From 42edc7ae2cd4bf19e9a9fb0cfcdf2c166ad9ff47 Mon Sep 17 00:00:00 2001
From: Euan Kemp <euank@euank.com>
Date: Mon, 27 Feb 2017 16:54:41 -0800
Subject: [PATCH 1/9] app-emulation/docker: re-add docker-1.12 ebuild

This is to allow packaging it for skim as well.

This is an unmodified copy of the ebuild from build-1325
---
 .../app-emulation/docker/docker-1.12.6.ebuild | 328 ++++++++++++++++++
 1 file changed, 328 insertions(+)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild

diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild
new file mode 100644
index 0000000000..62eb6bc1a6
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild
@@ -0,0 +1,328 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI=5
+
+CROS_WORKON_PROJECT="coreos/docker"
+CROS_WORKON_LOCALNAME="docker"
+CROS_WORKON_REPO="git://github.com"
+COREOS_GO_VERSION="go1.6"
+
+if [[ ${PV} == *9999 ]]; then
+	DOCKER_GITCOMMIT="unknown"
+	KEYWORDS="~amd64 ~arm64"
+else
+	CROS_WORKON_COMMIT="d5236f0452873048a28c1ecd63d40513efa66542" # coreos-1.12.6
+	DOCKER_GITCOMMIT="${CROS_WORKON_COMMIT:0:7}"
+	KEYWORDS="amd64 arm64"
+fi
+
+inherit bash-completion-r1 eutils linux-info multilib systemd udev user cros-workon coreos-go-depend
+
+DESCRIPTION="Docker complements kernel namespacing with a high-level API which operates at the process level"
+HOMEPAGE="https://dockerproject.org"
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="apparmor aufs +btrfs contrib +device-mapper experimental +overlay seccomp
+	+selinux vim-syntax zsh-completion +journald"
+
+# https://github.com/docker/docker/blob/master/hack/PACKAGERS.md#build-dependencies
+CDEPEND="
+	>=dev-db/sqlite-3.7.9:3
+	device-mapper? (
+		>=sys-fs/lvm2-2.02.89[thin]
+	)
+	seccomp? (
+		>=sys-libs/libseccomp-2.2.1[static-libs]
+	)
+	journald? (
+		>=sys-apps/systemd-225
+	)
+"
+
+DEPEND="
+	${CDEPEND}
+
+	btrfs? (
+		>=sys-fs/btrfs-progs-3.16.1
+	)
+"
+
+# For CoreOS builds coreos-kernel must be installed because this ebuild
+# checks the kernel config. The kernel config is left by the kernel compile
+# or an explicit copy when installing binary packages. See coreos-kernel.eclass
+DEPEND+="sys-kernel/coreos-kernel"
+
+# https://github.com/docker/docker/blob/master/hack/PACKAGERS.md#runtime-dependencies
+# https://github.com/docker/docker/blob/master/hack/PACKAGERS.md#optional-dependencies
+RDEPEND="
+	${CDEPEND}
+
+	!app-emulation/docker-bin
+	>=net-firewall/iptables-1.4
+	sys-process/procps
+	>=dev-vcs/git-1.7
+	>=app-arch/xz-utils-4.9
+	>=sys-apps/shadow-4.4
+
+	>=app-emulation/containerd-0.2.5[seccomp?]
+	>=app-emulation/runc-1.0.0_rc2-r2[apparmor?,seccomp?]
+"
+
+RESTRICT="installsources strip"
+
+# see "contrib/check-config.sh" from upstream's sources
+CONFIG_CHECK="
+	~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
+	~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
+	~KEYS ~MACVLAN ~VETH ~BRIDGE ~BRIDGE_NETFILTER
+	~NF_NAT_IPV4 ~IP_NF_FILTER ~IP_NF_MANGLE ~IP_NF_TARGET_MASQUERADE
+	~IP_VS ~IP_VS_RR
+	~NETFILTER_XT_MATCH_ADDRTYPE ~NETFILTER_XT_MATCH_CONNTRACK
+	~NETFILTER_XT_MATCH_IPVS
+	~NETFILTER_XT_MARK ~NETFILTER_XT_TARGET_REDIRECT
+	~NF_NAT ~NF_NAT_NEEDED
+
+	~POSIX_MQUEUE
+
+	~MEMCG_SWAP ~MEMCG_SWAP_ENABLED
+
+	~BLK_CGROUP ~IOSCHED_CFQ
+	~CGROUP_PERF
+	~CGROUP_HUGETLB
+	~NET_CLS_CGROUP
+	~CFS_BANDWIDTH ~FAIR_GROUP_SCHED ~RT_GROUP_SCHED
+	~XFRM_ALGO ~XFRM_USER
+"
+
+ERROR_KEYS="CONFIG_KEYS: is mandatory"
+ERROR_MEMCG_SWAP="CONFIG_MEMCG_SWAP: is required if you wish to limit swap usage of containers"
+ERROR_RESOURCE_COUNTERS="CONFIG_RESOURCE_COUNTERS: is optional for container statistics gathering"
+
+ERROR_BLK_CGROUP="CONFIG_BLK_CGROUP: is optional for container statistics gathering"
+ERROR_IOSCHED_CFQ="CONFIG_IOSCHED_CFQ: is optional for container statistics gathering"
+ERROR_CGROUP_PERF="CONFIG_CGROUP_PERF: is optional for container statistics gathering"
+ERROR_CFS_BANDWIDTH="CONFIG_CFS_BANDWIDTH: is optional for container statistics gathering"
+ERROR_XFRM_ALGO="CONFIG_XFRM_ALGO: is optional for secure networks"
+ERROR_XFRM_USER="CONFIG_XFRM_USER: is optional for secure networks"
+
+pkg_setup() {
+	if kernel_is lt 3 10; then
+		ewarn ""
+		ewarn "Using Docker with kernels older than 3.10 is unstable and unsupported."
+		ewarn " - http://docs.docker.com/installation/binaries/#check-kernel-dependencies"
+	fi
+
+	# for where these kernel versions come from, see:
+	# https://www.google.com/search?q=945b2b2d259d1a4364a2799e80e8ff32f8c6ee6f+site%3Akernel.org%2Fpub%2Flinux%2Fkernel+file%3AChangeLog*
+	if ! {
+		kernel_is ge 3 16 \
+		|| { kernel_is 3 15 && kernel_is ge 3 15 5; } \
+		|| { kernel_is 3 14 && kernel_is ge 3 14 12; } \
+		|| { kernel_is 3 12 && kernel_is ge 3 12 25; }
+	}; then
+		ewarn ""
+		ewarn "There is a serious Docker-related kernel panic that has been fixed in 3.16+"
+		ewarn "  (and was backported to 3.15.5+, 3.14.12+, and 3.12.25+)"
+		ewarn ""
+		ewarn "See also https://github.com/docker/docker/issues/2960"
+	fi
+
+	if kernel_is le 3 18; then
+		CONFIG_CHECK+="
+			~RESOURCE_COUNTERS
+		"
+	fi
+
+	if kernel_is le 3 13; then
+		CONFIG_CHECK+="
+			~NETPRIO_CGROUP
+		"
+	else
+		CONFIG_CHECK+="
+			~CGROUP_NET_PRIO
+		"
+	fi
+
+	if kernel_is lt 4 5; then
+		CONFIG_CHECK+="
+			~MEMCG_KMEM
+		"
+		ERROR_MEMCG_KMEM="CONFIG_MEMCG_KMEM: is optional"
+	fi
+
+	if kernel_is lt 4 7; then
+		CONFIG_CHECK+="
+			~DEVPTS_MULTIPLE_INSTANCES
+		"
+	fi
+
+	if use aufs; then
+		CONFIG_CHECK+="
+			~AUFS_FS
+			~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
+		"
+		ERROR_AUFS_FS="CONFIG_AUFS_FS: is required to be set if and only if aufs-sources are used instead of aufs4/aufs3"
+	fi
+
+	if use btrfs; then
+		CONFIG_CHECK+="
+			~BTRFS_FS
+		"
+	fi
+
+	if use device-mapper; then
+		CONFIG_CHECK+="
+			~BLK_DEV_DM ~DM_THIN_PROVISIONING ~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
+		"
+	fi
+
+	if use overlay; then
+		CONFIG_CHECK+="
+			~OVERLAY_FS ~EXT4_FS_SECURITY ~EXT4_FS_POSIX_ACL
+		"
+	fi
+
+	if use seccomp; then
+		CONFIG_CHECK+="
+			~SECCOMP
+		"
+	fi
+
+	linux-info_pkg_setup
+
+	# create docker group for the code checking for it in /etc/group
+	enewgroup docker
+}
+
+src_prepare() {
+	# allow user patches (use sparingly - upstream won't support them)
+	epatch_user
+
+	# remove the .git directory so that hack/make.sh uses DOCKER_GITCOMMIT
+	# for the commit hash.
+	rm --recursive --force .git
+}
+
+src_compile() {
+	# if we treat them right, Docker's build scripts will set up a
+	# reasonable GOPATH for us
+	export AUTO_GOPATH=1
+
+	# if we're building from a zip, we need the GITCOMMIT value
+	[ "$DOCKER_GITCOMMIT" ] && export DOCKER_GITCOMMIT
+
+	if gcc-specs-pie; then
+		sed -i "s/EXTLDFLAGS_STATIC='/&-fno-PIC /" hack/make.sh || die
+		grep -q -- '-fno-PIC' hack/make.sh || die 'hardened sed failed'
+
+		sed  "s/LDFLAGS_STATIC_DOCKER='/&-extldflags -fno-PIC /" \
+			-i hack/make/dynbinary-client || die
+		sed  "s/LDFLAGS_STATIC_DOCKER='/&-extldflags -fno-PIC /" \
+			-i hack/make/dynbinary-daemon || die
+		grep -q -- '-fno-PIC' hack/make/dynbinary-daemon || die 'hardened sed failed'
+		grep -q -- '-fno-PIC' hack/make/dynbinary-client || die 'hardened sed failed'
+	fi
+
+	# let's set up some optional features :)
+	export DOCKER_BUILDTAGS=''
+	for gd in aufs btrfs device-mapper overlay; do
+		if ! use $gd; then
+			DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
+		fi
+	done
+
+	for tag in apparmor seccomp selinux journald; do
+		if use $tag; then
+			DOCKER_BUILDTAGS+=" $tag"
+		fi
+	done
+
+	if has_version '<sys-fs/lvm2-2.02.110' ; then
+		# Docker uses the host files when testing features, so force
+		# docker to not use dm_task_deferred_remove to cover cross
+		# builds.
+		DOCKER_BUILDTAGS+=' libdm_no_deferred_remove'
+	fi
+
+	# https://github.com/docker/docker/pull/13338
+	if use experimental; then
+		export DOCKER_EXPERIMENTAL=1
+	else
+		unset DOCKER_EXPERIMENTAL
+	fi
+
+	# disable optimizations due to https://github.com/golang/go/issues/14669
+	CFLAGS+=" -O0"
+
+	go_export
+
+	# verbose building
+	export BUILDFLAGS="-x -v"
+
+	# time to build!
+	./hack/make.sh dynbinary || die 'dynbinary failed'
+}
+
+src_install() {
+	VERSION="$(cat VERSION)"
+	newbin "bundles/$VERSION/dynbinary-client/docker-$VERSION" docker
+	newbin "bundles/$VERSION/dynbinary-daemon/dockerd-$VERSION" dockerd
+	newbin "bundles/$VERSION/dynbinary-daemon/docker-proxy-$VERSION" docker-proxy
+	dosym containerd /usr/bin/docker-containerd
+	dosym containerd-shim /usr/bin/docker-containerd-shim
+	dosym runc /usr/bin/docker-runc
+
+	newinitd contrib/init/openrc/docker.initd docker
+	newconfd contrib/init/openrc/docker.confd docker
+
+	exeinto /usr/lib/coreos
+	doexe "${FILESDIR}/dockerd"
+
+	systemd_dounit "${FILESDIR}/docker.service"
+	systemd_dounit "${FILESDIR}/docker.socket"
+
+	insinto /usr/lib/systemd/network
+	doins "${FILESDIR}"/50-docker.network
+	doins "${FILESDIR}"/90-docker-veth.network
+
+	udev_dorules contrib/udev/*.rules
+
+	dodoc AUTHORS CONTRIBUTING.md CHANGELOG.md NOTICE README.md
+	dodoc -r docs/*
+
+	dobashcomp contrib/completion/bash/*
+
+	if use zsh-completion; then
+		insinto /usr/share/zsh/site-functions
+		doins contrib/completion/zsh/*
+	fi
+
+	if use vim-syntax; then
+		insinto /usr/share/vim/vimfiles
+		doins -r contrib/syntax/vim/ftdetect
+		doins -r contrib/syntax/vim/syntax
+	fi
+
+	if use contrib; then
+		# note: intentionally not using "doins" so that we preserve +x bits
+		mkdir -p "${D}/usr/share/${PN}/contrib"
+		cp -R contrib/* "${D}/usr/share/${PN}/contrib"
+	fi
+}
+
+pkg_postinst() {
+	udev_reload
+
+	elog
+	elog "To use Docker, the Docker daemon must be running as root. To automatically"
+	elog "start the Docker daemon at boot, add Docker to the default runlevel:"
+	elog "  rc-update add docker default"
+	elog "Similarly for systemd:"
+	elog "  systemctl enable docker.service"
+	elog
+	elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
+	elog "  usermod -aG docker youruser"
+	elog
+}

From 79014a1dcdbed683c678a878cc0bf377633d48a7 Mon Sep 17 00:00:00 2001
From: Euan Kemp <euank@euank.com>
Date: Mon, 27 Feb 2017 16:58:14 -0800
Subject: [PATCH 2/9] app-emulation/docker: remove 9999 logic from 1.12

---
 .../app-emulation/docker/docker-1.12.6.ebuild         | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild
index 62eb6bc1a6..ed9f63f973 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild
@@ -9,14 +9,9 @@ CROS_WORKON_LOCALNAME="docker"
 CROS_WORKON_REPO="git://github.com"
 COREOS_GO_VERSION="go1.6"
 
-if [[ ${PV} == *9999 ]]; then
-	DOCKER_GITCOMMIT="unknown"
-	KEYWORDS="~amd64 ~arm64"
-else
-	CROS_WORKON_COMMIT="d5236f0452873048a28c1ecd63d40513efa66542" # coreos-1.12.6
-	DOCKER_GITCOMMIT="${CROS_WORKON_COMMIT:0:7}"
-	KEYWORDS="amd64 arm64"
-fi
+CROS_WORKON_COMMIT="d5236f0452873048a28c1ecd63d40513efa66542" # coreos-1.12.6
+DOCKER_GITCOMMIT="${CROS_WORKON_COMMIT:0:7}"
+KEYWORDS="amd64 arm64"
 
 inherit bash-completion-r1 eutils linux-info multilib systemd udev user cros-workon coreos-go-depend
 

From 8303e82b8797585cbcc03b82b7bae51888ab0c5b Mon Sep 17 00:00:00 2001
From: Euan Kemp <euank@euank.com>
Date: Mon, 27 Feb 2017 17:00:47 -0800
Subject: [PATCH 3/9] app-emulation/runc: bring back p9 for docker 1.12

---
 .../app-emulation/runc/Manifest               |  1 +
 ...nt-set-label-for-mqueue-under-userns.patch | 94 +++++++++++++++++++
 .../runc/runc-1.0.0_rc2_p9.ebuild             | 62 ++++++++++++
 3 files changed, 157 insertions(+)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0002-Dont-set-label-for-mqueue-under-userns.patch
 create mode 100644 sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p9.ebuild

diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/Manifest b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/Manifest
index f005a91786..075e3f145f 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/Manifest
@@ -1 +1,2 @@
 DIST runc-1.0.0_rc2_p133.tar.gz 560793 SHA256 11f69923a786efb82b65d9f1eec0ac665a985e631a67f3f4d466dac720efacdd SHA512 8c19a02a55108cef36cbd1ff739a3c8e2962d188c426517fce91483ec525546d39c14072f0a0f2471b6b70a05cf6c1f0e99cfeb5e87203fcbae955bd5f5bd16b WHIRLPOOL 8a1f44234c668aca5c53e401ce80e2c297ad9c7ed0b10d782494e93020f824e6d5e3a00be221f1ff5d039df998c43556228503788181a45256d91278dd005721
+DIST runc-1.0.0_rc2_p9.tar.gz 550963 SHA256 374822cc2895ed3899b7a3a03b566413ea782fccec1307231f27894e9c6d5bea SHA512 0176fc0fd69b298b5cb304388544a45b3805154f635c4a7492daac6e33774b16ad76af2b3008205de169306812834f4299106c89a17b1667168f3ad2ddc2e975 WHIRLPOOL 5015352fe7dc9ddedf93d555cf2750b3e9d72adfda534b1e30a69ac8b6b05e73bfbbe0ba72f543be4e3133f1604a5b42acc3363d30187a75861ca42755dfff81
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0002-Dont-set-label-for-mqueue-under-userns.patch b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0002-Dont-set-label-for-mqueue-under-userns.patch
new file mode 100644
index 0000000000..8653745603
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0002-Dont-set-label-for-mqueue-under-userns.patch
@@ -0,0 +1,94 @@
+From 3ce50afe04f102cf28dbb6425773011707bf3ae0 Mon Sep 17 00:00:00 2001
+From: Mrunal Patel <mrunalp@gmail.com>
+Date: Wed, 12 Oct 2016 16:46:59 -0700
+Subject: [PATCH] Fix setting SELinux label for mqueue when user namespaces are
+ enabled
+
+If one tries to user SELinux with user namespaces, then labeling of /dev/mqueue
+fails because the IPC namespace belongs to the root in init_user_ns. This
+commit fixes that by unsharing IPC namespace after we clone into a new USER
+namespace so the IPC namespace is owned by the root inside the new USER
+namespace as opposed to init_user_ns.
+
+Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
+---
+ libcontainer/nsenter/nsexec.c | 25 ++++++++++++++++++++-----
+ 1 file changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/libcontainer/nsenter/nsexec.c b/libcontainer/nsenter/nsexec.c
+index b93f827..1e8d4da 100644
+--- a/libcontainer/nsenter/nsexec.c
++++ b/libcontainer/nsenter/nsexec.c
+@@ -94,14 +94,20 @@ static int child_func(void *arg)
+ 	longjmp(*ca->env, JUMP_VAL);
+ }
+ 
+-static int clone_parent(jmp_buf *env, int flags) __attribute__ ((noinline));
+-static int clone_parent(jmp_buf *env, int flags)
++static int clone_parent(jmp_buf *env, int flags, bool delay_ipc_unshare) __attribute__ ((noinline));
++static int clone_parent(jmp_buf *env, int flags, bool delay_ipc_unshare)
+ {
+ 	int child;
+ 	struct clone_arg ca = {
+ 		.env = env,
+ 	};
+ 
++	// Don't clone into NEWIPC at the same time as cloning into NEWUSER.
++	// This way we can ensure that NEWIPC namespace belongs to the root in new user namespace.
++	if (delay_ipc_unshare) {
++		flags &= ~CLONE_NEWIPC;
++	}
++
+ 	child = clone(child_func, ca.stack_ptr, CLONE_PARENT | SIGCHLD | flags, &ca);
+ 
+ 	/*
+@@ -227,7 +233,7 @@ static void update_gidmap(int pid, char *map, int map_len)
+ 
+ #define JSON_MAX 4096
+ 
+-static void start_child(int pipenum, jmp_buf *env, int syncpipe[2], struct nlconfig_t *config)
++static void start_child(int pipenum, jmp_buf *env, int syncpipe[2], struct nlconfig_t *config, bool delay_ipc_unshare)
+ {
+ 	int len, childpid;
+ 	char buf[JSON_MAX];
+@@ -239,7 +245,7 @@ static void start_child(int pipenum, jmp_buf *env, int syncpipe[2], struct nlcon
+ 	 * (the bootstrap process). Also so we don't need to forward the
+ 	 * child's exit code or resend its death signal.
+ 	 */
+-	childpid = clone_parent(env, config->cloneflags);
++	childpid = clone_parent(env, config->cloneflags, delay_ipc_unshare);
+ 	if (childpid < 0)
+ 		bail("unable to fork");
+ 
+@@ -415,6 +421,9 @@ void nsexec(void)
+ 	if (config.cloneflags == -1)
+ 		bail("missing clone_flags");
+ 
++	bool delay_ipc_unshare = ((config.cloneflags & CLONE_NEWUSER) == CLONE_NEWUSER)
++		&& ((config.cloneflags & CLONE_NEWIPC) == CLONE_NEWIPC);
++
+ 	/* Pipe so we can tell the child when we've finished setting up. */
+ 	if (pipe(syncpipe) < 0)
+ 		bail("failed to setup sync pipe between parent and child");
+@@ -447,6 +456,12 @@ void nsexec(void)
+ 		if (setgroups(0, NULL) < 0)
+ 			bail("setgroups failed");
+ 
++		if (delay_ipc_unshare) {
++			if (unshare(CLONE_NEWIPC)) {
++				bail("unable to unshare IPC namespace");
++			}
++		}
++
+ 		if (consolefd != -1) {
+ 			if (ioctl(consolefd, TIOCSCTTY, 0) < 0)
+ 				bail("ioctl TIOCSCTTY failed");
+@@ -466,7 +481,7 @@ void nsexec(void)
+ 	}
+ 
+ 	/* Run the parent code. */
+-	start_child(pipenum, &env, syncpipe, &config);
++	start_child(pipenum, &env, syncpipe, &config, delay_ipc_unshare);
+ 
+ 	/* Should never be reached. */
+ 	bail("should never be reached");
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p9.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p9.ebuild
new file mode 100644
index 0000000000..8e992535cb
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p9.ebuild
@@ -0,0 +1,62 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: $
+
+EAPI=5
+
+GITHUB_URI="github.com/opencontainers/runc"
+COREOS_GO_PACKAGE="${GITHUB_URI}"
+COREOS_GO_VERSION="go1.6"
+# the commit of runc that docker uses.
+# see https://github.com/docker/docker/blob/v1.12.6/Dockerfile#L245
+# Note: this commit is only really present in `docker/runc` in the 'docker/1.12.x' branch
+# Update the patch number when this commit is changed (i.e. the _p in the
+# ebuild).
+# The patch version is arbitrarily the number of commits since the tag version
+# spcified in the ebuild name. For example:
+# $ git log v1.0.0-rc2..${COMMIT_ID} --oneline | wc -l
+COMMIT_ID="50a19c6ff828c58e5dab13830bd3dacde268afe5"
+
+inherit eutils flag-o-matic coreos-go-depend vcs-snapshot
+
+DESCRIPTION="runc container cli tools"
+HOMEPAGE="http://runc.io"
+
+SRC_URI="https://${GITHUB_URI}/archive/${COMMIT_ID}.tar.gz -> ${P}.tar.gz"
+KEYWORDS="amd64 arm64"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="apparmor selinux +seccomp"
+
+DEPEND=""
+RDEPEND="
+	apparmor? ( sys-libs/libapparmor )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+src_prepare() {
+	epatch "${FILESDIR}/0001-Makefile-do-not-install-dependencies-of-target.patch"
+	epatch "${FILESDIR}/0002-Dont-set-label-for-mqueue-under-userns.patch"
+
+	# Work around https://github.com/golang/go/issues/14669
+	# Remove after updating to go1.7
+	filter-flags -O*
+
+	go_export
+}
+
+src_compile() {
+	# build up optional flags
+	local options=(
+		$(usev apparmor)
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	emake BUILDTAGS="${options[*]}" COMMIT="${COMMIT_ID}"
+}
+
+src_install() {
+	dobin runc
+}

From fa1eb15c377f05d5f836669ff548ddb66f2124e8 Mon Sep 17 00:00:00 2001
From: Euan Kemp <euank@euank.com>
Date: Mon, 27 Feb 2017 17:07:31 -0800
Subject: [PATCH 4/9] app-emulation/runc: improve patch naming

---
 ..._p9-Fix-setting-selinux-label-for-mqueue-under-userns.patch} | 0
 ....0_rc2_p133-Delay-unshare-of-clone-newipc-for-selinux.patch} | 0
 .../app-emulation/runc/runc-1.0.0_rc2_p133.ebuild               | 2 +-
 .../coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p9.ebuild  | 2 +-
 4 files changed, 2 insertions(+), 2 deletions(-)
 rename sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/{0002-Dont-set-label-for-mqueue-under-userns.patch => 0002-1.0.0_rc2_p9-Fix-setting-selinux-label-for-mqueue-under-userns.patch} (100%)
 rename sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/{0002-Delay-unshare-of-clone-newipc-for-selinux.patch => 0003-1.0.0_rc2_p133-Delay-unshare-of-clone-newipc-for-selinux.patch} (100%)

diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0002-Dont-set-label-for-mqueue-under-userns.patch b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0002-1.0.0_rc2_p9-Fix-setting-selinux-label-for-mqueue-under-userns.patch
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0002-Dont-set-label-for-mqueue-under-userns.patch
rename to sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0002-1.0.0_rc2_p9-Fix-setting-selinux-label-for-mqueue-under-userns.patch
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0002-Delay-unshare-of-clone-newipc-for-selinux.patch b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0003-1.0.0_rc2_p133-Delay-unshare-of-clone-newipc-for-selinux.patch
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0002-Delay-unshare-of-clone-newipc-for-selinux.patch
rename to sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0003-1.0.0_rc2_p133-Delay-unshare-of-clone-newipc-for-selinux.patch
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p133.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p133.ebuild
index 7357ac37bb..208c1bbfc8 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p133.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p133.ebuild
@@ -37,7 +37,7 @@ RDEPEND="
 
 src_prepare() {
 	epatch "${FILESDIR}/0001-Makefile-do-not-install-dependencies-of-target.patch"
-	epatch "${FILESDIR}/0002-Delay-unshare-of-clone-newipc-for-selinux.patch"
+	epatch "${FILESDIR}/0003-${PV}-Delay-unshare-of-clone-newipc-for-selinux.patch"
 
 	# Work around https://github.com/golang/go/issues/14669
 	# Remove after updating to go1.7
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p9.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p9.ebuild
index 8e992535cb..5fd9b610fc 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p9.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p9.ebuild
@@ -37,7 +37,7 @@ RDEPEND="
 
 src_prepare() {
 	epatch "${FILESDIR}/0001-Makefile-do-not-install-dependencies-of-target.patch"
-	epatch "${FILESDIR}/0002-Dont-set-label-for-mqueue-under-userns.patch"
+	epatch "${FILESDIR}/0002-${PV}-Fix-setting-selinux-label-for-mqueue-under-userns.patch"
 
 	# Work around https://github.com/golang/go/issues/14669
 	# Remove after updating to go1.7

From 44725296507081fa527eb02518babaa7173191ac Mon Sep 17 00:00:00 2001
From: Euan Kemp <euank@euank.com>
Date: Mon, 27 Feb 2017 17:08:29 -0800
Subject: [PATCH 5/9] app-emulation/docker: depend on correct runc

docker 1.12 is only tested to work by upstream with this specific runc
version.
---
 .../coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild
index ed9f63f973..28f20efd3b 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild
@@ -62,7 +62,7 @@ RDEPEND="
 	>=sys-apps/shadow-4.4
 
 	>=app-emulation/containerd-0.2.5[seccomp?]
-	>=app-emulation/runc-1.0.0_rc2-r2[apparmor?,seccomp?]
+	=app-emulation/runc-1.0.0_rc2_p9[apparmor?,seccomp?]
 "
 
 RESTRICT="installsources strip"

From 0fcf442a47a8861373c6b3a4084eed3ec9e882c8 Mon Sep 17 00:00:00 2001
From: Euan Kemp <euank@euank.com>
Date: Mon, 27 Feb 2017 17:10:27 -0800
Subject: [PATCH 6/9] app-emulation/docker: lock down 1.13 dependencies

These are the only versions upstream tests together
---
 .../coreos-overlay/app-emulation/docker/docker-9999.ebuild    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-9999.ebuild
index 3dc5d2b62b..4ba538e89b 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-9999.ebuild
@@ -66,8 +66,8 @@ RDEPEND="
 	>=app-arch/xz-utils-4.9
 	>=sys-apps/shadow-4.4
 
-	>=app-emulation/containerd-0.2.3[seccomp?]
-	>=app-emulation/runc-1.0.0_rc2[apparmor?,seccomp?]
+	=app-emulation/containerd-0.2.3_p85[seccomp?]
+	=app-emulation/runc-1.0.0_rc2_p133[apparmor?,seccomp?]
 	app-emulation/docker-proxy
 "
 

From 8cbe29301b3e3280af35c9b3b20ec58bab2650e7 Mon Sep 17 00:00:00 2001
From: Euan Kemp <euank@euank.com>
Date: Mon, 27 Feb 2017 17:13:12 -0800
Subject: [PATCH 7/9] app-emulation/containerd: re-add 0.2.5

And move it from being a symlink.
This is the older version docker 1.12 uses
---
 .../app-emulation/containerd/Manifest         |  1 +
 .../containerd/containerd-0.2.5.ebuild        | 44 +++++++++++++++++++
 2 files changed, 45 insertions(+)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/app-emulation/containerd/containerd-0.2.5.ebuild

diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/containerd/Manifest b/sdk_container/src/third_party/coreos-overlay/app-emulation/containerd/Manifest
index beba8d1253..019a2676d7 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/containerd/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/containerd/Manifest
@@ -1 +1,2 @@
 DIST containerd-0.2.3_p85.tar.gz 1021240 SHA256 77ea44af1531d46b22f0444eb506590d1b7e5a9fe891cc6f8e36db5c2aef2d80 SHA512 df782f44f53a39dbec5be281c98b1457d86d902e44451b995c35143f843e0233ac72dfea44407e47a39931bbedfa0537cf0e597d68509e3ae21311be0cc20cd6 WHIRLPOOL 322a577ed865dcac7d1185b7f7e67e59190de9f8898c6e14b7b99ada2e069652d20723f5f746fbe476586a4a3d204dc1e0563f325ea4cc0aa968e26c09debf34
+DIST containerd-0.2.5.tar.gz 1003500 SHA256 88e099af66b50abe7f2159f13bdab793fa5199d8d5b9a9ef7a68171abb4359be SHA512 ba1e074bb7556a7c4be4d68dc62aa2fa4b823682c209d1609c1f11518a7b7167139ea159d31e0b21ba190d83115a67e5e45b54b6a4770742d49e9e561309551f WHIRLPOOL eb3622ba99c4d4806bda9a45853422a5b0b884869ed3be4c3caec4c20f49027e8db78b9885eca7bc83a0f3b08e9a66eca950390f0eda1ef2535fd3ab41623bf4
diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/containerd/containerd-0.2.5.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/containerd/containerd-0.2.5.ebuild
new file mode 100644
index 0000000000..0b8be2a330
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/containerd/containerd-0.2.5.ebuild
@@ -0,0 +1,44 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI=5
+
+GITHUB_URI="github.com/docker/${PN}"
+COREOS_GO_PACKAGE="${GITHUB_URI}"
+COREOS_GO_VERSION="go1.6"
+
+if [[ ${PV} == *9999 ]]; then
+	EGIT_REPO_URI="https://${GITHUB_URI}.git"
+	inherit git-r3
+else
+	MY_PV="${PV/_/-}"
+	EGIT_COMMIT="v${MY_PV}"
+	SRC_URI="https://${EGO_PN}/archive/${EGIT_COMMIT}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 arm64"
+	inherit vcs-snapshot
+fi
+
+inherit coreos-go systemd
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.tools"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="seccomp"
+
+DEPEND=""
+RDEPEND="app-emulation/runc
+	seccomp? ( sys-libs/libseccomp )"
+
+src_compile() {
+	local options=( $(usev seccomp) )
+	LDFLAGS= emake GIT_COMMIT="$EGIT_COMMIT" BUILDTAGS="${options[*]}"
+}
+
+src_install() {
+	dobin bin/containerd* bin/ctr
+
+	systemd_dounit "${FILESDIR}/containerd.service"
+}

From d1ef988acc6b5bff91012e8aa5552d875281840a Mon Sep 17 00:00:00 2001
From: Euan Kemp <euank@euank.com>
Date: Mon, 27 Feb 2017 17:14:18 -0800
Subject: [PATCH 8/9] app-emulation/containerd: remove 9999 from 0.2.5

---
 .../containerd/containerd-0.2.5.ebuild            | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/containerd/containerd-0.2.5.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/containerd/containerd-0.2.5.ebuild
index 0b8be2a330..d0f039b4e5 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/containerd/containerd-0.2.5.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/containerd/containerd-0.2.5.ebuild
@@ -8,16 +8,11 @@ GITHUB_URI="github.com/docker/${PN}"
 COREOS_GO_PACKAGE="${GITHUB_URI}"
 COREOS_GO_VERSION="go1.6"
 
-if [[ ${PV} == *9999 ]]; then
-	EGIT_REPO_URI="https://${GITHUB_URI}.git"
-	inherit git-r3
-else
-	MY_PV="${PV/_/-}"
-	EGIT_COMMIT="v${MY_PV}"
-	SRC_URI="https://${EGO_PN}/archive/${EGIT_COMMIT}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="amd64 arm64"
-	inherit vcs-snapshot
-fi
+MY_PV="${PV/_/-}"
+EGIT_COMMIT="v${MY_PV}"
+SRC_URI="https://${EGO_PN}/archive/${EGIT_COMMIT}.tar.gz -> ${P}.tar.gz"
+KEYWORDS="amd64 arm64"
+inherit vcs-snapshot
 
 inherit coreos-go systemd
 

From e435e823389431608db69c695c8a6c3a50264c99 Mon Sep 17 00:00:00 2001
From: Euan Kemp <euank@euank.com>
Date: Mon, 27 Feb 2017 17:15:41 -0800
Subject: [PATCH 9/9] app-emulation/docker: lockdown 1.12 containerd dep

---
 .../coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild
index 28f20efd3b..87106e15b9 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/docker/docker-1.12.6.ebuild
@@ -61,7 +61,7 @@ RDEPEND="
 	>=app-arch/xz-utils-4.9
 	>=sys-apps/shadow-4.4
 
-	>=app-emulation/containerd-0.2.5[seccomp?]
+	=app-emulation/containerd-0.2.5[seccomp?]
 	=app-emulation/runc-1.0.0_rc2_p9[apparmor?,seccomp?]
 "