Re-think integration vendoring

- remove docker/docker from  Traefik vendor (unused)
- use `ignore` for all Traefik vendor in integration glide.
- defined only integration specific version of the dependencies.

integration/vendor/github.com/opencontainers/runc/restore.go

@@ -5,18 +5,25 @@ package main
 import (
 	"fmt"
 	"os"
-	"path/filepath"
+	"syscall"
 
 	"github.com/Sirupsen/logrus"
-	"github.com/codegangsta/cli"
 	"github.com/opencontainers/runc/libcontainer"
 	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/specs"
+	"github.com/opencontainers/runc/libcontainer/specconv"
+	"github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/urfave/cli"
 )
 
 var restoreCommand = cli.Command{
 	Name:  "restore",
 	Usage: "restore a container from a previous checkpoint",
+	ArgsUsage: `<container-id>
+
+Where "<container-id>" is the name for the instance of the container to be
+restored.`,
+	Description: `Restores the saved state of the container instance that was previously saved
+using the runc checkpoint command.`,
 	Flags: []cli.Flag{
 		cli.StringFlag{
 			Name:  "image-path",
@@ -47,50 +54,92 @@ var restoreCommand = cli.Command{
 		cli.StringFlag{
 			Name:  "manage-cgroups-mode",
 			Value: "",
-			Usage: "cgroups mode: 'soft' (default), 'full' and 'strict'.",
+			Usage: "cgroups mode: 'soft' (default), 'full' and 'strict'",
 		},
 		cli.StringFlag{
 			Name:  "bundle, b",
 			Value: "",
 			Usage: "path to the root of the bundle directory",
 		},
+		cli.BoolFlag{
+			Name:  "detach,d",
+			Usage: "detach from the container's process",
+		},
+		cli.StringFlag{
+			Name:  "pid-file",
+			Value: "",
+			Usage: "specify the file to write the process id to",
+		},
+		cli.BoolFlag{
+			Name:  "no-subreaper",
+			Usage: "disable the use of the subreaper used to reap reparented processes",
+		},
+		cli.BoolFlag{
+			Name:  "no-pivot",
+			Usage: "do not use pivot root to jail process inside rootfs.  This should be used whenever the rootfs is on top of a ramdisk",
+		},
+		cli.StringSliceFlag{
+			Name:  "empty-ns",
+			Usage: "create a namespace, but don't restore its properties",
+		},
 	},
-	Action: func(context *cli.Context) {
+	Action: func(context *cli.Context) error {
+		if err := checkArgs(context, 1, exactArgs); err != nil {
+			return err
+		}
+		// XXX: Currently this is untested with rootless containers.
+		if isRootless() {
+			return fmt.Errorf("runc restore requires root")
+		}
+
 		imagePath := context.String("image-path")
+		id := context.Args().First()
+		if id == "" {
+			return errEmptyID
+		}
 		if imagePath == "" {
 			imagePath = getDefaultImagePath(context)
 		}
 		bundle := context.String("bundle")
 		if bundle != "" {
 			if err := os.Chdir(bundle); err != nil {
-				fatal(err)
+				return err
 			}
 		}
-		spec, rspec, err := loadSpec(specConfig, runtimeConfig)
+		spec, err := loadSpec(specConfig)
 		if err != nil {
-			fatal(err)
+			return err
 		}
-		config, err := createLibcontainerConfig(context.GlobalString("id"), spec, rspec)
+		config, err := specconv.CreateLibcontainerConfig(&specconv.CreateOpts{
+			CgroupName:       id,
+			UseSystemdCgroup: context.GlobalBool("systemd-cgroup"),
+			NoPivotRoot:      context.Bool("no-pivot"),
+			Spec:             spec,
+		})
 		if err != nil {
-			fatal(err)
+			return err
 		}
 		status, err := restoreContainer(context, spec, config, imagePath)
-		if err != nil {
-			fatal(err)
+		if err == nil {
+			os.Exit(status)
 		}
-		os.Exit(status)
+		return err
 	},
 }
 
-func restoreContainer(context *cli.Context, spec *specs.LinuxSpec, config *configs.Config, imagePath string) (code int, err error) {
-	rootuid := 0
+func restoreContainer(context *cli.Context, spec *specs.Spec, config *configs.Config, imagePath string) (int, error) {
+	var (
+		rootuid = 0
+		rootgid = 0
+		id      = context.Args().First()
+	)
 	factory, err := loadFactory(context)
 	if err != nil {
 		return -1, err
 	}
-	container, err := factory.Load(context.GlobalString("id"))
+	container, err := factory.Load(id)
 	if err != nil {
-		container, err = factory.Create(context.GlobalString("id"), config)
+		container, err = factory.Create(id, config)
 		if err != nil {
 			return -1, err
 		}
@@ -102,51 +151,50 @@ func restoreContainer(context *cli.Context, spec *specs.LinuxSpec, config *confi
 		logrus.Error(err)
 	}
 	if status == libcontainer.Running {
-		fatal(fmt.Errorf("Container with id %s already running", context.GlobalString("id")))
+		fatalf("Container with id %s already running", id)
 	}
 
 	setManageCgroupsMode(context, options)
 
+	if err = setEmptyNsMask(context, options); err != nil {
+		return -1, err
+	}
+
 	// ensure that the container is always removed if we were the process
 	// that created it.
-	defer func() {
-		if err != nil {
-			return
-		}
-		status, err := container.Status()
-		if err != nil {
-			logrus.Error(err)
-		}
-		if status != libcontainer.Checkpointed {
-			if err := container.Destroy(); err != nil {
-				logrus.Error(err)
-			}
-			if err := os.RemoveAll(options.ImagesDirectory); err != nil {
-				logrus.Error(err)
-			}
-		}
-	}()
+	detach := context.Bool("detach")
+	if !detach {
+		defer destroy(container)
+	}
 	process := &libcontainer.Process{}
-	tty, err := newTty(spec.Process.Terminal, process, rootuid)
+	tty, err := setupIO(process, rootuid, rootgid, false, detach, "")
 	if err != nil {
 		return -1, err
 	}
-	handler := newSignalHandler(tty)
-	defer handler.Close()
+
+	notifySocket := newNotifySocket(context, os.Getenv("NOTIFY_SOCKET"), id)
+	if notifySocket != nil {
+		notifySocket.setupSpec(context, spec)
+		notifySocket.setupSocket()
+	}
+
+	handler := newSignalHandler(!context.Bool("no-subreaper"), notifySocket)
 	if err := container.Restore(process, options); err != nil {
-		cstatus, cerr := container.Status()
-		if cerr != nil {
-			logrus.Error(cerr)
-		}
-		if cstatus == libcontainer.Destroyed {
-			dest := filepath.Join(context.GlobalString("root"), context.GlobalString("id"))
-			if errVal := os.RemoveAll(dest); errVal != nil {
-				logrus.Error(errVal)
-			}
-		}
 		return -1, err
 	}
-	return handler.forward(process)
+	// We don't need to do a tty.recvtty because config.Terminal is always false.
+	defer tty.Close()
+	if err := tty.ClosePostStart(); err != nil {
+		return -1, err
+	}
+	if pidFile := context.String("pid-file"); pidFile != "" {
+		if err := createPidFile(pidFile, process); err != nil {
+			_ = process.Signal(syscall.SIGKILL)
+			_, _ = process.Wait()
+			return -1, err
+		}
+	}
+	return handler.forward(process, tty, detach)
 }
 
 func criuOptions(context *cli.Context) *libcontainer.CriuOpts {
@@ -157,10 +205,12 @@ func criuOptions(context *cli.Context) *libcontainer.CriuOpts {
 	return &libcontainer.CriuOpts{
 		ImagesDirectory:         imagePath,
 		WorkDirectory:           context.String("work-path"),
+		ParentImage:             context.String("parent-path"),
 		LeaveRunning:            context.Bool("leave-running"),
 		TcpEstablished:          context.Bool("tcp-established"),
 		ExternalUnixConnections: context.Bool("ext-unix-sk"),
 		ShellJob:                context.Bool("shell-job"),
 		FileLocks:               context.Bool("file-locks"),
+		PreDump:                 context.Bool("pre-dump"),
 	}
 }