dockershim: set security option separators based on the docker version

Also add a version cache to avoid hitting the docker daemon frequently.

pkg/kubelet/dockertools/docker_manager.go

@@ -110,7 +110,7 @@ const (
 	versionCacheTTL = 60 * time.Second
 
 	// Docker changed the API for specifying options in v1.11
-	SecurityOptSeparatorChangeVersion = "1.23" // Corresponds to docker 1.11.x
+	SecurityOptSeparatorChangeVersion = "1.23.0" // Corresponds to docker 1.11.x
 	SecurityOptSeparatorOld           = ':'
 	SecurityOptSeparatorNew           = '='
 )

pkg/kubelet/dockertools/fake_docker_client.go

@@ -569,7 +569,8 @@ func (f *FakeDockerClient) PullImage(image string, auth dockertypes.AuthConfig,
 func (f *FakeDockerClient) Version() (*dockertypes.Version, error) {
 	f.Lock()
 	defer f.Unlock()
-	return &f.VersionInfo, f.popError("version")
+	v := f.VersionInfo
+	return &v, f.popError("version")
 }
 
 func (f *FakeDockerClient) Info() (*dockertypes.Info, error) {