from client side.
+func (s *OutPayload) IsClient() bool { return s.Client }
+
+func (s *OutPayload) isRPCStats() {}
+
+// OutHeader contains stats when a header is sent.
+// FullMethod, addresses and Compression are only valid if Client is true.
+type OutHeader struct {
+	// Client is true if this OutHeader is from client side.
+	Client bool
+	// WireLength is the wire length of header.
+	WireLength int
+
+	// FullMethod is the full RPC method string, i.e., /package.service/method.
+	FullMethod string
+	// RemoteAddr is the remote address of the corresponding connection.
+	RemoteAddr net.Addr
+	// LocalAddr is the local address of the corresponding connection.
+	LocalAddr net.Addr
+	// Compression is the compression algorithm used for the RPC.
+	Compression string
+}
+
+// IsClient indicates if this is from client side.
+func (s *OutHeader) IsClient() bool { return s.Client }
+
+func (s *OutHeader) isRPCStats() {}
+
+// OutTrailer contains stats when a trailer is sent.
+type OutTrailer struct {
+	// Client is true if this OutTrailer is from client side.
+	Client bool
+	// WireLength is the wire length of trailer.
+	WireLength int
+}
+
+// IsClient indicates if this is from client side.
+func (s *OutTrailer) IsClient() bool { return s.Client }
+
+func (s *OutTrailer) isRPCStats() {}
+
+// End contains stats when an RPC ends.
+type End struct {
+	// Client is true if this End is from client side.
+	Client bool
+	// EndTime is the time when the RPC ends.
+	EndTime time.Time
+	// Error is the error just happened.  It implements status.Status if non-nil.
+	Error error
+}
+
+// IsClient indicates if this is from client side.
+func (s *End) IsClient() bool { return s.Client }
+
+func (s *End) isRPCStats() {}
+
+// ConnStats contains stats information about connections.
+type ConnStats interface {
+	isConnStats()
+	// IsClient returns true if this ConnStats is from client side.
+	IsClient() bool
+}
+
+// ConnBegin contains the stats of a connection when it is established.
+type ConnBegin struct {
+	// Client is true if this ConnBegin is from client side.
+	Client bool
+}
+
+// IsClient indicates if this is from client side.
+func (s *ConnBegin) IsClient() bool { return s.Client }
+
+func (s *ConnBegin) isConnStats() {}
+
+// ConnEnd contains the stats of a connection when it ends.
+type ConnEnd struct {
+	// Client is true if this ConnEnd is from client side.
+	Client bool
+}
+
+// IsClient indicates if this is from client side.
+func (s *ConnEnd) IsClient() bool { return s.Client }
+
+func (s *ConnEnd) isConnStats() {}
diff --git a/components/engine/vendor/google.golang.org/grpc/status/status.go b/components/engine/vendor/google.golang.org/grpc/status/status.go
new file mode 100644
index 0000000000..99a4cbe511
--- /dev/null
+++ b/components/engine/vendor/google.golang.org/grpc/status/status.go
@@ -0,0 +1,145 @@
+/*
+ *
+ * Copyright 2017, Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+// Package status implements errors returned by gRPC.  These errors are
+// serialized and transmitted on the wire between server and client, and allow
+// for additional data to be transmitted via the Details field in the status
+// proto.  gRPC service handlers should return an error created by this
+// package, and gRPC clients should expect a corresponding error to be
+// returned from the RPC call.
+//
+// This package upholds the invariants that a non-nil error may not
+// contain an OK code, and an OK code must result in a nil error.
+package status
+
+import (
+	"fmt"
+
+	"github.com/golang/protobuf/proto"
+	spb "google.golang.org/genproto/googleapis/rpc/status"
+	"google.golang.org/grpc/codes"
+)
+
+// statusError is an alias of a status proto.  It implements error and Status,
+// and a nil statusError should never be returned by this package.
+type statusError spb.Status
+
+func (se *statusError) Error() string {
+	p := (*spb.Status)(se)
+	return fmt.Sprintf("rpc error: code = %s desc = %s", codes.Code(p.GetCode()), p.GetMessage())
+}
+
+func (se *statusError) status() *Status {
+	return &Status{s: (*spb.Status)(se)}
+}
+
+// Status represents an RPC status code, message, and details.  It is immutable
+// and should be created with New, Newf, or FromProto.
+type Status struct {
+	s *spb.Status
+}
+
+// Code returns the status code contained in s.
+func (s *Status) Code() codes.Code {
+	if s == nil || s.s == nil {
+		return codes.OK
+	}
+	return codes.Code(s.s.Code)
+}
+
+// Message returns the message contained in s.
+func (s *Status) Message() string {
+	if s == nil || s.s == nil {
+		return ""
+	}
+	return s.s.Message
+}
+
+// Proto returns s's status as an spb.Status proto message.
+func (s *Status) Proto() *spb.Status {
+	if s == nil {
+		return nil
+	}
+	return proto.Clone(s.s).(*spb.Status)
+}
+
+// Err returns an immutable error representing s; returns nil if s.Code() is
+// OK.
+func (s *Status) Err() error {
+	if s.Code() == codes.OK {
+		return nil
+	}
+	return (*statusError)(s.s)
+}
+
+// New returns a Status representing c and msg.
+func New(c codes.Code, msg string) *Status {
+	return &Status{s: &spb.Status{Code: int32(c), Message: msg}}
+}
+
+// Newf returns New(c, fmt.Sprintf(format, a...)).
+func Newf(c codes.Code, format string, a ...interface{}) *Status {
+	return New(c, fmt.Sprintf(format, a...))
+}
+
+// Error returns an error representing c and msg.  If c is OK, returns nil.
+func Error(c codes.Code, msg string) error {
+	return New(c, msg).Err()
+}
+
+// Errorf returns Error(c, fmt.Sprintf(format, a...)).
+func Errorf(c codes.Code, format string, a ...interface{}) error {
+	return Error(c, fmt.Sprintf(format, a...))
+}
+
+// ErrorProto returns an error representing s.  If s.Code is OK, returns nil.
+func ErrorProto(s *spb.Status) error {
+	return FromProto(s).Err()
+}
+
+// FromProto returns a Status representing s.
+func FromProto(s *spb.Status) *Status {
+	return &Status{s: proto.Clone(s).(*spb.Status)}
+}
+
+// FromError returns a Status representing err if it was produced from this
+// package, otherwise it returns nil, false.
+func FromError(err error) (s *Status, ok bool) {
+	if err == nil {
+		return &Status{s: &spb.Status{Code: int32(codes.OK)}}, true
+	}
+	if s, ok := err.(*statusError); ok {
+		return s.status(), true
+	}
+	return nil, false
+}
diff --git a/components/engine/vendor/google.golang.org/grpc/stream.go b/components/engine/vendor/google.golang.org/grpc/stream.go
index 46810544f1..33f1c787b3 100644
--- a/components/engine/vendor/google.golang.org/grpc/stream.go
+++ b/components/engine/vendor/google.golang.org/grpc/stream.go
@@ -37,7 +37,6 @@ import (
 	"bytes"
 	"errors"
 	"io"
-	"math"
 	"sync"
 	"time"
 
@@ -45,6 +44,8 @@ import (
 	"golang.org/x/net/trace"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/stats"
+	"google.golang.org/grpc/status"
 	"google.golang.org/grpc/transport"
 )
 
@@ -97,7 +98,7 @@ type ClientStream interface {
 
 // NewClientStream creates a new Stream for the client side. This is called
 // by generated code.
-func NewClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, opts ...CallOption) (ClientStream, error) {
+func NewClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, opts ...CallOption) (_ ClientStream, err error) {
 	if cc.dopts.streamInt != nil {
 		return cc.dopts.streamInt(ctx, desc, cc, method, newClientStream, opts...)
 	}
@@ -106,11 +107,18 @@ func NewClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, meth
 
 func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, opts ...CallOption) (_ ClientStream, err error) {
 	var (
-		t   transport.ClientTransport
-		s   *transport.Stream
-		put func()
+		t      transport.ClientTransport
+		s      *transport.Stream
+		put    func()
+		cancel context.CancelFunc
 	)
 	c := defaultCallInfo
+	if mc, ok := cc.getMethodConfig(method); ok {
+		c.failFast = !mc.WaitForReady
+		if mc.Timeout > 0 {
+			ctx, cancel = context.WithTimeout(ctx, mc.Timeout)
+		}
+	}
 	for _, o := range opts {
 		if err := o.before(&c); err != nil {
 			return nil, toRPCErr(err)
@@ -143,6 +151,27 @@ func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, meth
 			}
 		}()
 	}
+	ctx = newContextWithRPCInfo(ctx)
+	sh := cc.dopts.copts.StatsHandler
+	if sh != nil {
+		ctx = sh.TagRPC(ctx, &stats.RPCTagInfo{FullMethodName: method})
+		begin := &stats.Begin{
+			Client:    true,
+			BeginTime: time.Now(),
+			FailFast:  c.failFast,
+		}
+		sh.HandleRPC(ctx, begin)
+	}
+	defer func() {
+		if err != nil && sh != nil {
+			// Only handle end stats if err != nil.
+			end := &stats.End{
+				Client: true,
+				Error:  err,
+			}
+			sh.HandleRPC(ctx, end)
+		}
+	}()
 	gopts := BalancerGetOptions{
 		BlockingWait: !c.failFast,
 	}
@@ -150,7 +179,7 @@ func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, meth
 		t, put, err = cc.getTransport(ctx, gopts)
 		if err != nil {
 			// TODO(zhaoq): Probably revisit the error handling.
-			if _, ok := err.(*rpcError); ok {
+			if _, ok := status.FromError(err); ok {
 				return nil, err
 			}
 			if err == errConnClosing || err == errConnUnavailable {
@@ -165,14 +194,17 @@ func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, meth
 
 		s, err = t.NewStream(ctx, callHdr)
 		if err != nil {
+			if _, ok := err.(transport.ConnectionError); ok && put != nil {
+				// If error is connection error, transport was sending data on wire,
+				// and we are not sure if anything has been sent on wire.
+				// If error is not connection error, we are sure nothing has been sent.
+				updateRPCInfoInContext(ctx, rpcInfo{bytesSent: true, bytesReceived: false})
+			}
 			if put != nil {
 				put()
 				put = nil
 			}
-			if _, ok := err.(transport.ConnectionError); ok || err == transport.ErrStreamDrain {
-				if c.failFast {
-					return nil, toRPCErr(err)
-				}
+			if _, ok := err.(transport.ConnectionError); (ok || err == transport.ErrStreamDrain) && !c.failFast {
 				continue
 			}
 			return nil, toRPCErr(err)
@@ -180,12 +212,14 @@ func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, meth
 		break
 	}
 	cs := &clientStream{
-		opts:  opts,
-		c:     c,
-		desc:  desc,
-		codec: cc.dopts.codec,
-		cp:    cc.dopts.cp,
-		dc:    cc.dopts.dc,
+		opts:       opts,
+		c:          c,
+		desc:       desc,
+		codec:      cc.dopts.codec,
+		cp:         cc.dopts.cp,
+		dc:         cc.dopts.dc,
+		maxMsgSize: cc.dopts.maxMsgSize,
+		cancel:     cancel,
 
 		put: put,
 		t:   t,
@@ -194,6 +228,9 @@ func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, meth
 
 		tracing: EnableTracing,
 		trInfo:  trInfo,
+
+		statsCtx:     ctx,
+		statsHandler: cc.dopts.copts.StatsHandler,
 	}
 	if cc.dopts.cp != nil {
 		cs.cbuf = new(bytes.Buffer)
@@ -204,14 +241,13 @@ func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, meth
 		select {
 		case <-t.Error():
 			// Incur transport error, simply exit.
+		case <-cc.ctx.Done():
+			cs.finish(ErrClientConnClosing)
+			cs.closeTransportStream(ErrClientConnClosing)
 		case <-s.Done():
 			// TODO: The trace of the RPC is terminated here when there is no pending
 			// I/O, which is probably not the optimal solution.
-			if s.StatusCode() == codes.OK {
-				cs.finish(nil)
-			} else {
-				cs.finish(Errorf(s.StatusCode(), "%s", s.StatusDesc()))
-			}
+			cs.finish(s.Status().Err())
 			cs.closeTransportStream(nil)
 		case <-s.GoAway():
 			cs.finish(errConnDrain)
@@ -227,25 +263,34 @@ func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, meth
 
 // clientStream implements a client side Stream.
 type clientStream struct {
-	opts  []CallOption
-	c     callInfo
-	t     transport.ClientTransport
-	s     *transport.Stream
-	p     *parser
-	desc  *StreamDesc
-	codec Codec
-	cp    Compressor
-	cbuf  *bytes.Buffer
-	dc    Decompressor
+	opts       []CallOption
+	c          callInfo
+	t          transport.ClientTransport
+	s          *transport.Stream
+	p          *parser
+	desc       *StreamDesc
+	codec      Codec
+	cp         Compressor
+	cbuf       *bytes.Buffer
+	dc         Decompressor
+	maxMsgSize int
+	cancel     context.CancelFunc
 
 	tracing bool // set to EnableTracing when the clientStream is created.
 
-	mu     sync.Mutex
-	put    func()
-	closed bool
+	mu       sync.Mutex
+	put      func()
+	closed   bool
+	finished bool
 	// trInfo.tr is set when the clientStream is created (if EnableTracing is true),
 	// and is set to nil when the clientStream's finish method is called.
 	trInfo traceInfo
+
+	// statsCtx keeps the user context for stats handling.
+	// All stats collection should use the statsCtx (instead of the stream context)
+	// so that all the generated stats for a particular RPC can be associated in the processing phase.
+	statsCtx     context.Context
+	statsHandler stats.Handler
 }
 
 func (cs *clientStream) Context() context.Context {
@@ -274,6 +319,8 @@ func (cs *clientStream) SendMsg(m interface{}) (err error) {
 		}
 		cs.mu.Unlock()
 	}
+	// TODO Investigate how to signal the stats handling party.
+	// generate error stats if err != nil && err != io.EOF?
 	defer func() {
 		if err != nil {
 			cs.finish(err)
@@ -296,7 +343,13 @@ func (cs *clientStream) SendMsg(m interface{}) (err error) {
 		}
 		err = toRPCErr(err)
 	}()
-	out, err := encode(cs.codec, m, cs.cp, cs.cbuf)
+	var outPayload *stats.OutPayload
+	if cs.statsHandler != nil {
+		outPayload = &stats.OutPayload{
+			Client: true,
+		}
+	}
+	out, err := encode(cs.codec, m, cs.cp, cs.cbuf, outPayload)
 	defer func() {
 		if cs.cbuf != nil {
 			cs.cbuf.Reset()
@@ -305,11 +358,22 @@ func (cs *clientStream) SendMsg(m interface{}) (err error) {
 	if err != nil {
 		return Errorf(codes.Internal, "grpc: %v", err)
 	}
-	return cs.t.Write(cs.s, out, &transport.Options{Last: false})
+	err = cs.t.Write(cs.s, out, &transport.Options{Last: false})
+	if err == nil && outPayload != nil {
+		outPayload.SentTime = time.Now()
+		cs.statsHandler.HandleRPC(cs.statsCtx, outPayload)
+	}
+	return err
 }
 
 func (cs *clientStream) RecvMsg(m interface{}) (err error) {
-	err = recv(cs.p, cs.codec, cs.s, cs.dc, m, math.MaxInt32)
+	var inPayload *stats.InPayload
+	if cs.statsHandler != nil {
+		inPayload = &stats.InPayload{
+			Client: true,
+		}
+	}
+	err = recv(cs.p, cs.codec, cs.s, cs.dc, m, cs.maxMsgSize, inPayload)
 	defer func() {
 		// err != nil indicates the termination of the stream.
 		if err != nil {
@@ -324,21 +388,25 @@ func (cs *clientStream) RecvMsg(m interface{}) (err error) {
 			}
 			cs.mu.Unlock()
 		}
+		if inPayload != nil {
+			cs.statsHandler.HandleRPC(cs.statsCtx, inPayload)
+		}
 		if !cs.desc.ClientStreams || cs.desc.ServerStreams {
 			return
 		}
 		// Special handling for client streaming rpc.
-		err = recv(cs.p, cs.codec, cs.s, cs.dc, m, math.MaxInt32)
+		// This recv expects EOF or errors, so we don't collect inPayload.
+		err = recv(cs.p, cs.codec, cs.s, cs.dc, m, cs.maxMsgSize, nil)
 		cs.closeTransportStream(err)
 		if err == nil {
 			return toRPCErr(errors.New("grpc: client streaming protocol violation: get <nil>, want <EOF>"))
 		}
 		if err == io.EOF {
-			if cs.s.StatusCode() == codes.OK {
-				cs.finish(err)
-				return nil
+			if se := cs.s.Status().Err(); se != nil {
+				return se
 			}
-			return Errorf(cs.s.StatusCode(), "%s", cs.s.StatusDesc())
+			cs.finish(err)
+			return nil
 		}
 		return toRPCErr(err)
 	}
@@ -346,11 +414,11 @@ func (cs *clientStream) RecvMsg(m interface{}) (err error) {
 		cs.closeTransportStream(err)
 	}
 	if err == io.EOF {
-		if cs.s.StatusCode() == codes.OK {
-			// Returns io.EOF to indicate the end of the stream.
-			return
+		if statusErr := cs.s.Status().Err(); statusErr != nil {
+			return statusErr
 		}
-		return Errorf(cs.s.StatusCode(), "%s", cs.s.StatusDesc())
+		// Returns io.EOF to indicate the end of the stream.
+		return
 	}
 	return toRPCErr(err)
 }
@@ -386,13 +454,37 @@ func (cs *clientStream) closeTransportStream(err error) {
 func (cs *clientStream) finish(err error) {
 	cs.mu.Lock()
 	defer cs.mu.Unlock()
+	if cs.finished {
+		return
+	}
+	cs.finished = true
+	defer func() {
+		if cs.cancel != nil {
+			cs.cancel()
+		}
+	}()
 	for _, o := range cs.opts {
 		o.after(&cs.c)
 	}
 	if cs.put != nil {
+		updateRPCInfoInContext(cs.s.Context(), rpcInfo{
+			bytesSent:     cs.s.BytesSent(),
+			bytesReceived: cs.s.BytesReceived(),
+		})
 		cs.put()
 		cs.put = nil
 	}
+	if cs.statsHandler != nil {
+		end := &stats.End{
+			Client:  true,
+			EndTime: time.Now(),
+		}
+		if err != io.EOF {
+			// end.Error is nil if the RPC finished successfully.
+			end.Error = toRPCErr(err)
+		}
+		cs.statsHandler.HandleRPC(cs.statsCtx, end)
+	}
 	if !cs.tracing {
 		return
 	}
@@ -437,10 +529,10 @@ type serverStream struct {
 	dc         Decompressor
 	cbuf       *bytes.Buffer
 	maxMsgSize int
-	statusCode codes.Code
-	statusDesc string
 	trInfo     *traceInfo
 
+	statsHandler stats.Handler
+
 	mu sync.Mutex // protects trInfo.tr after the service handler runs.
 }
 
@@ -482,7 +574,11 @@ func (ss *serverStream) SendMsg(m interface{}) (err error) {
 			ss.mu.Unlock()
 		}
 	}()
-	out, err := encode(ss.codec, m, ss.cp, ss.cbuf)
+	var outPayload *stats.OutPayload
+	if ss.statsHandler != nil {
+		outPayload = &stats.OutPayload{}
+	}
+	out, err := encode(ss.codec, m, ss.cp, ss.cbuf, outPayload)
 	defer func() {
 		if ss.cbuf != nil {
 			ss.cbuf.Reset()
@@ -495,6 +591,10 @@ func (ss *serverStream) SendMsg(m interface{}) (err error) {
 	if err := ss.t.Write(ss.s, out, &transport.Options{Last: false}); err != nil {
 		return toRPCErr(err)
 	}
+	if outPayload != nil {
+		outPayload.SentTime = time.Now()
+		ss.statsHandler.HandleRPC(ss.s.Context(), outPayload)
+	}
 	return nil
 }
 
@@ -513,7 +613,11 @@ func (ss *serverStream) RecvMsg(m interface{}) (err error) {
 			ss.mu.Unlock()
 		}
 	}()
-	if err := recv(ss.p, ss.codec, ss.s, ss.dc, m, ss.maxMsgSize); err != nil {
+	var inPayload *stats.InPayload
+	if ss.statsHandler != nil {
+		inPayload = &stats.InPayload{}
+	}
+	if err := recv(ss.p, ss.codec, ss.s, ss.dc, m, ss.maxMsgSize, inPayload); err != nil {
 		if err == io.EOF {
 			return err
 		}
@@ -522,5 +626,8 @@ func (ss *serverStream) RecvMsg(m interface{}) (err error) {
 		}
 		return toRPCErr(err)
 	}
+	if inPayload != nil {
+		ss.statsHandler.HandleRPC(ss.s.Context(), inPayload)
+	}
 	return nil
 }
diff --git a/components/engine/vendor/google.golang.org/grpc/tap/tap.go b/components/engine/vendor/google.golang.org/grpc/tap/tap.go
new file mode 100644
index 0000000000..0f36647674
--- /dev/null
+++ b/components/engine/vendor/google.golang.org/grpc/tap/tap.go
@@ -0,0 +1,54 @@
+/*
+ *
+ * Copyright 2016, Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+// Package tap defines the function handles which are executed on the transport
+// layer of gRPC-Go and related information. Everything here is EXPERIMENTAL.
+package tap
+
+import (
+	"golang.org/x/net/context"
+)
+
+// Info defines the relevant information needed by the handles.
+type Info struct {
+	// FullMethodName is the string of grpc method (in the format of
+	// /package.service/method).
+	FullMethodName string
+	// TODO: More to be added.
+}
+
+// ServerInHandle defines the function which runs when a new stream is created
+// on the server side. Note that it is executed in the per-connection I/O goroutine(s) instead
+// of per-RPC goroutine. Therefore, users should NOT have any blocking/time-consuming
+// work in this handle. Otherwise all the RPCs would slow down.
+type ServerInHandle func(ctx context.Context, info *Info) (context.Context, error)
diff --git a/components/engine/vendor/google.golang.org/grpc/transport/control.go b/components/engine/vendor/google.golang.org/grpc/transport/control.go
index 4ef0830b56..8d29aee53d 100644
--- a/components/engine/vendor/google.golang.org/grpc/transport/control.go
+++ b/components/engine/vendor/google.golang.org/grpc/transport/control.go
@@ -35,7 +35,9 @@ package transport
 
 import (
 	"fmt"
+	"math"
 	"sync"
+	"time"
 
 	"golang.org/x/net/http2"
 )
@@ -44,8 +46,18 @@ const (
 	// The default value of flow control window size in HTTP2 spec.
 	defaultWindowSize = 65535
 	// The initial window size for flow control.
-	initialWindowSize     = defaultWindowSize      // for an RPC
-	initialConnWindowSize = defaultWindowSize * 16 // for a connection
+	initialWindowSize             = defaultWindowSize      // for an RPC
+	initialConnWindowSize         = defaultWindowSize * 16 // for a connection
+	infinity                      = time.Duration(math.MaxInt64)
+	defaultClientKeepaliveTime    = infinity
+	defaultClientKeepaliveTimeout = time.Duration(20 * time.Second)
+	defaultMaxStreamsClient       = 100
+	defaultMaxConnectionIdle      = infinity
+	defaultMaxConnectionAge       = infinity
+	defaultMaxConnectionAgeGrace  = infinity
+	defaultServerKeepaliveTime    = time.Duration(2 * time.Hour)
+	defaultServerKeepaliveTimeout = time.Duration(20 * time.Second)
+	defaultKeepalivePolicyMinTime = time.Duration(5 * time.Minute)
 )
 
 // The following defines various control items which could flow through
@@ -73,6 +85,8 @@ type resetStream struct {
 func (*resetStream) item() {}
 
 type goAway struct {
+	code      http2.ErrCode
+	debugData []byte
 }
 
 func (*goAway) item() {}
@@ -111,35 +125,9 @@ func newQuotaPool(q int) *quotaPool {
 	return qb
 }
 
-// add adds n to the available quota and tries to send it on acquire.
-func (qb *quotaPool) add(n int) {
-	qb.mu.Lock()
-	defer qb.mu.Unlock()
-	qb.quota += n
-	if qb.quota <= 0 {
-		return
-	}
-	select {
-	case qb.c <- qb.quota:
-		qb.quota = 0
-	default:
-	}
-}
-
-// cancel cancels the pending quota sent on acquire, if any.
-func (qb *quotaPool) cancel() {
-	qb.mu.Lock()
-	defer qb.mu.Unlock()
-	select {
-	case n := <-qb.c:
-		qb.quota += n
-	default:
-	}
-}
-
-// reset cancels the pending quota sent on acquired, incremented by v and sends
+// add cancels the pending quota sent on acquired, incremented by v and sends
 // it back on acquire.
-func (qb *quotaPool) reset(v int) {
+func (qb *quotaPool) add(v int) {
 	qb.mu.Lock()
 	defer qb.mu.Unlock()
 	select {
@@ -151,6 +139,10 @@ func (qb *quotaPool) reset(v int) {
 	if qb.quota <= 0 {
 		return
 	}
+	// After the pool has been created, this is the only place that sends on
+	// the channel. Since mu is held at this point and any quota that was sent
+	// on the channel has been retrieved, we know that this code will always
+	// place any positive quota value on the channel.
 	select {
 	case qb.c <- qb.quota:
 		qb.quota = 0
diff --git a/components/engine/vendor/google.golang.org/grpc/transport/handler_server.go b/components/engine/vendor/google.golang.org/grpc/transport/handler_server.go
index 114e34906a..24f306babb 100644
--- a/components/engine/vendor/google.golang.org/grpc/transport/handler_server.go
+++ b/components/engine/vendor/google.golang.org/grpc/transport/handler_server.go
@@ -53,6 +53,7 @@ import (
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/status"
 )
 
 // NewServerHandlerTransport returns a ServerTransport handling gRPC
@@ -110,6 +111,10 @@ func NewServerHandlerTransport(w http.ResponseWriter, r *http.Request) (ServerTr
 					v = v[:i]
 				}
 			}
+			v, err := decodeMetadataHeader(k, v)
+			if err != nil {
+				return nil, streamErrorf(codes.InvalidArgument, "malformed binary metadata: %v", err)
+			}
 			metakv = append(metakv, k, v)
 		}
 	}
@@ -182,7 +187,7 @@ func (ht *serverHandlerTransport) do(fn func()) error {
 	}
 }
 
-func (ht *serverHandlerTransport) WriteStatus(s *Stream, statusCode codes.Code, statusDesc string) error {
+func (ht *serverHandlerTransport) WriteStatus(s *Stream, st *status.Status) error {
 	err := ht.do(func() {
 		ht.writeCommonHeaders(s)
 
@@ -192,10 +197,13 @@ func (ht *serverHandlerTransport) WriteStatus(s *Stream, statusCode codes.Code,
 		ht.rw.(http.Flusher).Flush()
 
 		h := ht.rw.Header()
-		h.Set("Grpc-Status", fmt.Sprintf("%d", statusCode))
-		if statusDesc != "" {
-			h.Set("Grpc-Message", encodeGrpcMessage(statusDesc))
+		h.Set("Grpc-Status", fmt.Sprintf("%d", st.Code()))
+		if m := st.Message(); m != "" {
+			h.Set("Grpc-Message", encodeGrpcMessage(m))
 		}
+
+		// TODO: Support Grpc-Status-Details-Bin
+
 		if md := s.Trailer(); len(md) > 0 {
 			for k, vv := range md {
 				// Clients don't tolerate reading restricted headers after some non restricted ones were sent.
@@ -203,10 +211,9 @@ func (ht *serverHandlerTransport) WriteStatus(s *Stream, statusCode codes.Code,
 					continue
 				}
 				for _, v := range vv {
-					// http2 ResponseWriter mechanism to
-					// send undeclared Trailers after the
-					// headers have possibly been written.
-					h.Add(http2.TrailerPrefix+k, v)
+					// http2 ResponseWriter mechanism to send undeclared Trailers after
+					// the headers have possibly been written.
+					h.Add(http2.TrailerPrefix+k, encodeMetadataHeader(k, v))
 				}
 			}
 		}
@@ -234,6 +241,7 @@ func (ht *serverHandlerTransport) writeCommonHeaders(s *Stream) {
 	// and https://golang.org/pkg/net/http/#example_ResponseWriter_trailers
 	h.Add("Trailer", "Grpc-Status")
 	h.Add("Trailer", "Grpc-Message")
+	// TODO: Support Grpc-Status-Details-Bin
 
 	if s.sendCompress != "" {
 		h.Set("Grpc-Encoding", s.sendCompress)
@@ -260,6 +268,7 @@ func (ht *serverHandlerTransport) WriteHeader(s *Stream, md metadata.MD) error {
 				continue
 			}
 			for _, v := range vv {
+				v = encodeMetadataHeader(k, v)
 				h.Add(k, v)
 			}
 		}
@@ -268,7 +277,7 @@ func (ht *serverHandlerTransport) WriteHeader(s *Stream, md metadata.MD) error {
 	})
 }
 
-func (ht *serverHandlerTransport) HandleStreams(startStream func(*Stream)) {
+func (ht *serverHandlerTransport) HandleStreams(startStream func(*Stream), traceCtx func(context.Context, string) context.Context) {
 	// With this transport type there will be exactly 1 stream: this HTTP request.
 
 	var ctx context.Context
@@ -314,7 +323,7 @@ func (ht *serverHandlerTransport) HandleStreams(startStream func(*Stream)) {
 	if req.TLS != nil {
 		pr.AuthInfo = credentials.TLSInfo{State: *req.TLS}
 	}
-	ctx = metadata.NewContext(ctx, ht.headerMD)
+	ctx = metadata.NewIncomingContext(ctx, ht.headerMD)
 	ctx = peer.NewContext(ctx, pr)
 	s.ctx = newContextWithStream(ctx, s)
 	s.dec = &recvBufferReader{ctx: s.ctx, recv: s.buf}
diff --git a/components/engine/vendor/google.golang.org/grpc/transport/http2_client.go b/components/engine/vendor/google.golang.org/grpc/transport/http2_client.go
index 2b0f68016a..380fff665f 100644
--- a/components/engine/vendor/google.golang.org/grpc/transport/http2_client.go
+++ b/components/engine/vendor/google.golang.org/grpc/transport/http2_client.go
@@ -35,12 +35,12 @@ package transport
 
 import (
 	"bytes"
-	"fmt"
 	"io"
 	"math"
 	"net"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"golang.org/x/net/context"
@@ -49,18 +49,24 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/keepalive"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/stats"
+	"google.golang.org/grpc/status"
 )
 
 // http2Client implements the ClientTransport interface with HTTP2.
 type http2Client struct {
-	target    string // server name/addr
-	userAgent string
-	md        interface{}
-	conn      net.Conn             // underlying communication channel
-	authInfo  credentials.AuthInfo // auth info about the connection
-	nextID    uint32               // the next stream ID to be used
+	ctx        context.Context
+	target     string // server name/addr
+	userAgent  string
+	md         interface{}
+	conn       net.Conn // underlying communication channel
+	remoteAddr net.Addr
+	localAddr  net.Addr
+	authInfo   credentials.AuthInfo // auth info about the connection
+	nextID     uint32               // the next stream ID to be used
 
 	// writableChan synchronizes write access to the transport.
 	// A writer acquires the write lock by sending a value on writableChan
@@ -76,6 +82,8 @@ type http2Client struct {
 	// goAway is closed to notify the upper layer (i.e., addrConn.transportMonitor)
 	// that the server sent GoAway on this transport.
 	goAway chan struct{}
+	// awakenKeepalive is used to wake up keepalive when after it has gone dormant.
+	awakenKeepalive chan struct{}
 
 	framer *framer
 	hBuf   *bytes.Buffer  // the buffer for HPACK encoding
@@ -95,6 +103,13 @@ type http2Client struct {
 
 	creds []credentials.PerRPCCredentials
 
+	// Boolean to keep track of reading activity on transport.
+	// 1 is true and 0 is false.
+	activity uint32 // Accessed atomically.
+	kp       keepalive.ClientParameters
+
+	statsHandler stats.Handler
+
 	mu            sync.Mutex     // guard the following variables
 	state         transportState // the state of underlying connection
 	activeStreams map[uint32]*Stream
@@ -106,6 +121,9 @@ type http2Client struct {
 	goAwayID uint32
 	// prevGoAway ID records the Last-Stream-ID in the previous GOAway frame.
 	prevGoAwayID uint32
+	// goAwayReason records the http2.ErrCode and debug data received with the
+	// GoAway frame.
+	goAwayReason GoAwayReason
 }
 
 func dial(ctx context.Context, fn func(context.Context, string) (net.Conn, error), addr string) (net.Conn, error) {
@@ -150,6 +168,9 @@ func newHTTP2Client(ctx context.Context, addr TargetInfo, opts ConnectOptions) (
 	scheme := "http"
 	conn, err := dial(ctx, opts.Dialer, addr.Addr)
 	if err != nil {
+		if opts.FailOnNonTempDialError {
+			return nil, connectionErrorf(isTemporary(err), err, "transport: %v", err)
+		}
 		return nil, connectionErrorf(true, err, "transport: %v", err)
 	}
 	// Any further errors will close the underlying connection
@@ -169,23 +190,31 @@ func newHTTP2Client(ctx context.Context, addr TargetInfo, opts ConnectOptions) (
 			return nil, connectionErrorf(temp, err, "transport: %v", err)
 		}
 	}
-	ua := primaryUA
-	if opts.UserAgent != "" {
-		ua = opts.UserAgent + " " + ua
+	kp := opts.KeepaliveParams
+	// Validate keepalive parameters.
+	if kp.Time == 0 {
+		kp.Time = defaultClientKeepaliveTime
+	}
+	if kp.Timeout == 0 {
+		kp.Timeout = defaultClientKeepaliveTimeout
 	}
 	var buf bytes.Buffer
 	t := &http2Client{
-		target:    addr.Addr,
-		userAgent: ua,
-		md:        addr.Metadata,
-		conn:      conn,
-		authInfo:  authInfo,
+		ctx:        ctx,
+		target:     addr.Addr,
+		userAgent:  opts.UserAgent,
+		md:         addr.Metadata,
+		conn:       conn,
+		remoteAddr: conn.RemoteAddr(),
+		localAddr:  conn.LocalAddr(),
+		authInfo:   authInfo,
 		// The client initiated stream id is odd starting from 1.
 		nextID:          1,
 		writableChan:    make(chan int, 1),
 		shutdownChan:    make(chan struct{}),
 		errorChan:       make(chan struct{}),
 		goAway:          make(chan struct{}),
+		awakenKeepalive: make(chan struct{}, 1),
 		framer:          newFramer(conn),
 		hBuf:            &buf,
 		hEnc:            hpack.NewEncoder(&buf),
@@ -196,8 +225,24 @@ func newHTTP2Client(ctx context.Context, addr TargetInfo, opts ConnectOptions) (
 		state:           reachable,
 		activeStreams:   make(map[uint32]*Stream),
 		creds:           opts.PerRPCCredentials,
-		maxStreams:      math.MaxInt32,
+		maxStreams:      defaultMaxStreamsClient,
+		streamsQuota:    newQuotaPool(defaultMaxStreamsClient),
 		streamSendQuota: defaultWindowSize,
+		kp:              kp,
+		statsHandler:    opts.StatsHandler,
+	}
+	// Make sure awakenKeepalive can't be written upon.
+	// keepalive routine will make it writable, if need be.
+	t.awakenKeepalive <- struct{}{}
+	if t.statsHandler != nil {
+		t.ctx = t.statsHandler.TagConn(t.ctx, &stats.ConnTagInfo{
+			RemoteAddr: t.remoteAddr,
+			LocalAddr:  t.localAddr,
+		})
+		connBegin := &stats.ConnBegin{
+			Client: true,
+		}
+		t.statsHandler.HandleConn(t.ctx, connBegin)
 	}
 	// Start the reader goroutine for incoming message. Each transport has
 	// a dedicated goroutine which reads HTTP2 frame from network. Then it
@@ -233,6 +278,9 @@ func newHTTP2Client(ctx context.Context, addr TargetInfo, opts ConnectOptions) (
 		}
 	}
 	go t.controller()
+	if t.kp.Time != infinity {
+		go t.keepalive()
+	}
 	t.writableChan <- 0
 	return t, nil
 }
@@ -266,16 +314,17 @@ func (t *http2Client) newStream(ctx context.Context, callHdr *CallHdr) *Stream {
 	return s
 }
 
-// NewStream creates a stream and register it into the transport as "active"
+// NewStream creates a stream and registers it into the transport as "active"
 // streams.
 func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (_ *Stream, err error) {
 	pr := &peer.Peer{
-		Addr: t.conn.RemoteAddr(),
+		Addr: t.remoteAddr,
 	}
 	// Attach Auth info if there is any.
 	if t.authInfo != nil {
 		pr.AuthInfo = t.authInfo
 	}
+	userCtx := ctx
 	ctx = peer.NewContext(ctx, pr)
 	authData := make(map[string]string)
 	for _, c := range t.creds {
@@ -313,21 +362,18 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (_ *Strea
 		t.mu.Unlock()
 		return nil, ErrConnClosing
 	}
-	checkStreamsQuota := t.streamsQuota != nil
 	t.mu.Unlock()
-	if checkStreamsQuota {
-		sq, err := wait(ctx, nil, nil, t.shutdownChan, t.streamsQuota.acquire())
-		if err != nil {
-			return nil, err
-		}
-		// Returns the quota balance back.
-		if sq > 1 {
-			t.streamsQuota.add(sq - 1)
-		}
+	sq, err := wait(ctx, nil, nil, t.shutdownChan, t.streamsQuota.acquire())
+	if err != nil {
+		return nil, err
+	}
+	// Returns the quota balance back.
+	if sq > 1 {
+		t.streamsQuota.add(sq - 1)
 	}
 	if _, err := wait(ctx, nil, nil, t.shutdownChan, t.writableChan); err != nil {
 		// Return the quota back now because there is no stream returned to the caller.
-		if _, ok := err.(StreamError); ok && checkStreamsQuota {
+		if _, ok := err.(StreamError); ok {
 			t.streamsQuota.add(1)
 		}
 		return nil, err
@@ -335,9 +381,7 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (_ *Strea
 	t.mu.Lock()
 	if t.state == draining {
 		t.mu.Unlock()
-		if checkStreamsQuota {
-			t.streamsQuota.add(1)
-		}
+		t.streamsQuota.add(1)
 		// Need to make t writable again so that the rpc in flight can still proceed.
 		t.writableChan <- 0
 		return nil, ErrStreamDrain
@@ -347,18 +391,19 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (_ *Strea
 		return nil, ErrConnClosing
 	}
 	s := t.newStream(ctx, callHdr)
+	s.clientStatsCtx = userCtx
 	t.activeStreams[s.id] = s
+	// If the number of active streams change from 0 to 1, then check if keepalive
+	// has gone dormant. If so, wake it up.
+	if len(t.activeStreams) == 1 {
+		select {
+		case t.awakenKeepalive <- struct{}{}:
+			t.framer.writePing(false, false, [8]byte{})
+		default:
+		}
+	}
 
-	// This stream is not counted when applySetings(...) initialize t.streamsQuota.
-	// Reset t.streamsQuota to the right value.
-	var reset bool
-	if !checkStreamsQuota && t.streamsQuota != nil {
-		reset = true
-	}
 	t.mu.Unlock()
-	if reset {
-		t.streamsQuota.reset(-1)
-	}
 
 	// HPACK encodes various headers. Note that once WriteField(...) is
 	// called, the corresponding headers/continuation frame has to be sent
@@ -390,29 +435,30 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (_ *Strea
 		hasMD      bool
 		endHeaders bool
 	)
-	if md, ok := metadata.FromContext(ctx); ok {
+	if md, ok := metadata.FromOutgoingContext(ctx); ok {
 		hasMD = true
-		for k, v := range md {
+		for k, vv := range md {
 			// HTTP doesn't allow you to set pseudoheaders after non pseudoheaders were set.
 			if isReservedHeader(k) {
 				continue
 			}
-			for _, entry := range v {
-				t.hEnc.WriteField(hpack.HeaderField{Name: k, Value: entry})
+			for _, v := range vv {
+				t.hEnc.WriteField(hpack.HeaderField{Name: k, Value: encodeMetadataHeader(k, v)})
 			}
 		}
 	}
 	if md, ok := t.md.(*metadata.MD); ok {
-		for k, v := range *md {
+		for k, vv := range *md {
 			if isReservedHeader(k) {
 				continue
 			}
-			for _, entry := range v {
-				t.hEnc.WriteField(hpack.HeaderField{Name: k, Value: entry})
+			for _, v := range vv {
+				t.hEnc.WriteField(hpack.HeaderField{Name: k, Value: encodeMetadataHeader(k, v)})
 			}
 		}
 	}
 	first := true
+	bufLen := t.hBuf.Len()
 	// Sends the headers in a single batch even when they span multiple frames.
 	for !endHeaders {
 		size := t.hBuf.Len()
@@ -447,6 +493,19 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (_ *Strea
 			return nil, connectionErrorf(true, err, "transport: %v", err)
 		}
 	}
+	s.bytesSent = true
+
+	if t.statsHandler != nil {
+		outHeader := &stats.OutHeader{
+			Client:      true,
+			WireLength:  bufLen,
+			FullMethod:  callHdr.Method,
+			RemoteAddr:  t.remoteAddr,
+			LocalAddr:   t.localAddr,
+			Compression: callHdr.SendCompress,
+		}
+		t.statsHandler.HandleRPC(s.clientStatsCtx, outHeader)
+	}
 	t.writableChan <- 0
 	return s, nil
 }
@@ -454,15 +513,11 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (_ *Strea
 // CloseStream clears the footprint of a stream when the stream is not needed any more.
 // This must not be executed in reader's goroutine.
 func (t *http2Client) CloseStream(s *Stream, err error) {
-	var updateStreams bool
 	t.mu.Lock()
 	if t.activeStreams == nil {
 		t.mu.Unlock()
 		return
 	}
-	if t.streamsQuota != nil {
-		updateStreams = true
-	}
 	delete(t.activeStreams, s.id)
 	if t.state == draining && len(t.activeStreams) == 0 {
 		// The transport is draining and s is the last live stream on t.
@@ -471,10 +526,27 @@ func (t *http2Client) CloseStream(s *Stream, err error) {
 		return
 	}
 	t.mu.Unlock()
-	if updateStreams {
-		t.streamsQuota.add(1)
-	}
+	// rstStream is true in case the stream is being closed at the client-side
+	// and the server needs to be intimated about it by sending a RST_STREAM
+	// frame.
+	// To make sure this frame is written to the wire before the headers of the
+	// next stream waiting for streamsQuota, we add to streamsQuota pool only
+	// after having acquired the writableChan to send RST_STREAM out (look at
+	// the controller() routine).
+	var rstStream bool
+	var rstError http2.ErrCode
+	defer func() {
+		// In case, the client doesn't have to send RST_STREAM to server
+		// we can safely add back to streamsQuota pool now.
+		if !rstStream {
+			t.streamsQuota.add(1)
+			return
+		}
+		t.controlBuf.put(&resetStream{s.id, rstError})
+	}()
 	s.mu.Lock()
+	rstStream = s.rstStream
+	rstError = s.rstError
 	if q := s.fc.resetPendingData(); q > 0 {
 		if n := t.fc.onRead(q); n > 0 {
 			t.controlBuf.put(&windowUpdate{0, n})
@@ -490,8 +562,9 @@ func (t *http2Client) CloseStream(s *Stream, err error) {
 	}
 	s.state = streamDone
 	s.mu.Unlock()
-	if se, ok := err.(StreamError); ok && se.Code != codes.DeadlineExceeded {
-		t.controlBuf.put(&resetStream{s.id, http2.ErrCodeCancel})
+	if _, ok := err.(StreamError); ok {
+		rstStream = true
+		rstError = http2.ErrCodeCancel
 	}
 }
 
@@ -525,6 +598,12 @@ func (t *http2Client) Close() (err error) {
 		s.mu.Unlock()
 		s.write(recvMsg{err: ErrConnClosing})
 	}
+	if t.statsHandler != nil {
+		connEnd := &stats.ConnEnd{
+			Client: true,
+		}
+		t.statsHandler.HandleConn(t.ctx, connEnd)
+	}
 	return
 }
 
@@ -582,19 +661,14 @@ func (t *http2Client) Write(s *Stream, data []byte, opts *Options) error {
 		var p []byte
 		if r.Len() > 0 {
 			size := http2MaxFrameLen
-			s.sendQuotaPool.add(0)
 			// Wait until the stream has some quota to send the data.
 			sq, err := wait(s.ctx, s.done, s.goAway, t.shutdownChan, s.sendQuotaPool.acquire())
 			if err != nil {
 				return err
 			}
-			t.sendQuotaPool.add(0)
 			// Wait until the transport has some quota to send the data.
 			tq, err := wait(s.ctx, s.done, s.goAway, t.shutdownChan, t.sendQuotaPool.acquire())
 			if err != nil {
-				if _, ok := err.(StreamError); ok || err == io.EOF {
-					t.sendQuotaPool.cancel()
-				}
 				return err
 			}
 			if sq < size {
@@ -704,7 +778,7 @@ func (t *http2Client) updateWindow(s *Stream, n uint32) {
 }
 
 func (t *http2Client) handleData(f *http2.DataFrame) {
-	size := len(f.Data())
+	size := f.Header().Length
 	if err := t.fc.onData(uint32(size)); err != nil {
 		t.notifyError(connectionErrorf(true, err, "%v", err))
 		return
@@ -718,6 +792,11 @@ func (t *http2Client) handleData(f *http2.DataFrame) {
 		return
 	}
 	if size > 0 {
+		if f.Header().Flags.Has(http2.FlagDataPadded) {
+			if w := t.fc.onRead(uint32(size) - uint32(len(f.Data()))); w > 0 {
+				t.controlBuf.put(&windowUpdate{0, w})
+			}
+		}
 		s.mu.Lock()
 		if s.state == streamDone {
 			s.mu.Unlock()
@@ -728,22 +807,27 @@ func (t *http2Client) handleData(f *http2.DataFrame) {
 			return
 		}
 		if err := s.fc.onData(uint32(size)); err != nil {
-			s.state = streamDone
-			s.statusCode = codes.Internal
-			s.statusDesc = err.Error()
-			close(s.done)
+			s.rstStream = true
+			s.rstError = http2.ErrCodeFlowControl
+			s.finish(status.New(codes.Internal, err.Error()))
 			s.mu.Unlock()
 			s.write(recvMsg{err: io.EOF})
-			t.controlBuf.put(&resetStream{s.id, http2.ErrCodeFlowControl})
 			return
 		}
+		if f.Header().Flags.Has(http2.FlagDataPadded) {
+			if w := s.fc.onRead(uint32(size) - uint32(len(f.Data()))); w > 0 {
+				t.controlBuf.put(&windowUpdate{s.id, w})
+			}
+		}
 		s.mu.Unlock()
 		// TODO(bradfitz, zhaoq): A copy is required here because there is no
 		// guarantee f.Data() is consumed before the arrival of next frame.
 		// Can this copy be eliminated?
-		data := make([]byte, size)
-		copy(data, f.Data())
-		s.write(recvMsg{data: data})
+		if len(f.Data()) > 0 {
+			data := make([]byte, len(f.Data()))
+			copy(data, f.Data())
+			s.write(recvMsg{data: data})
+		}
 	}
 	// The server has closed the stream without sending trailers.  Record that
 	// the read direction is closed, and set the status appropriately.
@@ -753,10 +837,7 @@ func (t *http2Client) handleData(f *http2.DataFrame) {
 			s.mu.Unlock()
 			return
 		}
-		s.state = streamDone
-		s.statusCode = codes.Internal
-		s.statusDesc = "server closed the stream without sending trailers"
-		close(s.done)
+		s.finish(status.New(codes.Internal, "server closed the stream without sending trailers"))
 		s.mu.Unlock()
 		s.write(recvMsg{err: io.EOF})
 	}
@@ -772,18 +853,16 @@ func (t *http2Client) handleRSTStream(f *http2.RSTStreamFrame) {
 		s.mu.Unlock()
 		return
 	}
-	s.state = streamDone
 	if !s.headerDone {
 		close(s.headerChan)
 		s.headerDone = true
 	}
-	s.statusCode, ok = http2ErrConvTab[http2.ErrCode(f.ErrCode)]
+	statusCode, ok := http2ErrConvTab[http2.ErrCode(f.ErrCode)]
 	if !ok {
 		grpclog.Println("transport: http2Client.handleRSTStream found no mapped gRPC status for the received http2 error ", f.ErrCode)
-		s.statusCode = codes.Unknown
+		statusCode = codes.Unknown
 	}
-	s.statusDesc = fmt.Sprintf("stream terminated by RST_STREAM with error code: %d", f.ErrCode)
-	close(s.done)
+	s.finish(status.Newf(statusCode, "stream terminated by RST_STREAM with error code: %d", f.ErrCode))
 	s.mu.Unlock()
 	s.write(recvMsg{err: io.EOF})
 }
@@ -811,6 +890,9 @@ func (t *http2Client) handlePing(f *http2.PingFrame) {
 }
 
 func (t *http2Client) handleGoAway(f *http2.GoAwayFrame) {
+	if f.ErrCode == http2.ErrCodeEnhanceYourCalm {
+		grpclog.Printf("Client received GoAway with http2.ErrCodeEnhanceYourCalm.")
+	}
 	t.mu.Lock()
 	if t.state == reachable || t.state == draining {
 		if f.LastStreamID > 0 && f.LastStreamID%2 != 1 {
@@ -832,6 +914,7 @@ func (t *http2Client) handleGoAway(f *http2.GoAwayFrame) {
 			t.mu.Unlock()
 			return
 		default:
+			t.setGoAwayReason(f)
 		}
 		t.goAwayID = f.LastStreamID
 		close(t.goAway)
@@ -839,6 +922,26 @@ func (t *http2Client) handleGoAway(f *http2.GoAwayFrame) {
 	t.mu.Unlock()
 }
 
+// setGoAwayReason sets the value of t.goAwayReason based
+// on the GoAway frame received.
+// It expects a lock on transport's mutext to be held by
+// the caller.
+func (t *http2Client) setGoAwayReason(f *http2.GoAwayFrame) {
+	t.goAwayReason = NoReason
+	switch f.ErrCode {
+	case http2.ErrCodeEnhanceYourCalm:
+		if string(f.DebugData()) == "too_many_pings" {
+			t.goAwayReason = TooManyPings
+		}
+	}
+}
+
+func (t *http2Client) GetGoAwayReason() GoAwayReason {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	return t.goAwayReason
+}
+
 func (t *http2Client) handleWindowUpdate(f *http2.WindowUpdateFrame) {
 	id := f.Header().StreamID
 	incr := f.Increment
@@ -857,23 +960,41 @@ func (t *http2Client) operateHeaders(frame *http2.MetaHeadersFrame) {
 	if !ok {
 		return
 	}
+	s.bytesReceived = true
 	var state decodeState
 	for _, hf := range frame.Fields {
-		state.processHeaderField(hf)
-	}
-	if state.err != nil {
-		s.mu.Lock()
-		if !s.headerDone {
-			close(s.headerChan)
-			s.headerDone = true
+		if err := state.processHeaderField(hf); err != nil {
+			s.mu.Lock()
+			if !s.headerDone {
+				close(s.headerChan)
+				s.headerDone = true
+			}
+			s.mu.Unlock()
+			s.write(recvMsg{err: err})
+			// Something wrong. Stops reading even when there is remaining.
+			return
 		}
-		s.mu.Unlock()
-		s.write(recvMsg{err: state.err})
-		// Something wrong. Stops reading even when there is remaining.
-		return
 	}
 
 	endStream := frame.StreamEnded()
+	var isHeader bool
+	defer func() {
+		if t.statsHandler != nil {
+			if isHeader {
+				inHeader := &stats.InHeader{
+					Client:     true,
+					WireLength: int(frame.Header().Length),
+				}
+				t.statsHandler.HandleRPC(s.clientStatsCtx, inHeader)
+			} else {
+				inTrailer := &stats.InTrailer{
+					Client:     true,
+					WireLength: int(frame.Header().Length),
+				}
+				t.statsHandler.HandleRPC(s.clientStatsCtx, inTrailer)
+			}
+		}
+	}()
 
 	s.mu.Lock()
 	if !endStream {
@@ -885,6 +1006,7 @@ func (t *http2Client) operateHeaders(frame *http2.MetaHeadersFrame) {
 		}
 		close(s.headerChan)
 		s.headerDone = true
+		isHeader = true
 	}
 	if !endStream || s.state == streamDone {
 		s.mu.Unlock()
@@ -894,10 +1016,7 @@ func (t *http2Client) operateHeaders(frame *http2.MetaHeadersFrame) {
 	if len(state.mdata) > 0 {
 		s.trailer = state.mdata
 	}
-	s.statusCode = state.statusCode
-	s.statusDesc = state.statusDesc
-	close(s.done)
-	s.state = streamDone
+	s.finish(state.status())
 	s.mu.Unlock()
 	s.write(recvMsg{err: io.EOF})
 }
@@ -925,6 +1044,7 @@ func (t *http2Client) reader() {
 		t.notifyError(err)
 		return
 	}
+	atomic.CompareAndSwapUint32(&t.activity, 0, 1)
 	sf, ok := frame.(*http2.SettingsFrame)
 	if !ok {
 		t.notifyError(err)
@@ -935,6 +1055,7 @@ func (t *http2Client) reader() {
 	// loop to keep reading incoming messages on this transport.
 	for {
 		frame, err := t.framer.readFrame()
+		atomic.CompareAndSwapUint32(&t.activity, 0, 1)
 		if err != nil {
 			// Abort an active stream if the http2.Framer returns a
 			// http2.StreamError. This can happen only if the server's response
@@ -986,21 +1107,15 @@ func (t *http2Client) applySettings(ss []http2.Setting) {
 				s.Val = math.MaxInt32
 			}
 			t.mu.Lock()
-			reset := t.streamsQuota != nil
-			if !reset {
-				t.streamsQuota = newQuotaPool(int(s.Val) - len(t.activeStreams))
-			}
 			ms := t.maxStreams
 			t.maxStreams = int(s.Val)
 			t.mu.Unlock()
-			if reset {
-				t.streamsQuota.reset(int(s.Val) - ms)
-			}
+			t.streamsQuota.add(int(s.Val) - ms)
 		case http2.SettingInitialWindowSize:
 			t.mu.Lock()
 			for _, stream := range t.activeStreams {
 				// Adjust the sending quota for each stream.
-				stream.sendQuotaPool.reset(int(s.Val - t.streamSendQuota))
+				stream.sendQuotaPool.add(int(s.Val - t.streamSendQuota))
 			}
 			t.streamSendQuota = s.Val
 			t.mu.Unlock()
@@ -1028,6 +1143,12 @@ func (t *http2Client) controller() {
 						t.framer.writeSettings(true, i.ss...)
 					}
 				case *resetStream:
+					// If the server needs to be to intimated about stream closing,
+					// then we need to make sure the RST_STREAM frame is written to
+					// the wire before the headers of the next stream waiting on
+					// streamQuota. We ensure this by adding to the streamsQuota pool
+					// only after having acquired the writableChan to send RST_STREAM.
+					t.streamsQuota.add(1)
 					t.framer.writeRSTStream(true, i.streamID, i.code)
 				case *flushIO:
 					t.framer.flushWrite()
@@ -1047,6 +1168,61 @@ func (t *http2Client) controller() {
 	}
 }
 
+// keepalive running in a separate goroutune makes sure the connection is alive by sending pings.
+func (t *http2Client) keepalive() {
+	p := &ping{data: [8]byte{}}
+	timer := time.NewTimer(t.kp.Time)
+	for {
+		select {
+		case <-timer.C:
+			if atomic.CompareAndSwapUint32(&t.activity, 1, 0) {
+				timer.Reset(t.kp.Time)
+				continue
+			}
+			// Check if keepalive should go dormant.
+			t.mu.Lock()
+			if len(t.activeStreams) < 1 && !t.kp.PermitWithoutStream {
+				// Make awakenKeepalive writable.
+				<-t.awakenKeepalive
+				t.mu.Unlock()
+				select {
+				case <-t.awakenKeepalive:
+					// If the control gets here a ping has been sent
+					// need to reset the timer with keepalive.Timeout.
+				case <-t.shutdownChan:
+					return
+				}
+			} else {
+				t.mu.Unlock()
+				// Send ping.
+				t.controlBuf.put(p)
+			}
+
+			// By the time control gets here a ping has been sent one way or the other.
+			timer.Reset(t.kp.Timeout)
+			select {
+			case <-timer.C:
+				if atomic.CompareAndSwapUint32(&t.activity, 1, 0) {
+					timer.Reset(t.kp.Time)
+					continue
+				}
+				t.Close()
+				return
+			case <-t.shutdownChan:
+				if !timer.Stop() {
+					<-timer.C
+				}
+				return
+			}
+		case <-t.shutdownChan:
+			if !timer.Stop() {
+				<-timer.C
+			}
+			return
+		}
+	}
+}
+
 func (t *http2Client) Error() <-chan struct{} {
 	return t.errorChan
 }
diff --git a/components/engine/vendor/google.golang.org/grpc/transport/http2_server.go b/components/engine/vendor/google.golang.org/grpc/transport/http2_server.go
index a62fb7c228..14cd19c64c 100644
--- a/components/engine/vendor/google.golang.org/grpc/transport/http2_server.go
+++ b/components/engine/vendor/google.golang.org/grpc/transport/http2_server.go
@@ -38,18 +38,26 @@ import (
 	"errors"
 	"io"
 	"math"
+	"math/rand"
 	"net"
 	"strconv"
 	"sync"
+	"sync/atomic"
+	"time"
 
+	"github.com/golang/protobuf/proto"
 	"golang.org/x/net/context"
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/hpack"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/keepalive"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/stats"
+	"google.golang.org/grpc/status"
+	"google.golang.org/grpc/tap"
 )
 
 // ErrIllegalHeaderWrite indicates that setting header is illegal because of
@@ -58,9 +66,13 @@ var ErrIllegalHeaderWrite = errors.New("transport: the stream is done or WriteHe
 
 // http2Server implements the ServerTransport interface with HTTP2.
 type http2Server struct {
+	ctx         context.Context
 	conn        net.Conn
+	remoteAddr  net.Addr
+	localAddr   net.Addr
 	maxStreamID uint32               // max stream ID ever seen
 	authInfo    credentials.AuthInfo // auth info about the connection
+	inTapHandle tap.ServerInHandle
 	// writableChan synchronizes write access to the transport.
 	// A writer acquires the write lock by receiving a value on writableChan
 	// and releases it by sending on writableChan.
@@ -82,21 +94,46 @@ type http2Server struct {
 	// sendQuotaPool provides flow control to outbound message.
 	sendQuotaPool *quotaPool
 
+	stats stats.Handler
+
+	// Flag to keep track of reading activity on transport.
+	// 1 is true and 0 is false.
+	activity uint32 // Accessed atomically.
+	// Keepalive and max-age parameters for the server.
+	kp keepalive.ServerParameters
+
+	// Keepalive enforcement policy.
+	kep keepalive.EnforcementPolicy
+	// The time instance last ping was received.
+	lastPingAt time.Time
+	// Number of times the client has violated keepalive ping policy so far.
+	pingStrikes uint8
+	// Flag to signify that number of ping strikes should be reset to 0.
+	// This is set whenever data or header frames are sent.
+	// 1 means yes.
+	resetPingStrikes uint32 // Accessed atomically.
+
 	mu            sync.Mutex // guard the following
 	state         transportState
 	activeStreams map[uint32]*Stream
 	// the per-stream outbound flow control window size set by the peer.
 	streamSendQuota uint32
+	// idle is the time instant when the connection went idle.
+	// This is either the begining of the connection or when the number of
+	// RPCs go down to 0.
+	// When the connection is busy, this value is set to 0.
+	idle time.Time
 }
 
 // newHTTP2Server constructs a ServerTransport based on HTTP2. ConnectionError is
 // returned if something goes wrong.
-func newHTTP2Server(conn net.Conn, maxStreams uint32, authInfo credentials.AuthInfo) (_ ServerTransport, err error) {
+func newHTTP2Server(conn net.Conn, config *ServerConfig) (_ ServerTransport, err error) {
 	framer := newFramer(conn)
 	// Send initial settings as connection preface to client.
 	var settings []http2.Setting
 	// TODO(zhaoq): Have a better way to signal "no limit" because 0 is
 	// permitted in the HTTP2 spec.
+	maxStreams := config.MaxStreams
 	if maxStreams == 0 {
 		maxStreams = math.MaxUint32
 	} else {
@@ -119,14 +156,40 @@ func newHTTP2Server(conn net.Conn, maxStreams uint32, authInfo credentials.AuthI
 			return nil, connectionErrorf(true, err, "transport: %v", err)
 		}
 	}
+	kp := config.KeepaliveParams
+	if kp.MaxConnectionIdle == 0 {
+		kp.MaxConnectionIdle = defaultMaxConnectionIdle
+	}
+	if kp.MaxConnectionAge == 0 {
+		kp.MaxConnectionAge = defaultMaxConnectionAge
+	}
+	// Add a jitter to MaxConnectionAge.
+	kp.MaxConnectionAge += getJitter(kp.MaxConnectionAge)
+	if kp.MaxConnectionAgeGrace == 0 {
+		kp.MaxConnectionAgeGrace = defaultMaxConnectionAgeGrace
+	}
+	if kp.Time == 0 {
+		kp.Time = defaultServerKeepaliveTime
+	}
+	if kp.Timeout == 0 {
+		kp.Timeout = defaultServerKeepaliveTimeout
+	}
+	kep := config.KeepalivePolicy
+	if kep.MinTime == 0 {
+		kep.MinTime = defaultKeepalivePolicyMinTime
+	}
 	var buf bytes.Buffer
 	t := &http2Server{
+		ctx:             context.Background(),
 		conn:            conn,
-		authInfo:        authInfo,
+		remoteAddr:      conn.RemoteAddr(),
+		localAddr:       conn.LocalAddr(),
+		authInfo:        config.AuthInfo,
 		framer:          framer,
 		hBuf:            &buf,
 		hEnc:            hpack.NewEncoder(&buf),
 		maxStreams:      maxStreams,
+		inTapHandle:     config.InTapHandle,
 		controlBuf:      newRecvBuffer(),
 		fc:              &inFlow{limit: initialConnWindowSize},
 		sendQuotaPool:   newQuotaPool(defaultWindowSize),
@@ -135,14 +198,27 @@ func newHTTP2Server(conn net.Conn, maxStreams uint32, authInfo credentials.AuthI
 		shutdownChan:    make(chan struct{}),
 		activeStreams:   make(map[uint32]*Stream),
 		streamSendQuota: defaultWindowSize,
+		stats:           config.StatsHandler,
+		kp:              kp,
+		idle:            time.Now(),
+		kep:             kep,
+	}
+	if t.stats != nil {
+		t.ctx = t.stats.TagConn(t.ctx, &stats.ConnTagInfo{
+			RemoteAddr: t.remoteAddr,
+			LocalAddr:  t.localAddr,
+		})
+		connBegin := &stats.ConnBegin{}
+		t.stats.HandleConn(t.ctx, connBegin)
 	}
 	go t.controller()
+	go t.keepalive()
 	t.writableChan <- 0
 	return t, nil
 }
 
 // operateHeader takes action on the decoded headers.
-func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(*Stream)) (close bool) {
+func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(*Stream), traceCtx func(context.Context, string) context.Context) (close bool) {
 	buf := newRecvBuffer()
 	s := &Stream{
 		id:  frame.Header().StreamID,
@@ -153,13 +229,12 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 
 	var state decodeState
 	for _, hf := range frame.Fields {
-		state.processHeaderField(hf)
-	}
-	if err := state.err; err != nil {
-		if se, ok := err.(StreamError); ok {
-			t.controlBuf.put(&resetStream{s.id, statusCodeConvTab[se.Code]})
+		if err := state.processHeaderField(hf); err != nil {
+			if se, ok := err.(StreamError); ok {
+				t.controlBuf.put(&resetStream{s.id, statusCodeConvTab[se.Code]})
+			}
+			return
 		}
-		return
 	}
 
 	if frame.StreamEnded() {
@@ -168,12 +243,12 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 	}
 	s.recvCompress = state.encoding
 	if state.timeoutSet {
-		s.ctx, s.cancel = context.WithTimeout(context.TODO(), state.timeout)
+		s.ctx, s.cancel = context.WithTimeout(t.ctx, state.timeout)
 	} else {
-		s.ctx, s.cancel = context.WithCancel(context.TODO())
+		s.ctx, s.cancel = context.WithCancel(t.ctx)
 	}
 	pr := &peer.Peer{
-		Addr: t.conn.RemoteAddr(),
+		Addr: t.remoteAddr,
 	}
 	// Attach Auth info if there is any.
 	if t.authInfo != nil {
@@ -186,7 +261,7 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 	s.ctx = newContextWithStream(s.ctx, s)
 	// Attach the received metadata to the context.
 	if len(state.mdata) > 0 {
-		s.ctx = metadata.NewContext(s.ctx, state.mdata)
+		s.ctx = metadata.NewIncomingContext(s.ctx, state.mdata)
 	}
 
 	s.dec = &recvBufferReader{
@@ -195,6 +270,18 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 	}
 	s.recvCompress = state.encoding
 	s.method = state.method
+	if t.inTapHandle != nil {
+		var err error
+		info := &tap.Info{
+			FullMethodName: state.method,
+		}
+		s.ctx, err = t.inTapHandle(s.ctx, info)
+		if err != nil {
+			// TODO: Log the real error.
+			t.controlBuf.put(&resetStream{s.id, http2.ErrCodeRefusedStream})
+			return
+		}
+	}
 	t.mu.Lock()
 	if t.state != reachable {
 		t.mu.Unlock()
@@ -214,17 +301,33 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 	t.maxStreamID = s.id
 	s.sendQuotaPool = newQuotaPool(int(t.streamSendQuota))
 	t.activeStreams[s.id] = s
+	if len(t.activeStreams) == 1 {
+		t.idle = time.Time{}
+	}
 	t.mu.Unlock()
 	s.windowHandler = func(n int) {
 		t.updateWindow(s, uint32(n))
 	}
+	s.ctx = traceCtx(s.ctx, s.method)
+	if t.stats != nil {
+		s.ctx = t.stats.TagRPC(s.ctx, &stats.RPCTagInfo{FullMethodName: s.method})
+		inHeader := &stats.InHeader{
+			FullMethod:  s.method,
+			RemoteAddr:  t.remoteAddr,
+			LocalAddr:   t.localAddr,
+			Compression: s.recvCompress,
+			WireLength:  int(frame.Header().Length),
+		}
+		t.stats.HandleRPC(s.ctx, inHeader)
+	}
 	handle(s)
 	return
 }
 
 // HandleStreams receives incoming streams using the given handler. This is
 // typically run in a separate goroutine.
-func (t *http2Server) HandleStreams(handle func(*Stream)) {
+// traceCtx attaches trace to ctx and returns the new context.
+func (t *http2Server) HandleStreams(handle func(*Stream), traceCtx func(context.Context, string) context.Context) {
 	// Check the validity of client preface.
 	preface := make([]byte, len(clientPreface))
 	if _, err := io.ReadFull(t.conn, preface); err != nil {
@@ -248,6 +351,7 @@ func (t *http2Server) HandleStreams(handle func(*Stream)) {
 		t.Close()
 		return
 	}
+	atomic.StoreUint32(&t.activity, 1)
 	sf, ok := frame.(*http2.SettingsFrame)
 	if !ok {
 		grpclog.Printf("transport: http2Server.HandleStreams saw invalid preface type %T from client", frame)
@@ -258,6 +362,7 @@ func (t *http2Server) HandleStreams(handle func(*Stream)) {
 
 	for {
 		frame, err := t.framer.readFrame()
+		atomic.StoreUint32(&t.activity, 1)
 		if err != nil {
 			if se, ok := err.(http2.StreamError); ok {
 				t.mu.Lock()
@@ -279,7 +384,7 @@ func (t *http2Server) HandleStreams(handle func(*Stream)) {
 		}
 		switch frame := frame.(type) {
 		case *http2.MetaHeadersFrame:
-			if t.operateHeaders(frame, handle) {
+			if t.operateHeaders(frame, handle, traceCtx) {
 				t.Close()
 				break
 			}
@@ -334,7 +439,7 @@ func (t *http2Server) updateWindow(s *Stream, n uint32) {
 }
 
 func (t *http2Server) handleData(f *http2.DataFrame) {
-	size := len(f.Data())
+	size := f.Header().Length
 	if err := t.fc.onData(uint32(size)); err != nil {
 		grpclog.Printf("transport: http2Server %v", err)
 		t.Close()
@@ -349,6 +454,11 @@ func (t *http2Server) handleData(f *http2.DataFrame) {
 		return
 	}
 	if size > 0 {
+		if f.Header().Flags.Has(http2.FlagDataPadded) {
+			if w := t.fc.onRead(uint32(size) - uint32(len(f.Data()))); w > 0 {
+				t.controlBuf.put(&windowUpdate{0, w})
+			}
+		}
 		s.mu.Lock()
 		if s.state == streamDone {
 			s.mu.Unlock()
@@ -364,13 +474,20 @@ func (t *http2Server) handleData(f *http2.DataFrame) {
 			t.controlBuf.put(&resetStream{s.id, http2.ErrCodeFlowControl})
 			return
 		}
+		if f.Header().Flags.Has(http2.FlagDataPadded) {
+			if w := s.fc.onRead(uint32(size) - uint32(len(f.Data()))); w > 0 {
+				t.controlBuf.put(&windowUpdate{s.id, w})
+			}
+		}
 		s.mu.Unlock()
 		// TODO(bradfitz, zhaoq): A copy is required here because there is no
 		// guarantee f.Data() is consumed before the arrival of next frame.
 		// Can this copy be eliminated?
-		data := make([]byte, size)
-		copy(data, f.Data())
-		s.write(recvMsg{data: data})
+		if len(f.Data()) > 0 {
+			data := make([]byte, len(f.Data()))
+			copy(data, f.Data())
+			s.write(recvMsg{data: data})
+		}
 	}
 	if f.Header().Flags.Has(http2.FlagDataEndStream) {
 		// Received the end of stream from the client.
@@ -404,6 +521,11 @@ func (t *http2Server) handleSettings(f *http2.SettingsFrame) {
 	t.controlBuf.put(&settings{ack: true, ss: ss})
 }
 
+const (
+	maxPingStrikes     = 2
+	defaultPingTimeout = 2 * time.Hour
+)
+
 func (t *http2Server) handlePing(f *http2.PingFrame) {
 	if f.IsAck() { // Do nothing.
 		return
@@ -411,6 +533,38 @@ func (t *http2Server) handlePing(f *http2.PingFrame) {
 	pingAck := &ping{ack: true}
 	copy(pingAck.data[:], f.Data[:])
 	t.controlBuf.put(pingAck)
+
+	now := time.Now()
+	defer func() {
+		t.lastPingAt = now
+	}()
+	// A reset ping strikes means that we don't need to check for policy
+	// violation for this ping and the pingStrikes counter should be set
+	// to 0.
+	if atomic.CompareAndSwapUint32(&t.resetPingStrikes, 1, 0) {
+		t.pingStrikes = 0
+		return
+	}
+	t.mu.Lock()
+	ns := len(t.activeStreams)
+	t.mu.Unlock()
+	if ns < 1 && !t.kep.PermitWithoutStream {
+		// Keepalive shouldn't be active thus, this new ping should
+		// have come after atleast defaultPingTimeout.
+		if t.lastPingAt.Add(defaultPingTimeout).After(now) {
+			t.pingStrikes++
+		}
+	} else {
+		// Check if keepalive policy is respected.
+		if t.lastPingAt.Add(t.kep.MinTime).After(now) {
+			t.pingStrikes++
+		}
+	}
+
+	if t.pingStrikes > maxPingStrikes {
+		// Send goaway and close the connection.
+		t.controlBuf.put(&goAway{code: http2.ErrCodeEnhanceYourCalm, debugData: []byte("too_many_pings")})
+	}
 }
 
 func (t *http2Server) handleWindowUpdate(f *http2.WindowUpdateFrame) {
@@ -429,6 +583,13 @@ func (t *http2Server) writeHeaders(s *Stream, b *bytes.Buffer, endStream bool) e
 	first := true
 	endHeaders := false
 	var err error
+	defer func() {
+		if err == nil {
+			// Reset ping strikes when seding headers since that might cause the
+			// peer to send ping.
+			atomic.StoreUint32(&t.resetPingStrikes, 1)
+		}
+	}()
 	// Sends the headers in a single batch.
 	for !endHeaders {
 		size := t.hBuf.Len()
@@ -483,18 +644,25 @@ func (t *http2Server) WriteHeader(s *Stream, md metadata.MD) error {
 	if s.sendCompress != "" {
 		t.hEnc.WriteField(hpack.HeaderField{Name: "grpc-encoding", Value: s.sendCompress})
 	}
-	for k, v := range md {
+	for k, vv := range md {
 		if isReservedHeader(k) {
 			// Clients don't tolerate reading restricted headers after some non restricted ones were sent.
 			continue
 		}
-		for _, entry := range v {
-			t.hEnc.WriteField(hpack.HeaderField{Name: k, Value: entry})
+		for _, v := range vv {
+			t.hEnc.WriteField(hpack.HeaderField{Name: k, Value: encodeMetadataHeader(k, v)})
 		}
 	}
+	bufLen := t.hBuf.Len()
 	if err := t.writeHeaders(s, t.hBuf, false); err != nil {
 		return err
 	}
+	if t.stats != nil {
+		outHeader := &stats.OutHeader{
+			WireLength: bufLen,
+		}
+		t.stats.HandleRPC(s.Context(), outHeader)
+	}
 	t.writableChan <- 0
 	return nil
 }
@@ -503,7 +671,7 @@ func (t *http2Server) WriteHeader(s *Stream, md metadata.MD) error {
 // There is no further I/O operations being able to perform on this stream.
 // TODO(zhaoq): Now it indicates the end of entire stream. Revisit if early
 // OK is adopted.
-func (t *http2Server) WriteStatus(s *Stream, statusCode codes.Code, statusDesc string) error {
+func (t *http2Server) WriteStatus(s *Stream, st *status.Status) error {
 	var headersSent, hasHeader bool
 	s.mu.Lock()
 	if s.state == streamDone {
@@ -534,23 +702,41 @@ func (t *http2Server) WriteStatus(s *Stream, statusCode codes.Code, statusDesc s
 	t.hEnc.WriteField(
 		hpack.HeaderField{
 			Name:  "grpc-status",
-			Value: strconv.Itoa(int(statusCode)),
+			Value: strconv.Itoa(int(st.Code())),
 		})
-	t.hEnc.WriteField(hpack.HeaderField{Name: "grpc-message", Value: encodeGrpcMessage(statusDesc)})
+	t.hEnc.WriteField(hpack.HeaderField{Name: "grpc-message", Value: encodeGrpcMessage(st.Message())})
+
+	if p := st.Proto(); p != nil && len(p.Details) > 0 {
+		stBytes, err := proto.Marshal(p)
+		if err != nil {
+			// TODO: return error instead, when callers are able to handle it.
+			panic(err)
+		}
+
+		t.hEnc.WriteField(hpack.HeaderField{Name: "grpc-status-details-bin", Value: encodeBinHeader(stBytes)})
+	}
+
 	// Attach the trailer metadata.
-	for k, v := range s.trailer {
+	for k, vv := range s.trailer {
 		// Clients don't tolerate reading restricted headers after some non restricted ones were sent.
 		if isReservedHeader(k) {
 			continue
 		}
-		for _, entry := range v {
-			t.hEnc.WriteField(hpack.HeaderField{Name: k, Value: entry})
+		for _, v := range vv {
+			t.hEnc.WriteField(hpack.HeaderField{Name: k, Value: encodeMetadataHeader(k, v)})
 		}
 	}
+	bufLen := t.hBuf.Len()
 	if err := t.writeHeaders(s, t.hBuf, true); err != nil {
 		t.Close()
 		return err
 	}
+	if t.stats != nil {
+		outTrailer := &stats.OutTrailer{
+			WireLength: bufLen,
+		}
+		t.stats.HandleRPC(s.Context(), outTrailer)
+	}
 	t.closeStream(s)
 	t.writableChan <- 0
 	return nil
@@ -558,7 +744,7 @@ func (t *http2Server) WriteStatus(s *Stream, statusCode codes.Code, statusDesc s
 
 // Write converts the data into HTTP2 data frame and sends it out. Non-nil error
 // is returns if it fails (e.g., framing error, transport error).
-func (t *http2Server) Write(s *Stream, data []byte, opts *Options) error {
+func (t *http2Server) Write(s *Stream, data []byte, opts *Options) (err error) {
 	// TODO(zhaoq): Support multi-writers for a single stream.
 	var writeHeaderFrame bool
 	s.mu.Lock()
@@ -573,25 +759,27 @@ func (t *http2Server) Write(s *Stream, data []byte, opts *Options) error {
 	if writeHeaderFrame {
 		t.WriteHeader(s, nil)
 	}
+	defer func() {
+		if err == nil {
+			// Reset ping strikes when sending data since this might cause
+			// the peer to send ping.
+			atomic.StoreUint32(&t.resetPingStrikes, 1)
+		}
+	}()
 	r := bytes.NewBuffer(data)
 	for {
 		if r.Len() == 0 {
 			return nil
 		}
 		size := http2MaxFrameLen
-		s.sendQuotaPool.add(0)
 		// Wait until the stream has some quota to send the data.
 		sq, err := wait(s.ctx, nil, nil, t.shutdownChan, s.sendQuotaPool.acquire())
 		if err != nil {
 			return err
 		}
-		t.sendQuotaPool.add(0)
 		// Wait until the transport has some quota to send the data.
 		tq, err := wait(s.ctx, nil, nil, t.shutdownChan, t.sendQuotaPool.acquire())
 		if err != nil {
-			if _, ok := err.(StreamError); ok {
-				t.sendQuotaPool.cancel()
-			}
 			return err
 		}
 		if sq < size {
@@ -659,7 +847,7 @@ func (t *http2Server) applySettings(ss []http2.Setting) {
 			t.mu.Lock()
 			defer t.mu.Unlock()
 			for _, stream := range t.activeStreams {
-				stream.sendQuotaPool.reset(int(s.Val - t.streamSendQuota))
+				stream.sendQuotaPool.add(int(s.Val - t.streamSendQuota))
 			}
 			t.streamSendQuota = s.Val
 		}
@@ -667,6 +855,91 @@ func (t *http2Server) applySettings(ss []http2.Setting) {
 	}
 }
 
+// keepalive running in a separate goroutine does the following:
+// 1. Gracefully closes an idle connection after a duration of keepalive.MaxConnectionIdle.
+// 2. Gracefully closes any connection after a duration of keepalive.MaxConnectionAge.
+// 3. Forcibly closes a connection after an additive period of keepalive.MaxConnectionAgeGrace over keepalive.MaxConnectionAge.
+// 4. Makes sure a connection is alive by sending pings with a frequency of keepalive.Time and closes a non-resposive connection
+// after an additional duration of keepalive.Timeout.
+func (t *http2Server) keepalive() {
+	p := &ping{}
+	var pingSent bool
+	maxIdle := time.NewTimer(t.kp.MaxConnectionIdle)
+	maxAge := time.NewTimer(t.kp.MaxConnectionAge)
+	keepalive := time.NewTimer(t.kp.Time)
+	// NOTE: All exit paths of this function should reset their
+	// respecitve timers. A failure to do so will cause the
+	// following clean-up to deadlock and eventually leak.
+	defer func() {
+		if !maxIdle.Stop() {
+			<-maxIdle.C
+		}
+		if !maxAge.Stop() {
+			<-maxAge.C
+		}
+		if !keepalive.Stop() {
+			<-keepalive.C
+		}
+	}()
+	for {
+		select {
+		case <-maxIdle.C:
+			t.mu.Lock()
+			idle := t.idle
+			if idle.IsZero() { // The connection is non-idle.
+				t.mu.Unlock()
+				maxIdle.Reset(t.kp.MaxConnectionIdle)
+				continue
+			}
+			val := t.kp.MaxConnectionIdle - time.Since(idle)
+			if val <= 0 {
+				// The connection has been idle for a duration of keepalive.MaxConnectionIdle or more.
+				// Gracefully close the connection.
+				t.state = draining
+				t.mu.Unlock()
+				t.Drain()
+				// Reseting the timer so that the clean-up doesn't deadlock.
+				maxIdle.Reset(infinity)
+				return
+			}
+			t.mu.Unlock()
+			maxIdle.Reset(val)
+		case <-maxAge.C:
+			t.mu.Lock()
+			t.state = draining
+			t.mu.Unlock()
+			t.Drain()
+			maxAge.Reset(t.kp.MaxConnectionAgeGrace)
+			select {
+			case <-maxAge.C:
+				// Close the connection after grace period.
+				t.Close()
+				// Reseting the timer so that the clean-up doesn't deadlock.
+				maxAge.Reset(infinity)
+			case <-t.shutdownChan:
+			}
+			return
+		case <-keepalive.C:
+			if atomic.CompareAndSwapUint32(&t.activity, 1, 0) {
+				pingSent = false
+				keepalive.Reset(t.kp.Time)
+				continue
+			}
+			if pingSent {
+				t.Close()
+				// Reseting the timer so that the clean-up doesn't deadlock.
+				keepalive.Reset(infinity)
+				return
+			}
+			pingSent = true
+			t.controlBuf.put(p)
+			keepalive.Reset(t.kp.Timeout)
+		case <-t.shutdownChan:
+			return
+		}
+	}
+}
+
 // controller running in a separate goroutine takes charge of sending control
 // frames (e.g., window update, reset stream, setting, etc.) to the server.
 func (t *http2Server) controller() {
@@ -698,7 +971,10 @@ func (t *http2Server) controller() {
 					sid := t.maxStreamID
 					t.state = draining
 					t.mu.Unlock()
-					t.framer.writeGoAway(true, sid, http2.ErrCodeNo, nil)
+					t.framer.writeGoAway(true, sid, i.code, i.debugData)
+					if i.code == http2.ErrCodeEnhanceYourCalm {
+						t.Close()
+					}
 				case *flushIO:
 					t.framer.flushWrite()
 				case *ping:
@@ -736,6 +1012,10 @@ func (t *http2Server) Close() (err error) {
 	for _, s := range streams {
 		s.cancel()
 	}
+	if t.stats != nil {
+		connEnd := &stats.ConnEnd{}
+		t.stats.HandleConn(t.ctx, connEnd)
+	}
 	return
 }
 
@@ -744,6 +1024,9 @@ func (t *http2Server) Close() (err error) {
 func (t *http2Server) closeStream(s *Stream) {
 	t.mu.Lock()
 	delete(t.activeStreams, s.id)
+	if len(t.activeStreams) == 0 {
+		t.idle = time.Now()
+	}
 	if t.state == draining && len(t.activeStreams) == 0 {
 		defer t.Close()
 	}
@@ -767,9 +1050,21 @@ func (t *http2Server) closeStream(s *Stream) {
 }
 
 func (t *http2Server) RemoteAddr() net.Addr {
-	return t.conn.RemoteAddr()
+	return t.remoteAddr
 }
 
 func (t *http2Server) Drain() {
-	t.controlBuf.put(&goAway{})
+	t.controlBuf.put(&goAway{code: http2.ErrCodeNo})
+}
+
+var rgen = rand.New(rand.NewSource(time.Now().UnixNano()))
+
+func getJitter(v time.Duration) time.Duration {
+	if v == infinity {
+		return 0
+	}
+	// Generate a jitter between +/- 10% of the value.
+	r := int64(v / 10)
+	j := rgen.Int63n(2*r) - r
+	return time.Duration(j)
 }
diff --git a/components/engine/vendor/google.golang.org/grpc/transport/http_util.go b/components/engine/vendor/google.golang.org/grpc/transport/http_util.go
index a3c68d4cac..795d5d18a4 100644
--- a/components/engine/vendor/google.golang.org/grpc/transport/http_util.go
+++ b/components/engine/vendor/google.golang.org/grpc/transport/http_util.go
@@ -36,6 +36,7 @@ package transport
 import (
 	"bufio"
 	"bytes"
+	"encoding/base64"
 	"fmt"
 	"io"
 	"net"
@@ -44,16 +45,16 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/golang/protobuf/proto"
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/hpack"
+	spb "google.golang.org/genproto/googleapis/rpc/status"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/grpclog"
-	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
 )
 
 const (
-	// The primary user agent
-	primaryUA = "grpc-go/1.0"
 	// http2MaxFrameLen specifies the max length of a HTTP2 frame.
 	http2MaxFrameLen = 16384 // 16KB frame
 	// http://http2.github.io/http2-spec/#SettingValues
@@ -92,13 +93,15 @@ var (
 // Records the states during HPACK decoding. Must be reset once the
 // decoding of the entire headers are finished.
 type decodeState struct {
-	err error // first error encountered decoding
-
 	encoding string
-	// statusCode caches the stream status received from the trailer
-	// the server sent. Client side only.
-	statusCode codes.Code
-	statusDesc string
+	// statusGen caches the stream status received from the trailer the server
+	// sent.  Client side only.  Do not access directly.  After all trailers are
+	// parsed, use the status method to retrieve the status.
+	statusGen *status.Status
+	// rawStatusCode and rawStatusMsg are set from the raw trailer fields and are not
+	// intended for direct access outside of parsing.
+	rawStatusCode int32
+	rawStatusMsg  string
 	// Server side only fields.
 	timeoutSet bool
 	timeout    time.Duration
@@ -121,6 +124,7 @@ func isReservedHeader(hdr string) bool {
 		"grpc-message",
 		"grpc-status",
 		"grpc-timeout",
+		"grpc-status-details-bin",
 		"te":
 		return true
 	default:
@@ -139,12 +143,6 @@ func isWhitelistedPseudoHeader(hdr string) bool {
 	}
 }
 
-func (d *decodeState) setErr(err error) {
-	if d.err == nil {
-		d.err = err
-	}
-}
-
 func validContentType(t string) bool {
 	e := "application/grpc"
 	if !strings.HasPrefix(t, e) {
@@ -158,56 +156,91 @@ func validContentType(t string) bool {
 	return true
 }
 
-func (d *decodeState) processHeaderField(f hpack.HeaderField) {
+func (d *decodeState) status() *status.Status {
+	if d.statusGen == nil {
+		// No status-details were provided; generate status using code/msg.
+		d.statusGen = status.New(codes.Code(d.rawStatusCode), d.rawStatusMsg)
+	}
+	return d.statusGen
+}
+
+const binHdrSuffix = "-bin"
+
+func encodeBinHeader(v []byte) string {
+	return base64.RawStdEncoding.EncodeToString(v)
+}
+
+func decodeBinHeader(v string) ([]byte, error) {
+	if len(v)%4 == 0 {
+		// Input was padded, or padding was not necessary.
+		return base64.StdEncoding.DecodeString(v)
+	}
+	return base64.RawStdEncoding.DecodeString(v)
+}
+
+func encodeMetadataHeader(k, v string) string {
+	if strings.HasSuffix(k, binHdrSuffix) {
+		return encodeBinHeader(([]byte)(v))
+	}
+	return v
+}
+
+func decodeMetadataHeader(k, v string) (string, error) {
+	if strings.HasSuffix(k, binHdrSuffix) {
+		b, err := decodeBinHeader(v)
+		return string(b), err
+	}
+	return v, nil
+}
+
+func (d *decodeState) processHeaderField(f hpack.HeaderField) error {
 	switch f.Name {
 	case "content-type":
 		if !validContentType(f.Value) {
-			d.setErr(streamErrorf(codes.FailedPrecondition, "transport: received the unexpected content-type %q", f.Value))
-			return
+			return streamErrorf(codes.FailedPrecondition, "transport: received the unexpected content-type %q", f.Value)
 		}
 	case "grpc-encoding":
 		d.encoding = f.Value
 	case "grpc-status":
 		code, err := strconv.Atoi(f.Value)
 		if err != nil {
-			d.setErr(streamErrorf(codes.Internal, "transport: malformed grpc-status: %v", err))
-			return
+			return streamErrorf(codes.Internal, "transport: malformed grpc-status: %v", err)
 		}
-		d.statusCode = codes.Code(code)
+		d.rawStatusCode = int32(code)
 	case "grpc-message":
-		d.statusDesc = decodeGrpcMessage(f.Value)
+		d.rawStatusMsg = decodeGrpcMessage(f.Value)
+	case "grpc-status-details-bin":
+		v, err := decodeBinHeader(f.Value)
+		if err != nil {
+			return streamErrorf(codes.Internal, "transport: malformed grpc-status-details-bin: %v", err)
+		}
+		s := &spb.Status{}
+		if err := proto.Unmarshal(v, s); err != nil {
+			return streamErrorf(codes.Internal, "transport: malformed grpc-status-details-bin: %v", err)
+		}
+		d.statusGen = status.FromProto(s)
 	case "grpc-timeout":
 		d.timeoutSet = true
 		var err error
-		d.timeout, err = decodeTimeout(f.Value)
-		if err != nil {
-			d.setErr(streamErrorf(codes.Internal, "transport: malformed time-out: %v", err))
-			return
+		if d.timeout, err = decodeTimeout(f.Value); err != nil {
+			return streamErrorf(codes.Internal, "transport: malformed time-out: %v", err)
 		}
 	case ":path":
 		d.method = f.Value
 	default:
 		if !isReservedHeader(f.Name) || isWhitelistedPseudoHeader(f.Name) {
-			if f.Name == "user-agent" {
-				i := strings.LastIndex(f.Value, " ")
-				if i == -1 {
-					// There is no application user agent string being set.
-					return
-				}
-				// Extract the application user agent string.
-				f.Value = f.Value[:i]
-			}
 			if d.mdata == nil {
 				d.mdata = make(map[string][]string)
 			}
-			k, v, err := metadata.DecodeKeyValue(f.Name, f.Value)
+			v, err := decodeMetadataHeader(f.Name, f.Value)
 			if err != nil {
 				grpclog.Printf("Failed to decode (%q, %q): %v", f.Name, f.Value, err)
-				return
+				return nil
 			}
-			d.mdata[k] = append(d.mdata[k], v)
+			d.mdata[f.Name] = append(d.mdata[f.Name], v)
 		}
 	}
+	return nil
 }
 
 type timeoutUnit uint8
@@ -379,6 +412,9 @@ func newFramer(conn net.Conn) *framer {
 		writer: bufio.NewWriterSize(conn, http2IOBufSize),
 	}
 	f.fr = http2.NewFramer(f.writer, f.reader)
+	// Opt-in to Frame reuse API on framer to reduce garbage.
+	// Frames aren't safe to read from after a subsequent call to ReadFrame.
+	f.fr.SetReuseFrames()
 	f.fr.ReadMetaHeaders = hpack.NewDecoder(http2InitHeaderTableSize, nil)
 	return f
 }
diff --git a/components/engine/vendor/google.golang.org/grpc/transport/transport.go b/components/engine/vendor/google.golang.org/grpc/transport/transport.go
index 413f7493b4..88c2c98721 100644
--- a/components/engine/vendor/google.golang.org/grpc/transport/transport.go
+++ b/components/engine/vendor/google.golang.org/grpc/transport/transport.go
@@ -45,10 +45,14 @@ import (
 	"sync"
 
 	"golang.org/x/net/context"
-	"golang.org/x/net/trace"
+	"golang.org/x/net/http2"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/keepalive"
 	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/stats"
+	"google.golang.org/grpc/status"
+	"google.golang.org/grpc/tap"
 )
 
 // recvMsg represents the received msg from the transport. All transport
@@ -167,6 +171,11 @@ type Stream struct {
 	id uint32
 	// nil for client side Stream.
 	st ServerTransport
+	// clientStatsCtx keeps the user context for stats handling.
+	// It's only valid on client side. Server side stats context is same as s.ctx.
+	// All client side stats collection should use the clientStatsCtx (instead of the stream context)
+	// so that all the generated stats for a particular RPC can be associated in the processing phase.
+	clientStatsCtx context.Context
 	// ctx is the associated context of the stream.
 	ctx context.Context
 	// cancel is always nil for client side Stream.
@@ -204,9 +213,17 @@ type Stream struct {
 	// true iff headerChan is closed. Used to avoid closing headerChan
 	// multiple times.
 	headerDone bool
-	// the status received from the server.
-	statusCode codes.Code
-	statusDesc string
+	// the status error received from the server.
+	status *status.Status
+	// rstStream indicates whether a RST_STREAM frame needs to be sent
+	// to the server to signify that this stream is closing.
+	rstStream bool
+	// rstError is the error that needs to be sent along with the RST_STREAM frame.
+	rstError http2.ErrCode
+	// bytesSent and bytesReceived indicates whether any bytes have been sent or
+	// received on this stream.
+	bytesSent     bool
+	bytesReceived bool
 }
 
 // RecvCompress returns the compression algorithm applied to the inbound
@@ -266,24 +283,14 @@ func (s *Stream) Context() context.Context {
 	return s.ctx
 }
 
-// TraceContext recreates the context of s with a trace.Trace.
-func (s *Stream) TraceContext(tr trace.Trace) {
-	s.ctx = trace.NewContext(s.ctx, tr)
-}
-
 // Method returns the method for the stream.
 func (s *Stream) Method() string {
 	return s.method
 }
 
-// StatusCode returns statusCode received from the server.
-func (s *Stream) StatusCode() codes.Code {
-	return s.statusCode
-}
-
-// StatusDesc returns statusDesc received from the server.
-func (s *Stream) StatusDesc() string {
-	return s.statusDesc
+// Status returns the status received from the server.
+func (s *Stream) Status() *status.Status {
+	return s.status
 }
 
 // SetHeader sets the header metadata. This can be called multiple times.
@@ -330,6 +337,34 @@ func (s *Stream) Read(p []byte) (n int, err error) {
 	return
 }
 
+// finish sets the stream's state and status, and closes the done channel.
+// s.mu must be held by the caller.  st must always be non-nil.
+func (s *Stream) finish(st *status.Status) {
+	s.status = st
+	s.state = streamDone
+	close(s.done)
+}
+
+// BytesSent indicates whether any bytes have been sent on this stream.
+func (s *Stream) BytesSent() bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.bytesSent
+}
+
+// BytesReceived indicates whether any bytes have been received on this stream.
+func (s *Stream) BytesReceived() bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.bytesReceived
+}
+
+// GoString is implemented by Stream so context.String() won't
+// race when printing %#v.
+func (s *Stream) GoString() string {
+	return fmt.Sprintf("<stream: %p, %v>", s, s.method)
+}
+
 // The key to save transport.Stream in the context.
 type streamKey struct{}
 
@@ -355,22 +390,41 @@ const (
 	draining
 )
 
+// ServerConfig consists of all the configurations to establish a server transport.
+type ServerConfig struct {
+	MaxStreams      uint32
+	AuthInfo        credentials.AuthInfo
+	InTapHandle     tap.ServerInHandle
+	StatsHandler    stats.Handler
+	KeepaliveParams keepalive.ServerParameters
+	KeepalivePolicy keepalive.EnforcementPolicy
+}
+
 // NewServerTransport creates a ServerTransport with conn or non-nil error
 // if it fails.
-func NewServerTransport(protocol string, conn net.Conn, maxStreams uint32, authInfo credentials.AuthInfo) (ServerTransport, error) {
-	return newHTTP2Server(conn, maxStreams, authInfo)
+func NewServerTransport(protocol string, conn net.Conn, config *ServerConfig) (ServerTransport, error) {
+	return newHTTP2Server(conn, config)
 }
 
 // ConnectOptions covers all relevant options for communicating with the server.
 type ConnectOptions struct {
 	// UserAgent is the application user agent.
 	UserAgent string
+	// Authority is the :authority pseudo-header to use. This field has no effect if
+	// TransportCredentials is set.
+	Authority string
 	// Dialer specifies how to dial a network address.
 	Dialer func(context.Context, string) (net.Conn, error)
+	// FailOnNonTempDialError specifies if gRPC fails on non-temporary dial errors.
+	FailOnNonTempDialError bool
 	// PerRPCCredentials stores the PerRPCCredentials required to issue RPCs.
 	PerRPCCredentials []credentials.PerRPCCredentials
 	// TransportCredentials stores the Authenticator required to setup a client connection.
 	TransportCredentials credentials.TransportCredentials
+	// KeepaliveParams stores the keepalive parameters.
+	KeepaliveParams keepalive.ClientParameters
+	// StatsHandler stores the handler for stats.
+	StatsHandler stats.Handler
 }
 
 // TargetInfo contains the information of the target such as network address and metadata.
@@ -457,6 +511,9 @@ type ClientTransport interface {
 	// receives the draining signal from the server (e.g., GOAWAY frame in
 	// HTTP/2).
 	GoAway() <-chan struct{}
+
+	// GetGoAwayReason returns the reason why GoAway frame was received.
+	GetGoAwayReason() GoAwayReason
 }
 
 // ServerTransport is the common interface for all gRPC server-side transport
@@ -466,7 +523,7 @@ type ClientTransport interface {
 // Write methods for a given Stream will be called serially.
 type ServerTransport interface {
 	// HandleStreams receives incoming streams using the given handler.
-	HandleStreams(func(*Stream))
+	HandleStreams(func(*Stream), func(context.Context, string) context.Context)
 
 	// WriteHeader sends the header metadata for the given stream.
 	// WriteHeader may not be called on all streams.
@@ -476,10 +533,9 @@ type ServerTransport interface {
 	// Write may not be called on all streams.
 	Write(s *Stream, data []byte, opts *Options) error
 
-	// WriteStatus sends the status of a stream to the client.
-	// WriteStatus is the final call made on a stream and always
-	// occurs.
-	WriteStatus(s *Stream, statusCode codes.Code, statusDesc string) error
+	// WriteStatus sends the status of a stream to the client.  WriteStatus is
+	// the final call made on a stream and always occurs.
+	WriteStatus(s *Stream, st *status.Status) error
 
 	// Close tears down the transport. Once it is called, the transport
 	// should not be accessed any more. All the pending streams and their
@@ -545,6 +601,8 @@ var (
 	ErrStreamDrain = streamErrorf(codes.Unavailable, "the server stops accepting new RPCs")
 )
 
+// TODO: See if we can replace StreamError with status package errors.
+
 // StreamError is an error that only affects one stream within a connection.
 type StreamError struct {
 	Code codes.Code
@@ -552,7 +610,7 @@ type StreamError struct {
 }
 
 func (e StreamError) Error() string {
-	return fmt.Sprintf("stream error: code = %d desc = %q", e.Code, e.Desc)
+	return fmt.Sprintf("stream error: code = %s desc = %q", e.Code, e.Desc)
 }
 
 // ContextErr converts the error from context package into a StreamError.
@@ -593,3 +651,16 @@ func wait(ctx context.Context, done, goAway, closing <-chan struct{}, proceed <-
 		return i, nil
 	}
 }
+
+// GoAwayReason contains the reason for the GoAway frame received.
+type GoAwayReason uint8
+
+const (
+	// Invalid indicates that no GoAway frame is received.
+	Invalid GoAwayReason = 0
+	// NoReason is the default value when GoAway frame is received.
+	NoReason GoAwayReason = 1
+	// TooManyPings indicates that a GoAway frame with ErrCodeEnhanceYourCalm
+	// was recieved and that the debug data said "too_many_pings".
+	TooManyPings GoAwayReason = 2
+)
diff --git a/components/engine/volume/local/local.go b/components/engine/volume/local/local.go
index 6631423bbc..43ba1e1db7 100644
--- a/components/engine/volume/local/local.go
+++ b/components/engine/volume/local/local.go
@@ -55,10 +55,10 @@ type activeMount struct {
 // New instantiates a new Root instance with the provided scope. Scope
 // is the base path that the Root instance uses to store its
 // volumes. The base path is created here if it does not exist.
-func New(scope string, rootUID, rootGID int) (*Root, error) {
+func New(scope string, rootIDs idtools.IDPair) (*Root, error) {
 	rootDirectory := filepath.Join(scope, volumesPathName)
 
-	if err := idtools.MkdirAllAs(rootDirectory, 0700, rootUID, rootGID); err != nil {
+	if err := idtools.MkdirAllAndChown(rootDirectory, 0700, rootIDs); err != nil {
 		return nil, err
 	}
 
@@ -66,8 +66,7 @@ func New(scope string, rootUID, rootGID int) (*Root, error) {
 		scope:   scope,
 		path:    rootDirectory,
 		volumes: make(map[string]*localVolume),
-		rootUID: rootUID,
-		rootGID: rootGID,
+		rootIDs: rootIDs,
 	}
 
 	dirs, err := ioutil.ReadDir(rootDirectory)
@@ -125,8 +124,7 @@ type Root struct {
 	scope   string
 	path    string
 	volumes map[string]*localVolume
-	rootUID int
-	rootGID int
+	rootIDs idtools.IDPair
 }
 
 // List lists all the volumes
@@ -167,7 +165,7 @@ func (r *Root) Create(name string, opts map[string]string) (volume.Volume, error
 	}
 
 	path := r.DataPath(name)
-	if err := idtools.MkdirAllAs(path, 0755, r.rootUID, r.rootGID); err != nil {
+	if err := idtools.MkdirAllAndChown(path, 0755, r.rootIDs); err != nil {
 		if os.IsExist(err) {
 			return nil, fmt.Errorf("volume already exists under %s", filepath.Dir(path))
 		}
diff --git a/components/engine/volume/local/local_test.go b/components/engine/volume/local/local_test.go
index f5a519b883..2353391aa5 100644
--- a/components/engine/volume/local/local_test.go
+++ b/components/engine/volume/local/local_test.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/mount"
 )
 
@@ -40,7 +41,7 @@ func TestRemove(t *testing.T) {
 	}
 	defer os.RemoveAll(rootDir)
 
-	r, err := New(rootDir, 0, 0)
+	r, err := New(rootDir, idtools.IDPair{UID: 0, GID: 0})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -82,7 +83,7 @@ func TestInitializeWithVolumes(t *testing.T) {
 	}
 	defer os.RemoveAll(rootDir)
 
-	r, err := New(rootDir, 0, 0)
+	r, err := New(rootDir, idtools.IDPair{UID: 0, GID: 0})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -92,7 +93,7 @@ func TestInitializeWithVolumes(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	r, err = New(rootDir, 0, 0)
+	r, err = New(rootDir, idtools.IDPair{UID: 0, GID: 0})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -114,7 +115,7 @@ func TestCreate(t *testing.T) {
 	}
 	defer os.RemoveAll(rootDir)
 
-	r, err := New(rootDir, 0, 0)
+	r, err := New(rootDir, idtools.IDPair{UID: 0, GID: 0})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -151,7 +152,7 @@ func TestCreate(t *testing.T) {
 		}
 	}
 
-	r, err = New(rootDir, 0, 0)
+	r, err = New(rootDir, idtools.IDPair{UID: 0, GID: 0})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -189,7 +190,7 @@ func TestCreateWithOpts(t *testing.T) {
 	}
 	defer os.RemoveAll(rootDir)
 
-	r, err := New(rootDir, 0, 0)
+	r, err := New(rootDir, idtools.IDPair{UID: 0, GID: 0})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -270,7 +271,7 @@ func TestCreateWithOpts(t *testing.T) {
 		t.Fatal("expected mount to still be active")
 	}
 
-	r, err = New(rootDir, 0, 0)
+	r, err = New(rootDir, idtools.IDPair{UID: 0, GID: 0})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -292,7 +293,7 @@ func TestRealodNoOpts(t *testing.T) {
 	}
 	defer os.RemoveAll(rootDir)
 
-	r, err := New(rootDir, 0, 0)
+	r, err := New(rootDir, idtools.IDPair{UID: 0, GID: 0})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -320,7 +321,7 @@ func TestRealodNoOpts(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	r, err = New(rootDir, 0, 0)
+	r, err = New(rootDir, idtools.IDPair{UID: 0, GID: 0})
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/components/engine/volume/store/store_test.go b/components/engine/volume/store/store_test.go
index c94237ac33..f5f00255a1 100644
--- a/components/engine/volume/store/store_test.go
+++ b/components/engine/volume/store/store_test.go
@@ -212,7 +212,7 @@ func TestDerefMultipleOfSameRef(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-
+	defer os.RemoveAll(dir)
 	s, err := New(dir)
 	if err != nil {
 		t.Fatal(err)
diff --git a/components/engine/volume/volume.go b/components/engine/volume/volume.go
index ef362370e5..2abfcc7b58 100644
--- a/components/engine/volume/volume.go
+++ b/components/engine/volume/volume.go
@@ -149,7 +149,9 @@ func (m *MountPoint) Cleanup() error {
 
 // Setup sets up a mount point by either mounting the volume if it is
 // configured, or creating the source directory if supplied.
-func (m *MountPoint) Setup(mountLabel string, rootUID, rootGID int) (path string, err error) {
+// The, optional, checkFun parameter allows doing additional checking
+// before creating the source directory on the host.
+func (m *MountPoint) Setup(mountLabel string, rootIDs idtools.IDPair, checkFun func(m *MountPoint) error) (path string, err error) {
 	defer func() {
 		if err == nil {
 			if label.RelabelNeeded(m.Mode) {
@@ -184,9 +186,17 @@ func (m *MountPoint) Setup(mountLabel string, rootUID, rootGID int) (path string
 
 	// system.MkdirAll() produces an error if m.Source exists and is a file (not a directory),
 	if m.Type == mounttypes.TypeBind {
+		// Before creating the source directory on the host, invoke checkFun if it's not nil. One of
+		// the use case is to forbid creating the daemon socket as a directory if the daemon is in
+		// the process of shutting down.
+		if checkFun != nil {
+			if err := checkFun(m); err != nil {
+				return "", err
+			}
+		}
 		// idtools.MkdirAllNewAs() produces an error if m.Source exists and is a file (not a directory)
 		// also, makes sure that if the directory is created, the correct remapped rootUID/rootGID will own it
-		if err := idtools.MkdirAllNewAs(m.Source, 0755, rootUID, rootGID); err != nil {
+		if err := idtools.MkdirAllAndChownNew(m.Source, 0755, rootIDs); err != nil {
 			if perr, ok := err.(*os.PathError); ok {
 				if perr.Err != syscall.ENOTDIR {
 					return "", errors.Wrapf(err, "error while creating mount source path '%s'", m.Source)