diff --git a/daemon/execdriver/driver_unix.go b/daemon/execdriver/driver_unix.go
index 168b818cc8..eedd8ac820 100644
--- a/daemon/execdriver/driver_unix.go
+++ b/daemon/execdriver/driver_unix.go
@@ -139,7 +139,7 @@ func InitContainer(c *Command) *configs.Config {
 
 	container.Hostname = getEnv("HOSTNAME", c.ProcessConfig.Env)
 	container.Cgroups.Name = c.ID
-	container.Cgroups.AllowedDevices = c.AllowedDevices
+	container.Cgroups.Resources.AllowedDevices = c.AllowedDevices
 	container.Devices = c.AutoCreatedDevices
 	container.Rootfs = c.Rootfs
 	container.Readonlyfs = c.ReadonlyRootfs
@@ -170,23 +170,23 @@ func getEnv(key string, env []string) string {
 // SetupCgroups setups cgroup resources for a container.
 func SetupCgroups(container *configs.Config, c *Command) error {
 	if c.Resources != nil {
-		container.Cgroups.CpuShares = c.Resources.CPUShares
-		container.Cgroups.Memory = c.Resources.Memory
-		container.Cgroups.MemoryReservation = c.Resources.MemoryReservation
-		container.Cgroups.MemorySwap = c.Resources.MemorySwap
-		container.Cgroups.KernelMemory = c.Resources.KernelMemory
-		container.Cgroups.CpusetCpus = c.Resources.CpusetCpus
-		container.Cgroups.CpusetMems = c.Resources.CpusetMems
-		container.Cgroups.CpuPeriod = c.Resources.CPUPeriod
-		container.Cgroups.CpuQuota = c.Resources.CPUQuota
-		container.Cgroups.BlkioWeight = c.Resources.BlkioWeight
-		container.Cgroups.BlkioWeightDevice = c.Resources.BlkioWeightDevice
-		container.Cgroups.BlkioThrottleReadBpsDevice = c.Resources.BlkioThrottleReadBpsDevice
-		container.Cgroups.BlkioThrottleWriteBpsDevice = c.Resources.BlkioThrottleWriteBpsDevice
-		container.Cgroups.BlkioThrottleReadIOPSDevice = c.Resources.BlkioThrottleReadIOpsDevice
-		container.Cgroups.BlkioThrottleWriteIOPSDevice = c.Resources.BlkioThrottleWriteIOpsDevice
-		container.Cgroups.OomKillDisable = c.Resources.OomKillDisable
-		container.Cgroups.MemorySwappiness = c.Resources.MemorySwappiness
+		container.Cgroups.Resources.CpuShares = c.Resources.CPUShares
+		container.Cgroups.Resources.Memory = c.Resources.Memory
+		container.Cgroups.Resources.MemoryReservation = c.Resources.MemoryReservation
+		container.Cgroups.Resources.MemorySwap = c.Resources.MemorySwap
+		container.Cgroups.Resources.KernelMemory = c.Resources.KernelMemory
+		container.Cgroups.Resources.CpusetCpus = c.Resources.CpusetCpus
+		container.Cgroups.Resources.CpusetMems = c.Resources.CpusetMems
+		container.Cgroups.Resources.CpuPeriod = c.Resources.CPUPeriod
+		container.Cgroups.Resources.CpuQuota = c.Resources.CPUQuota
+		container.Cgroups.Resources.BlkioWeight = c.Resources.BlkioWeight
+		container.Cgroups.Resources.BlkioWeightDevice = c.Resources.BlkioWeightDevice
+		container.Cgroups.Resources.BlkioThrottleReadBpsDevice = c.Resources.BlkioThrottleReadBpsDevice
+		container.Cgroups.Resources.BlkioThrottleWriteBpsDevice = c.Resources.BlkioThrottleWriteBpsDevice
+		container.Cgroups.Resources.BlkioThrottleReadIOPSDevice = c.Resources.BlkioThrottleReadIOpsDevice
+		container.Cgroups.Resources.BlkioThrottleWriteIOPSDevice = c.Resources.BlkioThrottleWriteIOpsDevice
+		container.Cgroups.Resources.OomKillDisable = c.Resources.OomKillDisable
+		container.Cgroups.Resources.MemorySwappiness = c.Resources.MemorySwappiness
 	}
 
 	return nil
diff --git a/daemon/execdriver/native/create.go b/daemon/execdriver/native/create.go
index 16ad4508d7..4f97ed93f8 100644
--- a/daemon/execdriver/native/create.go
+++ b/daemon/execdriver/native/create.go
@@ -251,7 +251,7 @@ func (d *Driver) setupRemappedRoot(container *configs.Config, c *execdriver.Comm
 
 func (d *Driver) setPrivileged(container *configs.Config) (err error) {
 	container.Capabilities = execdriver.GetAllCapabilities()
-	container.Cgroups.AllowAllDevices = true
+	container.Cgroups.Resources.AllowAllDevices = true
 
 	hostDevices, err := devices.HostDevices()
 	if err != nil {
diff --git a/daemon/execdriver/native/driver.go b/daemon/execdriver/native/driver.go
index e85c4179cf..c011bba861 100644
--- a/daemon/execdriver/native/driver.go
+++ b/daemon/execdriver/native/driver.go
@@ -385,7 +385,7 @@ func (d *Driver) Stats(id string) (*execdriver.ResourceStats, error) {
 	if err != nil {
 		return nil, err
 	}
-	memoryLimit := c.Config().Cgroups.Memory
+	memoryLimit := c.Config().Cgroups.Resources.Memory
 	// if the container does not have any memory limit specified set the
 	// limit to the machines memory
 	if memoryLimit == 0 {
diff --git a/daemon/execdriver/native/template/default_template_linux.go b/daemon/execdriver/native/template/default_template_linux.go
index d59e3181d8..8caf34fa4e 100644
--- a/daemon/execdriver/native/template/default_template_linux.go
+++ b/daemon/execdriver/native/template/default_template_linux.go
@@ -40,9 +40,11 @@ func New() *configs.Config {
 			{Type: "NEWUSER"},
 		}),
 		Cgroups: &configs.Cgroup{
-			Parent:           "/docker",
-			AllowAllDevices:  false,
-			MemorySwappiness: -1,
+			Parent: "/docker",
+			Resources: &configs.Resources{
+				AllowAllDevices:  false,
+				MemorySwappiness: -1,
+			},
 		},
 		Mounts: []*configs.Mount{
 			{
diff --git a/hack/vendor.sh b/hack/vendor.sh
index d99f9a4a48..9a4a612cdf 100755
--- a/hack/vendor.sh
+++ b/hack/vendor.sh
@@ -51,7 +51,7 @@ clone git github.com/miekg/pkcs11 80f102b5cac759de406949c47f0928b99bd64cdf
 clone git github.com/jfrazelle/go v1.5.1-1
 clone git github.com/agl/ed25519 d2b94fd789ea21d12fac1a4443dd3a3f79cda72c
 
-clone git github.com/opencontainers/runc ba1568de399395774ad84c2ace65937814c542ed # libcontainer
+clone git github.com/opencontainers/runc d97d5e8b007e4657316eed76ea30bc0f690230cf # libcontainer
 clone git github.com/opencontainers/specs 46d949ea81080c5f60dfb72ee91468b1e9fb2998 # specs
 clone git github.com/seccomp/libseccomp-golang 1b506fc7c24eec5a3693cdcbed40d9c226cfc6a1
 # libcontainer deps (see src/github.com/opencontainers/runc/Godeps/Godeps.json)
diff --git a/vendor/src/github.com/docker/go-connections/CONTRIBUTING.md b/vendor/src/github.com/docker/go-connections/CONTRIBUTING.md
deleted file mode 100644
index 926dcc931d..0000000000
--- a/vendor/src/github.com/docker/go-connections/CONTRIBUTING.md
+++ /dev/null
@@ -1,55 +0,0 @@
-# Contributing to Docker
-
-### Sign your work
-
-The sign-off is a simple line at the end of the explanation for the patch. Your
-signature certifies that you wrote the patch or otherwise have the right to pass
-it on as an open-source patch. The rules are pretty simple: if you can certify
-the below (from [developercertificate.org](http://developercertificate.org/)):
-
-```
-Developer Certificate of Origin
-Version 1.1
-
-Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
-660 York Street, Suite 102,
-San Francisco, CA 94110 USA
-
-Everyone is permitted to copy and distribute verbatim copies of this
-license document, but changing it is not allowed.
-
-Developer's Certificate of Origin 1.1
-
-By making a contribution to this project, I certify that:
-
-(a) The contribution was created in whole or in part by me and I
-    have the right to submit it under the open source license
-    indicated in the file; or
-
-(b) The contribution is based upon previous work that, to the best
-    of my knowledge, is covered under an appropriate open source
-    license and I have the right under that license to submit that
-    work with modifications, whether created in whole or in part
-    by me, under the same open source license (unless I am
-    permitted to submit under a different license), as indicated
-    in the file; or
-
-(c) The contribution was provided directly to me by some other
-    person who certified (a), (b) or (c) and I have not modified
-    it.
-
-(d) I understand and agree that this project and the contribution
-    are public and that a record of the contribution (including all
-    personal information I submit with it, including my sign-off) is
-    maintained indefinitely and may be redistributed consistent with
-    this project or the open source license(s) involved.
-```
-
-Then you just add a line to every git commit message:
-
-    Signed-off-by: Joe Smith <joe.smith@email.com>
-
-Use your real name (sorry, no pseudonyms or anonymous contributions.)
-
-If you set your `user.name` and `user.email` git configs, you can sign your
-commit automatically with `git commit -s`.
diff --git a/vendor/src/github.com/docker/go-connections/MAINTAINERS b/vendor/src/github.com/docker/go-connections/MAINTAINERS
deleted file mode 100644
index 477be8b214..0000000000
--- a/vendor/src/github.com/docker/go-connections/MAINTAINERS
+++ /dev/null
@@ -1,27 +0,0 @@
-# go-connections maintainers file
-#
-# This file describes who runs the docker/go-connections project and how.
-# This is a living document - if you see something out of date or missing, speak up!
-#
-# It is structured to be consumable by both humans and programs.
-# To extract its contents programmatically, use any TOML-compliant parser.
-#
-# This file is compiled into the MAINTAINERS file in docker/opensource.
-#
-[Org]
-	[Org."Core maintainers"]
-		people = [
-			"calavera",
-		]
-
-[people]
-
-# A reference list of all people associated with the project.
-# All other sections should refer to people by their canonical key
-# in the people section.
-
-	# ADD YOURSELF HERE IN ALPHABETICAL ORDER
-	[people.calavera]
-	Name = "David Calavera"
-	Email = "david.calavera@gmail.com"
-	GitHub = "calavera"
diff --git a/vendor/src/github.com/docker/go-connections/README.md b/vendor/src/github.com/docker/go-connections/README.md
deleted file mode 100644
index d257e44fdc..0000000000
--- a/vendor/src/github.com/docker/go-connections/README.md
+++ /dev/null
@@ -1,13 +0,0 @@
-[![GoDoc](https://godoc.org/github.com/docker/go-connections?status.svg)](https://godoc.org/github.com/docker/go-connections)
-
-# Introduction
-
-go-connections provides common package to work with network connections.
-
-## Usage
-
-See the [docs in godoc](https://godoc.org/github.com/docker/go-connections) for examples and documentation.
-
-## License
-
-go-connections is licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE) for the full license text.
diff --git a/vendor/src/github.com/docker/go-connections/circle.yml b/vendor/src/github.com/docker/go-connections/circle.yml
deleted file mode 100644
index 8a82ee8259..0000000000
--- a/vendor/src/github.com/docker/go-connections/circle.yml
+++ /dev/null
@@ -1,14 +0,0 @@
-dependencies:
-  pre:
-    # setup ipv6
-    - sudo sysctl -w net.ipv6.conf.lo.disable_ipv6=0 net.ipv6.conf.default.disable_ipv6=0 net.ipv6.conf.all.disable_ipv6=0
-  post:
-    # install golint
-    - go get github.com/golang/lint/golint
-
-test:
-  pre:
-    # run analysis before tests
-    - go vet ./...
-    - test -z "$(golint ./... | tee /dev/stderr)"
-    - test -z "$(gofmt -s -l . | tee /dev/stderr)"
diff --git a/vendor/src/github.com/docker/go-connections/doc.go b/vendor/src/github.com/docker/go-connections/doc.go
deleted file mode 100644
index 43e27247d4..0000000000
--- a/vendor/src/github.com/docker/go-connections/doc.go
+++ /dev/null
@@ -1,3 +0,0 @@
-// Package connections provides libraries to work with network connections.
-// This library is divided in several components for specific usage.
-package connections
diff --git a/vendor/src/github.com/docker/go-connections/nat/nat_test.go b/vendor/src/github.com/docker/go-connections/nat/nat_test.go
deleted file mode 100644
index 651dcd307d..0000000000
--- a/vendor/src/github.com/docker/go-connections/nat/nat_test.go
+++ /dev/null
@@ -1,525 +0,0 @@
-package nat
-
-import (
-	"testing"
-)
-
-func TestParsePort(t *testing.T) {
-	var (
-		p   int
-		err error
-	)
-
-	p, err = ParsePort("1234")
-
-	if err != nil || p != 1234 {
-		t.Fatal("Parsing '1234' did not succeed")
-	}
-
-	// FIXME currently this is a valid port. I don't think it should be.
-	// I'm leaving this test commented out until we make a decision.
-	// - erikh
-
-	/*
-		p, err = ParsePort("0123")
-
-		if err != nil {
-		    t.Fatal("Successfully parsed port '0123' to '123'")
-		}
-	*/
-
-	p, err = ParsePort("asdf")
-
-	if err == nil || p != 0 {
-		t.Fatal("Parsing port 'asdf' succeeded")
-	}
-
-	p, err = ParsePort("1asdf")
-
-	if err == nil || p != 0 {
-		t.Fatal("Parsing port '1asdf' succeeded")
-	}
-}
-
-func TestParsePortRangeToInt(t *testing.T) {
-	var (
-		begin int
-		end   int
-		err   error
-	)
-
-	type TestRange struct {
-		Range string
-		Begin int
-		End   int
-	}
-	validRanges := []TestRange{
-		{"1234", 1234, 1234},
-		{"1234-1234", 1234, 1234},
-		{"1234-1235", 1234, 1235},
-		{"8000-9000", 8000, 9000},
-		{"0", 0, 0},
-		{"0-0", 0, 0},
-	}
-
-	for _, r := range validRanges {
-		begin, end, err = ParsePortRangeToInt(r.Range)
-
-		if err != nil || begin != r.Begin {
-			t.Fatalf("Parsing port range '%s' did not succeed. Expected begin %d, got %d", r.Range, r.Begin, begin)
-		}
-		if err != nil || end != r.End {
-			t.Fatalf("Parsing port range '%s' did not succeed. Expected end %d, got %d", r.Range, r.End, end)
-		}
-	}
-
-	invalidRanges := []string{
-		"asdf",
-		"1asdf",
-		"9000-8000",
-		"9000-",
-		"-8000",
-		"-8000-",
-	}
-
-	for _, r := range invalidRanges {
-		begin, end, err = ParsePortRangeToInt(r)
-
-		if err == nil || begin != 0 || end != 0 {
-			t.Fatalf("Parsing port range '%s' succeeded", r)
-		}
-	}
-}
-
-func TestPort(t *testing.T) {
-	p, err := NewPort("tcp", "1234")
-
-	if err != nil {
-		t.Fatalf("tcp, 1234 had a parsing issue: %v", err)
-	}
-
-	if string(p) != "1234/tcp" {
-		t.Fatal("tcp, 1234 did not result in the string 1234/tcp")
-	}
-
-	if p.Proto() != "tcp" {
-		t.Fatal("protocol was not tcp")
-	}
-
-	if p.Port() != "1234" {
-		t.Fatal("port string value was not 1234")
-	}
-
-	if p.Int() != 1234 {
-		t.Fatal("port int value was not 1234")
-	}
-
-	p, err = NewPort("tcp", "asd1234")
-	if err == nil {
-		t.Fatal("tcp, asd1234 was supposed to fail")
-	}
-
-	p, err = NewPort("tcp", "1234-1230")
-	if err == nil {
-		t.Fatal("tcp, 1234-1230 was supposed to fail")
-	}
-
-	p, err = NewPort("tcp", "1234-1242")
-	if err != nil {
-		t.Fatalf("tcp, 1234-1242 had a parsing issue: %v", err)
-	}
-
-	if string(p) != "1234-1242/tcp" {
-		t.Fatal("tcp, 1234-1242 did not result in the string 1234-1242/tcp")
-	}
-}
-
-func TestSplitProtoPort(t *testing.T) {
-	var (
-		proto string
-		port  string
-	)
-
-	proto, port = SplitProtoPort("1234/tcp")
-
-	if proto != "tcp" || port != "1234" {
-		t.Fatal("Could not split 1234/tcp properly")
-	}
-
-	proto, port = SplitProtoPort("")
-
-	if proto != "" || port != "" {
-		t.Fatal("parsing an empty string yielded surprising results", proto, port)
-	}
-
-	proto, port = SplitProtoPort("1234")
-
-	if proto != "tcp" || port != "1234" {
-		t.Fatal("tcp is not the default protocol for portspec '1234'", proto, port)
-	}
-
-	proto, port = SplitProtoPort("1234/")
-
-	if proto != "tcp" || port != "1234" {
-		t.Fatal("parsing '1234/' yielded:" + port + "/" + proto)
-	}
-
-	proto, port = SplitProtoPort("/tcp")
-
-	if proto != "" || port != "" {
-		t.Fatal("parsing '/tcp' yielded:" + port + "/" + proto)
-	}
-}
-
-func TestParsePortSpecs(t *testing.T) {
-	var (
-		portMap    map[Port]struct{}
-		bindingMap map[Port][]PortBinding
-		err        error
-	)
-
-	portMap, bindingMap, err = ParsePortSpecs([]string{"1234/tcp", "2345/udp"})
-
-	if err != nil {
-		t.Fatalf("Error while processing ParsePortSpecs: %s", err)
-	}
-
-	if _, ok := portMap[Port("1234/tcp")]; !ok {
-		t.Fatal("1234/tcp was not parsed properly")
-	}
-
-	if _, ok := portMap[Port("2345/udp")]; !ok {
-		t.Fatal("2345/udp was not parsed properly")
-	}
-
-	for portspec, bindings := range bindingMap {
-		if len(bindings) != 1 {
-			t.Fatalf("%s should have exactly one binding", portspec)
-		}
-
-		if bindings[0].HostIP != "" {
-			t.Fatalf("HostIP should not be set for %s", portspec)
-		}
-
-		if bindings[0].HostPort != "" {
-			t.Fatalf("HostPort should not be set for %s", portspec)
-		}
-	}
-
-	portMap, bindingMap, err = ParsePortSpecs([]string{"1234:1234/tcp", "2345:2345/udp"})
-
-	if err != nil {
-		t.Fatalf("Error while processing ParsePortSpecs: %s", err)
-	}
-
-	if _, ok := portMap[Port("1234/tcp")]; !ok {
-		t.Fatal("1234/tcp was not parsed properly")
-	}
-
-	if _, ok := portMap[Port("2345/udp")]; !ok {
-		t.Fatal("2345/udp was not parsed properly")
-	}
-
-	for portspec, bindings := range bindingMap {
-		_, port := SplitProtoPort(string(portspec))
-
-		if len(bindings) != 1 {
-			t.Fatalf("%s should have exactly one binding", portspec)
-		}
-
-		if bindings[0].HostIP != "" {
-			t.Fatalf("HostIP should not be set for %s", portspec)
-		}
-
-		if bindings[0].HostPort != port {
-			t.Fatalf("HostPort should be %s for %s", port, portspec)
-		}
-	}
-
-	portMap, bindingMap, err = ParsePortSpecs([]string{"0.0.0.0:1234:1234/tcp", "0.0.0.0:2345:2345/udp"})
-
-	if err != nil {
-		t.Fatalf("Error while processing ParsePortSpecs: %s", err)
-	}
-
-	if _, ok := portMap[Port("1234/tcp")]; !ok {
-		t.Fatal("1234/tcp was not parsed properly")
-	}
-
-	if _, ok := portMap[Port("2345/udp")]; !ok {
-		t.Fatal("2345/udp was not parsed properly")
-	}
-
-	for portspec, bindings := range bindingMap {
-		_, port := SplitProtoPort(string(portspec))
-
-		if len(bindings) != 1 {
-			t.Fatalf("%s should have exactly one binding", portspec)
-		}
-
-		if bindings[0].HostIP != "0.0.0.0" {
-			t.Fatalf("HostIP is not 0.0.0.0 for %s", portspec)
-		}
-
-		if bindings[0].HostPort != port {
-			t.Fatalf("HostPort should be %s for %s", port, portspec)
-		}
-	}
-
-	_, _, err = ParsePortSpecs([]string{"localhost:1234:1234/tcp"})
-
-	if err == nil {
-		t.Fatal("Received no error while trying to parse a hostname instead of ip")
-	}
-}
-
-func TestParsePortSpecsWithRange(t *testing.T) {
-	var (
-		portMap    map[Port]struct{}
-		bindingMap map[Port][]PortBinding
-		err        error
-	)
-
-	portMap, bindingMap, err = ParsePortSpecs([]string{"1234-1236/tcp", "2345-2347/udp"})
-
-	if err != nil {
-		t.Fatalf("Error while processing ParsePortSpecs: %s", err)
-	}
-
-	if _, ok := portMap[Port("1235/tcp")]; !ok {
-		t.Fatal("1234/tcp was not parsed properly")
-	}
-
-	if _, ok := portMap[Port("2346/udp")]; !ok {
-		t.Fatal("2345/udp was not parsed properly")
-	}
-
-	for portspec, bindings := range bindingMap {
-		if len(bindings) != 1 {
-			t.Fatalf("%s should have exactly one binding", portspec)
-		}
-
-		if bindings[0].HostIP != "" {
-			t.Fatalf("HostIP should not be set for %s", portspec)
-		}
-
-		if bindings[0].HostPort != "" {
-			t.Fatalf("HostPort should not be set for %s", portspec)
-		}
-	}
-
-	portMap, bindingMap, err = ParsePortSpecs([]string{"1234-1236:1234-1236/tcp", "2345-2347:2345-2347/udp"})
-
-	if err != nil {
-		t.Fatalf("Error while processing ParsePortSpecs: %s", err)
-	}
-
-	if _, ok := portMap[Port("1235/tcp")]; !ok {
-		t.Fatal("1234/tcp was not parsed properly")
-	}
-
-	if _, ok := portMap[Port("2346/udp")]; !ok {
-		t.Fatal("2345/udp was not parsed properly")
-	}
-
-	for portspec, bindings := range bindingMap {
-		_, port := SplitProtoPort(string(portspec))
-		if len(bindings) != 1 {
-			t.Fatalf("%s should have exactly one binding", portspec)
-		}
-
-		if bindings[0].HostIP != "" {
-			t.Fatalf("HostIP should not be set for %s", portspec)
-		}
-
-		if bindings[0].HostPort != port {
-			t.Fatalf("HostPort should be %s for %s", port, portspec)
-		}
-	}
-
-	portMap, bindingMap, err = ParsePortSpecs([]string{"0.0.0.0:1234-1236:1234-1236/tcp", "0.0.0.0:2345-2347:2345-2347/udp"})
-
-	if err != nil {
-		t.Fatalf("Error while processing ParsePortSpecs: %s", err)
-	}
-
-	if _, ok := portMap[Port("1235/tcp")]; !ok {
-		t.Fatal("1234/tcp was not parsed properly")
-	}
-
-	if _, ok := portMap[Port("2346/udp")]; !ok {
-		t.Fatal("2345/udp was not parsed properly")
-	}
-
-	for portspec, bindings := range bindingMap {
-		_, port := SplitProtoPort(string(portspec))
-		if len(bindings) != 1 || bindings[0].HostIP != "0.0.0.0" || bindings[0].HostPort != port {
-			t.Fatalf("Expect single binding to port %s but found %s", port, bindings)
-		}
-	}
-
-	_, _, err = ParsePortSpecs([]string{"localhost:1234-1236:1234-1236/tcp"})
-
-	if err == nil {
-		t.Fatal("Received no error while trying to parse a hostname instead of ip")
-	}
-}
-
-func TestParseNetworkOptsPrivateOnly(t *testing.T) {
-	ports, bindings, err := ParsePortSpecs([]string{"192.168.1.100::80"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(ports) != 1 {
-		t.Logf("Expected 1 got %d", len(ports))
-		t.FailNow()
-	}
-	if len(bindings) != 1 {
-		t.Logf("Expected 1 got %d", len(bindings))
-		t.FailNow()
-	}
-	for k := range ports {
-		if k.Proto() != "tcp" {
-			t.Logf("Expected tcp got %s", k.Proto())
-			t.Fail()
-		}
-		if k.Port() != "80" {
-			t.Logf("Expected 80 got %s", k.Port())
-			t.Fail()
-		}
-		b, exists := bindings[k]
-		if !exists {
-			t.Log("Binding does not exist")
-			t.FailNow()
-		}
-		if len(b) != 1 {
-			t.Logf("Expected 1 got %d", len(b))
-			t.FailNow()
-		}
-		s := b[0]
-		if s.HostPort != "" {
-			t.Logf("Expected \"\" got %s", s.HostPort)
-			t.Fail()
-		}
-		if s.HostIP != "192.168.1.100" {
-			t.Fail()
-		}
-	}
-}
-
-func TestParseNetworkOptsPublic(t *testing.T) {
-	ports, bindings, err := ParsePortSpecs([]string{"192.168.1.100:8080:80"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(ports) != 1 {
-		t.Logf("Expected 1 got %d", len(ports))
-		t.FailNow()
-	}
-	if len(bindings) != 1 {
-		t.Logf("Expected 1 got %d", len(bindings))
-		t.FailNow()
-	}
-	for k := range ports {
-		if k.Proto() != "tcp" {
-			t.Logf("Expected tcp got %s", k.Proto())
-			t.Fail()
-		}
-		if k.Port() != "80" {
-			t.Logf("Expected 80 got %s", k.Port())
-			t.Fail()
-		}
-		b, exists := bindings[k]
-		if !exists {
-			t.Log("Binding does not exist")
-			t.FailNow()
-		}
-		if len(b) != 1 {
-			t.Logf("Expected 1 got %d", len(b))
-			t.FailNow()
-		}
-		s := b[0]
-		if s.HostPort != "8080" {
-			t.Logf("Expected 8080 got %s", s.HostPort)
-			t.Fail()
-		}
-		if s.HostIP != "192.168.1.100" {
-			t.Fail()
-		}
-	}
-}
-
-func TestParseNetworkOptsPublicNoPort(t *testing.T) {
-	ports, bindings, err := ParsePortSpecs([]string{"192.168.1.100"})
-
-	if err == nil {
-		t.Logf("Expected error Invalid containerPort")
-		t.Fail()
-	}
-	if ports != nil {
-		t.Logf("Expected nil got %s", ports)
-		t.Fail()
-	}
-	if bindings != nil {
-		t.Logf("Expected nil got %s", bindings)
-		t.Fail()
-	}
-}
-
-func TestParseNetworkOptsNegativePorts(t *testing.T) {
-	ports, bindings, err := ParsePortSpecs([]string{"192.168.1.100:-1:-1"})
-
-	if err == nil {
-		t.Fail()
-	}
-	if len(ports) != 0 {
-		t.Logf("Expected nil got %d", len(ports))
-		t.Fail()
-	}
-	if len(bindings) != 0 {
-		t.Logf("Expected 0 got %d", len(bindings))
-		t.Fail()
-	}
-}
-
-func TestParseNetworkOptsUdp(t *testing.T) {
-	ports, bindings, err := ParsePortSpecs([]string{"192.168.1.100::6000/udp"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(ports) != 1 {
-		t.Logf("Expected 1 got %d", len(ports))
-		t.FailNow()
-	}
-	if len(bindings) != 1 {
-		t.Logf("Expected 1 got %d", len(bindings))
-		t.FailNow()
-	}
-	for k := range ports {
-		if k.Proto() != "udp" {
-			t.Logf("Expected udp got %s", k.Proto())
-			t.Fail()
-		}
-		if k.Port() != "6000" {
-			t.Logf("Expected 6000 got %s", k.Port())
-			t.Fail()
-		}
-		b, exists := bindings[k]
-		if !exists {
-			t.Log("Binding does not exist")
-			t.FailNow()
-		}
-		if len(b) != 1 {
-			t.Logf("Expected 1 got %d", len(b))
-			t.FailNow()
-		}
-		s := b[0]
-		if s.HostPort != "" {
-			t.Logf("Expected \"\" got %s", s.HostPort)
-			t.Fail()
-		}
-		if s.HostIP != "192.168.1.100" {
-			t.Fail()
-		}
-	}
-}
diff --git a/vendor/src/github.com/docker/go-connections/nat/parse_test.go b/vendor/src/github.com/docker/go-connections/nat/parse_test.go
deleted file mode 100644
index 2ac204a05b..0000000000
--- a/vendor/src/github.com/docker/go-connections/nat/parse_test.go
+++ /dev/null
@@ -1,54 +0,0 @@
-package nat
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestParsePortRange(t *testing.T) {
-	if start, end, err := ParsePortRange("8000-8080"); err != nil || start != 8000 || end != 8080 {
-		t.Fatalf("Error: %s or Expecting {start,end} values {8000,8080} but found {%d,%d}.", err, start, end)
-	}
-}
-
-func TestParsePortRangeEmpty(t *testing.T) {
-	if _, _, err := ParsePortRange(""); err == nil || err.Error() != "Empty string specified for ports." {
-		t.Fatalf("Expected error 'Empty string specified for ports.', got %v", err)
-	}
-}
-
-func TestParsePortRangeWithNoRange(t *testing.T) {
-	start, end, err := ParsePortRange("8080")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if start != 8080 || end != 8080 {
-		t.Fatalf("Expected start and end to be the same and equal to 8080, but were %v and %v", start, end)
-	}
-}
-
-func TestParsePortRangeIncorrectRange(t *testing.T) {
-	if _, _, err := ParsePortRange("9000-8080"); err == nil || !strings.Contains(err.Error(), "Invalid range specified for the Port") {
-		t.Fatalf("Expecting error 'Invalid range specified for the Port' but received %s.", err)
-	}
-}
-
-func TestParsePortRangeIncorrectEndRange(t *testing.T) {
-	if _, _, err := ParsePortRange("8000-a"); err == nil || !strings.Contains(err.Error(), "invalid syntax") {
-		t.Fatalf("Expecting error 'Invalid range specified for the Port' but received %s.", err)
-	}
-
-	if _, _, err := ParsePortRange("8000-30a"); err == nil || !strings.Contains(err.Error(), "invalid syntax") {
-		t.Fatalf("Expecting error 'Invalid range specified for the Port' but received %s.", err)
-	}
-}
-
-func TestParsePortRangeIncorrectStartRange(t *testing.T) {
-	if _, _, err := ParsePortRange("a-8000"); err == nil || !strings.Contains(err.Error(), "invalid syntax") {
-		t.Fatalf("Expecting error 'Invalid range specified for the Port' but received %s.", err)
-	}
-
-	if _, _, err := ParsePortRange("30a-8000"); err == nil || !strings.Contains(err.Error(), "invalid syntax") {
-		t.Fatalf("Expecting error 'Invalid range specified for the Port' but received %s.", err)
-	}
-}
diff --git a/vendor/src/github.com/docker/go-connections/nat/sort_test.go b/vendor/src/github.com/docker/go-connections/nat/sort_test.go
deleted file mode 100644
index 88ed911156..0000000000
--- a/vendor/src/github.com/docker/go-connections/nat/sort_test.go
+++ /dev/null
@@ -1,85 +0,0 @@
-package nat
-
-import (
-	"fmt"
-	"reflect"
-	"testing"
-)
-
-func TestSortUniquePorts(t *testing.T) {
-	ports := []Port{
-		Port("6379/tcp"),
-		Port("22/tcp"),
-	}
-
-	Sort(ports, func(ip, jp Port) bool {
-		return ip.Int() < jp.Int() || (ip.Int() == jp.Int() && ip.Proto() == "tcp")
-	})
-
-	first := ports[0]
-	if fmt.Sprint(first) != "22/tcp" {
-		t.Log(fmt.Sprint(first))
-		t.Fail()
-	}
-}
-
-func TestSortSamePortWithDifferentProto(t *testing.T) {
-	ports := []Port{
-		Port("8888/tcp"),
-		Port("8888/udp"),
-		Port("6379/tcp"),
-		Port("6379/udp"),
-	}
-
-	Sort(ports, func(ip, jp Port) bool {
-		return ip.Int() < jp.Int() || (ip.Int() == jp.Int() && ip.Proto() == "tcp")
-	})
-
-	first := ports[0]
-	if fmt.Sprint(first) != "6379/tcp" {
-		t.Fail()
-	}
-}
-
-func TestSortPortMap(t *testing.T) {
-	ports := []Port{
-		Port("22/tcp"),
-		Port("22/udp"),
-		Port("8000/tcp"),
-		Port("6379/tcp"),
-		Port("9999/tcp"),
-	}
-
-	portMap := PortMap{
-		Port("22/tcp"): []PortBinding{
-			{},
-		},
-		Port("8000/tcp"): []PortBinding{
-			{},
-		},
-		Port("6379/tcp"): []PortBinding{
-			{},
-			{HostIP: "0.0.0.0", HostPort: "32749"},
-		},
-		Port("9999/tcp"): []PortBinding{
-			{HostIP: "0.0.0.0", HostPort: "40000"},
-		},
-	}
-
-	SortPortMap(ports, portMap)
-	if !reflect.DeepEqual(ports, []Port{
-		Port("9999/tcp"),
-		Port("6379/tcp"),
-		Port("8000/tcp"),
-		Port("22/tcp"),
-		Port("22/udp"),
-	}) {
-		t.Errorf("failed to prioritize port with explicit mappings, got %v", ports)
-	}
-	if pm := portMap[Port("6379/tcp")]; !reflect.DeepEqual(pm, []PortBinding{
-		{HostIP: "0.0.0.0", HostPort: "32749"},
-		{},
-	}) {
-		t.Errorf("failed to prioritize bindings with explicit mappings, got %v", pm)
-	}
-}
diff --git a/vendor/src/github.com/docker/go-connections/proxy/network_proxy_test.go b/vendor/src/github.com/docker/go-connections/proxy/network_proxy_test.go
deleted file mode 100644
index 9e382567c5..0000000000
--- a/vendor/src/github.com/docker/go-connections/proxy/network_proxy_test.go
+++ /dev/null
@@ -1,216 +0,0 @@
-package proxy
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"net"
-	"strings"
-	"testing"
-	"time"
-)
-
-var testBuf = []byte("Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo")
-var testBufSize = len(testBuf)
-
-type EchoServer interface {
-	Run()
-	Close()
-	LocalAddr() net.Addr
-}
-
-type TCPEchoServer struct {
-	listener net.Listener
-	testCtx  *testing.T
-}
-
-type UDPEchoServer struct {
-	conn    net.PacketConn
-	testCtx *testing.T
-}
-
-func NewEchoServer(t *testing.T, proto, address string) EchoServer {
-	var server EchoServer
-	if strings.HasPrefix(proto, "tcp") {
-		listener, err := net.Listen(proto, address)
-		if err != nil {
-			t.Fatal(err)
-		}
-		server = &TCPEchoServer{listener: listener, testCtx: t}
-	} else {
-		socket, err := net.ListenPacket(proto, address)
-		if err != nil {
-			t.Fatal(err)
-		}
-		server = &UDPEchoServer{conn: socket, testCtx: t}
-	}
-	return server
-}
-
-func (server *TCPEchoServer) Run() {
-	go func() {
-		for {
-			client, err := server.listener.Accept()
-			if err != nil {
-				return
-			}
-			go func(client net.Conn) {
-				if _, err := io.Copy(client, client); err != nil {
-					server.testCtx.Logf("can't echo to the client: %v\n", err.Error())
-				}
-				client.Close()
-			}(client)
-		}
-	}()
-}
-
-func (server *TCPEchoServer) LocalAddr() net.Addr { return server.listener.Addr() }
-func (server *TCPEchoServer) Close()              { server.listener.Addr() }
-
-func (server *UDPEchoServer) Run() {
-	go func() {
-		readBuf := make([]byte, 1024)
-		for {
-			read, from, err := server.conn.ReadFrom(readBuf)
-			if err != nil {
-				return
-			}
-			for i := 0; i != read; {
-				written, err := server.conn.WriteTo(readBuf[i:read], from)
-				if err != nil {
-					break
-				}
-				i += written
-			}
-		}
-	}()
-}
-
-func (server *UDPEchoServer) LocalAddr() net.Addr { return server.conn.LocalAddr() }
-func (server *UDPEchoServer) Close()              { server.conn.Close() }
-
-func testProxyAt(t *testing.T, proto string, proxy Proxy, addr string) {
-	defer proxy.Close()
-	go proxy.Run()
-	client, err := net.Dial(proto, addr)
-	if err != nil {
-		t.Fatalf("Can't connect to the proxy: %v", err)
-	}
-	defer client.Close()
-	client.SetDeadline(time.Now().Add(10 * time.Second))
-	if _, err = client.Write(testBuf); err != nil {
-		t.Fatal(err)
-	}
-	recvBuf := make([]byte, testBufSize)
-	if _, err = client.Read(recvBuf); err != nil {
-		t.Fatal(err)
-	}
-	if !bytes.Equal(testBuf, recvBuf) {
-		t.Fatal(fmt.Errorf("Expected [%v] but got [%v]", testBuf, recvBuf))
-	}
-}
-
-func testProxy(t *testing.T, proto string, proxy Proxy) {
-	testProxyAt(t, proto, proxy, proxy.FrontendAddr().String())
-}
-
-func TestTCP4Proxy(t *testing.T) {
-	backend := NewEchoServer(t, "tcp", "127.0.0.1:0")
-	defer backend.Close()
-	backend.Run()
-	frontendAddr := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0}
-	proxy, err := NewProxy(frontendAddr, backend.LocalAddr())
-	if err != nil {
-		t.Fatal(err)
-	}
-	testProxy(t, "tcp", proxy)
-}
-
-func TestTCP6Proxy(t *testing.T) {
-	backend := NewEchoServer(t, "tcp", "[::1]:0")
-	defer backend.Close()
-	backend.Run()
-	frontendAddr := &net.TCPAddr{IP: net.IPv6loopback, Port: 0}
-	proxy, err := NewProxy(frontendAddr, backend.LocalAddr())
-	if err != nil {
-		t.Fatal(err)
-	}
-	testProxy(t, "tcp", proxy)
-}
-
-func TestTCPDualStackProxy(t *testing.T) {
-	// If I understand `godoc -src net favoriteAddrFamily` (used by the
-	// net.Listen* functions) correctly this should work, but it doesn't.
-	t.Skip("No support for dual stack yet")
-	backend := NewEchoServer(t, "tcp", "[::1]:0")
-	defer backend.Close()
-	backend.Run()
-	frontendAddr := &net.TCPAddr{IP: net.IPv6loopback, Port: 0}
-	proxy, err := NewProxy(frontendAddr, backend.LocalAddr())
-	if err != nil {
-		t.Fatal(err)
-	}
-	ipv4ProxyAddr := &net.TCPAddr{
-		IP:   net.IPv4(127, 0, 0, 1),
-		Port: proxy.FrontendAddr().(*net.TCPAddr).Port,
-	}
-	testProxyAt(t, "tcp", proxy, ipv4ProxyAddr.String())
-}
-
-func TestUDP4Proxy(t *testing.T) {
-	backend := NewEchoServer(t, "udp", "127.0.0.1:0")
-	defer backend.Close()
-	backend.Run()
-	frontendAddr := &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0}
-	proxy, err := NewProxy(frontendAddr, backend.LocalAddr())
-	if err != nil {
-		t.Fatal(err)
-	}
-	testProxy(t, "udp", proxy)
-}
-
-func TestUDP6Proxy(t *testing.T) {
-	backend := NewEchoServer(t, "udp", "[::1]:0")
-	defer backend.Close()
-	backend.Run()
-	frontendAddr := &net.UDPAddr{IP: net.IPv6loopback, Port: 0}
-	proxy, err := NewProxy(frontendAddr, backend.LocalAddr())
-	if err != nil {
-		t.Fatal(err)
-	}
-	testProxy(t, "udp", proxy)
-}
-
-func TestUDPWriteError(t *testing.T) {
-	frontendAddr := &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0}
-	// Hopefully, this port will be free: */
-	backendAddr := &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 25587}
-	proxy, err := NewProxy(frontendAddr, backendAddr)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer proxy.Close()
-	go proxy.Run()
-	client, err := net.Dial("udp", "127.0.0.1:25587")
-	if err != nil {
-		t.Fatalf("Can't connect to the proxy: %v", err)
-	}
-	defer client.Close()
-	// Make sure the proxy doesn't stop when there is no actual backend:
-	client.Write(testBuf)
-	client.Write(testBuf)
-	backend := NewEchoServer(t, "udp", "127.0.0.1:25587")
-	defer backend.Close()
-	backend.Run()
-	client.SetDeadline(time.Now().Add(10 * time.Second))
-	if _, err = client.Write(testBuf); err != nil {
-		t.Fatal(err)
-	}
-	recvBuf := make([]byte, testBufSize)
-	if _, err = client.Read(recvBuf); err != nil {
-		t.Fatal(err)
-	}
-	if !bytes.Equal(testBuf, recvBuf) {
-		t.Fatal(fmt.Errorf("Expected [%v] but got [%v]", testBuf, recvBuf))
-	}
-}
diff --git a/vendor/src/github.com/docker/go-connections/proxy/proxy.go b/vendor/src/github.com/docker/go-connections/proxy/proxy.go
deleted file mode 100644
index 537aebb7ca..0000000000
--- a/vendor/src/github.com/docker/go-connections/proxy/proxy.go
+++ /dev/null
@@ -1,36 +0,0 @@
-// Package proxy provides a network Proxy interface and implementations for TCP and UDP.
-package proxy
-
-import (
-	"fmt"
-	"net"
-)
-
-// Proxy defines the behavior of a proxy. It forwards traffic back and forth
-// between two endpoints : the frontend and the backend.
-// It can be used to do software port-mapping between two addresses.
-// e.g. forward all traffic between the frontend (host) 127.0.0.1:3000
-// to the backend (container) at 172.17.42.108:4000.
-type Proxy interface {
-	// Run starts forwarding traffic back and forth between the front
-	// and back-end addresses.
-	Run()
-	// Close stops forwarding traffic and close both ends of the Proxy.
-	Close()
-	// FrontendAddr returns the address on which the proxy is listening.
-	FrontendAddr() net.Addr
-	// BackendAddr returns the proxied address.
-	BackendAddr() net.Addr
-}
-
-// NewProxy creates a Proxy according to the specified frontendAddr and backendAddr.
-func NewProxy(frontendAddr, backendAddr net.Addr) (Proxy, error) {
-	switch frontendAddr.(type) {
-	case *net.UDPAddr:
-		return NewUDPProxy(frontendAddr.(*net.UDPAddr), backendAddr.(*net.UDPAddr))
-	case *net.TCPAddr:
-		return NewTCPProxy(frontendAddr.(*net.TCPAddr), backendAddr.(*net.TCPAddr))
-	default:
-		panic(fmt.Errorf("Unsupported protocol"))
-	}
-}
diff --git a/vendor/src/github.com/docker/go-connections/proxy/stub_proxy.go b/vendor/src/github.com/docker/go-connections/proxy/stub_proxy.go
deleted file mode 100644
index 571749e467..0000000000
--- a/vendor/src/github.com/docker/go-connections/proxy/stub_proxy.go
+++ /dev/null
@@ -1,31 +0,0 @@
-package proxy
-
-import (
-	"net"
-)
-
-// StubProxy is a proxy that is a stub (does nothing).
-type StubProxy struct {
-	frontendAddr net.Addr
-	backendAddr  net.Addr
-}
-
-// Run does nothing.
-func (p *StubProxy) Run() {}
-
-// Close does nothing.
-func (p *StubProxy) Close() {}
-
-// FrontendAddr returns the frontend address.
-func (p *StubProxy) FrontendAddr() net.Addr { return p.frontendAddr }
-
-// BackendAddr returns the backend address.
-func (p *StubProxy) BackendAddr() net.Addr { return p.backendAddr }
-
-// NewStubProxy creates a new StubProxy
-func NewStubProxy(frontendAddr, backendAddr net.Addr) (Proxy, error) {
-	return &StubProxy{
-		frontendAddr: frontendAddr,
-		backendAddr:  backendAddr,
-	}, nil
-}
diff --git a/vendor/src/github.com/docker/go-connections/proxy/tcp_proxy.go b/vendor/src/github.com/docker/go-connections/proxy/tcp_proxy.go
deleted file mode 100644
index 3cd742af76..0000000000
--- a/vendor/src/github.com/docker/go-connections/proxy/tcp_proxy.go
+++ /dev/null
@@ -1,99 +0,0 @@
-package proxy
-
-import (
-	"io"
-	"net"
-	"syscall"
-
-	"github.com/Sirupsen/logrus"
-)
-
-// TCPProxy is a proxy for TCP connections. It implements the Proxy interface to
-// handle TCP traffic forwarding between the frontend and backend addresses.
-type TCPProxy struct {
-	listener     *net.TCPListener
-	frontendAddr *net.TCPAddr
-	backendAddr  *net.TCPAddr
-}
-
-// NewTCPProxy creates a new TCPProxy.
-func NewTCPProxy(frontendAddr, backendAddr *net.TCPAddr) (*TCPProxy, error) {
-	listener, err := net.ListenTCP("tcp", frontendAddr)
-	if err != nil {
-		return nil, err
-	}
-	// If the port in frontendAddr was 0 then ListenTCP will have a picked
-	// a port to listen on, hence the call to Addr to get that actual port:
-	return &TCPProxy{
-		listener:     listener,
-		frontendAddr: listener.Addr().(*net.TCPAddr),
-		backendAddr:  backendAddr,
-	}, nil
-}
-
-func (proxy *TCPProxy) clientLoop(client *net.TCPConn, quit chan bool) {
-	backend, err := net.DialTCP("tcp", nil, proxy.backendAddr)
-	if err != nil {
-		logrus.Printf("Can't forward traffic to backend tcp/%v: %s\n", proxy.backendAddr, err)
-		client.Close()
-		return
-	}
-
-	event := make(chan int64)
-	var broker = func(to, from *net.TCPConn) {
-		written, err := io.Copy(to, from)
-		if err != nil {
-			// If the socket we are writing to is shutdown with
-			// SHUT_WR, forward it to the other end of the pipe:
-			if err, ok := err.(*net.OpError); ok && err.Err == syscall.EPIPE {
-				from.CloseWrite()
-			}
-		}
-		to.CloseRead()
-		event <- written
-	}
-
-	go broker(client, backend)
-	go broker(backend, client)
-
-	var transferred int64
-	for i := 0; i < 2; i++ {
-		select {
-		case written := <-event:
-			transferred += written
-		case <-quit:
-			// Interrupt the two brokers and "join" them.
-			client.Close()
-			backend.Close()
-			for ; i < 2; i++ {
-				transferred += <-event
-			}
-			return
-		}
-	}
-	client.Close()
-	backend.Close()
-}
-
-// Run starts forwarding the traffic using TCP.
-func (proxy *TCPProxy) Run() {
-	quit := make(chan bool)
-	defer close(quit)
-	for {
-		client, err := proxy.listener.Accept()
-		if err != nil {
-			logrus.Printf("Stopping proxy on tcp/%v for tcp/%v (%s)", proxy.frontendAddr, proxy.backendAddr, err)
-			return
-		}
-		go proxy.clientLoop(client.(*net.TCPConn), quit)
-	}
-}
-
-// Close stops forwarding the traffic.
-func (proxy *TCPProxy) Close() { proxy.listener.Close() }
-
-// FrontendAddr returns the TCP address on which the proxy is listening.
-func (proxy *TCPProxy) FrontendAddr() net.Addr { return proxy.frontendAddr }
-
-// BackendAddr returns the TCP proxied address.
-func (proxy *TCPProxy) BackendAddr() net.Addr { return proxy.backendAddr }
diff --git a/vendor/src/github.com/docker/go-connections/proxy/udp_proxy.go b/vendor/src/github.com/docker/go-connections/proxy/udp_proxy.go
deleted file mode 100644
index b8375c374f..0000000000
--- a/vendor/src/github.com/docker/go-connections/proxy/udp_proxy.go
+++ /dev/null
@@ -1,169 +0,0 @@
-package proxy
-
-import (
-	"encoding/binary"
-	"net"
-	"strings"
-	"sync"
-	"syscall"
-	"time"
-
-	"github.com/Sirupsen/logrus"
-)
-
-const (
-	// UDPConnTrackTimeout is the timeout used for UDP connection tracking
-	UDPConnTrackTimeout = 90 * time.Second
-	// UDPBufSize is the buffer size for the UDP proxy
-	UDPBufSize = 65507
-)
-
-// A net.Addr where the IP is split into two fields so you can use it as a key
-// in a map:
-type connTrackKey struct {
-	IPHigh uint64
-	IPLow  uint64
-	Port   int
-}
-
-func newConnTrackKey(addr *net.UDPAddr) *connTrackKey {
-	if len(addr.IP) == net.IPv4len {
-		return &connTrackKey{
-			IPHigh: 0,
-			IPLow:  uint64(binary.BigEndian.Uint32(addr.IP)),
-			Port:   addr.Port,
-		}
-	}
-	return &connTrackKey{
-		IPHigh: binary.BigEndian.Uint64(addr.IP[:8]),
-		IPLow:  binary.BigEndian.Uint64(addr.IP[8:]),
-		Port:   addr.Port,
-	}
-}
-
-type connTrackMap map[connTrackKey]*net.UDPConn
-
-// UDPProxy is proxy for which handles UDP datagrams. It implements the Proxy
-// interface to handle UDP traffic forwarding between the frontend and backend
-// addresses.
-type UDPProxy struct {
-	listener       *net.UDPConn
-	frontendAddr   *net.UDPAddr
-	backendAddr    *net.UDPAddr
-	connTrackTable connTrackMap
-	connTrackLock  sync.Mutex
-}
-
-// NewUDPProxy creates a new UDPProxy.
-func NewUDPProxy(frontendAddr, backendAddr *net.UDPAddr) (*UDPProxy, error) {
-	listener, err := net.ListenUDP("udp", frontendAddr)
-	if err != nil {
-		return nil, err
-	}
-	return &UDPProxy{
-		listener:       listener,
-		frontendAddr:   listener.LocalAddr().(*net.UDPAddr),
-		backendAddr:    backendAddr,
-		connTrackTable: make(connTrackMap),
-	}, nil
-}
-
-func (proxy *UDPProxy) replyLoop(proxyConn *net.UDPConn, clientAddr *net.UDPAddr, clientKey *connTrackKey) {
-	defer func() {
-		proxy.connTrackLock.Lock()
-		delete(proxy.connTrackTable, *clientKey)
-		proxy.connTrackLock.Unlock()
-		proxyConn.Close()
-	}()
-
-	readBuf := make([]byte, UDPBufSize)
-	for {
-		proxyConn.SetReadDeadline(time.Now().Add(UDPConnTrackTimeout))
-	again:
-		read, err := proxyConn.Read(readBuf)
-		if err != nil {
-			if err, ok := err.(*net.OpError); ok && err.Err == syscall.ECONNREFUSED {
-				// This will happen if the last write failed
-				// (e.g: nothing is actually listening on the
-				// proxied port on the container), ignore it
-				// and continue until UDPConnTrackTimeout
-				// expires:
-				goto again
-			}
-			return
-		}
-		for i := 0; i != read; {
-			written, err := proxy.listener.WriteToUDP(readBuf[i:read], clientAddr)
-			if err != nil {
-				return
-			}
-			i += written
-		}
-	}
-}
-
-// Run starts forwarding the traffic using UDP.
-func (proxy *UDPProxy) Run() {
-	readBuf := make([]byte, UDPBufSize)
-	for {
-		read, from, err := proxy.listener.ReadFromUDP(readBuf)
-		if err != nil {
-			// NOTE: Apparently ReadFrom doesn't return
-			// ECONNREFUSED like Read do (see comment in
-			// UDPProxy.replyLoop)
-			if !isClosedError(err) {
-				logrus.Printf("Stopping proxy on udp/%v for udp/%v (%s)", proxy.frontendAddr, proxy.backendAddr, err)
-			}
-			break
-		}
-
-		fromKey := newConnTrackKey(from)
-		proxy.connTrackLock.Lock()
-		proxyConn, hit := proxy.connTrackTable[*fromKey]
-		if !hit {
-			proxyConn, err = net.DialUDP("udp", nil, proxy.backendAddr)
-			if err != nil {
-				logrus.Printf("Can't proxy a datagram to udp/%s: %s\n", proxy.backendAddr, err)
-				proxy.connTrackLock.Unlock()
-				continue
-			}
-			proxy.connTrackTable[*fromKey] = proxyConn
-			go proxy.replyLoop(proxyConn, from, fromKey)
-		}
-		proxy.connTrackLock.Unlock()
-		for i := 0; i != read; {
-			written, err := proxyConn.Write(readBuf[i:read])
-			if err != nil {
-				logrus.Printf("Can't proxy a datagram to udp/%s: %s\n", proxy.backendAddr, err)
-				break
-			}
-			i += written
-		}
-	}
-}
-
-// Close stops forwarding the traffic.
-func (proxy *UDPProxy) Close() {
-	proxy.listener.Close()
-	proxy.connTrackLock.Lock()
-	defer proxy.connTrackLock.Unlock()
-	for _, conn := range proxy.connTrackTable {
-		conn.Close()
-	}
-}
-
-// FrontendAddr returns the UDP address on which the proxy is listening.
-func (proxy *UDPProxy) FrontendAddr() net.Addr { return proxy.frontendAddr }
-
-// BackendAddr returns the proxied UDP address.
-func (proxy *UDPProxy) BackendAddr() net.Addr { return proxy.backendAddr }
-
-func isClosedError(err error) bool {
-	/* This comparison is ugly, but unfortunately, net.go doesn't export errClosing.
-	 * See:
-	 * http://golang.org/src/pkg/net/net.go
-	 * https://code.google.com/p/go/issues/detail?id=4337
-	 * https://groups.google.com/forum/#!msg/golang-nuts/0_aaCvBmOcM/SptmDyX1XJMJ
-	 */
-	return strings.HasSuffix(err.Error(), "use of closed network connection")
-}
diff --git a/vendor/src/github.com/docker/go-units/README.md b/vendor/src/github.com/docker/go-units/README.md
index f1d46d1626..e2fb4051f4 100644
--- a/vendor/src/github.com/docker/go-units/README.md
+++ b/vendor/src/github.com/docker/go-units/README.md
@@ -1,3 +1,5 @@
+[![GoDoc](https://godoc.org/github.com/docker/go-units?status.svg)](https://godoc.org/github.com/docker/go-units)
+
 # Introduction
 
 go-units is a library to transform human friendly measurements into machine friendly values.
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/apply_raw.go b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/apply_raw.go
index 68ebcfefbf..0c4d207ee7 100644
--- a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/apply_raw.go
+++ b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/apply_raw.go
@@ -137,7 +137,7 @@ func (m *Manager) Apply(pid int) (err error) {
 	m.Paths = paths
 
 	if paths["cpu"] != "" {
-		if err := CheckCpushares(paths["cpu"], c.CpuShares); err != nil {
+		if err := CheckCpushares(paths["cpu"], c.Resources.CpuShares); err != nil {
 			return err
 		}
 	}
@@ -202,15 +202,15 @@ func (m *Manager) Freeze(state configs.FreezerState) error {
 	if err != nil {
 		return err
 	}
-	prevState := m.Cgroups.Freezer
-	m.Cgroups.Freezer = state
+	prevState := m.Cgroups.Resources.Freezer
+	m.Cgroups.Resources.Freezer = state
 	freezer, err := subsystems.Get("freezer")
 	if err != nil {
 		return err
 	}
 	err = freezer.Set(dir, m.Cgroups)
 	if err != nil {
-		m.Cgroups.Freezer = prevState
+		m.Cgroups.Resources.Freezer = prevState
 		return err
 	}
 	return nil
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/blkio.go b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/blkio.go
index eddba0bf8b..518cb63f63 100644
--- a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/blkio.go
+++ b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/blkio.go
@@ -35,18 +35,18 @@ func (s *BlkioGroup) Apply(d *cgroupData) error {
 }
 
 func (s *BlkioGroup) Set(path string, cgroup *configs.Cgroup) error {
-	if cgroup.BlkioWeight != 0 {
-		if err := writeFile(path, "blkio.weight", strconv.FormatUint(uint64(cgroup.BlkioWeight), 10)); err != nil {
+	if cgroup.Resources.BlkioWeight != 0 {
+		if err := writeFile(path, "blkio.weight", strconv.FormatUint(uint64(cgroup.Resources.BlkioWeight), 10)); err != nil {
 			return err
 		}
 	}
 
-	if cgroup.BlkioLeafWeight != 0 {
-		if err := writeFile(path, "blkio.leaf_weight", strconv.FormatUint(uint64(cgroup.BlkioLeafWeight), 10)); err != nil {
+	if cgroup.Resources.BlkioLeafWeight != 0 {
+		if err := writeFile(path, "blkio.leaf_weight", strconv.FormatUint(uint64(cgroup.Resources.BlkioLeafWeight), 10)); err != nil {
 			return err
 		}
 	}
-	for _, wd := range cgroup.BlkioWeightDevice {
+	for _, wd := range cgroup.Resources.BlkioWeightDevice {
 		if err := writeFile(path, "blkio.weight_device", wd.WeightString()); err != nil {
 			return err
 		}
@@ -54,22 +54,22 @@ func (s *BlkioGroup) Set(path string, cgroup *configs.Cgroup) error {
 			return err
 		}
 	}
-	for _, td := range cgroup.BlkioThrottleReadBpsDevice {
+	for _, td := range cgroup.Resources.BlkioThrottleReadBpsDevice {
 		if err := writeFile(path, "blkio.throttle.read_bps_device", td.String()); err != nil {
 			return err
 		}
 	}
-	for _, td := range cgroup.BlkioThrottleWriteBpsDevice {
+	for _, td := range cgroup.Resources.BlkioThrottleWriteBpsDevice {
 		if err := writeFile(path, "blkio.throttle.write_bps_device", td.String()); err != nil {
 			return err
 		}
 	}
-	for _, td := range cgroup.BlkioThrottleReadIOPSDevice {
+	for _, td := range cgroup.Resources.BlkioThrottleReadIOPSDevice {
 		if err := writeFile(path, "blkio.throttle.read_iops_device", td.String()); err != nil {
 			return err
 		}
 	}
-	for _, td := range cgroup.BlkioThrottleWriteIOPSDevice {
+	for _, td := range cgroup.Resources.BlkioThrottleWriteIOPSDevice {
 		if err := writeFile(path, "blkio.throttle.write_iops_device", td.String()); err != nil {
 			return err
 		}
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpu.go b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpu.go
index 762a68fe80..ad5f427ec2 100644
--- a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpu.go
+++ b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpu.go
@@ -35,28 +35,28 @@ func (s *CpuGroup) Apply(d *cgroupData) error {
 }
 
 func (s *CpuGroup) Set(path string, cgroup *configs.Cgroup) error {
-	if cgroup.CpuShares != 0 {
-		if err := writeFile(path, "cpu.shares", strconv.FormatInt(cgroup.CpuShares, 10)); err != nil {
+	if cgroup.Resources.CpuShares != 0 {
+		if err := writeFile(path, "cpu.shares", strconv.FormatInt(cgroup.Resources.CpuShares, 10)); err != nil {
 			return err
 		}
 	}
-	if cgroup.CpuPeriod != 0 {
-		if err := writeFile(path, "cpu.cfs_period_us", strconv.FormatInt(cgroup.CpuPeriod, 10)); err != nil {
+	if cgroup.Resources.CpuPeriod != 0 {
+		if err := writeFile(path, "cpu.cfs_period_us", strconv.FormatInt(cgroup.Resources.CpuPeriod, 10)); err != nil {
 			return err
 		}
 	}
-	if cgroup.CpuQuota != 0 {
-		if err := writeFile(path, "cpu.cfs_quota_us", strconv.FormatInt(cgroup.CpuQuota, 10)); err != nil {
+	if cgroup.Resources.CpuQuota != 0 {
+		if err := writeFile(path, "cpu.cfs_quota_us", strconv.FormatInt(cgroup.Resources.CpuQuota, 10)); err != nil {
 			return err
 		}
 	}
-	if cgroup.CpuRtPeriod != 0 {
-		if err := writeFile(path, "cpu.rt_period_us", strconv.FormatInt(cgroup.CpuRtPeriod, 10)); err != nil {
+	if cgroup.Resources.CpuRtPeriod != 0 {
+		if err := writeFile(path, "cpu.rt_period_us", strconv.FormatInt(cgroup.Resources.CpuRtPeriod, 10)); err != nil {
 			return err
 		}
 	}
-	if cgroup.CpuRtRuntime != 0 {
-		if err := writeFile(path, "cpu.rt_runtime_us", strconv.FormatInt(cgroup.CpuRtRuntime, 10)); err != nil {
+	if cgroup.Resources.CpuRtRuntime != 0 {
+		if err := writeFile(path, "cpu.rt_runtime_us", strconv.FormatInt(cgroup.Resources.CpuRtRuntime, 10)); err != nil {
 			return err
 		}
 	}
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpuset.go b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpuset.go
index 088a665b97..b7632108f8 100644
--- a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpuset.go
+++ b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpuset.go
@@ -29,13 +29,13 @@ func (s *CpusetGroup) Apply(d *cgroupData) error {
 }
 
 func (s *CpusetGroup) Set(path string, cgroup *configs.Cgroup) error {
-	if cgroup.CpusetCpus != "" {
-		if err := writeFile(path, "cpuset.cpus", cgroup.CpusetCpus); err != nil {
+	if cgroup.Resources.CpusetCpus != "" {
+		if err := writeFile(path, "cpuset.cpus", cgroup.Resources.CpusetCpus); err != nil {
 			return err
 		}
 	}
-	if cgroup.CpusetMems != "" {
-		if err := writeFile(path, "cpuset.mems", cgroup.CpusetMems); err != nil {
+	if cgroup.Resources.CpusetMems != "" {
+		if err := writeFile(path, "cpuset.mems", cgroup.Resources.CpusetMems); err != nil {
 			return err
 		}
 	}
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/devices.go b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/devices.go
index 1e39618a46..a9883eb4bb 100644
--- a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/devices.go
+++ b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/devices.go
@@ -30,12 +30,12 @@ func (s *DevicesGroup) Apply(d *cgroupData) error {
 }
 
 func (s *DevicesGroup) Set(path string, cgroup *configs.Cgroup) error {
-	if !cgroup.AllowAllDevices {
+	if !cgroup.Resources.AllowAllDevices {
 		if err := writeFile(path, "devices.deny", "a"); err != nil {
 			return err
 		}
 
-		for _, dev := range cgroup.AllowedDevices {
+		for _, dev := range cgroup.Resources.AllowedDevices {
 			if err := writeFile(path, "devices.allow", dev.CgroupString()); err != nil {
 				return err
 			}
@@ -47,7 +47,7 @@ func (s *DevicesGroup) Set(path string, cgroup *configs.Cgroup) error {
 		return err
 	}
 
-	for _, dev := range cgroup.DeniedDevices {
+	for _, dev := range cgroup.Resources.DeniedDevices {
 		if err := writeFile(path, "devices.deny", dev.CgroupString()); err != nil {
 			return err
 		}
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/freezer.go b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/freezer.go
index 8960ec789c..6aaad4e009 100644
--- a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/freezer.go
+++ b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/freezer.go
@@ -32,9 +32,9 @@ func (s *FreezerGroup) Apply(d *cgroupData) error {
 }
 
 func (s *FreezerGroup) Set(path string, cgroup *configs.Cgroup) error {
-	switch cgroup.Freezer {
+	switch cgroup.Resources.Freezer {
 	case configs.Frozen, configs.Thawed:
-		if err := writeFile(path, "freezer.state", string(cgroup.Freezer)); err != nil {
+		if err := writeFile(path, "freezer.state", string(cgroup.Resources.Freezer)); err != nil {
 			return err
 		}
 
@@ -43,7 +43,7 @@ func (s *FreezerGroup) Set(path string, cgroup *configs.Cgroup) error {
 			if err != nil {
 				return err
 			}
-			if strings.TrimSpace(state) == string(cgroup.Freezer) {
+			if strings.TrimSpace(state) == string(cgroup.Resources.Freezer) {
 				break
 			}
 			time.Sleep(1 * time.Millisecond)
@@ -51,7 +51,7 @@ func (s *FreezerGroup) Set(path string, cgroup *configs.Cgroup) error {
 	case configs.Undefined:
 		return nil
 	default:
-		return fmt.Errorf("Invalid argument '%s' to freezer.state", string(cgroup.Freezer))
+		return fmt.Errorf("Invalid argument '%s' to freezer.state", string(cgroup.Resources.Freezer))
 	}
 
 	return nil
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/hugetlb.go b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/hugetlb.go
index b11365370f..ca106da44d 100644
--- a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/hugetlb.go
+++ b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/hugetlb.go
@@ -32,7 +32,7 @@ func (s *HugetlbGroup) Apply(d *cgroupData) error {
 }
 
 func (s *HugetlbGroup) Set(path string, cgroup *configs.Cgroup) error {
-	for _, hugetlb := range cgroup.HugetlbLimit {
+	for _, hugetlb := range cgroup.Resources.HugetlbLimit {
 		if err := writeFile(path, strings.Join([]string{"hugetlb", hugetlb.Pagesize, "limit_in_bytes"}, "."), strconv.FormatUint(hugetlb.Limit, 10)); err != nil {
 			return err
 		}
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/memory.go b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/memory.go
index e5ffde4b6d..6b9687ca2f 100644
--- a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/memory.go
+++ b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/memory.go
@@ -55,40 +55,40 @@ func (s *MemoryGroup) Apply(d *cgroupData) (err error) {
 }
 
 func (s *MemoryGroup) Set(path string, cgroup *configs.Cgroup) error {
-	if cgroup.Memory != 0 {
-		if err := writeFile(path, "memory.limit_in_bytes", strconv.FormatInt(cgroup.Memory, 10)); err != nil {
+	if cgroup.Resources.Memory != 0 {
+		if err := writeFile(path, "memory.limit_in_bytes", strconv.FormatInt(cgroup.Resources.Memory, 10)); err != nil {
 			return err
 		}
 	}
-	if cgroup.MemoryReservation != 0 {
-		if err := writeFile(path, "memory.soft_limit_in_bytes", strconv.FormatInt(cgroup.MemoryReservation, 10)); err != nil {
+	if cgroup.Resources.MemoryReservation != 0 {
+		if err := writeFile(path, "memory.soft_limit_in_bytes", strconv.FormatInt(cgroup.Resources.MemoryReservation, 10)); err != nil {
 			return err
 		}
 	}
-	if cgroup.MemorySwap > 0 {
-		if err := writeFile(path, "memory.memsw.limit_in_bytes", strconv.FormatInt(cgroup.MemorySwap, 10)); err != nil {
+	if cgroup.Resources.MemorySwap > 0 {
+		if err := writeFile(path, "memory.memsw.limit_in_bytes", strconv.FormatInt(cgroup.Resources.MemorySwap, 10)); err != nil {
 			return err
 		}
 	}
-	if cgroup.KernelMemory > 0 {
-		if err := writeFile(path, "memory.kmem.limit_in_bytes", strconv.FormatInt(cgroup.KernelMemory, 10)); err != nil {
+	if cgroup.Resources.KernelMemory > 0 {
+		if err := writeFile(path, "memory.kmem.limit_in_bytes", strconv.FormatInt(cgroup.Resources.KernelMemory, 10)); err != nil {
 			return err
 		}
 	}
 
-	if cgroup.OomKillDisable {
+	if cgroup.Resources.OomKillDisable {
 		if err := writeFile(path, "memory.oom_control", "1"); err != nil {
 			return err
 		}
 	}
-	if cgroup.MemorySwappiness >= 0 && cgroup.MemorySwappiness <= 100 {
-		if err := writeFile(path, "memory.swappiness", strconv.FormatInt(cgroup.MemorySwappiness, 10)); err != nil {
+	if cgroup.Resources.MemorySwappiness >= 0 && cgroup.Resources.MemorySwappiness <= 100 {
+		if err := writeFile(path, "memory.swappiness", strconv.FormatInt(cgroup.Resources.MemorySwappiness, 10)); err != nil {
 			return err
 		}
-	} else if cgroup.MemorySwappiness == -1 {
+	} else if cgroup.Resources.MemorySwappiness == -1 {
 		return nil
 	} else {
-		return fmt.Errorf("invalid value:%d. valid memory swappiness range is 0-100", cgroup.MemorySwappiness)
+		return fmt.Errorf("invalid value:%d. valid memory swappiness range is 0-100", cgroup.Resources.MemorySwappiness)
 	}
 
 	return nil
@@ -139,12 +139,12 @@ func (s *MemoryGroup) GetStats(path string, stats *cgroups.Stats) error {
 }
 
 func memoryAssigned(cgroup *configs.Cgroup) bool {
-	return cgroup.Memory != 0 ||
-		cgroup.MemoryReservation != 0 ||
-		cgroup.MemorySwap > 0 ||
-		cgroup.KernelMemory > 0 ||
-		cgroup.OomKillDisable ||
-		cgroup.MemorySwappiness != -1
+	return cgroup.Resources.Memory != 0 ||
+		cgroup.Resources.MemoryReservation != 0 ||
+		cgroup.Resources.MemorySwap > 0 ||
+		cgroup.Resources.KernelMemory > 0 ||
+		cgroup.Resources.OomKillDisable ||
+		cgroup.Resources.MemorySwappiness != -1
 }
 
 func getMemoryData(path, name string) (cgroups.MemoryData, error) {
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/net_cls.go b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/net_cls.go
index b09a1760e4..6382373127 100644
--- a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/net_cls.go
+++ b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/net_cls.go
@@ -28,8 +28,8 @@ func (s *NetClsGroup) Apply(d *cgroupData) error {
 }
 
 func (s *NetClsGroup) Set(path string, cgroup *configs.Cgroup) error {
-	if cgroup.NetClsClassid != "" {
-		if err := writeFile(path, "net_cls.classid", cgroup.NetClsClassid); err != nil {
+	if cgroup.Resources.NetClsClassid != "" {
+		if err := writeFile(path, "net_cls.classid", cgroup.Resources.NetClsClassid); err != nil {
 			return err
 		}
 	}
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/net_prio.go b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/net_prio.go
index 59117cad91..0dabaae729 100644
--- a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/net_prio.go
+++ b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/fs/net_prio.go
@@ -28,7 +28,7 @@ func (s *NetPrioGroup) Apply(d *cgroupData) error {
 }
 
 func (s *NetPrioGroup) Set(path string, cgroup *configs.Cgroup) error {
-	for _, prioMap := range cgroup.NetPrioIfpriomap {
+	for _, prioMap := range cgroup.Resources.NetPrioIfpriomap {
 		if err := writeFile(path, "net_prio.ifpriomap", prioMap.CgroupString()); err != nil {
 			return err
 		}
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/systemd/apply_systemd.go b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/systemd/apply_systemd.go
index 41b6fbcd8a..93300cda38 100644
--- a/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/systemd/apply_systemd.go
+++ b/vendor/src/github.com/opencontainers/runc/libcontainer/cgroups/systemd/apply_systemd.go
@@ -189,26 +189,26 @@ func (m *Manager) Apply(pid int) error {
 			newProp("DefaultDependencies", false))
 	}
 
-	if c.Memory != 0 {
+	if c.Resources.Memory != 0 {
 		properties = append(properties,
-			newProp("MemoryLimit", uint64(c.Memory)))
+			newProp("MemoryLimit", uint64(c.Resources.Memory)))
 	}
 
-	if c.CpuShares != 0 {
+	if c.Resources.CpuShares != 0 {
 		properties = append(properties,
-			newProp("CPUShares", uint64(c.CpuShares)))
+			newProp("CPUShares", uint64(c.Resources.CpuShares)))
 	}
 
-	if c.BlkioWeight != 0 {
+	if c.Resources.BlkioWeight != 0 {
 		properties = append(properties,
-			newProp("BlockIOWeight", uint64(c.BlkioWeight)))
+			newProp("BlockIOWeight", uint64(c.Resources.BlkioWeight)))
 	}
 
 	// We need to set kernel memory before processes join cgroup because
 	// kmem.limit_in_bytes can only be set when the cgroup is empty.
 	// And swap memory limit needs to be set after memory limit, only
 	// memory limit is handled by systemd, so it's kind of ugly here.
-	if c.KernelMemory > 0 {
+	if c.Resources.KernelMemory > 0 {
 		if err := setKernelMemory(c); err != nil {
 			return err
 		}
@@ -279,7 +279,7 @@ func (m *Manager) Apply(pid int) error {
 	m.Paths = paths
 
 	if paths["cpu"] != "" {
-		if err := fs.CheckCpushares(paths["cpu"], c.CpuShares); err != nil {
+		if err := fs.CheckCpushares(paths["cpu"], c.Resources.CpuShares); err != nil {
 			return err
 		}
 	}
@@ -334,23 +334,23 @@ func joinCpu(c *configs.Cgroup, pid int) error {
 	if err != nil && !cgroups.IsNotFound(err) {
 		return err
 	}
-	if c.CpuQuota != 0 {
-		if err = writeFile(path, "cpu.cfs_quota_us", strconv.FormatInt(c.CpuQuota, 10)); err != nil {
+	if c.Resources.CpuQuota != 0 {
+		if err = writeFile(path, "cpu.cfs_quota_us", strconv.FormatInt(c.Resources.CpuQuota, 10)); err != nil {
 			return err
 		}
 	}
-	if c.CpuPeriod != 0 {
-		if err = writeFile(path, "cpu.cfs_period_us", strconv.FormatInt(c.CpuPeriod, 10)); err != nil {
+	if c.Resources.CpuPeriod != 0 {
+		if err = writeFile(path, "cpu.cfs_period_us", strconv.FormatInt(c.Resources.CpuPeriod, 10)); err != nil {
 			return err
 		}
 	}
-	if c.CpuRtPeriod != 0 {
-		if err = writeFile(path, "cpu.rt_period_us", strconv.FormatInt(c.CpuRtPeriod, 10)); err != nil {
+	if c.Resources.CpuRtPeriod != 0 {
+		if err = writeFile(path, "cpu.rt_period_us", strconv.FormatInt(c.Resources.CpuRtPeriod, 10)); err != nil {
 			return err
 		}
 	}
-	if c.CpuRtRuntime != 0 {
-		if err = writeFile(path, "cpu.rt_runtime_us", strconv.FormatInt(c.CpuRtRuntime, 10)); err != nil {
+	if c.Resources.CpuRtRuntime != 0 {
+		if err = writeFile(path, "cpu.rt_runtime_us", strconv.FormatInt(c.Resources.CpuRtRuntime, 10)); err != nil {
 			return err
 		}
 	}
@@ -418,15 +418,15 @@ func (m *Manager) Freeze(state configs.FreezerState) error {
 	if err != nil {
 		return err
 	}
-	prevState := m.Cgroups.Freezer
-	m.Cgroups.Freezer = state
+	prevState := m.Cgroups.Resources.Freezer
+	m.Cgroups.Resources.Freezer = state
 	freezer, err := subsystems.Get("freezer")
 	if err != nil {
 		return err
 	}
 	err = freezer.Set(path, m.Cgroups)
 	if err != nil {
-		m.Cgroups.Freezer = prevState
+		m.Cgroups.Resources.Freezer = prevState
 		return err
 	}
 	return nil
@@ -510,8 +510,8 @@ func setKernelMemory(c *configs.Cgroup) error {
 		return err
 	}
 
-	if c.KernelMemory > 0 {
-		err = writeFile(path, "memory.kmem.limit_in_bytes", strconv.FormatInt(c.KernelMemory, 10))
+	if c.Resources.KernelMemory > 0 {
+		err = writeFile(path, "memory.kmem.limit_in_bytes", strconv.FormatInt(c.Resources.KernelMemory, 10))
 		if err != nil {
 			return err
 		}
@@ -527,33 +527,33 @@ func joinMemory(c *configs.Cgroup, pid int) error {
 	}
 
 	// -1 disables memoryswap
-	if c.MemorySwap > 0 {
-		err = writeFile(path, "memory.memsw.limit_in_bytes", strconv.FormatInt(c.MemorySwap, 10))
+	if c.Resources.MemorySwap > 0 {
+		err = writeFile(path, "memory.memsw.limit_in_bytes", strconv.FormatInt(c.Resources.MemorySwap, 10))
 		if err != nil {
 			return err
 		}
 	}
-	if c.MemoryReservation > 0 {
-		err = writeFile(path, "memory.soft_limit_in_bytes", strconv.FormatInt(c.MemoryReservation, 10))
+	if c.Resources.MemoryReservation > 0 {
+		err = writeFile(path, "memory.soft_limit_in_bytes", strconv.FormatInt(c.Resources.MemoryReservation, 10))
 		if err != nil {
 			return err
 		}
 	}
-	if c.OomKillDisable {
+	if c.Resources.OomKillDisable {
 		if err := writeFile(path, "memory.oom_control", "1"); err != nil {
 			return err
 		}
 	}
 
-	if c.MemorySwappiness >= 0 && c.MemorySwappiness <= 100 {
-		err = writeFile(path, "memory.swappiness", strconv.FormatInt(c.MemorySwappiness, 10))
+	if c.Resources.MemorySwappiness >= 0 && c.Resources.MemorySwappiness <= 100 {
+		err = writeFile(path, "memory.swappiness", strconv.FormatInt(c.Resources.MemorySwappiness, 10))
 		if err != nil {
 			return err
 		}
-	} else if c.MemorySwappiness == -1 {
+	} else if c.Resources.MemorySwappiness == -1 {
 		return nil
 	} else {
-		return fmt.Errorf("invalid value:%d. valid memory swappiness range is 0-100", c.MemorySwappiness)
+		return fmt.Errorf("invalid value:%d. valid memory swappiness range is 0-100", c.Resources.MemorySwappiness)
 	}
 
 	return nil
@@ -582,12 +582,12 @@ func joinBlkio(c *configs.Cgroup, pid int) error {
 		return err
 	}
 	// systemd doesn't directly support this in the dbus properties
-	if c.BlkioLeafWeight != 0 {
-		if err := writeFile(path, "blkio.leaf_weight", strconv.FormatUint(uint64(c.BlkioLeafWeight), 10)); err != nil {
+	if c.Resources.BlkioLeafWeight != 0 {
+		if err := writeFile(path, "blkio.leaf_weight", strconv.FormatUint(uint64(c.Resources.BlkioLeafWeight), 10)); err != nil {
 			return err
 		}
 	}
-	for _, wd := range c.BlkioWeightDevice {
+	for _, wd := range c.Resources.BlkioWeightDevice {
 		if err := writeFile(path, "blkio.weight_device", wd.WeightString()); err != nil {
 			return err
 		}
@@ -595,22 +595,22 @@ func joinBlkio(c *configs.Cgroup, pid int) error {
 			return err
 		}
 	}
-	for _, td := range c.BlkioThrottleReadBpsDevice {
+	for _, td := range c.Resources.BlkioThrottleReadBpsDevice {
 		if err := writeFile(path, "blkio.throttle.read_bps_device", td.String()); err != nil {
 			return err
 		}
 	}
-	for _, td := range c.BlkioThrottleWriteBpsDevice {
+	for _, td := range c.Resources.BlkioThrottleWriteBpsDevice {
 		if err := writeFile(path, "blkio.throttle.write_bps_device", td.String()); err != nil {
 			return err
 		}
 	}
-	for _, td := range c.BlkioThrottleReadIOPSDevice {
+	for _, td := range c.Resources.BlkioThrottleReadIOPSDevice {
 		if err := writeFile(path, "blkio.throttle.read_iops_device", td.String()); err != nil {
 			return err
 		}
 	}
-	for _, td := range c.BlkioThrottleWriteIOPSDevice {
+	for _, td := range c.Resources.BlkioThrottleWriteIOPSDevice {
 		if err := writeFile(path, "blkio.throttle.write_iops_device", td.String()); err != nil {
 			return err
 		}
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/configs/cgroup_unix.go b/vendor/src/github.com/opencontainers/runc/libcontainer/configs/cgroup_unix.go
index f256fa2471..ef781324fb 100644
--- a/vendor/src/github.com/opencontainers/runc/libcontainer/configs/cgroup_unix.go
+++ b/vendor/src/github.com/opencontainers/runc/libcontainer/configs/cgroup_unix.go
@@ -16,6 +16,14 @@ type Cgroup struct {
 	// name of parent cgroup or slice
 	Parent string `json:"parent"`
 
+	// ScopePrefix decribes prefix for the scope name
+	ScopePrefix string `json:"scope_prefix"`
+
+	// Resources contains various cgroups settings to apply
+	Resources *Resources `json:"resources"`
+}
+
+type Resources struct {
 	// If this is true allow access to any kind of device within the container.  If false, allow access only to devices explicitly listed in the allowed_devices list.
 	AllowAllDevices bool `json:"allow_all_devices"`
 
@@ -83,9 +91,6 @@ type Cgroup struct {
 	// Hugetlb limit (in bytes)
 	HugetlbLimit []*HugepageLimit `json:"hugetlb_limit"`
 
-	// ScopePrefix decribes prefix for the scope name
-	ScopePrefix string `json:"scope_prefix"`
-
 	// Whether to disable OOM Killer
 	OomKillDisable bool `json:"oom_kill_disable"`
 
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/container_linux.go b/vendor/src/github.com/opencontainers/runc/libcontainer/container_linux.go
index 82476ed99a..de98e97ca2 100644
--- a/vendor/src/github.com/opencontainers/runc/libcontainer/container_linux.go
+++ b/vendor/src/github.com/opencontainers/runc/libcontainer/container_linux.go
@@ -985,7 +985,7 @@ func (c *linuxContainer) currentStatus() (Status, error) {
 		}
 		return 0, newSystemError(err)
 	}
-	if c.config.Cgroups != nil && c.config.Cgroups.Freezer == configs.Frozen {
+	if c.config.Cgroups != nil && c.config.Cgroups.Resources != nil && c.config.Cgroups.Resources.Freezer == configs.Frozen {
 		return Paused, nil
 	}
 	return Running, nil
diff --git a/vendor/src/github.com/opencontainers/runc/libcontainer/message_linux.go b/vendor/src/github.com/opencontainers/runc/libcontainer/message_linux.go
index 0e95e3b0ad..0c3301f2bb 100644
--- a/vendor/src/github.com/opencontainers/runc/libcontainer/message_linux.go
+++ b/vendor/src/github.com/opencontainers/runc/libcontainer/message_linux.go
@@ -14,6 +14,8 @@ const (
 	InitMsg         uint16 = 62000
 	PidAttr         uint16 = 27281
 	ConsolePathAttr uint16 = 27282
+	// When syscall.NLA_HDRLEN is in gccgo, take this out.
+	syscall_NLA_HDRLEN = (syscall.SizeofNlAttr + syscall.NLA_ALIGNTO - 1) & ^(syscall.NLA_ALIGNTO - 1)
 )
 
 type Int32msg struct {
@@ -34,7 +36,7 @@ func (msg *Int32msg) Serialize() []byte {
 }
 
 func (msg *Int32msg) Len() int {
-	return syscall.NLA_HDRLEN + 4
+	return syscall_NLA_HDRLEN + 4
 }
 
 // bytemsg has the following representation
@@ -56,5 +58,5 @@ func (msg *Bytemsg) Serialize() []byte {
 }
 
 func (msg *Bytemsg) Len() int {
-	return syscall.NLA_HDRLEN + len(msg.Value) + 1 // null-terminated
+	return syscall_NLA_HDRLEN + len(msg.Value) + 1 // null-terminated
 }