Container changes (#320)

Added container metrics

vendor/github.com/Microsoft/hcsshim/internal/appargs/appargs.go

@@ -0,0 +1,93 @@
+// Package appargs provides argument validation routines for use with
+// github.com/urfave/cli.
+package appargs
+
+import (
+	"errors"
+	"strconv"
+
+	"github.com/urfave/cli"
+)
+
+// Validator is an argument validator function. It returns the number of
+// arguments consumed or -1 on error.
+type Validator = func([]string) int
+
+// String is a validator for strings.
+func String(args []string) int {
+	if len(args) == 0 {
+		return -1
+	}
+	return 1
+}
+
+// NonEmptyString is a validator for non-empty strings.
+func NonEmptyString(args []string) int {
+	if len(args) == 0 || args[0] == "" {
+		return -1
+	}
+	return 1
+}
+
+// Int returns a validator for integers.
+func Int(base int, min int, max int) Validator {
+	return func(args []string) int {
+		if len(args) == 0 {
+			return -1
+		}
+		i, err := strconv.ParseInt(args[0], base, 0)
+		if err != nil || int(i) < min || int(i) > max {
+			return -1
+		}
+		return 1
+	}
+}
+
+// Optional returns a validator that treats an argument as optional.
+func Optional(v Validator) Validator {
+	return func(args []string) int {
+		if len(args) == 0 {
+			return 0
+		}
+		return v(args)
+	}
+}
+
+// Rest returns a validator that validates each of the remaining arguments.
+func Rest(v Validator) Validator {
+	return func(args []string) int {
+		count := len(args)
+		for len(args) != 0 {
+			n := v(args)
+			if n < 0 {
+				return n
+			}
+			args = args[n:]
+		}
+		return count
+	}
+}
+
+// ErrInvalidUsage is returned when there is a validation error.
+var ErrInvalidUsage = errors.New("invalid command usage")
+
+// Validate can be used as a command's Before function to validate the arguments
+// to the command.
+func Validate(vs ...Validator) cli.BeforeFunc {
+	return func(context *cli.Context) error {
+		remaining := context.Args()
+		for _, v := range vs {
+			consumed := v(remaining)
+			if consumed < 0 {
+				return ErrInvalidUsage
+			}
+			remaining = remaining[consumed:]
+		}
+
+		if len(remaining) > 0 {
+			return ErrInvalidUsage
+		}
+
+		return nil
+	}
+}

vendor/github.com/Microsoft/hcsshim/internal/cni/registry.go

@@ -0,0 +1,110 @@
+package cni
+
+import (
+	"errors"
+
+	"github.com/Microsoft/hcsshim/internal/guid"
+	"github.com/Microsoft/hcsshim/internal/regstate"
+)
+
+const (
+	cniRoot = "cni"
+	cniKey  = "cfg"
+)
+
+// PersistedNamespaceConfig is the registry version of the `NamespaceID` to UVM
+// map.
+type PersistedNamespaceConfig struct {
+	namespaceID string
+	stored      bool
+
+	ContainerID  string
+	HostUniqueID guid.GUID
+}
+
+// NewPersistedNamespaceConfig creates an in-memory namespace config that can be
+// persisted to the registry.
+func NewPersistedNamespaceConfig(namespaceID, containerID string, containerHostUniqueID guid.GUID) *PersistedNamespaceConfig {
+	return &PersistedNamespaceConfig{
+		namespaceID:  namespaceID,
+		ContainerID:  containerID,
+		HostUniqueID: containerHostUniqueID,
+	}
+}
+
+// LoadPersistedNamespaceConfig loads a persisted config from the registry that matches
+// `namespaceID`. If not found returns `regstate.NotFoundError`
+func LoadPersistedNamespaceConfig(namespaceID string) (*PersistedNamespaceConfig, error) {
+	sk, err := regstate.Open(cniRoot, false)
+	if err != nil {
+		return nil, err
+	}
+	defer sk.Close()
+
+	pnc := PersistedNamespaceConfig{
+		namespaceID: namespaceID,
+		stored:      true,
+	}
+	if err := sk.Get(namespaceID, cniKey, &pnc); err != nil {
+		return nil, err
+	}
+	return &pnc, nil
+}
+
+// Store stores or updates the in-memory config to its registry state. If the
+// store failes returns the store error.
+func (pnc *PersistedNamespaceConfig) Store() error {
+	if pnc.namespaceID == "" {
+		return errors.New("invalid namespaceID ''")
+	}
+	if pnc.ContainerID == "" {
+		return errors.New("invalid containerID ''")
+	}
+	empty := guid.GUID{}
+	if pnc.HostUniqueID == empty {
+		return errors.New("invalid containerHostUniqueID 'empy'")
+	}
+	sk, err := regstate.Open(cniRoot, false)
+	if err != nil {
+		return err
+	}
+	defer sk.Close()
+
+	if pnc.stored {
+		if err := sk.Set(pnc.namespaceID, cniKey, pnc); err != nil {
+			return err
+		}
+	} else {
+		if err := sk.Create(pnc.namespaceID, cniKey, pnc); err != nil {
+			return err
+		}
+	}
+	pnc.stored = true
+	return nil
+}
+
+// Remove removes any persisted state associated with this config. If the config
+// is not found in the registery `Remove` returns no error.
+func (pnc *PersistedNamespaceConfig) Remove() error {
+	if pnc.stored {
+		sk, err := regstate.Open(cniRoot, false)
+		if err != nil {
+			if regstate.IsNotFoundError(err) {
+				pnc.stored = false
+				return nil
+			}
+			return err
+		}
+		defer sk.Close()
+
+		if err := sk.Remove(pnc.namespaceID); err != nil {
+			if regstate.IsNotFoundError(err) {
+				pnc.stored = false
+				return nil
+			}
+			return err
+		}
+	}
+	pnc.stored = false
+	return nil
+}

vendor/github.com/Microsoft/hcsshim/internal/cni/registry_test.go

@@ -0,0 +1,137 @@
+package cni
+
+import (
+	"testing"
+
+	"github.com/Microsoft/hcsshim/internal/guid"
+	"github.com/Microsoft/hcsshim/internal/regstate"
+)
+
+func Test_LoadPersistedNamespaceConfig_NoConfig(t *testing.T) {
+	pnc, err := LoadPersistedNamespaceConfig(t.Name())
+	if pnc != nil {
+		t.Fatal("config should be nil")
+	}
+	if err == nil {
+		t.Fatal("err should be set")
+	} else {
+		if !regstate.IsNotFoundError(err) {
+			t.Fatal("err should be NotFoundError")
+		}
+	}
+}
+
+func Test_LoadPersistedNamespaceConfig_WithConfig(t *testing.T) {
+	pnc := NewPersistedNamespaceConfig(t.Name(), "test-container", guid.New())
+	err := pnc.Store()
+	if err != nil {
+		pnc.Remove()
+		t.Fatalf("store failed with: %v", err)
+	}
+	defer pnc.Remove()
+
+	pnc2, err := LoadPersistedNamespaceConfig(t.Name())
+	if err != nil {
+		t.Fatal("should have no error on stored config")
+	}
+	if pnc2 == nil {
+		t.Fatal("stored config should have been returned")
+	} else {
+		if pnc.namespaceID != pnc2.namespaceID {
+			t.Fatal("actual/stored namespaceID not equal")
+		}
+		if pnc.ContainerID != pnc2.ContainerID {
+			t.Fatal("actual/stored ContainerID not equal")
+		}
+		if pnc.HostUniqueID != pnc2.HostUniqueID {
+			t.Fatal("actual/stored HostUniqueID not equal")
+		}
+		if !pnc2.stored {
+			t.Fatal("stored should be true for registry load")
+		}
+	}
+}
+
+func Test_PersistedNamespaceConfig_StoreNew(t *testing.T) {
+	pnc := NewPersistedNamespaceConfig(t.Name(), "test-container", guid.New())
+	err := pnc.Store()
+	if err != nil {
+		pnc.Remove()
+		t.Fatalf("store failed with: %v", err)
+	}
+	defer pnc.Remove()
+}
+
+func Test_PersistedNamespaceConfig_StoreUpdate(t *testing.T) {
+	pnc := NewPersistedNamespaceConfig(t.Name(), "test-container", guid.New())
+	err := pnc.Store()
+	if err != nil {
+		pnc.Remove()
+		t.Fatalf("store failed with: %v", err)
+	}
+	defer pnc.Remove()
+
+	pnc.ContainerID = "test-container2"
+	pnc.HostUniqueID = guid.New()
+	err = pnc.Store()
+	if err != nil {
+		pnc.Remove()
+		t.Fatalf("store update failed with: %v", err)
+	}
+
+	// Verify the update
+	pnc2, err := LoadPersistedNamespaceConfig(t.Name())
+	if err != nil {
+		t.Fatal("stored config should have been returned")
+	}
+	if pnc.ContainerID != pnc2.ContainerID {
+		t.Fatal("actual/stored ContainerID not equal")
+	}
+	if pnc.HostUniqueID != pnc2.HostUniqueID {
+		t.Fatal("actual/stored HostUniqueID not equal")
+	}
+}
+
+func Test_PersistedNamespaceConfig_RemoveNotStored(t *testing.T) {
+	pnc := NewPersistedNamespaceConfig(t.Name(), "test-container", guid.New())
+	err := pnc.Remove()
+	if err != nil {
+		t.Fatalf("remove on not stored should not fail: %v", err)
+	}
+}
+
+func Test_PersistedNamespaceConfig_RemoveStoredKey(t *testing.T) {
+	pnc := NewPersistedNamespaceConfig(t.Name(), "test-container", guid.New())
+	err := pnc.Store()
+	if err != nil {
+		t.Fatalf("store failed with: %v", err)
+	}
+	err = pnc.Remove()
+	if err != nil {
+		t.Fatalf("remove on stored key should not fail: %v", err)
+	}
+}
+
+func Test_PersistedNamespaceConfig_RemovedOtherKey(t *testing.T) {
+	pnc := NewPersistedNamespaceConfig(t.Name(), "test-container", guid.New())
+	err := pnc.Store()
+	if err != nil {
+		t.Fatalf("store failed with: %v", err)
+	}
+
+	pnc2, err := LoadPersistedNamespaceConfig(t.Name())
+	if err != nil {
+		t.Fatal("should of found stored config")
+	}
+
+	err = pnc.Remove()
+	if err != nil {
+		t.Fatalf("remove on stored key should not fail: %v", err)
+	}
+
+	// Now remove the other key that has the invalid memory state
+	err = pnc2.Remove()
+	if err != nil {
+		t.Fatalf("remove on in-memory already removed should not fail: %v", err)
+	}
+}

vendor/github.com/Microsoft/hcsshim/internal/copyfile/copyfile.go

@@ -0,0 +1,40 @@
+package copyfile
+
+import (
+	"fmt"
+	"syscall"
+	"unsafe"
+)
+
+var (
+	modkernel32   = syscall.NewLazyDLL("kernel32.dll")
+	procCopyFileW = modkernel32.NewProc("CopyFileW")
+)
+
+// CopyFile is a utility for copying a file - used for the LCOW scratch cache.
+// Uses CopyFileW win32 API for performance.
+func CopyFile(srcFile, destFile string, overwrite bool) error {
+	var bFailIfExists uint32 = 1
+	if overwrite {
+		bFailIfExists = 0
+	}
+
+	lpExistingFileName, err := syscall.UTF16PtrFromString(srcFile)
+	if err != nil {
+		return err
+	}
+	lpNewFileName, err := syscall.UTF16PtrFromString(destFile)
+	if err != nil {
+		return err
+	}
+	r1, _, err := syscall.Syscall(
+		procCopyFileW.Addr(),
+		3,
+		uintptr(unsafe.Pointer(lpExistingFileName)),
+		uintptr(unsafe.Pointer(lpNewFileName)),
+		uintptr(bFailIfExists))
+	if r1 == 0 {
+		return fmt.Errorf("failed CopyFileW Win32 call from '%s' to '%s': %s", srcFile, destFile, err)
+	}
+	return nil
+}

vendor/github.com/Microsoft/hcsshim/internal/copywithtimeout/copywithtimeout.go

@@ -0,0 +1,103 @@
+package copywithtimeout
+
+import (
+	"bytes"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"os"
+	"strconv"
+	"syscall"
+	"time"
+
+	"github.com/sirupsen/logrus"
+)
+
+// logDataByteCount is for an advanced debugging technique to allow
+// data read/written to a processes stdio channels hex-dumped to the
+// log when running at debug level or higher. It is controlled through
+// the environment variable HCSSHIM_LOG_DATA_BYTE_COUNT
+var logDataByteCount int64
+
+func init() {
+	bytes := os.Getenv("HCSSHIM_LOG_DATA_BYTE_COUNT")
+	if len(bytes) > 0 {
+		u, err := strconv.ParseUint(bytes, 10, 32)
+		if err == nil {
+			logDataByteCount = int64(u)
+		}
+	}
+}
+
+// Copy is a wrapper for io.Copy using a timeout duration
+func Copy(dst io.Writer, src io.Reader, size int64, context string, timeout time.Duration) (int64, error) {
+	logrus.WithFields(logrus.Fields{
+		"stdval":  context,
+		"size":    size,
+		"timeout": timeout,
+	}).Debug("hcsshim::copywithtimeout - Begin")
+
+	type resultType struct {
+		err   error
+		bytes int64
+	}
+
+	done := make(chan resultType, 1)
+	go func() {
+		result := resultType{}
+		if logrus.GetLevel() < logrus.DebugLevel || logDataByteCount == 0 {
+			result.bytes, result.err = io.Copy(dst, src)
+		} else {
+			// In advanced debug mode where we log (hexdump format) what is copied
+			// up to the number of bytes defined by environment variable
+			// HCSSHIM_LOG_DATA_BYTE_COUNT
+			var buf bytes.Buffer
+			tee := io.TeeReader(src, &buf)
+			result.bytes, result.err = io.Copy(dst, tee)
+			if result.err == nil {
+				size := result.bytes
+				if size > logDataByteCount {
+					size = logDataByteCount
+				}
+				if size > 0 {
+					bytes := make([]byte, size)
+					if _, err := buf.Read(bytes); err == nil {
+						logrus.Debugf("hcsshim::copyWithTimeout - Read bytes\n%s", hex.Dump(bytes))
+					}
+				}
+			}
+		}
+		done <- result
+	}()
+
+	var result resultType
+	timedout := time.After(timeout)
+
+	select {
+	case <-timedout:
+		return 0, fmt.Errorf("hcsshim::copyWithTimeout: timed out (%s)", context)
+	case result = <-done:
+		if result.err != nil && result.err != io.EOF {
+			// See https://github.com/golang/go/blob/f3f29d1dea525f48995c1693c609f5e67c046893/src/os/exec/exec_windows.go for a clue as to why we are doing this :)
+			if se, ok := result.err.(syscall.Errno); ok {
+				const (
+					errNoData     = syscall.Errno(232)
+					errBrokenPipe = syscall.Errno(109)
+				)
+				if se == errNoData || se == errBrokenPipe {
+					logrus.WithFields(logrus.Fields{
+						"stdval":        context,
+						logrus.ErrorKey: se,
+					}).Debug("hcsshim::copywithtimeout - End")
+					return result.bytes, nil
+				}
+			}
+			return 0, fmt.Errorf("hcsshim::copyWithTimeout: error reading: '%s' after %d bytes (%s)", result.err, result.bytes, context)
+		}
+	}
+	logrus.WithFields(logrus.Fields{
+		"stdval":       context,
+		"copied-bytes": result.bytes,
+	}).Debug("hcsshim::copywithtimeout - Completed Successfully")
+	return result.bytes, nil
+}

vendor/github.com/Microsoft/hcsshim/internal/guestrequest/types.go

@@ -0,0 +1,100 @@
+package guestrequest
+
+import (
+	"github.com/Microsoft/hcsshim/internal/schema2"
+)
+
+// Arguably, many of these (at least CombinedLayers) should have been generated
+// by swagger.
+//
+// This will also change package name due to an inbound breaking change.
+
+// This class is used by a modify request to add or remove a combined layers
+// structure in the guest. For windows, the GCS applies a filter in ContainerRootPath
+// using the specified layers as the parent content. Ignores property ScratchPath
+// since the container path is already the scratch path. For linux, the GCS unions
+// the specified layers and ScratchPath together, placing the resulting union
+// filesystem at ContainerRootPath.
+type CombinedLayers struct {
+	ContainerRootPath string            `json:"ContainerRootPath,omitempty"`
+	Layers            []hcsschema.Layer `json:"Layers,omitempty"`
+	ScratchPath       string            `json:"ScratchPath,omitempty"`
+}
+
+// Defines the schema for hosted settings passed to GCS and/or OpenGCS
+
+// SCSI. Scratch space for remote file-system commands, or R/W layer for containers
+type LCOWMappedVirtualDisk struct {
+	MountPath  string `json:"MountPath,omitempty"` // /tmp/scratch for an LCOW utility VM being used as a service VM
+	Lun        uint8  `json:"Lun,omitempty"`
+	Controller uint8  `json:"Controller,omitempty"`
+	ReadOnly   bool   `json:"ReadOnly,omitempty"`
+}
+
+type WCOWMappedVirtualDisk struct {
+	ContainerPath string `json:"ContainerPath,omitempty"`
+	Lun           int32  `json:"Lun,omitempty"`
+}
+
+type LCOWMappedDirectory struct {
+	MountPath string `json:"MountPath,omitempty"`
+	Port      int32  `json:"Port,omitempty"`
+	ShareName string `json:"ShareName,omitempty"` // If empty not using ANames (not currently supported)
+	ReadOnly  bool   `json:"ReadOnly,omitempty"`
+}
+
+// Read-only layers over VPMem
+type LCOWMappedVPMemDevice struct {
+	DeviceNumber uint32 `json:"DeviceNumber,omitempty"`
+	MountPath    string `json:"MountPath,omitempty"` // /tmp/pN
+}
+
+type LCOWNetworkAdapter struct {
+	NamespaceID     string `json:",omitempty"`
+	ID              string `json:",omitempty"`
+	MacAddress      string `json:",omitempty"`
+	IPAddress       string `json:",omitempty"`
+	PrefixLength    uint8  `json:",omitempty"`
+	GatewayAddress  string `json:",omitempty"`
+	DNSSuffix       string `json:",omitempty"`
+	DNSServerList   string `json:",omitempty"`
+	EnableLowMetric bool   `json:",omitempty"`
+	EncapOverhead   uint16 `json:",omitempty"`
+}
+
+type ResourceType string
+
+const (
+	// These are constants for v2 schema modify guest requests.
+	ResourceTypeMappedDirectory   ResourceType = "MappedDirectory"
+	ResourceTypeMappedVirtualDisk ResourceType = "MappedVirtualDisk"
+	ResourceTypeNetwork           ResourceType = "Network"
+	ResourceTypeNetworkNamespace  ResourceType = "NetworkNamespace"
+	ResourceTypeCombinedLayers    ResourceType = "CombinedLayers"
+	ResourceTypeVPMemDevice       ResourceType = "VPMemDevice"
+)
+
+// GuestRequest is for modify commands passed to the guest.
+type GuestRequest struct {
+	RequestType  string       `json:"RequestType,omitempty"`
+	ResourceType ResourceType `json:"ResourceType,omitempty"`
+	Settings     interface{}  `json:"Settings,omitempty"`
+}
+
+type NetworkModifyRequest struct {
+	AdapterId   string      `json:"AdapterId,omitempty"`
+	RequestType string      `json:"RequestType,omitempty"`
+	Settings    interface{} `json:"Settings,omitempty"`
+}
+
+type RS4NetworkModifyRequest struct {
+	AdapterInstanceId string      `json:"AdapterInstanceId,omitempty"`
+	RequestType       string      `json:"RequestType,omitempty"`
+	Settings          interface{} `json:"Settings,omitempty"`
+}
+
+// SignalProcessOptions is the options passed to either WCOW or LCOW
+// to signal a given process.
+type SignalProcessOptions struct {
+	Signal int `json:,omitempty`
+}

vendor/github.com/Microsoft/hcsshim/internal/guid/guid.go

@@ -0,0 +1,69 @@
+package guid
+
+import (
+	"crypto/rand"
+	"encoding/json"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+)
+
+var _ = (json.Marshaler)(&GUID{})
+var _ = (json.Unmarshaler)(&GUID{})
+
+type GUID [16]byte
+
+func New() GUID {
+	g := GUID{}
+	_, err := io.ReadFull(rand.Reader, g[:])
+	if err != nil {
+		panic(err)
+	}
+	return g
+}
+
+func (g GUID) String() string {
+	return fmt.Sprintf("%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x-%02x", g[3], g[2], g[1], g[0], g[5], g[4], g[7], g[6], g[8:10], g[10:])
+}
+
+func FromString(s string) GUID {
+	if len(s) != 36 {
+		panic(fmt.Sprintf("invalid GUID length: %d", len(s)))
+	}
+	if s[8] != '-' || s[13] != '-' || s[18] != '-' || s[23] != '-' {
+		panic("invalid GUID format")
+	}
+	indexOrder := [16]int{
+		0, 2, 4, 6,
+		9, 11,
+		14, 16,
+		19, 21,
+		24, 26, 28, 30, 32, 34,
+	}
+	byteOrder := [16]int{
+		3, 2, 1, 0,
+		5, 4,
+		7, 6,
+		8, 9,
+		10, 11, 12, 13, 14, 15,
+	}
+	var g GUID
+	for i, x := range indexOrder {
+		b, err := strconv.ParseInt(s[x:x+2], 16, 16)
+		if err != nil {
+			panic(err)
+		}
+		g[byteOrder[i]] = byte(b)
+	}
+	return g
+}
+
+func (g GUID) MarshalJSON() ([]byte, error) {
+	return json.Marshal(g.String())
+}
+
+func (g *GUID) UnmarshalJSON(data []byte) error {
+	*g = FromString(strings.Trim(string(data), "\""))
+	return nil
+}

vendor/github.com/Microsoft/hcsshim/internal/guid/guid_test.go

@@ -0,0 +1,136 @@
+package guid
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+)
+
+func Test_New(t *testing.T) {
+	g := New()
+	g2 := New()
+	if g == g2 {
+		t.Fatal("GUID's should not be equal when generated")
+	}
+}
+
+func Test_FromString(t *testing.T) {
+	g := New()
+	g2 := FromString(g.String())
+	if g != g2 {
+		t.Fatalf("GUID's not equal %v, %v", g, g2)
+	}
+}
+
+func Test_MarshalJSON(t *testing.T) {
+	g := New()
+	gs := g.String()
+	js, err := json.Marshal(g)
+	if err != nil {
+		t.Fatalf("failed to marshal with %v", err)
+	}
+	gsJSON := fmt.Sprintf("\"%s\"", gs)
+	if gsJSON != string(js) {
+		t.Fatalf("failed to marshal %s != %s", gsJSON, string(js))
+	}
+}
+
+func Test_MarshalJSON_Ptr(t *testing.T) {
+	g := New()
+	gs := g.String()
+	js, err := json.Marshal(&g)
+	if err != nil {
+		t.Fatalf("failed to marshal with %v", err)
+	}
+	gsJSON := fmt.Sprintf("\"%s\"", gs)
+	if gsJSON != string(js) {
+		t.Fatalf("failed to marshal %s != %s", gsJSON, string(js))
+	}
+}
+
+func Test_MarshalJSON_Nested(t *testing.T) {
+	type test struct {
+		G GUID
+	}
+	t1 := test{
+		G: New(),
+	}
+	gs := t1.G.String()
+	js, err := json.Marshal(t1)
+	if err != nil {
+		t.Fatalf("failed to marshal with %v", err)
+	}
+	gsJSON := fmt.Sprintf("{\"G\":\"%s\"}", gs)
+	if gsJSON != string(js) {
+		t.Fatalf("failed to marshal %s != %s", gsJSON, string(js))
+	}
+}
+
+func Test_MarshalJSON_Nested_Ptr(t *testing.T) {
+	type test struct {
+		G *GUID
+	}
+	v := New()
+	t1 := test{
+		G: &v,
+	}
+	gs := t1.G.String()
+	js, err := json.Marshal(t1)
+	if err != nil {
+		t.Fatalf("failed to marshal with %v", err)
+	}
+	gsJSON := fmt.Sprintf("{\"G\":\"%s\"}", gs)
+	if gsJSON != string(js) {
+		t.Fatalf("failed to marshal %s != %s", gsJSON, string(js))
+	}
+}
+
+func Test_UnmarshalJSON(t *testing.T) {
+	g := New()
+	js, _ := json.Marshal(g)
+	var g2 GUID
+	err := json.Unmarshal(js, &g2)
+	if err != nil {
+		t.Fatalf("failed to unmarshal with: %v", err)
+	}
+	if g != g2 {
+		t.Fatalf("failed to unmarshal %s != %s", g, g2)
+	}
+}
+
+func Test_UnmarshalJSON_Nested(t *testing.T) {
+	type test struct {
+		G GUID
+	}
+	t1 := test{
+		G: New(),
+	}
+	js, _ := json.Marshal(t1)
+	var t2 test
+	err := json.Unmarshal(js, &t2)
+	if err != nil {
+		t.Fatalf("failed to unmarshal with: %v", err)
+	}
+	if t1.G != t2.G {
+		t.Fatalf("failed to unmarshal %v != %v", t1.G, t2.G)
+	}
+}
+
+func Test_UnmarshalJSON_Nested_Ptr(t *testing.T) {
+	type test struct {
+		G *GUID
+	}
+	v := New()
+	t1 := test{
+		G: &v,
+	}
+	js, _ := json.Marshal(t1)
+	var t2 test
+	err := json.Unmarshal(js, &t2)
+	if err != nil {
+		t.Fatalf("failed to unmarshal with: %v", err)
+	}
+	if *t1.G != *t2.G {
+		t.Fatalf("failed to unmarshal %v != %v", t1.G, t2.G)
+	}
+}

vendor/github.com/Microsoft/hcsshim/internal/hcs/callback.go

@@ -0,0 +1,104 @@
+package hcs
+
+import (
+	"sync"
+	"syscall"
+
+	"github.com/Microsoft/hcsshim/internal/interop"
+	"github.com/sirupsen/logrus"
+)
+
+var (
+	nextCallback    uintptr
+	callbackMap     = map[uintptr]*notifcationWatcherContext{}
+	callbackMapLock = sync.RWMutex{}
+
+	notificationWatcherCallback = syscall.NewCallback(notificationWatcher)
+
+	// Notifications for HCS_SYSTEM handles
+	hcsNotificationSystemExited                      hcsNotification = 0x00000001
+	hcsNotificationSystemCreateCompleted             hcsNotification = 0x00000002
+	hcsNotificationSystemStartCompleted              hcsNotification = 0x00000003
+	hcsNotificationSystemPauseCompleted              hcsNotification = 0x00000004
+	hcsNotificationSystemResumeCompleted             hcsNotification = 0x00000005
+	hcsNotificationSystemCrashReport                 hcsNotification = 0x00000006
+	hcsNotificationSystemSiloJobCreated              hcsNotification = 0x00000007
+	hcsNotificationSystemSaveCompleted               hcsNotification = 0x00000008
+	hcsNotificationSystemRdpEnhancedModeStateChanged hcsNotification = 0x00000009
+	hcsNotificationSystemShutdownFailed              hcsNotification = 0x0000000A
+	hcsNotificationSystemGetPropertiesCompleted      hcsNotification = 0x0000000B
+	hcsNotificationSystemModifyCompleted             hcsNotification = 0x0000000C
+	hcsNotificationSystemCrashInitiated              hcsNotification = 0x0000000D
+	hcsNotificationSystemGuestConnectionClosed       hcsNotification = 0x0000000E
+
+	// Notifications for HCS_PROCESS handles
+	hcsNotificationProcessExited hcsNotification = 0x00010000
+
+	// Common notifications
+	hcsNotificationInvalid           hcsNotification = 0x00000000
+	hcsNotificationServiceDisconnect hcsNotification = 0x01000000
+)
+
+type hcsNotification uint32
+type notificationChannel chan error
+
+type notifcationWatcherContext struct {
+	channels notificationChannels
+	handle   hcsCallback
+}
+
+type notificationChannels map[hcsNotification]notificationChannel
+
+func newChannels() notificationChannels {
+	channels := make(notificationChannels)
+
+	channels[hcsNotificationSystemExited] = make(notificationChannel, 1)
+	channels[hcsNotificationSystemCreateCompleted] = make(notificationChannel, 1)
+	channels[hcsNotificationSystemStartCompleted] = make(notificationChannel, 1)
+	channels[hcsNotificationSystemPauseCompleted] = make(notificationChannel, 1)
+	channels[hcsNotificationSystemResumeCompleted] = make(notificationChannel, 1)
+	channels[hcsNotificationProcessExited] = make(notificationChannel, 1)
+	channels[hcsNotificationServiceDisconnect] = make(notificationChannel, 1)
+	channels[hcsNotificationSystemCrashReport] = make(notificationChannel, 1)
+	channels[hcsNotificationSystemSiloJobCreated] = make(notificationChannel, 1)
+	channels[hcsNotificationSystemSaveCompleted] = make(notificationChannel, 1)
+	channels[hcsNotificationSystemRdpEnhancedModeStateChanged] = make(notificationChannel, 1)
+	channels[hcsNotificationSystemShutdownFailed] = make(notificationChannel, 1)
+	channels[hcsNotificationSystemGetPropertiesCompleted] = make(notificationChannel, 1)
+	channels[hcsNotificationSystemModifyCompleted] = make(notificationChannel, 1)
+	channels[hcsNotificationSystemCrashInitiated] = make(notificationChannel, 1)
+	channels[hcsNotificationSystemGuestConnectionClosed] = make(notificationChannel, 1)
+
+	return channels
+}
+
+func closeChannels(channels notificationChannels) {
+	for _, c := range channels {
+		close(c)
+	}
+}
+
+func notificationWatcher(notificationType hcsNotification, callbackNumber uintptr, notificationStatus uintptr, notificationData *uint16) uintptr {
+	var result error
+	if int32(notificationStatus) < 0 {
+		result = interop.Win32FromHresult(notificationStatus)
+	}
+
+	callbackMapLock.RLock()
+	context := callbackMap[callbackNumber]
+	callbackMapLock.RUnlock()
+
+	if context == nil {
+		return 0
+	}
+
+	if channel, ok := context.channels[notificationType]; ok {
+		channel <- result
+	} else {
+		logrus.WithFields(logrus.Fields{
+			"notification-type": notificationType,
+		}).Warn("Received a callback of an unsupported type")
+	}
+
+	return 0
+}

vendor/github.com/Microsoft/hcsshim/internal/hcs/cgo.go

@@ -0,0 +1,7 @@
+package hcs
+
+import "C"
+
+// This import is needed to make the library compile as CGO because HCSSHIM
+// only works with CGO due to callbacks from HCS comming back from a C thread
+// which is not supported without CGO. See https://github.com/golang/go/issues/10973

vendor/github.com/Microsoft/hcsshim/internal/hcs/errors.go

@@ -0,0 +1,287 @@
+package hcs
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"syscall"
+
+	"github.com/Microsoft/hcsshim/internal/interop"
+	"github.com/Microsoft/hcsshim/internal/logfields"
+	"github.com/sirupsen/logrus"
+)
+
+var (
+	// ErrComputeSystemDoesNotExist is an error encountered when the container being operated on no longer exists
+	ErrComputeSystemDoesNotExist = syscall.Errno(0xc037010e)
+
+	// ErrElementNotFound is an error encountered when the object being referenced does not exist
+	ErrElementNotFound = syscall.Errno(0x490)
+
+	// ErrElementNotFound is an error encountered when the object being referenced does not exist
+	ErrNotSupported = syscall.Errno(0x32)
+
+	// ErrInvalidData is an error encountered when the request being sent to hcs is invalid/unsupported
+	// decimal -2147024883 / hex 0x8007000d
+	ErrInvalidData = syscall.Errno(0xd)
+
+	// ErrHandleClose is an error encountered when the handle generating the notification being waited on has been closed
+	ErrHandleClose = errors.New("hcsshim: the handle generating this notification has been closed")
+
+	// ErrAlreadyClosed is an error encountered when using a handle that has been closed by the Close method
+	ErrAlreadyClosed = errors.New("hcsshim: the handle has already been closed")
+
+	// ErrInvalidNotificationType is an error encountered when an invalid notification type is used
+	ErrInvalidNotificationType = errors.New("hcsshim: invalid notification type")
+
+	// ErrInvalidProcessState is an error encountered when the process is not in a valid state for the requested operation
+	ErrInvalidProcessState = errors.New("the process is in an invalid state for the attempted operation")
+
+	// ErrTimeout is an error encountered when waiting on a notification times out
+	ErrTimeout = errors.New("hcsshim: timeout waiting for notification")
+
+	// ErrUnexpectedContainerExit is the error encountered when a container exits while waiting for
+	// a different expected notification
+	ErrUnexpectedContainerExit = errors.New("unexpected container exit")
+
+	// ErrUnexpectedProcessAbort is the error encountered when communication with the compute service
+	// is lost while waiting for a notification
+	ErrUnexpectedProcessAbort = errors.New("lost communication with compute service")
+
+	// ErrUnexpectedValue is an error encountered when hcs returns an invalid value
+	ErrUnexpectedValue = errors.New("unexpected value returned from hcs")
+
+	// ErrVmcomputeAlreadyStopped is an error encountered when a shutdown or terminate request is made on a stopped container
+	ErrVmcomputeAlreadyStopped = syscall.Errno(0xc0370110)
+
+	// ErrVmcomputeOperationPending is an error encountered when the operation is being completed asynchronously
+	ErrVmcomputeOperationPending = syscall.Errno(0xC0370103)
+
+	// ErrVmcomputeOperationInvalidState is an error encountered when the compute system is not in a valid state for the requested operation
+	ErrVmcomputeOperationInvalidState = syscall.Errno(0xc0370105)
+
+	// ErrProcNotFound is an error encountered when the the process cannot be found
+	ErrProcNotFound = syscall.Errno(0x7f)
+
+	// ErrVmcomputeOperationAccessIsDenied is an error which can be encountered when enumerating compute systems in RS1/RS2
+	// builds when the underlying silo might be in the process of terminating. HCS was fixed in RS3.
+	ErrVmcomputeOperationAccessIsDenied = syscall.Errno(0x5)
+
+	// ErrVmcomputeInvalidJSON is an error encountered when the compute system does not support/understand the messages sent by management
+	ErrVmcomputeInvalidJSON = syscall.Errno(0xc037010d)
+
+	// ErrVmcomputeUnknownMessage is an error encountered guest compute system doesn't support the message
+	ErrVmcomputeUnknownMessage = syscall.Errno(0xc037010b)
+
+	// ErrVmcomputeUnexpectedExit is an error encountered when the compute system terminates unexpectedly
+	ErrVmcomputeUnexpectedExit = syscall.Errno(0xC0370106)
+
+	// ErrNotSupported is an error encountered when hcs doesn't support the request
+	ErrPlatformNotSupported = errors.New("unsupported platform request")
+)
+
+type ErrorEvent struct {
+	Message    string `json:"Message,omitempty"`    // Fully formated error message
+	StackTrace string `json:"StackTrace,omitempty"` // Stack trace in string form
+	Provider   string `json:"Provider,omitempty"`
+	EventID    uint16 `json:"EventId,omitempty"`
+	Flags      uint32 `json:"Flags,omitempty"`
+	Source     string `json:"Source,omitempty"`
+	//Data       []EventData `json:"Data,omitempty"`  // Omit this as HCS doesn't encode this well. It's more confusing to include. It is however logged in debug mode (see processHcsResult function)
+}
+
+type hcsResult struct {
+	Error        int32
+	ErrorMessage string
+	ErrorEvents  []ErrorEvent `json:"ErrorEvents,omitempty"`
+}
+
+func (ev *ErrorEvent) String() string {
+	evs := "[Event Detail: " + ev.Message
+	if ev.StackTrace != "" {
+		evs += " Stack Trace: " + ev.StackTrace
+	}
+	if ev.Provider != "" {
+		evs += " Provider: " + ev.Provider
+	}
+	if ev.EventID != 0 {
+		evs = fmt.Sprintf("%s EventID: %d", evs, ev.EventID)
+	}
+	if ev.Flags != 0 {
+		evs = fmt.Sprintf("%s flags: %d", evs, ev.Flags)
+	}
+	if ev.Source != "" {
+		evs += " Source: " + ev.Source
+	}
+	evs += "]"
+	return evs
+}
+
+func processHcsResult(resultp *uint16) []ErrorEvent {
+	if resultp != nil {
+		resultj := interop.ConvertAndFreeCoTaskMemString(resultp)
+		logrus.WithField(logfields.JSON, resultj).
+			Debug("HCS Result")
+		result := &hcsResult{}
+		if err := json.Unmarshal([]byte(resultj), result); err != nil {
+			logrus.WithFields(logrus.Fields{
+				logfields.JSON:  resultj,
+				logrus.ErrorKey: err,
+			}).Warning("Could not unmarshal HCS result")
+			return nil
+		}
+		return result.ErrorEvents
+	}
+	return nil
+}
+
+type HcsError struct {
+	Op     string
+	Err    error
+	Events []ErrorEvent
+}
+
+func (e *HcsError) Error() string {
+	s := e.Op + ": " + e.Err.Error()
+	for _, ev := range e.Events {
+		s += "\n" + ev.String()
+	}
+	return s
+}
+
+// ProcessError is an error encountered in HCS during an operation on a Process object
+type ProcessError struct {
+	SystemID string
+	Pid      int
+	Op       string
+	Err      error
+	Events   []ErrorEvent
+}
+
+// SystemError is an error encountered in HCS during an operation on a Container object
+type SystemError struct {
+	ID     string
+	Op     string
+	Err    error
+	Extra  string
+	Events []ErrorEvent
+}
+
+func (e *SystemError) Error() string {
+	s := e.Op + " " + e.ID + ": " + e.Err.Error()
+	for _, ev := range e.Events {
+		s += "\n" + ev.String()
+	}
+	if e.Extra != "" {
+		s += "\n(extra info: " + e.Extra + ")"
+	}
+	return s
+}
+
+func makeSystemError(system *System, op string, extra string, err error, events []ErrorEvent) error {
+	// Don't double wrap errors
+	if _, ok := err.(*SystemError); ok {
+		return err
+	}
+	return &SystemError{
+		ID:     system.ID(),
+		Op:     op,
+		Extra:  extra,
+		Err:    err,
+		Events: events,
+	}
+}
+
+func (e *ProcessError) Error() string {
+	s := fmt.Sprintf("%s %s:%d: %s", e.Op, e.SystemID, e.Pid, e.Err.Error())
+	for _, ev := range e.Events {
+		s += "\n" + ev.String()
+	}
+	return s
+}
+
+func makeProcessError(process *Process, op string, err error, events []ErrorEvent) error {
+	// Don't double wrap errors
+	if _, ok := err.(*ProcessError); ok {
+		return err
+	}
+	return &ProcessError{
+		Pid:      process.Pid(),
+		SystemID: process.SystemID(),
+		Op:       op,
+		Err:      err,
+		Events:   events,
+	}
+}
+
+// IsNotExist checks if an error is caused by the Container or Process not existing.
+// Note: Currently, ErrElementNotFound can mean that a Process has either
+// already exited, or does not exist. Both IsAlreadyStopped and IsNotExist
+// will currently return true when the error is ErrElementNotFound or ErrProcNotFound.
+func IsNotExist(err error) bool {
+	err = getInnerError(err)
+	return err == ErrComputeSystemDoesNotExist ||
+		err == ErrElementNotFound ||
+		err == ErrProcNotFound
+}
+
+// IsAlreadyClosed checks if an error is caused by the Container or Process having been
+// already closed by a call to the Close() method.
+func IsAlreadyClosed(err error) bool {
+	err = getInnerError(err)
+	return err == ErrAlreadyClosed
+}
+
+// IsPending returns a boolean indicating whether the error is that
+// the requested operation is being completed in the background.
+func IsPending(err error) bool {
+	err = getInnerError(err)
+	return err == ErrVmcomputeOperationPending
+}
+
+// IsTimeout returns a boolean indicating whether the error is caused by
+// a timeout waiting for the operation to complete.
+func IsTimeout(err error) bool {
+	err = getInnerError(err)
+	return err == ErrTimeout
+}
+
+// IsAlreadyStopped returns a boolean indicating whether the error is caused by
+// a Container or Process being already stopped.
+// Note: Currently, ErrElementNotFound can mean that a Process has either
+// already exited, or does not exist. Both IsAlreadyStopped and IsNotExist
+// will currently return true when the error is ErrElementNotFound or ErrProcNotFound.
+func IsAlreadyStopped(err error) bool {
+	err = getInnerError(err)
+	return err == ErrVmcomputeAlreadyStopped ||
+		err == ErrElementNotFound ||
+		err == ErrProcNotFound
+}
+
+// IsNotSupported returns a boolean indicating whether the error is caused by
+// unsupported platform requests
+// Note: Currently Unsupported platform requests can be mean either
+// ErrVmcomputeInvalidJSON, ErrInvalidData, ErrNotSupported or ErrVmcomputeUnknownMessage
+// is thrown from the Platform
+func IsNotSupported(err error) bool {
+	err = getInnerError(err)
+	// If Platform doesn't recognize or support the request sent, below errors are seen
+	return err == ErrVmcomputeInvalidJSON ||
+		err == ErrInvalidData ||
+		err == ErrNotSupported ||
+		err == ErrVmcomputeUnknownMessage
+}
+
+func getInnerError(err error) error {
+	switch pe := err.(type) {
+	case nil:
+		return nil
+	case *HcsError:
+		err = pe.Err
+	case *SystemError:
+		err = pe.Err
+	case *ProcessError:
+		err = pe.Err
+	}
+	return err
+}

vendor/github.com/Microsoft/hcsshim/internal/hcs/hcs.go

@@ -0,0 +1,48 @@
+// Shim for the Host Compute Service (HCS) to manage Windows Server
+// containers and Hyper-V containers.
+
+package hcs
+
+import (
+	"syscall"
+)
+
+//go:generate go run ../../mksyscall_windows.go -output zsyscall_windows.go hcs.go
+
+//sys hcsEnumerateComputeSystems(query string, computeSystems **uint16, result **uint16) (hr error) = vmcompute.HcsEnumerateComputeSystems?
+//sys hcsCreateComputeSystem(id string, configuration string, identity syscall.Handle, computeSystem *hcsSystem, result **uint16) (hr error) = vmcompute.HcsCreateComputeSystem?
+//sys hcsOpenComputeSystem(id string, computeSystem *hcsSystem, result **uint16) (hr error) = vmcompute.HcsOpenComputeSystem?
+//sys hcsCloseComputeSystem(computeSystem hcsSystem) (hr error) = vmcompute.HcsCloseComputeSystem?
+//sys hcsStartComputeSystem(computeSystem hcsSystem, options string, result **uint16) (hr error) = vmcompute.HcsStartComputeSystem?
+//sys hcsShutdownComputeSystem(computeSystem hcsSystem, options string, result **uint16) (hr error) = vmcompute.HcsShutdownComputeSystem?
+//sys hcsTerminateComputeSystem(computeSystem hcsSystem, options string, result **uint16) (hr error) = vmcompute.HcsTerminateComputeSystem?
+//sys hcsPauseComputeSystem(computeSystem hcsSystem, options string, result **uint16) (hr error) = vmcompute.HcsPauseComputeSystem?
+//sys hcsResumeComputeSystem(computeSystem hcsSystem, options string, result **uint16) (hr error) = vmcompute.HcsResumeComputeSystem?
+//sys hcsGetComputeSystemProperties(computeSystem hcsSystem, propertyQuery string, properties **uint16, result **uint16) (hr error) = vmcompute.HcsGetComputeSystemProperties?
+//sys hcsModifyComputeSystem(computeSystem hcsSystem, configuration string, result **uint16) (hr error) = vmcompute.HcsModifyComputeSystem?
+//sys hcsRegisterComputeSystemCallback(computeSystem hcsSystem, callback uintptr, context uintptr, callbackHandle *hcsCallback) (hr error) = vmcompute.HcsRegisterComputeSystemCallback?
+//sys hcsUnregisterComputeSystemCallback(callbackHandle hcsCallback) (hr error) = vmcompute.HcsUnregisterComputeSystemCallback?
+
+//sys hcsCreateProcess(computeSystem hcsSystem, processParameters string, processInformation *hcsProcessInformation, process *hcsProcess, result **uint16) (hr error) = vmcompute.HcsCreateProcess?
+//sys hcsOpenProcess(computeSystem hcsSystem, pid uint32, process *hcsProcess, result **uint16) (hr error) = vmcompute.HcsOpenProcess?
+//sys hcsCloseProcess(process hcsProcess) (hr error) = vmcompute.HcsCloseProcess?
+//sys hcsTerminateProcess(process hcsProcess, result **uint16) (hr error) = vmcompute.HcsTerminateProcess?
+//sys hcsSignalProcess(process hcsProcess, options string, result **uint16) (hr error) = vmcompute.HcsTerminateProcess?
+//sys hcsGetProcessInfo(process hcsProcess, processInformation *hcsProcessInformation, result **uint16) (hr error) = vmcompute.HcsGetProcessInfo?
+//sys hcsGetProcessProperties(process hcsProcess, processProperties **uint16, result **uint16) (hr error) = vmcompute.HcsGetProcessProperties?
+//sys hcsModifyProcess(process hcsProcess, settings string, result **uint16) (hr error) = vmcompute.HcsModifyProcess?
+//sys hcsGetServiceProperties(propertyQuery string, properties **uint16, result **uint16) (hr error) = vmcompute.HcsGetServiceProperties?
+//sys hcsRegisterProcessCallback(process hcsProcess, callback uintptr, context uintptr, callbackHandle *hcsCallback) (hr error) = vmcompute.HcsRegisterProcessCallback?
+//sys hcsUnregisterProcessCallback(callbackHandle hcsCallback) (hr error) = vmcompute.HcsUnregisterProcessCallback?
+
+type hcsSystem syscall.Handle
+type hcsProcess syscall.Handle
+type hcsCallback syscall.Handle
+
+type hcsProcessInformation struct {
+	ProcessId uint32
+	Reserved  uint32
+	StdInput  syscall.Handle
+	StdOutput syscall.Handle
+	StdError  syscall.Handle
+}

vendor/github.com/Microsoft/hcsshim/internal/hcs/log.go

@@ -0,0 +1,20 @@
+package hcs
+
+import "github.com/sirupsen/logrus"
+
+func logOperationBegin(ctx logrus.Fields, msg string) {
+	logrus.WithFields(ctx).Debug(msg)
+}
+
+func logOperationEnd(ctx logrus.Fields, msg string, err error) {
+	// Copy the log and fields first.
+	log := logrus.WithFields(ctx)
+	if err == nil {
+		log.Debug(msg)
+	} else {
+		// Edit only the copied field data to avoid race conditions on the
+		// write.
+		log.Data[logrus.ErrorKey] = err
+		log.Error(msg)
+	}
+}

vendor/github.com/Microsoft/hcsshim/internal/hcs/process.go

@@ -0,0 +1,459 @@
+package hcs
+
+import (
+	"encoding/json"
+	"io"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/Microsoft/hcsshim/internal/guestrequest"
+	"github.com/Microsoft/hcsshim/internal/interop"
+	"github.com/Microsoft/hcsshim/internal/logfields"
+	"github.com/sirupsen/logrus"
+)
+
+// ContainerError is an error encountered in HCS
+type Process struct {
+	handleLock     sync.RWMutex
+	handle         hcsProcess
+	processID      int
+	system         *System
+	cachedPipes    *cachedPipes
+	callbackNumber uintptr
+
+	logctx logrus.Fields
+}
+
+func newProcess(process hcsProcess, processID int, computeSystem *System) *Process {
+	return &Process{
+		handle:    process,
+		processID: processID,
+		system:    computeSystem,
+		logctx: logrus.Fields{
+			logfields.ContainerID: computeSystem.ID(),
+			logfields.ProcessID:   processID,
+		},
+	}
+}
+
+type cachedPipes struct {
+	stdIn  syscall.Handle
+	stdOut syscall.Handle
+	stdErr syscall.Handle
+}
+
+type processModifyRequest struct {
+	Operation   string
+	ConsoleSize *consoleSize `json:",omitempty"`
+	CloseHandle *closeHandle `json:",omitempty"`
+}
+
+type consoleSize struct {
+	Height uint16
+	Width  uint16
+}
+
+type closeHandle struct {
+	Handle string
+}
+
+type ProcessStatus struct {
+	ProcessID      uint32
+	Exited         bool
+	ExitCode       uint32
+	LastWaitResult int32
+}
+
+const (
+	stdIn  string = "StdIn"
+	stdOut string = "StdOut"
+	stdErr string = "StdErr"
+)
+
+const (
+	modifyConsoleSize string = "ConsoleSize"
+	modifyCloseHandle string = "CloseHandle"
+)
+
+// Pid returns the process ID of the process within the container.
+func (process *Process) Pid() int {
+	return process.processID
+}
+
+// SystemID returns the ID of the process's compute system.
+func (process *Process) SystemID() string {
+	return process.system.ID()
+}
+
+func (process *Process) logOperationBegin(operation string) {
+	logOperationBegin(
+		process.logctx,
+		operation+" - Begin Operation")
+}
+
+func (process *Process) logOperationEnd(operation string, err error) {
+	var result string
+	if err == nil {
+		result = "Success"
+	} else {
+		result = "Error"
+	}
+
+	logOperationEnd(
+		process.logctx,
+		operation+" - End Operation - "+result,
+		err)
+}
+
+// Signal signals the process with `options`.
+func (process *Process) Signal(options guestrequest.SignalProcessOptions) (err error) {
+	process.handleLock.RLock()
+	defer process.handleLock.RUnlock()
+
+	operation := "hcsshim::Process::Signal"
+	process.logOperationBegin(operation)
+	defer func() { process.logOperationEnd(operation, err) }()
+
+	if process.handle == 0 {
+		return makeProcessError(process, operation, ErrAlreadyClosed, nil)
+	}
+
+	optionsb, err := json.Marshal(options)
+	if err != nil {
+		return err
+	}
+
+	optionsStr := string(optionsb)
+
+	var resultp *uint16
+	syscallWatcher(process.logctx, func() {
+		err = hcsSignalProcess(process.handle, optionsStr, &resultp)
+	})
+	events := processHcsResult(resultp)
+	if err != nil {
+		return makeProcessError(process, operation, err, events)
+	}
+
+	return nil
+}
+
+// Kill signals the process to terminate but does not wait for it to finish terminating.
+func (process *Process) Kill() (err error) {
+	process.handleLock.RLock()
+	defer process.handleLock.RUnlock()
+
+	operation := "hcsshim::Process::Kill"
+	process.logOperationBegin(operation)
+	defer func() { process.logOperationEnd(operation, err) }()
+
+	if process.handle == 0 {
+		return makeProcessError(process, operation, ErrAlreadyClosed, nil)
+	}
+
+	var resultp *uint16
+	syscallWatcher(process.logctx, func() {
+		err = hcsTerminateProcess(process.handle, &resultp)
+	})
+	events := processHcsResult(resultp)
+	if err != nil {
+		return makeProcessError(process, operation, err, events)
+	}
+
+	return nil
+}
+
+// Wait waits for the process to exit.
+func (process *Process) Wait() (err error) {
+	operation := "hcsshim::Process::Wait"
+	process.logOperationBegin(operation)
+	defer func() { process.logOperationEnd(operation, err) }()
+
+	err = waitForNotification(process.callbackNumber, hcsNotificationProcessExited, nil)
+	if err != nil {
+		return makeProcessError(process, operation, err, nil)
+	}
+
+	return nil
+}
+
+// WaitTimeout waits for the process to exit or the duration to elapse. It returns
+// false if timeout occurs.
+func (process *Process) WaitTimeout(timeout time.Duration) (err error) {
+	operation := "hcssshim::Process::WaitTimeout"
+	process.logOperationBegin(operation)
+	defer func() { process.logOperationEnd(operation, err) }()
+
+	err = waitForNotification(process.callbackNumber, hcsNotificationProcessExited, &timeout)
+	if err != nil {
+		return makeProcessError(process, operation, err, nil)
+	}
+
+	return nil
+}
+
+// ResizeConsole resizes the console of the process.
+func (process *Process) ResizeConsole(width, height uint16) (err error) {
+	process.handleLock.RLock()
+	defer process.handleLock.RUnlock()
+
+	operation := "hcsshim::Process::ResizeConsole"
+	process.logOperationBegin(operation)
+	defer func() { process.logOperationEnd(operation, err) }()
+
+	if process.handle == 0 {
+		return makeProcessError(process, operation, ErrAlreadyClosed, nil)
+	}
+
+	modifyRequest := processModifyRequest{
+		Operation: modifyConsoleSize,
+		ConsoleSize: &consoleSize{
+			Height: height,
+			Width:  width,
+		},
+	}
+
+	modifyRequestb, err := json.Marshal(modifyRequest)
+	if err != nil {
+		return err
+	}
+
+	modifyRequestStr := string(modifyRequestb)
+
+	var resultp *uint16
+	err = hcsModifyProcess(process.handle, modifyRequestStr, &resultp)
+	events := processHcsResult(resultp)
+	if err != nil {
+		return makeProcessError(process, operation, err, events)
+	}
+
+	return nil
+}
+
+func (process *Process) Properties() (_ *ProcessStatus, err error) {
+	process.handleLock.RLock()
+	defer process.handleLock.RUnlock()
+
+	operation := "hcsshim::Process::Properties"
+	process.logOperationBegin(operation)
+	defer func() { process.logOperationEnd(operation, err) }()
+
+	if process.handle == 0 {
+		return nil, makeProcessError(process, operation, ErrAlreadyClosed, nil)
+	}
+
+	var (
+		resultp     *uint16
+		propertiesp *uint16
+	)
+	syscallWatcher(process.logctx, func() {
+		err = hcsGetProcessProperties(process.handle, &propertiesp, &resultp)
+	})
+	events := processHcsResult(resultp)
+	if err != nil {
+		return nil, makeProcessError(process, operation, err, events)
+	}
+
+	if propertiesp == nil {
+		return nil, ErrUnexpectedValue
+	}
+	propertiesRaw := interop.ConvertAndFreeCoTaskMemBytes(propertiesp)
+
+	properties := &ProcessStatus{}
+	if err := json.Unmarshal(propertiesRaw, properties); err != nil {
+		return nil, makeProcessError(process, operation, err, nil)
+	}
+
+	return properties, nil
+}
+
+// ExitCode returns the exit code of the process. The process must have
+// already terminated.
+func (process *Process) ExitCode() (_ int, err error) {
+	operation := "hcsshim::Process::ExitCode"
+	process.logOperationBegin(operation)
+	defer func() { process.logOperationEnd(operation, err) }()
+
+	properties, err := process.Properties()
+	if err != nil {
+		return 0, makeProcessError(process, operation, err, nil)
+	}
+
+	if properties.Exited == false {
+		return 0, makeProcessError(process, operation, ErrInvalidProcessState, nil)
+	}
+
+	if properties.LastWaitResult != 0 {
+		return 0, makeProcessError(process, operation, syscall.Errno(properties.LastWaitResult), nil)
+	}
+
+	return int(properties.ExitCode), nil
+}
+
+// Stdio returns the stdin, stdout, and stderr pipes, respectively. Closing
+// these pipes does not close the underlying pipes; it should be possible to
+// call this multiple times to get multiple interfaces.
+func (process *Process) Stdio() (_ io.WriteCloser, _ io.ReadCloser, _ io.ReadCloser, err error) {
+	process.handleLock.RLock()
+	defer process.handleLock.RUnlock()
+
+	operation := "hcsshim::Process::Stdio"
+	process.logOperationBegin(operation)
+	defer func() { process.logOperationEnd(operation, err) }()
+
+	if process.handle == 0 {
+		return nil, nil, nil, makeProcessError(process, operation, ErrAlreadyClosed, nil)
+	}
+
+	var stdIn, stdOut, stdErr syscall.Handle
+
+	if process.cachedPipes == nil {
+		var (
+			processInfo hcsProcessInformation
+			resultp     *uint16
+		)
+		err = hcsGetProcessInfo(process.handle, &processInfo, &resultp)
+		events := processHcsResult(resultp)
+		if err != nil {
+			return nil, nil, nil, makeProcessError(process, operation, err, events)
+		}
+
+		stdIn, stdOut, stdErr = processInfo.StdInput, processInfo.StdOutput, processInfo.StdError
+	} else {
+		// Use cached pipes
+		stdIn, stdOut, stdErr = process.cachedPipes.stdIn, process.cachedPipes.stdOut, process.cachedPipes.stdErr
+
+		// Invalidate the cache
+		process.cachedPipes = nil
+	}
+
+	pipes, err := makeOpenFiles([]syscall.Handle{stdIn, stdOut, stdErr})
+	if err != nil {
+		return nil, nil, nil, makeProcessError(process, operation, err, nil)
+	}
+
+	return pipes[0], pipes[1], pipes[2], nil
+}
+
+// CloseStdin closes the write side of the stdin pipe so that the process is
+// notified on the read side that there is no more data in stdin.
+func (process *Process) CloseStdin() (err error) {
+	process.handleLock.RLock()
+	defer process.handleLock.RUnlock()
+
+	operation := "hcsshim::Process::CloseStdin"
+	process.logOperationBegin(operation)
+	defer func() { process.logOperationEnd(operation, err) }()
+
+	if process.handle == 0 {
+		return makeProcessError(process, operation, ErrAlreadyClosed, nil)
+	}
+
+	modifyRequest := processModifyRequest{
+		Operation: modifyCloseHandle,
+		CloseHandle: &closeHandle{
+			Handle: stdIn,
+		},
+	}
+
+	modifyRequestb, err := json.Marshal(modifyRequest)
+	if err != nil {
+		return err
+	}
+
+	modifyRequestStr := string(modifyRequestb)
+
+	var resultp *uint16
+	err = hcsModifyProcess(process.handle, modifyRequestStr, &resultp)
+	events := processHcsResult(resultp)
+	if err != nil {
+		return makeProcessError(process, operation, err, events)
+	}
+
+	return nil
+}
+
+// Close cleans up any state associated with the process but does not kill
+// or wait on it.
+func (process *Process) Close() (err error) {
+	process.handleLock.Lock()
+	defer process.handleLock.Unlock()
+
+	operation := "hcsshim::Process::Close"
+	process.logOperationBegin(operation)
+	defer func() { process.logOperationEnd(operation, err) }()
+
+	// Don't double free this
+	if process.handle == 0 {
+		return nil
+	}
+
+	if err = process.unregisterCallback(); err != nil {
+		return makeProcessError(process, operation, err, nil)
+	}
+
+	if err = hcsCloseProcess(process.handle); err != nil {
+		return makeProcessError(process, operation, err, nil)
+	}
+
+	process.handle = 0
+
+	return nil
+}
+
+func (process *Process) registerCallback() error {
+	context := &notifcationWatcherContext{
+		channels: newChannels(),
+	}
+
+	callbackMapLock.Lock()
+	callbackNumber := nextCallback
+	nextCallback++
+	callbackMap[callbackNumber] = context
+	callbackMapLock.Unlock()
+
+	var callbackHandle hcsCallback
+	err := hcsRegisterProcessCallback(process.handle, notificationWatcherCallback, callbackNumber, &callbackHandle)
+	if err != nil {
+		return err
+	}
+	context.handle = callbackHandle
+	process.callbackNumber = callbackNumber
+
+	return nil
+}
+
+func (process *Process) unregisterCallback() error {
+	callbackNumber := process.callbackNumber
+
+	callbackMapLock.RLock()
+	context := callbackMap[callbackNumber]
+	callbackMapLock.RUnlock()
+
+	if context == nil {
+		return nil
+	}
+
+	handle := context.handle
+
+	if handle == 0 {
+		return nil
+	}
+
+	// hcsUnregisterProcessCallback has its own syncronization
+	// to wait for all callbacks to complete. We must NOT hold the callbackMapLock.
+	err := hcsUnregisterProcessCallback(handle)
+	if err != nil {
+		return err
+	}
+
+	closeChannels(context.channels)
+
+	callbackMapLock.Lock()
+	callbackMap[callbackNumber] = nil
+	callbackMapLock.Unlock()
+
+	handle = 0
+
+	return nil
+}

vendor/github.com/Microsoft/hcsshim/internal/hcs/system.go

@@ -0,0 +1,685 @@
+package hcs
+
+import (
+	"encoding/json"
+	"os"
+	"strconv"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/Microsoft/hcsshim/internal/interop"
+	"github.com/Microsoft/hcsshim/internal/logfields"
+	"github.com/Microsoft/hcsshim/internal/schema1"
+	"github.com/Microsoft/hcsshim/internal/timeout"
+	"github.com/sirupsen/logrus"
+)
+
+// currentContainerStarts is used to limit the number of concurrent container
+// starts.
+var currentContainerStarts containerStarts
+
+type containerStarts struct {
+	maxParallel int
+	inProgress  int
+	sync.Mutex
+}
+
+func init() {
+	mpsS := os.Getenv("HCSSHIM_MAX_PARALLEL_START")
+	if len(mpsS) > 0 {
+		mpsI, err := strconv.Atoi(mpsS)
+		if err != nil || mpsI < 0 {
+			return
+		}
+		currentContainerStarts.maxParallel = mpsI
+	}
+}
+
+type System struct {
+	handleLock     sync.RWMutex
+	handle         hcsSystem
+	id             string
+	callbackNumber uintptr
+
+	logctx logrus.Fields
+}
+
+func newSystem(id string) *System {
+	return &System{
+		id: id,
+		logctx: logrus.Fields{
+			logfields.ContainerID: id,
+		},
+	}
+}
+
+func (computeSystem *System) logOperationBegin(operation string) {
+	logOperationBegin(
+		computeSystem.logctx,
+		operation+" - Begin Operation")
+}
+
+func (computeSystem *System) logOperationEnd(operation string, err error) {
+	var result string
+	if err == nil {
+		result = "Success"
+	} else {
+		result = "Error"
+	}
+
+	logOperationEnd(
+		computeSystem.logctx,
+		operation+" - End Operation - "+result,
+		err)
+}
+
+// CreateComputeSystem creates a new compute system with the given configuration but does not start it.
+func CreateComputeSystem(id string, hcsDocumentInterface interface{}) (_ *System, err error) {
+	operation := "hcsshim::CreateComputeSystem"
+
+	computeSystem := newSystem(id)
+	computeSystem.logOperationBegin(operation)
+	defer func() { computeSystem.logOperationEnd(operation, err) }()
+
+	hcsDocumentB, err := json.Marshal(hcsDocumentInterface)
+	if err != nil {
+		return nil, err
+	}
+
+	hcsDocument := string(hcsDocumentB)
+
+	logrus.WithFields(computeSystem.logctx).
+		WithField(logfields.JSON, hcsDocument).
+		Debug("HCS ComputeSystem Document")
+
+	var (
+		resultp     *uint16
+		identity    syscall.Handle
+		createError error
+	)
+	syscallWatcher(computeSystem.logctx, func() {
+		createError = hcsCreateComputeSystem(id, hcsDocument, identity, &computeSystem.handle, &resultp)
+	})
+
+	if createError == nil || IsPending(createError) {
+		if err = computeSystem.registerCallback(); err != nil {
+			// Terminate the compute system if it still exists. We're okay to
+			// ignore a failure here.
+			computeSystem.Terminate()
+			return nil, makeSystemError(computeSystem, operation, "", err, nil)
+		}
+	}
+
+	events, err := processAsyncHcsResult(createError, resultp, computeSystem.callbackNumber, hcsNotificationSystemCreateCompleted, &timeout.SystemCreate)
+	if err != nil {
+		if err == ErrTimeout {
+			// Terminate the compute system if it still exists. We're okay to
+			// ignore a failure here.
+			computeSystem.Terminate()
+		}
+		return nil, makeSystemError(computeSystem, operation, hcsDocument, err, events)
+	}
+
+	return computeSystem, nil
+}
+
+// OpenComputeSystem opens an existing compute system by ID.
+func OpenComputeSystem(id string) (_ *System, err error) {
+	operation := "hcsshim::OpenComputeSystem"
+
+	computeSystem := newSystem(id)
+	computeSystem.logOperationBegin(operation)
+	defer func() {
+		if IsNotExist(err) {
+			computeSystem.logOperationEnd(operation, nil)
+		} else {
+			computeSystem.logOperationEnd(operation, err)
+		}
+	}()
+
+	var (
+		handle  hcsSystem
+		resultp *uint16
+	)
+	err = hcsOpenComputeSystem(id, &handle, &resultp)
+	events := processHcsResult(resultp)
+	if err != nil {
+		return nil, makeSystemError(computeSystem, operation, "", err, events)
+	}
+
+	computeSystem.handle = handle
+
+	if err = computeSystem.registerCallback(); err != nil {
+		return nil, makeSystemError(computeSystem, operation, "", err, nil)
+	}
+
+	return computeSystem, nil
+}
+
+// GetComputeSystems gets a list of the compute systems on the system that match the query
+func GetComputeSystems(q schema1.ComputeSystemQuery) (_ []schema1.ContainerProperties, err error) {
+	operation := "hcsshim::GetComputeSystems"
+	fields := logrus.Fields{}
+	logOperationBegin(
+		fields,
+		operation+" - Begin Operation")
+
+	defer func() {
+		var result string
+		if err == nil {
+			result = "Success"
+		} else {
+			result = "Error"
+		}
+
+		logOperationEnd(
+			fields,
+			operation+" - End Operation - "+result,
+			err)
+	}()
+
+	queryb, err := json.Marshal(q)
+	if err != nil {
+		return nil, err
+	}
+
+	query := string(queryb)
+
+	logrus.WithFields(fields).
+		WithField(logfields.JSON, query).
+		Debug("HCS ComputeSystem Query")
+
+	var (
+		resultp         *uint16
+		computeSystemsp *uint16
+	)
+
+	syscallWatcher(fields, func() {
+		err = hcsEnumerateComputeSystems(query, &computeSystemsp, &resultp)
+	})
+	events := processHcsResult(resultp)
+	if err != nil {
+		return nil, &HcsError{Op: operation, Err: err, Events: events}
+	}
+
+	if computeSystemsp == nil {
+		return nil, ErrUnexpectedValue
+	}
+	computeSystemsRaw := interop.ConvertAndFreeCoTaskMemBytes(computeSystemsp)
+	computeSystems := []schema1.ContainerProperties{}
+	if err = json.Unmarshal(computeSystemsRaw, &computeSystems); err != nil {
+		return nil, err
+	}
+
+	return computeSystems, nil
+}
+
+// Start synchronously starts the computeSystem.
+func (computeSystem *System) Start() (err error) {
+	computeSystem.handleLock.RLock()
+	defer computeSystem.handleLock.RUnlock()
+
+	operation := "hcsshim::ComputeSystem::Start"
+	computeSystem.logOperationBegin(operation)
+	defer func() { computeSystem.logOperationEnd(operation, err) }()
+
+	if computeSystem.handle == 0 {
+		return makeSystemError(computeSystem, "Start", "", ErrAlreadyClosed, nil)
+	}
+
+	// This is a very simple backoff-retry loop to limit the number
+	// of parallel container starts if environment variable
+	// HCSSHIM_MAX_PARALLEL_START is set to a positive integer.
+	// It should generally only be used as a workaround to various
+	// platform issues that exist between RS1 and RS4 as of Aug 2018
+	if currentContainerStarts.maxParallel > 0 {
+		for {
+			currentContainerStarts.Lock()
+			if currentContainerStarts.inProgress < currentContainerStarts.maxParallel {
+				currentContainerStarts.inProgress++
+				currentContainerStarts.Unlock()
+				break
+			}
+			if currentContainerStarts.inProgress == currentContainerStarts.maxParallel {
+				currentContainerStarts.Unlock()
+				time.Sleep(100 * time.Millisecond)
+			}
+		}
+		// Make sure we decrement the count when we are done.
+		defer func() {
+			currentContainerStarts.Lock()
+			currentContainerStarts.inProgress--
+			currentContainerStarts.Unlock()
+		}()
+	}
+
+	var resultp *uint16
+	syscallWatcher(computeSystem.logctx, func() {
+		err = hcsStartComputeSystem(computeSystem.handle, "", &resultp)
+	})
+	events, err := processAsyncHcsResult(err, resultp, computeSystem.callbackNumber, hcsNotificationSystemStartCompleted, &timeout.SystemStart)
+	if err != nil {
+		return makeSystemError(computeSystem, "Start", "", err, events)
+	}
+
+	return nil
+}
+
+// ID returns the compute system's identifier.
+func (computeSystem *System) ID() string {
+	return computeSystem.id
+}
+
+// Shutdown requests a compute system shutdown, if IsPending() on the error returned is true,
+// it may not actually be shut down until Wait() succeeds.
+func (computeSystem *System) Shutdown() (err error) {
+	computeSystem.handleLock.RLock()
+	defer computeSystem.handleLock.RUnlock()
+
+	operation := "hcsshim::ComputeSystem::Shutdown"
+	computeSystem.logOperationBegin(operation)
+	defer func() {
+		if IsAlreadyStopped(err) {
+			computeSystem.logOperationEnd(operation, nil)
+		} else {
+			computeSystem.logOperationEnd(operation, err)
+		}
+	}()
+
+	if computeSystem.handle == 0 {
+		return makeSystemError(computeSystem, "Shutdown", "", ErrAlreadyClosed, nil)
+	}
+
+	var resultp *uint16
+	syscallWatcher(computeSystem.logctx, func() {
+		err = hcsShutdownComputeSystem(computeSystem.handle, "", &resultp)
+	})
+	events := processHcsResult(resultp)
+	if err != nil {
+		return makeSystemError(computeSystem, "Shutdown", "", err, events)
+	}
+
+	return nil
+}
+
+// Terminate requests a compute system terminate, if IsPending() on the error returned is true,
+// it may not actually be shut down until Wait() succeeds.
+func (computeSystem *System) Terminate() (err error) {
+	computeSystem.handleLock.RLock()
+	defer computeSystem.handleLock.RUnlock()
+
+	operation := "hcsshim::ComputeSystem::Terminate"
+	computeSystem.logOperationBegin(operation)
+	defer func() {
+		if IsPending(err) {
+			computeSystem.logOperationEnd(operation, nil)
+		} else {
+			computeSystem.logOperationEnd(operation, err)
+		}
+	}()
+
+	if computeSystem.handle == 0 {
+		return makeSystemError(computeSystem, "Terminate", "", ErrAlreadyClosed, nil)
+	}
+
+	var resultp *uint16
+	syscallWatcher(computeSystem.logctx, func() {
+		err = hcsTerminateComputeSystem(computeSystem.handle, "", &resultp)
+	})
+	events := processHcsResult(resultp)
+	if err != nil && err != ErrVmcomputeAlreadyStopped {
+		return makeSystemError(computeSystem, "Terminate", "", err, events)
+	}
+
+	return nil
+}
+
+// Wait synchronously waits for the compute system to shutdown or terminate.
+func (computeSystem *System) Wait() (err error) {
+	operation := "hcsshim::ComputeSystem::Wait"
+	computeSystem.logOperationBegin(operation)
+	defer func() { computeSystem.logOperationEnd(operation, err) }()
+
+	err = waitForNotification(computeSystem.callbackNumber, hcsNotificationSystemExited, nil)
+	if err != nil {
+		return makeSystemError(computeSystem, "Wait", "", err, nil)
+	}
+
+	return nil
+}
+
+// WaitExpectedError synchronously waits for the compute system to shutdown or
+// terminate, and ignores the passed error if it occurs.
+func (computeSystem *System) WaitExpectedError(expected error) (err error) {
+	operation := "hcsshim::ComputeSystem::WaitExpectedError"
+	computeSystem.logOperationBegin(operation)
+	defer func() { computeSystem.logOperationEnd(operation, err) }()
+
+	err = waitForNotification(computeSystem.callbackNumber, hcsNotificationSystemExited, nil)
+	if err != nil && getInnerError(err) != expected {
+		return makeSystemError(computeSystem, "WaitExpectedError", "", err, nil)
+	}
+
+	return nil
+}
+
+// WaitTimeout synchronously waits for the compute system to terminate or the duration to elapse.
+// If the timeout expires, IsTimeout(err) == true
+func (computeSystem *System) WaitTimeout(timeout time.Duration) (err error) {
+	operation := "hcsshim::ComputeSystem::WaitTimeout"
+	computeSystem.logOperationBegin(operation)
+	defer func() { computeSystem.logOperationEnd(operation, err) }()
+
+	err = waitForNotification(computeSystem.callbackNumber, hcsNotificationSystemExited, &timeout)
+	if err != nil {
+		return makeSystemError(computeSystem, "WaitTimeout", "", err, nil)
+	}
+
+	return nil
+}
+
+func (computeSystem *System) Properties(types ...schema1.PropertyType) (_ *schema1.ContainerProperties, err error) {
+	computeSystem.handleLock.RLock()
+	defer computeSystem.handleLock.RUnlock()
+
+	operation := "hcsshim::ComputeSystem::Properties"
+	computeSystem.logOperationBegin(operation)
+	defer func() { computeSystem.logOperationEnd(operation, err) }()
+
+	queryj, err := json.Marshal(schema1.PropertyQuery{types})
+	if err != nil {
+		return nil, makeSystemError(computeSystem, "Properties", "", err, nil)
+	}
+
+	logrus.WithFields(computeSystem.logctx).
+		WithField(logfields.JSON, queryj).
+		Debug("HCS ComputeSystem Properties Query")
+
+	var resultp, propertiesp *uint16
+	syscallWatcher(computeSystem.logctx, func() {
+		err = hcsGetComputeSystemProperties(computeSystem.handle, string(queryj), &propertiesp, &resultp)
+	})
+	events := processHcsResult(resultp)
+	if err != nil {
+		return nil, makeSystemError(computeSystem, "Properties", "", err, events)
+	}
+
+	if propertiesp == nil {
+		return nil, ErrUnexpectedValue
+	}
+	propertiesRaw := interop.ConvertAndFreeCoTaskMemBytes(propertiesp)
+	properties := &schema1.ContainerProperties{}
+	if err := json.Unmarshal(propertiesRaw, properties); err != nil {
+		return nil, makeSystemError(computeSystem, "Properties", "", err, nil)
+	}
+
+	return properties, nil
+}
+
+// Pause pauses the execution of the computeSystem. This feature is not enabled in TP5.
+func (computeSystem *System) Pause() (err error) {
+	computeSystem.handleLock.RLock()
+	defer computeSystem.handleLock.RUnlock()
+
+	operation := "hcsshim::ComputeSystem::Pause"
+	computeSystem.logOperationBegin(operation)
+	defer func() { computeSystem.logOperationEnd(operation, err) }()
+
+	if computeSystem.handle == 0 {
+		return makeSystemError(computeSystem, "Pause", "", ErrAlreadyClosed, nil)
+	}
+
+	var resultp *uint16
+	syscallWatcher(computeSystem.logctx, func() {
+		err = hcsPauseComputeSystem(computeSystem.handle, "", &resultp)
+	})
+	events, err := processAsyncHcsResult(err, resultp, computeSystem.callbackNumber, hcsNotificationSystemPauseCompleted, &timeout.SystemPause)
+	if err != nil {
+		return makeSystemError(computeSystem, "Pause", "", err, events)
+	}
+
+	return nil
+}
+
+// Resume resumes the execution of the computeSystem. This feature is not enabled in TP5.
+func (computeSystem *System) Resume() (err error) {
+	computeSystem.handleLock.RLock()
+	defer computeSystem.handleLock.RUnlock()
+
+	operation := "hcsshim::ComputeSystem::Resume"
+	computeSystem.logOperationBegin(operation)
+	defer func() { computeSystem.logOperationEnd(operation, err) }()
+
+	if computeSystem.handle == 0 {
+		return makeSystemError(computeSystem, "Resume", "", ErrAlreadyClosed, nil)
+	}
+
+	var resultp *uint16
+	syscallWatcher(computeSystem.logctx, func() {
+		err = hcsResumeComputeSystem(computeSystem.handle, "", &resultp)
+	})
+	events, err := processAsyncHcsResult(err, resultp, computeSystem.callbackNumber, hcsNotificationSystemResumeCompleted, &timeout.SystemResume)
+	if err != nil {
+		return makeSystemError(computeSystem, "Resume", "", err, events)
+	}
+
+	return nil
+}
+
+// CreateProcess launches a new process within the computeSystem.
+func (computeSystem *System) CreateProcess(c interface{}) (_ *Process, err error) {
+	computeSystem.handleLock.RLock()
+	defer computeSystem.handleLock.RUnlock()
+
+	operation := "hcsshim::ComputeSystem::CreateProcess"
+	computeSystem.logOperationBegin(operation)
+	defer func() { computeSystem.logOperationEnd(operation, err) }()
+
+	var (
+		processInfo   hcsProcessInformation
+		processHandle hcsProcess
+		resultp       *uint16
+	)
+
+	if computeSystem.handle == 0 {
+		return nil, makeSystemError(computeSystem, "CreateProcess", "", ErrAlreadyClosed, nil)
+	}
+
+	configurationb, err := json.Marshal(c)
+	if err != nil {
+		return nil, makeSystemError(computeSystem, "CreateProcess", "", err, nil)
+	}
+
+	configuration := string(configurationb)
+
+	logrus.WithFields(computeSystem.logctx).
+		WithField(logfields.JSON, configuration).
+		Debug("HCS ComputeSystem Process Document")
+
+	syscallWatcher(computeSystem.logctx, func() {
+		err = hcsCreateProcess(computeSystem.handle, configuration, &processInfo, &processHandle, &resultp)
+	})
+	events := processHcsResult(resultp)
+	if err != nil {
+		return nil, makeSystemError(computeSystem, "CreateProcess", configuration, err, events)
+	}
+
+	logrus.WithFields(computeSystem.logctx).
+		WithField(logfields.ProcessID, processInfo.ProcessId).
+		Debug("HCS ComputeSystem CreateProcess PID")
+
+	process := newProcess(processHandle, int(processInfo.ProcessId), computeSystem)
+	process.cachedPipes = &cachedPipes{
+		stdIn:  processInfo.StdInput,
+		stdOut: processInfo.StdOutput,
+		stdErr: processInfo.StdError,
+	}
+
+	if err = process.registerCallback(); err != nil {
+		return nil, makeSystemError(computeSystem, "CreateProcess", "", err, nil)
+	}
+
+	return process, nil
+}
+
+// OpenProcess gets an interface to an existing process within the computeSystem.
+func (computeSystem *System) OpenProcess(pid int) (_ *Process, err error) {
+	computeSystem.handleLock.RLock()
+	defer computeSystem.handleLock.RUnlock()
+
+	// Add PID for the context of this operation
+	computeSystem.logctx[logfields.ProcessID] = pid
+	defer delete(computeSystem.logctx, logfields.ProcessID)
+
+	operation := "hcsshim::ComputeSystem::OpenProcess"
+	computeSystem.logOperationBegin(operation)
+	defer func() { computeSystem.logOperationEnd(operation, err) }()
+
+	var (
+		processHandle hcsProcess
+		resultp       *uint16
+	)
+
+	if computeSystem.handle == 0 {
+		return nil, makeSystemError(computeSystem, "OpenProcess", "", ErrAlreadyClosed, nil)
+	}
+
+	syscallWatcher(computeSystem.logctx, func() {
+		err = hcsOpenProcess(computeSystem.handle, uint32(pid), &processHandle, &resultp)
+	})
+	events := processHcsResult(resultp)
+	if err != nil {
+		return nil, makeSystemError(computeSystem, "OpenProcess", "", err, events)
+	}
+
+	process := newProcess(processHandle, pid, computeSystem)
+	if err = process.registerCallback(); err != nil {
+		return nil, makeSystemError(computeSystem, "OpenProcess", "", err, nil)
+	}
+
+	return process, nil
+}
+
+// Close cleans up any state associated with the compute system but does not terminate or wait for it.
+func (computeSystem *System) Close() (err error) {
+	computeSystem.handleLock.Lock()
+	defer computeSystem.handleLock.Unlock()
+
+	operation := "hcsshim::ComputeSystem::Close"
+	computeSystem.logOperationBegin(operation)
+	defer func() { computeSystem.logOperationEnd(operation, err) }()
+
+	// Don't double free this
+	if computeSystem.handle == 0 {
+		return nil
+	}
+
+	if err = computeSystem.unregisterCallback(); err != nil {
+		return makeSystemError(computeSystem, "Close", "", err, nil)
+	}
+
+	syscallWatcher(computeSystem.logctx, func() {
+		err = hcsCloseComputeSystem(computeSystem.handle)
+	})
+	if err != nil {
+		return makeSystemError(computeSystem, "Close", "", err, nil)
+	}
+
+	computeSystem.handle = 0
+
+	return nil
+}
+
+func (computeSystem *System) registerCallback() error {
+	context := &notifcationWatcherContext{
+		channels: newChannels(),
+	}
+
+	callbackMapLock.Lock()
+	callbackNumber := nextCallback
+	nextCallback++
+	callbackMap[callbackNumber] = context
+	callbackMapLock.Unlock()
+
+	var callbackHandle hcsCallback
+	err := hcsRegisterComputeSystemCallback(computeSystem.handle, notificationWatcherCallback, callbackNumber, &callbackHandle)
+	if err != nil {
+		return err
+	}
+	context.handle = callbackHandle
+	computeSystem.callbackNumber = callbackNumber
+
+	return nil
+}
+
+func (computeSystem *System) unregisterCallback() error {
+	callbackNumber := computeSystem.callbackNumber
+
+	callbackMapLock.RLock()
+	context := callbackMap[callbackNumber]
+	callbackMapLock.RUnlock()
+
+	if context == nil {
+		return nil
+	}
+
+	handle := context.handle
+
+	if handle == 0 {
+		return nil
+	}
+
+	// hcsUnregisterComputeSystemCallback has its own syncronization
+	// to wait for all callbacks to complete. We must NOT hold the callbackMapLock.
+	err := hcsUnregisterComputeSystemCallback(handle)
+	if err != nil {
+		return err
+	}
+
+	closeChannels(context.channels)
+
+	callbackMapLock.Lock()
+	callbackMap[callbackNumber] = nil
+	callbackMapLock.Unlock()
+
+	handle = 0
+
+	return nil
+}
+
+// Modify the System by sending a request to HCS
+func (computeSystem *System) Modify(config interface{}) (err error) {
+	computeSystem.handleLock.RLock()
+	defer computeSystem.handleLock.RUnlock()
+
+	operation := "hcsshim::ComputeSystem::Modify"
+	computeSystem.logOperationBegin(operation)
+	defer func() { computeSystem.logOperationEnd(operation, err) }()
+
+	if computeSystem.handle == 0 {
+		return makeSystemError(computeSystem, "Modify", "", ErrAlreadyClosed, nil)
+	}
+
+	requestJSON, err := json.Marshal(config)
+	if err != nil {
+		return err
+	}
+
+	requestString := string(requestJSON)
+
+	logrus.WithFields(computeSystem.logctx).
+		WithField(logfields.JSON, requestString).
+		Debug("HCS ComputeSystem Modify Document")
+
+	var resultp *uint16
+	syscallWatcher(computeSystem.logctx, func() {
+		err = hcsModifyComputeSystem(computeSystem.handle, requestString, &resultp)
+	})
+	events := processHcsResult(resultp)
+	if err != nil {
+		return makeSystemError(computeSystem, "Modify", requestString, err, events)
+	}
+
+	return nil
+}

vendor/github.com/Microsoft/hcsshim/internal/hcs/utils.go

@@ -0,0 +1,33 @@
+package hcs
+
+import (
+	"io"
+	"syscall"
+
+	"github.com/Microsoft/go-winio"
+)
+
+// makeOpenFiles calls winio.MakeOpenFile for each handle in a slice but closes all the handles
+// if there is an error.
+func makeOpenFiles(hs []syscall.Handle) (_ []io.ReadWriteCloser, err error) {
+	fs := make([]io.ReadWriteCloser, len(hs))
+	for i, h := range hs {
+		if h != syscall.Handle(0) {
+			if err == nil {
+				fs[i], err = winio.MakeOpenFile(h)
+			}
+			if err != nil {
+				syscall.Close(h)
+			}
+		}
+	}
+	if err != nil {
+		for _, f := range fs {
+			if f != nil {
+				f.Close()
+			}
+		}
+		return nil, err
+	}
+	return fs, nil
+}

vendor/github.com/Microsoft/hcsshim/internal/hcs/waithelper.go

@@ -0,0 +1,63 @@
+package hcs
+
+import (
+	"time"
+
+	"github.com/sirupsen/logrus"
+)
+
+func processAsyncHcsResult(err error, resultp *uint16, callbackNumber uintptr, expectedNotification hcsNotification, timeout *time.Duration) ([]ErrorEvent, error) {
+	events := processHcsResult(resultp)
+	if IsPending(err) {
+		return nil, waitForNotification(callbackNumber, expectedNotification, timeout)
+	}
+
+	return events, err
+}
+
+func waitForNotification(callbackNumber uintptr, expectedNotification hcsNotification, timeout *time.Duration) error {
+	callbackMapLock.RLock()
+	channels := callbackMap[callbackNumber].channels
+	callbackMapLock.RUnlock()
+
+	expectedChannel := channels[expectedNotification]
+	if expectedChannel == nil {
+		logrus.Errorf("unknown notification type in waitForNotification %x", expectedNotification)
+		return ErrInvalidNotificationType
+	}
+
+	var c <-chan time.Time
+	if timeout != nil {
+		timer := time.NewTimer(*timeout)
+		c = timer.C
+		defer timer.Stop()
+	}
+
+	select {
+	case err, ok := <-expectedChannel:
+		if !ok {
+			return ErrHandleClose
+		}
+		return err
+	case err, ok := <-channels[hcsNotificationSystemExited]:
+		if !ok {
+			return ErrHandleClose
+		}
+		// If the expected notification is hcsNotificationSystemExited which of the two selects
+		// chosen is random. Return the raw error if hcsNotificationSystemExited is expected
+		if channels[hcsNotificationSystemExited] == expectedChannel {
+			return err
+		}
+		return ErrUnexpectedContainerExit
+	case _, ok := <-channels[hcsNotificationServiceDisconnect]:
+		if !ok {
+			return ErrHandleClose
+		}
+		// hcsNotificationServiceDisconnect should never be an expected notification
+		// it does not need the same handling as hcsNotificationSystemExited
+		return ErrUnexpectedProcessAbort
+	case <-c:
+		return ErrTimeout
+	}
+	return nil
+}

vendor/github.com/Microsoft/hcsshim/internal/hcs/watcher.go

@@ -0,0 +1,41 @@
+package hcs
+
+import (
+	"context"
+
+	"github.com/Microsoft/hcsshim/internal/logfields"
+	"github.com/Microsoft/hcsshim/internal/timeout"
+	"github.com/sirupsen/logrus"
+)
+
+// syscallWatcher is used as a very simple goroutine around calls into
+// the platform. In some cases, we have seen HCS APIs not returning due to
+// various bugs, and the goroutine making the syscall ends up not returning,
+// prior to its async callback. By spinning up a syscallWatcher, it allows
+// us to at least log a warning if a syscall doesn't complete in a reasonable
+// amount of time.
+//
+// Usage is:
+//
+// syscallWatcher(logContext, func() {
+//    err = <syscall>(args...)
+// })
+//
+
+func syscallWatcher(logContext logrus.Fields, syscallLambda func()) {
+	ctx, cancel := context.WithTimeout(context.Background(), timeout.SyscallWatcher)
+	defer cancel()
+	go watchFunc(ctx, logContext)
+	syscallLambda()
+}
+
+func watchFunc(ctx context.Context, logContext logrus.Fields) {
+	select {
+	case <-ctx.Done():
+		if ctx.Err() != context.Canceled {
+			logrus.WithFields(logContext).
+				WithField(logfields.Timeout, timeout.SyscallWatcher).
+				Warning("Syscall did not complete within operation timeout. This may indicate a platform issue. If it appears to be making no forward progress, obtain the stacks and see if there is a syscall stuck in the platform API for a significant length of time.")
+		}
+	}
+}

vendor/github.com/Microsoft/hcsshim/internal/hcs/zsyscall_windows.go

@@ -0,0 +1,533 @@
+// Code generated mksyscall_windows.exe DO NOT EDIT
+
+package hcs
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+var _ unsafe.Pointer
+
+// Do the interface allocations only once for common
+// Errno values.
+const (
+	errnoERROR_IO_PENDING = 997
+)
+
+var (
+	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
+)
+
+// errnoErr returns common boxed Errno values, to prevent
+// allocations at runtime.
+func errnoErr(e syscall.Errno) error {
+	switch e {
+	case 0:
+		return nil
+	case errnoERROR_IO_PENDING:
+		return errERROR_IO_PENDING
+	}
+	// TODO: add more here, after collecting data on the common
+	// error values see on Windows. (perhaps when running
+	// all.bat?)
+	return e
+}
+
+var (
+	modvmcompute = windows.NewLazySystemDLL("vmcompute.dll")
+
+	procHcsEnumerateComputeSystems         = modvmcompute.NewProc("HcsEnumerateComputeSystems")
+	procHcsCreateComputeSystem             = modvmcompute.NewProc("HcsCreateComputeSystem")
+	procHcsOpenComputeSystem               = modvmcompute.NewProc("HcsOpenComputeSystem")
+	procHcsCloseComputeSystem              = modvmcompute.NewProc("HcsCloseComputeSystem")
+	procHcsStartComputeSystem              = modvmcompute.NewProc("HcsStartComputeSystem")
+	procHcsShutdownComputeSystem           = modvmcompute.NewProc("HcsShutdownComputeSystem")
+	procHcsTerminateComputeSystem          = modvmcompute.NewProc("HcsTerminateComputeSystem")
+	procHcsPauseComputeSystem              = modvmcompute.NewProc("HcsPauseComputeSystem")
+	procHcsResumeComputeSystem             = modvmcompute.NewProc("HcsResumeComputeSystem")
+	procHcsGetComputeSystemProperties      = modvmcompute.NewProc("HcsGetComputeSystemProperties")
+	procHcsModifyComputeSystem             = modvmcompute.NewProc("HcsModifyComputeSystem")
+	procHcsRegisterComputeSystemCallback   = modvmcompute.NewProc("HcsRegisterComputeSystemCallback")
+	procHcsUnregisterComputeSystemCallback = modvmcompute.NewProc("HcsUnregisterComputeSystemCallback")
+	procHcsCreateProcess                   = modvmcompute.NewProc("HcsCreateProcess")
+	procHcsOpenProcess                     = modvmcompute.NewProc("HcsOpenProcess")
+	procHcsCloseProcess                    = modvmcompute.NewProc("HcsCloseProcess")
+	procHcsTerminateProcess                = modvmcompute.NewProc("HcsTerminateProcess")
+
+	procHcsGetProcessInfo            = modvmcompute.NewProc("HcsGetProcessInfo")
+	procHcsGetProcessProperties      = modvmcompute.NewProc("HcsGetProcessProperties")
+	procHcsModifyProcess             = modvmcompute.NewProc("HcsModifyProcess")
+	procHcsGetServiceProperties      = modvmcompute.NewProc("HcsGetServiceProperties")
+	procHcsRegisterProcessCallback   = modvmcompute.NewProc("HcsRegisterProcessCallback")
+	procHcsUnregisterProcessCallback = modvmcompute.NewProc("HcsUnregisterProcessCallback")
+)
+
+func hcsEnumerateComputeSystems(query string, computeSystems **uint16, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(query)
+	if hr != nil {
+		return
+	}
+	return _hcsEnumerateComputeSystems(_p0, computeSystems, result)
+}
+
+func _hcsEnumerateComputeSystems(query *uint16, computeSystems **uint16, result **uint16) (hr error) {
+	if hr = procHcsEnumerateComputeSystems.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsEnumerateComputeSystems.Addr(), 3, uintptr(unsafe.Pointer(query)), uintptr(unsafe.Pointer(computeSystems)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsCreateComputeSystem(id string, configuration string, identity syscall.Handle, computeSystem *hcsSystem, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(id)
+	if hr != nil {
+		return
+	}
+	var _p1 *uint16
+	_p1, hr = syscall.UTF16PtrFromString(configuration)
+	if hr != nil {
+		return
+	}
+	return _hcsCreateComputeSystem(_p0, _p1, identity, computeSystem, result)
+}
+
+func _hcsCreateComputeSystem(id *uint16, configuration *uint16, identity syscall.Handle, computeSystem *hcsSystem, result **uint16) (hr error) {
+	if hr = procHcsCreateComputeSystem.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHcsCreateComputeSystem.Addr(), 5, uintptr(unsafe.Pointer(id)), uintptr(unsafe.Pointer(configuration)), uintptr(identity), uintptr(unsafe.Pointer(computeSystem)), uintptr(unsafe.Pointer(result)), 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsOpenComputeSystem(id string, computeSystem *hcsSystem, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(id)
+	if hr != nil {
+		return
+	}
+	return _hcsOpenComputeSystem(_p0, computeSystem, result)
+}
+
+func _hcsOpenComputeSystem(id *uint16, computeSystem *hcsSystem, result **uint16) (hr error) {
+	if hr = procHcsOpenComputeSystem.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsOpenComputeSystem.Addr(), 3, uintptr(unsafe.Pointer(id)), uintptr(unsafe.Pointer(computeSystem)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsCloseComputeSystem(computeSystem hcsSystem) (hr error) {
+	if hr = procHcsCloseComputeSystem.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsCloseComputeSystem.Addr(), 1, uintptr(computeSystem), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsStartComputeSystem(computeSystem hcsSystem, options string, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(options)
+	if hr != nil {
+		return
+	}
+	return _hcsStartComputeSystem(computeSystem, _p0, result)
+}
+
+func _hcsStartComputeSystem(computeSystem hcsSystem, options *uint16, result **uint16) (hr error) {
+	if hr = procHcsStartComputeSystem.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsStartComputeSystem.Addr(), 3, uintptr(computeSystem), uintptr(unsafe.Pointer(options)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsShutdownComputeSystem(computeSystem hcsSystem, options string, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(options)
+	if hr != nil {
+		return
+	}
+	return _hcsShutdownComputeSystem(computeSystem, _p0, result)
+}
+
+func _hcsShutdownComputeSystem(computeSystem hcsSystem, options *uint16, result **uint16) (hr error) {
+	if hr = procHcsShutdownComputeSystem.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsShutdownComputeSystem.Addr(), 3, uintptr(computeSystem), uintptr(unsafe.Pointer(options)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsTerminateComputeSystem(computeSystem hcsSystem, options string, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(options)
+	if hr != nil {
+		return
+	}
+	return _hcsTerminateComputeSystem(computeSystem, _p0, result)
+}
+
+func _hcsTerminateComputeSystem(computeSystem hcsSystem, options *uint16, result **uint16) (hr error) {
+	if hr = procHcsTerminateComputeSystem.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsTerminateComputeSystem.Addr(), 3, uintptr(computeSystem), uintptr(unsafe.Pointer(options)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsPauseComputeSystem(computeSystem hcsSystem, options string, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(options)
+	if hr != nil {
+		return
+	}
+	return _hcsPauseComputeSystem(computeSystem, _p0, result)
+}
+
+func _hcsPauseComputeSystem(computeSystem hcsSystem, options *uint16, result **uint16) (hr error) {
+	if hr = procHcsPauseComputeSystem.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsPauseComputeSystem.Addr(), 3, uintptr(computeSystem), uintptr(unsafe.Pointer(options)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsResumeComputeSystem(computeSystem hcsSystem, options string, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(options)
+	if hr != nil {
+		return
+	}
+	return _hcsResumeComputeSystem(computeSystem, _p0, result)
+}
+
+func _hcsResumeComputeSystem(computeSystem hcsSystem, options *uint16, result **uint16) (hr error) {
+	if hr = procHcsResumeComputeSystem.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsResumeComputeSystem.Addr(), 3, uintptr(computeSystem), uintptr(unsafe.Pointer(options)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsGetComputeSystemProperties(computeSystem hcsSystem, propertyQuery string, properties **uint16, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(propertyQuery)
+	if hr != nil {
+		return
+	}
+	return _hcsGetComputeSystemProperties(computeSystem, _p0, properties, result)
+}
+
+func _hcsGetComputeSystemProperties(computeSystem hcsSystem, propertyQuery *uint16, properties **uint16, result **uint16) (hr error) {
+	if hr = procHcsGetComputeSystemProperties.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHcsGetComputeSystemProperties.Addr(), 4, uintptr(computeSystem), uintptr(unsafe.Pointer(propertyQuery)), uintptr(unsafe.Pointer(properties)), uintptr(unsafe.Pointer(result)), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsModifyComputeSystem(computeSystem hcsSystem, configuration string, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(configuration)
+	if hr != nil {
+		return
+	}
+	return _hcsModifyComputeSystem(computeSystem, _p0, result)
+}
+
+func _hcsModifyComputeSystem(computeSystem hcsSystem, configuration *uint16, result **uint16) (hr error) {
+	if hr = procHcsModifyComputeSystem.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsModifyComputeSystem.Addr(), 3, uintptr(computeSystem), uintptr(unsafe.Pointer(configuration)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsRegisterComputeSystemCallback(computeSystem hcsSystem, callback uintptr, context uintptr, callbackHandle *hcsCallback) (hr error) {
+	if hr = procHcsRegisterComputeSystemCallback.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHcsRegisterComputeSystemCallback.Addr(), 4, uintptr(computeSystem), uintptr(callback), uintptr(context), uintptr(unsafe.Pointer(callbackHandle)), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsUnregisterComputeSystemCallback(callbackHandle hcsCallback) (hr error) {
+	if hr = procHcsUnregisterComputeSystemCallback.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsUnregisterComputeSystemCallback.Addr(), 1, uintptr(callbackHandle), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsCreateProcess(computeSystem hcsSystem, processParameters string, processInformation *hcsProcessInformation, process *hcsProcess, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(processParameters)
+	if hr != nil {
+		return
+	}
+	return _hcsCreateProcess(computeSystem, _p0, processInformation, process, result)
+}
+
+func _hcsCreateProcess(computeSystem hcsSystem, processParameters *uint16, processInformation *hcsProcessInformation, process *hcsProcess, result **uint16) (hr error) {
+	if hr = procHcsCreateProcess.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHcsCreateProcess.Addr(), 5, uintptr(computeSystem), uintptr(unsafe.Pointer(processParameters)), uintptr(unsafe.Pointer(processInformation)), uintptr(unsafe.Pointer(process)), uintptr(unsafe.Pointer(result)), 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsOpenProcess(computeSystem hcsSystem, pid uint32, process *hcsProcess, result **uint16) (hr error) {
+	if hr = procHcsOpenProcess.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHcsOpenProcess.Addr(), 4, uintptr(computeSystem), uintptr(pid), uintptr(unsafe.Pointer(process)), uintptr(unsafe.Pointer(result)), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsCloseProcess(process hcsProcess) (hr error) {
+	if hr = procHcsCloseProcess.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsCloseProcess.Addr(), 1, uintptr(process), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsTerminateProcess(process hcsProcess, result **uint16) (hr error) {
+	if hr = procHcsTerminateProcess.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsTerminateProcess.Addr(), 2, uintptr(process), uintptr(unsafe.Pointer(result)), 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsSignalProcess(process hcsProcess, options string, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(options)
+	if hr != nil {
+		return
+	}
+	return _hcsSignalProcess(process, _p0, result)
+}
+
+func _hcsSignalProcess(process hcsProcess, options *uint16, result **uint16) (hr error) {
+	if hr = procHcsTerminateProcess.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsTerminateProcess.Addr(), 3, uintptr(process), uintptr(unsafe.Pointer(options)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsGetProcessInfo(process hcsProcess, processInformation *hcsProcessInformation, result **uint16) (hr error) {
+	if hr = procHcsGetProcessInfo.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsGetProcessInfo.Addr(), 3, uintptr(process), uintptr(unsafe.Pointer(processInformation)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsGetProcessProperties(process hcsProcess, processProperties **uint16, result **uint16) (hr error) {
+	if hr = procHcsGetProcessProperties.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsGetProcessProperties.Addr(), 3, uintptr(process), uintptr(unsafe.Pointer(processProperties)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsModifyProcess(process hcsProcess, settings string, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(settings)
+	if hr != nil {
+		return
+	}
+	return _hcsModifyProcess(process, _p0, result)
+}
+
+func _hcsModifyProcess(process hcsProcess, settings *uint16, result **uint16) (hr error) {
+	if hr = procHcsModifyProcess.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsModifyProcess.Addr(), 3, uintptr(process), uintptr(unsafe.Pointer(settings)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsGetServiceProperties(propertyQuery string, properties **uint16, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(propertyQuery)
+	if hr != nil {
+		return
+	}
+	return _hcsGetServiceProperties(_p0, properties, result)
+}
+
+func _hcsGetServiceProperties(propertyQuery *uint16, properties **uint16, result **uint16) (hr error) {
+	if hr = procHcsGetServiceProperties.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsGetServiceProperties.Addr(), 3, uintptr(unsafe.Pointer(propertyQuery)), uintptr(unsafe.Pointer(properties)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsRegisterProcessCallback(process hcsProcess, callback uintptr, context uintptr, callbackHandle *hcsCallback) (hr error) {
+	if hr = procHcsRegisterProcessCallback.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHcsRegisterProcessCallback.Addr(), 4, uintptr(process), uintptr(callback), uintptr(context), uintptr(unsafe.Pointer(callbackHandle)), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcsUnregisterProcessCallback(callbackHandle hcsCallback) (hr error) {
+	if hr = procHcsUnregisterProcessCallback.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcsUnregisterProcessCallback.Addr(), 1, uintptr(callbackHandle), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}

vendor/github.com/Microsoft/hcsshim/internal/hcserror/hcserror.go

@@ -0,0 +1,47 @@
+package hcserror
+
+import (
+	"fmt"
+	"syscall"
+)
+
+const ERROR_GEN_FAILURE = syscall.Errno(31)
+
+type HcsError struct {
+	title string
+	rest  string
+	Err   error
+}
+
+func (e *HcsError) Error() string {
+	s := e.title
+	if len(s) > 0 && s[len(s)-1] != ' ' {
+		s += " "
+	}
+	s += fmt.Sprintf("failed in Win32: %s (0x%x)", e.Err, Win32FromError(e.Err))
+	if e.rest != "" {
+		if e.rest[0] != ' ' {
+			s += " "
+		}
+		s += e.rest
+	}
+	return s
+}
+
+func New(err error, title, rest string) error {
+	// Pass through DLL errors directly since they do not originate from HCS.
+	if _, ok := err.(*syscall.DLLError); ok {
+		return err
+	}
+	return &HcsError{title, rest, err}
+}
+
+func Win32FromError(err error) uint32 {
+	if herr, ok := err.(*HcsError); ok {
+		return Win32FromError(herr.Err)
+	}
+	if code, ok := err.(syscall.Errno); ok {
+		return uint32(code)
+	}
+	return uint32(ERROR_GEN_FAILURE)
+}

vendor/github.com/Microsoft/hcsshim/internal/hcsoci/create.go

@@ -0,0 +1,173 @@
+// +build windows
+
+package hcsoci
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+
+	"github.com/Microsoft/hcsshim/internal/guid"
+	"github.com/Microsoft/hcsshim/internal/hcs"
+	"github.com/Microsoft/hcsshim/internal/schema2"
+	"github.com/Microsoft/hcsshim/internal/schemaversion"
+	"github.com/Microsoft/hcsshim/internal/uvm"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/sirupsen/logrus"
+)
+
+// CreateOptions are the set of fields used to call CreateContainer().
+// Note: In the spec, the LayerFolders must be arranged in the same way in which
+// moby configures them: layern, layern-1,...,layer2,layer1,scratch
+// where layer1 is the base read-only layer, layern is the top-most read-only
+// layer, and scratch is the RW layer. This is for historical reasons only.
+type CreateOptions struct {
+
+	// Common parameters
+	ID               string             // Identifier for the container
+	Owner            string             // Specifies the owner. Defaults to executable name.
+	Spec             *specs.Spec        // Definition of the container or utility VM being created
+	SchemaVersion    *hcsschema.Version // Requested Schema Version. Defaults to v2 for RS5, v1 for RS1..RS4
+	HostingSystem    *uvm.UtilityVM     // Utility or service VM in which the container is to be created.
+	NetworkNamespace string             // Host network namespace to use (overrides anything in the spec)
+
+	// This is an advanced debugging parameter. It allows for diagnosibility by leaving a containers
+	// resources allocated in case of a failure. Thus you would be able to use tools such as hcsdiag
+	// to look at the state of a utility VM to see what resources were allocated. Obviously the caller
+	// must a) not tear down the utility VM on failure (or pause in some way) and b) is responsible for
+	// performing the ReleaseResources() call themselves.
+	DoNotReleaseResourcesOnFailure bool
+}
+
+// createOptionsInternal is the set of user-supplied create options, but includes internal
+// fields for processing the request once user-supplied stuff has been validated.
+type createOptionsInternal struct {
+	*CreateOptions
+
+	actualSchemaVersion    *hcsschema.Version // Calculated based on Windows build and optional caller-supplied override
+	actualID               string             // Identifier for the container
+	actualOwner            string             // Owner for the container
+	actualNetworkNamespace string
+}
+
+// CreateContainer creates a container. It can cope with a  wide variety of
+// scenarios, including v1 HCS schema calls, as well as more complex v2 HCS schema
+// calls. Note we always return the resources that have been allocated, even in the
+// case of an error. This provides support for the debugging option not to
+// release the resources on failure, so that the client can make the necessary
+// call to release resources that have been allocated as part of calling this function.
+func CreateContainer(createOptions *CreateOptions) (_ *hcs.System, _ *Resources, err error) {
+	logrus.Debugf("hcsshim::CreateContainer options: %+v", createOptions)
+
+	coi := &createOptionsInternal{
+		CreateOptions: createOptions,
+		actualID:      createOptions.ID,
+		actualOwner:   createOptions.Owner,
+	}
+
+	// Defaults if omitted by caller.
+	if coi.actualID == "" {
+		coi.actualID = guid.New().String()
+	}
+	if coi.actualOwner == "" {
+		coi.actualOwner = filepath.Base(os.Args[0])
+	}
+
+	if coi.Spec == nil {
+		return nil, nil, fmt.Errorf("Spec must be supplied")
+	}
+
+	if coi.HostingSystem != nil {
+		// By definition, a hosting system can only be supplied for a v2 Xenon.
+		coi.actualSchemaVersion = schemaversion.SchemaV21()
+	} else {
+		coi.actualSchemaVersion = schemaversion.DetermineSchemaVersion(coi.SchemaVersion)
+		logrus.Debugf("hcsshim::CreateContainer using schema %s", schemaversion.String(coi.actualSchemaVersion))
+	}
+
+	resources := &Resources{}
+	defer func() {
+		if err != nil {
+			if !coi.DoNotReleaseResourcesOnFailure {
+				ReleaseResources(resources, coi.HostingSystem, true)
+			}
+		}
+	}()
+
+	if coi.HostingSystem != nil {
+		n := coi.HostingSystem.ContainerCounter()
+		if coi.Spec.Linux != nil {
+			resources.containerRootInUVM = "/run/gcs/c/" + strconv.FormatUint(n, 16)
+		} else {
+			resources.containerRootInUVM = `C:\c\` + strconv.FormatUint(n, 16)
+		}
+	}
+
+	// Create a network namespace if necessary.
+	if coi.Spec.Windows != nil &&
+		coi.Spec.Windows.Network != nil &&
+		schemaversion.IsV21(coi.actualSchemaVersion) {
+
+		if coi.NetworkNamespace != "" {
+			resources.netNS = coi.NetworkNamespace
+		} else {
+			err := createNetworkNamespace(coi, resources)
+			if err != nil {
+				return nil, resources, err
+			}
+		}
+		coi.actualNetworkNamespace = resources.netNS
+		if coi.HostingSystem != nil {
+			endpoints, err := getNamespaceEndpoints(coi.actualNetworkNamespace)
+			if err != nil {
+				return nil, resources, err
+			}
+			err = coi.HostingSystem.AddNetNS(coi.actualNetworkNamespace, endpoints)
+			if err != nil {
+				return nil, resources, err
+			}
+			resources.addedNetNSToVM = true
+		}
+	}
+
+	var hcsDocument interface{}
+	logrus.Debugf("hcsshim::CreateContainer allocating resources")
+	if coi.Spec.Linux != nil {
+		if schemaversion.IsV10(coi.actualSchemaVersion) {
+			return nil, resources, errors.New("LCOW v1 not supported")
+		}
+		logrus.Debugf("hcsshim::CreateContainer allocateLinuxResources")
+		err = allocateLinuxResources(coi, resources)
+		if err != nil {
+			logrus.Debugf("failed to allocateLinuxResources %s", err)
+			return nil, resources, err
+		}
+		hcsDocument, err = createLinuxContainerDocument(coi, resources.containerRootInUVM)
+		if err != nil {
+			logrus.Debugf("failed createHCSContainerDocument %s", err)
+			return nil, resources, err
+		}
+	} else {
+		err = allocateWindowsResources(coi, resources)
+		if err != nil {
+			logrus.Debugf("failed to allocateWindowsResources %s", err)
+			return nil, resources, err
+		}
+		logrus.Debugf("hcsshim::CreateContainer creating container document")
+		hcsDocument, err = createWindowsContainerDocument(coi)
+		if err != nil {
+			logrus.Debugf("failed createHCSContainerDocument %s", err)
+			return nil, resources, err
+		}
+	}
+
+	logrus.Debugf("hcsshim::CreateContainer creating compute system")
+	system, err := hcs.CreateComputeSystem(coi.actualID, hcsDocument)
+	if err != nil {
+		logrus.Debugf("failed to CreateComputeSystem %s", err)
+		return nil, resources, err
+	}
+	return system, resources, err
+}

vendor/github.com/Microsoft/hcsshim/internal/hcsoci/create_test.go

@@ -0,0 +1,78 @@
+// +build windows,functional
+
+//
+// These unit tests must run on a system setup to run both Argons and Xenons,
+// have docker installed, and have the nanoserver (WCOW) and alpine (LCOW)
+// base images installed. The nanoserver image MUST match the build of the
+// host.
+//
+// We rely on docker as the tools to extract a container image aren't
+// open source. We use it to find the location of the base image on disk.
+//
+
+package hcsoci
+
+//import (
+//	"bytes"
+//	"encoding/json"
+//	"io/ioutil"
+//	"os"
+//	"os/exec"
+//	"path/filepath"
+//	"strings"
+//	"testing"
+
+//	"github.com/Microsoft/hcsshim/internal/schemaversion"
+//	_ "github.com/Microsoft/hcsshim/test/assets"
+//	specs "github.com/opencontainers/runtime-spec/specs-go"
+//	"github.com/sirupsen/logrus"
+//)
+
+//func startUVM(t *testing.T, uvm *UtilityVM) {
+//	if err := uvm.Start(); err != nil {
+//		t.Fatalf("UVM %s Failed start: %s", uvm.Id, err)
+//	}
+//}
+
+//// Helper to shoot a utility VM
+//func terminateUtilityVM(t *testing.T, uvm *UtilityVM) {
+//	if err := uvm.Terminate(); err != nil {
+//		t.Fatalf("Failed terminate utility VM %s", err)
+//	}
+//}
+
+//// TODO: Test UVMResourcesFromContainerSpec
+//func TestUVMSizing(t *testing.T) {
+//	t.Skip("for now - not implemented at all")
+//}
+
+//// TestID validates that the requested ID is retrieved
+//func TestID(t *testing.T) {
+//	t.Skip("fornow")
+//	tempDir := createWCOWTempDirWithSandbox(t)
+//	defer os.RemoveAll(tempDir)
+
+//	layers := append(layersNanoserver, tempDir)
+//	mountPath, err := mountContainerLayers(layers, nil)
+//	if err != nil {
+//		t.Fatalf("failed to mount container storage: %s", err)
+//	}
+//	defer unmountContainerLayers(layers, nil, unmountOperationAll)
+
+//	c, err := CreateContainer(&CreateOptions{
+//		Id:            "gruntbuggly",
+//		SchemaVersion: schemaversion.SchemaV21(),
+//		Spec: &specs.Spec{
+//			Windows: &specs.Windows{LayerFolders: layers},
+//			Root:    &specs.Root{Path: mountPath.(string)},
+//		},
+//	})
+//	if err != nil {
+//		t.Fatalf("Failed create: %s", err)
+//	}
+//	if c.ID() != "gruntbuggly" {
+//		t.Fatalf("id not set correctly: %s", c.ID())
+//	}
+
+//	c.Terminate()
+//}

vendor/github.com/Microsoft/hcsshim/internal/hcsoci/hcsdoc_lcow.go

@@ -0,0 +1,115 @@
+// +build windows
+
+package hcsoci
+
+import (
+	"encoding/json"
+
+	"github.com/Microsoft/hcsshim/internal/schema2"
+	"github.com/Microsoft/hcsshim/internal/schemaversion"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/sirupsen/logrus"
+)
+
+func createLCOWSpec(coi *createOptionsInternal) (*specs.Spec, error) {
+	// Remarshal the spec to perform a deep copy.
+	j, err := json.Marshal(coi.Spec)
+	if err != nil {
+		return nil, err
+	}
+	spec := &specs.Spec{}
+	err = json.Unmarshal(j, spec)
+	if err != nil {
+		return nil, err
+	}
+
+	// TODO
+	// Translate the mounts. The root has already been translated in
+	// allocateLinuxResources.
+	/*
+		for i := range spec.Mounts {
+			spec.Mounts[i].Source = "???"
+			spec.Mounts[i].Destination = "???"
+		}
+	*/
+
+	// Linux containers don't care about Windows aspects of the spec except the
+	// network namespace
+	spec.Windows = nil
+	if coi.Spec.Windows != nil &&
+		coi.Spec.Windows.Network != nil &&
+		coi.Spec.Windows.Network.NetworkNamespace != "" {
+		spec.Windows = &specs.Windows{
+			Network: &specs.WindowsNetwork{
+				NetworkNamespace: coi.Spec.Windows.Network.NetworkNamespace,
+			},
+		}
+	}
+
+	// Hooks are not supported (they should be run in the host)
+	spec.Hooks = nil
+
+	// Clear unsupported features
+	if spec.Linux.Resources != nil {
+		spec.Linux.Resources.Devices = nil
+		spec.Linux.Resources.Memory = nil
+		spec.Linux.Resources.Pids = nil
+		spec.Linux.Resources.BlockIO = nil
+		spec.Linux.Resources.HugepageLimits = nil
+		spec.Linux.Resources.Network = nil
+	}
+	spec.Linux.Seccomp = nil
+
+	// Clear any specified namespaces
+	var namespaces []specs.LinuxNamespace
+	for _, ns := range spec.Linux.Namespaces {
+		switch ns.Type {
+		case specs.NetworkNamespace:
+		default:
+			ns.Path = ""
+			namespaces = append(namespaces, ns)
+		}
+	}
+	spec.Linux.Namespaces = namespaces
+
+	return spec, nil
+}
+
+// This is identical to hcsschema.ComputeSystem but HostedSystem is an LCOW specific type - the schema docs only include WCOW.
+type linuxComputeSystem struct {
+	Owner                             string                    `json:"Owner,omitempty"`
+	SchemaVersion                     *hcsschema.Version        `json:"SchemaVersion,omitempty"`
+	HostingSystemId                   string                    `json:"HostingSystemId,omitempty"`
+	HostedSystem                      *linuxHostedSystem        `json:"HostedSystem,omitempty"`
+	Container                         *hcsschema.Container      `json:"Container,omitempty"`
+	VirtualMachine                    *hcsschema.VirtualMachine `json:"VirtualMachine,omitempty"`
+	ShouldTerminateOnLastHandleClosed bool                      `json:"ShouldTerminateOnLastHandleClosed,omitempty"`
+}
+
+type linuxHostedSystem struct {
+	SchemaVersion    *hcsschema.Version
+	OciBundlePath    string
+	OciSpecification *specs.Spec
+}
+
+func createLinuxContainerDocument(coi *createOptionsInternal, guestRoot string) (interface{}, error) {
+	spec, err := createLCOWSpec(coi)
+	if err != nil {
+		return nil, err
+	}
+
+	logrus.Debugf("hcsshim::createLinuxContainerDoc: guestRoot:%s", guestRoot)
+	v2 := &linuxComputeSystem{
+		Owner:                             coi.actualOwner,
+		SchemaVersion:                     schemaversion.SchemaV21(),
+		ShouldTerminateOnLastHandleClosed: true,
+		HostingSystemId:                   coi.HostingSystem.ID(),
+		HostedSystem: &linuxHostedSystem{
+			SchemaVersion:    schemaversion.SchemaV21(),
+			OciBundlePath:    guestRoot,
+			OciSpecification: spec,
+		},
+	}
+
+	return v2, nil
+}

vendor/github.com/Microsoft/hcsshim/internal/hcsoci/hcsdoc_wcow.go

@@ -0,0 +1,273 @@
+// +build windows
+
+package hcsoci
+
+import (
+	"fmt"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"strings"
+
+	"github.com/Microsoft/hcsshim/internal/schema1"
+	"github.com/Microsoft/hcsshim/internal/schema2"
+	"github.com/Microsoft/hcsshim/internal/schemaversion"
+	"github.com/Microsoft/hcsshim/internal/uvm"
+	"github.com/Microsoft/hcsshim/internal/uvmfolder"
+	"github.com/Microsoft/hcsshim/internal/wclayer"
+	"github.com/Microsoft/hcsshim/osversion"
+	"github.com/sirupsen/logrus"
+)
+
+// createWindowsContainerDocument creates a document suitable for calling HCS to create
+// a container, both hosted and process isolated. It can create both v1 and v2
+// schema, WCOW only. The containers storage should have been mounted already.
+func createWindowsContainerDocument(coi *createOptionsInternal) (interface{}, error) {
+	logrus.Debugf("hcsshim: CreateHCSContainerDocument")
+	// TODO: Make this safe if exported so no null pointer dereferences.
+
+	if coi.Spec == nil {
+		return nil, fmt.Errorf("cannot create HCS container document - OCI spec is missing")
+	}
+
+	if coi.Spec.Windows == nil {
+		return nil, fmt.Errorf("cannot create HCS container document - OCI spec Windows section is missing ")
+	}
+
+	v1 := &schema1.ContainerConfig{
+		SystemType:              "Container",
+		Name:                    coi.actualID,
+		Owner:                   coi.actualOwner,
+		HvPartition:             false,
+		IgnoreFlushesDuringBoot: coi.Spec.Windows.IgnoreFlushesDuringBoot,
+	}
+
+	// IgnoreFlushesDuringBoot is a property of the SCSI attachment for the scratch. Set when it's hot-added to the utility VM
+	// ID is a property on the create call in V2 rather than part of the schema.
+	v2 := &hcsschema.ComputeSystem{
+		Owner:                             coi.actualOwner,
+		SchemaVersion:                     schemaversion.SchemaV21(),
+		ShouldTerminateOnLastHandleClosed: true,
+	}
+	v2Container := &hcsschema.Container{Storage: &hcsschema.Storage{}}
+
+	// TODO: Still want to revisit this.
+	if coi.Spec.Windows.LayerFolders == nil || len(coi.Spec.Windows.LayerFolders) < 2 {
+		return nil, fmt.Errorf("invalid spec - not enough layer folders supplied")
+	}
+
+	if coi.Spec.Hostname != "" {
+		v1.HostName = coi.Spec.Hostname
+		v2Container.GuestOs = &hcsschema.GuestOs{HostName: coi.Spec.Hostname}
+	}
+
+	if coi.Spec.Windows.Resources != nil {
+		if coi.Spec.Windows.Resources.CPU != nil {
+			if coi.Spec.Windows.Resources.CPU.Count != nil ||
+				coi.Spec.Windows.Resources.CPU.Shares != nil ||
+				coi.Spec.Windows.Resources.CPU.Maximum != nil {
+				v2Container.Processor = &hcsschema.Processor{}
+			}
+			if coi.Spec.Windows.Resources.CPU.Count != nil {
+				cpuCount := *coi.Spec.Windows.Resources.CPU.Count
+				hostCPUCount := uint64(runtime.NumCPU())
+				if cpuCount > hostCPUCount {
+					logrus.Warnf("Changing requested CPUCount of %d to current number of processors, %d", cpuCount, hostCPUCount)
+					cpuCount = hostCPUCount
+				}
+				v1.ProcessorCount = uint32(cpuCount)
+				v2Container.Processor.Count = int32(cpuCount)
+			}
+			if coi.Spec.Windows.Resources.CPU.Shares != nil {
+				v1.ProcessorWeight = uint64(*coi.Spec.Windows.Resources.CPU.Shares)
+				v2Container.Processor.Weight = int32(v1.ProcessorWeight)
+			}
+			if coi.Spec.Windows.Resources.CPU.Maximum != nil {
+				v1.ProcessorMaximum = int64(*coi.Spec.Windows.Resources.CPU.Maximum)
+				v2Container.Processor.Maximum = int32(v1.ProcessorMaximum)
+			}
+		}
+		if coi.Spec.Windows.Resources.Memory != nil {
+			if coi.Spec.Windows.Resources.Memory.Limit != nil {
+				v1.MemoryMaximumInMB = int64(*coi.Spec.Windows.Resources.Memory.Limit) / 1024 / 1024
+				v2Container.Memory = &hcsschema.Memory{SizeInMB: int32(v1.MemoryMaximumInMB)}
+
+			}
+		}
+		if coi.Spec.Windows.Resources.Storage != nil {
+			if coi.Spec.Windows.Resources.Storage.Bps != nil || coi.Spec.Windows.Resources.Storage.Iops != nil {
+				v2Container.Storage.QoS = &hcsschema.StorageQoS{}
+			}
+			if coi.Spec.Windows.Resources.Storage.Bps != nil {
+				v1.StorageBandwidthMaximum = *coi.Spec.Windows.Resources.Storage.Bps
+				v2Container.Storage.QoS.BandwidthMaximum = int32(v1.StorageBandwidthMaximum)
+			}
+			if coi.Spec.Windows.Resources.Storage.Iops != nil {
+				v1.StorageIOPSMaximum = *coi.Spec.Windows.Resources.Storage.Iops
+				v2Container.Storage.QoS.IopsMaximum = int32(*coi.Spec.Windows.Resources.Storage.Iops)
+			}
+		}
+	}
+
+	// TODO V2 networking. Only partial at the moment. v2.Container.Networking.Namespace specifically
+	if coi.Spec.Windows.Network != nil {
+		v2Container.Networking = &hcsschema.Networking{}
+
+		v1.EndpointList = coi.Spec.Windows.Network.EndpointList
+		v2Container.Networking.Namespace = coi.actualNetworkNamespace
+
+		v1.AllowUnqualifiedDNSQuery = coi.Spec.Windows.Network.AllowUnqualifiedDNSQuery
+		v2Container.Networking.AllowUnqualifiedDnsQuery = v1.AllowUnqualifiedDNSQuery
+
+		if coi.Spec.Windows.Network.DNSSearchList != nil {
+			v1.DNSSearchList = strings.Join(coi.Spec.Windows.Network.DNSSearchList, ",")
+			v2Container.Networking.DnsSearchList = v1.DNSSearchList
+		}
+
+		v1.NetworkSharedContainerName = coi.Spec.Windows.Network.NetworkSharedContainerName
+		v2Container.Networking.NetworkSharedContainerName = v1.NetworkSharedContainerName
+	}
+
+	//	// TODO V2 Credentials not in the schema yet.
+	if cs, ok := coi.Spec.Windows.CredentialSpec.(string); ok {
+		v1.Credentials = cs
+	}
+
+	if coi.Spec.Root == nil {
+		return nil, fmt.Errorf("spec is invalid - root isn't populated")
+	}
+
+	if coi.Spec.Root.Readonly {
+		return nil, fmt.Errorf(`invalid container spec - readonly is not supported for Windows containers`)
+	}
+
+	// Strip off the top-most RW/scratch layer as that's passed in separately to HCS for v1
+	v1.LayerFolderPath = coi.Spec.Windows.LayerFolders[len(coi.Spec.Windows.LayerFolders)-1]
+
+	if (schemaversion.IsV21(coi.actualSchemaVersion) && coi.HostingSystem == nil) ||
+		(schemaversion.IsV10(coi.actualSchemaVersion) && coi.Spec.Windows.HyperV == nil) {
+		// Argon v1 or v2.
+		const volumeGUIDRegex = `^\\\\\?\\(Volume)\{{0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1}\}(|\\)$`
+		if matched, err := regexp.MatchString(volumeGUIDRegex, coi.Spec.Root.Path); !matched || err != nil {
+			return nil, fmt.Errorf(`invalid container spec - Root.Path '%s' must be a volume GUID path in the format '\\?\Volume{GUID}\'`, coi.Spec.Root.Path)
+		}
+		if coi.Spec.Root.Path[len(coi.Spec.Root.Path)-1] != '\\' {
+			coi.Spec.Root.Path += `\` // Be nice to clients and make sure well-formed for back-compat
+		}
+		v1.VolumePath = coi.Spec.Root.Path[:len(coi.Spec.Root.Path)-1] // Strip the trailing backslash. Required for v1.
+		v2Container.Storage.Path = coi.Spec.Root.Path
+	} else {
+		// A hosting system was supplied, implying v2 Xenon; OR a v1 Xenon.
+		if schemaversion.IsV10(coi.actualSchemaVersion) {
+			// V1 Xenon
+			v1.HvPartition = true
+			if coi.Spec == nil || coi.Spec.Windows == nil || coi.Spec.Windows.HyperV == nil { // Be resilient to nil de-reference
+				return nil, fmt.Errorf(`invalid container spec - Spec.Windows.HyperV is nil`)
+			}
+			if coi.Spec.Windows.HyperV.UtilityVMPath != "" {
+				// Client-supplied utility VM path
+				v1.HvRuntime = &schema1.HvRuntime{ImagePath: coi.Spec.Windows.HyperV.UtilityVMPath}
+			} else {
+				// Client was lazy. Let's locate it from the layer folders instead.
+				uvmImagePath, err := uvmfolder.LocateUVMFolder(coi.Spec.Windows.LayerFolders)
+				if err != nil {
+					return nil, err
+				}
+				v1.HvRuntime = &schema1.HvRuntime{ImagePath: filepath.Join(uvmImagePath, `UtilityVM`)}
+			}
+		} else {
+			// Hosting system was supplied, so is v2 Xenon.
+			v2Container.Storage.Path = coi.Spec.Root.Path
+			if coi.HostingSystem.OS() == "windows" {
+				layers, err := computeV2Layers(coi.HostingSystem, coi.Spec.Windows.LayerFolders[:len(coi.Spec.Windows.LayerFolders)-1])
+				if err != nil {
+					return nil, err
+				}
+				v2Container.Storage.Layers = layers
+			}
+		}
+	}
+
+	if coi.HostingSystem == nil { // Argon v1 or v2
+		for _, layerPath := range coi.Spec.Windows.LayerFolders[:len(coi.Spec.Windows.LayerFolders)-1] {
+			layerID, err := wclayer.LayerID(layerPath)
+			if err != nil {
+				return nil, err
+			}
+			v1.Layers = append(v1.Layers, schema1.Layer{ID: layerID.String(), Path: layerPath})
+			v2Container.Storage.Layers = append(v2Container.Storage.Layers, hcsschema.Layer{Id: layerID.String(), Path: layerPath})
+		}
+	}
+
+	// Add the mounts as mapped directories or mapped pipes
+	// TODO: Mapped pipes to add in v2 schema.
+	var (
+		mdsv1 []schema1.MappedDir
+		mpsv1 []schema1.MappedPipe
+		mdsv2 []hcsschema.MappedDirectory
+		mpsv2 []hcsschema.MappedPipe
+	)
+	for _, mount := range coi.Spec.Mounts {
+		const pipePrefix = `\\.\pipe\`
+		if mount.Type != "" {
+			return nil, fmt.Errorf("invalid container spec - Mount.Type '%s' must not be set", mount.Type)
+		}
+		if strings.HasPrefix(strings.ToLower(mount.Destination), pipePrefix) {
+			mpsv1 = append(mpsv1, schema1.MappedPipe{HostPath: mount.Source, ContainerPipeName: mount.Destination[len(pipePrefix):]})
+			mpsv2 = append(mpsv2, hcsschema.MappedPipe{HostPath: mount.Source, ContainerPipeName: mount.Destination[len(pipePrefix):]})
+		} else {
+			readOnly := false
+			for _, o := range mount.Options {
+				if strings.ToLower(o) == "ro" {
+					readOnly = true
+				}
+			}
+			mdv1 := schema1.MappedDir{HostPath: mount.Source, ContainerPath: mount.Destination, ReadOnly: readOnly}
+			mdv2 := hcsschema.MappedDirectory{ContainerPath: mount.Destination, ReadOnly: readOnly}
+			if coi.HostingSystem == nil {
+				mdv2.HostPath = mount.Source
+			} else {
+				uvmPath, err := coi.HostingSystem.GetVSMBUvmPath(mount.Source)
+				if err != nil {
+					if err == uvm.ErrNotAttached {
+						// It could also be a scsi mount.
+						uvmPath, err = coi.HostingSystem.GetScsiUvmPath(mount.Source)
+						if err != nil {
+							return nil, err
+						}
+					} else {
+						return nil, err
+					}
+				}
+				mdv2.HostPath = uvmPath
+			}
+			mdsv1 = append(mdsv1, mdv1)
+			mdsv2 = append(mdsv2, mdv2)
+		}
+	}
+
+	v1.MappedDirectories = mdsv1
+	v2Container.MappedDirectories = mdsv2
+	if len(mpsv1) > 0 && osversion.Get().Build < osversion.RS3 {
+		return nil, fmt.Errorf("named pipe mounts are not supported on this version of Windows")
+	}
+	v1.MappedPipes = mpsv1
+	v2Container.MappedPipes = mpsv2
+
+	// Put the v2Container object as a HostedSystem for a Xenon, or directly in the schema for an Argon.
+	if coi.HostingSystem == nil {
+		v2.Container = v2Container
+	} else {
+		v2.HostingSystemId = coi.HostingSystem.ID()
+		v2.HostedSystem = &hcsschema.HostedSystem{
+			SchemaVersion: schemaversion.SchemaV21(),
+			Container:     v2Container,
+		}
+	}
+
+	if schemaversion.IsV10(coi.actualSchemaVersion) {
+		return v1, nil
+	}
+
+	return v2, nil
+}

vendor/github.com/Microsoft/hcsshim/internal/hcsoci/layers.go

@@ -0,0 +1,373 @@
+// +build windows
+
+package hcsoci
+
+import (
+	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+
+	"github.com/Microsoft/hcsshim/internal/guestrequest"
+	"github.com/Microsoft/hcsshim/internal/ospath"
+	"github.com/Microsoft/hcsshim/internal/requesttype"
+	"github.com/Microsoft/hcsshim/internal/schema2"
+	"github.com/Microsoft/hcsshim/internal/uvm"
+	"github.com/Microsoft/hcsshim/internal/wclayer"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+)
+
+type lcowLayerEntry struct {
+	hostPath string
+	uvmPath  string
+	scsi     bool
+}
+
+const scratchPath = "scratch"
+
+// mountContainerLayers is a helper for clients to hide all the complexity of layer mounting
+// Layer folder are in order: base, [rolayer1..rolayern,] scratch
+//
+// v1/v2: Argon WCOW: Returns the mount path on the host as a volume GUID.
+// v1:    Xenon WCOW: Done internally in HCS, so no point calling doing anything here.
+// v2:    Xenon WCOW: Returns a CombinedLayersV2 structure where ContainerRootPath is a folder
+//                    inside the utility VM which is a GUID mapping of the scratch folder. Each
+//                    of the layers are the VSMB locations where the read-only layers are mounted.
+//
+func MountContainerLayers(layerFolders []string, guestRoot string, uvm *uvm.UtilityVM) (interface{}, error) {
+	logrus.Debugln("hcsshim::mountContainerLayers", layerFolders)
+
+	if uvm == nil {
+		if len(layerFolders) < 2 {
+			return nil, fmt.Errorf("need at least two layers - base and scratch")
+		}
+		path := layerFolders[len(layerFolders)-1]
+		rest := layerFolders[:len(layerFolders)-1]
+		logrus.Debugln("hcsshim::mountContainerLayers ActivateLayer", path)
+		if err := wclayer.ActivateLayer(path); err != nil {
+			return nil, err
+		}
+		logrus.Debugln("hcsshim::mountContainerLayers Preparelayer", path, rest)
+		if err := wclayer.PrepareLayer(path, rest); err != nil {
+			if err2 := wclayer.DeactivateLayer(path); err2 != nil {
+				logrus.Warnf("Failed to Deactivate %s: %s", path, err)
+			}
+			return nil, err
+		}
+
+		mountPath, err := wclayer.GetLayerMountPath(path)
+		if err != nil {
+			if err := wclayer.UnprepareLayer(path); err != nil {
+				logrus.Warnf("Failed to Unprepare %s: %s", path, err)
+			}
+			if err2 := wclayer.DeactivateLayer(path); err2 != nil {
+				logrus.Warnf("Failed to Deactivate %s: %s", path, err)
+			}
+			return nil, err
+		}
+		return mountPath, nil
+	}
+
+	// V2 UVM
+	logrus.Debugf("hcsshim::mountContainerLayers Is a %s V2 UVM", uvm.OS())
+
+	// 	Add each read-only layers. For Windows, this is a VSMB share with the ResourceUri ending in
+	// a GUID based on the folder path. For Linux, this is a VPMEM device, except where is over the
+	// max size supported, where we put it on SCSI instead.
+	//
+	//  Each layer is ref-counted so that multiple containers in the same utility VM can share them.
+	var wcowLayersAdded []string
+	var lcowlayersAdded []lcowLayerEntry
+	attachedSCSIHostPath := ""
+
+	for _, layerPath := range layerFolders[:len(layerFolders)-1] {
+		var err error
+		if uvm.OS() == "windows" {
+			options := &hcsschema.VirtualSmbShareOptions{
+				ReadOnly:            true,
+				PseudoOplocks:       true,
+				TakeBackupPrivilege: true,
+				CacheIo:             true,
+				ShareRead:           true,
+			}
+			err = uvm.AddVSMB(layerPath, "", options)
+			if err == nil {
+				wcowLayersAdded = append(wcowLayersAdded, layerPath)
+			}
+		} else {
+			uvmPath := ""
+			hostPath := filepath.Join(layerPath, "layer.vhd")
+
+			var fi os.FileInfo
+			fi, err = os.Stat(hostPath)
+			if err == nil && uint64(fi.Size()) > uvm.PMemMaxSizeBytes() {
+				// Too big for PMEM. Add on SCSI instead (at /tmp/S<C>/<L>).
+				var (
+					controller int
+					lun        int32
+				)
+				controller, lun, err = uvm.AddSCSILayer(hostPath)
+				if err == nil {
+					lcowlayersAdded = append(lcowlayersAdded,
+						lcowLayerEntry{
+							hostPath: hostPath,
+							uvmPath:  fmt.Sprintf("/tmp/S%d/%d", controller, lun),
+							scsi:     true,
+						})
+				}
+			} else {
+				_, uvmPath, err = uvm.AddVPMEM(hostPath, true) // UVM path is calculated. Will be /tmp/vN/
+				if err == nil {
+					lcowlayersAdded = append(lcowlayersAdded,
+						lcowLayerEntry{
+							hostPath: hostPath,
+							uvmPath:  uvmPath,
+						})
+				}
+			}
+		}
+		if err != nil {
+			cleanupOnMountFailure(uvm, wcowLayersAdded, lcowlayersAdded, attachedSCSIHostPath)
+			return nil, err
+		}
+	}
+
+	// Add the scratch at an unused SCSI location. The container path inside the
+	// utility VM will be C:\<ID>.
+	hostPath := filepath.Join(layerFolders[len(layerFolders)-1], "sandbox.vhdx")
+
+	// BUGBUG Rename guestRoot better.
+	containerScratchPathInUVM := ospath.Join(uvm.OS(), guestRoot, scratchPath)
+	_, _, err := uvm.AddSCSI(hostPath, containerScratchPathInUVM, false)
+	if err != nil {
+		cleanupOnMountFailure(uvm, wcowLayersAdded, lcowlayersAdded, attachedSCSIHostPath)
+		return nil, err
+	}
+	attachedSCSIHostPath = hostPath
+
+	if uvm.OS() == "windows" {
+		// 	Load the filter at the C:\s<ID> location calculated above. We pass into this request each of the
+		// 	read-only layer folders.
+		layers, err := computeV2Layers(uvm, wcowLayersAdded)
+		if err != nil {
+			cleanupOnMountFailure(uvm, wcowLayersAdded, lcowlayersAdded, attachedSCSIHostPath)
+			return nil, err
+		}
+		guestRequest := guestrequest.CombinedLayers{
+			ContainerRootPath: containerScratchPathInUVM,
+			Layers:            layers,
+		}
+		combinedLayersModification := &hcsschema.ModifySettingRequest{
+			GuestRequest: guestrequest.GuestRequest{
+				Settings:     guestRequest,
+				ResourceType: guestrequest.ResourceTypeCombinedLayers,
+				RequestType:  requesttype.Add,
+			},
+		}
+		if err := uvm.Modify(combinedLayersModification); err != nil {
+			cleanupOnMountFailure(uvm, wcowLayersAdded, lcowlayersAdded, attachedSCSIHostPath)
+			return nil, err
+		}
+		logrus.Debugln("hcsshim::mountContainerLayers Succeeded")
+		return guestRequest, nil
+	}
+
+	// This is the LCOW layout inside the utilityVM. NNN is the container "number"
+	// which increments for each container created in a utility VM.
+	//
+	// /run/gcs/c/NNN/config.json
+	// /run/gcs/c/NNN/rootfs
+	// /run/gcs/c/NNN/scratch/upper
+	// /run/gcs/c/NNN/scratch/work
+	//
+	// /dev/sda on /tmp/scratch type ext4 (rw,relatime,block_validity,delalloc,barrier,user_xattr,acl)
+	// /dev/pmem0 on /tmp/v0 type ext4 (ro,relatime,block_validity,delalloc,norecovery,barrier,dax,user_xattr,acl)
+	// /dev/sdb on /run/gcs/c/NNN/scratch type ext4 (rw,relatime,block_validity,delalloc,barrier,user_xattr,acl)
+	// overlay on /run/gcs/c/NNN/rootfs type overlay (rw,relatime,lowerdir=/tmp/v0,upperdir=/run/gcs/c/NNN/scratch/upper,workdir=/run/gcs/c/NNN/scratch/work)
+	//
+	// Where /dev/sda      is the scratch for utility VM itself
+	//       /dev/pmemX    are read-only layers for containers
+	//       /dev/sd(b...) are scratch spaces for each container
+
+	layers := []hcsschema.Layer{}
+	for _, l := range lcowlayersAdded {
+		layers = append(layers, hcsschema.Layer{Path: l.uvmPath})
+	}
+	guestRequest := guestrequest.CombinedLayers{
+		ContainerRootPath: path.Join(guestRoot, rootfsPath),
+		Layers:            layers,
+		ScratchPath:       containerScratchPathInUVM,
+	}
+	combinedLayersModification := &hcsschema.ModifySettingRequest{
+		GuestRequest: guestrequest.GuestRequest{
+			ResourceType: guestrequest.ResourceTypeCombinedLayers,
+			RequestType:  requesttype.Add,
+			Settings:     guestRequest,
+		},
+	}
+	if err := uvm.Modify(combinedLayersModification); err != nil {
+		cleanupOnMountFailure(uvm, wcowLayersAdded, lcowlayersAdded, attachedSCSIHostPath)
+		return nil, err
+	}
+	logrus.Debugln("hcsshim::mountContainerLayers Succeeded")
+	return guestRequest, nil
+
+}
+
+// UnmountOperation is used when calling Unmount() to determine what type of unmount is
+// required. In V1 schema, this must be unmountOperationAll. In V2, client can
+// be more optimal and only unmount what they need which can be a minor performance
+// improvement (eg if you know only one container is running in a utility VM, and
+// the UVM is about to be torn down, there's no need to unmount the VSMB shares,
+// just SCSI to have a consistent file system).
+type UnmountOperation uint
+
+const (
+	UnmountOperationSCSI  UnmountOperation = 0x01
+	UnmountOperationVSMB                   = 0x02
+	UnmountOperationVPMEM                  = 0x04
+	UnmountOperationAll                    = UnmountOperationSCSI | UnmountOperationVSMB | UnmountOperationVPMEM
+)
+
+// UnmountContainerLayers is a helper for clients to hide all the complexity of layer unmounting
+func UnmountContainerLayers(layerFolders []string, guestRoot string, uvm *uvm.UtilityVM, op UnmountOperation) error {
+	logrus.Debugln("hcsshim::unmountContainerLayers", layerFolders)
+	if uvm == nil {
+		// Must be an argon - folders are mounted on the host
+		if op != UnmountOperationAll {
+			return fmt.Errorf("only operation supported for host-mounted folders is unmountOperationAll")
+		}
+		if len(layerFolders) < 1 {
+			return fmt.Errorf("need at least one layer for Unmount")
+		}
+		path := layerFolders[len(layerFolders)-1]
+		logrus.Debugln("hcsshim::Unmount UnprepareLayer", path)
+		if err := wclayer.UnprepareLayer(path); err != nil {
+			return err
+		}
+		// TODO Should we try this anyway?
+		logrus.Debugln("hcsshim::unmountContainerLayers DeactivateLayer", path)
+		return wclayer.DeactivateLayer(path)
+	}
+
+	// V2 Xenon
+
+	// Base+Scratch as a minimum. This is different to v1 which only requires the scratch
+	if len(layerFolders) < 2 {
+		return fmt.Errorf("at least two layers are required for unmount")
+	}
+
+	var retError error
+
+	// Unload the storage filter followed by the SCSI scratch
+	if (op & UnmountOperationSCSI) == UnmountOperationSCSI {
+		containerScratchPathInUVM := ospath.Join(uvm.OS(), guestRoot, scratchPath)
+		logrus.Debugf("hcsshim::unmountContainerLayers CombinedLayers %s", containerScratchPathInUVM)
+		combinedLayersModification := &hcsschema.ModifySettingRequest{
+			GuestRequest: guestrequest.GuestRequest{
+				ResourceType: guestrequest.ResourceTypeCombinedLayers,
+				RequestType:  requesttype.Remove,
+				Settings:     guestrequest.CombinedLayers{ContainerRootPath: containerScratchPathInUVM},
+			},
+		}
+		if err := uvm.Modify(combinedLayersModification); err != nil {
+			logrus.Errorf(err.Error())
+		}
+
+		// Hot remove the scratch from the SCSI controller
+		hostScratchFile := filepath.Join(layerFolders[len(layerFolders)-1], "sandbox.vhdx")
+		logrus.Debugf("hcsshim::unmountContainerLayers SCSI %s %s", containerScratchPathInUVM, hostScratchFile)
+		if err := uvm.RemoveSCSI(hostScratchFile); err != nil {
+			e := fmt.Errorf("failed to remove SCSI %s: %s", hostScratchFile, err)
+			logrus.Debugln(e)
+			if retError == nil {
+				retError = e
+			} else {
+				retError = errors.Wrapf(retError, e.Error())
+			}
+		}
+	}
+
+	// Remove each of the read-only layers from VSMB. These's are ref-counted and
+	// only removed once the count drops to zero. This allows multiple containers
+	// to share layers.
+	if uvm.OS() == "windows" && len(layerFolders) > 1 && (op&UnmountOperationVSMB) == UnmountOperationVSMB {
+		for _, layerPath := range layerFolders[:len(layerFolders)-1] {
+			if e := uvm.RemoveVSMB(layerPath); e != nil {
+				logrus.Debugln(e)
+				if retError == nil {
+					retError = e
+				} else {
+					retError = errors.Wrapf(retError, e.Error())
+				}
+			}
+		}
+	}
+
+	// Remove each of the read-only layers from VPMEM (or SCSI). These's are ref-counted
+	// and only removed once the count drops to zero. This allows multiple containers to
+	// share layers. Note that SCSI is used on large layers.
+	if uvm.OS() == "linux" && len(layerFolders) > 1 && (op&UnmountOperationVPMEM) == UnmountOperationVPMEM {
+		for _, layerPath := range layerFolders[:len(layerFolders)-1] {
+			hostPath := filepath.Join(layerPath, "layer.vhd")
+			if fi, err := os.Stat(hostPath); err != nil {
+				var e error
+				if uint64(fi.Size()) > uvm.PMemMaxSizeBytes() {
+					e = uvm.RemoveSCSI(hostPath)
+				} else {
+					e = uvm.RemoveVPMEM(hostPath)
+				}
+				if e != nil {
+					logrus.Debugln(e)
+					if retError == nil {
+						retError = e
+					} else {
+						retError = errors.Wrapf(retError, e.Error())
+					}
+				}
+			}
+		}
+	}
+
+	// TODO (possibly) Consider deleting the container directory in the utility VM
+
+	return retError
+}
+
+func cleanupOnMountFailure(uvm *uvm.UtilityVM, wcowLayers []string, lcowLayers []lcowLayerEntry, scratchHostPath string) {
+	for _, wl := range wcowLayers {
+		if err := uvm.RemoveVSMB(wl); err != nil {
+			logrus.Warnf("Possibly leaked vsmbshare on error removal path: %s", err)
+		}
+	}
+	for _, ll := range lcowLayers {
+		if ll.scsi {
+			if err := uvm.RemoveSCSI(ll.hostPath); err != nil {
+				logrus.Warnf("Possibly leaked SCSI on error removal path: %s", err)
+			}
+		} else if err := uvm.RemoveVPMEM(ll.hostPath); err != nil {
+			logrus.Warnf("Possibly leaked vpmemdevice on error removal path: %s", err)
+		}
+	}
+	if scratchHostPath != "" {
+		if err := uvm.RemoveSCSI(scratchHostPath); err != nil {
+			logrus.Warnf("Possibly leaked SCSI disk on error removal path: %s", err)
+		}
+	}
+}
+
+func computeV2Layers(vm *uvm.UtilityVM, paths []string) (layers []hcsschema.Layer, err error) {
+	for _, path := range paths {
+		uvmPath, err := vm.GetVSMBUvmPath(path)
+		if err != nil {
+			return nil, err
+		}
+		layerID, err := wclayer.LayerID(path)
+		if err != nil {
+			return nil, err
+		}
+		layers = append(layers, hcsschema.Layer{Id: layerID.String(), Path: uvmPath})
+	}
+	return layers, nil
+}

vendor/github.com/Microsoft/hcsshim/internal/hcsoci/network.go

@@ -0,0 +1,41 @@
+package hcsoci
+
+import (
+	"github.com/Microsoft/hcsshim/internal/hns"
+	"github.com/sirupsen/logrus"
+)
+
+func createNetworkNamespace(coi *createOptionsInternal, resources *Resources) error {
+	netID, err := hns.CreateNamespace()
+	if err != nil {
+		return err
+	}
+	logrus.Infof("created network namespace %s for %s", netID, coi.ID)
+	resources.netNS = netID
+	resources.createdNetNS = true
+	for _, endpointID := range coi.Spec.Windows.Network.EndpointList {
+		err = hns.AddNamespaceEndpoint(netID, endpointID)
+		if err != nil {
+			return err
+		}
+		logrus.Infof("added network endpoint %s to namespace %s", endpointID, netID)
+		resources.networkEndpoints = append(resources.networkEndpoints, endpointID)
+	}
+	return nil
+}
+
+func getNamespaceEndpoints(netNS string) ([]*hns.HNSEndpoint, error) {
+	ids, err := hns.GetNamespaceEndpoints(netNS)
+	if err != nil {
+		return nil, err
+	}
+	var endpoints []*hns.HNSEndpoint
+	for _, id := range ids {
+		endpoint, err := hns.GetHNSEndpointByID(id)
+		if err != nil {
+			return nil, err
+		}
+		endpoints = append(endpoints, endpoint)
+	}
+	return endpoints, nil
+}

vendor/github.com/Microsoft/hcsshim/internal/hcsoci/resources.go

@@ -0,0 +1,127 @@
+package hcsoci
+
+import (
+	"os"
+
+	"github.com/Microsoft/hcsshim/internal/hns"
+	"github.com/Microsoft/hcsshim/internal/uvm"
+	"github.com/sirupsen/logrus"
+)
+
+// NetNS returns the network namespace for the container
+func (r *Resources) NetNS() string {
+	return r.netNS
+}
+
+// Resources is the structure returned as part of creating a container. It holds
+// nothing useful to clients, hence everything is lowercased. A client would use
+// it in a call to ReleaseResource to ensure everything is cleaned up when a
+// container exits.
+type Resources struct {
+	// containerRootInUVM is the base path in a utility VM where elements relating
+	// to a container are exposed. For example, the mounted filesystem; the runtime
+	// spec (in the case of LCOW); overlay and scratch (in the case of LCOW).
+	//
+	// For WCOW, this will be under C:\c\N, and for LCOW this will
+	// be under /run/gcs/c/N. N is an atomic counter for each container created
+	// in that utility VM. For LCOW this is also the "OCI Bundle Path".
+	containerRootInUVM string
+
+	// layers is an array of the layer folder paths which have been mounted either on
+	// the host in the case or a WCOW Argon, or in a utility VM for WCOW Xenon and LCOW.
+	layers []string
+
+	// vsmbMounts is an array of the host-paths mounted into a utility VM to support
+	// (bind-)mounts into a WCOW v2 Xenon.
+	vsmbMounts []string
+
+	// plan9Mounts is an array of all the host paths which have been added to
+	// an LCOW utility VM
+	plan9Mounts []string
+
+	// netNS is the network namespace
+	netNS string
+
+	// networkEndpoints is the list of network endpoints used by the container
+	networkEndpoints []string
+
+	// createNetNS indicates if the network namespace has been created
+	createdNetNS bool
+
+	// addedNetNSToVM indicates if the network namespace has been added to the containers utility VM
+	addedNetNSToVM bool
+
+	// scsiMounts is an array of the host-paths mounted into a utility VM to
+	// support scsi device passthrough.
+	scsiMounts []string
+}
+
+// TODO: Method on the resources?
+func ReleaseResources(r *Resources, vm *uvm.UtilityVM, all bool) error {
+	if vm != nil && r.addedNetNSToVM {
+		err := vm.RemoveNetNS(r.netNS)
+		if err != nil {
+			logrus.Warn(err)
+		}
+		r.addedNetNSToVM = false
+	}
+
+	if r.createdNetNS {
+		for len(r.networkEndpoints) != 0 {
+			endpoint := r.networkEndpoints[len(r.networkEndpoints)-1]
+			err := hns.RemoveNamespaceEndpoint(r.netNS, endpoint)
+			if err != nil {
+				if !os.IsNotExist(err) {
+					return err
+				}
+				logrus.Warnf("removing endpoint %s from namespace %s: does not exist", endpoint, r.NetNS())
+			}
+			r.networkEndpoints = r.networkEndpoints[:len(r.networkEndpoints)-1]
+		}
+		r.networkEndpoints = nil
+		err := hns.RemoveNamespace(r.netNS)
+		if err != nil && !os.IsNotExist(err) {
+			return err
+		}
+		r.createdNetNS = false
+	}
+
+	if len(r.layers) != 0 {
+		op := UnmountOperationSCSI
+		if vm == nil || all {
+			op = UnmountOperationAll
+		}
+		err := UnmountContainerLayers(r.layers, r.containerRootInUVM, vm, op)
+		if err != nil {
+			return err
+		}
+		r.layers = nil
+	}
+
+	if all {
+		for len(r.vsmbMounts) != 0 {
+			mount := r.vsmbMounts[len(r.vsmbMounts)-1]
+			if err := vm.RemoveVSMB(mount); err != nil {
+				return err
+			}
+			r.vsmbMounts = r.vsmbMounts[:len(r.vsmbMounts)-1]
+		}
+
+		for len(r.plan9Mounts) != 0 {
+			mount := r.plan9Mounts[len(r.plan9Mounts)-1]
+			if err := vm.RemovePlan9(mount); err != nil {
+				return err
+			}
+			r.plan9Mounts = r.plan9Mounts[:len(r.plan9Mounts)-1]
+		}
+
+		for _, path := range r.scsiMounts {
+			if err := vm.RemoveSCSI(path); err != nil {
+				return err
+			}
+			r.scsiMounts = nil
+		}
+	}
+
+	return nil
+}

vendor/github.com/Microsoft/hcsshim/internal/hcsoci/resources_lcow.go

@@ -0,0 +1,104 @@
+// +build windows
+
+package hcsoci
+
+// Contains functions relating to a LCOW container, as opposed to a utility VM
+
+import (
+	"fmt"
+	"path"
+	"strconv"
+	"strings"
+
+	"github.com/Microsoft/hcsshim/internal/guestrequest"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/sirupsen/logrus"
+)
+
+const rootfsPath = "rootfs"
+const mountPathPrefix = "m"
+
+func allocateLinuxResources(coi *createOptionsInternal, resources *Resources) error {
+	if coi.Spec.Root == nil {
+		coi.Spec.Root = &specs.Root{}
+	}
+	if coi.Spec.Root.Path == "" {
+		logrus.Debugln("hcsshim::allocateLinuxResources mounting storage")
+		mcl, err := MountContainerLayers(coi.Spec.Windows.LayerFolders, resources.containerRootInUVM, coi.HostingSystem)
+		if err != nil {
+			return fmt.Errorf("failed to mount container storage: %s", err)
+		}
+		if coi.HostingSystem == nil {
+			coi.Spec.Root.Path = mcl.(string) // Argon v1 or v2
+		} else {
+			coi.Spec.Root.Path = mcl.(guestrequest.CombinedLayers).ContainerRootPath // v2 Xenon LCOW
+		}
+		resources.layers = coi.Spec.Windows.LayerFolders
+	} else {
+		// This is the "Plan 9" root filesystem.
+		// TODO: We need a test for this. Ask @jstarks how you can even lay this out on Windows.
+		hostPath := coi.Spec.Root.Path
+		uvmPathForContainersFileSystem := path.Join(resources.containerRootInUVM, rootfsPath)
+		err := coi.HostingSystem.AddPlan9(hostPath, uvmPathForContainersFileSystem, coi.Spec.Root.Readonly)
+		if err != nil {
+			return fmt.Errorf("adding plan9 root: %s", err)
+		}
+		coi.Spec.Root.Path = uvmPathForContainersFileSystem
+		resources.plan9Mounts = append(resources.plan9Mounts, hostPath)
+	}
+
+	for i, mount := range coi.Spec.Mounts {
+		switch mount.Type {
+		case "bind":
+		case "physical-disk":
+		case "virtual-disk":
+		default:
+			// Unknown mount type
+			continue
+		}
+		if mount.Destination == "" || mount.Source == "" {
+			return fmt.Errorf("invalid OCI spec - a mount must have both source and a destination: %+v", mount)
+		}
+
+		if coi.HostingSystem != nil {
+			hostPath := mount.Source
+			uvmPathForShare := path.Join(resources.containerRootInUVM, mountPathPrefix+strconv.Itoa(i))
+
+			readOnly := false
+			for _, o := range mount.Options {
+				if strings.ToLower(o) == "ro" {
+					readOnly = true
+					break
+				}
+			}
+
+			if mount.Type == "physical-disk" {
+				logrus.Debugf("hcsshim::allocateLinuxResources Hot-adding SCSI physical disk for OCI mount %+v", mount)
+				_, _, err := coi.HostingSystem.AddSCSIPhysicalDisk(hostPath, uvmPathForShare, readOnly)
+				if err != nil {
+					return fmt.Errorf("adding SCSI physical disk mount %+v: %s", mount, err)
+				}
+				resources.scsiMounts = append(resources.scsiMounts, hostPath)
+				coi.Spec.Mounts[i].Type = "none"
+			} else if mount.Type == "virtual-disk" {
+				logrus.Debugf("hcsshim::allocateLinuxResources Hot-adding SCSI virtual disk for OCI mount %+v", mount)
+				_, _, err := coi.HostingSystem.AddSCSI(hostPath, uvmPathForShare, readOnly)
+				if err != nil {
+					return fmt.Errorf("adding SCSI virtual disk mount %+v: %s", mount, err)
+				}
+				resources.scsiMounts = append(resources.scsiMounts, hostPath)
+				coi.Spec.Mounts[i].Type = "none"
+			} else {
+				logrus.Debugf("hcsshim::allocateLinuxResources Hot-adding Plan9 for OCI mount %+v", mount)
+				err := coi.HostingSystem.AddPlan9(hostPath, uvmPathForShare, readOnly)
+				if err != nil {
+					return fmt.Errorf("adding plan9 mount %+v: %s", mount, err)
+				}
+				resources.plan9Mounts = append(resources.plan9Mounts, hostPath)
+			}
+			coi.Spec.Mounts[i].Source = uvmPathForShare
+		}
+	}
+
+	return nil
+}

vendor/github.com/Microsoft/hcsshim/internal/hcsoci/resources_wcow.go

@@ -0,0 +1,127 @@
+// +build windows
+
+package hcsoci
+
+// Contains functions relating to a WCOW container, as opposed to a utility VM
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/Microsoft/hcsshim/internal/guestrequest"
+	"github.com/Microsoft/hcsshim/internal/schema2"
+	"github.com/Microsoft/hcsshim/internal/schemaversion"
+	"github.com/Microsoft/hcsshim/internal/wclayer"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/sirupsen/logrus"
+)
+
+func allocateWindowsResources(coi *createOptionsInternal, resources *Resources) error {
+	if coi.Spec == nil || coi.Spec.Windows == nil || coi.Spec.Windows.LayerFolders == nil {
+		return fmt.Errorf("field 'Spec.Windows.Layerfolders' is not populated")
+	}
+
+	scratchFolder := coi.Spec.Windows.LayerFolders[len(coi.Spec.Windows.LayerFolders)-1]
+	logrus.Debugf("hcsshim::allocateWindowsResources scratch folder: %s", scratchFolder)
+
+	// TODO: Remove this code for auto-creation. Make the caller responsible.
+	// Create the directory for the RW scratch layer if it doesn't exist
+	if _, err := os.Stat(scratchFolder); os.IsNotExist(err) {
+		logrus.Debugf("hcsshim::allocateWindowsResources container scratch folder does not exist so creating: %s ", scratchFolder)
+		if err := os.MkdirAll(scratchFolder, 0777); err != nil {
+			return fmt.Errorf("failed to auto-create container scratch folder %s: %s", scratchFolder, err)
+		}
+	}
+
+	// Create sandbox.vhdx if it doesn't exist in the scratch folder. It's called sandbox.vhdx
+	// rather than scratch.vhdx as in the v1 schema, it's hard-coded in HCS.
+	if _, err := os.Stat(filepath.Join(scratchFolder, "sandbox.vhdx")); os.IsNotExist(err) {
+		logrus.Debugf("hcsshim::allocateWindowsResources container sandbox.vhdx does not exist so creating in %s ", scratchFolder)
+		if err := wclayer.CreateScratchLayer(scratchFolder, coi.Spec.Windows.LayerFolders[:len(coi.Spec.Windows.LayerFolders)-1]); err != nil {
+			return fmt.Errorf("failed to CreateSandboxLayer %s", err)
+		}
+	}
+
+	if coi.Spec.Root == nil {
+		coi.Spec.Root = &specs.Root{}
+	}
+
+	if coi.Spec.Root.Path == "" && (coi.HostingSystem != nil || coi.Spec.Windows.HyperV == nil) {
+		logrus.Debugln("hcsshim::allocateWindowsResources mounting storage")
+		mcl, err := MountContainerLayers(coi.Spec.Windows.LayerFolders, resources.containerRootInUVM, coi.HostingSystem)
+		if err != nil {
+			return fmt.Errorf("failed to mount container storage: %s", err)
+		}
+		if coi.HostingSystem == nil {
+			coi.Spec.Root.Path = mcl.(string) // Argon v1 or v2
+		} else {
+			coi.Spec.Root.Path = mcl.(guestrequest.CombinedLayers).ContainerRootPath // v2 Xenon WCOW
+		}
+		resources.layers = coi.Spec.Windows.LayerFolders
+	}
+
+	// Validate each of the mounts. If this is a V2 Xenon, we have to add them as
+	// VSMB shares to the utility VM. For V1 Xenon and Argons, there's nothing for
+	// us to do as it's done by HCS.
+	for i, mount := range coi.Spec.Mounts {
+		if mount.Destination == "" || mount.Source == "" {
+			return fmt.Errorf("invalid OCI spec - a mount must have both source and a destination: %+v", mount)
+		}
+		switch mount.Type {
+		case "":
+		case "physical-disk":
+		case "virtual-disk":
+		default:
+			return fmt.Errorf("invalid OCI spec - Type '%s' not supported", mount.Type)
+		}
+
+		if coi.HostingSystem != nil && schemaversion.IsV21(coi.actualSchemaVersion) {
+			uvmPath := fmt.Sprintf("C:\\%s\\%d", coi.actualID, i)
+
+			readOnly := false
+			for _, o := range mount.Options {
+				if strings.ToLower(o) == "ro" {
+					readOnly = true
+					break
+				}
+			}
+			if mount.Type == "physical-disk" {
+				logrus.Debugf("hcsshim::allocateWindowsResources Hot-adding SCSI physical disk for OCI mount %+v", mount)
+				_, _, err := coi.HostingSystem.AddSCSIPhysicalDisk(mount.Source, uvmPath, readOnly)
+				if err != nil {
+					return fmt.Errorf("adding SCSI physical disk mount %+v: %s", mount, err)
+				}
+				coi.Spec.Mounts[i].Type = ""
+				resources.scsiMounts = append(resources.scsiMounts, mount.Source)
+			} else if mount.Type == "virtual-disk" {
+				logrus.Debugf("hcsshim::allocateWindowsResources Hot-adding SCSI virtual disk for OCI mount %+v", mount)
+				_, _, err := coi.HostingSystem.AddSCSI(mount.Source, uvmPath, readOnly)
+				if err != nil {
+					return fmt.Errorf("adding SCSI virtual disk mount %+v: %s", mount, err)
+				}
+				coi.Spec.Mounts[i].Type = ""
+				resources.scsiMounts = append(resources.scsiMounts, mount.Source)
+			} else {
+				logrus.Debugf("hcsshim::allocateWindowsResources Hot-adding VSMB share for OCI mount %+v", mount)
+				options := &hcsschema.VirtualSmbShareOptions{}
+				if readOnly {
+					options.ReadOnly = true
+					options.CacheIo = true
+					options.ShareRead = true
+					options.ForceLevelIIOplocks = true
+					break
+				}
+
+				err := coi.HostingSystem.AddVSMB(mount.Source, "", options)
+				if err != nil {
+					return fmt.Errorf("failed to add VSMB share to utility VM for mount %+v: %s", mount, err)
+				}
+				resources.vsmbMounts = append(resources.vsmbMounts, mount.Source)
+			}
+		}
+	}
+
+	return nil
+}

vendor/github.com/Microsoft/hcsshim/internal/hcsoci/wcow_argon_test.go

@@ -0,0 +1,260 @@
+// +build windows,functional
+
+package hcsoci
+
+//import (
+//	"os"
+//	"path/filepath"
+//	"testing"
+
+//	"github.com/Microsoft/hcsshim/internal/schemaversion"
+//	specs "github.com/opencontainers/runtime-spec/specs-go"
+//)
+
+//// --------------------------------
+////    W C O W    A R G O N   V 1
+//// --------------------------------
+
+//// A v1 Argon with a single base layer. It also validates hostname functionality is propagated.
+//func TestV1Argon(t *testing.T) {
+//	t.Skip("fornow")
+//	tempDir := createWCOWTempDirWithSandbox(t)
+//	defer os.RemoveAll(tempDir)
+
+//	layers := append(layersNanoserver, tempDir)
+//	mountPath, err := mountContainerLayers(layers, nil)
+//	if err != nil {
+//		t.Fatalf("failed to mount container storage: %s", err)
+//	}
+//	defer unmountContainerLayers(layers, nil, unmountOperationAll)
+
+//	c, err := CreateContainer(&CreateOptions{
+//		SchemaVersion: schemaversion.SchemaV10(),
+//		Id:            "TestV1Argon",
+//		Owner:         "unit-test",
+//		Spec: &specs.Spec{
+//			Hostname: "goofy",
+//			Windows:  &specs.Windows{LayerFolders: layers},
+//			Root:     &specs.Root{Path: mountPath.(string)},
+//		},
+//	})
+//	if err != nil {
+//		t.Fatalf("Failed create: %s", err)
+//	}
+//	startContainer(t, c)
+//	runCommand(t, c, "cmd /s /c echo Hello", `c:\`, "Hello")
+//	runCommand(t, c, "cmd /s /c hostname", `c:\`, "goofy")
+//	stopContainer(t, c)
+//	c.Terminate()
+//}
+
+//// A v1 Argon with a single base layer which uses the auto-mount capability
+//func TestV1ArgonAutoMount(t *testing.T) {
+//	t.Skip("fornow")
+//	tempDir := createWCOWTempDirWithSandbox(t)
+//	defer os.RemoveAll(tempDir)
+
+//	layers := append(layersBusybox, tempDir)
+//	c, err := CreateContainer(&CreateOptions{
+//		Id:            "TestV1ArgonAutoMount",
+//		SchemaVersion: schemaversion.SchemaV10(),
+//		Spec:          &specs.Spec{Windows: &specs.Windows{LayerFolders: layers}},
+//	})
+//	if err != nil {
+//		t.Fatalf("Failed create: %s", err)
+//	}
+//	defer unmountContainerLayers(layers, nil, unmountOperationAll)
+//	startContainer(t, c)
+//	runCommand(t, c, "cmd /s /c echo Hello", `c:\`, "Hello")
+//	stopContainer(t, c)
+//	c.Terminate()
+//}
+
+//// A v1 Argon with multiple layers which uses the auto-mount capability
+//func TestV1ArgonMultipleBaseLayersAutoMount(t *testing.T) {
+//	t.Skip("fornow")
+
+//	// This is the important bit for this test. It's deleted here. We call the helper only to allocate a temporary directory
+//	containerScratchDir := createTempDir(t)
+//	os.RemoveAll(containerScratchDir)
+//	defer os.RemoveAll(containerScratchDir) // As auto-created
+
+//	layers := append(layersBusybox, containerScratchDir)
+//	c, err := CreateContainer(&CreateOptions{
+//		Id:            "TestV1ArgonMultipleBaseLayersAutoMount",
+//		SchemaVersion: schemaversion.SchemaV10(),
+//		Spec:          &specs.Spec{Windows: &specs.Windows{LayerFolders: layers}},
+//	})
+//	if err != nil {
+//		t.Fatalf("Failed create: %s", err)
+//	}
+//	defer unmountContainerLayers(layers, nil, unmountOperationAll)
+//	startContainer(t, c)
+//	runCommand(t, c, "cmd /s /c echo Hello", `c:\`, "Hello")
+//	stopContainer(t, c)
+//	c.Terminate()
+//}
+
+//// A v1 Argon with a single mapped directory.
+//func TestV1ArgonSingleMappedDirectory(t *testing.T) {
+//	t.Skip("fornow")
+//	tempDir := createWCOWTempDirWithSandbox(t)
+//	defer os.RemoveAll(tempDir)
+
+//	layers := append(layersNanoserver, tempDir)
+
+//	// Create a temp folder containing foo.txt which will be used for the bind-mount test.
+//	source := createTempDir(t)
+//	defer os.RemoveAll(source)
+//	mount := specs.Mount{
+//		Source:      source,
+//		Destination: `c:\foo`,
+//	}
+//	f, err := os.OpenFile(filepath.Join(source, "foo.txt"), os.O_RDWR|os.O_CREATE, 0755)
+//	f.Close()
+
+//	c, err := CreateContainer(&CreateOptions{
+//		SchemaVersion: schemaversion.SchemaV10(),
+//		Spec: &specs.Spec{
+//			Windows: &specs.Windows{LayerFolders: layers},
+//			Mounts:  []specs.Mount{mount},
+//		},
+//	})
+//	if err != nil {
+//		t.Fatalf("Failed create: %s", err)
+//	}
+//	defer unmountContainerLayers(layers, nil, unmountOperationAll)
+
+//	startContainer(t, c)
+//	runCommand(t, c, `cmd /s /c dir /b c:\foo`, `c:\`, "foo.txt")
+//	stopContainer(t, c)
+//	c.Terminate()
+//}
+
+//// --------------------------------
+////    W C O W    A R G O N   V 2
+//// --------------------------------
+
+//// A v2 Argon with a single base layer. It also validates hostname functionality is propagated.
+//// It also uses an auto-generated ID.
+//func TestV2Argon(t *testing.T) {
+//	t.Skip("fornow")
+//	tempDir := createWCOWTempDirWithSandbox(t)
+//	defer os.RemoveAll(tempDir)
+
+//	layers := append(layersNanoserver, tempDir)
+//	mountPath, err := mountContainerLayers(layers, nil)
+//	if err != nil {
+//		t.Fatalf("failed to mount container storage: %s", err)
+//	}
+//	defer unmountContainerLayers(layers, nil, unmountOperationAll)
+
+//	c, err := CreateContainer(&CreateOptions{
+//		SchemaVersion: schemaversion.SchemaV21(),
+//		Spec: &specs.Spec{
+//			Hostname: "mickey",
+//			Windows:  &specs.Windows{LayerFolders: layers},
+//			Root:     &specs.Root{Path: mountPath.(string)},
+//		},
+//	})
+//	if err != nil {
+//		t.Fatalf("Failed create: %s", err)
+//	}
+//	startContainer(t, c)
+//	runCommand(t, c, "cmd /s /c echo Hello", `c:\`, "Hello")
+//	runCommand(t, c, "cmd /s /c hostname", `c:\`, "mickey")
+//	stopContainer(t, c)
+//	c.Terminate()
+//}
+
+//// A v2 Argon with multiple layers
+//func TestV2ArgonMultipleBaseLayers(t *testing.T) {
+//	t.Skip("fornow")
+//	tempDir := createWCOWTempDirWithSandbox(t)
+//	defer os.RemoveAll(tempDir)
+
+//	layers := append(layersBusybox, tempDir)
+//	mountPath, err := mountContainerLayers(layers, nil)
+//	if err != nil {
+//		t.Fatalf("failed to mount container storage: %s", err)
+//	}
+//	defer unmountContainerLayers(layers, nil, unmountOperationAll)
+
+//	c, err := CreateContainer(&CreateOptions{
+//		SchemaVersion: schemaversion.SchemaV21(),
+//		Id:            "TestV2ArgonMultipleBaseLayers",
+//		Spec: &specs.Spec{
+//			Windows: &specs.Windows{LayerFolders: layers},
+//			Root:    &specs.Root{Path: mountPath.(string)},
+//		},
+//	})
+//	if err != nil {
+//		t.Fatalf("Failed create: %s", err)
+//	}
+//	startContainer(t, c)
+//	runCommand(t, c, "cmd /s /c echo Hello", `c:\`, "Hello")
+//	stopContainer(t, c)
+//	c.Terminate()
+//}
+
+//// A v2 Argon with multiple layers which uses the auto-mount capability and auto-create
+//func TestV2ArgonAutoMountMultipleBaseLayers(t *testing.T) {
+//	t.Skip("fornow")
+
+//	// This is the important bit for this test. It's deleted here. We call the helper only to allocate a temporary directory
+//	containerScratchDir := createTempDir(t)
+//	os.RemoveAll(containerScratchDir)
+//	defer os.RemoveAll(containerScratchDir) // As auto-created
+
+//	layers := append(layersBusybox, containerScratchDir)
+
+//	c, err := CreateContainer(&CreateOptions{
+//		SchemaVersion: schemaversion.SchemaV21(),
+//		Id:            "TestV2ArgonAutoMountMultipleBaseLayers",
+//		Spec:          &specs.Spec{Windows: &specs.Windows{LayerFolders: layers}},
+//	})
+//	if err != nil {
+//		t.Fatalf("Failed create: %s", err)
+//	}
+//	defer unmountContainerLayers(layers, nil, unmountOperationAll)
+//	startContainer(t, c)
+//	runCommand(t, c, "cmd /s /c echo Hello", `c:\`, "Hello")
+//	stopContainer(t, c)
+//	c.Terminate()
+//}
+
+//// A v2 Argon with a single mapped directory.
+//func TestV2ArgonSingleMappedDirectory(t *testing.T) {
+//	t.Skip("fornow")
+//	tempDir := createWCOWTempDirWithSandbox(t)
+//	defer os.RemoveAll(tempDir)
+
+//	layers := append(layersNanoserver, tempDir)
+
+//	// Create a temp folder containing foo.txt which will be used for the bind-mount test.
+//	source := createTempDir(t)
+//	defer os.RemoveAll(source)
+//	mount := specs.Mount{
+//		Source:      source,
+//		Destination: `c:\foo`,
+//	}
+//	f, err := os.OpenFile(filepath.Join(source, "foo.txt"), os.O_RDWR|os.O_CREATE, 0755)
+//	f.Close()
+
+//	c, err := CreateContainer(&CreateOptions{
+//		SchemaVersion: schemaversion.SchemaV21(),
+//		Spec: &specs.Spec{
+//			Windows: &specs.Windows{LayerFolders: layers},
+//			Mounts:  []specs.Mount{mount},
+//		},
+//	})
+//	if err != nil {
+//		t.Fatalf("Failed create: %s", err)
+//	}
+//	defer unmountContainerLayers(layers, nil, unmountOperationAll)
+
+//	startContainer(t, c)
+//	runCommand(t, c, `cmd /s /c dir /b c:\foo`, `c:\`, "foo.txt")
+//	stopContainer(t, c)
+//	c.Terminate()
+//}

vendor/github.com/Microsoft/hcsshim/internal/hcsoci/wcow_xenon_test.go

@@ -0,0 +1,365 @@
+// +build windows,functional
+
+package hcsoci
+
+//import (
+//	"fmt"
+//	"os"
+//	"path/filepath"
+//	"testing"
+
+//	"github.com/Microsoft/hcsshim/internal/schemaversion"
+//	specs "github.com/opencontainers/runtime-spec/specs-go"
+//)
+
+//// --------------------------------
+////    W C O W    X E N O N   V 2
+//// --------------------------------
+
+//// A single WCOW xenon. Note in this test, neither the UVM or the
+//// containers are supplied IDs - they will be autogenerated for us.
+//// This is the minimum set of parameters needed to create a V2 WCOW xenon.
+//func TestV2XenonWCOW(t *testing.T) {
+//	t.Skip("Skipping for now")
+//	uvm, uvmScratchDir := createv2WCOWUVM(t, layersNanoserver, "", nil)
+//	defer os.RemoveAll(uvmScratchDir)
+//	defer uvm.Terminate()
+
+//	// Create the container hosted inside the utility VM
+//	containerScratchDir := createWCOWTempDirWithSandbox(t)
+//	defer os.RemoveAll(containerScratchDir)
+//	layerFolders := append(layersNanoserver, containerScratchDir)
+//	hostedContainer, err := CreateContainer(&CreateOptions{
+//		HostingSystem: uvm,
+//		Spec:          &specs.Spec{Windows: &specs.Windows{LayerFolders: layerFolders}},
+//	})
+//	if err != nil {
+//		t.Fatalf("CreateContainer failed: %s", err)
+//	}
+//	defer unmountContainerLayers(layerFolders, uvm, unmountOperationAll)
+
+//	// Start/stop the container
+//	startContainer(t, hostedContainer)
+//	runCommand(t, hostedContainer, "cmd /s /c echo TestV2XenonWCOW", `c:\`, "TestV2XenonWCOW")
+//	stopContainer(t, hostedContainer)
+//	hostedContainer.Terminate()
+//}
+
+//// TODO: Have a similar test where the UVM scratch folder does not exist.
+//// A single WCOW xenon but where the container sandbox folder is not pre-created by the client
+//func TestV2XenonWCOWContainerSandboxFolderDoesNotExist(t *testing.T) {
+//	t.Skip("Skipping for now")
+//	uvm, uvmScratchDir := createv2WCOWUVM(t, layersNanoserver, "TestV2XenonWCOWContainerSandboxFolderDoesNotExist_UVM", nil)
+//	defer os.RemoveAll(uvmScratchDir)
+//	defer uvm.Terminate()
+
+//	// This is the important bit for this test. It's deleted here. We call the helper only to allocate a temporary directory
+//	containerScratchDir := createTempDir(t)
+//	os.RemoveAll(containerScratchDir)
+//	defer os.RemoveAll(containerScratchDir) // As auto-created
+
+//	layerFolders := append(layersBusybox, containerScratchDir)
+//	hostedContainer, err := CreateContainer(&CreateOptions{
+//		Id:            "container",
+//		HostingSystem: uvm,
+//		Spec:          &specs.Spec{Windows: &specs.Windows{LayerFolders: layerFolders}},
+//	})
+//	if err != nil {
+//		t.Fatalf("CreateContainer failed: %s", err)
+//	}
+//	defer unmountContainerLayers(layerFolders, uvm, unmountOperationAll)
+
+//	// Start/stop the container
+//	startContainer(t, hostedContainer)
+//	runCommand(t, hostedContainer, "cmd /s /c echo TestV2XenonWCOW", `c:\`, "TestV2XenonWCOW")
+//	stopContainer(t, hostedContainer)
+//	hostedContainer.Terminate()
+//}
+
+//// TODO What about mount. Test with the client doing the mount.
+//// TODO Test as above, but where sandbox for UVM is entirely created by a client to show how it's done.
+
+//// Two v2 WCOW containers in the same UVM, each with a single base layer
+//func TestV2XenonWCOWTwoContainers(t *testing.T) {
+//	t.Skip("Skipping for now")
+//	uvm, uvmScratchDir := createv2WCOWUVM(t, layersNanoserver, "TestV2XenonWCOWTwoContainers_UVM", nil)
+//	defer os.RemoveAll(uvmScratchDir)
+//	defer uvm.Terminate()
+
+//	// First hosted container
+//	firstContainerScratchDir := createWCOWTempDirWithSandbox(t)
+//	defer os.RemoveAll(firstContainerScratchDir)
+//	firstLayerFolders := append(layersNanoserver, firstContainerScratchDir)
+//	firstHostedContainer, err := CreateContainer(&CreateOptions{
+//		Id:            "FirstContainer",
+//		HostingSystem: uvm,
+//		SchemaVersion: schemaversion.SchemaV21(),
+//		Spec:          &specs.Spec{Windows: &specs.Windows{LayerFolders: firstLayerFolders}},
+//	})
+//	if err != nil {
+//		t.Fatalf("CreateContainer failed: %s", err)
+//	}
+//	defer unmountContainerLayers(firstLayerFolders, uvm, unmountOperationAll)
+
+//	// Second hosted container
+//	secondContainerScratchDir := createWCOWTempDirWithSandbox(t)
+//	defer os.RemoveAll(firstContainerScratchDir)
+//	secondLayerFolders := append(layersNanoserver, secondContainerScratchDir)
+//	secondHostedContainer, err := CreateContainer(&CreateOptions{
+//		Id:            "SecondContainer",
+//		HostingSystem: uvm,
+//		SchemaVersion: schemaversion.SchemaV21(),
+//		Spec:          &specs.Spec{Windows: &specs.Windows{LayerFolders: secondLayerFolders}},
+//	})
+//	if err != nil {
+//		t.Fatalf("CreateContainer failed: %s", err)
+//	}
+//	defer unmountContainerLayers(secondLayerFolders, uvm, unmountOperationAll)
+
+//	startContainer(t, firstHostedContainer)
+//	runCommand(t, firstHostedContainer, "cmd /s /c echo FirstContainer", `c:\`, "FirstContainer")
+//	startContainer(t, secondHostedContainer)
+//	runCommand(t, secondHostedContainer, "cmd /s /c echo SecondContainer", `c:\`, "SecondContainer")
+//	stopContainer(t, firstHostedContainer)
+//	stopContainer(t, secondHostedContainer)
+//	firstHostedContainer.Terminate()
+//	secondHostedContainer.Terminate()
+//}
+
+////// This verifies the container storage is unmounted correctly so that a second
+////// container can be started from the same storage.
+////func TestV2XenonWCOWWithRemount(t *testing.T) {
+//////	//t.Skip("Skipping for now")
+////	uvmID := "Testv2XenonWCOWWithRestart_UVM"
+////	uvmScratchDir, err := ioutil.TempDir("", "uvmScratch")
+////	if err != nil {
+////		t.Fatalf("Failed create temporary directory: %s", err)
+////	}
+////	if err := CreateWCOWSandbox(layersNanoserver[0], uvmScratchDir, uvmID); err != nil {
+////		t.Fatalf("Failed create Windows UVM Sandbox: %s", err)
+////	}
+////	defer os.RemoveAll(uvmScratchDir)
+
+////	uvm, err := CreateContainer(&CreateOptions{
+////		Id:              uvmID,
+////		Owner:           "unit-test",
+////		SchemaVersion:   SchemaV21(),
+////		IsHostingSystem: true,
+////		Spec: &specs.Spec{
+////			Windows: &specs.Windows{
+////				LayerFolders: []string{uvmScratchDir},
+////				HyperV:       &specs.WindowsHyperV{UtilityVMPath: filepath.Join(layersNanoserver[0], `UtilityVM\Files`)},
+////			},
+////		},
+////	})
+////	if err != nil {
+////		t.Fatalf("Failed create UVM: %s", err)
+////	}
+////	defer uvm.Terminate()
+////	if err := uvm.Start(); err != nil {
+////		t.Fatalf("Failed start utility VM: %s", err)
+////	}
+
+////	// Mount the containers storage in the utility VM
+////	containerScratchDir := createWCOWTempDirWithSandbox(t)
+////	layerFolders := append(layersNanoserver, containerScratchDir)
+////	cls, err := Mount(layerFolders, uvm, SchemaV21())
+////	if err != nil {
+////		t.Fatalf("failed to mount container storage: %s", err)
+////	}
+////	combinedLayers := cls.(CombinedLayersV2)
+////	mountedLayers := &ContainersResourcesStorageV2{
+////		Layers: combinedLayers.Layers,
+////		Path:   combinedLayers.ContainerRootPath,
+////	}
+////	defer func() {
+////		if err := Unmount(layerFolders, uvm, SchemaV21(), unmountOperationAll); err != nil {
+////			t.Fatalf("failed to unmount container storage: %s", err)
+////		}
+////	}()
+
+////	// Create the first container
+////	defer os.RemoveAll(containerScratchDir)
+////	xenon, err := CreateContainer(&CreateOptions{
+////		Id:            "container",
+////		Owner:         "unit-test",
+////		HostingSystem: uvm,
+////		SchemaVersion: SchemaV21(),
+////		Spec:          &specs.Spec{Windows: &specs.Windows{}}, // No layerfolders as we mounted them ourself.
+////	})
+////	if err != nil {
+////		t.Fatalf("CreateContainer failed: %s", err)
+////	}
+
+////	// Start/stop the first container
+////	startContainer(t, xenon)
+////	runCommand(t, xenon, "cmd /s /c echo TestV2XenonWCOWFirstStart", `c:\`, "TestV2XenonWCOWFirstStart")
+////	stopContainer(t, xenon)
+////	xenon.Terminate()
+
+////	// Now unmount and remount to exactly the same places
+////	if err := Unmount(layerFolders, uvm, SchemaV21(), unmountOperationAll); err != nil {
+////		t.Fatalf("failed to unmount container storage: %s", err)
+////	}
+////	if _, err = Mount(layerFolders, uvm, SchemaV21()); err != nil {
+////		t.Fatalf("failed to mount container storage: %s", err)
+////	}
+
+////	// Create an identical second container and verify it works too.
+////	xenon2, err := CreateContainer(&CreateOptions{
+////		Id:            "container",
+////		Owner:         "unit-test",
+////		HostingSystem: uvm,
+////		SchemaVersion: SchemaV21(),
+////		Spec:          &specs.Spec{Windows: &specs.Windows{LayerFolders: layerFolders}},
+////		MountedLayers: mountedLayers,
+////	})
+////	if err != nil {
+////		t.Fatalf("CreateContainer failed: %s", err)
+////	}
+////	startContainer(t, xenon2)
+////	runCommand(t, xenon2, "cmd /s /c echo TestV2XenonWCOWAfterRemount", `c:\`, "TestV2XenonWCOWAfterRemount")
+////	stopContainer(t, xenon2)
+////	xenon2.Terminate()
+////}
+
+//// Lots of v2 WCOW containers in the same UVM, each with a single base layer. Containers aren't
+//// actually started, but it stresses the SCSI controller hot-add logic.
+//func TestV2XenonWCOWCreateLots(t *testing.T) {
+//	t.Skip("Skipping for now")
+//	uvm, uvmScratchDir := createv2WCOWUVM(t, layersNanoserver, "TestV2XenonWCOWCreateLots", nil)
+//	defer os.RemoveAll(uvmScratchDir)
+//	defer uvm.Terminate()
+
+//	// 63 as 0:0 is already taken as the UVMs scratch. So that leaves us with 64-1 left for container scratches on SCSI
+//	for i := 0; i < 63; i++ {
+//		containerScratchDir := createWCOWTempDirWithSandbox(t)
+//		defer os.RemoveAll(containerScratchDir)
+//		layerFolders := append(layersNanoserver, containerScratchDir)
+//		hostedContainer, err := CreateContainer(&CreateOptions{
+//			Id:            fmt.Sprintf("container%d", i),
+//			HostingSystem: uvm,
+//			SchemaVersion: schemaversion.SchemaV21(),
+//			Spec:          &specs.Spec{Windows: &specs.Windows{LayerFolders: layerFolders}},
+//		})
+//		if err != nil {
+//			t.Fatalf("CreateContainer failed: %s", err)
+//		}
+//		defer hostedContainer.Terminate()
+//		defer unmountContainerLayers(layerFolders, uvm, unmountOperationAll)
+//	}
+
+//	// TODO: Should check the internal structures here for VSMB and SCSI
+
+//	// TODO: Push it over 63 now and will get a failure.
+//}
+
+//// Helper for the v2 Xenon tests to create a utility VM. Returns the UtilityVM
+//// object; folder used as its scratch
+//func createv2WCOWUVM(t *testing.T, uvmLayers []string, uvmId string, resources *specs.WindowsResources) (*UtilityVM, string) {
+//	scratchDir := createTempDir(t)
+//	uvm := UtilityVM{
+//		OperatingSystem: "windows",
+//		LayerFolders:    append(uvmLayers, scratchDir),
+//		Resources:       resources,
+//	}
+//	if uvmId != "" {
+//		uvm.Id = uvmId
+//	}
+//	if err := uvm.Create(); err != nil {
+//		t.Fatalf("Failed create WCOW v2 UVM: %s", err)
+//	}
+//	if err := uvm.Start(); err != nil {
+//		t.Fatalf("Failed start WCOW v2UVM: %s", err)
+
+//	}
+//	return &uvm, scratchDir
+//}
+
+//// TestV2XenonWCOWMultiLayer creates a V2 Xenon having multiple image layers
+//func TestV2XenonWCOWMultiLayer(t *testing.T) {
+//	t.Skip("for now")
+
+//	uvmMemory := uint64(1 * 1024 * 1024 * 1024)
+//	uvmCPUCount := uint64(2)
+//	resources := &specs.WindowsResources{
+//		Memory: &specs.WindowsMemoryResources{
+//			Limit: &uvmMemory,
+//		},
+//		CPU: &specs.WindowsCPUResources{
+//			Count: &uvmCPUCount,
+//		},
+//	}
+//	uvm, uvmScratchDir := createv2WCOWUVM(t, layersNanoserver, "TestV2XenonWCOWMultiLayer_UVM", resources)
+//	defer os.RemoveAll(uvmScratchDir)
+//	defer uvm.Terminate()
+
+//	// Create a sandbox for the hosted container
+//	containerScratchDir := createWCOWTempDirWithSandbox(t)
+//	defer os.RemoveAll(containerScratchDir)
+
+//	// Create the container. Note that this will auto-mount for us.
+//	containerLayers := append(layersBusybox, containerScratchDir)
+//	xenon, err := CreateContainer(&CreateOptions{
+//		Id:            "container",
+//		HostingSystem: uvm,
+//		Spec:          &specs.Spec{Windows: &specs.Windows{LayerFolders: containerLayers}},
+//	})
+//	if err != nil {
+//		t.Fatalf("CreateContainer failed: %s", err)
+//	}
+
+//	// Start/stop the container
+//	startContainer(t, xenon)
+//	runCommand(t, xenon, "echo Container", `c:\`, "Container")
+//	stopContainer(t, xenon)
+//	xenon.Terminate()
+//	// TODO Move this to a defer function to fail if it fails.
+//	if err := unmountContainerLayers(containerLayers, uvm, unmountOperationAll); err != nil {
+//		t.Fatalf("unmount failed: %s", err)
+//	}
+
+//}
+
+//// TestV2XenonWCOWSingleMappedDirectory tests a V2 Xenon WCOW with a single mapped directory
+//func TestV2XenonWCOWSingleMappedDirectory(t *testing.T) {
+//	t.Skip("Skipping for now")
+//	uvm, uvmScratchDir := createv2WCOWUVM(t, layersNanoserver, "", nil)
+//	defer os.RemoveAll(uvmScratchDir)
+//	defer uvm.Terminate()
+
+//	// Create the container hosted inside the utility VM
+//	containerScratchDir := createWCOWTempDirWithSandbox(t)
+//	defer os.RemoveAll(containerScratchDir)
+//	layerFolders := append(layersNanoserver, containerScratchDir)
+
+//	// Create a temp folder containing foo.txt which will be used for the bind-mount test.
+//	source := createTempDir(t)
+//	defer os.RemoveAll(source)
+//	mount := specs.Mount{
+//		Source:      source,
+//		Destination: `c:\foo`,
+//	}
+//	f, err := os.OpenFile(filepath.Join(source, "foo.txt"), os.O_RDWR|os.O_CREATE, 0755)
+//	f.Close()
+
+//	hostedContainer, err := CreateContainer(&CreateOptions{
+//		HostingSystem: uvm,
+//		Spec: &specs.Spec{
+//			Windows: &specs.Windows{LayerFolders: layerFolders},
+//			Mounts:  []specs.Mount{mount},
+//		},
+//	})
+//	if err != nil {
+//		t.Fatalf("CreateContainer failed: %s", err)
+//	}
+//	defer unmountContainerLayers(layerFolders, uvm, unmountOperationAll)
+
+//	// TODO BUGBUG NEED TO UNMOUNT TO VSMB SHARE FOR THE CONTAINER
+
+//	// Start/stop the container
+//	startContainer(t, hostedContainer)
+//	runCommand(t, hostedContainer, `cmd /s /c dir /b c:\foo`, `c:\`, "foo.txt")
+//	stopContainer(t, hostedContainer)
+//	hostedContainer.Terminate()
+//}

vendor/github.com/Microsoft/hcsshim/internal/hns/hns.go

@@ -0,0 +1,23 @@
+package hns
+
+import "fmt"
+
+//go:generate go run ../../mksyscall_windows.go -output zsyscall_windows.go hns.go
+
+//sys _hnsCall(method string, path string, object string, response **uint16) (hr error) = vmcompute.HNSCall?
+
+type EndpointNotFoundError struct {
+	EndpointName string
+}
+
+func (e EndpointNotFoundError) Error() string {
+	return fmt.Sprintf("Endpoint %s not found", e.EndpointName)
+}
+
+type NetworkNotFoundError struct {
+	NetworkName string
+}
+
+func (e NetworkNotFoundError) Error() string {
+	return fmt.Sprintf("Network %s not found", e.NetworkName)
+}

vendor/github.com/Microsoft/hcsshim/internal/hns/hnsendpoint.go

@@ -0,0 +1,262 @@
+package hns
+
+import (
+	"encoding/json"
+	"net"
+
+	"github.com/sirupsen/logrus"
+)
+
+// HNSEndpoint represents a network endpoint in HNS
+type HNSEndpoint struct {
+	Id                 string            `json:"ID,omitempty"`
+	Name               string            `json:",omitempty"`
+	VirtualNetwork     string            `json:",omitempty"`
+	VirtualNetworkName string            `json:",omitempty"`
+	Policies           []json.RawMessage `json:",omitempty"`
+	MacAddress         string            `json:",omitempty"`
+	IPAddress          net.IP            `json:",omitempty"`
+	DNSSuffix          string            `json:",omitempty"`
+	DNSServerList      string            `json:",omitempty"`
+	GatewayAddress     string            `json:",omitempty"`
+	EnableInternalDNS  bool              `json:",omitempty"`
+	DisableICC         bool              `json:",omitempty"`
+	PrefixLength       uint8             `json:",omitempty"`
+	IsRemoteEndpoint   bool              `json:",omitempty"`
+	EnableLowMetric    bool              `json:",omitempty"`
+	Namespace          *Namespace        `json:",omitempty"`
+	EncapOverhead      uint16            `json:",omitempty"`
+}
+
+//SystemType represents the type of the system on which actions are done
+type SystemType string
+
+// SystemType const
+const (
+	ContainerType      SystemType = "Container"
+	VirtualMachineType SystemType = "VirtualMachine"
+	HostType           SystemType = "Host"
+)
+
+// EndpointAttachDetachRequest is the structure used to send request to the container to modify the system
+// Supported resource types are Network and Request Types are Add/Remove
+type EndpointAttachDetachRequest struct {
+	ContainerID    string     `json:"ContainerId,omitempty"`
+	SystemType     SystemType `json:"SystemType"`
+	CompartmentID  uint16     `json:"CompartmentId,omitempty"`
+	VirtualNICName string     `json:"VirtualNicName,omitempty"`
+}
+
+// EndpointResquestResponse is object to get the endpoint request response
+type EndpointResquestResponse struct {
+	Success bool
+	Error   string
+}
+
+// HNSEndpointRequest makes a HNS call to modify/query a network endpoint
+func HNSEndpointRequest(method, path, request string) (*HNSEndpoint, error) {
+	endpoint := &HNSEndpoint{}
+	err := hnsCall(method, "/endpoints/"+path, request, &endpoint)
+	if err != nil {
+		return nil, err
+	}
+
+	return endpoint, nil
+}
+
+// HNSListEndpointRequest makes a HNS call to query the list of available endpoints
+func HNSListEndpointRequest() ([]HNSEndpoint, error) {
+	var endpoint []HNSEndpoint
+	err := hnsCall("GET", "/endpoints/", "", &endpoint)
+	if err != nil {
+		return nil, err
+	}
+
+	return endpoint, nil
+}
+
+// GetHNSEndpointByID get the Endpoint by ID
+func GetHNSEndpointByID(endpointID string) (*HNSEndpoint, error) {
+	return HNSEndpointRequest("GET", endpointID, "")
+}
+
+// GetHNSEndpointByName gets the endpoint filtered by Name
+func GetHNSEndpointByName(endpointName string) (*HNSEndpoint, error) {
+	hnsResponse, err := HNSListEndpointRequest()
+	if err != nil {
+		return nil, err
+	}
+	for _, hnsEndpoint := range hnsResponse {
+		if hnsEndpoint.Name == endpointName {
+			return &hnsEndpoint, nil
+		}
+	}
+	return nil, EndpointNotFoundError{EndpointName: endpointName}
+}
+
+// Create Endpoint by sending EndpointRequest to HNS. TODO: Create a separate HNS interface to place all these methods
+func (endpoint *HNSEndpoint) Create() (*HNSEndpoint, error) {
+	operation := "Create"
+	title := "hcsshim::HNSEndpoint::" + operation
+	logrus.Debugf(title+" id=%s", endpoint.Id)
+
+	jsonString, err := json.Marshal(endpoint)
+	if err != nil {
+		return nil, err
+	}
+	return HNSEndpointRequest("POST", "", string(jsonString))
+}
+
+// Delete Endpoint by sending EndpointRequest to HNS
+func (endpoint *HNSEndpoint) Delete() (*HNSEndpoint, error) {
+	operation := "Delete"
+	title := "hcsshim::HNSEndpoint::" + operation
+	logrus.Debugf(title+" id=%s", endpoint.Id)
+
+	return HNSEndpointRequest("DELETE", endpoint.Id, "")
+}
+
+// Update Endpoint
+func (endpoint *HNSEndpoint) Update() (*HNSEndpoint, error) {
+	operation := "Update"
+	title := "hcsshim::HNSEndpoint::" + operation
+	logrus.Debugf(title+" id=%s", endpoint.Id)
+	jsonString, err := json.Marshal(endpoint)
+	if err != nil {
+		return nil, err
+	}
+	err = hnsCall("POST", "/endpoints/"+endpoint.Id, string(jsonString), &endpoint)
+
+	return endpoint, err
+}
+
+// ApplyACLPolicy applies a set of ACL Policies on the Endpoint
+func (endpoint *HNSEndpoint) ApplyACLPolicy(policies ...*ACLPolicy) error {
+	operation := "ApplyACLPolicy"
+	title := "hcsshim::HNSEndpoint::" + operation
+	logrus.Debugf(title+" id=%s", endpoint.Id)
+
+	for _, policy := range policies {
+		if policy == nil {
+			continue
+		}
+		jsonString, err := json.Marshal(policy)
+		if err != nil {
+			return err
+		}
+		endpoint.Policies = append(endpoint.Policies, jsonString)
+	}
+
+	_, err := endpoint.Update()
+	return err
+}
+
+// ContainerAttach attaches an endpoint to container
+func (endpoint *HNSEndpoint) ContainerAttach(containerID string, compartmentID uint16) error {
+	operation := "ContainerAttach"
+	title := "hcsshim::HNSEndpoint::" + operation
+	logrus.Debugf(title+" id=%s", endpoint.Id)
+
+	requestMessage := &EndpointAttachDetachRequest{
+		ContainerID:   containerID,
+		CompartmentID: compartmentID,
+		SystemType:    ContainerType,
+	}
+	response := &EndpointResquestResponse{}
+	jsonString, err := json.Marshal(requestMessage)
+	if err != nil {
+		return err
+	}
+	return hnsCall("POST", "/endpoints/"+endpoint.Id+"/attach", string(jsonString), &response)
+}
+
+// ContainerDetach detaches an endpoint from container
+func (endpoint *HNSEndpoint) ContainerDetach(containerID string) error {
+	operation := "ContainerDetach"
+	title := "hcsshim::HNSEndpoint::" + operation
+	logrus.Debugf(title+" id=%s", endpoint.Id)
+
+	requestMessage := &EndpointAttachDetachRequest{
+		ContainerID: containerID,
+		SystemType:  ContainerType,
+	}
+	response := &EndpointResquestResponse{}
+
+	jsonString, err := json.Marshal(requestMessage)
+	if err != nil {
+		return err
+	}
+	return hnsCall("POST", "/endpoints/"+endpoint.Id+"/detach", string(jsonString), &response)
+}
+
+// HostAttach attaches a nic on the host
+func (endpoint *HNSEndpoint) HostAttach(compartmentID uint16) error {
+	operation := "HostAttach"
+	title := "hcsshim::HNSEndpoint::" + operation
+	logrus.Debugf(title+" id=%s", endpoint.Id)
+	requestMessage := &EndpointAttachDetachRequest{
+		CompartmentID: compartmentID,
+		SystemType:    HostType,
+	}
+	response := &EndpointResquestResponse{}
+
+	jsonString, err := json.Marshal(requestMessage)
+	if err != nil {
+		return err
+	}
+	return hnsCall("POST", "/endpoints/"+endpoint.Id+"/attach", string(jsonString), &response)
+
+}
+
+// HostDetach detaches a nic on the host
+func (endpoint *HNSEndpoint) HostDetach() error {
+	operation := "HostDetach"
+	title := "hcsshim::HNSEndpoint::" + operation
+	logrus.Debugf(title+" id=%s", endpoint.Id)
+	requestMessage := &EndpointAttachDetachRequest{
+		SystemType: HostType,
+	}
+	response := &EndpointResquestResponse{}
+
+	jsonString, err := json.Marshal(requestMessage)
+	if err != nil {
+		return err
+	}
+	return hnsCall("POST", "/endpoints/"+endpoint.Id+"/detach", string(jsonString), &response)
+}
+
+// VirtualMachineNICAttach attaches a endpoint to a virtual machine
+func (endpoint *HNSEndpoint) VirtualMachineNICAttach(virtualMachineNICName string) error {
+	operation := "VirtualMachineNicAttach"
+	title := "hcsshim::HNSEndpoint::" + operation
+	logrus.Debugf(title+" id=%s", endpoint.Id)
+	requestMessage := &EndpointAttachDetachRequest{
+		VirtualNICName: virtualMachineNICName,
+		SystemType:     VirtualMachineType,
+	}
+	response := &EndpointResquestResponse{}
+
+	jsonString, err := json.Marshal(requestMessage)
+	if err != nil {
+		return err
+	}
+	return hnsCall("POST", "/endpoints/"+endpoint.Id+"/attach", string(jsonString), &response)
+}
+
+// VirtualMachineNICDetach detaches a endpoint  from a virtual machine
+func (endpoint *HNSEndpoint) VirtualMachineNICDetach() error {
+	operation := "VirtualMachineNicDetach"
+	title := "hcsshim::HNSEndpoint::" + operation
+	logrus.Debugf(title+" id=%s", endpoint.Id)
+
+	requestMessage := &EndpointAttachDetachRequest{
+		SystemType: VirtualMachineType,
+	}
+	response := &EndpointResquestResponse{}
+
+	jsonString, err := json.Marshal(requestMessage)
+	if err != nil {
+		return err
+	}
+	return hnsCall("POST", "/endpoints/"+endpoint.Id+"/detach", string(jsonString), &response)
+}

vendor/github.com/Microsoft/hcsshim/internal/hns/hnsfuncs.go

@@ -0,0 +1,42 @@
+package hns
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/Microsoft/hcsshim/internal/hcserror"
+	"github.com/Microsoft/hcsshim/internal/interop"
+	"github.com/sirupsen/logrus"
+)
+
+func hnsCall(method, path, request string, returnResponse interface{}) error {
+	var responseBuffer *uint16
+	logrus.Debugf("[%s]=>[%s] Request : %s", method, path, request)
+
+	err := _hnsCall(method, path, request, &responseBuffer)
+	if err != nil {
+		return hcserror.New(err, "hnsCall ", "")
+	}
+	response := interop.ConvertAndFreeCoTaskMemString(responseBuffer)
+
+	hnsresponse := &hnsResponse{}
+	if err = json.Unmarshal([]byte(response), &hnsresponse); err != nil {
+		return err
+	}
+
+	if !hnsresponse.Success {
+		return fmt.Errorf("HNS failed with error : %s", hnsresponse.Error)
+	}
+
+	if len(hnsresponse.Output) == 0 {
+		return nil
+	}
+
+	logrus.Debugf("Network Response : %s", hnsresponse.Output)
+	err = json.Unmarshal(hnsresponse.Output, returnResponse)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

vendor/github.com/Microsoft/hcsshim/internal/hns/hnsglobals.go

@@ -0,0 +1,28 @@
+package hns
+
+type HNSGlobals struct {
+	Version HNSVersion `json:"Version"`
+}
+
+type HNSVersion struct {
+	Major int `json:"Major"`
+	Minor int `json:"Minor"`
+}
+
+var (
+	HNSVersion1803 = HNSVersion{Major: 7, Minor: 2}
+)
+
+func GetHNSGlobals() (*HNSGlobals, error) {
+	var version HNSVersion
+	err := hnsCall("GET", "/globals/version", "", &version)
+	if err != nil {
+		return nil, err
+	}
+
+	globals := &HNSGlobals{
+		Version: version,
+	}
+
+	return globals, nil
+}

vendor/github.com/Microsoft/hcsshim/internal/hns/hnsnetwork.go

@@ -0,0 +1,141 @@
+package hns
+
+import (
+	"encoding/json"
+	"net"
+
+	"github.com/sirupsen/logrus"
+)
+
+// Subnet is assoicated with a network and represents a list
+// of subnets available to the network
+type Subnet struct {
+	AddressPrefix  string            `json:",omitempty"`
+	GatewayAddress string            `json:",omitempty"`
+	Policies       []json.RawMessage `json:",omitempty"`
+}
+
+// MacPool is assoicated with a network and represents a list
+// of macaddresses available to the network
+type MacPool struct {
+	StartMacAddress string `json:",omitempty"`
+	EndMacAddress   string `json:",omitempty"`
+}
+
+// HNSNetwork represents a network in HNS
+type HNSNetwork struct {
+	Id                   string            `json:"ID,omitempty"`
+	Name                 string            `json:",omitempty"`
+	Type                 string            `json:",omitempty"`
+	NetworkAdapterName   string            `json:",omitempty"`
+	SourceMac            string            `json:",omitempty"`
+	Policies             []json.RawMessage `json:",omitempty"`
+	MacPools             []MacPool         `json:",omitempty"`
+	Subnets              []Subnet          `json:",omitempty"`
+	DNSSuffix            string            `json:",omitempty"`
+	DNSServerList        string            `json:",omitempty"`
+	DNSServerCompartment uint32            `json:",omitempty"`
+	ManagementIP         string            `json:",omitempty"`
+	AutomaticDNS         bool              `json:",omitempty"`
+}
+
+type hnsNetworkResponse struct {
+	Success bool
+	Error   string
+	Output  HNSNetwork
+}
+
+type hnsResponse struct {
+	Success bool
+	Error   string
+	Output  json.RawMessage
+}
+
+// HNSNetworkRequest makes a call into HNS to update/query a single network
+func HNSNetworkRequest(method, path, request string) (*HNSNetwork, error) {
+	var network HNSNetwork
+	err := hnsCall(method, "/networks/"+path, request, &network)
+	if err != nil {
+		return nil, err
+	}
+
+	return &network, nil
+}
+
+// HNSListNetworkRequest makes a HNS call to query the list of available networks
+func HNSListNetworkRequest(method, path, request string) ([]HNSNetwork, error) {
+	var network []HNSNetwork
+	err := hnsCall(method, "/networks/"+path, request, &network)
+	if err != nil {
+		return nil, err
+	}
+
+	return network, nil
+}
+
+// GetHNSNetworkByID
+func GetHNSNetworkByID(networkID string) (*HNSNetwork, error) {
+	return HNSNetworkRequest("GET", networkID, "")
+}
+
+// GetHNSNetworkName filtered by Name
+func GetHNSNetworkByName(networkName string) (*HNSNetwork, error) {
+	hsnnetworks, err := HNSListNetworkRequest("GET", "", "")
+	if err != nil {
+		return nil, err
+	}
+	for _, hnsnetwork := range hsnnetworks {
+		if hnsnetwork.Name == networkName {
+			return &hnsnetwork, nil
+		}
+	}
+	return nil, NetworkNotFoundError{NetworkName: networkName}
+}
+
+// Create Network by sending NetworkRequest to HNS.
+func (network *HNSNetwork) Create() (*HNSNetwork, error) {
+	operation := "Create"
+	title := "hcsshim::HNSNetwork::" + operation
+	logrus.Debugf(title+" id=%s", network.Id)
+
+	jsonString, err := json.Marshal(network)
+	if err != nil {
+		return nil, err
+	}
+	return HNSNetworkRequest("POST", "", string(jsonString))
+}
+
+// Delete Network by sending NetworkRequest to HNS
+func (network *HNSNetwork) Delete() (*HNSNetwork, error) {
+	operation := "Delete"
+	title := "hcsshim::HNSNetwork::" + operation
+	logrus.Debugf(title+" id=%s", network.Id)
+
+	return HNSNetworkRequest("DELETE", network.Id, "")
+}
+
+// Creates an endpoint on the Network.
+func (network *HNSNetwork) NewEndpoint(ipAddress net.IP, macAddress net.HardwareAddr) *HNSEndpoint {
+	return &HNSEndpoint{
+		VirtualNetwork: network.Id,
+		IPAddress:      ipAddress,
+		MacAddress:     string(macAddress),
+	}
+}
+
+func (network *HNSNetwork) CreateEndpoint(endpoint *HNSEndpoint) (*HNSEndpoint, error) {
+	operation := "CreateEndpoint"
+	title := "hcsshim::HNSNetwork::" + operation
+	logrus.Debugf(title+" id=%s, endpointId=%s", network.Id, endpoint.Id)
+
+	endpoint.VirtualNetwork = network.Id
+	return endpoint.Create()
+}
+
+func (network *HNSNetwork) CreateRemoteEndpoint(endpoint *HNSEndpoint) (*HNSEndpoint, error) {
+	operation := "CreateRemoteEndpoint"
+	title := "hcsshim::HNSNetwork::" + operation
+	logrus.Debugf(title+" id=%s", network.Id)
+	endpoint.IsRemoteEndpoint = true
+	return network.CreateEndpoint(endpoint)
+}

vendor/github.com/Microsoft/hcsshim/internal/hns/hnspolicy.go

@@ -0,0 +1,98 @@
+package hns
+
+// Type of Request Support in ModifySystem
+type PolicyType string
+
+// RequestType const
+const (
+	Nat                  PolicyType = "NAT"
+	ACL                  PolicyType = "ACL"
+	PA                   PolicyType = "PA"
+	VLAN                 PolicyType = "VLAN"
+	VSID                 PolicyType = "VSID"
+	VNet                 PolicyType = "VNET"
+	L2Driver             PolicyType = "L2Driver"
+	Isolation            PolicyType = "Isolation"
+	QOS                  PolicyType = "QOS"
+	OutboundNat          PolicyType = "OutBoundNAT"
+	ExternalLoadBalancer PolicyType = "ELB"
+	Route                PolicyType = "ROUTE"
+)
+
+type NatPolicy struct {
+	Type         PolicyType `json:"Type"`
+	Protocol     string
+	InternalPort uint16
+	ExternalPort uint16
+}
+
+type QosPolicy struct {
+	Type                            PolicyType `json:"Type"`
+	MaximumOutgoingBandwidthInBytes uint64
+}
+
+type IsolationPolicy struct {
+	Type               PolicyType `json:"Type"`
+	VLAN               uint
+	VSID               uint
+	InDefaultIsolation bool
+}
+
+type VlanPolicy struct {
+	Type PolicyType `json:"Type"`
+	VLAN uint
+}
+
+type VsidPolicy struct {
+	Type PolicyType `json:"Type"`
+	VSID uint
+}
+
+type PaPolicy struct {
+	Type PolicyType `json:"Type"`
+	PA   string     `json:"PA"`
+}
+
+type OutboundNatPolicy struct {
+	Policy
+	VIP        string   `json:"VIP,omitempty"`
+	Exceptions []string `json:"ExceptionList,omitempty"`
+}
+
+type ActionType string
+type DirectionType string
+type RuleType string
+
+const (
+	Allow ActionType = "Allow"
+	Block ActionType = "Block"
+
+	In  DirectionType = "In"
+	Out DirectionType = "Out"
+
+	Host   RuleType = "Host"
+	Switch RuleType = "Switch"
+)
+
+type ACLPolicy struct {
+	Type            PolicyType `json:"Type"`
+	Id              string     `json:"Id,omitempty"`
+	Protocol        uint16
+	Protocols       string `json:"Protocols,omitempty"`
+	InternalPort    uint16
+	Action          ActionType
+	Direction       DirectionType
+	LocalAddresses  string
+	RemoteAddresses string
+	LocalPorts      string `json:"LocalPorts,omitempty"`
+	LocalPort       uint16
+	RemotePorts     string `json:"RemotePorts,omitempty"`
+	RemotePort      uint16
+	RuleType        RuleType `json:"RuleType,omitempty"`
+	Priority        uint16
+	ServiceName     string
+}
+
+type Policy struct {
+	Type PolicyType `json:"Type"`
+}

vendor/github.com/Microsoft/hcsshim/internal/hns/hnspolicylist.go

@@ -0,0 +1,201 @@
+package hns
+
+import (
+	"encoding/json"
+
+	"github.com/sirupsen/logrus"
+)
+
+// RoutePolicy is a structure defining schema for Route based Policy
+type RoutePolicy struct {
+	Policy
+	DestinationPrefix string `json:"DestinationPrefix,omitempty"`
+	NextHop           string `json:"NextHop,omitempty"`
+	EncapEnabled      bool   `json:"NeedEncap,omitempty"`
+}
+
+// ELBPolicy is a structure defining schema for ELB LoadBalancing based Policy
+type ELBPolicy struct {
+	LBPolicy
+	SourceVIP string   `json:"SourceVIP,omitempty"`
+	VIPs      []string `json:"VIPs,omitempty"`
+	ILB       bool     `json:"ILB,omitempty"`
+	DSR       bool     `json:"IsDSR,omitempty"`
+}
+
+// LBPolicy is a structure defining schema for LoadBalancing based Policy
+type LBPolicy struct {
+	Policy
+	Protocol     uint16 `json:"Protocol,omitempty"`
+	InternalPort uint16
+	ExternalPort uint16
+}
+
+// PolicyList is a structure defining schema for Policy list request
+type PolicyList struct {
+	ID                 string            `json:"ID,omitempty"`
+	EndpointReferences []string          `json:"References,omitempty"`
+	Policies           []json.RawMessage `json:"Policies,omitempty"`
+}
+
+// HNSPolicyListRequest makes a call into HNS to update/query a single network
+func HNSPolicyListRequest(method, path, request string) (*PolicyList, error) {
+	var policy PolicyList
+	err := hnsCall(method, "/policylists/"+path, request, &policy)
+	if err != nil {
+		return nil, err
+	}
+
+	return &policy, nil
+}
+
+// HNSListPolicyListRequest gets all the policy list
+func HNSListPolicyListRequest() ([]PolicyList, error) {
+	var plist []PolicyList
+	err := hnsCall("GET", "/policylists/", "", &plist)
+	if err != nil {
+		return nil, err
+	}
+
+	return plist, nil
+}
+
+// PolicyListRequest makes a HNS call to modify/query a network policy list
+func PolicyListRequest(method, path, request string) (*PolicyList, error) {
+	policylist := &PolicyList{}
+	err := hnsCall(method, "/policylists/"+path, request, &policylist)
+	if err != nil {
+		return nil, err
+	}
+
+	return policylist, nil
+}
+
+// GetPolicyListByID get the policy list by ID
+func GetPolicyListByID(policyListID string) (*PolicyList, error) {
+	return PolicyListRequest("GET", policyListID, "")
+}
+
+// Create PolicyList by sending PolicyListRequest to HNS.
+func (policylist *PolicyList) Create() (*PolicyList, error) {
+	operation := "Create"
+	title := "hcsshim::PolicyList::" + operation
+	logrus.Debugf(title+" id=%s", policylist.ID)
+	jsonString, err := json.Marshal(policylist)
+	if err != nil {
+		return nil, err
+	}
+	return PolicyListRequest("POST", "", string(jsonString))
+}
+
+// Delete deletes PolicyList
+func (policylist *PolicyList) Delete() (*PolicyList, error) {
+	operation := "Delete"
+	title := "hcsshim::PolicyList::" + operation
+	logrus.Debugf(title+" id=%s", policylist.ID)
+
+	return PolicyListRequest("DELETE", policylist.ID, "")
+}
+
+// AddEndpoint add an endpoint to a Policy List
+func (policylist *PolicyList) AddEndpoint(endpoint *HNSEndpoint) (*PolicyList, error) {
+	operation := "AddEndpoint"
+	title := "hcsshim::PolicyList::" + operation
+	logrus.Debugf(title+" id=%s, endpointId:%s", policylist.ID, endpoint.Id)
+
+	_, err := policylist.Delete()
+	if err != nil {
+		return nil, err
+	}
+
+	// Add Endpoint to the Existing List
+	policylist.EndpointReferences = append(policylist.EndpointReferences, "/endpoints/"+endpoint.Id)
+
+	return policylist.Create()
+}
+
+// RemoveEndpoint removes an endpoint from the Policy List
+func (policylist *PolicyList) RemoveEndpoint(endpoint *HNSEndpoint) (*PolicyList, error) {
+	operation := "RemoveEndpoint"
+	title := "hcsshim::PolicyList::" + operation
+	logrus.Debugf(title+" id=%s, endpointId:%s", policylist.ID, endpoint.Id)
+
+	_, err := policylist.Delete()
+	if err != nil {
+		return nil, err
+	}
+
+	elementToRemove := "/endpoints/" + endpoint.Id
+
+	var references []string
+
+	for _, endpointReference := range policylist.EndpointReferences {
+		if endpointReference == elementToRemove {
+			continue
+		}
+		references = append(references, endpointReference)
+	}
+	policylist.EndpointReferences = references
+	return policylist.Create()
+}
+
+// AddLoadBalancer policy list for the specified endpoints
+func AddLoadBalancer(endpoints []HNSEndpoint, isILB bool, sourceVIP, vip string, protocol uint16, internalPort uint16, externalPort uint16) (*PolicyList, error) {
+	operation := "AddLoadBalancer"
+	title := "hcsshim::PolicyList::" + operation
+	logrus.Debugf(title+" endpointId=%v, isILB=%v, sourceVIP=%s, vip=%s, protocol=%v, internalPort=%v, externalPort=%v", endpoints, isILB, sourceVIP, vip, protocol, internalPort, externalPort)
+
+	policylist := &PolicyList{}
+
+	elbPolicy := &ELBPolicy{
+		SourceVIP: sourceVIP,
+		ILB:       isILB,
+	}
+
+	if len(vip) > 0 {
+		elbPolicy.VIPs = []string{vip}
+	}
+	elbPolicy.Type = ExternalLoadBalancer
+	elbPolicy.Protocol = protocol
+	elbPolicy.InternalPort = internalPort
+	elbPolicy.ExternalPort = externalPort
+
+	for _, endpoint := range endpoints {
+		policylist.EndpointReferences = append(policylist.EndpointReferences, "/endpoints/"+endpoint.Id)
+	}
+
+	jsonString, err := json.Marshal(elbPolicy)
+	if err != nil {
+		return nil, err
+	}
+	policylist.Policies = append(policylist.Policies, jsonString)
+	return policylist.Create()
+}
+
+// AddRoute adds route policy list for the specified endpoints
+func AddRoute(endpoints []HNSEndpoint, destinationPrefix string, nextHop string, encapEnabled bool) (*PolicyList, error) {
+	operation := "AddRoute"
+	title := "hcsshim::PolicyList::" + operation
+	logrus.Debugf(title+" destinationPrefix:%s", destinationPrefix)
+
+	policylist := &PolicyList{}
+
+	rPolicy := &RoutePolicy{
+		DestinationPrefix: destinationPrefix,
+		NextHop:           nextHop,
+		EncapEnabled:      encapEnabled,
+	}
+	rPolicy.Type = Route
+
+	for _, endpoint := range endpoints {
+		policylist.EndpointReferences = append(policylist.EndpointReferences, "/endpoints/"+endpoint.Id)
+	}
+
+	jsonString, err := json.Marshal(rPolicy)
+	if err != nil {
+		return nil, err
+	}
+
+	policylist.Policies = append(policylist.Policies, jsonString)
+	return policylist.Create()
+}

vendor/github.com/Microsoft/hcsshim/internal/hns/hnssupport.go

@@ -0,0 +1,49 @@
+package hns
+
+import (
+	"github.com/sirupsen/logrus"
+)
+
+type HNSSupportedFeatures struct {
+	Acl HNSAclFeatures `json:"ACL"`
+}
+
+type HNSAclFeatures struct {
+	AclAddressLists       bool `json:"AclAddressLists"`
+	AclNoHostRulePriority bool `json:"AclHostRulePriority"`
+	AclPortRanges         bool `json:"AclPortRanges"`
+	AclRuleId             bool `json:"AclRuleId"`
+}
+
+func GetHNSSupportedFeatures() HNSSupportedFeatures {
+	var hnsFeatures HNSSupportedFeatures
+
+	globals, err := GetHNSGlobals()
+	if err != nil {
+		// Expected on pre-1803 builds, all features will be false/unsupported
+		logrus.Debugf("Unable to obtain HNS globals: %s", err)
+		return hnsFeatures
+	}
+
+	hnsFeatures.Acl = HNSAclFeatures{
+		AclAddressLists:       isHNSFeatureSupported(globals.Version, HNSVersion1803),
+		AclNoHostRulePriority: isHNSFeatureSupported(globals.Version, HNSVersion1803),
+		AclPortRanges:         isHNSFeatureSupported(globals.Version, HNSVersion1803),
+		AclRuleId:             isHNSFeatureSupported(globals.Version, HNSVersion1803),
+	}
+
+	return hnsFeatures
+}
+
+func isHNSFeatureSupported(currentVersion HNSVersion, minVersionSupported HNSVersion) bool {
+	if currentVersion.Major < minVersionSupported.Major {
+		return false
+	}
+	if currentVersion.Major > minVersionSupported.Major {
+		return true
+	}
+	if currentVersion.Minor < minVersionSupported.Minor {
+		return false
+	}
+	return true
+}

vendor/github.com/Microsoft/hcsshim/internal/hns/namespace.go

@@ -0,0 +1,110 @@
+package hns
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path"
+	"strings"
+)
+
+type namespaceRequest struct {
+	IsDefault bool `json:",omitempty"`
+}
+
+type namespaceEndpointRequest struct {
+	ID string `json:"Id"`
+}
+
+type NamespaceResource struct {
+	Type string
+	Data json.RawMessage
+}
+
+type namespaceResourceRequest struct {
+	Type string
+	Data interface{}
+}
+
+type Namespace struct {
+	ID           string
+	IsDefault    bool                `json:",omitempty"`
+	ResourceList []NamespaceResource `json:",omitempty"`
+}
+
+func issueNamespaceRequest(id *string, method, subpath string, request interface{}) (*Namespace, error) {
+	var err error
+	hnspath := "/namespaces/"
+	if id != nil {
+		hnspath = path.Join(hnspath, *id)
+	}
+	if subpath != "" {
+		hnspath = path.Join(hnspath, subpath)
+	}
+	var reqJSON []byte
+	if request != nil {
+		if reqJSON, err = json.Marshal(request); err != nil {
+			return nil, err
+		}
+	}
+	var ns Namespace
+	err = hnsCall(method, hnspath, string(reqJSON), &ns)
+	if err != nil {
+		if strings.Contains(err.Error(), "Element not found.") {
+			return nil, os.ErrNotExist
+		}
+		return nil, fmt.Errorf("%s %s: %s", method, hnspath, err)
+	}
+	return &ns, err
+}
+
+func CreateNamespace() (string, error) {
+	req := namespaceRequest{}
+	ns, err := issueNamespaceRequest(nil, "POST", "", &req)
+	if err != nil {
+		return "", err
+	}
+	return ns.ID, nil
+}
+
+func RemoveNamespace(id string) error {
+	_, err := issueNamespaceRequest(&id, "DELETE", "", nil)
+	return err
+}
+
+func GetNamespaceEndpoints(id string) ([]string, error) {
+	ns, err := issueNamespaceRequest(&id, "GET", "", nil)
+	if err != nil {
+		return nil, err
+	}
+	var endpoints []string
+	for _, rsrc := range ns.ResourceList {
+		if rsrc.Type == "Endpoint" {
+			var endpoint namespaceEndpointRequest
+			err = json.Unmarshal(rsrc.Data, &endpoint)
+			if err != nil {
+				return nil, fmt.Errorf("unmarshal endpoint: %s", err)
+			}
+			endpoints = append(endpoints, endpoint.ID)
+		}
+	}
+	return endpoints, nil
+}
+
+func AddNamespaceEndpoint(id string, endpointID string) error {
+	resource := namespaceResourceRequest{
+		Type: "Endpoint",
+		Data: namespaceEndpointRequest{endpointID},
+	}
+	_, err := issueNamespaceRequest(&id, "POST", "addresource", &resource)
+	return err
+}
+
+func RemoveNamespaceEndpoint(id string, endpointID string) error {
+	resource := namespaceResourceRequest{
+		Type: "Endpoint",
+		Data: namespaceEndpointRequest{endpointID},
+	}
+	_, err := issueNamespaceRequest(&id, "POST", "removeresource", &resource)
+	return err
+}

vendor/github.com/Microsoft/hcsshim/internal/hns/zsyscall_windows.go

@@ -0,0 +1,76 @@
+// Code generated mksyscall_windows.exe DO NOT EDIT
+
+package hns
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+var _ unsafe.Pointer
+
+// Do the interface allocations only once for common
+// Errno values.
+const (
+	errnoERROR_IO_PENDING = 997
+)
+
+var (
+	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
+)
+
+// errnoErr returns common boxed Errno values, to prevent
+// allocations at runtime.
+func errnoErr(e syscall.Errno) error {
+	switch e {
+	case 0:
+		return nil
+	case errnoERROR_IO_PENDING:
+		return errERROR_IO_PENDING
+	}
+	// TODO: add more here, after collecting data on the common
+	// error values see on Windows. (perhaps when running
+	// all.bat?)
+	return e
+}
+
+var (
+	modvmcompute = windows.NewLazySystemDLL("vmcompute.dll")
+
+	procHNSCall = modvmcompute.NewProc("HNSCall")
+)
+
+func _hnsCall(method string, path string, object string, response **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(method)
+	if hr != nil {
+		return
+	}
+	var _p1 *uint16
+	_p1, hr = syscall.UTF16PtrFromString(path)
+	if hr != nil {
+		return
+	}
+	var _p2 *uint16
+	_p2, hr = syscall.UTF16PtrFromString(object)
+	if hr != nil {
+		return
+	}
+	return __hnsCall(_p0, _p1, _p2, response)
+}
+
+func __hnsCall(method *uint16, path *uint16, object *uint16, response **uint16) (hr error) {
+	if hr = procHNSCall.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHNSCall.Addr(), 4, uintptr(unsafe.Pointer(method)), uintptr(unsafe.Pointer(path)), uintptr(unsafe.Pointer(object)), uintptr(unsafe.Pointer(response)), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}

vendor/github.com/Microsoft/hcsshim/internal/interop/interop.go

@@ -0,0 +1,27 @@
+package interop
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+//go:generate go run ../../mksyscall_windows.go -output zsyscall_windows.go interop.go
+
+//sys coTaskMemFree(buffer unsafe.Pointer) = api_ms_win_core_com_l1_1_0.CoTaskMemFree
+
+func ConvertAndFreeCoTaskMemString(buffer *uint16) string {
+	str := syscall.UTF16ToString((*[1 << 29]uint16)(unsafe.Pointer(buffer))[:])
+	coTaskMemFree(unsafe.Pointer(buffer))
+	return str
+}
+
+func ConvertAndFreeCoTaskMemBytes(buffer *uint16) []byte {
+	return []byte(ConvertAndFreeCoTaskMemString(buffer))
+}
+
+func Win32FromHresult(hr uintptr) syscall.Errno {
+	if hr&0x1fff0000 == 0x00070000 {
+		return syscall.Errno(hr & 0xffff)
+	}
+	return syscall.Errno(hr)
+}

vendor/github.com/Microsoft/hcsshim/internal/interop/zsyscall_windows.go

@@ -0,0 +1,48 @@
+// Code generated mksyscall_windows.exe DO NOT EDIT
+
+package interop
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+var _ unsafe.Pointer
+
+// Do the interface allocations only once for common
+// Errno values.
+const (
+	errnoERROR_IO_PENDING = 997
+)
+
+var (
+	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
+)
+
+// errnoErr returns common boxed Errno values, to prevent
+// allocations at runtime.
+func errnoErr(e syscall.Errno) error {
+	switch e {
+	case 0:
+		return nil
+	case errnoERROR_IO_PENDING:
+		return errERROR_IO_PENDING
+	}
+	// TODO: add more here, after collecting data on the common
+	// error values see on Windows. (perhaps when running
+	// all.bat?)
+	return e
+}
+
+var (
+	modapi_ms_win_core_com_l1_1_0 = windows.NewLazySystemDLL("api-ms-win-core-com-l1-1-0.dll")
+
+	procCoTaskMemFree = modapi_ms_win_core_com_l1_1_0.NewProc("CoTaskMemFree")
+)
+
+func coTaskMemFree(buffer unsafe.Pointer) {
+	syscall.Syscall(procCoTaskMemFree.Addr(), 1, uintptr(buffer), 0, 0)
+	return
+}

vendor/github.com/Microsoft/hcsshim/internal/lcow/constants.go

@@ -0,0 +1,9 @@
+package lcow
+
+const (
+	// DefaultScratchSizeGB is the size of the default LCOW scratch disk in GB
+	DefaultScratchSizeGB = 20
+
+	// defaultVhdxBlockSizeMB is the block-size for the scratch VHDx's this package can create.
+	defaultVhdxBlockSizeMB = 1
+)

vendor/github.com/Microsoft/hcsshim/internal/lcow/debug.go

@@ -0,0 +1,55 @@
+package lcow
+
+//func debugCommand(s string) string {
+//	return fmt.Sprintf(`echo -e 'DEBUG COMMAND: %s\\n--------------\\n';%s;echo -e '\\n\\n';`, s, s)
+//}
+
+// DebugLCOWGCS extracts logs from the GCS in LCOW. It's a useful hack for debugging,
+// but not necessarily optimal, but all that is available to us in RS3.
+//func (container *container) DebugLCOWGCS() {
+//	if logrus.GetLevel() < logrus.DebugLevel || len(os.Getenv("HCSSHIM_LCOW_DEBUG_ENABLE")) == 0 {
+//		return
+//	}
+
+//	var out bytes.Buffer
+//	cmd := os.Getenv("HCSSHIM_LCOW_DEBUG_COMMAND")
+//	if cmd == "" {
+//		cmd = `sh -c "`
+//		cmd += debugCommand("kill -10 `pidof gcs`") // SIGUSR1 for stackdump
+//		cmd += debugCommand("ls -l /tmp")
+//		cmd += debugCommand("cat /tmp/gcs.log")
+//		cmd += debugCommand("cat /tmp/gcs/gcs-stacks*")
+//		cmd += debugCommand("cat /tmp/gcs/paniclog*")
+//		cmd += debugCommand("ls -l /tmp/gcs")
+//		cmd += debugCommand("ls -l /tmp/gcs/*")
+//		cmd += debugCommand("cat /tmp/gcs/*/config.json")
+//		cmd += debugCommand("ls -lR /var/run/gcsrunc")
+//		cmd += debugCommand("cat /tmp/gcs/global-runc.log")
+//		cmd += debugCommand("cat /tmp/gcs/*/runc.log")
+//		cmd += debugCommand("ps -ef")
+//		cmd += `"`
+//	}
+
+//	proc, _, err := container.CreateProcessEx(
+//		&CreateProcessEx{
+//			OCISpecification: &specs.Spec{
+//				Process: &specs.Process{Args: []string{cmd}},
+//				Linux:   &specs.Linux{},
+//			},
+//			CreateInUtilityVm: true,
+//			Stdout:            &out,
+//		})
+//	defer func() {
+//		if proc != nil {
+//			proc.Kill()
+//			proc.Close()
+//		}
+//	}()
+//	if err != nil {
+//		logrus.Debugln("benign failure getting gcs logs: ", err)
+//	}
+//	if proc != nil {
+//		proc.WaitTimeout(time.Duration(int(time.Second) * 30))
+//	}
+//	logrus.Debugf("GCS Debugging:\n%s\n\nEnd GCS Debugging", strings.TrimSpace(out.String()))
+//}

vendor/github.com/Microsoft/hcsshim/internal/lcow/process.go

@@ -0,0 +1,161 @@
+package lcow
+
+import (
+	"fmt"
+	"io"
+	"strings"
+	"time"
+
+	"github.com/Microsoft/hcsshim/internal/copywithtimeout"
+	"github.com/Microsoft/hcsshim/internal/hcs"
+	"github.com/Microsoft/hcsshim/internal/schema2"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/sirupsen/logrus"
+)
+
+// ByteCounts are the number of bytes copied to/from standard handles. Note
+// this is int64 rather than uint64 to match the golang io.Copy() signature.
+type ByteCounts struct {
+	In  int64
+	Out int64
+	Err int64
+}
+
+// ProcessOptions are the set of options which are passed to CreateProcessEx() to
+// create a utility vm.
+type ProcessOptions struct {
+	HCSSystem         *hcs.System
+	Process           *specs.Process
+	Stdin             io.Reader     // Optional reader for sending on to the processes stdin stream
+	Stdout            io.Writer     // Optional writer for returning the processes stdout stream
+	Stderr            io.Writer     // Optional writer for returning the processes stderr stream
+	CopyTimeout       time.Duration // Timeout for the copy
+	CreateInUtilityVm bool          // If the compute system is a utility VM
+	ByteCounts        ByteCounts    // How much data to copy on each stream if they are supplied. 0 means to io.EOF.
+}
+
+// CreateProcess creates a process either in an LCOW utility VM, or for starting
+// the init process. TODO: Potentially extend for exec'd processes.
+//
+// It's essentially a glorified wrapper around hcs.ComputeSystem CreateProcess used
+// for internal purposes.
+//
+// This is used on LCOW to run processes for remote filesystem commands, utilities,
+// and debugging.
+//
+// It optional performs IO copies with timeout between the pipes provided as input,
+// and the pipes in the process.
+//
+// In the ProcessOptions structure, if byte-counts are non-zero, a maximum of those
+// bytes are copied to the appropriate standard IO reader/writer. When zero,
+// it copies until EOF. It also returns byte-counts indicating how much data
+// was sent/received from the process.
+//
+// It is the responsibility of the caller to call Close() on the process returned.
+
+func CreateProcess(opts *ProcessOptions) (*hcs.Process, *ByteCounts, error) {
+
+	var environment = make(map[string]string)
+	copiedByteCounts := &ByteCounts{}
+
+	if opts == nil {
+		return nil, nil, fmt.Errorf("no options supplied")
+	}
+
+	if opts.HCSSystem == nil {
+		return nil, nil, fmt.Errorf("no HCS system supplied")
+	}
+
+	if opts.CreateInUtilityVm && opts.Process == nil {
+		return nil, nil, fmt.Errorf("process must be supplied for UVM process")
+	}
+
+	// Don't pass a process in if this is an LCOW container. This will start the init process.
+	if opts.Process != nil {
+		for _, v := range opts.Process.Env {
+			s := strings.SplitN(v, "=", 2)
+			if len(s) == 2 && len(s[1]) > 0 {
+				environment[s[0]] = s[1]
+			}
+		}
+		if _, ok := environment["PATH"]; !ok {
+			environment["PATH"] = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:"
+		}
+	}
+
+	processConfig := &ProcessParameters{
+		ProcessParameters: hcsschema.ProcessParameters{
+			CreateStdInPipe:  (opts.Stdin != nil),
+			CreateStdOutPipe: (opts.Stdout != nil),
+			CreateStdErrPipe: (opts.Stderr != nil),
+			EmulateConsole:   false,
+		},
+		CreateInUtilityVm: opts.CreateInUtilityVm,
+	}
+
+	if opts.Process != nil {
+		processConfig.Environment = environment
+		processConfig.CommandLine = strings.Join(opts.Process.Args, " ")
+		processConfig.WorkingDirectory = opts.Process.Cwd
+		if processConfig.WorkingDirectory == "" {
+			processConfig.WorkingDirectory = `/`
+		}
+	}
+
+	proc, err := opts.HCSSystem.CreateProcess(processConfig)
+	if err != nil {
+		logrus.Debugf("failed to create process: %s", err)
+		return nil, nil, err
+	}
+
+	processStdin, processStdout, processStderr, err := proc.Stdio()
+	if err != nil {
+		proc.Kill() // Should this have a timeout?
+		proc.Close()
+		return nil, nil, fmt.Errorf("failed to get stdio pipes for process %+v: %s", processConfig, err)
+	}
+
+	// Send the data into the process's stdin
+	if opts.Stdin != nil {
+		if copiedByteCounts.In, err = copywithtimeout.Copy(processStdin,
+			opts.Stdin,
+			opts.ByteCounts.In,
+			"stdin",
+			opts.CopyTimeout); err != nil {
+			return nil, nil, err
+		}
+
+		// Don't need stdin now we've sent everything. This signals GCS that we are finished sending data.
+		if err := proc.CloseStdin(); err != nil && !hcs.IsNotExist(err) && !hcs.IsAlreadyClosed(err) {
+			// This error will occur if the compute system is currently shutting down
+			if perr, ok := err.(*hcs.ProcessError); ok && perr.Err != hcs.ErrVmcomputeOperationInvalidState {
+				return nil, nil, err
+			}
+		}
+	}
+
+	// Copy the data back from stdout
+	if opts.Stdout != nil {
+		// Copy the data over to the writer.
+		if copiedByteCounts.Out, err = copywithtimeout.Copy(opts.Stdout,
+			processStdout,
+			opts.ByteCounts.Out,
+			"stdout",
+			opts.CopyTimeout); err != nil {
+			return nil, nil, err
+		}
+	}
+
+	// Copy the data back from stderr
+	if opts.Stderr != nil {
+		// Copy the data over to the writer.
+		if copiedByteCounts.Err, err = copywithtimeout.Copy(opts.Stderr,
+			processStderr,
+			opts.ByteCounts.Err,
+			"stderr",
+			opts.CopyTimeout); err != nil {
+			return nil, nil, err
+		}
+	}
+	return proc, copiedByteCounts, nil
+}

vendor/github.com/Microsoft/hcsshim/internal/lcow/scratch.go

@@ -0,0 +1,168 @@
+package lcow
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/Microsoft/go-winio/vhd"
+	"github.com/Microsoft/hcsshim/internal/copyfile"
+	"github.com/Microsoft/hcsshim/internal/timeout"
+	"github.com/Microsoft/hcsshim/internal/uvm"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/sirupsen/logrus"
+)
+
+// CreateScratch uses a utility VM to create an empty scratch disk of a requested size.
+// It has a caching capability. If the cacheFile exists, and the request is for a default
+// size, a copy of that is made to the target. If the size is non-default, or the cache file
+// does not exist, it uses a utility VM to create target. It is the responsibility of the
+// caller to synchronise simultaneous attempts to create the cache file.
+func CreateScratch(lcowUVM *uvm.UtilityVM, destFile string, sizeGB uint32, cacheFile string, vmID string) error {
+
+	if lcowUVM == nil {
+		return fmt.Errorf("no uvm")
+	}
+
+	if lcowUVM.OS() != "linux" {
+		return fmt.Errorf("CreateLCOWScratch requires a linux utility VM to operate!")
+	}
+
+	// Smallest we can accept is the default scratch size as we can't size down, only expand.
+	if sizeGB < DefaultScratchSizeGB {
+		sizeGB = DefaultScratchSizeGB
+	}
+
+	logrus.Debugf("hcsshim::CreateLCOWScratch: Dest:%s size:%dGB cache:%s", destFile, sizeGB, cacheFile)
+
+	// Retrieve from cache if the default size and already on disk
+	if cacheFile != "" && sizeGB == DefaultScratchSizeGB {
+		if _, err := os.Stat(cacheFile); err == nil {
+			if err := copyfile.CopyFile(cacheFile, destFile, false); err != nil {
+				return fmt.Errorf("failed to copy cached file '%s' to '%s': %s", cacheFile, destFile, err)
+			}
+			logrus.Debugf("hcsshim::CreateLCOWScratch: %s fulfilled from cache (%s)", destFile, cacheFile)
+			return nil
+		}
+	}
+
+	// Create the VHDX
+	if err := vhd.CreateVhdx(destFile, sizeGB, defaultVhdxBlockSizeMB); err != nil {
+		return fmt.Errorf("failed to create VHDx %s: %s", destFile, err)
+	}
+
+	controller, lun, err := lcowUVM.AddSCSI(destFile, "", false) // No destination as not formatted
+	if err != nil {
+		return err
+	}
+
+	logrus.Debugf("hcsshim::CreateLCOWScratch: %s at C=%d L=%d", destFile, controller, lun)
+
+	// Validate /sys/bus/scsi/devices/C:0:0:L exists as a directory
+
+	startTime := time.Now()
+	for {
+		testdCommand := []string{"test", "-d", fmt.Sprintf("/sys/bus/scsi/devices/%d:0:0:%d", controller, lun)}
+		testdProc, _, err := CreateProcess(&ProcessOptions{
+			HCSSystem:         lcowUVM.ComputeSystem(),
+			CreateInUtilityVm: true,
+			CopyTimeout:       timeout.ExternalCommandToStart,
+			Process:           &specs.Process{Args: testdCommand},
+		})
+		if err != nil {
+			lcowUVM.RemoveSCSI(destFile)
+			return fmt.Errorf("failed to run %+v following hot-add %s to utility VM: %s", testdCommand, destFile, err)
+		}
+		defer testdProc.Close()
+
+		testdProc.WaitTimeout(timeout.ExternalCommandToComplete)
+		testdExitCode, err := testdProc.ExitCode()
+		if err != nil {
+			lcowUVM.RemoveSCSI(destFile)
+			return fmt.Errorf("failed to get exit code from from %+v following hot-add %s to utility VM: %s", testdCommand, destFile, err)
+		}
+		if testdExitCode != 0 {
+			currentTime := time.Now()
+			elapsedTime := currentTime.Sub(startTime)
+			if elapsedTime > timeout.TestDRetryLoop {
+				lcowUVM.RemoveSCSI(destFile)
+				return fmt.Errorf("`%+v` return non-zero exit code (%d) following hot-add %s to utility VM", testdCommand, testdExitCode, destFile)
+			}
+		} else {
+			break
+		}
+		time.Sleep(time.Millisecond * 10)
+	}
+
+	// Get the device from under the block subdirectory by doing a simple ls. This will come back as (eg) `sda`
+	var lsOutput bytes.Buffer
+	lsCommand := []string{"ls", fmt.Sprintf("/sys/bus/scsi/devices/%d:0:0:%d/block", controller, lun)}
+	lsProc, _, err := CreateProcess(&ProcessOptions{
+		HCSSystem:         lcowUVM.ComputeSystem(),
+		CreateInUtilityVm: true,
+		CopyTimeout:       timeout.ExternalCommandToStart,
+		Process:           &specs.Process{Args: lsCommand},
+		Stdout:            &lsOutput,
+	})
+
+	if err != nil {
+		lcowUVM.RemoveSCSI(destFile)
+		return fmt.Errorf("failed to `%+v` following hot-add %s to utility VM: %s", lsCommand, destFile, err)
+	}
+	defer lsProc.Close()
+	lsProc.WaitTimeout(timeout.ExternalCommandToComplete)
+	lsExitCode, err := lsProc.ExitCode()
+	if err != nil {
+		lcowUVM.RemoveSCSI(destFile)
+		return fmt.Errorf("failed to get exit code from `%+v` following hot-add %s to utility VM: %s", lsCommand, destFile, err)
+	}
+	if lsExitCode != 0 {
+		lcowUVM.RemoveSCSI(destFile)
+		return fmt.Errorf("`%+v` return non-zero exit code (%d) following hot-add %s to utility VM", lsCommand, lsExitCode, destFile)
+	}
+	device := fmt.Sprintf(`/dev/%s`, strings.TrimSpace(lsOutput.String()))
+	logrus.Debugf("hcsshim: CreateExt4Vhdx: %s: device at %s", destFile, device)
+
+	// Format it ext4
+	mkfsCommand := []string{"mkfs.ext4", "-q", "-E", "lazy_itable_init=1", "-O", `^has_journal,sparse_super2,uninit_bg,^resize_inode`, device}
+	var mkfsStderr bytes.Buffer
+	mkfsProc, _, err := CreateProcess(&ProcessOptions{
+		HCSSystem:         lcowUVM.ComputeSystem(),
+		CreateInUtilityVm: true,
+		CopyTimeout:       timeout.ExternalCommandToStart,
+		Process:           &specs.Process{Args: mkfsCommand},
+		Stderr:            &mkfsStderr,
+	})
+	if err != nil {
+		lcowUVM.RemoveSCSI(destFile)
+		return fmt.Errorf("failed to `%+v` following hot-add %s to utility VM: %s", mkfsCommand, destFile, err)
+	}
+	defer mkfsProc.Close()
+	mkfsProc.WaitTimeout(timeout.ExternalCommandToComplete)
+	mkfsExitCode, err := mkfsProc.ExitCode()
+	if err != nil {
+		lcowUVM.RemoveSCSI(destFile)
+		return fmt.Errorf("failed to get exit code from `%+v` following hot-add %s to utility VM: %s", mkfsCommand, destFile, err)
+	}
+	if mkfsExitCode != 0 {
+		lcowUVM.RemoveSCSI(destFile)
+		return fmt.Errorf("`%+v` return non-zero exit code (%d) following hot-add %s to utility VM: %s", mkfsCommand, mkfsExitCode, destFile, strings.TrimSpace(mkfsStderr.String()))
+	}
+
+	// Hot-Remove before we copy it
+	if err := lcowUVM.RemoveSCSI(destFile); err != nil {
+		return fmt.Errorf("failed to hot-remove: %s", err)
+	}
+
+	// Populate the cache.
+	if cacheFile != "" && (sizeGB == DefaultScratchSizeGB) {
+		if err := copyfile.CopyFile(destFile, cacheFile, true); err != nil {
+			return fmt.Errorf("failed to seed cache '%s' from '%s': %s", destFile, cacheFile, err)
+		}
+	}
+
+	logrus.Debugf("hcsshim::CreateLCOWScratch: %s created (non-cache)", destFile)
+	return nil
+}

vendor/github.com/Microsoft/hcsshim/internal/lcow/tar2vhd.go

@@ -0,0 +1,46 @@
+package lcow
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"time"
+
+	"github.com/Microsoft/hcsshim/internal/uvm"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/sirupsen/logrus"
+)
+
+// TarToVhd streams a tarstream contained in an io.Reader to a fixed vhd file
+func TarToVhd(lcowUVM *uvm.UtilityVM, targetVHDFile string, reader io.Reader) (int64, error) {
+	logrus.Debugf("hcsshim: TarToVhd: %s", targetVHDFile)
+
+	if lcowUVM == nil {
+		return 0, fmt.Errorf("no utility VM passed")
+	}
+
+	//defer uvm.DebugLCOWGCS()
+
+	outFile, err := os.Create(targetVHDFile)
+	if err != nil {
+		return 0, fmt.Errorf("tar2vhd failed to create %s: %s", targetVHDFile, err)
+	}
+	defer outFile.Close()
+	// BUGBUG Delete the file on failure
+
+	tar2vhd, byteCounts, err := CreateProcess(&ProcessOptions{
+		HCSSystem:         lcowUVM.ComputeSystem(),
+		Process:           &specs.Process{Args: []string{"tar2vhd"}},
+		CreateInUtilityVm: true,
+		Stdin:             reader,
+		Stdout:            outFile,
+		CopyTimeout:       2 * time.Minute,
+	})
+	if err != nil {
+		return 0, fmt.Errorf("failed to start tar2vhd for %s: %s", targetVHDFile, err)
+	}
+	defer tar2vhd.Close()
+
+	logrus.Debugf("hcsshim: TarToVhd: %s created, %d bytes", targetVHDFile, byteCounts.Out)
+	return byteCounts.Out, err
+}

vendor/github.com/Microsoft/hcsshim/internal/lcow/types.go

@@ -0,0 +1,11 @@
+package lcow
+
+import "github.com/Microsoft/hcsshim/internal/schema2"
+
+// Additional fields to hcsschema.ProcessParameters used by LCOW
+type ProcessParameters struct {
+	hcsschema.ProcessParameters
+
+	CreateInUtilityVm bool        `json:",omitempty"`
+	OCIProcess        interface{} `json:"OciProcess,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/lcow/vhd2tar.go

@@ -0,0 +1,75 @@
+package lcow
+
+import (
+	"fmt"
+	"io"
+	//	"os"
+
+	"github.com/Microsoft/hcsshim/internal/uvm"
+	//	specs "github.com/opencontainers/runtime-spec/specs-go"
+	//	"github.com/sirupsen/logrus"
+)
+
+// VhdToTar does what is says - it exports a VHD in a specified
+// folder (either a read-only layer.vhd, or a read-write scratch vhdx) to a
+// ReadCloser containing a tar-stream of the layers contents.
+func VhdToTar(lcowUVM *uvm.UtilityVM, vhdFile string, uvmMountPath string, isContainerScratch bool, vhdSize int64) (io.ReadCloser, error) {
+	return nil, fmt.Errorf("not implemented yet")
+	//	logrus.Debugf("hcsshim: VhdToTar: %s isScratch: %t", vhdFile, isContainerScratch)
+
+	//	if lcowUVM == nil {
+	//		return nil, fmt.Errorf("cannot VhdToTar as no utility VM is in configuration")
+	//	}
+
+	//	//defer uvm.DebugLCOWGCS()
+
+	//	vhdHandle, err := os.Open(vhdFile)
+	//	if err != nil {
+	//		return nil, fmt.Errorf("hcsshim: VhdToTar: failed to open %s: %s", vhdFile, err)
+	//	}
+	//	defer vhdHandle.Close()
+	//	logrus.Debugf("hcsshim: VhdToTar: exporting %s, size %d, isScratch %t", vhdHandle.Name(), vhdSize, isContainerScratch)
+
+	//	// Different binary depending on whether a RO layer or a RW scratch
+	//	command := "vhd2tar"
+	//	if isContainerScratch {
+	//		command = fmt.Sprintf("exportSandbox -path %s", uvmMountPath)
+	//	}
+
+	//	//	tar2vhd, byteCounts, err := lcowUVM.CreateProcess(&uvm.ProcessOptions{
+	//	//		Process: &specs.Process{Args: []string{"tar2vhd"}},
+	//	//		Stdin:   reader,
+	//	//		Stdout:  outFile,
+	//	//	})
+
+	//	// Start the binary in the utility VM
+	//	proc, stdin, stdout, _, err := config.createLCOWUVMProcess(command)
+	//	if err != nil {
+	//		return nil, fmt.Errorf("hcsshim: VhdToTar: %s: failed to create utils process %s: %s", vhdHandle.Name(), command, err)
+	//	}
+
+	//	if !isContainerScratch {
+	//		// Send the VHD contents to the utility VM processes stdin handle if not a container scratch
+	//		logrus.Debugf("hcsshim: VhdToTar: copying the layer VHD into the utility VM")
+	//		if _, err = copyWithTimeout(stdin, vhdHandle, vhdSize, processOperationTimeoutSeconds, fmt.Sprintf("vhdtotarstream: sending %s to %s", vhdHandle.Name(), command)); err != nil {
+	//			proc.Close()
+	//			return nil, fmt.Errorf("hcsshim: VhdToTar: %s: failed to copyWithTimeout on the stdin pipe (to utility VM): %s", vhdHandle.Name(), err)
+	//		}
+	//	}
+
+	//	// Start a goroutine which copies the stdout (ie the tar stream)
+	//	reader, writer := io.Pipe()
+	//	go func() {
+	//		defer writer.Close()
+	//		defer proc.Close()
+	//		logrus.Debugf("hcsshim: VhdToTar: copying tar stream back from the utility VM")
+	//		bytes, err := copyWithTimeout(writer, stdout, vhdSize, processOperationTimeoutSeconds, fmt.Sprintf("vhdtotarstream: copy tarstream from %s", command))
+	//		if err != nil {
+	//			logrus.Errorf("hcsshim: VhdToTar: %s:  copyWithTimeout on the stdout pipe (from utility VM) failed: %s", vhdHandle.Name(), err)
+	//		}
+	//		logrus.Debugf("hcsshim: VhdToTar: copied %d bytes of the tarstream of %s from the utility VM", bytes, vhdHandle.Name())
+	//	}()
+
+	//	// Return the read-side of the pipe connected to the goroutine which is reading from the stdout of the process in the utility VM
+	//	return reader, nil
+}

vendor/github.com/Microsoft/hcsshim/internal/logfields/fields.go

@@ -0,0 +1,32 @@
+package logfields
+
+const (
+	// Identifiers
+
+	ContainerID = "cid"
+	UVMID       = "uvm-id"
+	ProcessID   = "pid"
+
+	// Common Misc
+
+	// Timeout represents an operation timeout.
+	Timeout = "timeout"
+	JSON    = "json"
+
+	// Keys/values
+
+	Field         = "field"
+	OCIAnnotation = "oci-annotation"
+	Value         = "value"
+
+	// Golang type's
+
+	ExpectedType = "expected-type"
+	Bool         = "bool"
+	Uint32       = "uint32"
+	Uint64       = "uint64"
+
+	// runhcs
+
+	VMShimOperation = "vmshim-op"
+)

vendor/github.com/Microsoft/hcsshim/internal/longpath/longpath.go

@@ -0,0 +1,24 @@
+package longpath
+
+import (
+	"path/filepath"
+	"strings"
+)
+
+// LongAbs makes a path absolute and returns it in NT long path form.
+func LongAbs(path string) (string, error) {
+	if strings.HasPrefix(path, `\\?\`) || strings.HasPrefix(path, `\\.\`) {
+		return path, nil
+	}
+	if !filepath.IsAbs(path) {
+		absPath, err := filepath.Abs(path)
+		if err != nil {
+			return "", err
+		}
+		path = absPath
+	}
+	if strings.HasPrefix(path, `\\`) {
+		return `\\?\UNC\` + path[2:], nil
+	}
+	return `\\?\` + path, nil
+}

vendor/github.com/Microsoft/hcsshim/internal/mergemaps/merge.go

@@ -0,0 +1,52 @@
+package mergemaps
+
+import "encoding/json"
+
+// Merge recursively merges map `fromMap` into map `ToMap`. Any pre-existing values
+// in ToMap are overwritten. Values in fromMap are added to ToMap.
+// From http://stackoverflow.com/questions/40491438/merging-two-json-strings-in-golang
+func Merge(fromMap, ToMap interface{}) interface{} {
+	switch fromMap := fromMap.(type) {
+	case map[string]interface{}:
+		ToMap, ok := ToMap.(map[string]interface{})
+		if !ok {
+			return fromMap
+		}
+		for keyToMap, valueToMap := range ToMap {
+			if valueFromMap, ok := fromMap[keyToMap]; ok {
+				fromMap[keyToMap] = Merge(valueFromMap, valueToMap)
+			} else {
+				fromMap[keyToMap] = valueToMap
+			}
+		}
+	case nil:
+		// merge(nil, map[string]interface{...}) -> map[string]interface{...}
+		ToMap, ok := ToMap.(map[string]interface{})
+		if ok {
+			return ToMap
+		}
+	}
+	return fromMap
+}
+
+// MergeJSON merges the contents of a JSON string into an object representation,
+// returning a new object suitable for translating to JSON.
+func MergeJSON(object interface{}, additionalJSON []byte) (interface{}, error) {
+	if len(additionalJSON) == 0 {
+		return object, nil
+	}
+	objectJSON, err := json.Marshal(object)
+	if err != nil {
+		return nil, err
+	}
+	var objectMap, newMap map[string]interface{}
+	err = json.Unmarshal(objectJSON, &objectMap)
+	if err != nil {
+		return nil, err
+	}
+	err = json.Unmarshal(additionalJSON, &newMap)
+	if err != nil {
+		return nil, err
+	}
+	return Merge(newMap, objectMap), nil
+}

vendor/github.com/Microsoft/hcsshim/internal/ociwclayer/export.go

@@ -0,0 +1,79 @@
+// Package ociwclayer provides functions for importing and exporting Windows
+// container layers from and to their OCI tar representation.
+package ociwclayer
+
+import (
+	"io"
+	"path/filepath"
+
+	"github.com/Microsoft/go-winio/archive/tar"
+	"github.com/Microsoft/go-winio/backuptar"
+	"github.com/Microsoft/hcsshim"
+)
+
+var driverInfo = hcsshim.DriverInfo{}
+
+// ExportLayer writes an OCI layer tar stream from the provided on-disk layer.
+// The caller must specify the parent layers, if any, ordered from lowest to
+// highest layer.
+//
+// The layer will be mounted for this process, so the caller should ensure that
+// it is not currently mounted.
+func ExportLayer(w io.Writer, path string, parentLayerPaths []string) error {
+	err := hcsshim.ActivateLayer(driverInfo, path)
+	if err != nil {
+		return err
+	}
+	defer hcsshim.DeactivateLayer(driverInfo, path)
+
+	// Prepare and unprepare the layer to ensure that it has been initialized.
+	err = hcsshim.PrepareLayer(driverInfo, path, parentLayerPaths)
+	if err != nil {
+		return err
+	}
+	err = hcsshim.UnprepareLayer(driverInfo, path)
+	if err != nil {
+		return err
+	}
+
+	r, err := hcsshim.NewLayerReader(driverInfo, path, parentLayerPaths)
+	if err != nil {
+		return err
+	}
+
+	err = writeTarFromLayer(r, w)
+	cerr := r.Close()
+	if err != nil {
+		return err
+	}
+	return cerr
+}
+
+func writeTarFromLayer(r hcsshim.LayerReader, w io.Writer) error {
+	t := tar.NewWriter(w)
+	for {
+		name, size, fileInfo, err := r.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return err
+		}
+		if fileInfo == nil {
+			// Write a whiteout file.
+			hdr := &tar.Header{
+				Name: filepath.ToSlash(filepath.Join(filepath.Dir(name), whiteoutPrefix+filepath.Base(name))),
+			}
+			err := t.WriteHeader(hdr)
+			if err != nil {
+				return err
+			}
+		} else {
+			err = backuptar.WriteTarFileFromBackupStream(t, r, name, size, fileInfo)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return t.Close()
+}

vendor/github.com/Microsoft/hcsshim/internal/ociwclayer/import.go

@@ -0,0 +1,141 @@
+package ociwclayer
+
+import (
+	"bufio"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+
+	winio "github.com/Microsoft/go-winio"
+	"github.com/Microsoft/go-winio/archive/tar"
+	"github.com/Microsoft/go-winio/backuptar"
+	"github.com/Microsoft/hcsshim"
+)
+
+const whiteoutPrefix = ".wh."
+
+var (
+	// mutatedFiles is a list of files that are mutated by the import process
+	// and must be backed up and restored.
+	mutatedFiles = map[string]string{
+		"UtilityVM/Files/EFI/Microsoft/Boot/BCD":      "bcd.bak",
+		"UtilityVM/Files/EFI/Microsoft/Boot/BCD.LOG":  "bcd.log.bak",
+		"UtilityVM/Files/EFI/Microsoft/Boot/BCD.LOG1": "bcd.log1.bak",
+		"UtilityVM/Files/EFI/Microsoft/Boot/BCD.LOG2": "bcd.log2.bak",
+	}
+)
+
+// ImportLayer reads a layer from an OCI layer tar stream and extracts it to the
+// specified path. The caller must specify the parent layers, if any, ordered
+// from lowest to highest layer.
+//
+// The caller must ensure that the thread or process has acquired backup and
+// restore privileges.
+//
+// This function returns the total size of the layer's files, in bytes.
+func ImportLayer(r io.Reader, path string, parentLayerPaths []string) (int64, error) {
+	err := os.MkdirAll(path, 0)
+	if err != nil {
+		return 0, err
+	}
+	w, err := hcsshim.NewLayerWriter(hcsshim.DriverInfo{}, path, parentLayerPaths)
+	if err != nil {
+		return 0, err
+	}
+	n, err := writeLayerFromTar(r, w, path)
+	cerr := w.Close()
+	if err != nil {
+		return 0, err
+	}
+	if cerr != nil {
+		return 0, cerr
+	}
+	return n, nil
+}
+
+func writeLayerFromTar(r io.Reader, w hcsshim.LayerWriter, root string) (int64, error) {
+	t := tar.NewReader(r)
+	hdr, err := t.Next()
+	totalSize := int64(0)
+	buf := bufio.NewWriter(nil)
+	for err == nil {
+		base := path.Base(hdr.Name)
+		if strings.HasPrefix(base, whiteoutPrefix) {
+			name := path.Join(path.Dir(hdr.Name), base[len(whiteoutPrefix):])
+			err = w.Remove(filepath.FromSlash(name))
+			if err != nil {
+				return 0, err
+			}
+			hdr, err = t.Next()
+		} else if hdr.Typeflag == tar.TypeLink {
+			err = w.AddLink(filepath.FromSlash(hdr.Name), filepath.FromSlash(hdr.Linkname))
+			if err != nil {
+				return 0, err
+			}
+			hdr, err = t.Next()
+		} else {
+			var (
+				name     string
+				size     int64
+				fileInfo *winio.FileBasicInfo
+			)
+			name, size, fileInfo, err = backuptar.FileInfoFromHeader(hdr)
+			if err != nil {
+				return 0, err
+			}
+			err = w.Add(filepath.FromSlash(name), fileInfo)
+			if err != nil {
+				return 0, err
+			}
+			hdr, err = writeBackupStreamFromTarAndSaveMutatedFiles(buf, w, t, hdr, root)
+			totalSize += size
+		}
+	}
+	if err != io.EOF {
+		return 0, err
+	}
+	return totalSize, nil
+}
+
+// writeBackupStreamFromTarAndSaveMutatedFiles reads data from a tar stream and
+// writes it to a backup stream, and also saves any files that will be mutated
+// by the import layer process to a backup location.
+func writeBackupStreamFromTarAndSaveMutatedFiles(buf *bufio.Writer, w io.Writer, t *tar.Reader, hdr *tar.Header, root string) (nextHdr *tar.Header, err error) {
+	var bcdBackup *os.File
+	var bcdBackupWriter *winio.BackupFileWriter
+	if backupPath, ok := mutatedFiles[hdr.Name]; ok {
+		bcdBackup, err = os.Create(filepath.Join(root, backupPath))
+		if err != nil {
+			return nil, err
+		}
+		defer func() {
+			cerr := bcdBackup.Close()
+			if err == nil {
+				err = cerr
+			}
+		}()
+
+		bcdBackupWriter = winio.NewBackupFileWriter(bcdBackup, false)
+		defer func() {
+			cerr := bcdBackupWriter.Close()
+			if err == nil {
+				err = cerr
+			}
+		}()
+
+		buf.Reset(io.MultiWriter(w, bcdBackupWriter))
+	} else {
+		buf.Reset(w)
+	}
+
+	defer func() {
+		ferr := buf.Flush()
+		if err == nil {
+			err = ferr
+		}
+	}()
+
+	return backuptar.WriteBackupStreamFromTarFile(buf, t, hdr)
+}

vendor/github.com/Microsoft/hcsshim/internal/ospath/join.go

@@ -0,0 +1,14 @@
+package ospath
+
+import (
+	"path"
+	"path/filepath"
+)
+
+// Join joins paths using the target OS's path separator.
+func Join(os string, elem ...string) string {
+	if os == "windows" {
+		return filepath.Join(elem...)
+	}
+	return path.Join(elem...)
+}

vendor/github.com/Microsoft/hcsshim/internal/regstate/regstate.go

@@ -0,0 +1,287 @@
+package regstate
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"os"
+	"path/filepath"
+	"reflect"
+	"syscall"
+
+	"golang.org/x/sys/windows/registry"
+)
+
+//go:generate go run $GOROOT/src/syscall/mksyscall_windows.go -output zsyscall_windows.go regstate.go
+
+//sys	regCreateKeyEx(key syscall.Handle, subkey *uint16, reserved uint32, class *uint16, options uint32, desired uint32, sa *syscall.SecurityAttributes, result *syscall.Handle, disposition *uint32) (regerrno error) = advapi32.RegCreateKeyExW
+
+const (
+	_REG_OPTION_VOLATILE = 1
+
+	_REG_CREATED_NEW_KEY     = 1
+	_REG_OPENED_EXISTING_KEY = 2
+)
+
+type Key struct {
+	registry.Key
+	Name string
+}
+
+var localMachine = &Key{registry.LOCAL_MACHINE, "HKEY_LOCAL_MACHINE"}
+var localUser = &Key{registry.CURRENT_USER, "HKEY_CURRENT_USER"}
+
+var rootPath = `SOFTWARE\Microsoft\runhcs`
+
+type NotFoundError struct {
+	Id string
+}
+
+func (err *NotFoundError) Error() string {
+	return fmt.Sprintf("ID '%s' was not found", err.Id)
+}
+
+func IsNotFoundError(err error) bool {
+	_, ok := err.(*NotFoundError)
+	return ok
+}
+
+type NoStateError struct {
+	ID  string
+	Key string
+}
+
+func (err *NoStateError) Error() string {
+	return fmt.Sprintf("state '%s' is not present for ID '%s'", err.Key, err.ID)
+}
+
+func createVolatileKey(k *Key, path string, access uint32) (newk *Key, openedExisting bool, err error) {
+	var (
+		h syscall.Handle
+		d uint32
+	)
+	fullpath := filepath.Join(k.Name, path)
+	err = regCreateKeyEx(syscall.Handle(k.Key), syscall.StringToUTF16Ptr(path), 0, nil, _REG_OPTION_VOLATILE, access, nil, &h, &d)
+	if err != nil {
+		return nil, false, &os.PathError{Op: "RegCreateKeyEx", Path: fullpath, Err: err}
+	}
+	return &Key{registry.Key(h), fullpath}, d == _REG_OPENED_EXISTING_KEY, nil
+}
+
+func hive(perUser bool) *Key {
+	r := localMachine
+	if perUser {
+		r = localUser
+	}
+	return r
+}
+
+func Open(root string, perUser bool) (*Key, error) {
+	k, _, err := createVolatileKey(hive(perUser), rootPath, registry.ALL_ACCESS)
+	if err != nil {
+		return nil, err
+	}
+	defer k.Close()
+
+	k2, _, err := createVolatileKey(k, url.PathEscape(root), registry.ALL_ACCESS)
+	if err != nil {
+		return nil, err
+	}
+	return k2, nil
+}
+
+func RemoveAll(root string, perUser bool) error {
+	k, err := hive(perUser).open(rootPath)
+	if err != nil {
+		return err
+	}
+	defer k.Close()
+	r, err := k.open(url.PathEscape(root))
+	if err != nil {
+		return err
+	}
+	defer r.Close()
+	ids, err := r.Enumerate()
+	if err != nil {
+		return err
+	}
+	for _, id := range ids {
+		err = r.Remove(id)
+		if err != nil {
+			return err
+		}
+	}
+	r.Close()
+	return k.Remove(root)
+}
+
+func (k *Key) Close() error {
+	err := k.Key.Close()
+	k.Key = 0
+	return err
+}
+
+func (k *Key) Enumerate() ([]string, error) {
+	escapedIDs, err := k.ReadSubKeyNames(0)
+	if err != nil {
+		return nil, err
+	}
+	var ids []string
+	for _, e := range escapedIDs {
+		id, err := url.PathUnescape(e)
+		if err == nil {
+			ids = append(ids, id)
+		}
+	}
+	return ids, nil
+}
+
+func (k *Key) open(name string) (*Key, error) {
+	fullpath := filepath.Join(k.Name, name)
+	nk, err := registry.OpenKey(k.Key, name, registry.ALL_ACCESS)
+	if err != nil {
+		return nil, &os.PathError{Op: "RegOpenKey", Path: fullpath, Err: err}
+	}
+	return &Key{nk, fullpath}, nil
+}
+
+func (k *Key) openid(id string) (*Key, error) {
+	escaped := url.PathEscape(id)
+	fullpath := filepath.Join(k.Name, escaped)
+	nk, err := k.open(escaped)
+	if perr, ok := err.(*os.PathError); ok && perr.Err == syscall.ERROR_FILE_NOT_FOUND {
+		return nil, &NotFoundError{id}
+	}
+	if err != nil {
+		return nil, &os.PathError{Op: "RegOpenKey", Path: fullpath, Err: err}
+	}
+	return nk, nil
+}
+
+func (k *Key) Remove(id string) error {
+	escaped := url.PathEscape(id)
+	err := registry.DeleteKey(k.Key, escaped)
+	if err != nil {
+		if err == syscall.ERROR_FILE_NOT_FOUND {
+			return &NotFoundError{id}
+		}
+		return &os.PathError{Op: "RegDeleteKey", Path: filepath.Join(k.Name, escaped), Err: err}
+	}
+	return nil
+}
+
+func (k *Key) set(id string, create bool, key string, state interface{}) error {
+	var sk *Key
+	var err error
+	if create {
+		var existing bool
+		eid := url.PathEscape(id)
+		sk, existing, err = createVolatileKey(k, eid, registry.ALL_ACCESS)
+		if err != nil {
+			return err
+		}
+		defer sk.Close()
+		if existing {
+			sk.Close()
+			return fmt.Errorf("container %s already exists", id)
+		}
+	} else {
+		sk, err = k.openid(id)
+		if err != nil {
+			return err
+		}
+		defer sk.Close()
+	}
+	switch reflect.TypeOf(state).Kind() {
+	case reflect.Bool:
+		v := uint32(0)
+		if state.(bool) {
+			v = 1
+		}
+		err = sk.SetDWordValue(key, v)
+	case reflect.Int:
+		err = sk.SetQWordValue(key, uint64(state.(int)))
+	case reflect.String:
+		err = sk.SetStringValue(key, state.(string))
+	default:
+		var js []byte
+		js, err = json.Marshal(state)
+		if err != nil {
+			return err
+		}
+		err = sk.SetBinaryValue(key, js)
+	}
+	if err != nil {
+		if err == syscall.ERROR_FILE_NOT_FOUND {
+			return &NoStateError{id, key}
+		}
+		return &os.PathError{Op: "RegSetValueEx", Path: sk.Name + ":" + key, Err: err}
+	}
+	return nil
+}
+
+func (k *Key) Create(id, key string, state interface{}) error {
+	return k.set(id, true, key, state)
+}
+
+func (k *Key) Set(id, key string, state interface{}) error {
+	return k.set(id, false, key, state)
+}
+
+func (k *Key) Clear(id, key string) error {
+	sk, err := k.openid(id)
+	if err != nil {
+		return err
+	}
+	defer sk.Close()
+	err = sk.DeleteValue(key)
+	if err != nil {
+		if err == syscall.ERROR_FILE_NOT_FOUND {
+			return &NoStateError{id, key}
+		}
+		return &os.PathError{Op: "RegDeleteValue", Path: sk.Name + ":" + key, Err: err}
+	}
+	return nil
+}
+
+func (k *Key) Get(id, key string, state interface{}) error {
+	sk, err := k.openid(id)
+	if err != nil {
+		return err
+	}
+	defer sk.Close()
+
+	var js []byte
+	switch reflect.TypeOf(state).Elem().Kind() {
+	case reflect.Bool:
+		var v uint64
+		v, _, err = sk.GetIntegerValue(key)
+		if err == nil {
+			*state.(*bool) = v != 0
+		}
+	case reflect.Int:
+		var v uint64
+		v, _, err = sk.GetIntegerValue(key)
+		if err == nil {
+			*state.(*int) = int(v)
+		}
+	case reflect.String:
+		var v string
+		v, _, err = sk.GetStringValue(key)
+		if err == nil {
+			*state.(*string) = string(v)
+		}
+	default:
+		js, _, err = sk.GetBinaryValue(key)
+	}
+	if err != nil {
+		if err == syscall.ERROR_FILE_NOT_FOUND {
+			return &NoStateError{id, key}
+		}
+		return &os.PathError{Op: "RegQueryValueEx", Path: sk.Name + ":" + key, Err: err}
+	}
+	if js != nil {
+		err = json.Unmarshal(js, state)
+	}
+	return err
+}

vendor/github.com/Microsoft/hcsshim/internal/regstate/regstate_test.go

@@ -0,0 +1,185 @@
+package regstate
+
+import (
+	"os"
+	"testing"
+)
+
+var testKey = "runhcs-test-test-key"
+
+func prepTest(t *testing.T) {
+	err := RemoveAll(testKey, true)
+	if err != nil && !os.IsNotExist(err) {
+		t.Fatal(err)
+	}
+}
+
+func TestLifetime(t *testing.T) {
+	prepTest(t)
+	k, err := Open(testKey, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ids, err := k.Enumerate()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(ids) != 0 {
+		t.Fatal("wrong count", len(ids))
+	}
+
+	id := "a/b/c"
+	key := "key"
+	err = k.Set(id, key, 1)
+	if err == nil {
+		t.Fatal("expected error")
+	}
+
+	var i int
+	err = k.Get(id, key, &i)
+	if err == nil {
+		t.Fatal("expected error")
+	}
+
+	err = k.Create(id, key, 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ids, err = k.Enumerate()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(ids) != 1 {
+		t.Fatal("wrong count", len(ids))
+	}
+	if ids[0] != id {
+		t.Fatal("wrong value", ids[0])
+	}
+
+	err = k.Get(id, key, &i)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if i != 2 {
+		t.Fatal("got wrong value", i)
+	}
+
+	err = k.Set(id, key, 3)
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = k.Get(id, key, &i)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if i != 3 {
+		t.Fatal("got wrong value", i)
+	}
+
+	err = k.Remove(id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = k.Remove(id)
+	if err == nil {
+		t.Fatal("expected error")
+	}
+
+	ids, err = k.Enumerate()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(ids) != 0 {
+		t.Fatal("wrong count", len(ids))
+	}
+}
+
+func TestBool(t *testing.T) {
+	prepTest(t)
+	k, err := Open(testKey, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	id := "x"
+	key := "y"
+	err = k.Create(id, key, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	b := false
+	err = k.Get(id, key, &b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !b {
+		t.Fatal("value did not marshal correctly")
+	}
+}
+
+func TestInt(t *testing.T) {
+	prepTest(t)
+	k, err := Open(testKey, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	id := "x"
+	key := "y"
+	err = k.Create(id, key, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	v := 0
+	err = k.Get(id, key, &v)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if v != 10 {
+		t.Fatal("value did not marshal correctly")
+	}
+}
+
+func TestString(t *testing.T) {
+	prepTest(t)
+	k, err := Open(testKey, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	id := "x"
+	key := "y"
+	err = k.Create(id, key, "blah")
+	if err != nil {
+		t.Fatal(err)
+	}
+	v := ""
+	err = k.Get(id, key, &v)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if v != "blah" {
+		t.Fatal("value did not marshal correctly")
+	}
+}
+
+func TestJson(t *testing.T) {
+	prepTest(t)
+	k, err := Open(testKey, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	id := "x"
+	key := "y"
+	v := struct{ X int }{5}
+	err = k.Create(id, key, &v)
+	if err != nil {
+		t.Fatal(err)
+	}
+	v.X = 0
+	err = k.Get(id, key, &v)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if v.X != 5 {
+		t.Fatal("value did not marshal correctly: ", v)
+	}
+}

vendor/github.com/Microsoft/hcsshim/internal/regstate/zsyscall_windows.go

@@ -0,0 +1,51 @@
+// Code generated by 'go generate'; DO NOT EDIT.
+
+package regstate
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+var _ unsafe.Pointer
+
+// Do the interface allocations only once for common
+// Errno values.
+const (
+	errnoERROR_IO_PENDING = 997
+)
+
+var (
+	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
+)
+
+// errnoErr returns common boxed Errno values, to prevent
+// allocations at runtime.
+func errnoErr(e syscall.Errno) error {
+	switch e {
+	case 0:
+		return nil
+	case errnoERROR_IO_PENDING:
+		return errERROR_IO_PENDING
+	}
+	// TODO: add more here, after collecting data on the common
+	// error values see on Windows. (perhaps when running
+	// all.bat?)
+	return e
+}
+
+var (
+	modadvapi32 = windows.NewLazySystemDLL("advapi32.dll")
+
+	procRegCreateKeyExW = modadvapi32.NewProc("RegCreateKeyExW")
+)
+
+func regCreateKeyEx(key syscall.Handle, subkey *uint16, reserved uint32, class *uint16, options uint32, desired uint32, sa *syscall.SecurityAttributes, result *syscall.Handle, disposition *uint32) (regerrno error) {
+	r0, _, _ := syscall.Syscall9(procRegCreateKeyExW.Addr(), 9, uintptr(key), uintptr(unsafe.Pointer(subkey)), uintptr(reserved), uintptr(unsafe.Pointer(class)), uintptr(options), uintptr(desired), uintptr(unsafe.Pointer(sa)), uintptr(unsafe.Pointer(result)), uintptr(unsafe.Pointer(disposition)))
+	if r0 != 0 {
+		regerrno = syscall.Errno(r0)
+	}
+	return
+}

vendor/github.com/Microsoft/hcsshim/internal/requesttype/types.go

@@ -0,0 +1,10 @@
+package requesttype
+
+// These are constants for v2 schema modify requests.
+
+// RequestType const
+const (
+	Add    = "Add"
+	Remove = "Remove"
+	PreAdd = "PreAdd" // For networking
+)

vendor/github.com/Microsoft/hcsshim/internal/runhcs/container.go

@@ -0,0 +1,71 @@
+package runhcs
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"syscall"
+	"time"
+
+	"github.com/Microsoft/hcsshim/internal/guid"
+)
+
+// ContainerState represents the platform agnostic pieces relating to a
+// running container's status and state
+type ContainerState struct {
+	// Version is the OCI version for the container
+	Version string `json:"ociVersion"`
+	// ID is the container ID
+	ID string `json:"id"`
+	// InitProcessPid is the init process id in the parent namespace
+	InitProcessPid int `json:"pid"`
+	// Status is the current status of the container, running, paused, ...
+	Status string `json:"status"`
+	// Bundle is the path on the filesystem to the bundle
+	Bundle string `json:"bundle"`
+	// Rootfs is a path to a directory containing the container's root filesystem.
+	Rootfs string `json:"rootfs"`
+	// Created is the unix timestamp for the creation time of the container in UTC
+	Created time.Time `json:"created"`
+	// Annotations is the user defined annotations added to the config.
+	Annotations map[string]string `json:"annotations,omitempty"`
+	// The owner of the state directory (the owner of the container).
+	Owner string `json:"owner"`
+}
+
+// GetErrorFromPipe returns reads from `pipe` and verifies if the operation
+// returned success or error. If error converts that to an error and returns. If
+// `p` is not nill will issue a `Kill` and `Wait` for exit.
+func GetErrorFromPipe(pipe io.Reader, p *os.Process) error {
+	serr, err := ioutil.ReadAll(pipe)
+	if err != nil {
+		return err
+	}
+
+	if bytes.Equal(serr, ShimSuccess) {
+		return nil
+	}
+
+	extra := ""
+	if p != nil {
+		p.Kill()
+		state, err := p.Wait()
+		if err != nil {
+			panic(err)
+		}
+		extra = fmt.Sprintf(", exit code %d", state.Sys().(syscall.WaitStatus).ExitCode)
+	}
+	if len(serr) == 0 {
+		return fmt.Errorf("unknown shim failure%s", extra)
+	}
+
+	return errors.New(string(serr))
+}
+
+// VMPipePath returns the named pipe path for the vm shim.
+func VMPipePath(hostUniqueID guid.GUID) string {
+	return SafePipePath("runhcs-vm-" + hostUniqueID.String())
+}

vendor/github.com/Microsoft/hcsshim/internal/runhcs/util.go

@@ -0,0 +1,16 @@
+package runhcs
+
+import "net/url"
+
+const (
+	SafePipePrefix = `\\.\pipe\ProtectedPrefix\Administrators\`
+)
+
+// ShimSuccess is the byte stream returned on a successful operation.
+var ShimSuccess = []byte{0, 'O', 'K', 0}
+
+func SafePipePath(name string) string {
+	// Use a pipe in the Administrators protected prefixed to prevent malicious
+	// squatting.
+	return SafePipePrefix + url.PathEscape(name)
+}

vendor/github.com/Microsoft/hcsshim/internal/runhcs/util_test.go

@@ -0,0 +1,17 @@
+package runhcs
+
+import (
+	"testing"
+)
+
+func Test_SafePipePath(t *testing.T) {
+	tests := []string{"test", "test with spaces", "test/with\\\\.\\slashes", "test.with..dots..."}
+	expected := []string{"test", "test%20with%20spaces", "test%2Fwith%5C%5C.%5Cslashes", "test.with..dots..."}
+	for i, test := range tests {
+		actual := SafePipePath(test)
+		e := SafePipePrefix + expected[i]
+		if actual != e {
+			t.Fatalf("SafePipePath: actual '%s' != '%s'", actual, expected[i])
+		}
+	}
+}

vendor/github.com/Microsoft/hcsshim/internal/runhcs/vm.go

@@ -0,0 +1,43 @@
+package runhcs
+
+import (
+	"encoding/json"
+
+	"github.com/Microsoft/go-winio"
+)
+
+// VMRequestOp is an operation that can be issued to a VM shim.
+type VMRequestOp string
+
+const (
+	// OpCreateContainer is a create container request.
+	OpCreateContainer VMRequestOp = "create"
+	// OpSyncNamespace is a `cni.NamespaceTypeGuest` sync request with the UVM.
+	OpSyncNamespace VMRequestOp = "sync"
+	// OpUnmountContainer is a container unmount request.
+	OpUnmountContainer VMRequestOp = "unmount"
+	// OpUnmountContainerDiskOnly is a container unmount disk request.
+	OpUnmountContainerDiskOnly VMRequestOp = "unmount-disk"
+)
+
+// VMRequest is an operation request that is issued to a VM shim.
+type VMRequest struct {
+	ID string
+	Op VMRequestOp
+}
+
+// IssueVMRequest issues a request to a shim at the given pipe.
+func IssueVMRequest(pipepath string, req *VMRequest) error {
+	pipe, err := winio.DialPipe(pipepath, nil)
+	if err != nil {
+		return err
+	}
+	defer pipe.Close()
+	if err := json.NewEncoder(pipe).Encode(req); err != nil {
+		return err
+	}
+	if err := GetErrorFromPipe(pipe, nil); err != nil {
+		return err
+	}
+	return nil
+}

vendor/github.com/Microsoft/hcsshim/internal/safefile/safeopen.go

@@ -0,0 +1,431 @@
+package safefile
+
+import (
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"unicode/utf16"
+	"unsafe"
+
+	"github.com/Microsoft/hcsshim/internal/longpath"
+
+	winio "github.com/Microsoft/go-winio"
+)
+
+//go:generate go run $GOROOT\src\syscall\mksyscall_windows.go -output zsyscall_windows.go safeopen.go
+
+//sys ntCreateFile(handle *uintptr, accessMask uint32, oa *objectAttributes, iosb *ioStatusBlock, allocationSize *uint64, fileAttributes uint32, shareAccess uint32, createDisposition uint32, createOptions uint32, eaBuffer *byte, eaLength uint32) (status uint32) = ntdll.NtCreateFile
+//sys ntSetInformationFile(handle uintptr, iosb *ioStatusBlock, information uintptr, length uint32, class uint32) (status uint32) = ntdll.NtSetInformationFile
+//sys rtlNtStatusToDosError(status uint32) (winerr error) = ntdll.RtlNtStatusToDosErrorNoTeb
+//sys localAlloc(flags uint32, size int) (ptr uintptr) = kernel32.LocalAlloc
+//sys localFree(ptr uintptr) = kernel32.LocalFree
+
+type ioStatusBlock struct {
+	Status, Information uintptr
+}
+
+type objectAttributes struct {
+	Length             uintptr
+	RootDirectory      uintptr
+	ObjectName         uintptr
+	Attributes         uintptr
+	SecurityDescriptor uintptr
+	SecurityQoS        uintptr
+}
+
+type unicodeString struct {
+	Length        uint16
+	MaximumLength uint16
+	Buffer        uintptr
+}
+
+type fileLinkInformation struct {
+	ReplaceIfExists bool
+	RootDirectory   uintptr
+	FileNameLength  uint32
+	FileName        [1]uint16
+}
+
+type fileDispositionInformationEx struct {
+	Flags uintptr
+}
+
+const (
+	_FileLinkInformation          = 11
+	_FileDispositionInformationEx = 64
+
+	FILE_READ_ATTRIBUTES  = 0x0080
+	FILE_WRITE_ATTRIBUTES = 0x0100
+	DELETE                = 0x10000
+
+	FILE_OPEN   = 1
+	FILE_CREATE = 2
+
+	FILE_DIRECTORY_FILE          = 0x00000001
+	FILE_SYNCHRONOUS_IO_NONALERT = 0x00000020
+	FILE_DELETE_ON_CLOSE         = 0x00001000
+	FILE_OPEN_FOR_BACKUP_INTENT  = 0x00004000
+	FILE_OPEN_REPARSE_POINT      = 0x00200000
+
+	FILE_DISPOSITION_DELETE = 0x00000001
+
+	_OBJ_DONT_REPARSE = 0x1000
+
+	_STATUS_REPARSE_POINT_ENCOUNTERED = 0xC000050B
+)
+
+func OpenRoot(path string) (*os.File, error) {
+	longpath, err := longpath.LongAbs(path)
+	if err != nil {
+		return nil, err
+	}
+	return winio.OpenForBackup(longpath, syscall.GENERIC_READ, syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE|syscall.FILE_SHARE_DELETE, syscall.OPEN_EXISTING)
+}
+
+func ntRelativePath(path string) ([]uint16, error) {
+	path = filepath.Clean(path)
+	if strings.Contains(path, ":") {
+		// Since alternate data streams must follow the file they
+		// are attached to, finding one here (out of order) is invalid.
+		return nil, errors.New("path contains invalid character `:`")
+	}
+	fspath := filepath.FromSlash(path)
+	if len(fspath) > 0 && fspath[0] == '\\' {
+		return nil, errors.New("expected relative path")
+	}
+
+	path16 := utf16.Encode(([]rune)(fspath))
+	if len(path16) > 32767 {
+		return nil, syscall.ENAMETOOLONG
+	}
+
+	return path16, nil
+}
+
+// openRelativeInternal opens a relative path from the given root, failing if
+// any of the intermediate path components are reparse points.
+func openRelativeInternal(path string, root *os.File, accessMask uint32, shareFlags uint32, createDisposition uint32, flags uint32) (*os.File, error) {
+	var (
+		h    uintptr
+		iosb ioStatusBlock
+		oa   objectAttributes
+	)
+
+	path16, err := ntRelativePath(path)
+	if err != nil {
+		return nil, err
+	}
+
+	if root == nil || root.Fd() == 0 {
+		return nil, errors.New("missing root directory")
+	}
+
+	upathBuffer := localAlloc(0, int(unsafe.Sizeof(unicodeString{}))+len(path16)*2)
+	defer localFree(upathBuffer)
+
+	upath := (*unicodeString)(unsafe.Pointer(upathBuffer))
+	upath.Length = uint16(len(path16) * 2)
+	upath.MaximumLength = upath.Length
+	upath.Buffer = upathBuffer + unsafe.Sizeof(*upath)
+	copy((*[32768]uint16)(unsafe.Pointer(upath.Buffer))[:], path16)
+
+	oa.Length = unsafe.Sizeof(oa)
+	oa.ObjectName = upathBuffer
+	oa.RootDirectory = uintptr(root.Fd())
+	oa.Attributes = _OBJ_DONT_REPARSE
+	status := ntCreateFile(
+		&h,
+		accessMask|syscall.SYNCHRONIZE,
+		&oa,
+		&iosb,
+		nil,
+		0,
+		shareFlags,
+		createDisposition,
+		FILE_OPEN_FOR_BACKUP_INTENT|FILE_SYNCHRONOUS_IO_NONALERT|flags,
+		nil,
+		0,
+	)
+	if status != 0 {
+		return nil, rtlNtStatusToDosError(status)
+	}
+
+	fullPath, err := longpath.LongAbs(filepath.Join(root.Name(), path))
+	if err != nil {
+		syscall.Close(syscall.Handle(h))
+		return nil, err
+	}
+
+	return os.NewFile(h, fullPath), nil
+}
+
+// OpenRelative opens a relative path from the given root, failing if
+// any of the intermediate path components are reparse points.
+func OpenRelative(path string, root *os.File, accessMask uint32, shareFlags uint32, createDisposition uint32, flags uint32) (*os.File, error) {
+	f, err := openRelativeInternal(path, root, accessMask, shareFlags, createDisposition, flags)
+	if err != nil {
+		err = &os.PathError{Op: "open", Path: filepath.Join(root.Name(), path), Err: err}
+	}
+	return f, err
+}
+
+// LinkRelative creates a hard link from oldname to newname (relative to oldroot
+// and newroot), failing if any of the intermediate path components are reparse
+// points.
+func LinkRelative(oldname string, oldroot *os.File, newname string, newroot *os.File) error {
+	// Open the old file.
+	oldf, err := openRelativeInternal(
+		oldname,
+		oldroot,
+		syscall.FILE_WRITE_ATTRIBUTES,
+		syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE|syscall.FILE_SHARE_DELETE,
+		FILE_OPEN,
+		0,
+	)
+	if err != nil {
+		return &os.LinkError{Op: "link", Old: filepath.Join(oldroot.Name(), oldname), New: filepath.Join(newroot.Name(), newname), Err: err}
+	}
+	defer oldf.Close()
+
+	// Open the parent of the new file.
+	var parent *os.File
+	parentPath := filepath.Dir(newname)
+	if parentPath != "." {
+		parent, err = openRelativeInternal(
+			parentPath,
+			newroot,
+			syscall.GENERIC_READ,
+			syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE|syscall.FILE_SHARE_DELETE,
+			FILE_OPEN,
+			FILE_DIRECTORY_FILE)
+		if err != nil {
+			return &os.LinkError{Op: "link", Old: oldf.Name(), New: filepath.Join(newroot.Name(), newname), Err: err}
+		}
+		defer parent.Close()
+
+		fi, err := winio.GetFileBasicInfo(parent)
+		if err != nil {
+			return err
+		}
+		if (fi.FileAttributes & syscall.FILE_ATTRIBUTE_REPARSE_POINT) != 0 {
+			return &os.LinkError{Op: "link", Old: oldf.Name(), New: filepath.Join(newroot.Name(), newname), Err: rtlNtStatusToDosError(_STATUS_REPARSE_POINT_ENCOUNTERED)}
+		}
+
+	} else {
+		parent = newroot
+	}
+
+	// Issue an NT call to create the link. This will be safe because NT will
+	// not open any more directories to create the link, so it cannot walk any
+	// more reparse points.
+	newbase := filepath.Base(newname)
+	newbase16, err := ntRelativePath(newbase)
+	if err != nil {
+		return err
+	}
+
+	size := int(unsafe.Offsetof(fileLinkInformation{}.FileName)) + len(newbase16)*2
+	linkinfoBuffer := localAlloc(0, size)
+	defer localFree(linkinfoBuffer)
+	linkinfo := (*fileLinkInformation)(unsafe.Pointer(linkinfoBuffer))
+	linkinfo.RootDirectory = parent.Fd()
+	linkinfo.FileNameLength = uint32(len(newbase16) * 2)
+	copy((*[32768]uint16)(unsafe.Pointer(&linkinfo.FileName[0]))[:], newbase16)
+
+	var iosb ioStatusBlock
+	status := ntSetInformationFile(
+		oldf.Fd(),
+		&iosb,
+		linkinfoBuffer,
+		uint32(size),
+		_FileLinkInformation,
+	)
+	if status != 0 {
+		return &os.LinkError{Op: "link", Old: oldf.Name(), New: filepath.Join(parent.Name(), newbase), Err: rtlNtStatusToDosError(status)}
+	}
+
+	return nil
+}
+
+// deleteOnClose marks a file to be deleted when the handle is closed.
+func deleteOnClose(f *os.File) error {
+	disposition := fileDispositionInformationEx{Flags: FILE_DISPOSITION_DELETE}
+	var iosb ioStatusBlock
+	status := ntSetInformationFile(
+		f.Fd(),
+		&iosb,
+		uintptr(unsafe.Pointer(&disposition)),
+		uint32(unsafe.Sizeof(disposition)),
+		_FileDispositionInformationEx,
+	)
+	if status != 0 {
+		return rtlNtStatusToDosError(status)
+	}
+	return nil
+}
+
+// clearReadOnly clears the readonly attribute on a file.
+func clearReadOnly(f *os.File) error {
+	bi, err := winio.GetFileBasicInfo(f)
+	if err != nil {
+		return err
+	}
+	if bi.FileAttributes&syscall.FILE_ATTRIBUTE_READONLY == 0 {
+		return nil
+	}
+	sbi := winio.FileBasicInfo{
+		FileAttributes: bi.FileAttributes &^ syscall.FILE_ATTRIBUTE_READONLY,
+	}
+	if sbi.FileAttributes == 0 {
+		sbi.FileAttributes = syscall.FILE_ATTRIBUTE_NORMAL
+	}
+	return winio.SetFileBasicInfo(f, &sbi)
+}
+
+// RemoveRelative removes a file or directory relative to a root, failing if any
+// intermediate path components are reparse points.
+func RemoveRelative(path string, root *os.File) error {
+	f, err := openRelativeInternal(
+		path,
+		root,
+		FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|DELETE,
+		syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE|syscall.FILE_SHARE_DELETE,
+		FILE_OPEN,
+		FILE_OPEN_REPARSE_POINT)
+	if err == nil {
+		defer f.Close()
+		err = deleteOnClose(f)
+		if err == syscall.ERROR_ACCESS_DENIED {
+			// Maybe the file is marked readonly. Clear the bit and retry.
+			clearReadOnly(f)
+			err = deleteOnClose(f)
+		}
+	}
+	if err != nil {
+		return &os.PathError{Op: "remove", Path: filepath.Join(root.Name(), path), Err: err}
+	}
+	return nil
+}
+
+// RemoveAllRelative removes a directory tree relative to a root, failing if any
+// intermediate path components are reparse points.
+func RemoveAllRelative(path string, root *os.File) error {
+	fi, err := LstatRelative(path, root)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	fileAttributes := fi.Sys().(*syscall.Win32FileAttributeData).FileAttributes
+	if fileAttributes&syscall.FILE_ATTRIBUTE_DIRECTORY == 0 || fileAttributes&syscall.FILE_ATTRIBUTE_REPARSE_POINT != 0 {
+		// If this is a reparse point, it can't have children. Simple remove will do.
+		err := RemoveRelative(path, root)
+		if err == nil || os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+
+	// It is necessary to use os.Open as Readdirnames does not work with
+	// OpenRelative. This is safe because the above lstatrelative fails
+	// if the target is outside the root, and we know this is not a
+	// symlink from the above FILE_ATTRIBUTE_REPARSE_POINT check.
+	fd, err := os.Open(filepath.Join(root.Name(), path))
+	if err != nil {
+		if os.IsNotExist(err) {
+			// Race. It was deleted between the Lstat and Open.
+			// Return nil per RemoveAll's docs.
+			return nil
+		}
+		return err
+	}
+
+	// Remove contents & return first error.
+	for {
+		names, err1 := fd.Readdirnames(100)
+		for _, name := range names {
+			err1 := RemoveAllRelative(path+string(os.PathSeparator)+name, root)
+			if err == nil {
+				err = err1
+			}
+		}
+		if err1 == io.EOF {
+			break
+		}
+		// If Readdirnames returned an error, use it.
+		if err == nil {
+			err = err1
+		}
+		if len(names) == 0 {
+			break
+		}
+	}
+	fd.Close()
+
+	// Remove directory.
+	err1 := RemoveRelative(path, root)
+	if err1 == nil || os.IsNotExist(err1) {
+		return nil
+	}
+	if err == nil {
+		err = err1
+	}
+	return err
+}
+
+// MkdirRelative creates a directory relative to a root, failing if any
+// intermediate path components are reparse points.
+func MkdirRelative(path string, root *os.File) error {
+	f, err := openRelativeInternal(
+		path,
+		root,
+		0,
+		syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE|syscall.FILE_SHARE_DELETE,
+		FILE_CREATE,
+		FILE_DIRECTORY_FILE)
+	if err == nil {
+		f.Close()
+	} else {
+		err = &os.PathError{Op: "mkdir", Path: filepath.Join(root.Name(), path), Err: err}
+	}
+	return err
+}
+
+// LstatRelative performs a stat operation on a file relative to a root, failing
+// if any intermediate path components are reparse points.
+func LstatRelative(path string, root *os.File) (os.FileInfo, error) {
+	f, err := openRelativeInternal(
+		path,
+		root,
+		FILE_READ_ATTRIBUTES,
+		syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE|syscall.FILE_SHARE_DELETE,
+		FILE_OPEN,
+		FILE_OPEN_REPARSE_POINT)
+	if err != nil {
+		return nil, &os.PathError{Op: "stat", Path: filepath.Join(root.Name(), path), Err: err}
+	}
+	defer f.Close()
+	return f.Stat()
+}
+
+// EnsureNotReparsePointRelative validates that a given file (relative to a
+// root) and all intermediate path components are not a reparse points.
+func EnsureNotReparsePointRelative(path string, root *os.File) error {
+	// Perform an open with OBJ_DONT_REPARSE but without specifying FILE_OPEN_REPARSE_POINT.
+	f, err := OpenRelative(
+		path,
+		root,
+		0,
+		syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE|syscall.FILE_SHARE_DELETE,
+		FILE_OPEN,
+		0)
+	if err != nil {
+		return err
+	}
+	f.Close()
+	return nil
+}

vendor/github.com/Microsoft/hcsshim/internal/safefile/safeopen_admin_test.go

@@ -0,0 +1,125 @@
+// +build admin
+
+package safefile
+
+import (
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+func TestOpenRelative(t *testing.T) {
+	badroot, err := tempRoot()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(badroot.Name())
+	defer badroot.Close()
+
+	root, err := tempRoot()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(root.Name())
+	defer root.Close()
+
+	// Create a file
+	f, err := OpenRelative("foo", root, 0, syscall.FILE_SHARE_READ, FILE_CREATE, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	f.Close()
+
+	// Create a directory
+	err = MkdirRelative("dir", root)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Create a file in the bad root
+	f, err = os.Create(filepath.Join(badroot.Name(), "badfile"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	f.Close()
+
+	// Create a directory symlink to the bad root
+	err = os.Symlink(badroot.Name(), filepath.Join(root.Name(), "dsymlink"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Create a file symlink to the bad file
+	err = os.Symlink(filepath.Join(badroot.Name(), "badfile"), filepath.Join(root.Name(), "symlink"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Make sure opens cannot happen through the symlink
+	f, err = OpenRelative("dsymlink/foo", root, 0, syscall.FILE_SHARE_READ, FILE_CREATE, 0)
+	if err == nil {
+		f.Close()
+		t.Fatal("created file in wrong tree!")
+	}
+	t.Log(err)
+
+	// Check again using EnsureNotReparsePointRelative
+	err = EnsureNotReparsePointRelative("dsymlink", root)
+	if err == nil {
+		t.Fatal("reparse check should have failed")
+	}
+	t.Log(err)
+
+	// Make sure links work
+	err = LinkRelative("foo", root, "hardlink", root)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Even inside directories
+	err = LinkRelative("foo", root, "dir/bar", root)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Make sure links cannot happen through the symlink
+	err = LinkRelative("foo", root, "dsymlink/hardlink", root)
+	if err == nil {
+		f.Close()
+		t.Fatal("created link in wrong tree!")
+	}
+	t.Log(err)
+
+	// In either direction
+	err = LinkRelative("dsymlink/badfile", root, "bar", root)
+	if err == nil {
+		f.Close()
+		t.Fatal("created link in wrong tree!")
+	}
+	t.Log(err)
+
+	// Make sure remove cannot happen through the symlink
+	err = RemoveRelative("symlink/badfile", root)
+	if err == nil {
+		t.Fatal("remove in wrong tree!")
+	}
+
+	// Remove the symlink
+	err = RemoveAllRelative("symlink", root)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Make sure it's not possible to escape with .. (NT doesn't support .. at the kernel level)
+	f, err = OpenRelative("..", root, syscall.GENERIC_READ, syscall.FILE_SHARE_READ, FILE_OPEN, 0)
+	if err == nil {
+		t.Fatal("escaped the directory")
+	}
+	t.Log(err)
+
+	// Should not have touched the other directory
+	if _, err = os.Lstat(filepath.Join(badroot.Name(), "badfile")); err != nil {
+		t.Fatal(err)
+	}
+}

vendor/github.com/Microsoft/hcsshim/internal/safefile/safeopen_test.go

@@ -0,0 +1,53 @@
+package safefile
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+
+	winio "github.com/Microsoft/go-winio"
+)
+
+func tempRoot() (*os.File, error) {
+	name, err := ioutil.TempDir("", "hcsshim-test")
+	if err != nil {
+		return nil, err
+	}
+	f, err := OpenRoot(name)
+	if err != nil {
+		os.Remove(name)
+		return nil, err
+	}
+	return f, nil
+}
+
+func TestRemoveRelativeReadOnly(t *testing.T) {
+	root, err := tempRoot()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(root.Name())
+	defer root.Close()
+
+	p := filepath.Join(root.Name(), "foo")
+	f, err := os.Create(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+
+	bi := winio.FileBasicInfo{}
+	bi.FileAttributes = syscall.FILE_ATTRIBUTE_READONLY
+	err = winio.SetFileBasicInfo(f, &bi)
+	if err != nil {
+		t.Fatal(err)
+	}
+	f.Close()
+
+	err = RemoveRelative("foo", root)
+	if err != nil {
+		t.Fatal(err)
+	}
+}

vendor/github.com/Microsoft/hcsshim/internal/safefile/zsyscall_windows.go

@@ -0,0 +1,79 @@
+// Code generated by 'go generate'; DO NOT EDIT.
+
+package safefile
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+var _ unsafe.Pointer
+
+// Do the interface allocations only once for common
+// Errno values.
+const (
+	errnoERROR_IO_PENDING = 997
+)
+
+var (
+	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
+)
+
+// errnoErr returns common boxed Errno values, to prevent
+// allocations at runtime.
+func errnoErr(e syscall.Errno) error {
+	switch e {
+	case 0:
+		return nil
+	case errnoERROR_IO_PENDING:
+		return errERROR_IO_PENDING
+	}
+	// TODO: add more here, after collecting data on the common
+	// error values see on Windows. (perhaps when running
+	// all.bat?)
+	return e
+}
+
+var (
+	modntdll    = windows.NewLazySystemDLL("ntdll.dll")
+	modkernel32 = windows.NewLazySystemDLL("kernel32.dll")
+
+	procNtCreateFile               = modntdll.NewProc("NtCreateFile")
+	procNtSetInformationFile       = modntdll.NewProc("NtSetInformationFile")
+	procRtlNtStatusToDosErrorNoTeb = modntdll.NewProc("RtlNtStatusToDosErrorNoTeb")
+	procLocalAlloc                 = modkernel32.NewProc("LocalAlloc")
+	procLocalFree                  = modkernel32.NewProc("LocalFree")
+)
+
+func ntCreateFile(handle *uintptr, accessMask uint32, oa *objectAttributes, iosb *ioStatusBlock, allocationSize *uint64, fileAttributes uint32, shareAccess uint32, createDisposition uint32, createOptions uint32, eaBuffer *byte, eaLength uint32) (status uint32) {
+	r0, _, _ := syscall.Syscall12(procNtCreateFile.Addr(), 11, uintptr(unsafe.Pointer(handle)), uintptr(accessMask), uintptr(unsafe.Pointer(oa)), uintptr(unsafe.Pointer(iosb)), uintptr(unsafe.Pointer(allocationSize)), uintptr(fileAttributes), uintptr(shareAccess), uintptr(createDisposition), uintptr(createOptions), uintptr(unsafe.Pointer(eaBuffer)), uintptr(eaLength), 0)
+	status = uint32(r0)
+	return
+}
+
+func ntSetInformationFile(handle uintptr, iosb *ioStatusBlock, information uintptr, length uint32, class uint32) (status uint32) {
+	r0, _, _ := syscall.Syscall6(procNtSetInformationFile.Addr(), 5, uintptr(handle), uintptr(unsafe.Pointer(iosb)), uintptr(information), uintptr(length), uintptr(class), 0)
+	status = uint32(r0)
+	return
+}
+
+func rtlNtStatusToDosError(status uint32) (winerr error) {
+	r0, _, _ := syscall.Syscall(procRtlNtStatusToDosErrorNoTeb.Addr(), 1, uintptr(status), 0, 0)
+	if r0 != 0 {
+		winerr = syscall.Errno(r0)
+	}
+	return
+}
+
+func localAlloc(flags uint32, size int) (ptr uintptr) {
+	r0, _, _ := syscall.Syscall(procLocalAlloc.Addr(), 2, uintptr(flags), uintptr(size), 0)
+	ptr = uintptr(r0)
+	return
+}
+
+func localFree(ptr uintptr) {
+	syscall.Syscall(procLocalFree.Addr(), 1, uintptr(ptr), 0, 0)
+	return
+}

vendor/github.com/Microsoft/hcsshim/internal/schema1/schema1.go

@@ -0,0 +1,245 @@
+package schema1
+
+import (
+	"encoding/json"
+	"time"
+
+	"github.com/Microsoft/hcsshim/internal/schema2"
+)
+
+// ProcessConfig is used as both the input of Container.CreateProcess
+// and to convert the parameters to JSON for passing onto the HCS
+type ProcessConfig struct {
+	ApplicationName   string            `json:",omitempty"`
+	CommandLine       string            `json:",omitempty"`
+	CommandArgs       []string          `json:",omitempty"` // Used by Linux Containers on Windows
+	User              string            `json:",omitempty"`
+	WorkingDirectory  string            `json:",omitempty"`
+	Environment       map[string]string `json:",omitempty"`
+	EmulateConsole    bool              `json:",omitempty"`
+	CreateStdInPipe   bool              `json:",omitempty"`
+	CreateStdOutPipe  bool              `json:",omitempty"`
+	CreateStdErrPipe  bool              `json:",omitempty"`
+	ConsoleSize       [2]uint           `json:",omitempty"`
+	CreateInUtilityVm bool              `json:",omitempty"` // Used by Linux Containers on Windows
+	OCISpecification  *json.RawMessage  `json:",omitempty"` // Used by Linux Containers on Windows
+}
+
+type Layer struct {
+	ID   string
+	Path string
+}
+
+type MappedDir struct {
+	HostPath          string
+	ContainerPath     string
+	ReadOnly          bool
+	BandwidthMaximum  uint64
+	IOPSMaximum       uint64
+	CreateInUtilityVM bool
+	// LinuxMetadata - Support added in 1803/RS4+.
+	LinuxMetadata bool `json:",omitempty"`
+}
+
+type MappedPipe struct {
+	HostPath          string
+	ContainerPipeName string
+}
+
+type HvRuntime struct {
+	ImagePath           string `json:",omitempty"`
+	SkipTemplate        bool   `json:",omitempty"`
+	LinuxInitrdFile     string `json:",omitempty"` // File under ImagePath on host containing an initrd image for starting a Linux utility VM
+	LinuxKernelFile     string `json:",omitempty"` // File under ImagePath on host containing a kernel for starting a Linux utility VM
+	LinuxBootParameters string `json:",omitempty"` // Additional boot parameters for starting a Linux Utility VM in initrd mode
+	BootSource          string `json:",omitempty"` // "Vhd" for Linux Utility VM booting from VHD
+	WritableBootSource  bool   `json:",omitempty"` // Linux Utility VM booting from VHD
+}
+
+type MappedVirtualDisk struct {
+	HostPath          string `json:",omitempty"` // Path to VHD on the host
+	ContainerPath     string // Platform-specific mount point path in the container
+	CreateInUtilityVM bool   `json:",omitempty"`
+	ReadOnly          bool   `json:",omitempty"`
+	Cache             string `json:",omitempty"` // "" (Unspecified); "Disabled"; "Enabled"; "Private"; "PrivateAllowSharing"
+	AttachOnly        bool   `json:",omitempty:`
+}
+
+// AssignedDevice represents a device that has been directly assigned to a container
+//
+// NOTE: Support added in RS5
+type AssignedDevice struct {
+	//  InterfaceClassGUID of the device to assign to container.
+	InterfaceClassGUID string `json:"InterfaceClassGuid,omitempty"`
+}
+
+// ContainerConfig is used as both the input of CreateContainer
+// and to convert the parameters to JSON for passing onto the HCS
+type ContainerConfig struct {
+	SystemType                  string              // HCS requires this to be hard-coded to "Container"
+	Name                        string              // Name of the container. We use the docker ID.
+	Owner                       string              `json:",omitempty"` // The management platform that created this container
+	VolumePath                  string              `json:",omitempty"` // Windows volume path for scratch space. Used by Windows Server Containers only. Format \\?\\Volume{GUID}
+	IgnoreFlushesDuringBoot     bool                `json:",omitempty"` // Optimization hint for container startup in Windows
+	LayerFolderPath             string              `json:",omitempty"` // Where the layer folders are located. Used by Windows Server Containers only. Format  %root%\windowsfilter\containerID
+	Layers                      []Layer             // List of storage layers. Required for Windows Server and Hyper-V Containers. Format ID=GUID;Path=%root%\windowsfilter\layerID
+	Credentials                 string              `json:",omitempty"` // Credentials information
+	ProcessorCount              uint32              `json:",omitempty"` // Number of processors to assign to the container.
+	ProcessorWeight             uint64              `json:",omitempty"` // CPU shares (relative weight to other containers with cpu shares). Range is from 1 to 10000. A value of 0 results in default shares.
+	ProcessorMaximum            int64               `json:",omitempty"` // Specifies the portion of processor cycles that this container can use as a percentage times 100. Range is from 1 to 10000. A value of 0 results in no limit.
+	StorageIOPSMaximum          uint64              `json:",omitempty"` // Maximum Storage IOPS
+	StorageBandwidthMaximum     uint64              `json:",omitempty"` // Maximum Storage Bandwidth in bytes per second
+	StorageSandboxSize          uint64              `json:",omitempty"` // Size in bytes that the container system drive should be expanded to if smaller
+	MemoryMaximumInMB           int64               `json:",omitempty"` // Maximum memory available to the container in Megabytes
+	HostName                    string              `json:",omitempty"` // Hostname
+	MappedDirectories           []MappedDir         `json:",omitempty"` // List of mapped directories (volumes/mounts)
+	MappedPipes                 []MappedPipe        `json:",omitempty"` // List of mapped Windows named pipes
+	HvPartition                 bool                // True if it a Hyper-V Container
+	NetworkSharedContainerName  string              `json:",omitempty"` // Name (ID) of the container that we will share the network stack with.
+	EndpointList                []string            `json:",omitempty"` // List of networking endpoints to be attached to container
+	HvRuntime                   *HvRuntime          `json:",omitempty"` // Hyper-V container settings. Used by Hyper-V containers only. Format ImagePath=%root%\BaseLayerID\UtilityVM
+	Servicing                   bool                `json:",omitempty"` // True if this container is for servicing
+	AllowUnqualifiedDNSQuery    bool                `json:",omitempty"` // True to allow unqualified DNS name resolution
+	DNSSearchList               string              `json:",omitempty"` // Comma seperated list of DNS suffixes to use for name resolution
+	ContainerType               string              `json:",omitempty"` // "Linux" for Linux containers on Windows. Omitted otherwise.
+	TerminateOnLastHandleClosed bool                `json:",omitempty"` // Should HCS terminate the container once all handles have been closed
+	MappedVirtualDisks          []MappedVirtualDisk `json:",omitempty"` // Array of virtual disks to mount at start
+	AssignedDevices             []AssignedDevice    `json:",omitempty"` // Array of devices to assign. NOTE: Support added in RS5
+}
+
+type ComputeSystemQuery struct {
+	IDs    []string `json:"Ids,omitempty"`
+	Types  []string `json:",omitempty"`
+	Names  []string `json:",omitempty"`
+	Owners []string `json:",omitempty"`
+}
+
+type PropertyType string
+
+const (
+	PropertyTypeStatistics        PropertyType = "Statistics"        // V1 and V2
+	PropertyTypeProcessList                    = "ProcessList"       // V1 and V2
+	PropertyTypeMappedVirtualDisk              = "MappedVirtualDisk" // Not supported in V2 schema call
+	PropertyTypeGuestConnection                = "GuestConnection"   // V1 and V2. Nil return from HCS before RS5
+)
+
+type PropertyQuery struct {
+	PropertyTypes []PropertyType `json:",omitempty"`
+}
+
+// ContainerProperties holds the properties for a container and the processes running in that container
+type ContainerProperties struct {
+	ID                           string `json:"Id"`
+	State                        string
+	Name                         string
+	SystemType                   string
+	Owner                        string
+	SiloGUID                     string                              `json:"SiloGuid,omitempty"`
+	RuntimeID                    string                              `json:"RuntimeId,omitempty"`
+	IsRuntimeTemplate            bool                                `json:",omitempty"`
+	RuntimeImagePath             string                              `json:",omitempty"`
+	Stopped                      bool                                `json:",omitempty"`
+	ExitType                     string                              `json:",omitempty"`
+	AreUpdatesPending            bool                                `json:",omitempty"`
+	ObRoot                       string                              `json:",omitempty"`
+	Statistics                   Statistics                          `json:",omitempty"`
+	ProcessList                  []ProcessListItem                   `json:",omitempty"`
+	MappedVirtualDiskControllers map[int]MappedVirtualDiskController `json:",omitempty"`
+	GuestConnectionInfo          GuestConnectionInfo                 `json:",omitempty"`
+}
+
+// MemoryStats holds the memory statistics for a container
+type MemoryStats struct {
+	UsageCommitBytes            uint64 `json:"MemoryUsageCommitBytes,omitempty"`
+	UsageCommitPeakBytes        uint64 `json:"MemoryUsageCommitPeakBytes,omitempty"`
+	UsagePrivateWorkingSetBytes uint64 `json:"MemoryUsagePrivateWorkingSetBytes,omitempty"`
+}
+
+// ProcessorStats holds the processor statistics for a container
+type ProcessorStats struct {
+	TotalRuntime100ns  uint64 `json:",omitempty"`
+	RuntimeUser100ns   uint64 `json:",omitempty"`
+	RuntimeKernel100ns uint64 `json:",omitempty"`
+}
+
+// StorageStats holds the storage statistics for a container
+type StorageStats struct {
+	ReadCountNormalized  uint64 `json:",omitempty"`
+	ReadSizeBytes        uint64 `json:",omitempty"`
+	WriteCountNormalized uint64 `json:",omitempty"`
+	WriteSizeBytes       uint64 `json:",omitempty"`
+}
+
+// NetworkStats holds the network statistics for a container
+type NetworkStats struct {
+	BytesReceived          uint64 `json:",omitempty"`
+	BytesSent              uint64 `json:",omitempty"`
+	PacketsReceived        uint64 `json:",omitempty"`
+	PacketsSent            uint64 `json:",omitempty"`
+	DroppedPacketsIncoming uint64 `json:",omitempty"`
+	DroppedPacketsOutgoing uint64 `json:",omitempty"`
+	EndpointId             string `json:",omitempty"`
+	InstanceId             string `json:",omitempty"`
+}
+
+// Statistics is the structure returned by a statistics call on a container
+type Statistics struct {
+	Timestamp          time.Time      `json:",omitempty"`
+	ContainerStartTime time.Time      `json:",omitempty"`
+	Uptime100ns        uint64         `json:",omitempty"`
+	Memory             MemoryStats    `json:",omitempty"`
+	Processor          ProcessorStats `json:",omitempty"`
+	Storage            StorageStats   `json:",omitempty"`
+	Network            []NetworkStats `json:",omitempty"`
+}
+
+// ProcessList is the structure of an item returned by a ProcessList call on a container
+type ProcessListItem struct {
+	CreateTimestamp              time.Time `json:",omitempty"`
+	ImageName                    string    `json:",omitempty"`
+	KernelTime100ns              uint64    `json:",omitempty"`
+	MemoryCommitBytes            uint64    `json:",omitempty"`
+	MemoryWorkingSetPrivateBytes uint64    `json:",omitempty"`
+	MemoryWorkingSetSharedBytes  uint64    `json:",omitempty"`
+	ProcessId                    uint32    `json:",omitempty"`
+	UserTime100ns                uint64    `json:",omitempty"`
+}
+
+// MappedVirtualDiskController is the structure of an item returned by a MappedVirtualDiskList call on a container
+type MappedVirtualDiskController struct {
+	MappedVirtualDisks map[int]MappedVirtualDisk `json:",omitempty"`
+}
+
+// GuestDefinedCapabilities is part of the GuestConnectionInfo returned by a GuestConnection call on a utility VM
+type GuestDefinedCapabilities struct {
+	NamespaceAddRequestSupported bool `json:",omitempty"`
+	SignalProcessSupported       bool `json:",omitempty"`
+}
+
+// GuestConnectionInfo is the structure of an iterm return by a GuestConnection call on a utility VM
+type GuestConnectionInfo struct {
+	SupportedSchemaVersions  []hcsschema.Version      `json:",omitempty"`
+	ProtocolVersion          uint32                   `json:",omitempty"`
+	GuestDefinedCapabilities GuestDefinedCapabilities `json:",omitempty"`
+}
+
+// Type of Request Support in ModifySystem
+type RequestType string
+
+// Type of Resource Support in ModifySystem
+type ResourceType string
+
+// RequestType const
+const (
+	Add     RequestType  = "Add"
+	Remove  RequestType  = "Remove"
+	Network ResourceType = "Network"
+)
+
+// ResourceModificationRequestResponse is the structure used to send request to the container to modify the system
+// Supported resource types are Network and Request Types are Add/Remove
+type ResourceModificationRequestResponse struct {
+	Resource ResourceType `json:"ResourceType"`
+	Data     interface{}  `json:"Settings"`
+	Request  RequestType  `json:"RequestType,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/attachment.go

@@ -0,0 +1,31 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type Attachment struct {
+
+	Type_ string `json:"Type,omitempty"`
+
+	Path string `json:"Path,omitempty"`
+
+	IgnoreFlushes bool `json:"IgnoreFlushes,omitempty"`
+
+	CachingMode string `json:"CachingMode,omitempty"`
+
+	NoWriteHardening bool `json:"NoWriteHardening,omitempty"`
+
+	DisableExpansionOptimization bool `json:"DisableExpansionOptimization,omitempty"`
+
+	IgnoreRelativeLocator bool `json:"IgnoreRelativeLocator,omitempty"`
+
+	CaptureIoAttributionContext bool `json:"CaptureIoAttributionContext,omitempty"`
+
+	ReadOnly bool `json:"ReadOnly,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/battery.go

@@ -0,0 +1,13 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type Battery struct {
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/cache_query_stats_response.go

@@ -0,0 +1,19 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type CacheQueryStatsResponse struct {
+
+	L3OccupancyBytes int32 `json:"L3OccupancyBytes,omitempty"`
+
+	L3TotalBwBytes int32 `json:"L3TotalBwBytes,omitempty"`
+
+	L3LocalBwBytes int32 `json:"L3LocalBwBytes,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/chipset.go

@@ -0,0 +1,27 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type Chipset struct {
+	Uefi *Uefi `json:"Uefi,omitempty"`
+
+	IsNumLockDisabled bool `json:"IsNumLockDisabled,omitempty"`
+
+	BaseBoardSerialNumber string `json:"BaseBoardSerialNumber,omitempty"`
+
+	ChassisSerialNumber string `json:"ChassisSerialNumber,omitempty"`
+
+	ChassisAssetTag string `json:"ChassisAssetTag,omitempty"`
+
+	UseUtc bool `json:"UseUtc,omitempty"`
+
+	// LinuxKernelDirect - Added in v2.2 Builds >=181117
+	LinuxKernelDirect *LinuxKernelDirect `json:"LinuxKernelDirect,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/close_handle.go

@@ -0,0 +1,15 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type CloseHandle struct {
+
+	Handle string `json:"Handle,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/com_port.go

@@ -0,0 +1,18 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+//  ComPort specifies the named pipe that will be used for the port, with empty string indicating a disconnected port.
+type ComPort struct {
+
+	NamedPipe string `json:"NamedPipe,omitempty"`
+
+	OptimizeForDebugger bool `json:"OptimizeForDebugger,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/compute_system.go

@@ -0,0 +1,27 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type ComputeSystem struct {
+
+	Owner string `json:"Owner,omitempty"`
+
+	SchemaVersion *Version `json:"SchemaVersion,omitempty"`
+
+	HostingSystemId string `json:"HostingSystemId,omitempty"`
+
+	HostedSystem *HostedSystem `json:"HostedSystem,omitempty"`
+
+	Container *Container `json:"Container,omitempty"`
+
+	VirtualMachine *VirtualMachine `json:"VirtualMachine,omitempty"`
+
+	ShouldTerminateOnLastHandleClosed bool `json:"ShouldTerminateOnLastHandleClosed,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/configuration.go

@@ -0,0 +1,72 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+import (
+	"net/http"
+)
+
+// contextKeys are used to identify the type of value in the context.
+// Since these are string, it is possible to get a short description of the
+// context key for logging and debugging using key.String().
+
+type contextKey string
+
+func (c contextKey) String() string {
+	return "auth " + string(c)
+}
+
+var (
+	// ContextOAuth2 takes a oauth2.TokenSource as authentication for the request.
+	ContextOAuth2    	= contextKey("token")
+
+	// ContextBasicAuth takes BasicAuth as authentication for the request.
+	ContextBasicAuth 	= contextKey("basic")
+
+	// ContextAccessToken takes a string oauth2 access token as authentication for the request.
+	ContextAccessToken 	= contextKey("accesstoken")
+
+	// ContextAPIKey takes an APIKey as authentication for the request
+ 	ContextAPIKey 		= contextKey("apikey")
+)
+
+// BasicAuth provides basic http authentication to a request passed via context using ContextBasicAuth 
+type BasicAuth struct {
+	UserName      string            `json:"userName,omitempty"`
+	Password      string            `json:"password,omitempty"`	
+}
+
+// APIKey provides API key based authentication to a request passed via context using ContextAPIKey
+type APIKey struct {
+	Key 	string
+	Prefix	string
+}
+
+type Configuration struct {
+	BasePath      string            	`json:"basePath,omitempty"`
+	Host          string            	`json:"host,omitempty"`
+	Scheme        string            	`json:"scheme,omitempty"`
+	DefaultHeader map[string]string 	`json:"defaultHeader,omitempty"`
+	UserAgent     string            	`json:"userAgent,omitempty"`
+	HTTPClient 	  *http.Client
+}
+
+func NewConfiguration() *Configuration {
+	cfg := &Configuration{
+		BasePath:      "https://localhost",
+		DefaultHeader: make(map[string]string),
+		UserAgent:     "Swagger-Codegen/2.1.0/go",
+	}
+	return cfg
+}
+
+func (c *Configuration) AddDefaultHeader(key string, value string) {
+	c.DefaultHeader[key] = value
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/console_size.go

@@ -0,0 +1,17 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type ConsoleSize struct {
+
+	Height int32 `json:"Height,omitempty"`
+
+	Width int32 `json:"Width,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/container.go

@@ -0,0 +1,35 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type Container struct {
+
+	GuestOs *GuestOs `json:"GuestOs,omitempty"`
+
+	Storage *Storage `json:"Storage,omitempty"`
+
+	MappedDirectories []MappedDirectory `json:"MappedDirectories,omitempty"`
+
+	MappedPipes []MappedPipe `json:"MappedPipes,omitempty"`
+
+	Memory *Memory `json:"Memory,omitempty"`
+
+	Processor *Processor `json:"Processor,omitempty"`
+
+	Networking *Networking `json:"Networking,omitempty"`
+
+	HvSocket *HvSocket `json:"HvSocket,omitempty"`
+
+	ContainerCredentialGuard *ContainerCredentialGuardState `json:"ContainerCredentialGuard,omitempty"`
+
+	RegistryChanges *RegistryChanges `json:"RegistryChanges,omitempty"`
+
+	AssignedDevices []Device `json:"AssignedDevices,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/container_credential_guard_state.go

@@ -0,0 +1,25 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type ContainerCredentialGuardState struct {
+
+	//  Authentication cookie for calls to a Container Credential Guard instance.
+	Cookie string `json:"Cookie,omitempty"`
+
+	//  Name of the RPC endpoint of the Container Credential Guard instance.
+	RpcEndpoint string `json:"RpcEndpoint,omitempty"`
+
+	//  Transport used for the configured Container Credential Guard instance.
+	Transport string `json:"Transport,omitempty"`
+
+	//  Credential spec used for the configured Container Credential Guard instance.
+	CredentialSpec string `json:"CredentialSpec,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/container_memory_information.go

@@ -0,0 +1,26 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+//  memory usage as viewed from within the container
+type ContainerMemoryInformation struct {
+
+	TotalPhysicalBytes int32 `json:"TotalPhysicalBytes,omitempty"`
+
+	TotalUsage int32 `json:"TotalUsage,omitempty"`
+
+	CommittedBytes int32 `json:"CommittedBytes,omitempty"`
+
+	SharedCommittedBytes int32 `json:"SharedCommittedBytes,omitempty"`
+
+	CommitLimitBytes int32 `json:"CommitLimitBytes,omitempty"`
+
+	PeakCommitmentBytes int32 `json:"PeakCommitmentBytes,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/device.go

@@ -0,0 +1,16 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type Device struct {
+
+	//  The interface class guid of the device to assign to container.
+	InterfaceClassGuid string `json:"InterfaceClassGuid,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/devices.go

@@ -0,0 +1,43 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type Devices struct {
+
+	ComPorts map[string]ComPort `json:"ComPorts,omitempty"`
+
+	Scsi map[string]Scsi `json:"Scsi,omitempty"`
+
+	VirtualPMem *VirtualPMemController `json:"VirtualPMem,omitempty"`
+
+	NetworkAdapters map[string]NetworkAdapter `json:"NetworkAdapters,omitempty"`
+
+	VideoMonitor *VideoMonitor `json:"VideoMonitor,omitempty"`
+
+	Keyboard *Keyboard `json:"Keyboard,omitempty"`
+
+	Mouse *Mouse `json:"Mouse,omitempty"`
+
+	HvSocket *HvSocket2 `json:"HvSocket,omitempty"`
+
+	EnhancedModeVideo *EnhancedModeVideo `json:"EnhancedModeVideo,omitempty"`
+
+	GuestCrashReporting *GuestCrashReporting `json:"GuestCrashReporting,omitempty"`
+
+	VirtualSmb *VirtualSmb `json:"VirtualSmb,omitempty"`
+
+	Plan9 *Plan9 `json:"Plan9,omitempty"`
+
+	Battery *Battery `json:"Battery,omitempty"`
+
+	FlexibleIov map[string]FlexibleIoDevice `json:"FlexibleIov,omitempty"`
+
+	SharedMemory *SharedMemoryConfiguration `json:"SharedMemory,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/enhanced_mode_video.go

@@ -0,0 +1,15 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type EnhancedModeVideo struct {
+
+	ConnectionOptions *RdpConnectionOptions `json:"ConnectionOptions,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/flexible_io_device.go

@@ -0,0 +1,19 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type FlexibleIoDevice struct {
+
+	EmulatorId string `json:"EmulatorId,omitempty"`
+
+	HostingModel string `json:"HostingModel,omitempty"`
+
+	Configuration []string `json:"Configuration,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/guest_connection.go

@@ -0,0 +1,19 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type GuestConnection struct {
+
+	//  Use Vsock rather than Hyper-V sockets to communicate with the guest service.
+	UseVsock bool `json:"UseVsock,omitempty"`
+
+	//  Don't disconnect the guest connection when pausing the virtual machine.
+	UseConnectedSuspend bool `json:"UseConnectedSuspend,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/guest_connection_info.go

@@ -0,0 +1,21 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+//  Information about the guest.
+type GuestConnectionInfo struct {
+
+	//  Each schema version x.y stands for the range of versions a.b where a==x  and b<=y. This list comes from the SupportedSchemaVersions field in  GcsCapabilities.
+	SupportedSchemaVersions []Version `json:"SupportedSchemaVersions,omitempty"`
+
+	ProtocolVersion int32 `json:"ProtocolVersion,omitempty"`
+
+	GuestDefinedCapabilities *interface{} `json:"GuestDefinedCapabilities,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/guest_crash_reporting.go

@@ -0,0 +1,15 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type GuestCrashReporting struct {
+
+	WindowsCrashSettings *WindowsCrashReporting `json:"WindowsCrashSettings,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/guest_os.go

@@ -0,0 +1,15 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type GuestOs struct {
+
+	HostName string `json:"HostName,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/guest_state.go

@@ -0,0 +1,22 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type GuestState struct {
+
+	//  The path to an existing file uses for persistent guest state storage.  An empty string indicates the system should initialize new transient, in-memory guest state.
+	GuestStateFilePath string `json:"GuestStateFilePath,omitempty"`
+
+	//  The path to an existing file for persistent runtime state storage.  An empty string indicates the system should initialize new transient, in-memory runtime state.
+	RuntimeStateFilePath string `json:"RuntimeStateFilePath,omitempty"`
+
+	//  If true, the guest state and runtime state files will be used as templates  to populate transient, in-memory state instead of using the files as persistent backing store.
+	ForceTransientState bool `json:"ForceTransientState,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/hosted_system.go

@@ -0,0 +1,17 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type HostedSystem struct {
+
+	SchemaVersion *Version `json:"SchemaVersion,omitempty"`
+
+	Container *Container `json:"Container,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/hv_socket.go

@@ -0,0 +1,17 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type HvSocket struct {
+
+	Config *HvSocketSystemConfig `json:"Config,omitempty"`
+
+	EnablePowerShellDirect bool `json:"EnablePowerShellDirect,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/hv_socket_2.go

@@ -0,0 +1,16 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+//  HvSocket configuration for a VM
+type HvSocket2 struct {
+
+	HvSocketConfig *HvSocketSystemConfig `json:"HvSocketConfig,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/hv_socket_service_config.go

@@ -0,0 +1,22 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type HvSocketServiceConfig struct {
+
+	//  SDDL string that HvSocket will check before allowing a host process to bind  to this specific service.  If not specified, defaults to the system DefaultBindSecurityDescriptor, defined in  HvSocketSystemWpConfig in V1.
+	BindSecurityDescriptor string `json:"BindSecurityDescriptor,omitempty"`
+
+	//  SDDL string that HvSocket will check before allowing a host process to connect  to this specific service.  If not specified, defaults to the system DefaultConnectSecurityDescriptor, defined in  HvSocketSystemWpConfig in V1.
+	ConnectSecurityDescriptor string `json:"ConnectSecurityDescriptor,omitempty"`
+
+	//  If true, HvSocket will process wildcard binds for this service/system combination.  Wildcard binds are secured in the registry at  SOFTWARE/Microsoft/Windows NT/CurrentVersion/Virtualization/HvSocket/WildcardDescriptors
+	AllowWildcardBinds bool `json:"AllowWildcardBinds,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/hv_socket_system_config.go

@@ -0,0 +1,22 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+//  This is the HCS Schema version of the HvSocket configuration. The VMWP version is  located in Config.Devices.IC in V1.
+type HvSocketSystemConfig struct {
+
+	//  SDDL string that HvSocket will check before allowing a host process to bind  to an unlisted service for this specific container/VM (not wildcard binds).
+	DefaultBindSecurityDescriptor string `json:"DefaultBindSecurityDescriptor,omitempty"`
+
+	//  SDDL string that HvSocket will check before allowing a host process to connect  to an unlisted service in the VM/container.
+	DefaultConnectSecurityDescriptor string `json:"DefaultConnectSecurityDescriptor,omitempty"`
+
+	ServiceTable map[string]HvSocketServiceConfig `json:"ServiceTable,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/keyboard.go

@@ -0,0 +1,13 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type Keyboard struct {
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/layer.go

@@ -0,0 +1,22 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type Layer struct {
+
+	Id string `json:"Id,omitempty"`
+
+	Path string `json:"Path,omitempty"`
+
+	PathType string `json:"PathType,omitempty"`
+
+	//  Unspecified defaults to Enabled
+	Cache string `json:"Cache,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/linux_kernel_direct.go

@@ -0,0 +1,18 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.2
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type LinuxKernelDirect struct {
+	KernelFilePath string `json:"KernelFilePath,omitempty"`
+
+	InitRdPath string `json:"InitRdPath,omitempty"`
+
+	KernelCmdLine string `json:"KernelCmdLine,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/mapped_directory.go

@@ -0,0 +1,21 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type MappedDirectory struct {
+
+	HostPath string `json:"HostPath,omitempty"`
+
+	HostPathType string `json:"HostPathType,omitempty"`
+
+	ContainerPath string `json:"ContainerPath,omitempty"`
+
+	ReadOnly bool `json:"ReadOnly,omitempty"`
+}

vendor/github.com/Microsoft/hcsshim/internal/schema2/mapped_pipe.go

@@ -0,0 +1,19 @@
+/*
+ * HCS API
+ *
+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)
+ *
+ * API version: 2.1
+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)
+ */
+
+package hcsschema
+
+type MappedPipe struct {
+
+	ContainerPipeName string `json:"ContainerPipeName,omitempty"`
+
+	HostPath string `json:"HostPath,omitempty"`
+
+	HostPathType string `json:"HostPathType,omitempty"`
+}