@@ -63,4 +63,4 @@ mv tmp-tar src/code.google.com/p/go/src/pkg/archive/tar

 clone git github.com/godbus/dbus v1

 clone git github.com/coreos/go-systemd v2

-clone git github.com/docker/libcontainer bc06326a5e7decdc4191d1367de8439b9d83c450

+clone git github.com/docker/libcontainer 68ea1234a0b046803aacb2562df0da12eec2b2f9

deleted file mode 100644

@@ -1,73 +0,0 @@

-package fs

-

-import (

-	"fmt"

-	"log"

-	"testing"

-

-	"github.com/docker/libcontainer/cgroups"

-)

-

-func blkioStatEntryEquals(expected, actual []cgroups.BlkioStatEntry) error {

-	if len(expected) != len(actual) {

-		return fmt.Errorf("blkioStatEntries length do not match")

-	}

-	for i, expValue := range expected {

-		actValue := actual[i]

-		if expValue != actValue {

-			return fmt.Errorf("Expected blkio stat entry %v but found %v", expValue, actValue)

-		}

-	}

-	return nil

-}

-

-func expectBlkioStatsEquals(t *testing.T, expected, actual cgroups.BlkioStats) {

-	if err := blkioStatEntryEquals(expected.IoServiceBytesRecursive, actual.IoServiceBytesRecursive); err != nil {

-		log.Printf("blkio IoServiceBytesRecursive do not match - %s\n", err)

-		t.Fail()

-	}

-

-	if err := blkioStatEntryEquals(expected.IoServicedRecursive, actual.IoServicedRecursive); err != nil {

-		log.Printf("blkio IoServicedRecursive do not match - %s\n", err)

-		t.Fail()

-	}

-

-	if err := blkioStatEntryEquals(expected.IoQueuedRecursive, actual.IoQueuedRecursive); err != nil {

-		log.Printf("blkio IoQueuedRecursive do not match - %s\n", err)

-		t.Fail()

-	}

-

-	if err := blkioStatEntryEquals(expected.SectorsRecursive, actual.SectorsRecursive); err != nil {

-		log.Printf("blkio SectorsRecursive do not match - %s\n", err)

-		t.Fail()

-	}

-}

-

-func expectThrottlingDataEquals(t *testing.T, expected, actual cgroups.ThrottlingData) {

-	if expected != actual {

-		log.Printf("Expected throttling data %v but found %v\n", expected, actual)

-		t.Fail()

-	}

-}

-

-func expectMemoryStatEquals(t *testing.T, expected, actual cgroups.MemoryStats) {

-	if expected.Usage != actual.Usage {

-		log.Printf("Expected memory usage %d but found %d\n", expected.Usage, actual.Usage)

-		t.Fail()

-	}

-	if expected.MaxUsage != actual.MaxUsage {

-		log.Printf("Expected memory max usage %d but found %d\n", expected.MaxUsage, actual.MaxUsage)

-		t.Fail()

-	}

-	for key, expValue := range expected.Stats {

-		actValue, ok := actual.Stats[key]

-		if !ok {

-			log.Printf("Expected memory stat key %s not found\n", key)

-			t.Fail()

-		}

-		if expValue != actValue {

-			log.Printf("Expected memory stat value %d but found %d\n", expValue, actValue)

-			t.Fail()

-		}

-	}

-}

new file mode 100644

@@ -0,0 +1,73 @@

+package fs

+

+import (

+	"fmt"

+	"log"

+	"testing"

+

+	"github.com/docker/libcontainer/cgroups"

+)

+

+func blkioStatEntryEquals(expected, actual []cgroups.BlkioStatEntry) error {

+	if len(expected) != len(actual) {

+		return fmt.Errorf("blkioStatEntries length do not match")

+	}

+	for i, expValue := range expected {

+		actValue := actual[i]

+		if expValue != actValue {

+			return fmt.Errorf("Expected blkio stat entry %v but found %v", expValue, actValue)

+		}

+	}

+	return nil

+}

+

+func expectBlkioStatsEquals(t *testing.T, expected, actual cgroups.BlkioStats) {

+	if err := blkioStatEntryEquals(expected.IoServiceBytesRecursive, actual.IoServiceBytesRecursive); err != nil {

+		log.Printf("blkio IoServiceBytesRecursive do not match - %s\n", err)

+		t.Fail()

+	}

+

+	if err := blkioStatEntryEquals(expected.IoServicedRecursive, actual.IoServicedRecursive); err != nil {

+		log.Printf("blkio IoServicedRecursive do not match - %s\n", err)

+		t.Fail()

+	}

+

+	if err := blkioStatEntryEquals(expected.IoQueuedRecursive, actual.IoQueuedRecursive); err != nil {

+		log.Printf("blkio IoQueuedRecursive do not match - %s\n", err)

+		t.Fail()

+	}

+

+	if err := blkioStatEntryEquals(expected.SectorsRecursive, actual.SectorsRecursive); err != nil {

+		log.Printf("blkio SectorsRecursive do not match - %s\n", err)

+		t.Fail()

+	}

+}

+

+func expectThrottlingDataEquals(t *testing.T, expected, actual cgroups.ThrottlingData) {

+	if expected != actual {

+		log.Printf("Expected throttling data %v but found %v\n", expected, actual)

+		t.Fail()

+	}

+}

+

+func expectMemoryStatEquals(t *testing.T, expected, actual cgroups.MemoryStats) {

+	if expected.Usage != actual.Usage {

+		log.Printf("Expected memory usage %d but found %d\n", expected.Usage, actual.Usage)

+		t.Fail()

+	}

+	if expected.MaxUsage != actual.MaxUsage {

+		log.Printf("Expected memory max usage %d but found %d\n", expected.MaxUsage, actual.MaxUsage)

+		t.Fail()

+	}

+	for key, expValue := range expected.Stats {

+		actValue, ok := actual.Stats[key]

+		if !ok {

+			log.Printf("Expected memory stat key %s not found\n", key)

+			t.Fail()

+		}

+		if expValue != actValue {

+			log.Printf("Expected memory stat value %d but found %d\n", expValue, actValue)

+			t.Fail()

+		}

+	}

+}

deleted file mode 100644

@@ -1,60 +0,0 @@

-/*

-Utility for testing cgroup operations.

-

-Creates a mock of the cgroup filesystem for the duration of the test.

-*/

-package fs

-

-import (

-	"fmt"

-	"io/ioutil"

-	"os"

-	"testing"

-)

-

-type cgroupTestUtil struct {

-	// data to use in tests.

-	CgroupData *data

-

-	// Path to the mock cgroup directory.

-	CgroupPath string

-

-	// Temporary directory to store mock cgroup filesystem.

-	tempDir string

-	t       *testing.T

-}

-

-// Creates a new test util for the specified subsystem

-func NewCgroupTestUtil(subsystem string, t *testing.T) *cgroupTestUtil {

-	d := &data{}

-	tempDir, err := ioutil.TempDir("", fmt.Sprintf("%s_cgroup_test", subsystem))

-	if err != nil {

-		t.Fatal(err)

-	}

-	d.root = tempDir

-	testCgroupPath, err := d.path(subsystem)

-	if err != nil {

-		t.Fatal(err)

-	}

-

-	// Ensure the full mock cgroup path exists.

-	err = os.MkdirAll(testCgroupPath, 0755)

-	if err != nil {

-		t.Fatal(err)

-	}

-	return &cgroupTestUtil{CgroupData: d, CgroupPath: testCgroupPath, tempDir: tempDir, t: t}

-}

-

-func (c *cgroupTestUtil) cleanup() {

-	os.RemoveAll(c.tempDir)

-}

-

-// Write the specified contents on the mock of the specified cgroup files.

-func (c *cgroupTestUtil) writeFileContents(fileContents map[string]string) {

-	for file, contents := range fileContents {

-		err := writeFile(c.CgroupPath, file, contents)

-		if err != nil {

-			c.t.Fatal(err)

-		}

-	}

-}

new file mode 100644

@@ -0,0 +1,60 @@

+/*

+Utility for testing cgroup operations.

+

+Creates a mock of the cgroup filesystem for the duration of the test.

+*/

+package fs

+

+import (

+	"fmt"

+	"io/ioutil"

+	"os"

+	"testing"

+)

+

+type cgroupTestUtil struct {

+	// data to use in tests.

+	CgroupData *data

+

+	// Path to the mock cgroup directory.

+	CgroupPath string

+

+	// Temporary directory to store mock cgroup filesystem.

+	tempDir string

+	t       *testing.T

+}

+

+// Creates a new test util for the specified subsystem

+func NewCgroupTestUtil(subsystem string, t *testing.T) *cgroupTestUtil {

+	d := &data{}

+	tempDir, err := ioutil.TempDir("", fmt.Sprintf("%s_cgroup_test", subsystem))

+	if err != nil {

+		t.Fatal(err)

+	}

+	d.root = tempDir

+	testCgroupPath, err := d.path(subsystem)

+	if err != nil {

+		t.Fatal(err)

+	}

+

+	// Ensure the full mock cgroup path exists.

+	err = os.MkdirAll(testCgroupPath, 0755)

+	if err != nil {

+		t.Fatal(err)

+	}

+	return &cgroupTestUtil{CgroupData: d, CgroupPath: testCgroupPath, tempDir: tempDir, t: t}

+}

+

+func (c *cgroupTestUtil) cleanup() {

+	os.RemoveAll(c.tempDir)

+}

+

+// Write the specified contents on the mock of the specified cgroup files.

+func (c *cgroupTestUtil) writeFileContents(fileContents map[string]string) {

+	for file, contents := range fileContents {

+		err := writeFile(c.CgroupPath, file, contents)

+		if err != nil {

+			c.t.Fatal(err)

+		}

+	}

+}

@@ -133,7 +133,7 @@ func DefaultCreateCommand(container *libcontainer.Config, console, rootfs, dataP

 	   }

 	*/

-	command := exec.Command(init, append([]string{"init"}, args...)...)

+	command := exec.Command(init, append([]string{"init", "--"}, args...)...)

 	// make sure the process is executed inside the context of the rootfs

 	command.Dir = rootfs

 	command.Env = append(os.Environ(), env...)

@@ -5,7 +5,6 @@ package namespaces

 import (

 	"fmt"

 	"os"

-	"runtime"

 	"strings"

 	"syscall"

@@ -28,6 +27,8 @@ import (

 // Move this to libcontainer package.

 // Init is the init process that first runs inside a new namespace to setup mounts, users, networking,

 // and other options required for the new container.

+// The caller of Init function has to ensure that the go runtime is locked to an OS thread

+// (using runtime.LockOSThread) else system calls like setns called within Init may not work as intended.

 func Init(container *libcontainer.Config, uncleanRootfs, consolePath string, syncPipe *syncpipe.SyncPipe, args []string) (err error) {

 	defer func() {

 		if err != nil {

@@ -87,8 +88,6 @@ func Init(container *libcontainer.Config, uncleanRootfs, consolePath string, syn

 		}

 	}

-	runtime.LockOSThread()

-

 	if err := apparmor.ApplyProfile(container.AppArmorProfile); err != nil {

 		return fmt.Errorf("set apparmor profile %s: %s", container.AppArmorProfile, err)

 	}

@@ -3,6 +3,7 @@ package nsinit

 import (

 	"log"

 	"os"

+	"runtime"

 	"strconv"

 	"github.com/codegangsta/cli"

@@ -23,6 +24,8 @@ var (

 )

 func initAction(context *cli.Context) {

+	runtime.LockOSThread()

+

 	container, err := loadContainer()

 	if err != nil {

 		log.Fatal(err)