Emulate DNAT in userland for loopback-to-loopback connections. This makes container ports available from localhost.

Not only is this a more common idiom, it'll make finding bugs easier,
and it'll make porting to Go 1.1 easier.

Go 1.1 will not require the final return or panic because it has a
notion of terminating statements.

Instead of allocating all possible IPs in advance, generate them as
needed.

A loop will cycle through all possible IPs in sequential order,
allocating them as needed and marking them as in use. Once the loop
exhausts all IPs, it will wrap back to the beginning. IPs that are
already in use will be skipped. When an IP is released, it will be
cleared and be available for allocation again.

Two decisions went into this design:

1) Minimize memory footprint by only allocating IPs that are actually
in use

2) Minimize reuse of released IP addresses to avoid sending traffic to
the wrong containers

As a side effect, the functions for IP/Mask<->int conversion have been
rewritten to never be able to fail in order to reduce the amount of
error returns.

Fixes gh-231

Properly cleanup iptables rules inserted in OUTPUT (introduced in 3c6b8bb8)

example:

  2013/03/22 21:42:55 Unable to setup port networking: Failed to create DOCKER chain

  (which was possibly introduced by commit 3c6b8bb8)

Current Go tip (+74e65f07a0c8) and likely Go 1.1 does not build docker since net.TCPAddr struct has an additional field now for IPv6:

type TCPAddr struct {
    IP   IP
    Port int
    Zone string // IPv6 scoped addressing zone
}

Initializing the struct with named fields resolves this problem.

Implemented a port allocator and a port mapper that is able to forward TCP ports
from the host to the container.

is assigned to each container upon Start and released whenever the
container exits.

IP addresses range and network size in order to allocate an IP address.

the lxc bridge interface