Much good stuff:
- AppArmor! Unprivileged containers are now secured with a default apparmor profile. This is based on the default docker apparmor profile for maximum compatibility
- The
shared_mountsbosh property is gone, we now do the right thing for anything in/var/vcap/data - We now use the new OCI "create/start" split to run network plugins, allowing much more flexibility in how this works and cleaning up the code a lot
- Iodaemon is gone, we now use a binary called 'dadoo' to do a roughly similar job
- Reattaching after restart should now be more bulletproof, for example getting the exit code should work
- Code now imported via
code.cloudfoundry.orgdomain