@@ -18,6 +18,8 @@ import (

 	"github.com/docker/docker/daemon/daemonbuilder"

 	"github.com/docker/docker/graph"

 	"github.com/docker/docker/graph/tags"

+	"github.com/docker/docker/pkg/archive"

+	"github.com/docker/docker/pkg/chrootarchive"

 	"github.com/docker/docker/pkg/ioutils"

 	"github.com/docker/docker/pkg/parsers"

 	"github.com/docker/docker/pkg/progressreader"

@@ -393,7 +395,13 @@ func (s *router) postBuild(ctx context.Context, w http.ResponseWriter, r *http.R

 		}

 	}()

-	docker := daemonbuilder.Docker{s.daemon, output, authConfigs}

+	uidMaps, gidMaps := s.daemon.GetUIDGIDMaps()

+	defaultArchiver := &archive.Archiver{

+		Untar:   chrootarchive.Untar,

+		UIDMaps: uidMaps,

+		GIDMaps: gidMaps,

+	}

+	docker := daemonbuilder.Docker{s.daemon, output, authConfigs, defaultArchiver}

 	b, err := dockerfile.NewBuilder(buildConfig, docker, builder.DockerIgnoreContext{context}, nil)

 	if err != nil {

@@ -30,6 +30,7 @@ type CommonConfig struct {

 	LogConfig      runconfig.LogConfig

 	Mtu            int

 	Pidfile        string

+	RemappedRoot   string

 	Root           string

 	TrustKeyPath   string

 	DefaultNetwork string

@@ -27,6 +27,7 @@ type Config struct {

 	CorsHeaders          string

 	EnableCors           bool

 	EnableSelinuxSupport bool

+	RemappedRoot         string

 	SocketGroup          string

 	Ulimits              map[string]*ulimit.Ulimit

 }

@@ -77,4 +78,6 @@ func (config *Config) InstallFlags(cmd *flag.FlagSet, usageFn func(string) strin

 	cmd.BoolVar(&config.Bridge.EnableUserlandProxy, []string{"-userland-proxy"}, true, usageFn("Use userland proxy for loopback traffic"))

 	cmd.BoolVar(&config.EnableCors, []string{"#api-enable-cors", "#-api-enable-cors"}, false, usageFn("Enable CORS headers in the remote API, this is deprecated by --api-cors-header"))

 	cmd.StringVar(&config.CorsHeaders, []string{"-api-cors-header"}, "", usageFn("Set CORS headers in the remote API"))

+

+	config.attachExperimentalFlags(cmd, usageFn)

 }

@@ -553,7 +553,12 @@ func (container *Container) export() (archive.Archive, error) {

 		return nil, err

 	}

-	archive, err := archive.Tar(container.basefs, archive.Uncompressed)

+	uidMaps, gidMaps := container.daemon.GetUIDGIDMaps()

+	archive, err := archive.TarWithOptions(container.basefs, &archive.TarOptions{

+		Compression: archive.Uncompressed,

+		UIDMaps:     uidMaps,

+		GIDMaps:     gidMaps,

+	})

 	if err != nil {

 		container.Unmount()

 		return nil, err

@@ -20,6 +20,7 @@ import (

 	"github.com/docker/docker/daemon/network"

 	derr "github.com/docker/docker/errors"

 	"github.com/docker/docker/pkg/directory"

+	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/nat"

 	"github.com/docker/docker/pkg/stringid"

 	"github.com/docker/docker/pkg/system"

@@ -302,6 +303,14 @@ func populateCommand(c *Container, env []string) error {

 	processConfig.SysProcAttr = &syscall.SysProcAttr{Setsid: true}

 	processConfig.Env = env

+	remappedRoot := &execdriver.User{}

+	rootUID, rootGID := c.daemon.GetRemappedUIDGID()

+	if rootUID != 0 {

+		remappedRoot.UID = rootUID

+		remappedRoot.GID = rootGID

+	}

+	uidMap, gidMap := c.daemon.GetUIDGIDMaps()

+

 	c.command = &execdriver.Command{

 		ID:                 c.ID,

 		Rootfs:             c.rootfsPath(),

@@ -310,6 +319,9 @@ func populateCommand(c *Container, env []string) error {

 		WorkingDir:         c.Config.WorkingDir,

 		Network:            en,

 		Ipc:                ipc,

+		UIDMapping:         uidMap,

+		GIDMapping:         gidMap,

+		RemappedRoot:       remappedRoot,

 		Pid:                pid,

 		UTS:                uts,

 		Resources:          resources,

@@ -1343,19 +1355,23 @@ func (container *Container) hasMountFor(path string) bool {

 }

 func (container *Container) setupIpcDirs() error {

+	rootUID, rootGID := container.daemon.GetRemappedUIDGID()

 	if !container.hasMountFor("/dev/shm") {

 		shmPath, err := container.shmPath()

 		if err != nil {

 			return err

 		}

-		if err := os.MkdirAll(shmPath, 0700); err != nil {

+		if err := idtools.MkdirAllAs(shmPath, 0700, rootUID, rootGID); err != nil {

 			return err

 		}

 		if err := syscall.Mount("shm", shmPath, "tmpfs", uintptr(syscall.MS_NOEXEC|syscall.MS_NOSUID|syscall.MS_NODEV), label.FormatMountLabel("mode=1777,size=65536k", container.getMountLabel())); err != nil {

 			return fmt.Errorf("mounting shm tmpfs: %s", err)

 		}

+		if err := os.Chown(shmPath, rootUID, rootGID); err != nil {

+			return err

+		}

 	}

 	if !container.hasMountFor("/dev/mqueue") {

@@ -1364,13 +1380,16 @@ func (container *Container) setupIpcDirs() error {

 			return err

 		}

-		if err := os.MkdirAll(mqueuePath, 0700); err != nil {

+		if err := idtools.MkdirAllAs(mqueuePath, 0700, rootUID, rootGID); err != nil {

 			return err

 		}

 		if err := syscall.Mount("mqueue", mqueuePath, "mqueue", uintptr(syscall.MS_NOEXEC|syscall.MS_NOSUID|syscall.MS_NODEV), ""); err != nil {

 			return fmt.Errorf("mounting mqueue mqueue : %s", err)

 		}

+		if err := os.Chown(mqueuePath, rootUID, rootGID); err != nil {

+			return err

+		}

 	}

 	return nil

@@ -37,6 +37,7 @@ import (

 	"github.com/docker/docker/pkg/discovery"

 	"github.com/docker/docker/pkg/fileutils"

 	"github.com/docker/docker/pkg/graphdb"

+	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/ioutils"

 	"github.com/docker/docker/pkg/namesgenerator"

 	"github.com/docker/docker/pkg/nat"

@@ -121,6 +122,8 @@ type Daemon struct {

 	discoveryWatcher discovery.Watcher

 	root             string

 	shutdown         bool

+	uidMaps          []idtools.IDMap

+	gidMaps          []idtools.IDMap

 }

 // Get looks for a container using the provided information, which could be

@@ -632,6 +635,15 @@ func NewDaemon(config *Config, registryService *registry.Service) (daemon *Daemo

 	// on Windows to dump Go routine stacks

 	setupDumpStackTrap()

+	uidMaps, gidMaps, err := setupRemappedRoot(config)

+	if err != nil {

+		return nil, err

+	}

+	rootUID, rootGID, err := idtools.GetRootUIDGID(uidMaps, gidMaps)

+	if err != nil {

+		return nil, err

+	}

+

 	// get the canonical path to the Docker root directory

 	var realRoot string

 	if _, err := os.Stat(config.Root); err != nil && os.IsNotExist(err) {

@@ -642,14 +654,13 @@ func NewDaemon(config *Config, registryService *registry.Service) (daemon *Daemo

 			return nil, fmt.Errorf("Unable to get the full path to root (%s): %s", config.Root, err)

 		}

 	}

-	config.Root = realRoot

-	// Create the root directory if it doesn't exists

-	if err := system.MkdirAll(config.Root, 0700); err != nil {

+

+	if err = setupDaemonRoot(config, realRoot, rootUID, rootGID); err != nil {

 		return nil, err

 	}

 	// set up the tmpDir to use a canonical path

-	tmp, err := tempDir(config.Root)

+	tmp, err := tempDir(config.Root, rootUID, rootGID)

 	if err != nil {

 		return nil, fmt.Errorf("Unable to get the TempDir under %s: %s", config.Root, err)

 	}

@@ -663,7 +674,7 @@ func NewDaemon(config *Config, registryService *registry.Service) (daemon *Daemo

 	graphdriver.DefaultDriver = config.GraphDriver

 	// Load storage driver

-	driver, err := graphdriver.New(config.Root, config.GraphOptions)

+	driver, err := graphdriver.New(config.Root, config.GraphOptions, uidMaps, gidMaps)

 	if err != nil {

 		return nil, fmt.Errorf("error initializing graphdriver: %v", err)

 	}

@@ -696,7 +707,7 @@ func NewDaemon(config *Config, registryService *registry.Service) (daemon *Daemo

 	daemonRepo := filepath.Join(config.Root, "containers")

-	if err := system.MkdirAll(daemonRepo, 0700); err != nil {

+	if err := idtools.MkdirAllAs(daemonRepo, 0700, rootUID, rootGID); err != nil && !os.IsExist(err) {

 		return nil, err

 	}

@@ -706,13 +717,13 @@ func NewDaemon(config *Config, registryService *registry.Service) (daemon *Daemo

 	}

 	logrus.Debug("Creating images graph")

-	g, err := graph.NewGraph(filepath.Join(config.Root, "graph"), d.driver)

+	g, err := graph.NewGraph(filepath.Join(config.Root, "graph"), d.driver, uidMaps, gidMaps)

 	if err != nil {

 		return nil, err

 	}

 	// Configure the volumes driver

-	volStore, err := configureVolumes(config)

+	volStore, err := configureVolumes(config, rootUID, rootGID)

 	if err != nil {

 		return nil, err

 	}

@@ -777,7 +788,7 @@ func NewDaemon(config *Config, registryService *registry.Service) (daemon *Daemo

 	var sysInitPath string

 	if config.ExecDriver == "lxc" {

-		initPath, err := configureSysInit(config)

+		initPath, err := configureSysInit(config, rootUID, rootGID)

 		if err != nil {

 			return nil, err

 		}

@@ -812,6 +823,8 @@ func NewDaemon(config *Config, registryService *registry.Service) (daemon *Daemo

 	d.EventsService = eventsService

 	d.volumes = volStore

 	d.root = config.Root

+	d.uidMaps = uidMaps

+	d.gidMaps = gidMaps

 	if err := d.cleanupMounts(); err != nil {

 		return nil, err

@@ -974,7 +987,11 @@ func (daemon *Daemon) diff(container *Container) (archive.Archive, error) {

 func (daemon *Daemon) createRootfs(container *Container) error {

 	// Step 1: create the container directory.

 	// This doubles as a barrier to avoid race conditions.

-	if err := os.Mkdir(container.root, 0700); err != nil {

+	rootUID, rootGID, err := idtools.GetRootUIDGID(daemon.uidMaps, daemon.gidMaps)

+	if err != nil {

+		return err

+	}

+	if err := idtools.MkdirAs(container.root, 0700, rootUID, rootGID); err != nil {

 		return err

 	}

 	initID := fmt.Sprintf("%s-init", container.ID)

@@ -986,7 +1003,7 @@ func (daemon *Daemon) createRootfs(container *Container) error {

 		return err

 	}

-	if err := setupInitLayer(initPath); err != nil {

+	if err := setupInitLayer(initPath, rootUID, rootGID); err != nil {

 		daemon.driver.Put(initID)

 		return err

 	}

@@ -1105,6 +1122,21 @@ func (daemon *Daemon) containerGraph() *graphdb.Database {

 	return daemon.containerGraphDB

 }

+// GetUIDGIDMaps returns the current daemon's user namespace settings

+// for the full uid and gid maps which will be applied to containers

+// started in this instance.

+func (daemon *Daemon) GetUIDGIDMaps() ([]idtools.IDMap, []idtools.IDMap) {

+	return daemon.uidMaps, daemon.gidMaps

+}

+

+// GetRemappedUIDGID returns the current daemon's uid and gid values

+// if user namespaces are in use for this daemon instance.  If not

+// this function will return "real" root values of 0, 0.

+func (daemon *Daemon) GetRemappedUIDGID() (int, int) {

+	uid, gid, _ := idtools.GetRootUIDGID(daemon.uidMaps, daemon.gidMaps)

+	return uid, gid

+}

+

 // ImageGetCached returns the earliest created image that is a child

 // of the image with imgID, that had the same config when it was

 // created. nil is returned if a child cannot be found. An error is

@@ -1139,12 +1171,12 @@ func (daemon *Daemon) ImageGetCached(imgID string, config *runconfig.Config) (*i

 }

 // tempDir returns the default directory to use for temporary files.

-func tempDir(rootDir string) (string, error) {

+func tempDir(rootDir string, rootUID, rootGID int) (string, error) {

 	var tmpDir string

 	if tmpDir = os.Getenv("DOCKER_TMPDIR"); tmpDir == "" {

 		tmpDir = filepath.Join(rootDir, "tmp")

 	}

-	return tmpDir, system.MkdirAll(tmpDir, 0700)

+	return tmpDir, idtools.MkdirAllAs(tmpDir, 0700, rootUID, rootGID)

 }

 func (daemon *Daemon) setHostConfig(container *Container, hostConfig *runconfig.HostConfig) error {

@@ -1228,8 +1260,8 @@ func (daemon *Daemon) verifyContainerSettings(hostConfig *runconfig.HostConfig,

 	return verifyPlatformContainerSettings(daemon, hostConfig, config)

 }

-func configureVolumes(config *Config) (*store.VolumeStore, error) {

-	volumesDriver, err := local.New(config.Root)

+func configureVolumes(config *Config, rootUID, rootGID int) (*store.VolumeStore, error) {

+	volumesDriver, err := local.New(config.Root, rootUID, rootGID)

 	if err != nil {

 		return nil, err

 	}

@@ -509,7 +509,7 @@ func initDaemonForVolumesTest(tmp string) (*Daemon, error) {

 		volumes:    store.New(),

 	}

-	volumesDriver, err := local.New(tmp)

+	volumesDriver, err := local.New(tmp, 0, 0)

 	if err != nil {

 		return nil, err

 	}

@@ -15,10 +15,10 @@ import (

 	"github.com/docker/docker/daemon/graphdriver"

 	derr "github.com/docker/docker/errors"

 	"github.com/docker/docker/pkg/fileutils"

+	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/parsers"

 	"github.com/docker/docker/pkg/parsers/kernel"

 	"github.com/docker/docker/pkg/sysinfo"

-	"github.com/docker/docker/pkg/system"

 	"github.com/docker/docker/runconfig"

 	"github.com/docker/docker/utils"

 	"github.com/docker/libnetwork"

@@ -121,6 +121,11 @@ func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *runconfig.HostC

 	warnings := []string{}

 	sysInfo := sysinfo.New(true)

+	warnings, err := daemon.verifyExperimentalContainerSettings(hostConfig, config)

+	if err != nil {

+		return warnings, err

+	}

+

 	if hostConfig.LxcConf.Len() > 0 && !strings.Contains(daemon.ExecutionDriver().Name(), "lxc") {

 		return warnings, fmt.Errorf("Cannot use --lxc-conf with execdriver: %s", daemon.ExecutionDriver().Name())

 	}

@@ -275,7 +280,7 @@ func migrateIfDownlevel(driver graphdriver.Driver, root string) error {

 	return migrateIfAufs(driver, root)

 }

-func configureSysInit(config *Config) (string, error) {

+func configureSysInit(config *Config, rootUID, rootGID int) (string, error) {

 	localCopy := filepath.Join(config.Root, "init", fmt.Sprintf("dockerinit-%s", dockerversion.VERSION))

 	sysInitPath := utils.DockerInitPath(localCopy)

 	if sysInitPath == "" {

@@ -284,7 +289,7 @@ func configureSysInit(config *Config) (string, error) {

 	if sysInitPath != localCopy {

 		// When we find a suitable dockerinit binary (even if it's our local binary), we copy it into config.Root at localCopy for future use (so that the original can go away without that being a problem, for example during a package upgrade).

-		if err := os.Mkdir(filepath.Dir(localCopy), 0700); err != nil && !os.IsExist(err) {

+		if err := idtools.MkdirAs(filepath.Dir(localCopy), 0700, rootUID, rootGID); err != nil && !os.IsExist(err) {

 			return "", err

 		}

 		if _, err := fileutils.CopyFile(sysInitPath, localCopy); err != nil {

@@ -455,7 +460,7 @@ func initBridgeDriver(controller libnetwork.NetworkController, config *Config) e

 //

 // This extra layer is used by all containers as the top-most ro layer. It protects

 // the container from unwanted side-effects on the rw layer.

-func setupInitLayer(initLayer string) error {

+func setupInitLayer(initLayer string, rootUID, rootGID int) error {

 	for pth, typ := range map[string]string{

 		"/dev/pts":         "dir",

 		"/dev/shm":         "dir",

@@ -478,12 +483,12 @@ func setupInitLayer(initLayer string) error {

 		if _, err := os.Stat(filepath.Join(initLayer, pth)); err != nil {

 			if os.IsNotExist(err) {

-				if err := system.MkdirAll(filepath.Join(initLayer, filepath.Dir(pth)), 0755); err != nil {

+				if err := idtools.MkdirAllAs(filepath.Join(initLayer, filepath.Dir(pth)), 0755, rootUID, rootGID); err != nil {

 					return err

 				}

 				switch typ {

 				case "dir":

-					if err := system.MkdirAll(filepath.Join(initLayer, pth), 0755); err != nil {

+					if err := idtools.MkdirAllAs(filepath.Join(initLayer, pth), 0755, rootUID, rootGID); err != nil {

 						return err

 					}

 				case "file":

@@ -492,6 +497,7 @@ func setupInitLayer(initLayer string) error {

 						return err

 					}

 					f.Close()

+					f.Chown(rootUID, rootGID)

 				default:

 					if err := os.Symlink(typ, filepath.Join(initLayer, pth)); err != nil {

 						return err

@@ -25,7 +25,7 @@ func parseSecurityOpt(container *Container, config *runconfig.HostConfig) error

 	return nil

 }

-func setupInitLayer(initLayer string) error {

+func setupInitLayer(initLayer string, rootUID, rootGID int) error {

 	return nil

 }

@@ -89,7 +89,7 @@ func migrateIfDownlevel(driver graphdriver.Driver, root string) error {

 	return nil

 }

-func configureSysInit(config *Config) (string, error) {

+func configureSysInit(config *Config, rootUID, rootGID int) (string, error) {

 	// TODO Windows.

 	return os.Getenv("TEMP"), nil

 }

@@ -16,7 +16,6 @@ import (

 	"github.com/docker/docker/graph"

 	"github.com/docker/docker/image"

 	"github.com/docker/docker/pkg/archive"

-	"github.com/docker/docker/pkg/chrootarchive"

 	"github.com/docker/docker/pkg/httputils"

 	"github.com/docker/docker/pkg/ioutils"

 	"github.com/docker/docker/pkg/parsers"

@@ -32,6 +31,7 @@ type Docker struct {

 	Daemon      *daemon.Daemon

 	OutOld      io.Writer

 	AuthConfigs map[string]cliconfig.AuthConfig

+	Archiver    *archive.Archiver

 }

 // ensure Docker implements builder.Docker

@@ -121,6 +121,7 @@ func (d Docker) Release(sessionID string, activeImages []string) {

 func (d Docker) Copy(c *daemon.Container, destPath string, src builder.FileInfo, decompress bool) error {

 	srcPath := src.Path()

 	destExists := true

+	rootUID, rootGID := d.Daemon.GetRemappedUIDGID()

 	// Work in daemon-local OS specific file paths

 	destPath = filepath.FromSlash(destPath)

@@ -149,10 +150,10 @@ func (d Docker) Copy(c *daemon.Container, destPath string, src builder.FileInfo,

 	if src.IsDir() {

 		// copy as directory

-		if err := chrootarchive.CopyWithTar(srcPath, destPath); err != nil {

+		if err := d.Archiver.CopyWithTar(srcPath, destPath); err != nil {

 			return err

 		}

-		return fixPermissions(srcPath, destPath, 0, 0, destExists)

+		return fixPermissions(srcPath, destPath, rootUID, rootGID, destExists)

 	}

 	if decompress {

 		// Only try to untar if it is a file and that we've been told to decompress (when ADD-ing a remote file)

@@ -167,7 +168,7 @@ func (d Docker) Copy(c *daemon.Container, destPath string, src builder.FileInfo,

 		}

 		// try to successfully untar the orig

-		if err := chrootarchive.UntarPath(srcPath, tarDest); err == nil {

+		if err := d.Archiver.UntarPath(srcPath, tarDest); err == nil {

 			return nil

 		} else if err != io.EOF {

 			logrus.Debugf("Couldn't untar to %s: %v", tarDest, err)

@@ -182,11 +183,11 @@ func (d Docker) Copy(c *daemon.Container, destPath string, src builder.FileInfo,

 	if err := system.MkdirAll(filepath.Dir(destPath), 0755); err != nil {

 		return err

 	}

-	if err := chrootarchive.CopyFileWithTar(srcPath, destPath); err != nil {

+	if err := d.Archiver.CopyFileWithTar(srcPath, destPath); err != nil {

 		return err

 	}

-	return fixPermissions(srcPath, destPath, 0, 0, destExists)

+	return fixPermissions(srcPath, destPath, rootUID, rootGID, destExists)

 }

 // GetCachedImage returns a reference to a cached image whose parent equals `parent`

@@ -6,6 +6,7 @@ import (

 	"os/exec"

 	"time"

+	"github.com/docker/docker/pkg/idtools"

 	// TODO Windows: Factor out ulimit

 	"github.com/docker/docker/pkg/ulimit"

 	"github.com/opencontainers/runc/libcontainer"

@@ -173,6 +174,12 @@ type Mount struct {

 	Slave       bool   `json:"slave"`

 }

+// User contains the uid and gid representing a Unix user

+type User struct {

+	UID int `json:"root_uid"`

+	GID int `json:"root_gid"`

+}

+

 // ProcessConfig describes a process that will be run inside a container.

 type ProcessConfig struct {

 	exec.Cmd `json:"-"`

@@ -202,6 +209,9 @@ type Command struct {

 	Ipc                *Ipc              `json:"ipc"`

 	Pid                *Pid              `json:"pid"`

 	UTS                *UTS              `json:"uts"`

+	RemappedRoot       *User             `json:"remap_root"`

+	UIDMapping         []idtools.IDMap   `json:"uidmapping"`

+	GIDMapping         []idtools.IDMap   `json:"gidmapping"`

 	Resources          *Resources        `json:"resources"`

 	Mounts             []Mount           `json:"mounts"`

 	AllowedDevices     []*configs.Device `json:"allowed_devices"`

@@ -8,6 +8,7 @@ import (

 	"syscall"

 	"github.com/docker/docker/daemon/execdriver"

+

 	"github.com/opencontainers/runc/libcontainer/apparmor"

 	"github.com/opencontainers/runc/libcontainer/configs"

 	"github.com/opencontainers/runc/libcontainer/devices"

@@ -30,6 +31,10 @@ func (d *Driver) createContainer(c *execdriver.Command, hooks execdriver.Hooks)

 		return nil, err

 	}

+	if err := d.setupRemappedRoot(container, c); err != nil {

+		return nil, err

+	}

+

 	if err := d.createNetwork(container, c, hooks); err != nil {

 		return nil, err

 	}

@@ -193,6 +198,40 @@ func (d *Driver) createUTS(container *configs.Config, c *execdriver.Command) err

 	return nil

 }

+func (d *Driver) setupRemappedRoot(container *configs.Config, c *execdriver.Command) error {

+	if c.RemappedRoot.UID == 0 {

+		container.Namespaces.Remove(configs.NEWUSER)

+		return nil

+	}

+

+	// convert the Docker daemon id map to the libcontainer variant of the same struct

+	// this keeps us from having to import libcontainer code across Docker client + daemon packages

+	cuidMaps := []configs.IDMap{}

+	cgidMaps := []configs.IDMap{}

+	for _, idMap := range c.UIDMapping {

+		cuidMaps = append(cuidMaps, configs.IDMap(idMap))

+	}

+	for _, idMap := range c.GIDMapping {

+		cgidMaps = append(cgidMaps, configs.IDMap(idMap))

+	}

+	container.UidMappings = cuidMaps

+	container.GidMappings = cgidMaps

+

+	for _, node := range container.Devices {

+		node.Uid = uint32(c.RemappedRoot.UID)

+		node.Gid = uint32(c.RemappedRoot.GID)

+	}

+	// TODO: until a kernel/mount solution exists for handling remount in a user namespace,

+	// we must clear the readonly flag for the cgroups mount (@mrunalp concurs)

+	for i := range container.Mounts {

+		if container.Mounts[i].Device == "cgroup" {

+			container.Mounts[i].Flags &= ^syscall.MS_RDONLY

+		}

+	}

+

+	return nil

+}

+

 func (d *Driver) setPrivileged(container *configs.Config) (err error) {

 	container.Capabilities = execdriver.GetAllCapabilities()

 	container.Cgroups.AllowAllDevices = true

@@ -255,6 +294,7 @@ func (d *Driver) setupMounts(container *configs.Config, c *execdriver.Command) e

 		if m.Slave {

 			flags |= syscall.MS_SLAVE

 		}

+

 		container.Mounts = append(container.Mounts, &configs.Mount{

 			Source:      m.Source,

 			Destination: m.Destination,

@@ -443,22 +443,35 @@ func (t *TtyConsole) Close() error {

 }

 func setupPipes(container *configs.Config, processConfig *execdriver.ProcessConfig, p *libcontainer.Process, pipes *execdriver.Pipes) error {

-	var term execdriver.Terminal

-	var err error

+

+	rootuid, err := container.HostUID()

+	if err != nil {

+		return err

+	}

 	if processConfig.Tty {

-		rootuid, err := container.HostUID()

+		cons, err := p.NewConsole(rootuid)

 		if err != nil {

 			return err

 		}

-		cons, err := p.NewConsole(rootuid)

+		term, err := NewTtyConsole(cons, pipes)

 		if err != nil {

 			return err

 		}

-		term, err = NewTtyConsole(cons, pipes)

-	} else {

+		processConfig.Terminal = term

+		return nil

+	}

+	// not a tty--set up stdio pipes

+	term := &execdriver.StdConsole{}

+	processConfig.Terminal = term

+

+	// if we are not in a user namespace, there is no reason to go through

+	// the hassle of setting up os-level pipes with proper (remapped) ownership

+	// so we will do the prior shortcut for non-userns containers

+	if rootuid == 0 {

 		p.Stdout = pipes.Stdout

 		p.Stderr = pipes.Stderr

+

 		r, w, err := os.Pipe()

 		if err != nil {

 			return err

@@ -470,12 +483,57 @@ func setupPipes(container *configs.Config, processConfig *execdriver.ProcessConf

 			}()

 			p.Stdin = r

 		}

-		term = &execdriver.StdConsole{}

+		return nil

 	}

+

+	// if we have user namespaces enabled (rootuid != 0), we will set

+	// up os pipes for stderr, stdout, stdin so we can chown them to

+	// the proper ownership to allow for proper access to the underlying

+	// fds

+	var fds []int

+

+	//setup stdout

+	r, w, err := os.Pipe()

 	if err != nil {

 		return err

 	}

-	processConfig.Terminal = term

+	fds = append(fds, int(r.Fd()), int(w.Fd()))

+	if pipes.Stdout != nil {

+		go io.Copy(pipes.Stdout, r)

+	}

+	term.Closers = append(term.Closers, r)

+	p.Stdout = w

+

+	//setup stderr

+	r, w, err = os.Pipe()

+	if err != nil {

+		return err

+	}

+	fds = append(fds, int(r.Fd()), int(w.Fd()))

+	if pipes.Stderr != nil {

+		go io.Copy(pipes.Stderr, r)

+	}

+	term.Closers = append(term.Closers, r)

+	p.Stderr = w

+

+	//setup stdin

+	r, w, err = os.Pipe()

+	if err != nil {

+		return err

+	}

+	fds = append(fds, int(r.Fd()), int(w.Fd()))

+	if pipes.Stdin != nil {

+		go func() {

+			io.Copy(w, pipes.Stdin)

+			w.Close()

+		}()

+		p.Stdin = r

+	}

+	for _, fd := range fds {

+		if err := syscall.Fchown(fd, rootuid, rootuid); err != nil {

+			return fmt.Errorf("Failed to chown pipes fd: %v", err)

+		}

+	}

 	return nil

 }

@@ -26,11 +26,18 @@ func (d *Driver) Exec(c *execdriver.Command, processConfig *execdriver.ProcessCo

 		return -1, fmt.Errorf("No active container exists with ID %s", c.ID)

 	}

+	user := processConfig.User

+	if c.RemappedRoot.UID != 0 && user == "" {

+		//if user namespaces are enabled, set user explicitly so uid/gid is set to 0

+		//otherwise we end up with the overflow id and no permissions (65534)

+		user = "0"

+	}

+

 	p := &libcontainer.Process{

 		Args: append([]string{processConfig.Entrypoint}, processConfig.Arguments...),

 		Env:  c.ProcessConfig.Env,

 		Cwd:  c.WorkingDir,

-		User: processConfig.User,

+		User: user,

 	}

 	if processConfig.Privileged {

@@ -34,6 +34,7 @@ func New() *configs.Config {

 			{Type: "NEWIPC"},

 			{Type: "NEWPID"},

 			{Type: "NEWNET"},

+			{Type: "NEWUSER"},

 		}),

 		Cgroups: &configs.Cgroup{

 			Parent:           "docker",

@@ -7,6 +7,8 @@ import (

 // StdConsole defines standard console operations for execdriver

 type StdConsole struct {

+	// Closers holds io.Closer references for closing at terminal close time

+	Closers []io.Closer

 }

 // NewStdConsole returns a new StdConsole struct

@@ -46,6 +48,8 @@ func (s *StdConsole) Resize(h, w int) error {

 // Close implements Close method of Terminal interface

 func (s *StdConsole) Close() error {

-	// nothing to close here

+	for _, c := range s.Closers {

+		c.Close()

+	}

 	return nil

 }

@@ -34,12 +34,15 @@ import (

 	"syscall"

 	"github.com/Sirupsen/logrus"

+

 	"github.com/docker/docker/daemon/graphdriver"

 	"github.com/docker/docker/pkg/archive"

 	"github.com/docker/docker/pkg/chrootarchive"

 	"github.com/docker/docker/pkg/directory"

+	"github.com/docker/docker/pkg/idtools"

 	mountpk "github.com/docker/docker/pkg/mount"

 	"github.com/docker/docker/pkg/stringid"

+

 	"github.com/opencontainers/runc/libcontainer/label"

 )

@@ -71,13 +74,15 @@ type data struct {

 // active maps mount id to the count

 type Driver struct {

 	root       string

+	uidMaps    []idtools.IDMap

+	gidMaps    []idtools.IDMap

 	sync.Mutex // Protects concurrent modification to active

 	active     map[string]*data

 }

 // Init returns a new AUFS driver.

 // An error is returned if AUFS is not supported.

-func Init(root string, options []string) (graphdriver.Driver, error) {

+func Init(root string, options []string, uidMaps, gidMaps []idtools.IDMap) (graphdriver.Driver, error) {

 	// Try to load the aufs kernel module

 	if err := supportsAufs(); err != nil {

@@ -105,12 +110,23 @@ func Init(root string, options []string) (graphdriver.Driver, error) {

 	}

 	a := &Driver{

-		root:   root,

-		active: make(map[string]*data),

+		root:    root,

+		active:  make(map[string]*data),

+		uidMaps: uidMaps,

+		gidMaps: gidMaps,

 	}

-	// Create the root aufs driver dir

-	if err := os.MkdirAll(root, 0755); err != nil {

+	rootUID, rootGID, err := idtools.GetRootUIDGID(uidMaps, gidMaps)

+	if err != nil {

+		return nil, err

+	}

+	// Create the root aufs driver dir and return

+	// if it already exists

+	// If not populate the dir structure

+	if err := idtools.MkdirAllAs(root, 0755, rootUID, rootGID); err != nil {

+		if os.IsExist(err) {

+			return a, nil

+		}

 		return nil, err

 	}

@@ -120,7 +136,7 @@ func Init(root string, options []string) (graphdriver.Driver, error) {

 	// Populate the dir structure

 	for _, p := range paths {

-		if err := os.MkdirAll(path.Join(root, p), 0755); err != nil {

+		if err := idtools.MkdirAllAs(path.Join(root, p), 0755, rootUID, rootGID); err != nil {

 			return nil, err

 		}

 	}

@@ -221,8 +237,12 @@ func (a *Driver) createDirsFor(id string) error {

 		"diff",

 	}

+	rootUID, rootGID, err := idtools.GetRootUIDGID(a.uidMaps, a.gidMaps)

+	if err != nil {

+		return err

+	}

 	for _, p := range paths {

-		if err := os.MkdirAll(path.Join(a.rootPath(), p, id), 0755); err != nil {

+		if err := idtools.MkdirAllAs(path.Join(a.rootPath(), p, id), 0755, rootUID, rootGID); err != nil {

 			return err

 		}

 	}

@@ -334,11 +354,16 @@ func (a *Driver) Diff(id, parent string) (archive.Archive, error) {

 	return archive.TarWithOptions(path.Join(a.rootPath(), "diff", id), &archive.TarOptions{

 		Compression:     archive.Uncompressed,

 		ExcludePatterns: []string{archive.WhiteoutMetaPrefix + "*", "!" + archive.WhiteoutOpaqueDir},

+		UIDMaps:         a.uidMaps,

+		GIDMaps:         a.gidMaps,

 	})

 }

 func (a *Driver) applyDiff(id string, diff archive.Reader) error {

-	return chrootarchive.UntarUncompressed(diff, path.Join(a.rootPath(), "diff", id), nil)

+	return chrootarchive.UntarUncompressed(diff, path.Join(a.rootPath(), "diff", id), &archive.TarOptions{

+		UIDMaps: a.uidMaps,

+		GIDMaps: a.gidMaps,

+	})

 }

 // DiffSize calculates the changes between the specified id

@@ -26,7 +26,7 @@ func init() {

 }

 func testInit(dir string, t *testing.T) graphdriver.Driver {

-	d, err := Init(dir, nil)

+	d, err := Init(dir, nil, nil, nil)

 	if err != nil {

 		if err == graphdriver.ErrNotSupported {

 			t.Skip(err)

@@ -8,6 +8,8 @@ import (

 	"io/ioutil"

 	"os"

 	"path"

+

+	"github.com/docker/docker/pkg/idtools"

 )

 type metadata struct {

@@ -38,7 +40,7 @@ func pathExists(pth string) bool {

 // For the migration we try to move the folder containing the layer files, if that

 // fails because the data is currently mounted we will fallback to creating a

 // symlink.

-func (a *Driver) Migrate(pth string, setupInit func(p string) error) error {

+func (a *Driver) Migrate(pth string, setupInit func(p string, rootUID, rootGID int) error) error {

 	if pathExists(path.Join(pth, "graph")) {

 		if err := a.migrateRepositories(pth); err != nil {

 			return err

@@ -59,12 +61,17 @@ func (a *Driver) migrateRepositories(pth string) error {

 	return nil

 }

-func (a *Driver) migrateContainers(pth string, setupInit func(p string) error) error {

+func (a *Driver) migrateContainers(pth string, setupInit func(p string, rootUID, rootGID int) error) error {

 	fis, err := ioutil.ReadDir(pth)

 	if err != nil {

 		return err

 	}