Using the Ring CRDT and Weave gossip, provides an interface
for the weave script to allocate IP addresses in `weave run`,
`weave start` and `weave expose`.
See docs/ipam.md for implementation details, and site/features.md
for user-visible changes.
We cannot just leave that to the `-port` parameter since that only
controls the container internal port weave is listening on (and uses
as the default destination port for outbound connections). Also, we
need the port for connection tracking cleanup during `stop` and
`reset`.
So we make setting `WEAVE_PORT` the only documented mechanism for
overriding the port, and let `-port` set the container internal port
only (and the script pays attentiont to that, so it can establish the
correct port mapping).
The latter is the most secure route since it keeps the password
completely out of any command lines, and the permissions on the file
can be very restrictive, e.g. 0400.
It would be somewhat nicer if the password file contained just
<password>
rather than
WEAVE_PASSWORD=<password>
but then we'd have to transit the password via a temporary file with
0600 permissions.
Bryan Boreham