Support for ulimit in new Docker 1.6

[Jon Schipp]

Hello all, 

Docker 1.6 has a new option ``--ulimit'' for passing ulimit settings to containers. [1]
I just added support for it in ISLET [2]. Settings can be globally applied in security.conf or per image. If you haven't upgraded to 1.6 then the ulimit settings are ignored.

This new options simplifies install too because we no longer have to modify Docker's Upstart script to apply basic security controls.

Let me know if you have any issues.

[1] https://blog.docker.com/2015/04/docker-release-1-6/
[2]https://github.com/jonschipp/ISLET/commit/8793e3e91fee73a56e244f39fff07e20ce49fd22

--

Jon Schipp, 

jonschipp.com, sickbits.net, open-nsm.net,

[Jon Schipp]

Update on the new --ulimit option in Docker.
I noticed that ``--ulimit fsize=$value'' in Docker and thus ULIMIT_FSIZE=$value in ISLET has a bug in the counter.

I reported this to Docker yesterday [1].

Also, unfortunately, ``--ulimit nproc=$value'' in Docker and thus ULIMIT_NPROC=$value in ISLET, do not prevent fork
bombs in the way that ISLET is currently used. This wasn't explained in the Docker documentation and there's a ticket for it now requesting further explanation which also identifies why this is the case [2].

[1] https://github.com/docker/docker/issues/12698
[2] https://github.com/docker/docker/issues/12695