@@ -14,6 +14,8 @@ import (

 	"syscall"

 	"time"

+	"github.com/docker/libcontainer"

+	"github.com/docker/libcontainer/configs"

 	"github.com/docker/libcontainer/devices"

 	"github.com/docker/libcontainer/label"

@@ -259,18 +261,18 @@ func populateCommand(c *Container, env []string) error {

 	pid.HostPid = c.hostConfig.PidMode.IsHost()

 	// Build lists of devices allowed and created within the container.

-	userSpecifiedDevices := make([]*devices.Device, len(c.hostConfig.Devices))

+	userSpecifiedDevices := make([]*configs.Device, len(c.hostConfig.Devices))

 	for i, deviceMapping := range c.hostConfig.Devices {

-		device, err := devices.GetDevice(deviceMapping.PathOnHost, deviceMapping.CgroupPermissions)

+		device, err := devices.DeviceFromPath(deviceMapping.PathOnHost, deviceMapping.CgroupPermissions)

 		if err != nil {

 			return fmt.Errorf("error gathering device information while adding custom device %q: %s", deviceMapping.PathOnHost, err)

 		}

 		device.Path = deviceMapping.PathInContainer

 		userSpecifiedDevices[i] = device

 	}

-	allowedDevices := append(devices.DefaultAllowedDevices, userSpecifiedDevices...)

+	allowedDevices := append(configs.DefaultAllowedDevices, userSpecifiedDevices...)

-	autoCreatedDevices := append(devices.DefaultAutoCreatedDevices, userSpecifiedDevices...)

+	autoCreatedDevices := append(configs.DefaultAutoCreatedDevices, userSpecifiedDevices...)

 	// TODO: this can be removed after lxc-conf is fully deprecated

 	lxcConfig, err := mergeLxcConfIntoOptions(c.hostConfig)

@@ -972,7 +974,7 @@ func (container *Container) Exposes(p nat.Port) bool {

 	return exists

 }

-func (container *Container) GetPtyMaster() (*os.File, error) {

+func (container *Container) GetPtyMaster() (libcontainer.Console, error) {

 	ttyConsole, ok := container.command.ProcessConfig.Terminal.(execdriver.TtyTerminal)

 	if !ok {

 		return nil, ErrNoTTY

@@ -1,17 +1,22 @@

 package execdriver

 import (

+	"encoding/json"

 	"errors"

 	"io"

+	"io/ioutil"

 	"os"

 	"os/exec"

+	"path/filepath"

+	"strconv"

 	"strings"

 	"time"

 	"github.com/docker/docker/daemon/execdriver/native/template"

 	"github.com/docker/docker/pkg/ulimit"

 	"github.com/docker/libcontainer"

-	"github.com/docker/libcontainer/devices"

+	"github.com/docker/libcontainer/cgroups/fs"

+	"github.com/docker/libcontainer/configs"

 )

 // Context is a generic key value pair that allows

@@ -42,7 +47,7 @@ type Terminal interface {

 }

 type TtyTerminal interface {

-	Master() *os.File

+	Master() libcontainer.Console

 }

 // ExitStatus provides exit reasons for a container.

@@ -109,7 +114,7 @@ type Resources struct {

 }

 type ResourceStats struct {

-	*libcontainer.ContainerStats

+	*libcontainer.Stats

 	Read        time.Time `json:"read"`

 	MemoryLimit int64     `json:"memory_limit"`

 	SystemUsage uint64    `json:"system_usage"`

@@ -149,8 +154,8 @@ type Command struct {

 	Pid                *Pid              `json:"pid"`

 	Resources          *Resources        `json:"resources"`

 	Mounts             []Mount           `json:"mounts"`

-	AllowedDevices     []*devices.Device `json:"allowed_devices"`

-	AutoCreatedDevices []*devices.Device `json:"autocreated_devices"`

+	AllowedDevices     []*configs.Device `json:"allowed_devices"`

+	AutoCreatedDevices []*configs.Device `json:"autocreated_devices"`

 	CapAdd             []string          `json:"cap_add"`

 	CapDrop            []string          `json:"cap_drop"`

 	ContainerPid       int               `json:"container_pid"`  // the pid for the process inside a container

@@ -161,23 +166,19 @@ type Command struct {

 	AppArmorProfile    string            `json:"apparmor_profile"`

 }

-func InitContainer(c *Command) *libcontainer.Config {

+func InitContainer(c *Command) *configs.Config {

 	container := template.New()

 	container.Hostname = getEnv("HOSTNAME", c.ProcessConfig.Env)

-	container.Tty = c.ProcessConfig.Tty

-	container.User = c.ProcessConfig.User

-	container.WorkingDir = c.WorkingDir

-	container.Env = c.ProcessConfig.Env

 	container.Cgroups.Name = c.ID

 	container.Cgroups.AllowedDevices = c.AllowedDevices

-	container.MountConfig.DeviceNodes = c.AutoCreatedDevices

-	container.RootFs = c.Rootfs

-	container.MountConfig.ReadonlyFs = c.ReadonlyRootfs

+	container.Readonlyfs = c.ReadonlyRootfs

+	container.Devices = c.AutoCreatedDevices

+	container.Rootfs = c.Rootfs

+	container.Readonlyfs = c.ReadonlyRootfs

 	// check to see if we are running in ramdisk to disable pivot root

-	container.MountConfig.NoPivotRoot = os.Getenv("DOCKER_RAMDISK") != ""

-	container.RestrictSys = true

+	container.NoPivotRoot = os.Getenv("DOCKER_RAMDISK") != ""

 	return container

 }

@@ -191,7 +192,7 @@ func getEnv(key string, env []string) string {

 	return ""

 }

-func SetupCgroups(container *libcontainer.Config, c *Command) error {

+func SetupCgroups(container *configs.Config, c *Command) error {

 	if c.Resources != nil {

 		container.Cgroups.CpuShares = c.Resources.CpuShares

 		container.Cgroups.Memory = c.Resources.Memory

@@ -203,28 +204,98 @@ func SetupCgroups(container *libcontainer.Config, c *Command) error {

 	return nil

 }

-func Stats(stateFile string, containerMemoryLimit int64, machineMemory int64) (*ResourceStats, error) {

-	state, err := libcontainer.GetState(stateFile)

-	if err != nil {

-		if os.IsNotExist(err) {

-			return nil, ErrNotRunning

+// Returns the network statistics for the network interfaces represented by the NetworkRuntimeInfo.

+func getNetworkInterfaceStats(interfaceName string) (*libcontainer.NetworkInterface, error) {

+	out := &libcontainer.NetworkInterface{Name: interfaceName}

+	// This can happen if the network runtime information is missing - possible if the

+	// container was created by an old version of libcontainer.

+	if interfaceName == "" {

+		return out, nil

+	}

+	type netStatsPair struct {

+		// Where to write the output.

+		Out *uint64

+		// The network stats file to read.

+		File string

+	}

+	// Ingress for host veth is from the container. Hence tx_bytes stat on the host veth is actually number of bytes received by the container.

+	netStats := []netStatsPair{

+		{Out: &out.RxBytes, File: "tx_bytes"},

+		{Out: &out.RxPackets, File: "tx_packets"},

+		{Out: &out.RxErrors, File: "tx_errors"},

+		{Out: &out.RxDropped, File: "tx_dropped"},

+

+		{Out: &out.TxBytes, File: "rx_bytes"},

+		{Out: &out.TxPackets, File: "rx_packets"},

+		{Out: &out.TxErrors, File: "rx_errors"},

+		{Out: &out.TxDropped, File: "rx_dropped"},

+	}

+	for _, netStat := range netStats {

+		data, err := readSysfsNetworkStats(interfaceName, netStat.File)

+		if err != nil {

+			return nil, err

 		}

+		*(netStat.Out) = data

+	}

+	return out, nil

+}

+

+// Reads the specified statistics available under /sys/class/net/<EthInterface>/statistics

+func readSysfsNetworkStats(ethInterface, statsFile string) (uint64, error) {

+	data, err := ioutil.ReadFile(filepath.Join("/sys/class/net", ethInterface, "statistics", statsFile))

+	if err != nil {

+		return 0, err

+	}

+	return strconv.ParseUint(strings.TrimSpace(string(data)), 10, 64)

+}

+

+func Stats(containerDir string, containerMemoryLimit int64, machineMemory int64) (*ResourceStats, error) {

+	f, err := os.Open(filepath.Join(containerDir, "state.json"))

+	if err != nil {

+		return nil, err

+	}

+	defer f.Close()

+

+	type network struct {

+		Type              string

+		HostInterfaceName string

+	}

+

+	state := struct {

+		CgroupPaths map[string]string `json:"cgroup_paths"`

+		Networks    []network

+	}{}

+

+	if err := json.NewDecoder(f).Decode(&state); err != nil {

 		return nil, err

 	}

 	now := time.Now()

-	stats, err := libcontainer.GetStats(nil, state)

+

+	mgr := fs.Manager{Paths: state.CgroupPaths}

+	cstats, err := mgr.GetStats()

 	if err != nil {

 		return nil, err

 	}

+	stats := &libcontainer.Stats{CgroupStats: cstats}

 	// if the container does not have any memory limit specified set the

 	// limit to the machines memory

 	memoryLimit := containerMemoryLimit

 	if memoryLimit == 0 {

 		memoryLimit = machineMemory

 	}

+	for _, iface := range state.Networks {

+		switch iface.Type {

+		case "veth":

+			istats, err := getNetworkInterfaceStats(iface.HostInterfaceName)

+			if err != nil {

+				return nil, err

+			}

+			stats.Interfaces = append(stats.Interfaces, istats)

+		}

+	}

 	return &ResourceStats{

-		Read:           now,

-		ContainerStats: stats,

-		MemoryLimit:    memoryLimit,

+		Stats:       stats,

+		Read:        now,

+		MemoryLimit: memoryLimit,

 	}, nil

 }

@@ -23,7 +23,9 @@ import (

 	"github.com/docker/docker/utils"

 	"github.com/docker/libcontainer"

 	"github.com/docker/libcontainer/cgroups"

-	"github.com/docker/libcontainer/mount/nodes"

+	"github.com/docker/libcontainer/configs"

+	"github.com/docker/libcontainer/system"

+	"github.com/docker/libcontainer/user"

 	"github.com/kr/pty"

 )

@@ -42,7 +44,7 @@ type driver struct {

 }

 type activeContainer struct {

-	container *libcontainer.Config

+	container *configs.Config

 	cmd       *exec.Cmd

 }

@@ -190,7 +192,7 @@ func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba

 	c.ProcessConfig.Path = aname

 	c.ProcessConfig.Args = append([]string{name}, arg...)

-	if err := nodes.CreateDeviceNodes(c.Rootfs, c.AutoCreatedDevices); err != nil {

+	if err := createDeviceNodes(c.Rootfs, c.AutoCreatedDevices); err != nil {

 		return execdriver.ExitStatus{ExitCode: -1}, err

 	}

@@ -231,11 +233,17 @@ func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba

 	}

 	state := &libcontainer.State{

-		InitPid:     pid,

-		CgroupPaths: cgroupPaths,

+		InitProcessPid: pid,

+		CgroupPaths:    cgroupPaths,

 	}

-	if err := libcontainer.SaveState(dataPath, state); err != nil {

+	f, err := os.Create(filepath.Join(dataPath, "state.json"))

+	if err != nil {

+		return terminate(err)

+	}

+	defer f.Close()

+

+	if err := json.NewEncoder(f).Encode(state); err != nil {

 		return terminate(err)

 	}

@@ -245,8 +253,9 @@ func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba

 		log.Debugf("Invoking startCallback")

 		startCallback(&c.ProcessConfig, pid)

 	}

+

 	oomKill := false

-	oomKillNotification, err := libcontainer.NotifyOnOOM(state)

+	oomKillNotification, err := notifyOnOOM(cgroupPaths)

 	if err == nil {

 		_, oomKill = <-oomKillNotification

 		log.Debugf("oomKill error %s waitErr %s", oomKill, waitErr)

@@ -265,9 +274,57 @@ func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba

 	return execdriver.ExitStatus{ExitCode: exitCode, OOMKilled: oomKill}, waitErr

 }

+// copy from libcontainer

+func notifyOnOOM(paths map[string]string) (<-chan struct{}, error) {

+	dir := paths["memory"]

+	if dir == "" {

+		return nil, fmt.Errorf("There is no path for %q in state", "memory")

+	}

+	oomControl, err := os.Open(filepath.Join(dir, "memory.oom_control"))

+	if err != nil {

+		return nil, err

+	}

+	fd, _, syserr := syscall.RawSyscall(syscall.SYS_EVENTFD2, 0, syscall.FD_CLOEXEC, 0)

+	if syserr != 0 {

+		oomControl.Close()

+		return nil, syserr

+	}

+

+	eventfd := os.NewFile(fd, "eventfd")

+

+	eventControlPath := filepath.Join(dir, "cgroup.event_control")

+	data := fmt.Sprintf("%d %d", eventfd.Fd(), oomControl.Fd())

+	if err := ioutil.WriteFile(eventControlPath, []byte(data), 0700); err != nil {

+		eventfd.Close()

+		oomControl.Close()

+		return nil, err

+	}

+	ch := make(chan struct{})

+	go func() {

+		defer func() {

+			close(ch)

+			eventfd.Close()

+			oomControl.Close()

+		}()

+		buf := make([]byte, 8)

+		for {

+			if _, err := eventfd.Read(buf); err != nil {

+				return

+			}

+			// When a cgroup is destroyed, an event is sent to eventfd.

+			// So if the control path is gone, return instead of notifying.

+			if _, err := os.Lstat(eventControlPath); os.IsNotExist(err) {

+				return

+			}

+			ch <- struct{}{}

+		}

+	}()

+	return ch, nil

+}

+

 // createContainer populates and configures the container type with the

 // data provided by the execdriver.Command

-func (d *driver) createContainer(c *execdriver.Command) (*libcontainer.Config, error) {

+func (d *driver) createContainer(c *execdriver.Command) (*configs.Config, error) {

 	container := execdriver.InitContainer(c)

 	if err := execdriver.SetupCgroups(container, c); err != nil {

 		return nil, err

@@ -297,6 +354,87 @@ func cgroupPaths(containerId string) (map[string]string, error) {

 	return paths, nil

 }

+// this is copy from old libcontainer nodes.go

+func createDeviceNodes(rootfs string, nodesToCreate []*configs.Device) error {

+	oldMask := syscall.Umask(0000)

+	defer syscall.Umask(oldMask)

+

+	for _, node := range nodesToCreate {

+		if err := createDeviceNode(rootfs, node); err != nil {

+			return err

+		}

+	}

+	return nil

+}

+

+// Creates the device node in the rootfs of the container.

+func createDeviceNode(rootfs string, node *configs.Device) error {

+	var (

+		dest   = filepath.Join(rootfs, node.Path)

+		parent = filepath.Dir(dest)

+	)

+

+	if err := os.MkdirAll(parent, 0755); err != nil {

+		return err

+	}

+

+	fileMode := node.FileMode

+	switch node.Type {

+	case 'c':

+		fileMode |= syscall.S_IFCHR

+	case 'b':

+		fileMode |= syscall.S_IFBLK

+	default:

+		return fmt.Errorf("%c is not a valid device type for device %s", node.Type, node.Path)

+	}

+

+	if err := syscall.Mknod(dest, uint32(fileMode), node.Mkdev()); err != nil && !os.IsExist(err) {

+		return fmt.Errorf("mknod %s %s", node.Path, err)

+	}

+

+	if err := syscall.Chown(dest, int(node.Uid), int(node.Gid)); err != nil {

+		return fmt.Errorf("chown %s to %d:%d", node.Path, node.Uid, node.Gid)

+	}

+

+	return nil

+}

+

+// setupUser changes the groups, gid, and uid for the user inside the container

+// copy from libcontainer, cause not it's private

+func setupUser(userSpec string) error {

+	// Set up defaults.

+	defaultExecUser := user.ExecUser{

+		Uid:  syscall.Getuid(),

+		Gid:  syscall.Getgid(),

+		Home: "/",

+	}

+	passwdPath, err := user.GetPasswdPath()

+	if err != nil {

+		return err

+	}

+	groupPath, err := user.GetGroupPath()

+	if err != nil {

+		return err

+	}

+	execUser, err := user.GetExecUserPath(userSpec, &defaultExecUser, passwdPath, groupPath)

+	if err != nil {

+		return err

+	}

+	if err := system.Setgid(execUser.Gid); err != nil {

+		return err

+	}

+	if err := system.Setuid(execUser.Uid); err != nil {

+		return err

+	}

+	// if we didn't get HOME already, set it based on the user's HOME

+	if envHome := os.Getenv("HOME"); envHome == "" {

+		if err := os.Setenv("HOME", execUser.Home); err != nil {

+			return err

+		}

+	}

+	return nil

+}

+

 /// Return the exit code of the process

 // if the process has not exited -1 will be returned

 func getExitCode(c *execdriver.Command) int {

@@ -3,8 +3,6 @@ package lxc

 import (

 	"fmt"

-	"github.com/docker/libcontainer"

-	"github.com/docker/libcontainer/namespaces"

 	"github.com/docker/libcontainer/utils"

 )

@@ -12,9 +10,7 @@ func finalizeNamespace(args *InitArgs) error {

 	if err := utils.CloseExecFrom(3); err != nil {

 		return err

 	}

-	if err := namespaces.SetupUser(&libcontainer.Config{

-		User: args.User,

-	}); err != nil {

+	if err := setupUser(args.User); err != nil {

 		return fmt.Errorf("setup user %s", err)

 	}

 	if err := setupWorkingDirectory(args); err != nil {

@@ -11,7 +11,6 @@ import (

 	nativeTemplate "github.com/docker/docker/daemon/execdriver/native/template"

 	"github.com/docker/docker/utils"

 	"github.com/docker/libcontainer/label"

-	"github.com/docker/libcontainer/security/capabilities"

 )

 const LxcTemplate = `

@@ -169,7 +168,7 @@ func keepCapabilities(adds []string, drops []string) ([]string, error) {

 	var newCaps []string

 	for _, cap := range caps {

 		log.Debugf("cap %s\n", cap)

-		realCap := capabilities.GetCapability(cap)

+		realCap := execdriver.GetCapability(cap)

 		numCap := fmt.Sprintf("%d", realCap.Value)

 		newCaps = append(newCaps, numCap)

 	}

@@ -180,13 +179,10 @@ func keepCapabilities(adds []string, drops []string) ([]string, error) {

 func dropList(drops []string) ([]string, error) {

 	if utils.StringsContainsNoCase(drops, "all") {

 		var newCaps []string

-		for _, cap := range capabilities.GetAllCapabilities() {

-			log.Debugf("drop cap %s\n", cap)

-			realCap := capabilities.GetCapability(cap)

-			if realCap == nil {

-				return nil, fmt.Errorf("Invalid capability '%s'", cap)

-			}

-			numCap := fmt.Sprintf("%d", realCap.Value)

+		for _, capName := range execdriver.GetAllCapabilities() {

+			cap := execdriver.GetCapability(capName)

+			log.Debugf("drop cap %s\n", cap.Key)

+			numCap := fmt.Sprintf("%d", cap.Value)

 			newCaps = append(newCaps, numCap)

 		}

 		return newCaps, nil

@@ -5,11 +5,6 @@ package lxc

 import (

 	"bufio"

 	"fmt"

-	"github.com/docker/docker/daemon/execdriver"

-	nativeTemplate "github.com/docker/docker/daemon/execdriver/native/template"

-	"github.com/docker/libcontainer/devices"

-	"github.com/docker/libcontainer/security/capabilities"

-	"github.com/syndtr/gocapability/capability"

 	"io/ioutil"

 	"math/rand"

 	"os"

@@ -17,6 +12,11 @@ import (

 	"strings"

 	"testing"

 	"time"

+

+	"github.com/docker/docker/daemon/execdriver"

+	nativeTemplate "github.com/docker/docker/daemon/execdriver/native/template"

+	"github.com/docker/libcontainer/configs"

+	"github.com/syndtr/gocapability/capability"

 )

 func TestLXCConfig(t *testing.T) {

@@ -53,7 +53,7 @@ func TestLXCConfig(t *testing.T) {

 			Mtu:       1500,

 			Interface: nil,

 		},

-		AllowedDevices: make([]*devices.Device, 0),

+		AllowedDevices: make([]*configs.Device, 0),

 		ProcessConfig:  execdriver.ProcessConfig{},

 	}

 	p, err := driver.generateLXCConfig(command)

@@ -295,7 +295,7 @@ func TestCustomLxcConfigMisc(t *testing.T) {

 	grepFile(t, p, "lxc.cgroup.cpuset.cpus = 0,1")

 	container := nativeTemplate.New()

 	for _, cap := range container.Capabilities {

-		realCap := capabilities.GetCapability(cap)

+		realCap := execdriver.GetCapability(cap)

 		numCap := fmt.Sprintf("%d", realCap.Value)

 		if cap != "MKNOD" && cap != "KILL" {

 			grepFile(t, p, fmt.Sprintf("lxc.cap.keep = %s", numCap))

@@ -359,7 +359,7 @@ func TestCustomLxcConfigMiscOverride(t *testing.T) {

 	grepFile(t, p, "lxc.cgroup.cpuset.cpus = 0,1")

 	container := nativeTemplate.New()

 	for _, cap := range container.Capabilities {

-		realCap := capabilities.GetCapability(cap)

+		realCap := execdriver.GetCapability(cap)

 		numCap := fmt.Sprintf("%d", realCap.Value)

 		if cap != "MKNOD" && cap != "KILL" {

 			grepFile(t, p, fmt.Sprintf("lxc.cap.keep = %s", numCap))

@@ -3,21 +3,24 @@

 package native

 import (

+	"errors"

 	"fmt"

-	"os/exec"

+	"net"

 	"path/filepath"

+	"strings"

+	"syscall"

 	"github.com/docker/docker/daemon/execdriver"

-	"github.com/docker/libcontainer"

+	"github.com/docker/docker/pkg/symlink"

 	"github.com/docker/libcontainer/apparmor"

+	"github.com/docker/libcontainer/configs"

 	"github.com/docker/libcontainer/devices"

-	"github.com/docker/libcontainer/mount"

-	"github.com/docker/libcontainer/security/capabilities"

+	"github.com/docker/libcontainer/utils"

 )

 // createContainer populates and configures the container type with the

 // data provided by the execdriver.Command

-func (d *driver) createContainer(c *execdriver.Command) (*libcontainer.Config, error) {

+func (d *driver) createContainer(c *execdriver.Command) (*configs.Config, error) {

 	container := execdriver.InitContainer(c)

 	if err := d.createIpc(container, c); err != nil {

@@ -33,6 +36,13 @@ func (d *driver) createContainer(c *execdriver.Command) (*libcontainer.Config, e

 	}

 	if c.ProcessConfig.Privileged {

+		// clear readonly for /sys

+		for i := range container.Mounts {

+			if container.Mounts[i].Destination == "/sys" {

+				container.Mounts[i].Flags &= ^syscall.MS_RDONLY

+			}

+		}

+		container.ReadonlyPaths = nil

 		if err := d.setPrivileged(container); err != nil {

 			return nil, err

 		}

@@ -57,43 +67,52 @@ func (d *driver) createContainer(c *execdriver.Command) (*libcontainer.Config, e

 	if err := d.setupLabels(container, c); err != nil {

 		return nil, err

 	}

-

 	d.setupRlimits(container, c)

+	return container, nil

+}

-	cmds := make(map[string]*exec.Cmd)

-	d.Lock()

-	for k, v := range d.activeContainers {

-		cmds[k] = v.cmd

+func generateIfaceName() (string, error) {

+	for i := 0; i < 10; i++ {

+		name, err := utils.GenerateRandomName("veth", 7)

+		if err != nil {

+			continue

+		}

+		if _, err := net.InterfaceByName(name); err != nil {

+			if strings.Contains(err.Error(), "no such") {

+				return name, nil

+			}

+			return "", err

+		}

 	}

-	d.Unlock()

-

-	return container, nil

+	return "", errors.New("Failed to find name for new interface")

 }

-func (d *driver) createNetwork(container *libcontainer.Config, c *execdriver.Command) error {

+func (d *driver) createNetwork(container *configs.Config, c *execdriver.Command) error {

 	if c.Network.HostNetworking {

-		container.Namespaces.Remove(libcontainer.NEWNET)

+		container.Namespaces.Remove(configs.NEWNET)

 		return nil

 	}

-	container.Networks = []*libcontainer.Network{

+	container.Networks = []*configs.Network{

 		{

-			Mtu:     c.Network.Mtu,

-			Address: fmt.Sprintf("%s/%d", "127.0.0.1", 0),

-			Gateway: "localhost",

-			Type:    "loopback",

+			Type: "loopback",

 		},

 	}

+	iName, err := generateIfaceName()

+	if err != nil {

+		return err

+	}

 	if c.Network.Interface != nil {

-		vethNetwork := libcontainer.Network{

-			Mtu:        c.Network.Mtu,

-			Address:    fmt.Sprintf("%s/%d", c.Network.Interface.IPAddress, c.Network.Interface.IPPrefixLen),

-			MacAddress: c.Network.Interface.MacAddress,

-			Gateway:    c.Network.Interface.Gateway,

-			Type:       "veth",

-			Bridge:     c.Network.Interface.Bridge,

-			VethPrefix: "veth",

+		vethNetwork := configs.Network{

+			Name:              "eth0",

+			HostInterfaceName: iName,

+			Mtu:               c.Network.Mtu,

+			Address:           fmt.Sprintf("%s/%d", c.Network.Interface.IPAddress, c.Network.Interface.IPPrefixLen),

+			MacAddress:        c.Network.Interface.MacAddress,

+			Gateway:           c.Network.Interface.Gateway,

+			Type:              "veth",

+			Bridge:            c.Network.Interface.Bridge,

 		}

 		if c.Network.Interface.GlobalIPv6Address != "" {

 			vethNetwork.IPv6Address = fmt.Sprintf("%s/%d", c.Network.Interface.GlobalIPv6Address, c.Network.Interface.GlobalIPv6PrefixLen)

@@ -107,21 +126,24 @@ func (d *driver) createNetwork(container *libcontainer.Config, c *execdriver.Com

 		active := d.activeContainers[c.Network.ContainerID]

 		d.Unlock()

-		if active == nil || active.cmd.Process == nil {

+		if active == nil {

 			return fmt.Errorf("%s is not a valid running container to join", c.Network.ContainerID)

 		}

-		cmd := active.cmd

-		nspath := filepath.Join("/proc", fmt.Sprint(cmd.Process.Pid), "ns", "net")

-		container.Namespaces.Add(libcontainer.NEWNET, nspath)

+		state, err := active.State()

+		if err != nil {

+			return err

+		}

+

+		container.Namespaces.Add(configs.NEWNET, state.NamespacePaths[configs.NEWNET])

 	}

 	return nil

 }

-func (d *driver) createIpc(container *libcontainer.Config, c *execdriver.Command) error {

+func (d *driver) createIpc(container *configs.Config, c *execdriver.Command) error {

 	if c.Ipc.HostIpc {

-		container.Namespaces.Remove(libcontainer.NEWIPC)

+		container.Namespaces.Remove(configs.NEWIPC)

 		return nil

 	}

@@ -130,37 +152,38 @@ func (d *driver) createIpc(container *libcontainer.Config, c *execdriver.Command

 		active := d.activeContainers[c.Ipc.ContainerID]

 		d.Unlock()

-		if active == nil || active.cmd.Process == nil {

+		if active == nil {

 			return fmt.Errorf("%s is not a valid running container to join", c.Ipc.ContainerID)

 		}

-		cmd := active.cmd

-		container.Namespaces.Add(libcontainer.NEWIPC, filepath.Join("/proc", fmt.Sprint(cmd.Process.Pid), "ns", "ipc"))

+		state, err := active.State()

+		if err != nil {

+			return err

+		}

+		container.Namespaces.Add(configs.NEWIPC, state.NamespacePaths[configs.NEWIPC])

 	}

 	return nil

 }

-func (d *driver) createPid(container *libcontainer.Config, c *execdriver.Command) error {

+func (d *driver) createPid(container *configs.Config, c *execdriver.Command) error {

 	if c.Pid.HostPid {

-		container.Namespaces.Remove(libcontainer.NEWPID)

+		container.Namespaces.Remove(configs.NEWPID)

 		return nil

 	}

 	return nil

 }

-func (d *driver) setPrivileged(container *libcontainer.Config) (err error) {

-	container.Capabilities = capabilities.GetAllCapabilities()

+func (d *driver) setPrivileged(container *configs.Config) (err error) {

+	container.Capabilities = execdriver.GetAllCapabilities()

 	container.Cgroups.AllowAllDevices = true

-	hostDeviceNodes, err := devices.GetHostDeviceNodes()

+	hostDevices, err := devices.HostDevices()

 	if err != nil {

 		return err

 	}

-	container.MountConfig.DeviceNodes = hostDeviceNodes

-

-	container.RestrictSys = false

+	container.Devices = hostDevices

 	if apparmor.IsEnabled() {

 		container.AppArmorProfile = "unconfined"

@@ -169,39 +192,52 @@ func (d *driver) setPrivileged(container *libcontainer.Config) (err error) {

 	return nil

 }

-func (d *driver) setCapabilities(container *libcontainer.Config, c *execdriver.Command) (err error) {

+func (d *driver) setCapabilities(container *configs.Config, c *execdriver.Command) (err error) {

 	container.Capabilities, err = execdriver.TweakCapabilities(container.Capabilities, c.CapAdd, c.CapDrop)

 	return err

 }

-func (d *driver) setupRlimits(container *libcontainer.Config, c *execdriver.Command) {

+func (d *driver) setupRlimits(container *configs.Config, c *execdriver.Command) {

 	if c.Resources == nil {

 		return

 	}

 	for _, rlimit := range c.Resources.Rlimits {

-		container.Rlimits = append(container.Rlimits, libcontainer.Rlimit((*rlimit)))

+		container.Rlimits = append(container.Rlimits, configs.Rlimit{

+			Type: rlimit.Type,

+			Hard: rlimit.Hard,

+			Soft: rlimit.Soft,

+		})

 	}

 }

-func (d *driver) setupMounts(container *libcontainer.Config, c *execdriver.Command) error {

+func (d *driver) setupMounts(container *configs.Config, c *execdriver.Command) error {

 	for _, m := range c.Mounts {

-		container.MountConfig.Mounts = append(container.MountConfig.Mounts, &mount.Mount{

-			Type:        "bind",

+		dest, err := symlink.FollowSymlinkInScope(filepath.Join(c.Rootfs, m.Destination), c.Rootfs)

+		if err != nil {

+			return err

+		}

+		flags := syscall.MS_BIND | syscall.MS_REC

+		if !m.Writable {

+			flags |= syscall.MS_RDONLY

+		}

+		if m.Slave {

+			flags |= syscall.MS_SLAVE

+		}

+

+		container.Mounts = append(container.Mounts, &configs.Mount{

 			Source:      m.Source,

-			Destination: m.Destination,

-			Writable:    m.Writable,

-			Private:     m.Private,

-			Slave:       m.Slave,

+			Destination: dest,

+			Device:      "bind",

+			Flags:       flags,

 		})

 	}

-

 	return nil

 }

-func (d *driver) setupLabels(container *libcontainer.Config, c *execdriver.Command) error {

+func (d *driver) setupLabels(container *configs.Config, c *execdriver.Command) error {

 	container.ProcessLabel = c.ProcessLabel

-	container.MountConfig.MountLabel = c.MountLabel

+	container.MountLabel = c.MountLabel

 	return nil

 }

@@ -4,28 +4,28 @@ package native

 import (

 	"encoding/json"

-	"errors"

 	"fmt"

 	"io"

 	"io/ioutil"

 	"os"

 	"os/exec"

 	"path/filepath"

+	"strings"

 	"sync"

 	"syscall"

+	"time"

 	log "github.com/Sirupsen/logrus"

 	"github.com/docker/docker/daemon/execdriver"

+	"github.com/docker/docker/pkg/reexec"

 	sysinfo "github.com/docker/docker/pkg/system"

 	"github.com/docker/docker/pkg/term"

 	"github.com/docker/libcontainer"

 	"github.com/docker/libcontainer/apparmor"

-	"github.com/docker/libcontainer/cgroups/fs"

 	"github.com/docker/libcontainer/cgroups/systemd"

-	consolepkg "github.com/docker/libcontainer/console"

-	"github.com/docker/libcontainer/namespaces"

-	_ "github.com/docker/libcontainer/namespaces/nsenter"

+	"github.com/docker/libcontainer/configs"

 	"github.com/docker/libcontainer/system"

+	"github.com/docker/libcontainer/utils"

 )

 const (

@@ -33,16 +33,12 @@ const (

 	Version    = "0.2"

 )

-type activeContainer struct {

-	container *libcontainer.Config

-	cmd       *exec.Cmd

-}

-

 type driver struct {

 	root             string

 	initPath         string

-	activeContainers map[string]*activeContainer

+	activeContainers map[string]libcontainer.Container

 	machineMemory    int64

+	factory          libcontainer.Factory

 	sync.Mutex

 }

@@ -59,11 +55,22 @@ func NewDriver(root, initPath string) (*driver, error) {

 	if err := apparmor.InstallDefaultProfile(); err != nil {

 		return nil, err

 	}

+	cgm := libcontainer.Cgroupfs

+	if systemd.UseSystemd() {