When we launch a container in a new user namespace, we cannot create
devices, so we bind mount the host's devices into place instead.

If we are running in a user namespace (i.e. nested in a container),
then we need to do the same thing.  Add a function to detect that
and check for it before doing mknod.

Signed-off-by: Serge Hallyn <[email protected]>

These are the real host devices, container should not generally
have or need them.

Signed-off-by: Serge Hallyn <[email protected]>

If we are running in a user namespace, don't try to mknod as
it won't be allowed.  libcontainer will bind-mount the host's
devices over files in the container anyway, so it's not needed.

Signed-off-by: Serge Hallyn <[email protected]>

The chrootarchive package does a chroot (without mounting /proc) before
its work, so we cannot check /proc/self/uid_map when we need to.  So
compute it in advance and pass it along with the tar options.

Signed-off-by: Serge Hallyn <[email protected]>

kernel won't allow it.

Signed-off-by: Serge Hallyn <[email protected]>

We should do this in a better way, in particular by verifying through
/proc/self/cgroup whether the mount.Root is our cgroup prefix, but
this suffices at the moment:  if we have cgroup namespaces and are
running inside an lxc or lxd container, the mount prefix will always
be wrong.

Signed-off-by: Serge Hallyn <[email protected]>