Update containerd to 59a625defb

Signed-off-by: Lantao Liu <lantaol@google.com>

vendor.conf

@@ -5,11 +5,12 @@ github.com/docker/docker 86f080cff0914e9694068ed78d503701667c4c00
 github.com/docker/distribution 0d3efadf0154c2b8a4e7b6621fff9809655cc580
 
 # containerd dependencies
-go.etcd.io/bbolt 2eb7227adea1d5cf85f0bc2a82b7059b13c2fa68
+go.opencensus.io v0.22.0
-google.golang.org/grpc 25c4f928eaa6d96443009bd842389fb4fa48664e # v1.20.1
+go.etcd.io/bbolt v1.3.3
+google.golang.org/grpc 6eaf6f47437a6b4e2153a190160ef39a92c7eceb # v1.23.0
 google.golang.org/genproto d80a6e20e776b0b17a324d0ba1ab50a39c8e8944
 golang.org/x/text 19e51611da83d6be54ddafce4a4af510cb3e9ea4
-golang.org/x/sys 4c4f7f33c9ed00de01c4c741d2177abfcfe19307 https://github.com/golang/sys
+golang.org/x/sys fb81701db80f1745f51259b1f286de3fe2ec80c8 https://github.com/golang/sys # TODO(windows): update this in containerd/containerd
 golang.org/x/sync 42b317875d0fa942474b76e1b46a6060d720ae6e
 golang.org/x/net f3200d17e092c607f615320ecaad13d87ad9a2b3
 github.com/urfave/cli 7bc6a0acffa589f415f88aca16cc1de5ffd66f9c
@@ -26,6 +27,8 @@ github.com/opencontainers/image-spec v1.0.1
 github.com/opencontainers/go-digest c9281466c8b2f606084ac71339773efd177436e7
 github.com/matttproud/golang_protobuf_extensions v1.0.1
 github.com/konsorten/go-windows-terminal-sequences v1.0.1
+github.com/imdario/mergo v0.3.7
+github.com/hashicorp/golang-lru v0.5.3
 github.com/grpc-ecosystem/go-grpc-prometheus v1.1
 github.com/google/uuid v1.1.1
 github.com/golang/protobuf v1.2.0
@@ -37,15 +40,15 @@ github.com/docker/go-metrics 4ea375f7759c82740c893fc030bc37088d2ec098
 github.com/docker/go-events 9461782956ad83b30282bf90e31fa6a70c255ba9
 github.com/coreos/go-systemd v14
 github.com/containerd/typeurl a93fcdb778cd272c6e9b3028b2f42d813e785d40
-github.com/containerd/ttrpc 1fb3814edf44a76e0ccf503decf726d994919a9a
+github.com/containerd/ttrpc 92c8520ef9f86600c650dd540266a007bf03670f
 github.com/containerd/go-runc 9007c2405372fe28918845901a3276c0915689a1
-github.com/containerd/fifo 3d5202aec260678c48179c56f40e6f38a095738c
+github.com/containerd/fifo bda0ff6ed73c67bfb5e62bc9c697f146b7fd7f13
-github.com/containerd/continuity bd77b46c8352f74eb12c85bdc01f4b90f69d66b4
+github.com/containerd/continuity f2a389ac0a02ce21c09edd7344677a601970f41c
-github.com/containerd/containerd a3a30635ef713b544ea7feff0d12a768fd1ed636
+github.com/containerd/containerd 59a625defb21c958c25424fa5cc806167e22382e
 github.com/containerd/console 0650fd9eeb50bab4fc99dceb9f2e14cf58f36e7f
 github.com/containerd/cgroups c4b9ac5c7601384c965b9646fc515884e091ebb9
 github.com/beorn7/perks 4c0e84591b9aa9e6dcfdf3e020114cd81f89d5f9
-github.com/Microsoft/hcsshim 8abdbb8205e4192c68b5f84c31197156f31be517
+github.com/Microsoft/hcsshim 1354cb2e878d37d2f5c11595634290ea9e2600a1 # TODO(windows): update this in containerd/containerd
 github.com/Microsoft/go-winio v0.4.14
 github.com/BurntSushi/toml v0.3.1
 

vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/doc.go

@@ -0,0 +1 @@
+package options

vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.proto

@@ -0,0 +1,63 @@
+syntax = "proto3";
+
+package containerd.runhcs.v1;
+
+import weak "gogoproto/gogo.proto";
+import "google/protobuf/timestamp.proto";
+
+option go_package = "github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options;options";
+
+// Options are the set of customizations that can be passed at Create time.
+message Options {
+	// enable debug tracing
+	bool debug = 1;
+
+	enum DebugType {
+		NPIPE = 0;
+		FILE = 1;
+		ETW = 2;
+	}
+
+	// debug tracing output type
+	DebugType debug_type = 2;
+
+	// registry key root for storage of the runhcs container state
+	string registry_root = 3;
+
+	// sandbox_image is the image to use for the sandbox that matches the
+	// sandbox_platform.
+	string sandbox_image = 4;
+
+	// sandbox_platform is a CRI setting that specifies the platform
+	// architecture for all sandbox's in this runtime. Values are
+	// 'windows/amd64' and 'linux/amd64'.
+	string sandbox_platform = 5;
+
+	enum SandboxIsolation {
+		PROCESS = 0;
+		HYPERVISOR = 1;
+	}
+
+	// sandbox_isolation is a CRI setting that specifies the isolation level of
+	// the sandbox. For Windows runtime PROCESS and HYPERVISOR are valid. For
+	// LCOW only HYPERVISOR is valid and default if omitted.
+	SandboxIsolation sandbox_isolation = 6;
+
+	// boot_files_root_path is the path to the directory containing the LCOW
+	// kernel and root FS files.
+	string boot_files_root_path = 7;
+}
+
+// ProcessDetails contains additional information about a process. This is the additional
+// info returned in the Pids query.
+message ProcessDetails {
+	string image_name = 1;
+	google.protobuf.Timestamp created_at = 2 [(gogoproto.stdtime) = true, (gogoproto.nullable) = false];
+	uint64 kernel_time_100_ns = 3;
+	uint64 memory_commit_bytes = 4;
+	uint64 memory_working_set_private_bytes = 5;
+	uint64 memory_working_set_shared_bytes = 6;
+	uint32 process_id = 7;
+	uint64 user_time_100_ns = 8;
+	string exec_id = 9;
+}

vendor/github.com/Microsoft/hcsshim/container.go

@@ -1,8 +1,10 @@
 package hcsshim
 
 import (
+	"context"
 	"fmt"
 	"os"
+	"sync"
 	"time"
 
 	"github.com/Microsoft/hcsshim/internal/hcs"
@@ -52,7 +54,10 @@ const (
 type ResourceModificationRequestResponse = schema1.ResourceModificationRequestResponse
 
 type container struct {
-	system *hcs.System
+	system   *hcs.System
+	waitOnce sync.Once
+	waitErr  error
+	waitCh   chan struct{}
 }
 
 // createComputeSystemAdditionalJSON is read from the environment at initialisation
@@ -71,61 +76,87 @@ func CreateContainer(id string, c *ContainerConfig) (Container, error) {
 		return nil, fmt.Errorf("failed to merge additional JSON '%s': %s", createContainerAdditionalJSON, err)
 	}
 
-	system, err := hcs.CreateComputeSystem(id, fullConfig)
+	system, err := hcs.CreateComputeSystem(context.Background(), id, fullConfig)
 	if err != nil {
 		return nil, err
 	}
-	return &container{system}, err
+	return &container{system: system}, err
 }
 
 // OpenContainer opens an existing container by ID.
 func OpenContainer(id string) (Container, error) {
-	system, err := hcs.OpenComputeSystem(id)
+	system, err := hcs.OpenComputeSystem(context.Background(), id)
 	if err != nil {
 		return nil, err
 	}
-	return &container{system}, err
+	return &container{system: system}, err
 }
 
 // GetContainers gets a list of the containers on the system that match the query
 func GetContainers(q ComputeSystemQuery) ([]ContainerProperties, error) {
-	return hcs.GetComputeSystems(q)
+	return hcs.GetComputeSystems(context.Background(), q)
 }
 
 // Start synchronously starts the container.
 func (container *container) Start() error {
-	return convertSystemError(container.system.Start(), container)
+	return convertSystemError(container.system.Start(context.Background()), container)
 }
 
 // Shutdown requests a container shutdown, but it may not actually be shutdown until Wait() succeeds.
 func (container *container) Shutdown() error {
-	return convertSystemError(container.system.Shutdown(), container)
+	err := container.system.Shutdown(context.Background())
+	if err != nil {
+		return convertSystemError(err, container)
+	}
+	return &ContainerError{Container: container, Err: ErrVmcomputeOperationPending, Operation: "hcsshim::ComputeSystem::Shutdown"}
 }
 
 // Terminate requests a container terminate, but it may not actually be terminated until Wait() succeeds.
 func (container *container) Terminate() error {
-	return convertSystemError(container.system.Terminate(), container)
+	err := container.system.Terminate(context.Background())
+	if err != nil {
+		return convertSystemError(err, container)
+	}
+	return &ContainerError{Container: container, Err: ErrVmcomputeOperationPending, Operation: "hcsshim::ComputeSystem::Terminate"}
 }
 
 // Waits synchronously waits for the container to shutdown or terminate.
 func (container *container) Wait() error {
-	return convertSystemError(container.system.Wait(), container)
+	err := container.system.Wait()
+	if err == nil {
+		err = container.system.ExitError()
+	}
+	return convertSystemError(err, container)
 }
 
 // WaitTimeout synchronously waits for the container to terminate or the duration to elapse. It
 // returns false if timeout occurs.
-func (container *container) WaitTimeout(t time.Duration) error {
+func (container *container) WaitTimeout(timeout time.Duration) error {
-	return convertSystemError(container.system.WaitTimeout(t), container)
+	container.waitOnce.Do(func() {
+		container.waitCh = make(chan struct{})
+		go func() {
+			container.waitErr = container.Wait()
+			close(container.waitCh)
+		}()
+	})
+	t := time.NewTimer(timeout)
+	defer t.Stop()
+	select {
+	case <-t.C:
+		return &ContainerError{Container: container, Err: ErrTimeout, Operation: "hcsshim::ComputeSystem::Wait"}
+	case <-container.waitCh:
+		return container.waitErr
+	}
 }
 
 // Pause pauses the execution of a container.
 func (container *container) Pause() error {
-	return convertSystemError(container.system.Pause(), container)
+	return convertSystemError(container.system.Pause(context.Background()), container)
 }
 
 // Resume resumes the execution of a container.
 func (container *container) Resume() error {
-	return convertSystemError(container.system.Resume(), container)
+	return convertSystemError(container.system.Resume(context.Background()), container)
 }
 
 // HasPendingUpdates returns true if the container has updates pending to install
@@ -135,7 +166,7 @@ func (container *container) HasPendingUpdates() (bool, error) {
 
 // Statistics returns statistics for the container. This is a legacy v1 call
 func (container *container) Statistics() (Statistics, error) {
-	properties, err := container.system.Properties(schema1.PropertyTypeStatistics)
+	properties, err := container.system.Properties(context.Background(), schema1.PropertyTypeStatistics)
 	if err != nil {
 		return Statistics{}, convertSystemError(err, container)
 	}
@@ -145,7 +176,7 @@ func (container *container) Statistics() (Statistics, error) {
 
 // ProcessList returns an array of ProcessListItems for the container. This is a legacy v1 call
 func (container *container) ProcessList() ([]ProcessListItem, error) {
-	properties, err := container.system.Properties(schema1.PropertyTypeProcessList)
+	properties, err := container.system.Properties(context.Background(), schema1.PropertyTypeProcessList)
 	if err != nil {
 		return nil, convertSystemError(err, container)
 	}
@@ -155,7 +186,7 @@ func (container *container) ProcessList() ([]ProcessListItem, error) {
 
 // This is a legacy v1 call
 func (container *container) MappedVirtualDisks() (map[int]MappedVirtualDiskController, error) {
-	properties, err := container.system.Properties(schema1.PropertyTypeMappedVirtualDisk)
+	properties, err := container.system.Properties(context.Background(), schema1.PropertyTypeMappedVirtualDisk)
 	if err != nil {
 		return nil, convertSystemError(err, container)
 	}
@@ -165,20 +196,20 @@ func (container *container) MappedVirtualDisks() (map[int]MappedVirtualDiskContr
 
 // CreateProcess launches a new process within the container.
 func (container *container) CreateProcess(c *ProcessConfig) (Process, error) {
-	p, err := container.system.CreateProcess(c)
+	p, err := container.system.CreateProcessNoStdio(c)
 	if err != nil {
 		return nil, convertSystemError(err, container)
 	}
-	return &process{p}, nil
+	return &process{p: p.(*hcs.Process)}, nil
 }
 
 // OpenProcess gets an interface to an existing process within the container.
 func (container *container) OpenProcess(pid int) (Process, error) {
-	p, err := container.system.OpenProcess(pid)
+	p, err := container.system.OpenProcess(context.Background(), pid)
 	if err != nil {
 		return nil, convertSystemError(err, container)
 	}
-	return &process{p}, nil
+	return &process{p: p}, nil
 }
 
 // Close cleans up any state associated with the container but does not terminate or wait for it.
@@ -188,5 +219,5 @@ func (container *container) Close() error {
 
 // Modify the System
 func (container *container) Modify(config *ResourceModificationRequestResponse) error {
-	return convertSystemError(container.system.Modify(config), container)
+	return convertSystemError(container.system.Modify(context.Background(), config), container)
 }

vendor/github.com/Microsoft/hcsshim/go.mod

@@ -0,0 +1,39 @@
+module github.com/Microsoft/hcsshim
+
+go 1.12
+
+require (
+	github.com/Microsoft/go-winio v0.4.14
+	github.com/blang/semver v3.1.0+incompatible // indirect
+	github.com/containerd/console v0.0.0-20180822173158-c12b1e7919c1
+	github.com/containerd/containerd v1.3.0-beta.2.0.20190828155532-0293cbd26c69
+	github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc // indirect
+	github.com/containerd/fifo v0.0.0-20190226154929-a9fb20d87448 // indirect
+	github.com/containerd/go-runc v0.0.0-20180907222934-5a6d9f37cfa3
+	github.com/containerd/ttrpc v0.0.0-20190826154248-f969a7f076a2
+	github.com/containerd/typeurl v0.0.0-20180627222232-a93fcdb778cd
+	github.com/docker/distribution v2.7.1+incompatible // indirect
+	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
+	github.com/gogo/googleapis v1.2.0 // indirect
+	github.com/gogo/protobuf v1.2.1
+	github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce // indirect
+	github.com/hashicorp/go-multierror v0.0.0-20161216184304-ed905158d874 // indirect
+	github.com/opencontainers/go-digest v0.0.0-20180430190053-c9281466c8b2 // indirect
+	github.com/opencontainers/image-spec v1.0.1 // indirect
+	github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f // indirect
+	github.com/opencontainers/runtime-spec v0.0.0-20190207185410-29686dbc5559
+	github.com/opencontainers/runtime-tools v0.0.0-20181011054405-1d69bd0f9c39
+	github.com/pkg/errors v0.8.1
+	github.com/sirupsen/logrus v1.4.1
+	github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8 // indirect
+	github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5
+	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/xeipuuv/gojsonschema v0.0.0-20180618132009-1d523034197f // indirect
+	go.opencensus.io v0.22.0
+	golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6
+	golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b
+	google.golang.org/grpc v1.20.1
+	gotest.tools v2.2.0+incompatible // indirect
+	k8s.io/kubernetes v1.13.0
+)

vendor/github.com/Microsoft/hcsshim/hcn/hcn.go

@@ -0,0 +1,177 @@
+// Package hcn is a shim for the Host Compute Networking (HCN) service, which manages networking for Windows Server
+// containers and Hyper-V containers. Previous to RS5, HCN was referred to as Host Networking Service (HNS).
+package hcn
+
+import (
+	"encoding/json"
+	"fmt"
+	"syscall"
+
+	"github.com/Microsoft/go-winio/pkg/guid"
+)
+
+//go:generate go run ../mksyscall_windows.go -output zsyscall_windows.go hcn.go
+
+/// HNS V1 API
+
+//sys SetCurrentThreadCompartmentId(compartmentId uint32) (hr error) = iphlpapi.SetCurrentThreadCompartmentId
+//sys _hnsCall(method string, path string, object string, response **uint16) (hr error) = vmcompute.HNSCall?
+
+/// HCN V2 API
+
+// Network
+//sys hcnEnumerateNetworks(query string, networks **uint16, result **uint16) (hr error) = computenetwork.HcnEnumerateNetworks?
+//sys hcnCreateNetwork(id *_guid, settings string, network *hcnNetwork, result **uint16) (hr error) = computenetwork.HcnCreateNetwork?
+//sys hcnOpenNetwork(id *_guid, network *hcnNetwork, result **uint16) (hr error) = computenetwork.HcnOpenNetwork?
+//sys hcnModifyNetwork(network hcnNetwork, settings string, result **uint16) (hr error) = computenetwork.HcnModifyNetwork?
+//sys hcnQueryNetworkProperties(network hcnNetwork, query string, properties **uint16, result **uint16) (hr error) = computenetwork.HcnQueryNetworkProperties?
+//sys hcnDeleteNetwork(id *_guid, result **uint16) (hr error) = computenetwork.HcnDeleteNetwork?
+//sys hcnCloseNetwork(network hcnNetwork) (hr error) = computenetwork.HcnCloseNetwork?
+
+// Endpoint
+//sys hcnEnumerateEndpoints(query string, endpoints **uint16, result **uint16) (hr error) = computenetwork.HcnEnumerateEndpoints?
+//sys hcnCreateEndpoint(network hcnNetwork, id *_guid, settings string, endpoint *hcnEndpoint, result **uint16) (hr error) = computenetwork.HcnCreateEndpoint?
+//sys hcnOpenEndpoint(id *_guid, endpoint *hcnEndpoint, result **uint16) (hr error) = computenetwork.HcnOpenEndpoint?
+//sys hcnModifyEndpoint(endpoint hcnEndpoint, settings string, result **uint16) (hr error) = computenetwork.HcnModifyEndpoint?
+//sys hcnQueryEndpointProperties(endpoint hcnEndpoint, query string, properties **uint16, result **uint16) (hr error) = computenetwork.HcnQueryEndpointProperties?
+//sys hcnDeleteEndpoint(id *_guid, result **uint16) (hr error) = computenetwork.HcnDeleteEndpoint?
+//sys hcnCloseEndpoint(endpoint hcnEndpoint) (hr error) = computenetwork.HcnCloseEndpoint?
+
+// Namespace
+//sys hcnEnumerateNamespaces(query string, namespaces **uint16, result **uint16) (hr error) = computenetwork.HcnEnumerateNamespaces?
+//sys hcnCreateNamespace(id *_guid, settings string, namespace *hcnNamespace, result **uint16) (hr error) = computenetwork.HcnCreateNamespace?
+//sys hcnOpenNamespace(id *_guid, namespace *hcnNamespace, result **uint16) (hr error) = computenetwork.HcnOpenNamespace?
+//sys hcnModifyNamespace(namespace hcnNamespace, settings string, result **uint16) (hr error) = computenetwork.HcnModifyNamespace?
+//sys hcnQueryNamespaceProperties(namespace hcnNamespace, query string, properties **uint16, result **uint16) (hr error) = computenetwork.HcnQueryNamespaceProperties?
+//sys hcnDeleteNamespace(id *_guid, result **uint16) (hr error) = computenetwork.HcnDeleteNamespace?
+//sys hcnCloseNamespace(namespace hcnNamespace) (hr error) = computenetwork.HcnCloseNamespace?
+
+// LoadBalancer
+//sys hcnEnumerateLoadBalancers(query string, loadBalancers **uint16, result **uint16) (hr error) = computenetwork.HcnEnumerateLoadBalancers?
+//sys hcnCreateLoadBalancer(id *_guid, settings string, loadBalancer *hcnLoadBalancer, result **uint16) (hr error) = computenetwork.HcnCreateLoadBalancer?
+//sys hcnOpenLoadBalancer(id *_guid, loadBalancer *hcnLoadBalancer, result **uint16) (hr error) = computenetwork.HcnOpenLoadBalancer?
+//sys hcnModifyLoadBalancer(loadBalancer hcnLoadBalancer, settings string, result **uint16) (hr error) = computenetwork.HcnModifyLoadBalancer?
+//sys hcnQueryLoadBalancerProperties(loadBalancer hcnLoadBalancer, query string, properties **uint16, result **uint16) (hr error) = computenetwork.HcnQueryLoadBalancerProperties?
+//sys hcnDeleteLoadBalancer(id *_guid, result **uint16) (hr error) = computenetwork.HcnDeleteLoadBalancer?
+//sys hcnCloseLoadBalancer(loadBalancer hcnLoadBalancer) (hr error) = computenetwork.HcnCloseLoadBalancer?
+
+// Service
+//sys hcnOpenService(service *hcnService, result **uint16) (hr error) = computenetwork.HcnOpenService?
+//sys hcnRegisterServiceCallback(service hcnService, callback int32, context int32, callbackHandle *hcnCallbackHandle) (hr error) = computenetwork.HcnRegisterServiceCallback?
+//sys hcnUnregisterServiceCallback(callbackHandle hcnCallbackHandle) (hr error) = computenetwork.HcnUnregisterServiceCallback?
+//sys hcnCloseService(service hcnService) (hr error) = computenetwork.HcnCloseService?
+
+type _guid = guid.GUID
+
+type hcnNetwork syscall.Handle
+type hcnEndpoint syscall.Handle
+type hcnNamespace syscall.Handle
+type hcnLoadBalancer syscall.Handle
+type hcnService syscall.Handle
+type hcnCallbackHandle syscall.Handle
+
+// SchemaVersion for HCN Objects/Queries.
+type SchemaVersion = Version // hcnglobals.go
+
+// HostComputeQueryFlags are passed in to a HostComputeQuery to determine which
+// properties of an object are returned.
+type HostComputeQueryFlags uint32
+
+var (
+	// HostComputeQueryFlagsNone returns an object with the standard properties.
+	HostComputeQueryFlagsNone HostComputeQueryFlags
+	// HostComputeQueryFlagsDetailed returns an object with all properties.
+	HostComputeQueryFlagsDetailed HostComputeQueryFlags = 1
+)
+
+// HostComputeQuery is the format for HCN queries.
+type HostComputeQuery struct {
+	SchemaVersion SchemaVersion         `json:""`
+	Flags         HostComputeQueryFlags `json:",omitempty"`
+	Filter        string                `json:",omitempty"`
+}
+
+// defaultQuery generates HCN Query.
+// Passed into get/enumerate calls to filter results.
+func defaultQuery() HostComputeQuery {
+	query := HostComputeQuery{
+		SchemaVersion: SchemaVersion{
+			Major: 2,
+			Minor: 0,
+		},
+		Flags: HostComputeQueryFlagsNone,
+	}
+	return query
+}
+
+func defaultQueryJson() string {
+	query := defaultQuery()
+	queryJson, err := json.Marshal(query)
+	if err != nil {
+		return ""
+	}
+	return string(queryJson)
+}
+
+// PlatformDoesNotSupportError happens when users are attempting to use a newer shim on an older OS
+func platformDoesNotSupportError(featureName string) error {
+	return fmt.Errorf("Platform does not support feature %s", featureName)
+}
+
+// V2ApiSupported returns an error if the HCN version does not support the V2 Apis.
+func V2ApiSupported() error {
+	supported := GetSupportedFeatures()
+	if supported.Api.V2 {
+		return nil
+	}
+	return platformDoesNotSupportError("V2 Api/Schema")
+}
+
+func V2SchemaVersion() SchemaVersion {
+	return SchemaVersion{
+		Major: 2,
+		Minor: 0,
+	}
+}
+
+// RemoteSubnetSupported returns an error if the HCN version does not support Remote Subnet policies.
+func RemoteSubnetSupported() error {
+	supported := GetSupportedFeatures()
+	if supported.RemoteSubnet {
+		return nil
+	}
+	return platformDoesNotSupportError("Remote Subnet")
+}
+
+// HostRouteSupported returns an error if the HCN version does not support Host Route policies.
+func HostRouteSupported() error {
+	supported := GetSupportedFeatures()
+	if supported.HostRoute {
+		return nil
+	}
+	return platformDoesNotSupportError("Host Route")
+}
+
+// DSRSupported returns an error if the HCN version does not support Direct Server Return.
+func DSRSupported() error {
+	supported := GetSupportedFeatures()
+	if supported.DSR {
+		return nil
+	}
+	return platformDoesNotSupportError("Direct Server Return (DSR)")
+}
+
+// RequestType are the different operations performed to settings.
+// Used to update the settings of Endpoint/Namespace objects.
+type RequestType string
+
+var (
+	// RequestTypeAdd adds the provided settings object.
+	RequestTypeAdd RequestType = "Add"
+	// RequestTypeRemove removes the provided settings object.
+	RequestTypeRemove RequestType = "Remove"
+	// RequestTypeUpdate replaces settings with the ones provided.
+	RequestTypeUpdate RequestType = "Update"
+	// RequestTypeRefresh refreshes the settings provided.
+	RequestTypeRefresh RequestType = "Refresh"
+)

vendor/github.com/Microsoft/hcsshim/hcn/hcnendpoint.go

@@ -0,0 +1,380 @@
+package hcn
+
+import (
+	"encoding/json"
+	"errors"
+
+	"github.com/Microsoft/go-winio/pkg/guid"
+	"github.com/Microsoft/hcsshim/internal/interop"
+	"github.com/sirupsen/logrus"
+)
+
+// IpConfig is assoicated with an endpoint
+type IpConfig struct {
+	IpAddress    string `json:",omitempty"`
+	PrefixLength uint8  `json:",omitempty"`
+}
+
+// EndpointFlags are special settings on an endpoint.
+type EndpointFlags uint32
+
+var (
+	// EndpointFlagsNone is the default.
+	EndpointFlagsNone EndpointFlags
+	// EndpointFlagsRemoteEndpoint means that an endpoint is on another host.
+	EndpointFlagsRemoteEndpoint EndpointFlags = 1
+)
+
+// HostComputeEndpoint represents a network endpoint
+type HostComputeEndpoint struct {
+	Id                   string           `json:"ID,omitempty"`
+	Name                 string           `json:",omitempty"`
+	HostComputeNetwork   string           `json:",omitempty"` // GUID
+	HostComputeNamespace string           `json:",omitempty"` // GUID
+	Policies             []EndpointPolicy `json:",omitempty"`
+	IpConfigurations     []IpConfig       `json:",omitempty"`
+	Dns                  Dns              `json:",omitempty"`
+	Routes               []Route          `json:",omitempty"`
+	MacAddress           string           `json:",omitempty"`
+	Flags                EndpointFlags    `json:",omitempty"`
+	SchemaVersion        SchemaVersion    `json:",omitempty"`
+}
+
+// EndpointResourceType are the two different Endpoint settings resources.
+type EndpointResourceType string
+
+var (
+	// EndpointResourceTypePolicy is for Endpoint Policies. Ex: ACL, NAT
+	EndpointResourceTypePolicy EndpointResourceType = "Policy"
+	// EndpointResourceTypePort is for Endpoint Port settings.
+	EndpointResourceTypePort EndpointResourceType = "Port"
+)
+
+// ModifyEndpointSettingRequest is the structure used to send request to modify an endpoint.
+// Used to update policy/port on an endpoint.
+type ModifyEndpointSettingRequest struct {
+	ResourceType EndpointResourceType `json:",omitempty"` // Policy, Port
+	RequestType  RequestType          `json:",omitempty"` // Add, Remove, Update, Refresh
+	Settings     json.RawMessage      `json:",omitempty"`
+}
+
+type PolicyEndpointRequest struct {
+	Policies []EndpointPolicy `json:",omitempty"`
+}
+
+func getEndpoint(endpointGuid guid.GUID, query string) (*HostComputeEndpoint, error) {
+	// Open endpoint.
+	var (
+		endpointHandle   hcnEndpoint
+		resultBuffer     *uint16
+		propertiesBuffer *uint16
+	)
+	hr := hcnOpenEndpoint(&endpointGuid, &endpointHandle, &resultBuffer)
+	if err := checkForErrors("hcnOpenEndpoint", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Query endpoint.
+	hr = hcnQueryEndpointProperties(endpointHandle, query, &propertiesBuffer, &resultBuffer)
+	if err := checkForErrors("hcnQueryEndpointProperties", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	properties := interop.ConvertAndFreeCoTaskMemString(propertiesBuffer)
+	// Close endpoint.
+	hr = hcnCloseEndpoint(endpointHandle)
+	if err := checkForErrors("hcnCloseEndpoint", hr, nil); err != nil {
+		return nil, err
+	}
+	// Convert output to HostComputeEndpoint
+	var outputEndpoint HostComputeEndpoint
+	if err := json.Unmarshal([]byte(properties), &outputEndpoint); err != nil {
+		return nil, err
+	}
+	return &outputEndpoint, nil
+}
+
+func enumerateEndpoints(query string) ([]HostComputeEndpoint, error) {
+	// Enumerate all Endpoint Guids
+	var (
+		resultBuffer   *uint16
+		endpointBuffer *uint16
+	)
+	hr := hcnEnumerateEndpoints(query, &endpointBuffer, &resultBuffer)
+	if err := checkForErrors("hcnEnumerateEndpoints", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+
+	endpoints := interop.ConvertAndFreeCoTaskMemString(endpointBuffer)
+	var endpointIds []guid.GUID
+	err := json.Unmarshal([]byte(endpoints), &endpointIds)
+	if err != nil {
+		return nil, err
+	}
+
+	var outputEndpoints []HostComputeEndpoint
+	for _, endpointGuid := range endpointIds {
+		endpoint, err := getEndpoint(endpointGuid, query)
+		if err != nil {
+			return nil, err
+		}
+		outputEndpoints = append(outputEndpoints, *endpoint)
+	}
+	return outputEndpoints, nil
+}
+
+func createEndpoint(networkId string, endpointSettings string) (*HostComputeEndpoint, error) {
+	networkGuid, err := guid.FromString(networkId)
+	if err != nil {
+		return nil, errInvalidNetworkID
+	}
+	// Open network.
+	var networkHandle hcnNetwork
+	var resultBuffer *uint16
+	hr := hcnOpenNetwork(&networkGuid, &networkHandle, &resultBuffer)
+	if err := checkForErrors("hcnOpenNetwork", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Create endpoint.
+	endpointId := guid.GUID{}
+	var endpointHandle hcnEndpoint
+	hr = hcnCreateEndpoint(networkHandle, &endpointId, endpointSettings, &endpointHandle, &resultBuffer)
+	if err := checkForErrors("hcnCreateEndpoint", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Query endpoint.
+	hcnQuery := defaultQuery()
+	query, err := json.Marshal(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	var propertiesBuffer *uint16
+	hr = hcnQueryEndpointProperties(endpointHandle, string(query), &propertiesBuffer, &resultBuffer)
+	if err := checkForErrors("hcnQueryEndpointProperties", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	properties := interop.ConvertAndFreeCoTaskMemString(propertiesBuffer)
+	// Close endpoint.
+	hr = hcnCloseEndpoint(endpointHandle)
+	if err := checkForErrors("hcnCloseEndpoint", hr, nil); err != nil {
+		return nil, err
+	}
+	// Close network.
+	hr = hcnCloseNetwork(networkHandle)
+	if err := checkForErrors("hcnCloseNetwork", hr, nil); err != nil {
+		return nil, err
+	}
+	// Convert output to HostComputeEndpoint
+	var outputEndpoint HostComputeEndpoint
+	if err := json.Unmarshal([]byte(properties), &outputEndpoint); err != nil {
+		return nil, err
+	}
+	return &outputEndpoint, nil
+}
+
+func modifyEndpoint(endpointId string, settings string) (*HostComputeEndpoint, error) {
+	endpointGuid, err := guid.FromString(endpointId)
+	if err != nil {
+		return nil, errInvalidEndpointID
+	}
+	// Open endpoint
+	var (
+		endpointHandle   hcnEndpoint
+		resultBuffer     *uint16
+		propertiesBuffer *uint16
+	)
+	hr := hcnOpenEndpoint(&endpointGuid, &endpointHandle, &resultBuffer)
+	if err := checkForErrors("hcnOpenEndpoint", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Modify endpoint
+	hr = hcnModifyEndpoint(endpointHandle, settings, &resultBuffer)
+	if err := checkForErrors("hcnModifyEndpoint", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Query endpoint.
+	hcnQuery := defaultQuery()
+	query, err := json.Marshal(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	hr = hcnQueryEndpointProperties(endpointHandle, string(query), &propertiesBuffer, &resultBuffer)
+	if err := checkForErrors("hcnQueryEndpointProperties", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	properties := interop.ConvertAndFreeCoTaskMemString(propertiesBuffer)
+	// Close endpoint.
+	hr = hcnCloseEndpoint(endpointHandle)
+	if err := checkForErrors("hcnCloseEndpoint", hr, nil); err != nil {
+		return nil, err
+	}
+	// Convert output to HostComputeEndpoint
+	var outputEndpoint HostComputeEndpoint
+	if err := json.Unmarshal([]byte(properties), &outputEndpoint); err != nil {
+		return nil, err
+	}
+	return &outputEndpoint, nil
+}
+
+func deleteEndpoint(endpointId string) error {
+	endpointGuid, err := guid.FromString(endpointId)
+	if err != nil {
+		return errInvalidEndpointID
+	}
+	var resultBuffer *uint16
+	hr := hcnDeleteEndpoint(&endpointGuid, &resultBuffer)
+	if err := checkForErrors("hcnDeleteEndpoint", hr, resultBuffer); err != nil {
+		return err
+	}
+	return nil
+}
+
+// ListEndpoints makes a call to list all available endpoints.
+func ListEndpoints() ([]HostComputeEndpoint, error) {
+	hcnQuery := defaultQuery()
+	endpoints, err := ListEndpointsQuery(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	return endpoints, nil
+}
+
+// ListEndpointsQuery makes a call to query the list of available endpoints.
+func ListEndpointsQuery(query HostComputeQuery) ([]HostComputeEndpoint, error) {
+	queryJson, err := json.Marshal(query)
+	if err != nil {
+		return nil, err
+	}
+
+	endpoints, err := enumerateEndpoints(string(queryJson))
+	if err != nil {
+		return nil, err
+	}
+	return endpoints, nil
+}
+
+// ListEndpointsOfNetwork queries the list of endpoints on a network.
+func ListEndpointsOfNetwork(networkId string) ([]HostComputeEndpoint, error) {
+	hcnQuery := defaultQuery()
+	// TODO: Once query can convert schema, change to {HostComputeNetwork:networkId}
+	mapA := map[string]string{"VirtualNetwork": networkId}
+	filter, err := json.Marshal(mapA)
+	if err != nil {
+		return nil, err
+	}
+	hcnQuery.Filter = string(filter)
+
+	return ListEndpointsQuery(hcnQuery)
+}
+
+// GetEndpointByID returns an endpoint specified by Id
+func GetEndpointByID(endpointId string) (*HostComputeEndpoint, error) {
+	hcnQuery := defaultQuery()
+	mapA := map[string]string{"ID": endpointId}
+	filter, err := json.Marshal(mapA)
+	if err != nil {
+		return nil, err
+	}
+	hcnQuery.Filter = string(filter)
+
+	endpoints, err := ListEndpointsQuery(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	if len(endpoints) == 0 {
+		return nil, EndpointNotFoundError{EndpointID: endpointId}
+	}
+	return &endpoints[0], err
+}
+
+// GetEndpointByName returns an endpoint specified by Name
+func GetEndpointByName(endpointName string) (*HostComputeEndpoint, error) {
+	hcnQuery := defaultQuery()
+	mapA := map[string]string{"Name": endpointName}
+	filter, err := json.Marshal(mapA)
+	if err != nil {
+		return nil, err
+	}
+	hcnQuery.Filter = string(filter)
+
+	endpoints, err := ListEndpointsQuery(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	if len(endpoints) == 0 {
+		return nil, EndpointNotFoundError{EndpointName: endpointName}
+	}
+	return &endpoints[0], err
+}
+
+// Create Endpoint.
+func (endpoint *HostComputeEndpoint) Create() (*HostComputeEndpoint, error) {
+	logrus.Debugf("hcn::HostComputeEndpoint::Create id=%s", endpoint.Id)
+
+	if endpoint.HostComputeNamespace != "" {
+		return nil, errors.New("endpoint create error, endpoint json HostComputeNamespace is read only and should not be set")
+	}
+
+	jsonString, err := json.Marshal(endpoint)
+	if err != nil {
+		return nil, err
+	}
+
+	logrus.Debugf("hcn::HostComputeEndpoint::Create JSON: %s", jsonString)
+	endpoint, hcnErr := createEndpoint(endpoint.HostComputeNetwork, string(jsonString))
+	if hcnErr != nil {
+		return nil, hcnErr
+	}
+	return endpoint, nil
+}
+
+// Delete Endpoint.
+func (endpoint *HostComputeEndpoint) Delete() error {
+	logrus.Debugf("hcn::HostComputeEndpoint::Delete id=%s", endpoint.Id)
+
+	if err := deleteEndpoint(endpoint.Id); err != nil {
+		return err
+	}
+	return nil
+}
+
+// ModifyEndpointSettings updates the Port/Policy of an Endpoint.
+func ModifyEndpointSettings(endpointId string, request *ModifyEndpointSettingRequest) error {
+	logrus.Debugf("hcn::HostComputeEndpoint::ModifyEndpointSettings id=%s", endpointId)
+
+	endpointSettingsRequest, err := json.Marshal(request)
+	if err != nil {
+		return err
+	}
+
+	_, err = modifyEndpoint(endpointId, string(endpointSettingsRequest))
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// ApplyPolicy applies a Policy (ex: ACL) on the Endpoint.
+func (endpoint *HostComputeEndpoint) ApplyPolicy(requestType RequestType, endpointPolicy PolicyEndpointRequest) error {
+	logrus.Debugf("hcn::HostComputeEndpoint::ApplyPolicy id=%s", endpoint.Id)
+
+	settingsJson, err := json.Marshal(endpointPolicy)
+	if err != nil {
+		return err
+	}
+	requestMessage := &ModifyEndpointSettingRequest{
+		ResourceType: EndpointResourceTypePolicy,
+		RequestType:  requestType,
+		Settings:     settingsJson,
+	}
+
+	return ModifyEndpointSettings(endpoint.Id, requestMessage)
+}
+
+// NamespaceAttach modifies a Namespace to add an endpoint.
+func (endpoint *HostComputeEndpoint) NamespaceAttach(namespaceId string) error {
+	return AddNamespaceEndpoint(namespaceId, endpoint.Id)
+}
+
+// NamespaceDetach modifies a Namespace to remove an endpoint.
+func (endpoint *HostComputeEndpoint) NamespaceDetach(namespaceId string) error {
+	return RemoveNamespaceEndpoint(namespaceId, endpoint.Id)
+}

vendor/github.com/Microsoft/hcsshim/hcn/hcnerrors.go

@@ -0,0 +1,106 @@
+// Package hcn is a shim for the Host Compute Networking (HCN) service, which manages networking for Windows Server
+// containers and Hyper-V containers. Previous to RS5, HCN was referred to as Host Networking Service (HNS).
+package hcn
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/Microsoft/hcsshim/internal/hcs"
+	"github.com/Microsoft/hcsshim/internal/hcserror"
+	"github.com/Microsoft/hcsshim/internal/interop"
+	"github.com/sirupsen/logrus"
+)
+
+var (
+	errInvalidNetworkID      = errors.New("invalid network ID")
+	errInvalidEndpointID     = errors.New("invalid endpoint ID")
+	errInvalidNamespaceID    = errors.New("invalid namespace ID")
+	errInvalidLoadBalancerID = errors.New("invalid load balancer ID")
+)
+
+func checkForErrors(methodName string, hr error, resultBuffer *uint16) error {
+	errorFound := false
+
+	if hr != nil {
+		errorFound = true
+	}
+
+	result := ""
+	if resultBuffer != nil {
+		result = interop.ConvertAndFreeCoTaskMemString(resultBuffer)
+		if result != "" {
+			errorFound = true
+		}
+	}
+
+	if errorFound {
+		returnError := hcserror.New(hr, methodName, result)
+		logrus.Debugf(returnError.Error()) // HCN errors logged for debugging.
+		return returnError
+	}
+
+	return nil
+}
+
+// NetworkNotFoundError results from a failed seach for a network by Id or Name
+type NetworkNotFoundError struct {
+	NetworkName string
+	NetworkID   string
+}
+
+func (e NetworkNotFoundError) Error() string {
+	if e.NetworkName == "" {
+		return fmt.Sprintf("Network Name %s not found", e.NetworkName)
+	}
+	return fmt.Sprintf("Network Id %s not found", e.NetworkID)
+}
+
+// EndpointNotFoundError results from a failed seach for an endpoint by Id or Name
+type EndpointNotFoundError struct {
+	EndpointName string
+	EndpointID   string
+}
+
+func (e EndpointNotFoundError) Error() string {
+	if e.EndpointName == "" {
+		return fmt.Sprintf("Endpoint Name %s not found", e.EndpointName)
+	}
+	return fmt.Sprintf("Endpoint Id %s not found", e.EndpointID)
+}
+
+// NamespaceNotFoundError results from a failed seach for a namsepace by Id
+type NamespaceNotFoundError struct {
+	NamespaceID string
+}
+
+func (e NamespaceNotFoundError) Error() string {
+	return fmt.Sprintf("Namespace %s not found", e.NamespaceID)
+}
+
+// LoadBalancerNotFoundError results from a failed seach for a loadbalancer by Id
+type LoadBalancerNotFoundError struct {
+	LoadBalancerId string
+}
+
+func (e LoadBalancerNotFoundError) Error() string {
+	return fmt.Sprintf("LoadBalancer %s not found", e.LoadBalancerId)
+}
+
+// IsNotFoundError returns a boolean indicating whether the error was caused by
+// a resource not being found.
+func IsNotFoundError(err error) bool {
+	switch pe := err.(type) {
+	case NetworkNotFoundError:
+		return true
+	case EndpointNotFoundError:
+		return true
+	case NamespaceNotFoundError:
+		return true
+	case LoadBalancerNotFoundError:
+		return true
+	case *hcserror.HcsError:
+		return pe.Err == hcs.ErrElementNotFound
+	}
+	return false
+}

vendor/github.com/Microsoft/hcsshim/hcn/hcnglobals.go

@@ -0,0 +1,87 @@
+package hcn
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/Microsoft/hcsshim/internal/hcserror"
+	"github.com/Microsoft/hcsshim/internal/interop"
+	"github.com/sirupsen/logrus"
+)
+
+// Globals are all global properties of the HCN Service.
+type Globals struct {
+	Version Version `json:"Version"`
+}
+
+// Version is the HCN Service version.
+type Version struct {
+	Major int `json:"Major"`
+	Minor int `json:"Minor"`
+}
+
+var (
+	// HNSVersion1803 added ACL functionality.
+	HNSVersion1803 = Version{Major: 7, Minor: 2}
+	// V2ApiSupport allows the use of V2 Api calls and V2 Schema.
+	V2ApiSupport = Version{Major: 9, Minor: 2}
+	// Remote Subnet allows for Remote Subnet policies on Overlay networks
+	RemoteSubnetVersion = Version{Major: 9, Minor: 2}
+	// A Host Route policy allows for local container to local host communication Overlay networks
+	HostRouteVersion = Version{Major: 9, Minor: 2}
+	// HNS 10.2 allows for Direct Server Return for loadbalancing
+	DSRVersion = Version{Major: 10, Minor: 2}
+)
+
+// GetGlobals returns the global properties of the HCN Service.
+func GetGlobals() (*Globals, error) {
+	var version Version
+	err := hnsCall("GET", "/globals/version", "", &version)
+	if err != nil {
+		return nil, err
+	}
+
+	globals := &Globals{
+		Version: version,
+	}
+
+	return globals, nil
+}
+
+type hnsResponse struct {
+	Success bool
+	Error   string
+	Output  json.RawMessage
+}
+
+func hnsCall(method, path, request string, returnResponse interface{}) error {
+	var responseBuffer *uint16
+	logrus.Debugf("[%s]=>[%s] Request : %s", method, path, request)
+
+	err := _hnsCall(method, path, request, &responseBuffer)
+	if err != nil {
+		return hcserror.New(err, "hnsCall ", "")
+	}
+	response := interop.ConvertAndFreeCoTaskMemString(responseBuffer)
+
+	hnsresponse := &hnsResponse{}
+	if err = json.Unmarshal([]byte(response), &hnsresponse); err != nil {
+		return err
+	}
+
+	if !hnsresponse.Success {
+		return fmt.Errorf("HNS failed with error : %s", hnsresponse.Error)
+	}
+
+	if len(hnsresponse.Output) == 0 {
+		return nil
+	}
+
+	logrus.Debugf("Network Response : %s", hnsresponse.Output)
+	err = json.Unmarshal(hnsresponse.Output, returnResponse)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

vendor/github.com/Microsoft/hcsshim/hcn/hcnloadbalancer.go

@@ -0,0 +1,341 @@
+package hcn
+
+import (
+	"encoding/json"
+
+	"github.com/Microsoft/go-winio/pkg/guid"
+	"github.com/Microsoft/hcsshim/internal/interop"
+	"github.com/sirupsen/logrus"
+)
+
+// LoadBalancerPortMapping is associated with HostComputeLoadBalancer
+type LoadBalancerPortMapping struct {
+	Protocol     uint32                       `json:",omitempty"` // EX: TCP = 6, UDP = 17
+	InternalPort uint16                       `json:",omitempty"`
+	ExternalPort uint16                       `json:",omitempty"`
+	Flags        LoadBalancerPortMappingFlags `json:",omitempty"`
+}
+
+// HostComputeLoadBalancer represents software load balancer.
+type HostComputeLoadBalancer struct {
+	Id                   string                    `json:"ID,omitempty"`
+	HostComputeEndpoints []string                  `json:",omitempty"`
+	SourceVIP            string                    `json:",omitempty"`
+	FrontendVIPs         []string                  `json:",omitempty"`
+	PortMappings         []LoadBalancerPortMapping `json:",omitempty"`
+	SchemaVersion        SchemaVersion             `json:",omitempty"`
+	Flags                LoadBalancerFlags         `json:",omitempty"` // 0: None, 1: EnableDirectServerReturn
+}
+
+//LoadBalancerFlags modify settings for a loadbalancer.
+type LoadBalancerFlags uint32
+
+var (
+	// LoadBalancerFlagsNone is the default.
+	LoadBalancerFlagsNone LoadBalancerFlags = 0
+	// LoadBalancerFlagsDSR enables Direct Server Return (DSR)
+	LoadBalancerFlagsDSR LoadBalancerFlags = 1
+)
+
+// LoadBalancerPortMappingFlags are special settings on a loadbalancer.
+type LoadBalancerPortMappingFlags uint32
+
+var (
+	// LoadBalancerPortMappingFlagsNone is the default.
+	LoadBalancerPortMappingFlagsNone LoadBalancerPortMappingFlags
+	// LoadBalancerPortMappingFlagsILB enables internal loadbalancing.
+	LoadBalancerPortMappingFlagsILB LoadBalancerPortMappingFlags = 1
+	// LoadBalancerPortMappingFlagsLocalRoutedVIP enables VIP access from the host.
+	LoadBalancerPortMappingFlagsLocalRoutedVIP LoadBalancerPortMappingFlags = 2
+	// LoadBalancerPortMappingFlagsUseMux enables DSR for NodePort access of VIP.
+	LoadBalancerPortMappingFlagsUseMux LoadBalancerPortMappingFlags = 4
+	// LoadBalancerPortMappingFlagsPreserveDIP delivers packets with destination IP as the VIP.
+	LoadBalancerPortMappingFlagsPreserveDIP LoadBalancerPortMappingFlags = 8
+)
+
+func getLoadBalancer(loadBalancerGuid guid.GUID, query string) (*HostComputeLoadBalancer, error) {
+	// Open loadBalancer.
+	var (
+		loadBalancerHandle hcnLoadBalancer
+		resultBuffer       *uint16
+		propertiesBuffer   *uint16
+	)
+	hr := hcnOpenLoadBalancer(&loadBalancerGuid, &loadBalancerHandle, &resultBuffer)
+	if err := checkForErrors("hcnOpenLoadBalancer", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Query loadBalancer.
+	hr = hcnQueryLoadBalancerProperties(loadBalancerHandle, query, &propertiesBuffer, &resultBuffer)
+	if err := checkForErrors("hcnQueryLoadBalancerProperties", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	properties := interop.ConvertAndFreeCoTaskMemString(propertiesBuffer)
+	// Close loadBalancer.
+	hr = hcnCloseLoadBalancer(loadBalancerHandle)
+	if err := checkForErrors("hcnCloseLoadBalancer", hr, nil); err != nil {
+		return nil, err
+	}
+	// Convert output to HostComputeLoadBalancer
+	var outputLoadBalancer HostComputeLoadBalancer
+	if err := json.Unmarshal([]byte(properties), &outputLoadBalancer); err != nil {
+		return nil, err
+	}
+	return &outputLoadBalancer, nil
+}
+
+func enumerateLoadBalancers(query string) ([]HostComputeLoadBalancer, error) {
+	// Enumerate all LoadBalancer Guids
+	var (
+		resultBuffer       *uint16
+		loadBalancerBuffer *uint16
+	)
+	hr := hcnEnumerateLoadBalancers(query, &loadBalancerBuffer, &resultBuffer)
+	if err := checkForErrors("hcnEnumerateLoadBalancers", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+
+	loadBalancers := interop.ConvertAndFreeCoTaskMemString(loadBalancerBuffer)
+	var loadBalancerIds []guid.GUID
+	if err := json.Unmarshal([]byte(loadBalancers), &loadBalancerIds); err != nil {
+		return nil, err
+	}
+
+	var outputLoadBalancers []HostComputeLoadBalancer
+	for _, loadBalancerGuid := range loadBalancerIds {
+		loadBalancer, err := getLoadBalancer(loadBalancerGuid, query)
+		if err != nil {
+			return nil, err
+		}
+		outputLoadBalancers = append(outputLoadBalancers, *loadBalancer)
+	}
+	return outputLoadBalancers, nil
+}
+
+func createLoadBalancer(settings string) (*HostComputeLoadBalancer, error) {
+	// Create new loadBalancer.
+	var (
+		loadBalancerHandle hcnLoadBalancer
+		resultBuffer       *uint16
+		propertiesBuffer   *uint16
+	)
+	loadBalancerGuid := guid.GUID{}
+	hr := hcnCreateLoadBalancer(&loadBalancerGuid, settings, &loadBalancerHandle, &resultBuffer)
+	if err := checkForErrors("hcnCreateLoadBalancer", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Query loadBalancer.
+	hcnQuery := defaultQuery()
+	query, err := json.Marshal(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	hr = hcnQueryLoadBalancerProperties(loadBalancerHandle, string(query), &propertiesBuffer, &resultBuffer)
+	if err := checkForErrors("hcnQueryLoadBalancerProperties", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	properties := interop.ConvertAndFreeCoTaskMemString(propertiesBuffer)
+	// Close loadBalancer.
+	hr = hcnCloseLoadBalancer(loadBalancerHandle)
+	if err := checkForErrors("hcnCloseLoadBalancer", hr, nil); err != nil {
+		return nil, err
+	}
+	// Convert output to HostComputeLoadBalancer
+	var outputLoadBalancer HostComputeLoadBalancer
+	if err := json.Unmarshal([]byte(properties), &outputLoadBalancer); err != nil {
+		return nil, err
+	}
+	return &outputLoadBalancer, nil
+}
+
+func modifyLoadBalancer(loadBalancerId string, settings string) (*HostComputeLoadBalancer, error) {
+	loadBalancerGuid, err := guid.FromString(loadBalancerId)
+	if err != nil {
+		return nil, errInvalidLoadBalancerID
+	}
+	// Open loadBalancer.
+	var (
+		loadBalancerHandle hcnLoadBalancer
+		resultBuffer       *uint16
+		propertiesBuffer   *uint16
+	)
+	hr := hcnOpenLoadBalancer(&loadBalancerGuid, &loadBalancerHandle, &resultBuffer)
+	if err := checkForErrors("hcnOpenLoadBalancer", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Modify loadBalancer.
+	hr = hcnModifyLoadBalancer(loadBalancerHandle, settings, &resultBuffer)
+	if err := checkForErrors("hcnModifyLoadBalancer", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Query loadBalancer.
+	hcnQuery := defaultQuery()
+	query, err := json.Marshal(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	hr = hcnQueryLoadBalancerProperties(loadBalancerHandle, string(query), &propertiesBuffer, &resultBuffer)
+	if err := checkForErrors("hcnQueryLoadBalancerProperties", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	properties := interop.ConvertAndFreeCoTaskMemString(propertiesBuffer)
+	// Close loadBalancer.
+	hr = hcnCloseLoadBalancer(loadBalancerHandle)
+	if err := checkForErrors("hcnCloseLoadBalancer", hr, nil); err != nil {
+		return nil, err
+	}
+	// Convert output to LoadBalancer
+	var outputLoadBalancer HostComputeLoadBalancer
+	if err := json.Unmarshal([]byte(properties), &outputLoadBalancer); err != nil {
+		return nil, err
+	}
+	return &outputLoadBalancer, nil
+}
+
+func deleteLoadBalancer(loadBalancerId string) error {
+	loadBalancerGuid, err := guid.FromString(loadBalancerId)
+	if err != nil {
+		return errInvalidLoadBalancerID
+	}
+	var resultBuffer *uint16
+	hr := hcnDeleteLoadBalancer(&loadBalancerGuid, &resultBuffer)
+	if err := checkForErrors("hcnDeleteLoadBalancer", hr, resultBuffer); err != nil {
+		return err
+	}
+	return nil
+}
+
+// ListLoadBalancers makes a call to list all available loadBalancers.
+func ListLoadBalancers() ([]HostComputeLoadBalancer, error) {
+	hcnQuery := defaultQuery()
+	loadBalancers, err := ListLoadBalancersQuery(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	return loadBalancers, nil
+}
+
+// ListLoadBalancersQuery makes a call to query the list of available loadBalancers.
+func ListLoadBalancersQuery(query HostComputeQuery) ([]HostComputeLoadBalancer, error) {
+	queryJson, err := json.Marshal(query)
+	if err != nil {
+		return nil, err
+	}
+
+	loadBalancers, err := enumerateLoadBalancers(string(queryJson))
+	if err != nil {
+		return nil, err
+	}
+	return loadBalancers, nil
+}
+
+// GetLoadBalancerByID returns the LoadBalancer specified by Id.
+func GetLoadBalancerByID(loadBalancerId string) (*HostComputeLoadBalancer, error) {
+	hcnQuery := defaultQuery()
+	mapA := map[string]string{"ID": loadBalancerId}
+	filter, err := json.Marshal(mapA)
+	if err != nil {
+		return nil, err
+	}
+	hcnQuery.Filter = string(filter)
+
+	loadBalancers, err := ListLoadBalancersQuery(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	if len(loadBalancers) == 0 {
+		return nil, LoadBalancerNotFoundError{LoadBalancerId: loadBalancerId}
+	}
+	return &loadBalancers[0], err
+}
+
+// Create LoadBalancer.
+func (loadBalancer *HostComputeLoadBalancer) Create() (*HostComputeLoadBalancer, error) {
+	logrus.Debugf("hcn::HostComputeLoadBalancer::Create id=%s", loadBalancer.Id)
+
+	jsonString, err := json.Marshal(loadBalancer)
+	if err != nil {
+		return nil, err
+	}
+
+	logrus.Debugf("hcn::HostComputeLoadBalancer::Create JSON: %s", jsonString)
+	loadBalancer, hcnErr := createLoadBalancer(string(jsonString))
+	if hcnErr != nil {
+		return nil, hcnErr
+	}
+	return loadBalancer, nil
+}
+
+// Delete LoadBalancer.
+func (loadBalancer *HostComputeLoadBalancer) Delete() error {
+	logrus.Debugf("hcn::HostComputeLoadBalancer::Delete id=%s", loadBalancer.Id)
+
+	if err := deleteLoadBalancer(loadBalancer.Id); err != nil {
+		return err
+	}
+	return nil
+}
+
+// AddEndpoint add an endpoint to a LoadBalancer
+func (loadBalancer *HostComputeLoadBalancer) AddEndpoint(endpoint *HostComputeEndpoint) (*HostComputeLoadBalancer, error) {
+	logrus.Debugf("hcn::HostComputeLoadBalancer::AddEndpoint loadBalancer=%s endpoint=%s", loadBalancer.Id, endpoint.Id)
+
+	err := loadBalancer.Delete()
+	if err != nil {
+		return nil, err
+	}
+
+	// Add Endpoint to the Existing List
+	loadBalancer.HostComputeEndpoints = append(loadBalancer.HostComputeEndpoints, endpoint.Id)
+
+	return loadBalancer.Create()
+}
+
+// RemoveEndpoint removes an endpoint from a LoadBalancer
+func (loadBalancer *HostComputeLoadBalancer) RemoveEndpoint(endpoint *HostComputeEndpoint) (*HostComputeLoadBalancer, error) {
+	logrus.Debugf("hcn::HostComputeLoadBalancer::RemoveEndpoint loadBalancer=%s endpoint=%s", loadBalancer.Id, endpoint.Id)
+
+	err := loadBalancer.Delete()
+	if err != nil {
+		return nil, err
+	}
+
+	// Create a list of all the endpoints besides the one being removed
+	var endpoints []string
+	for _, endpointReference := range loadBalancer.HostComputeEndpoints {
+		if endpointReference == endpoint.Id {
+			continue
+		}
+		endpoints = append(endpoints, endpointReference)
+	}
+	loadBalancer.HostComputeEndpoints = endpoints
+	return loadBalancer.Create()
+}
+
+// AddLoadBalancer for the specified endpoints
+func AddLoadBalancer(endpoints []HostComputeEndpoint, flags LoadBalancerFlags, portMappingFlags LoadBalancerPortMappingFlags, sourceVIP string, frontendVIPs []string, protocol uint16, internalPort uint16, externalPort uint16) (*HostComputeLoadBalancer, error) {
+	logrus.Debugf("hcn::HostComputeLoadBalancer::AddLoadBalancer endpointId=%v, LoadBalancerFlags=%v, LoadBalancerPortMappingFlags=%v, sourceVIP=%s, frontendVIPs=%v, protocol=%v, internalPort=%v, externalPort=%v", endpoints, flags, portMappingFlags, sourceVIP, frontendVIPs, protocol, internalPort, externalPort)
+
+	loadBalancer := &HostComputeLoadBalancer{
+		SourceVIP: sourceVIP,
+		PortMappings: []LoadBalancerPortMapping{
+			{
+				Protocol:     uint32(protocol),
+				InternalPort: internalPort,
+				ExternalPort: externalPort,
+				Flags:        portMappingFlags,
+			},
+		},
+		FrontendVIPs: frontendVIPs,
+		SchemaVersion: SchemaVersion{
+			Major: 2,
+			Minor: 0,
+		},
+		Flags: flags,
+	}
+
+	for _, endpoint := range endpoints {
+		loadBalancer.HostComputeEndpoints = append(loadBalancer.HostComputeEndpoints, endpoint.Id)
+	}
+
+	return loadBalancer.Create()
+}

vendor/github.com/Microsoft/hcsshim/hcn/hcnnamespace.go

@@ -0,0 +1,434 @@
+package hcn
+
+import (
+	"encoding/json"
+	"os"
+	"syscall"
+
+	"github.com/Microsoft/go-winio/pkg/guid"
+	icni "github.com/Microsoft/hcsshim/internal/cni"
+	"github.com/Microsoft/hcsshim/internal/interop"
+	"github.com/Microsoft/hcsshim/internal/regstate"
+	"github.com/Microsoft/hcsshim/internal/runhcs"
+	"github.com/sirupsen/logrus"
+)
+
+// NamespaceResourceEndpoint represents an Endpoint attached to a Namespace.
+type NamespaceResourceEndpoint struct {
+	Id string `json:"ID,"`
+}
+
+// NamespaceResourceContainer represents a Container attached to a Namespace.
+type NamespaceResourceContainer struct {
+	Id string `json:"ID,"`
+}
+
+// NamespaceResourceType determines whether the Namespace resource is a Container or Endpoint.
+type NamespaceResourceType string
+
+var (
+	// NamespaceResourceTypeContainer are contianers associated with a Namespace.
+	NamespaceResourceTypeContainer NamespaceResourceType = "Container"
+	// NamespaceResourceTypeEndpoint are endpoints associated with a Namespace.
+	NamespaceResourceTypeEndpoint NamespaceResourceType = "Endpoint"
+)
+
+// NamespaceResource is associated with a namespace
+type NamespaceResource struct {
+	Type NamespaceResourceType `json:","` // Container, Endpoint
+	Data json.RawMessage       `json:","`
+}
+
+// NamespaceType determines whether the Namespace is for a Host or Guest
+type NamespaceType string
+
+var (
+	// NamespaceTypeHost are host namespaces.
+	NamespaceTypeHost NamespaceType = "Host"
+	// NamespaceTypeHostDefault are host namespaces in the default compartment.
+	NamespaceTypeHostDefault NamespaceType = "HostDefault"
+	// NamespaceTypeGuest are guest namespaces.
+	NamespaceTypeGuest NamespaceType = "Guest"
+	// NamespaceTypeGuestDefault are guest namespaces in the default compartment.
+	NamespaceTypeGuestDefault NamespaceType = "GuestDefault"
+)
+
+// HostComputeNamespace represents a namespace (AKA compartment) in
+type HostComputeNamespace struct {
+	Id            string              `json:"ID,omitempty"`
+	NamespaceId   uint32              `json:",omitempty"`
+	Type          NamespaceType       `json:",omitempty"` // Host, HostDefault, Guest, GuestDefault
+	Resources     []NamespaceResource `json:",omitempty"`
+	SchemaVersion SchemaVersion       `json:",omitempty"`
+}
+
+// ModifyNamespaceSettingRequest is the structure used to send request to modify a namespace.
+// Used to Add/Remove an endpoints and containers to/from a namespace.
+type ModifyNamespaceSettingRequest struct {
+	ResourceType NamespaceResourceType `json:",omitempty"` // Container, Endpoint
+	RequestType  RequestType           `json:",omitempty"` // Add, Remove, Update, Refresh
+	Settings     json.RawMessage       `json:",omitempty"`
+}
+
+func getNamespace(namespaceGuid guid.GUID, query string) (*HostComputeNamespace, error) {
+	// Open namespace.
+	var (
+		namespaceHandle  hcnNamespace
+		resultBuffer     *uint16
+		propertiesBuffer *uint16
+	)
+	hr := hcnOpenNamespace(&namespaceGuid, &namespaceHandle, &resultBuffer)
+	if err := checkForErrors("hcnOpenNamespace", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Query namespace.
+	hr = hcnQueryNamespaceProperties(namespaceHandle, query, &propertiesBuffer, &resultBuffer)
+	if err := checkForErrors("hcnQueryNamespaceProperties", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	properties := interop.ConvertAndFreeCoTaskMemString(propertiesBuffer)
+	// Close namespace.
+	hr = hcnCloseNamespace(namespaceHandle)
+	if err := checkForErrors("hcnCloseNamespace", hr, nil); err != nil {
+		return nil, err
+	}
+	// Convert output to HostComputeNamespace
+	var outputNamespace HostComputeNamespace
+	if err := json.Unmarshal([]byte(properties), &outputNamespace); err != nil {
+		return nil, err
+	}
+	return &outputNamespace, nil
+}
+
+func enumerateNamespaces(query string) ([]HostComputeNamespace, error) {
+	// Enumerate all Namespace Guids
+	var (
+		resultBuffer    *uint16
+		namespaceBuffer *uint16
+	)
+	hr := hcnEnumerateNamespaces(query, &namespaceBuffer, &resultBuffer)
+	if err := checkForErrors("hcnEnumerateNamespaces", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+
+	namespaces := interop.ConvertAndFreeCoTaskMemString(namespaceBuffer)
+	var namespaceIds []guid.GUID
+	if err := json.Unmarshal([]byte(namespaces), &namespaceIds); err != nil {
+		return nil, err
+	}
+
+	var outputNamespaces []HostComputeNamespace
+	for _, namespaceGuid := range namespaceIds {
+		namespace, err := getNamespace(namespaceGuid, query)
+		if err != nil {
+			return nil, err
+		}
+		outputNamespaces = append(outputNamespaces, *namespace)
+	}
+	return outputNamespaces, nil
+}
+
+func createNamespace(settings string) (*HostComputeNamespace, error) {
+	// Create new namespace.
+	var (
+		namespaceHandle  hcnNamespace
+		resultBuffer     *uint16
+		propertiesBuffer *uint16
+	)
+	namespaceGuid := guid.GUID{}
+	hr := hcnCreateNamespace(&namespaceGuid, settings, &namespaceHandle, &resultBuffer)
+	if err := checkForErrors("hcnCreateNamespace", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Query namespace.
+	hcnQuery := defaultQuery()
+	query, err := json.Marshal(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	hr = hcnQueryNamespaceProperties(namespaceHandle, string(query), &propertiesBuffer, &resultBuffer)
+	if err := checkForErrors("hcnQueryNamespaceProperties", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	properties := interop.ConvertAndFreeCoTaskMemString(propertiesBuffer)
+	// Close namespace.
+	hr = hcnCloseNamespace(namespaceHandle)
+	if err := checkForErrors("hcnCloseNamespace", hr, nil); err != nil {
+		return nil, err
+	}
+	// Convert output to HostComputeNamespace
+	var outputNamespace HostComputeNamespace
+	if err := json.Unmarshal([]byte(properties), &outputNamespace); err != nil {
+		return nil, err
+	}
+	return &outputNamespace, nil
+}
+
+func modifyNamespace(namespaceId string, settings string) (*HostComputeNamespace, error) {
+	namespaceGuid, err := guid.FromString(namespaceId)
+	if err != nil {
+		return nil, errInvalidNamespaceID
+	}
+	// Open namespace.
+	var (
+		namespaceHandle  hcnNamespace
+		resultBuffer     *uint16
+		propertiesBuffer *uint16
+	)
+	hr := hcnOpenNamespace(&namespaceGuid, &namespaceHandle, &resultBuffer)
+	if err := checkForErrors("hcnOpenNamespace", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Modify namespace.
+	hr = hcnModifyNamespace(namespaceHandle, settings, &resultBuffer)
+	if err := checkForErrors("hcnModifyNamespace", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Query namespace.
+	hcnQuery := defaultQuery()
+	query, err := json.Marshal(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	hr = hcnQueryNamespaceProperties(namespaceHandle, string(query), &propertiesBuffer, &resultBuffer)
+	if err := checkForErrors("hcnQueryNamespaceProperties", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	properties := interop.ConvertAndFreeCoTaskMemString(propertiesBuffer)
+	// Close namespace.
+	hr = hcnCloseNamespace(namespaceHandle)
+	if err := checkForErrors("hcnCloseNamespace", hr, nil); err != nil {
+		return nil, err
+	}
+	// Convert output to Namespace
+	var outputNamespace HostComputeNamespace
+	if err := json.Unmarshal([]byte(properties), &outputNamespace); err != nil {
+		return nil, err
+	}
+	return &outputNamespace, nil
+}
+
+func deleteNamespace(namespaceId string) error {
+	namespaceGuid, err := guid.FromString(namespaceId)
+	if err != nil {
+		return errInvalidNamespaceID
+	}
+	var resultBuffer *uint16
+	hr := hcnDeleteNamespace(&namespaceGuid, &resultBuffer)
+	if err := checkForErrors("hcnDeleteNamespace", hr, resultBuffer); err != nil {
+		return err
+	}
+	return nil
+}
+
+// ListNamespaces makes a call to list all available namespaces.
+func ListNamespaces() ([]HostComputeNamespace, error) {
+	hcnQuery := defaultQuery()
+	namespaces, err := ListNamespacesQuery(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	return namespaces, nil
+}
+
+// ListNamespacesQuery makes a call to query the list of available namespaces.
+func ListNamespacesQuery(query HostComputeQuery) ([]HostComputeNamespace, error) {
+	queryJson, err := json.Marshal(query)
+	if err != nil {
+		return nil, err
+	}
+
+	namespaces, err := enumerateNamespaces(string(queryJson))
+	if err != nil {
+		return nil, err
+	}
+	return namespaces, nil
+}
+
+// GetNamespaceByID returns the Namespace specified by Id.
+func GetNamespaceByID(namespaceId string) (*HostComputeNamespace, error) {
+	g, err := guid.FromString(namespaceId)
+	if err != nil {
+		return nil, errInvalidNamespaceID
+	}
+	return getNamespace(g, defaultQueryJson())
+}
+
+// GetNamespaceEndpointIds returns the endpoints of the Namespace specified by Id.
+func GetNamespaceEndpointIds(namespaceId string) ([]string, error) {
+	namespace, err := GetNamespaceByID(namespaceId)
+	if err != nil {
+		return nil, err
+	}
+	var endpointsIds []string
+	for _, resource := range namespace.Resources {
+		if resource.Type == "Endpoint" {
+			var endpointResource NamespaceResourceEndpoint
+			if err := json.Unmarshal([]byte(resource.Data), &endpointResource); err != nil {
+				return nil, err
+			}
+			endpointsIds = append(endpointsIds, endpointResource.Id)
+		}
+	}
+	return endpointsIds, nil
+}
+
+// GetNamespaceContainerIds returns the containers of the Namespace specified by Id.
+func GetNamespaceContainerIds(namespaceId string) ([]string, error) {
+	namespace, err := GetNamespaceByID(namespaceId)
+	if err != nil {
+		return nil, err
+	}
+	var containerIds []string
+	for _, resource := range namespace.Resources {
+		if resource.Type == "Container" {
+			var contaienrResource NamespaceResourceContainer
+			if err := json.Unmarshal([]byte(resource.Data), &contaienrResource); err != nil {
+				return nil, err
+			}
+			containerIds = append(containerIds, contaienrResource.Id)
+		}
+	}
+	return containerIds, nil
+}
+
+// NewNamespace creates a new Namespace object
+func NewNamespace(nsType NamespaceType) *HostComputeNamespace {
+	return &HostComputeNamespace{
+		Type:          nsType,
+		SchemaVersion: V2SchemaVersion(),
+	}
+}
+
+// Create Namespace.
+func (namespace *HostComputeNamespace) Create() (*HostComputeNamespace, error) {
+	logrus.Debugf("hcn::HostComputeNamespace::Create id=%s", namespace.Id)
+
+	jsonString, err := json.Marshal(namespace)
+	if err != nil {
+		return nil, err
+	}
+
+	logrus.Debugf("hcn::HostComputeNamespace::Create JSON: %s", jsonString)
+	namespace, hcnErr := createNamespace(string(jsonString))
+	if hcnErr != nil {
+		return nil, hcnErr
+	}
+	return namespace, nil
+}
+
+// Delete Namespace.
+func (namespace *HostComputeNamespace) Delete() error {
+	logrus.Debugf("hcn::HostComputeNamespace::Delete id=%s", namespace.Id)
+
+	if err := deleteNamespace(namespace.Id); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Sync Namespace endpoints with the appropriate sandbox container holding the
+// network namespace open. If no sandbox container is found for this namespace
+// this method is determined to be a success and will not return an error in
+// this case. If the sandbox container is found and a sync is initiated any
+// failures will be returned via this method.
+//
+// This call initiates a sync between endpoints and the matching UtilityVM
+// hosting those endpoints. It is safe to call for any `NamespaceType` but
+// `NamespaceTypeGuest` is the only case when a sync will actually occur. For
+// `NamespaceTypeHost` the process container will be automatically synchronized
+// when the the endpoint is added via `AddNamespaceEndpoint`.
+//
+// Note: This method sync's both additions and removals of endpoints from a
+// `NamespaceTypeGuest` namespace.
+func (namespace *HostComputeNamespace) Sync() error {
+	logrus.WithField("id", namespace.Id).Debugf("hcs::HostComputeNamespace::Sync")
+
+	// We only attempt a sync for namespace guest.
+	if namespace.Type != NamespaceTypeGuest {
+		return nil
+	}
+
+	// Look in the registry for the key to map from namespace id to pod-id
+	cfg, err := icni.LoadPersistedNamespaceConfig(namespace.Id)
+	if err != nil {
+		if regstate.IsNotFoundError(err) {
+			return nil
+		}
+		return err
+	}
+	req := runhcs.VMRequest{
+		ID: cfg.ContainerID,
+		Op: runhcs.OpSyncNamespace,
+	}
+	shimPath := runhcs.VMPipePath(cfg.HostUniqueID)
+	if err := runhcs.IssueVMRequest(shimPath, &req); err != nil {
+		// The shim is likey gone. Simply ignore the sync as if it didn't exist.
+		if perr, ok := err.(*os.PathError); ok && perr.Err == syscall.ERROR_FILE_NOT_FOUND {
+			// Remove the reg key there is no point to try again
+			cfg.Remove()
+			return nil
+		}
+		f := map[string]interface{}{
+			"id":           namespace.Id,
+			"container-id": cfg.ContainerID,
+		}
+		logrus.WithFields(f).
+			WithError(err).
+			Debugf("hcs::HostComputeNamespace::Sync failed to connect to shim pipe: '%s'", shimPath)
+		return err
+	}
+	return nil
+}
+
+// ModifyNamespaceSettings updates the Endpoints/Containers of a Namespace.
+func ModifyNamespaceSettings(namespaceId string, request *ModifyNamespaceSettingRequest) error {
+	logrus.Debugf("hcn::HostComputeNamespace::ModifyNamespaceSettings id=%s", namespaceId)
+
+	namespaceSettings, err := json.Marshal(request)
+	if err != nil {
+		return err
+	}
+
+	_, err = modifyNamespace(namespaceId, string(namespaceSettings))
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// AddNamespaceEndpoint adds an endpoint to a Namespace.
+func AddNamespaceEndpoint(namespaceId string, endpointId string) error {
+	logrus.Debugf("hcn::HostComputeEndpoint::AddNamespaceEndpoint id=%s", endpointId)
+
+	mapA := map[string]string{"EndpointId": endpointId}
+	settingsJson, err := json.Marshal(mapA)
+	if err != nil {
+		return err
+	}
+	requestMessage := &ModifyNamespaceSettingRequest{
+		ResourceType: NamespaceResourceTypeEndpoint,
+		RequestType:  RequestTypeAdd,
+		Settings:     settingsJson,
+	}
+
+	return ModifyNamespaceSettings(namespaceId, requestMessage)
+}
+
+// RemoveNamespaceEndpoint removes an endpoint from a Namespace.
+func RemoveNamespaceEndpoint(namespaceId string, endpointId string) error {
+	logrus.Debugf("hcn::HostComputeNamespace::RemoveNamespaceEndpoint id=%s", endpointId)
+
+	mapA := map[string]string{"EndpointId": endpointId}
+	settingsJson, err := json.Marshal(mapA)
+	if err != nil {
+		return err
+	}
+	requestMessage := &ModifyNamespaceSettingRequest{
+		ResourceType: NamespaceResourceTypeEndpoint,
+		RequestType:  RequestTypeRemove,
+		Settings:     settingsJson,
+	}
+
+	return ModifyNamespaceSettings(namespaceId, requestMessage)
+}

vendor/github.com/Microsoft/hcsshim/hcn/hcnnetwork.go

@@ -0,0 +1,461 @@
+package hcn
+
+import (
+	"encoding/json"
+	"errors"
+
+	"github.com/Microsoft/go-winio/pkg/guid"
+	"github.com/Microsoft/hcsshim/internal/interop"
+	"github.com/sirupsen/logrus"
+)
+
+// Route is assoicated with a subnet.
+type Route struct {
+	NextHop           string `json:",omitempty"`
+	DestinationPrefix string `json:",omitempty"`
+	Metric            uint16 `json:",omitempty"`
+}
+
+// Subnet is assoicated with a Ipam.
+type Subnet struct {
+	IpAddressPrefix string            `json:",omitempty"`
+	Policies        []json.RawMessage `json:",omitempty"`
+	Routes          []Route           `json:",omitempty"`
+}
+
+// Ipam (Internet Protocol Addres Management) is assoicated with a network
+// and represents the address space(s) of a network.
+type Ipam struct {
+	Type    string   `json:",omitempty"` // Ex: Static, DHCP
+	Subnets []Subnet `json:",omitempty"`
+}
+
+// MacRange is associated with MacPool and respresents the start and end addresses.
+type MacRange struct {
+	StartMacAddress string `json:",omitempty"`
+	EndMacAddress   string `json:",omitempty"`
+}
+
+// MacPool is assoicated with a network and represents pool of MacRanges.
+type MacPool struct {
+	Ranges []MacRange `json:",omitempty"`
+}
+
+// Dns (Domain Name System is associated with a network.
+type Dns struct {
+	Domain     string   `json:",omitempty"`
+	Search     []string `json:",omitempty"`
+	ServerList []string `json:",omitempty"`
+	Options    []string `json:",omitempty"`
+}
+
+// NetworkType are various networks.
+type NetworkType string
+
+// NetworkType const
+const (
+	NAT         NetworkType = "NAT"
+	Transparent NetworkType = "Transparent"
+	L2Bridge    NetworkType = "L2Bridge"
+	L2Tunnel    NetworkType = "L2Tunnel"
+	ICS         NetworkType = "ICS"
+	Private     NetworkType = "Private"
+	Overlay     NetworkType = "Overlay"
+)
+
+// NetworkFlags are various network flags.
+type NetworkFlags uint32
+
+// NetworkFlags const
+const (
+	None                NetworkFlags = 0
+	EnableNonPersistent NetworkFlags = 8
+)
+
+// HostComputeNetwork represents a network
+type HostComputeNetwork struct {
+	Id            string          `json:"ID,omitempty"`
+	Name          string          `json:",omitempty"`
+	Type          NetworkType     `json:",omitempty"`
+	Policies      []NetworkPolicy `json:",omitempty"`
+	MacPool       MacPool         `json:",omitempty"`
+	Dns           Dns             `json:",omitempty"`
+	Ipams         []Ipam          `json:",omitempty"`
+	Flags         NetworkFlags    `json:",omitempty"` // 0: None
+	SchemaVersion SchemaVersion   `json:",omitempty"`
+}
+
+// NetworkResourceType are the 3 different Network settings resources.
+type NetworkResourceType string
+
+var (
+	// NetworkResourceTypePolicy is for Network's policies. Ex: RemoteSubnet
+	NetworkResourceTypePolicy NetworkResourceType = "Policy"
+	// NetworkResourceTypeDNS is for Network's DNS settings.
+	NetworkResourceTypeDNS NetworkResourceType = "DNS"
+	// NetworkResourceTypeExtension is for Network's extension settings.
+	NetworkResourceTypeExtension NetworkResourceType = "Extension"
+)
+
+// ModifyNetworkSettingRequest is the structure used to send request to modify an network.
+// Used to update DNS/extension/policy on an network.
+type ModifyNetworkSettingRequest struct {
+	ResourceType NetworkResourceType `json:",omitempty"` // Policy, DNS, Extension
+	RequestType  RequestType         `json:",omitempty"` // Add, Remove, Update, Refresh
+	Settings     json.RawMessage     `json:",omitempty"`
+}
+
+type PolicyNetworkRequest struct {
+	Policies []NetworkPolicy `json:",omitempty"`
+}
+
+func getNetwork(networkGuid guid.GUID, query string) (*HostComputeNetwork, error) {
+	// Open network.
+	var (
+		networkHandle    hcnNetwork
+		resultBuffer     *uint16
+		propertiesBuffer *uint16
+	)
+	hr := hcnOpenNetwork(&networkGuid, &networkHandle, &resultBuffer)
+	if err := checkForErrors("hcnOpenNetwork", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Query network.
+	hr = hcnQueryNetworkProperties(networkHandle, query, &propertiesBuffer, &resultBuffer)
+	if err := checkForErrors("hcnQueryNetworkProperties", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	properties := interop.ConvertAndFreeCoTaskMemString(propertiesBuffer)
+	// Close network.
+	hr = hcnCloseNetwork(networkHandle)
+	if err := checkForErrors("hcnCloseNetwork", hr, nil); err != nil {
+		return nil, err
+	}
+	// Convert output to HostComputeNetwork
+	var outputNetwork HostComputeNetwork
+
+	// If HNS sets the network type to NAT (i.e. '0' in HNS.Schema.Network.NetworkMode),
+	// the value will be omitted from the JSON blob. We therefore need to initialize NAT here before
+	// unmarshaling the JSON blob.
+	outputNetwork.Type = NAT
+
+	if err := json.Unmarshal([]byte(properties), &outputNetwork); err != nil {
+		return nil, err
+	}
+	return &outputNetwork, nil
+}
+
+func enumerateNetworks(query string) ([]HostComputeNetwork, error) {
+	// Enumerate all Network Guids
+	var (
+		resultBuffer  *uint16
+		networkBuffer *uint16
+	)
+	hr := hcnEnumerateNetworks(query, &networkBuffer, &resultBuffer)
+	if err := checkForErrors("hcnEnumerateNetworks", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+
+	networks := interop.ConvertAndFreeCoTaskMemString(networkBuffer)
+	var networkIds []guid.GUID
+	if err := json.Unmarshal([]byte(networks), &networkIds); err != nil {
+		return nil, err
+	}
+
+	var outputNetworks []HostComputeNetwork
+	for _, networkGuid := range networkIds {
+		network, err := getNetwork(networkGuid, query)
+		if err != nil {
+			return nil, err
+		}
+		outputNetworks = append(outputNetworks, *network)
+	}
+	return outputNetworks, nil
+}
+
+func createNetwork(settings string) (*HostComputeNetwork, error) {
+	// Create new network.
+	var (
+		networkHandle    hcnNetwork
+		resultBuffer     *uint16
+		propertiesBuffer *uint16
+	)
+	networkGuid := guid.GUID{}
+	hr := hcnCreateNetwork(&networkGuid, settings, &networkHandle, &resultBuffer)
+	if err := checkForErrors("hcnCreateNetwork", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Query network.
+	hcnQuery := defaultQuery()
+	query, err := json.Marshal(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	hr = hcnQueryNetworkProperties(networkHandle, string(query), &propertiesBuffer, &resultBuffer)
+	if err := checkForErrors("hcnQueryNetworkProperties", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	properties := interop.ConvertAndFreeCoTaskMemString(propertiesBuffer)
+	// Close network.
+	hr = hcnCloseNetwork(networkHandle)
+	if err := checkForErrors("hcnCloseNetwork", hr, nil); err != nil {
+		return nil, err
+	}
+	// Convert output to HostComputeNetwork
+	var outputNetwork HostComputeNetwork
+
+	// If HNS sets the network type to NAT (i.e. '0' in HNS.Schema.Network.NetworkMode),
+	// the value will be omitted from the JSON blob. We therefore need to initialize NAT here before
+	// unmarshaling the JSON blob.
+	outputNetwork.Type = NAT
+
+	if err := json.Unmarshal([]byte(properties), &outputNetwork); err != nil {
+		return nil, err
+	}
+	return &outputNetwork, nil
+}
+
+func modifyNetwork(networkId string, settings string) (*HostComputeNetwork, error) {
+	networkGuid, err := guid.FromString(networkId)
+	if err != nil {
+		return nil, errInvalidNetworkID
+	}
+	// Open Network
+	var (
+		networkHandle    hcnNetwork
+		resultBuffer     *uint16
+		propertiesBuffer *uint16
+	)
+	hr := hcnOpenNetwork(&networkGuid, &networkHandle, &resultBuffer)
+	if err := checkForErrors("hcnOpenNetwork", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Modify Network
+	hr = hcnModifyNetwork(networkHandle, settings, &resultBuffer)
+	if err := checkForErrors("hcnModifyNetwork", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	// Query network.
+	hcnQuery := defaultQuery()
+	query, err := json.Marshal(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	hr = hcnQueryNetworkProperties(networkHandle, string(query), &propertiesBuffer, &resultBuffer)
+	if err := checkForErrors("hcnQueryNetworkProperties", hr, resultBuffer); err != nil {
+		return nil, err
+	}
+	properties := interop.ConvertAndFreeCoTaskMemString(propertiesBuffer)
+	// Close network.
+	hr = hcnCloseNetwork(networkHandle)
+	if err := checkForErrors("hcnCloseNetwork", hr, nil); err != nil {
+		return nil, err
+	}
+	// Convert output to HostComputeNetwork
+	var outputNetwork HostComputeNetwork
+
+	// If HNS sets the network type to NAT (i.e. '0' in HNS.Schema.Network.NetworkMode),
+	// the value will be omitted from the JSON blob. We therefore need to initialize NAT here before
+	// unmarshaling the JSON blob.
+	outputNetwork.Type = NAT
+
+	if err := json.Unmarshal([]byte(properties), &outputNetwork); err != nil {
+		return nil, err
+	}
+	return &outputNetwork, nil
+}
+
+func deleteNetwork(networkId string) error {
+	networkGuid, err := guid.FromString(networkId)
+	if err != nil {
+		return errInvalidNetworkID
+	}
+	var resultBuffer *uint16
+	hr := hcnDeleteNetwork(&networkGuid, &resultBuffer)
+	if err := checkForErrors("hcnDeleteNetwork", hr, resultBuffer); err != nil {
+		return err
+	}
+	return nil
+}
+
+// ListNetworks makes a call to list all available networks.
+func ListNetworks() ([]HostComputeNetwork, error) {
+	hcnQuery := defaultQuery()
+	networks, err := ListNetworksQuery(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	return networks, nil
+}
+
+// ListNetworksQuery makes a call to query the list of available networks.
+func ListNetworksQuery(query HostComputeQuery) ([]HostComputeNetwork, error) {
+	queryJson, err := json.Marshal(query)
+	if err != nil {
+		return nil, err
+	}
+
+	networks, err := enumerateNetworks(string(queryJson))
+	if err != nil {
+		return nil, err
+	}
+	return networks, nil
+}
+
+// GetNetworkByID returns the network specified by Id.
+func GetNetworkByID(networkID string) (*HostComputeNetwork, error) {
+	hcnQuery := defaultQuery()
+	mapA := map[string]string{"ID": networkID}
+	filter, err := json.Marshal(mapA)
+	if err != nil {
+		return nil, err
+	}
+	hcnQuery.Filter = string(filter)
+
+	networks, err := ListNetworksQuery(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	if len(networks) == 0 {
+		return nil, NetworkNotFoundError{NetworkID: networkID}
+	}
+	return &networks[0], err
+}
+
+// GetNetworkByName returns the network specified by Name.
+func GetNetworkByName(networkName string) (*HostComputeNetwork, error) {
+	hcnQuery := defaultQuery()
+	mapA := map[string]string{"Name": networkName}
+	filter, err := json.Marshal(mapA)
+	if err != nil {
+		return nil, err
+	}
+	hcnQuery.Filter = string(filter)
+
+	networks, err := ListNetworksQuery(hcnQuery)
+	if err != nil {
+		return nil, err
+	}
+	if len(networks) == 0 {
+		return nil, NetworkNotFoundError{NetworkName: networkName}
+	}
+	return &networks[0], err
+}
+
+// Create Network.
+func (network *HostComputeNetwork) Create() (*HostComputeNetwork, error) {
+	logrus.Debugf("hcn::HostComputeNetwork::Create id=%s", network.Id)
+	for _, ipam := range network.Ipams {
+		for _, subnet := range ipam.Subnets {
+			if subnet.IpAddressPrefix != "" {
+				hasDefault := false
+				for _, route := range subnet.Routes {
+					if route.NextHop == "" {
+						return nil, errors.New("network create error, subnet has address prefix but no gateway specified")
+					}
+					if route.DestinationPrefix == "0.0.0.0/0" || route.DestinationPrefix == "::/0" {
+						hasDefault = true
+					}
+				}
+				if !hasDefault {
+					return nil, errors.New("network create error, no default gateway")
+				}
+			}
+		}
+	}
+
+	jsonString, err := json.Marshal(network)
+	if err != nil {
+		return nil, err
+	}
+
+	logrus.Debugf("hcn::HostComputeNetwork::Create JSON: %s", jsonString)
+	network, hcnErr := createNetwork(string(jsonString))
+	if hcnErr != nil {
+		return nil, hcnErr
+	}
+	return network, nil
+}
+
+// Delete Network.
+func (network *HostComputeNetwork) Delete() error {
+	logrus.Debugf("hcn::HostComputeNetwork::Delete id=%s", network.Id)
+
+	if err := deleteNetwork(network.Id); err != nil {
+		return err
+	}
+	return nil
+}
+
+// ModifyNetworkSettings updates the Policy for a network.
+func (network *HostComputeNetwork) ModifyNetworkSettings(request *ModifyNetworkSettingRequest) error {
+	logrus.Debugf("hcn::HostComputeNetwork::ModifyNetworkSettings id=%s", network.Id)
+
+	networkSettingsRequest, err := json.Marshal(request)
+	if err != nil {
+		return err
+	}
+
+	_, err = modifyNetwork(network.Id, string(networkSettingsRequest))
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// AddPolicy applies a Policy (ex: RemoteSubnet) on the Network.
+func (network *HostComputeNetwork) AddPolicy(networkPolicy PolicyNetworkRequest) error {
+	logrus.Debugf("hcn::HostComputeNetwork::AddPolicy id=%s", network.Id)
+
+	settingsJson, err := json.Marshal(networkPolicy)
+	if err != nil {
+		return err
+	}
+	requestMessage := &ModifyNetworkSettingRequest{
+		ResourceType: NetworkResourceTypePolicy,
+		RequestType:  RequestTypeAdd,
+		Settings:     settingsJson,
+	}
+
+	return network.ModifyNetworkSettings(requestMessage)
+}
+
+// RemovePolicy removes a Policy (ex: RemoteSubnet) from the Network.
+func (network *HostComputeNetwork) RemovePolicy(networkPolicy PolicyNetworkRequest) error {
+	logrus.Debugf("hcn::HostComputeNetwork::RemovePolicy id=%s", network.Id)
+
+	settingsJson, err := json.Marshal(networkPolicy)
+	if err != nil {
+		return err
+	}
+	requestMessage := &ModifyNetworkSettingRequest{
+		ResourceType: NetworkResourceTypePolicy,
+		RequestType:  RequestTypeRemove,
+		Settings:     settingsJson,
+	}
+
+	return network.ModifyNetworkSettings(requestMessage)
+}
+
+// CreateEndpoint creates an endpoint on the Network.
+func (network *HostComputeNetwork) CreateEndpoint(endpoint *HostComputeEndpoint) (*HostComputeEndpoint, error) {
+	isRemote := endpoint.Flags&EndpointFlagsRemoteEndpoint != 0
+	logrus.Debugf("hcn::HostComputeNetwork::CreatEndpoint, networkId=%s remote=%t", network.Id, isRemote)
+
+	endpoint.HostComputeNetwork = network.Id
+	endpointSettings, err := json.Marshal(endpoint)
+	if err != nil {
+		return nil, err
+	}
+	newEndpoint, err := createEndpoint(network.Id, string(endpointSettings))
+	if err != nil {
+		return nil, err
+	}
+	return newEndpoint, nil
+}
+
+// CreateRemoteEndpoint creates a remote endpoint on the Network.
+func (network *HostComputeNetwork) CreateRemoteEndpoint(endpoint *HostComputeEndpoint) (*HostComputeEndpoint, error) {
+	endpoint.Flags = EndpointFlagsRemoteEndpoint | endpoint.Flags
+	return network.CreateEndpoint(endpoint)
+}

vendor/github.com/Microsoft/hcsshim/hcn/hcnpolicy.go

@@ -0,0 +1,249 @@
+package hcn
+
+import (
+	"encoding/json"
+)
+
+// EndpointPolicyType are the potential Policies that apply to Endpoints.
+type EndpointPolicyType string
+
+// EndpointPolicyType const
+const (
+	PortMapping   EndpointPolicyType = "PortMapping"
+	ACL           EndpointPolicyType = "ACL"
+	QOS           EndpointPolicyType = "QOS"
+	L2Driver      EndpointPolicyType = "L2Driver"
+	OutBoundNAT   EndpointPolicyType = "OutBoundNAT"
+	SDNRoute      EndpointPolicyType = "SDNRoute"
+	L4Proxy       EndpointPolicyType = "L4Proxy"
+	PortName      EndpointPolicyType = "PortName"
+	EncapOverhead EndpointPolicyType = "EncapOverhead"
+	// Endpoint and Network have InterfaceConstraint and ProviderAddress
+	NetworkProviderAddress     EndpointPolicyType = "ProviderAddress"
+	NetworkInterfaceConstraint EndpointPolicyType = "InterfaceConstraint"
+)
+
+// EndpointPolicy is a collection of Policy settings for an Endpoint.
+type EndpointPolicy struct {
+	Type     EndpointPolicyType `json:""`
+	Settings json.RawMessage    `json:",omitempty"`
+}
+
+// NetworkPolicyType are the potential Policies that apply to Networks.
+type NetworkPolicyType string
+
+// NetworkPolicyType const
+const (
+	SourceMacAddress    NetworkPolicyType = "SourceMacAddress"
+	NetAdapterName      NetworkPolicyType = "NetAdapterName"
+	VSwitchExtension    NetworkPolicyType = "VSwitchExtension"
+	DrMacAddress        NetworkPolicyType = "DrMacAddress"
+	AutomaticDNS        NetworkPolicyType = "AutomaticDNS"
+	InterfaceConstraint NetworkPolicyType = "InterfaceConstraint"
+	ProviderAddress     NetworkPolicyType = "ProviderAddress"
+	RemoteSubnetRoute   NetworkPolicyType = "RemoteSubnetRoute"
+	HostRoute           NetworkPolicyType = "HostRoute"
+)
+
+// NetworkPolicy is a collection of Policy settings for a Network.
+type NetworkPolicy struct {
+	Type     NetworkPolicyType `json:""`
+	Settings json.RawMessage   `json:",omitempty"`
+}
+
+// SubnetPolicyType are the potential Policies that apply to Subnets.
+type SubnetPolicyType string
+
+// SubnetPolicyType const
+const (
+	VLAN SubnetPolicyType = "VLAN"
+	VSID SubnetPolicyType = "VSID"
+)
+
+// SubnetPolicy is a collection of Policy settings for a Subnet.
+type SubnetPolicy struct {
+	Type     SubnetPolicyType `json:""`
+	Settings json.RawMessage  `json:",omitempty"`
+}
+
+// NatFlags are flags for portmappings.
+type NatFlags uint32
+
+/// Endpoint Policy objects
+
+// PortMappingPolicySetting defines Port Mapping (NAT)
+type PortMappingPolicySetting struct {
+	Protocol     uint32   `json:",omitempty"` // EX: TCP = 6, UDP = 17
+	InternalPort uint16   `json:",omitempty"`
+	ExternalPort uint16   `json:",omitempty"`
+	VIP          string   `json:",omitempty"`
+	Flags        NatFlags `json:",omitempty"`
+}
+
+// ActionType associated with ACLs. Value is either Allow or Block.
+type ActionType string
+
+// DirectionType associated with ACLs. Value is either In or Out.
+type DirectionType string
+
+// RuleType associated with ACLs. Value is either Host (WFP) or Switch (VFP).
+type RuleType string
+
+const (
+	// Allow traffic
+	ActionTypeAllow ActionType = "Allow"
+	// Block traffic
+	ActionTypeBlock ActionType = "Block"
+
+	// In is traffic coming to the Endpoint
+	DirectionTypeIn DirectionType = "In"
+	// Out is traffic leaving the Endpoint
+	DirectionTypeOut DirectionType = "Out"
+
+	// Host creates WFP (Windows Firewall) rules
+	RuleTypeHost RuleType = "Host"
+	// Switch creates VFP (Virtual Filter Platform) rules
+	RuleTypeSwitch RuleType = "Switch"
+)
+
+// AclPolicySetting creates firewall rules on an endpoint
+type AclPolicySetting struct {
+	Protocols       string        `json:",omitempty"` // EX: 6 (TCP), 17 (UDP), 1 (ICMPv4), 58 (ICMPv6), 2 (IGMP)
+	Action          ActionType    `json:","`
+	Direction       DirectionType `json:","`
+	LocalAddresses  string        `json:",omitempty"`
+	RemoteAddresses string        `json:",omitempty"`
+	LocalPorts      string        `json:",omitempty"`
+	RemotePorts     string        `json:",omitempty"`
+	RuleType        RuleType      `json:",omitempty"`
+	Priority        uint16        `json:",omitempty"`
+}
+
+// QosPolicySetting sets Quality of Service bandwidth caps on an Endpoint.
+type QosPolicySetting struct {
+	MaximumOutgoingBandwidthInBytes uint64
+}
+
+// OutboundNatPolicySetting sets outbound Network Address Translation on an Endpoint.
+type OutboundNatPolicySetting struct {
+	VirtualIP  string   `json:",omitempty"`
+	Exceptions []string `json:",omitempty"`
+}
+
+// SDNRoutePolicySetting sets SDN Route on an Endpoint.
+type SDNRoutePolicySetting struct {
+	DestinationPrefix string `json:",omitempty"`
+	NextHop           string `json:",omitempty"`
+	NeedEncap         bool   `json:",omitempty"`
+}
+
+// A ProxyType is a type of proxy used by the L4 proxy policy.
+type ProxyType int
+
+const (
+	// ProxyTypeVFP specifies a Virtual Filtering Protocol proxy.
+	ProxyTypeVFP ProxyType = iota
+	// ProxyTypeWFP specifies a Windows Filtering Platform proxy.
+	ProxyTypeWFP
+)
+
+// FiveTuple is nested in L4ProxyPolicySetting for WFP support.
+type FiveTuple struct {
+	Protocols       string `json:",omitempty"`
+	LocalAddresses  string `json:",omitempty"`
+	RemoteAddresses string `json:",omitempty"`
+	LocalPorts      string `json:",omitempty"`
+	RemotePorts     string `json:",omitempty"`
+	Priority        uint16 `json:",omitempty"`
+}
+
+// L4ProxyPolicySetting sets Layer-4 Proxy on an endpoint.
+type L4ProxyPolicySetting struct {
+	IP            string   `json:",omitempty"`
+	Port          string   `json:",omitempty"`
+	Protocol      uint32   `json:",omitempty"` // EX: TCP = 6, UDP = 17
+	ExceptionList []string `json:",omitempty"`
+	Destination   string   `json:","`
+	OutboundNat   bool     `json:",omitempty"`
+
+	// For the WFP proxy
+	FilterTuple   FiveTuple `json:",omitempty"`
+	ProxyType     ProxyType `json:",omitempty"`
+	UserSID       string    `json:",omitempty"`
+	CompartmentID uint32    `json:",omitempty"`
+}
+
+// PortnameEndpointPolicySetting sets the port name for an endpoint.
+type PortnameEndpointPolicySetting struct {
+	Name string `json:",omitempty"`
+}
+
+// EncapOverheadEndpointPolicySetting sets the encap overhead for an endpoint.
+type EncapOverheadEndpointPolicySetting struct {
+	Overhead uint16 `json:",omitempty"`
+}
+
+/// Endpoint and Network Policy objects
+
+// ProviderAddressEndpointPolicySetting sets the PA for an endpoint.
+type ProviderAddressEndpointPolicySetting struct {
+	ProviderAddress string `json:",omitempty"`
+}
+
+// InterfaceConstraintPolicySetting limits an Endpoint or Network to a specific Nic.
+type InterfaceConstraintPolicySetting struct {
+	InterfaceGuid        string `json:",omitempty"`
+	InterfaceLuid        uint64 `json:",omitempty"`
+	InterfaceIndex       uint32 `json:",omitempty"`
+	InterfaceMediaType   uint32 `json:",omitempty"`
+	InterfaceAlias       string `json:",omitempty"`
+	InterfaceDescription string `json:",omitempty"`
+}
+
+/// Network Policy objects
+
+// SourceMacAddressNetworkPolicySetting sets source MAC for a network.
+type SourceMacAddressNetworkPolicySetting struct {
+	SourceMacAddress string `json:",omitempty"`
+}
+
+// NetAdapterNameNetworkPolicySetting sets network adapter of a network.
+type NetAdapterNameNetworkPolicySetting struct {
+	NetworkAdapterName string `json:",omitempty"`
+}
+
+// VSwitchExtensionNetworkPolicySetting enables/disabled VSwitch extensions for a network.
+type VSwitchExtensionNetworkPolicySetting struct {
+	ExtensionID string `json:",omitempty"`
+	Enable      bool   `json:",omitempty"`
+}
+
+// DrMacAddressNetworkPolicySetting sets the DR MAC for a network.
+type DrMacAddressNetworkPolicySetting struct {
+	Address string `json:",omitempty"`
+}
+
+// AutomaticDNSNetworkPolicySetting enables/disables automatic DNS on a network.
+type AutomaticDNSNetworkPolicySetting struct {
+	Enable bool `json:",omitempty"`
+}
+
+/// Subnet Policy objects
+
+// VlanPolicySetting isolates a subnet with VLAN tagging.
+type VlanPolicySetting struct {
+	IsolationId uint32 `json:","`
+}
+
+// VsidPolicySetting isolates a subnet with VSID tagging.
+type VsidPolicySetting struct {
+	IsolationId uint32 `json:","`
+}
+
+// RemoteSubnetRoutePolicySetting creates remote subnet route rules on a network
+type RemoteSubnetRoutePolicySetting struct {
+	DestinationPrefix           string
+	IsolationId                 uint16
+	ProviderAddress             string
+	DistributedRouterMacAddress string
+}

vendor/github.com/Microsoft/hcsshim/hcn/hcnsupport.go

@@ -0,0 +1,71 @@
+package hcn
+
+import (
+	"github.com/sirupsen/logrus"
+)
+
+// SupportedFeatures are the features provided by the Service.
+type SupportedFeatures struct {
+	Acl          AclFeatures `json:"ACL"`
+	Api          ApiSupport  `json:"API"`
+	RemoteSubnet bool        `json:"RemoteSubnet"`
+	HostRoute    bool        `json:"HostRoute"`
+	DSR          bool        `json:"DSR"`
+}
+
+// AclFeatures are the supported ACL possibilities.
+type AclFeatures struct {
+	AclAddressLists       bool `json:"AclAddressLists"`
+	AclNoHostRulePriority bool `json:"AclHostRulePriority"`
+	AclPortRanges         bool `json:"AclPortRanges"`
+	AclRuleId             bool `json:"AclRuleId"`
+}
+
+// ApiSupport lists the supported API versions.
+type ApiSupport struct {
+	V1 bool `json:"V1"`
+	V2 bool `json:"V2"`
+}
+
+// GetSupportedFeatures returns the features supported by the Service.
+func GetSupportedFeatures() SupportedFeatures {
+	var features SupportedFeatures
+
+	globals, err := GetGlobals()
+	if err != nil {
+		// Expected on pre-1803 builds, all features will be false/unsupported
+		logrus.Debugf("Unable to obtain globals: %s", err)
+		return features
+	}
+
+	features.Acl = AclFeatures{
+		AclAddressLists:       isFeatureSupported(globals.Version, HNSVersion1803),
+		AclNoHostRulePriority: isFeatureSupported(globals.Version, HNSVersion1803),
+		AclPortRanges:         isFeatureSupported(globals.Version, HNSVersion1803),
+		AclRuleId:             isFeatureSupported(globals.Version, HNSVersion1803),
+	}
+
+	features.Api = ApiSupport{
+		V2: isFeatureSupported(globals.Version, V2ApiSupport),
+		V1: true, // HNSCall is still available.
+	}
+
+	features.RemoteSubnet = isFeatureSupported(globals.Version, RemoteSubnetVersion)
+	features.HostRoute = isFeatureSupported(globals.Version, HostRouteVersion)
+	features.DSR = isFeatureSupported(globals.Version, DSRVersion)
+
+	return features
+}
+
+func isFeatureSupported(currentVersion Version, minVersionSupported Version) bool {
+	if currentVersion.Major < minVersionSupported.Major {
+		return false
+	}
+	if currentVersion.Major > minVersionSupported.Major {
+		return true
+	}
+	if currentVersion.Minor < minVersionSupported.Minor {
+		return false
+	}
+	return true
+}

vendor/github.com/Microsoft/hcsshim/hcn/zsyscall_windows.go

@@ -0,0 +1,714 @@
+// Code generated mksyscall_windows.exe DO NOT EDIT
+
+package hcn
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+var _ unsafe.Pointer
+
+// Do the interface allocations only once for common
+// Errno values.
+const (
+	errnoERROR_IO_PENDING = 997
+)
+
+var (
+	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
+)
+
+// errnoErr returns common boxed Errno values, to prevent
+// allocations at runtime.
+func errnoErr(e syscall.Errno) error {
+	switch e {
+	case 0:
+		return nil
+	case errnoERROR_IO_PENDING:
+		return errERROR_IO_PENDING
+	}
+	// TODO: add more here, after collecting data on the common
+	// error values see on Windows. (perhaps when running
+	// all.bat?)
+	return e
+}
+
+var (
+	modiphlpapi       = windows.NewLazySystemDLL("iphlpapi.dll")
+	modvmcompute      = windows.NewLazySystemDLL("vmcompute.dll")
+	modcomputenetwork = windows.NewLazySystemDLL("computenetwork.dll")
+
+	procSetCurrentThreadCompartmentId  = modiphlpapi.NewProc("SetCurrentThreadCompartmentId")
+	procHNSCall                        = modvmcompute.NewProc("HNSCall")
+	procHcnEnumerateNetworks           = modcomputenetwork.NewProc("HcnEnumerateNetworks")
+	procHcnCreateNetwork               = modcomputenetwork.NewProc("HcnCreateNetwork")
+	procHcnOpenNetwork                 = modcomputenetwork.NewProc("HcnOpenNetwork")
+	procHcnModifyNetwork               = modcomputenetwork.NewProc("HcnModifyNetwork")
+	procHcnQueryNetworkProperties      = modcomputenetwork.NewProc("HcnQueryNetworkProperties")
+	procHcnDeleteNetwork               = modcomputenetwork.NewProc("HcnDeleteNetwork")
+	procHcnCloseNetwork                = modcomputenetwork.NewProc("HcnCloseNetwork")
+	procHcnEnumerateEndpoints          = modcomputenetwork.NewProc("HcnEnumerateEndpoints")
+	procHcnCreateEndpoint              = modcomputenetwork.NewProc("HcnCreateEndpoint")
+	procHcnOpenEndpoint                = modcomputenetwork.NewProc("HcnOpenEndpoint")
+	procHcnModifyEndpoint              = modcomputenetwork.NewProc("HcnModifyEndpoint")
+	procHcnQueryEndpointProperties     = modcomputenetwork.NewProc("HcnQueryEndpointProperties")
+	procHcnDeleteEndpoint              = modcomputenetwork.NewProc("HcnDeleteEndpoint")
+	procHcnCloseEndpoint               = modcomputenetwork.NewProc("HcnCloseEndpoint")
+	procHcnEnumerateNamespaces         = modcomputenetwork.NewProc("HcnEnumerateNamespaces")
+	procHcnCreateNamespace             = modcomputenetwork.NewProc("HcnCreateNamespace")
+	procHcnOpenNamespace               = modcomputenetwork.NewProc("HcnOpenNamespace")
+	procHcnModifyNamespace             = modcomputenetwork.NewProc("HcnModifyNamespace")
+	procHcnQueryNamespaceProperties    = modcomputenetwork.NewProc("HcnQueryNamespaceProperties")
+	procHcnDeleteNamespace             = modcomputenetwork.NewProc("HcnDeleteNamespace")
+	procHcnCloseNamespace              = modcomputenetwork.NewProc("HcnCloseNamespace")
+	procHcnEnumerateLoadBalancers      = modcomputenetwork.NewProc("HcnEnumerateLoadBalancers")
+	procHcnCreateLoadBalancer          = modcomputenetwork.NewProc("HcnCreateLoadBalancer")
+	procHcnOpenLoadBalancer            = modcomputenetwork.NewProc("HcnOpenLoadBalancer")
+	procHcnModifyLoadBalancer          = modcomputenetwork.NewProc("HcnModifyLoadBalancer")
+	procHcnQueryLoadBalancerProperties = modcomputenetwork.NewProc("HcnQueryLoadBalancerProperties")
+	procHcnDeleteLoadBalancer          = modcomputenetwork.NewProc("HcnDeleteLoadBalancer")
+	procHcnCloseLoadBalancer           = modcomputenetwork.NewProc("HcnCloseLoadBalancer")
+	procHcnOpenService                 = modcomputenetwork.NewProc("HcnOpenService")
+	procHcnRegisterServiceCallback     = modcomputenetwork.NewProc("HcnRegisterServiceCallback")
+	procHcnUnregisterServiceCallback   = modcomputenetwork.NewProc("HcnUnregisterServiceCallback")
+	procHcnCloseService                = modcomputenetwork.NewProc("HcnCloseService")
+)
+
+func SetCurrentThreadCompartmentId(compartmentId uint32) (hr error) {
+	r0, _, _ := syscall.Syscall(procSetCurrentThreadCompartmentId.Addr(), 1, uintptr(compartmentId), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func _hnsCall(method string, path string, object string, response **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(method)
+	if hr != nil {
+		return
+	}
+	var _p1 *uint16
+	_p1, hr = syscall.UTF16PtrFromString(path)
+	if hr != nil {
+		return
+	}
+	var _p2 *uint16
+	_p2, hr = syscall.UTF16PtrFromString(object)
+	if hr != nil {
+		return
+	}
+	return __hnsCall(_p0, _p1, _p2, response)
+}
+
+func __hnsCall(method *uint16, path *uint16, object *uint16, response **uint16) (hr error) {
+	if hr = procHNSCall.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHNSCall.Addr(), 4, uintptr(unsafe.Pointer(method)), uintptr(unsafe.Pointer(path)), uintptr(unsafe.Pointer(object)), uintptr(unsafe.Pointer(response)), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnEnumerateNetworks(query string, networks **uint16, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(query)
+	if hr != nil {
+		return
+	}
+	return _hcnEnumerateNetworks(_p0, networks, result)
+}
+
+func _hcnEnumerateNetworks(query *uint16, networks **uint16, result **uint16) (hr error) {
+	if hr = procHcnEnumerateNetworks.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnEnumerateNetworks.Addr(), 3, uintptr(unsafe.Pointer(query)), uintptr(unsafe.Pointer(networks)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnCreateNetwork(id *_guid, settings string, network *hcnNetwork, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(settings)
+	if hr != nil {
+		return
+	}
+	return _hcnCreateNetwork(id, _p0, network, result)
+}
+
+func _hcnCreateNetwork(id *_guid, settings *uint16, network *hcnNetwork, result **uint16) (hr error) {
+	if hr = procHcnCreateNetwork.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHcnCreateNetwork.Addr(), 4, uintptr(unsafe.Pointer(id)), uintptr(unsafe.Pointer(settings)), uintptr(unsafe.Pointer(network)), uintptr(unsafe.Pointer(result)), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnOpenNetwork(id *_guid, network *hcnNetwork, result **uint16) (hr error) {
+	if hr = procHcnOpenNetwork.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnOpenNetwork.Addr(), 3, uintptr(unsafe.Pointer(id)), uintptr(unsafe.Pointer(network)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnModifyNetwork(network hcnNetwork, settings string, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(settings)
+	if hr != nil {
+		return
+	}
+	return _hcnModifyNetwork(network, _p0, result)
+}
+
+func _hcnModifyNetwork(network hcnNetwork, settings *uint16, result **uint16) (hr error) {
+	if hr = procHcnModifyNetwork.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnModifyNetwork.Addr(), 3, uintptr(network), uintptr(unsafe.Pointer(settings)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnQueryNetworkProperties(network hcnNetwork, query string, properties **uint16, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(query)
+	if hr != nil {
+		return
+	}
+	return _hcnQueryNetworkProperties(network, _p0, properties, result)
+}
+
+func _hcnQueryNetworkProperties(network hcnNetwork, query *uint16, properties **uint16, result **uint16) (hr error) {
+	if hr = procHcnQueryNetworkProperties.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHcnQueryNetworkProperties.Addr(), 4, uintptr(network), uintptr(unsafe.Pointer(query)), uintptr(unsafe.Pointer(properties)), uintptr(unsafe.Pointer(result)), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnDeleteNetwork(id *_guid, result **uint16) (hr error) {
+	if hr = procHcnDeleteNetwork.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnDeleteNetwork.Addr(), 2, uintptr(unsafe.Pointer(id)), uintptr(unsafe.Pointer(result)), 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnCloseNetwork(network hcnNetwork) (hr error) {
+	if hr = procHcnCloseNetwork.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnCloseNetwork.Addr(), 1, uintptr(network), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnEnumerateEndpoints(query string, endpoints **uint16, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(query)
+	if hr != nil {
+		return
+	}
+	return _hcnEnumerateEndpoints(_p0, endpoints, result)
+}
+
+func _hcnEnumerateEndpoints(query *uint16, endpoints **uint16, result **uint16) (hr error) {
+	if hr = procHcnEnumerateEndpoints.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnEnumerateEndpoints.Addr(), 3, uintptr(unsafe.Pointer(query)), uintptr(unsafe.Pointer(endpoints)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnCreateEndpoint(network hcnNetwork, id *_guid, settings string, endpoint *hcnEndpoint, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(settings)
+	if hr != nil {
+		return
+	}
+	return _hcnCreateEndpoint(network, id, _p0, endpoint, result)
+}
+
+func _hcnCreateEndpoint(network hcnNetwork, id *_guid, settings *uint16, endpoint *hcnEndpoint, result **uint16) (hr error) {
+	if hr = procHcnCreateEndpoint.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHcnCreateEndpoint.Addr(), 5, uintptr(network), uintptr(unsafe.Pointer(id)), uintptr(unsafe.Pointer(settings)), uintptr(unsafe.Pointer(endpoint)), uintptr(unsafe.Pointer(result)), 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnOpenEndpoint(id *_guid, endpoint *hcnEndpoint, result **uint16) (hr error) {
+	if hr = procHcnOpenEndpoint.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnOpenEndpoint.Addr(), 3, uintptr(unsafe.Pointer(id)), uintptr(unsafe.Pointer(endpoint)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnModifyEndpoint(endpoint hcnEndpoint, settings string, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(settings)
+	if hr != nil {
+		return
+	}
+	return _hcnModifyEndpoint(endpoint, _p0, result)
+}
+
+func _hcnModifyEndpoint(endpoint hcnEndpoint, settings *uint16, result **uint16) (hr error) {
+	if hr = procHcnModifyEndpoint.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnModifyEndpoint.Addr(), 3, uintptr(endpoint), uintptr(unsafe.Pointer(settings)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnQueryEndpointProperties(endpoint hcnEndpoint, query string, properties **uint16, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(query)
+	if hr != nil {
+		return
+	}
+	return _hcnQueryEndpointProperties(endpoint, _p0, properties, result)
+}
+
+func _hcnQueryEndpointProperties(endpoint hcnEndpoint, query *uint16, properties **uint16, result **uint16) (hr error) {
+	if hr = procHcnQueryEndpointProperties.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHcnQueryEndpointProperties.Addr(), 4, uintptr(endpoint), uintptr(unsafe.Pointer(query)), uintptr(unsafe.Pointer(properties)), uintptr(unsafe.Pointer(result)), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnDeleteEndpoint(id *_guid, result **uint16) (hr error) {
+	if hr = procHcnDeleteEndpoint.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnDeleteEndpoint.Addr(), 2, uintptr(unsafe.Pointer(id)), uintptr(unsafe.Pointer(result)), 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnCloseEndpoint(endpoint hcnEndpoint) (hr error) {
+	if hr = procHcnCloseEndpoint.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnCloseEndpoint.Addr(), 1, uintptr(endpoint), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnEnumerateNamespaces(query string, namespaces **uint16, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(query)
+	if hr != nil {
+		return
+	}
+	return _hcnEnumerateNamespaces(_p0, namespaces, result)
+}
+
+func _hcnEnumerateNamespaces(query *uint16, namespaces **uint16, result **uint16) (hr error) {
+	if hr = procHcnEnumerateNamespaces.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnEnumerateNamespaces.Addr(), 3, uintptr(unsafe.Pointer(query)), uintptr(unsafe.Pointer(namespaces)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnCreateNamespace(id *_guid, settings string, namespace *hcnNamespace, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(settings)
+	if hr != nil {
+		return
+	}
+	return _hcnCreateNamespace(id, _p0, namespace, result)
+}
+
+func _hcnCreateNamespace(id *_guid, settings *uint16, namespace *hcnNamespace, result **uint16) (hr error) {
+	if hr = procHcnCreateNamespace.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHcnCreateNamespace.Addr(), 4, uintptr(unsafe.Pointer(id)), uintptr(unsafe.Pointer(settings)), uintptr(unsafe.Pointer(namespace)), uintptr(unsafe.Pointer(result)), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnOpenNamespace(id *_guid, namespace *hcnNamespace, result **uint16) (hr error) {
+	if hr = procHcnOpenNamespace.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnOpenNamespace.Addr(), 3, uintptr(unsafe.Pointer(id)), uintptr(unsafe.Pointer(namespace)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnModifyNamespace(namespace hcnNamespace, settings string, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(settings)
+	if hr != nil {
+		return
+	}
+	return _hcnModifyNamespace(namespace, _p0, result)
+}
+
+func _hcnModifyNamespace(namespace hcnNamespace, settings *uint16, result **uint16) (hr error) {
+	if hr = procHcnModifyNamespace.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnModifyNamespace.Addr(), 3, uintptr(namespace), uintptr(unsafe.Pointer(settings)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnQueryNamespaceProperties(namespace hcnNamespace, query string, properties **uint16, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(query)
+	if hr != nil {
+		return
+	}
+	return _hcnQueryNamespaceProperties(namespace, _p0, properties, result)
+}
+
+func _hcnQueryNamespaceProperties(namespace hcnNamespace, query *uint16, properties **uint16, result **uint16) (hr error) {
+	if hr = procHcnQueryNamespaceProperties.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHcnQueryNamespaceProperties.Addr(), 4, uintptr(namespace), uintptr(unsafe.Pointer(query)), uintptr(unsafe.Pointer(properties)), uintptr(unsafe.Pointer(result)), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnDeleteNamespace(id *_guid, result **uint16) (hr error) {
+	if hr = procHcnDeleteNamespace.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnDeleteNamespace.Addr(), 2, uintptr(unsafe.Pointer(id)), uintptr(unsafe.Pointer(result)), 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnCloseNamespace(namespace hcnNamespace) (hr error) {
+	if hr = procHcnCloseNamespace.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnCloseNamespace.Addr(), 1, uintptr(namespace), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnEnumerateLoadBalancers(query string, loadBalancers **uint16, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(query)
+	if hr != nil {
+		return
+	}
+	return _hcnEnumerateLoadBalancers(_p0, loadBalancers, result)
+}
+
+func _hcnEnumerateLoadBalancers(query *uint16, loadBalancers **uint16, result **uint16) (hr error) {
+	if hr = procHcnEnumerateLoadBalancers.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnEnumerateLoadBalancers.Addr(), 3, uintptr(unsafe.Pointer(query)), uintptr(unsafe.Pointer(loadBalancers)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnCreateLoadBalancer(id *_guid, settings string, loadBalancer *hcnLoadBalancer, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(settings)
+	if hr != nil {
+		return
+	}
+	return _hcnCreateLoadBalancer(id, _p0, loadBalancer, result)
+}
+
+func _hcnCreateLoadBalancer(id *_guid, settings *uint16, loadBalancer *hcnLoadBalancer, result **uint16) (hr error) {
+	if hr = procHcnCreateLoadBalancer.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHcnCreateLoadBalancer.Addr(), 4, uintptr(unsafe.Pointer(id)), uintptr(unsafe.Pointer(settings)), uintptr(unsafe.Pointer(loadBalancer)), uintptr(unsafe.Pointer(result)), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnOpenLoadBalancer(id *_guid, loadBalancer *hcnLoadBalancer, result **uint16) (hr error) {
+	if hr = procHcnOpenLoadBalancer.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnOpenLoadBalancer.Addr(), 3, uintptr(unsafe.Pointer(id)), uintptr(unsafe.Pointer(loadBalancer)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnModifyLoadBalancer(loadBalancer hcnLoadBalancer, settings string, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(settings)
+	if hr != nil {
+		return
+	}
+	return _hcnModifyLoadBalancer(loadBalancer, _p0, result)
+}
+
+func _hcnModifyLoadBalancer(loadBalancer hcnLoadBalancer, settings *uint16, result **uint16) (hr error) {
+	if hr = procHcnModifyLoadBalancer.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnModifyLoadBalancer.Addr(), 3, uintptr(loadBalancer), uintptr(unsafe.Pointer(settings)), uintptr(unsafe.Pointer(result)))
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnQueryLoadBalancerProperties(loadBalancer hcnLoadBalancer, query string, properties **uint16, result **uint16) (hr error) {
+	var _p0 *uint16
+	_p0, hr = syscall.UTF16PtrFromString(query)
+	if hr != nil {
+		return
+	}
+	return _hcnQueryLoadBalancerProperties(loadBalancer, _p0, properties, result)
+}
+
+func _hcnQueryLoadBalancerProperties(loadBalancer hcnLoadBalancer, query *uint16, properties **uint16, result **uint16) (hr error) {
+	if hr = procHcnQueryLoadBalancerProperties.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHcnQueryLoadBalancerProperties.Addr(), 4, uintptr(loadBalancer), uintptr(unsafe.Pointer(query)), uintptr(unsafe.Pointer(properties)), uintptr(unsafe.Pointer(result)), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnDeleteLoadBalancer(id *_guid, result **uint16) (hr error) {
+	if hr = procHcnDeleteLoadBalancer.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnDeleteLoadBalancer.Addr(), 2, uintptr(unsafe.Pointer(id)), uintptr(unsafe.Pointer(result)), 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnCloseLoadBalancer(loadBalancer hcnLoadBalancer) (hr error) {
+	if hr = procHcnCloseLoadBalancer.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnCloseLoadBalancer.Addr(), 1, uintptr(loadBalancer), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnOpenService(service *hcnService, result **uint16) (hr error) {
+	if hr = procHcnOpenService.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnOpenService.Addr(), 2, uintptr(unsafe.Pointer(service)), uintptr(unsafe.Pointer(result)), 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnRegisterServiceCallback(service hcnService, callback int32, context int32, callbackHandle *hcnCallbackHandle) (hr error) {
+	if hr = procHcnRegisterServiceCallback.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall6(procHcnRegisterServiceCallback.Addr(), 4, uintptr(service), uintptr(callback), uintptr(context), uintptr(unsafe.Pointer(callbackHandle)), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnUnregisterServiceCallback(callbackHandle hcnCallbackHandle) (hr error) {
+	if hr = procHcnUnregisterServiceCallback.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnUnregisterServiceCallback.Addr(), 1, uintptr(callbackHandle), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
+func hcnCloseService(service hcnService) (hr error) {
+	if hr = procHcnCloseService.Find(); hr != nil {
+		return
+	}
+	r0, _, _ := syscall.Syscall(procHcnCloseService.Addr(), 1, uintptr(service), 0, 0)
+	if int32(r0) < 0 {
+		if r0&0x1fff0000 == 0x00070000 {
+			r0 &= 0xffff
+		}
+		hr = syscall.Errno(r0)
+	}
+	return
+}

vendor/github.com/Microsoft/hcsshim/hnsendpoint.go

@@ -39,11 +39,21 @@ func HNSListEndpointRequest() ([]HNSEndpoint, error) {
 
 // HotAttachEndpoint makes a HCS Call to attach the endpoint to the container
 func HotAttachEndpoint(containerID string, endpointID string) error {
+	endpoint, err := GetHNSEndpointByID(endpointID)
+	isAttached, err := endpoint.IsAttached(containerID)
+	if isAttached {
+		return err
+	}
 	return modifyNetworkEndpoint(containerID, endpointID, Add)
 }
 
 // HotDetachEndpoint makes a HCS Call to detach the endpoint from the container
 func HotDetachEndpoint(containerID string, endpointID string) error {
+	endpoint, err := GetHNSEndpointByID(endpointID)
+	isAttached, err := endpoint.IsAttached(containerID)
+	if !isAttached {
+		return err
+	}
 	return modifyNetworkEndpoint(containerID, endpointID, Remove)
 }
 

vendor/github.com/Microsoft/hcsshim/internal/cni/registry.go

@@ -0,0 +1,110 @@
+package cni
+
+import (
+	"errors"
+
+	"github.com/Microsoft/go-winio/pkg/guid"
+	"github.com/Microsoft/hcsshim/internal/regstate"
+)
+
+const (
+	cniRoot = "cni"
+	cniKey  = "cfg"
+)
+
+// PersistedNamespaceConfig is the registry version of the `NamespaceID` to UVM
+// map.
+type PersistedNamespaceConfig struct {
+	namespaceID string
+	stored      bool
+
+	ContainerID  string
+	HostUniqueID guid.GUID
+}
+
+// NewPersistedNamespaceConfig creates an in-memory namespace config that can be
+// persisted to the registry.
+func NewPersistedNamespaceConfig(namespaceID, containerID string, containerHostUniqueID guid.GUID) *PersistedNamespaceConfig {
+	return &PersistedNamespaceConfig{
+		namespaceID:  namespaceID,
+		ContainerID:  containerID,
+		HostUniqueID: containerHostUniqueID,
+	}
+}
+
+// LoadPersistedNamespaceConfig loads a persisted config from the registry that matches
+// `namespaceID`. If not found returns `regstate.NotFoundError`
+func LoadPersistedNamespaceConfig(namespaceID string) (*PersistedNamespaceConfig, error) {
+	sk, err := regstate.Open(cniRoot, false)
+	if err != nil {
+		return nil, err
+	}
+	defer sk.Close()
+
+	pnc := PersistedNamespaceConfig{
+		namespaceID: namespaceID,
+		stored:      true,
+	}
+	if err := sk.Get(namespaceID, cniKey, &pnc); err != nil {
+		return nil, err
+	}
+	return &pnc, nil
+}
+
+// Store stores or updates the in-memory config to its registry state. If the
+// store failes returns the store error.
+func (pnc *PersistedNamespaceConfig) Store() error {
+	if pnc.namespaceID == "" {
+		return errors.New("invalid namespaceID ''")
+	}
+	if pnc.ContainerID == "" {
+		return errors.New("invalid containerID ''")
+	}
+	empty := guid.GUID{}
+	if pnc.HostUniqueID == empty {
+		return errors.New("invalid containerHostUniqueID 'empy'")
+	}
+	sk, err := regstate.Open(cniRoot, false)
+	if err != nil {
+		return err
+	}
+	defer sk.Close()
+
+	if pnc.stored {
+		if err := sk.Set(pnc.namespaceID, cniKey, pnc); err != nil {
+			return err
+		}
+	} else {
+		if err := sk.Create(pnc.namespaceID, cniKey, pnc); err != nil {
+			return err
+		}
+	}
+	pnc.stored = true
+	return nil
+}
+
+// Remove removes any persisted state associated with this config. If the config
+// is not found in the registery `Remove` returns no error.
+func (pnc *PersistedNamespaceConfig) Remove() error {
+	if pnc.stored {
+		sk, err := regstate.Open(cniRoot, false)
+		if err != nil {
+			if regstate.IsNotFoundError(err) {
+				pnc.stored = false
+				return nil
+			}
+			return err
+		}
+		defer sk.Close()
+
+		if err := sk.Remove(pnc.namespaceID); err != nil {
+			if regstate.IsNotFoundError(err) {
+				pnc.stored = false
+				return nil
+			}
+			return err
+		}
+	}
+	pnc.stored = false
+	return nil
+}

vendor/github.com/Microsoft/hcsshim/internal/cow/cow.go

@@ -0,0 +1,80 @@
+package cow
+
+import (
+	"context"
+	"io"
+
+	"github.com/Microsoft/hcsshim/internal/schema1"
+)
+
+// Process is the interface for an OS process running in a container or utility VM.
+type Process interface {
+	// Close releases resources associated with the process and closes the
+	// writer and readers returned by Stdio. Depending on the implementation,
+	// this may also terminate the process.
+	Close() error
+	// CloseStdin causes the process's stdin handle to receive EOF/EPIPE/whatever
+	// is appropriate to indicate that no more data is available.
+	CloseStdin(ctx context.Context) error
+	// Pid returns the process ID.
+	Pid() int
+	// Stdio returns the stdio streams for a process. These may be nil if a stream
+	// was not requested during CreateProcess.
+	Stdio() (_ io.Writer, _ io.Reader, _ io.Reader)
+	// ResizeConsole resizes the virtual terminal associated with the process.
+	ResizeConsole(ctx context.Context, width, height uint16) error
+	// Kill sends a SIGKILL or equivalent signal to the process and returns whether
+	// the signal was delivered. It does not wait for the process to terminate.
+	Kill(ctx context.Context) (bool, error)
+	// Signal sends a signal to the process and returns whether the signal was
+	// delivered. The input is OS specific (either
+	// guestrequest.SignalProcessOptionsWCOW or
+	// guestrequest.SignalProcessOptionsLCOW). It does not wait for the process
+	// to terminate.
+	Signal(ctx context.Context, options interface{}) (bool, error)
+	// Wait waits for the process to complete, or for a connection to the process to be
+	// terminated by some error condition (including calling Close).
+	Wait() error
+	// ExitCode returns the exit code of the process. Returns an error if the process is
+	// not running.
+	ExitCode() (int, error)
+}
+
+// ProcessHost is the interface for creating processes.
+type ProcessHost interface {
+	// CreateProcess creates a process. The configuration is host specific
+	// (either hcsschema.ProcessParameters or lcow.ProcessParameters).
+	CreateProcess(ctx context.Context, config interface{}) (Process, error)
+	// OS returns the host's operating system, "linux" or "windows".
+	OS() string
+	// IsOCI specifies whether this is an OCI-compliant process host. If true,
+	// then the configuration passed to CreateProcess should have an OCI process
+	// spec (or nil if this is the initial process in an OCI container).
+	// Otherwise, it should have the HCS-specific process parameters.
+	IsOCI() bool
+}
+
+// Container is the interface for container objects, either running on the host or
+// in a utility VM.
+type Container interface {
+	ProcessHost
+	// Close releases the resources associated with the container. Depending on
+	// the implementation, this may also terminate the container.
+	Close() error
+	// ID returns the container ID.
+	ID() string
+	// Properties returns the requested container properties.
+	Properties(ctx context.Context, types ...schema1.PropertyType) (*schema1.ContainerProperties, error)
+	// Start starts a container.
+	Start(ctx context.Context) error
+	// Shutdown sends a shutdown request to the container (but does not wait for
+	// the shutdown to complete).
+	Shutdown(ctx context.Context) error
+	// Terminate sends a terminate request to the container (but does not wait
+	// for the terminate to complete).
+	Terminate(ctx context.Context) error
+	// Wait waits for the container to terminate, or for the connection to the
+	// container to be terminated by some error condition (including calling
+	// Close).
+	Wait() error
+}

vendor/github.com/Microsoft/hcsshim/internal/guestrequest/types.go

@@ -1,100 +0,0 @@
-package guestrequest
-
-import (
-	"github.com/Microsoft/hcsshim/internal/schema2"
-)
-
-// Arguably, many of these (at least CombinedLayers) should have been generated
-// by swagger.
-//
-// This will also change package name due to an inbound breaking change.
-
-// This class is used by a modify request to add or remove a combined layers
-// structure in the guest. For windows, the GCS applies a filter in ContainerRootPath
-// using the specified layers as the parent content. Ignores property ScratchPath
-// since the container path is already the scratch path. For linux, the GCS unions
-// the specified layers and ScratchPath together, placing the resulting union
-// filesystem at ContainerRootPath.
-type CombinedLayers struct {
-	ContainerRootPath string            `json:"ContainerRootPath,omitempty"`
-	Layers            []hcsschema.Layer `json:"Layers,omitempty"`
-	ScratchPath       string            `json:"ScratchPath,omitempty"`
-}
-
-// Defines the schema for hosted settings passed to GCS and/or OpenGCS
-
-// SCSI. Scratch space for remote file-system commands, or R/W layer for containers
-type LCOWMappedVirtualDisk struct {
-	MountPath  string `json:"MountPath,omitempty"` // /tmp/scratch for an LCOW utility VM being used as a service VM
-	Lun        uint8  `json:"Lun,omitempty"`
-	Controller uint8  `json:"Controller,omitempty"`
-	ReadOnly   bool   `json:"ReadOnly,omitempty"`
-}
-
-type WCOWMappedVirtualDisk struct {
-	ContainerPath string `json:"ContainerPath,omitempty"`
-	Lun           int32  `json:"Lun,omitempty"`
-}
-
-type LCOWMappedDirectory struct {
-	MountPath string `json:"MountPath,omitempty"`
-	Port      int32  `json:"Port,omitempty"`
-	ShareName string `json:"ShareName,omitempty"` // If empty not using ANames (not currently supported)
-	ReadOnly  bool   `json:"ReadOnly,omitempty"`
-}
-
-// Read-only layers over VPMem
-type LCOWMappedVPMemDevice struct {
-	DeviceNumber uint32 `json:"DeviceNumber,omitempty"`
-	MountPath    string `json:"MountPath,omitempty"` // /tmp/pN
-}
-
-type LCOWNetworkAdapter struct {
-	NamespaceID     string `json:",omitempty"`
-	ID              string `json:",omitempty"`
-	MacAddress      string `json:",omitempty"`
-	IPAddress       string `json:",omitempty"`
-	PrefixLength    uint8  `json:",omitempty"`
-	GatewayAddress  string `json:",omitempty"`
-	DNSSuffix       string `json:",omitempty"`
-	DNSServerList   string `json:",omitempty"`
-	EnableLowMetric bool   `json:",omitempty"`
-	EncapOverhead   uint16 `json:",omitempty"`
-}
-
-type ResourceType string
-
-const (
-	// These are constants for v2 schema modify guest requests.
-	ResourceTypeMappedDirectory   ResourceType = "MappedDirectory"
-	ResourceTypeMappedVirtualDisk ResourceType = "MappedVirtualDisk"
-	ResourceTypeNetwork           ResourceType = "Network"
-	ResourceTypeNetworkNamespace  ResourceType = "NetworkNamespace"
-	ResourceTypeCombinedLayers    ResourceType = "CombinedLayers"
-	ResourceTypeVPMemDevice       ResourceType = "VPMemDevice"
-)
-
-// GuestRequest is for modify commands passed to the guest.
-type GuestRequest struct {
-	RequestType  string       `json:"RequestType,omitempty"`
-	ResourceType ResourceType `json:"ResourceType,omitempty"`
-	Settings     interface{}  `json:"Settings,omitempty"`
-}
-
-type NetworkModifyRequest struct {
-	AdapterId   string      `json:"AdapterId,omitempty"`
-	RequestType string      `json:"RequestType,omitempty"`
-	Settings    interface{} `json:"Settings,omitempty"`
-}
-
-type RS4NetworkModifyRequest struct {
-	AdapterInstanceId string      `json:"AdapterInstanceId,omitempty"`
-	RequestType       string      `json:"RequestType,omitempty"`
-	Settings          interface{} `json:"Settings,omitempty"`
-}
-
-// SignalProcessOptions is the options passed to either WCOW or LCOW
-// to signal a given process.
-type SignalProcessOptions struct {
-	Signal int `json:,omitempty`
-}

vendor/github.com/Microsoft/hcsshim/internal/guid/guid.go

@@ -1,69 +0,0 @@
-package guid
-
-import (
-	"crypto/rand"
-	"encoding/json"
-	"fmt"
-	"io"
-	"strconv"
-	"strings"
-)
-
-var _ = (json.Marshaler)(&GUID{})
-var _ = (json.Unmarshaler)(&GUID{})
-
-type GUID [16]byte
-
-func New() GUID {
-	g := GUID{}
-	_, err := io.ReadFull(rand.Reader, g[:])
-	if err != nil {
-		panic(err)
-	}
-	return g
-}
-
-func (g GUID) String() string {
-	return fmt.Sprintf("%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x-%02x", g[3], g[2], g[1], g[0], g[5], g[4], g[7], g[6], g[8:10], g[10:])
-}
-
-func FromString(s string) GUID {
-	if len(s) != 36 {
-		panic(fmt.Sprintf("invalid GUID length: %d", len(s)))
-	}
-	if s[8] != '-' || s[13] != '-' || s[18] != '-' || s[23] != '-' {
-		panic("invalid GUID format")
-	}
-	indexOrder := [16]int{
-		0, 2, 4, 6,
-		9, 11,
-		14, 16,
-		19, 21,
-		24, 26, 28, 30, 32, 34,
-	}
-	byteOrder := [16]int{
-		3, 2, 1, 0,
-		5, 4,
-		7, 6,
-		8, 9,
-		10, 11, 12, 13, 14, 15,
-	}
-	var g GUID
-	for i, x := range indexOrder {
-		b, err := strconv.ParseInt(s[x:x+2], 16, 16)
-		if err != nil {
-			panic(err)
-		}
-		g[byteOrder[i]] = byte(b)
-	}
-	return g
-}
-
-func (g GUID) MarshalJSON() ([]byte, error) {
-	return json.Marshal(g.String())
-}
-
-func (g *GUID) UnmarshalJSON(data []byte) error {
-	*g = FromString(strings.Trim(string(data), "\""))
-	return nil
-}

vendor/github.com/Microsoft/hcsshim/internal/hcs/callback.go

@@ -1,10 +1,13 @@
 package hcs
 
 import (
+	"fmt"
 	"sync"
 	"syscall"
 
 	"github.com/Microsoft/hcsshim/internal/interop"
+	"github.com/Microsoft/hcsshim/internal/logfields"
+	"github.com/Microsoft/hcsshim/internal/vmcompute"
 	"github.com/sirupsen/logrus"
 )
 
@@ -40,35 +43,83 @@ var (
 )
 
 type hcsNotification uint32
+
+func (hn hcsNotification) String() string {
+	switch hn {
+	case hcsNotificationSystemExited:
+		return "SystemExited"
+	case hcsNotificationSystemCreateCompleted:
+		return "SystemCreateCompleted"
+	case hcsNotificationSystemStartCompleted:
+		return "SystemStartCompleted"
+	case hcsNotificationSystemPauseCompleted:
+		return "SystemPauseCompleted"
+	case hcsNotificationSystemResumeCompleted:
+		return "SystemResumeCompleted"
+	case hcsNotificationSystemCrashReport:
+		return "SystemCrashReport"
+	case hcsNotificationSystemSiloJobCreated:
+		return "SystemSiloJobCreated"
+	case hcsNotificationSystemSaveCompleted:
+		return "SystemSaveCompleted"
+	case hcsNotificationSystemRdpEnhancedModeStateChanged:
+		return "SystemRdpEnhancedModeStateChanged"
+	case hcsNotificationSystemShutdownFailed:
+		return "SystemShutdownFailed"
+	case hcsNotificationSystemGetPropertiesCompleted:
+		return "SystemGetPropertiesCompleted"
+	case hcsNotificationSystemModifyCompleted:
+		return "SystemModifyCompleted"
+	case hcsNotificationSystemCrashInitiated:
+		return "SystemCrashInitiated"
+	case hcsNotificationSystemGuestConnectionClosed:
+		return "SystemGuestConnectionClosed"
+	case hcsNotificationProcessExited:
+		return "ProcessExited"
+	case hcsNotificationInvalid:
+		return "Invalid"
+	case hcsNotificationServiceDisconnect:
+		return "ServiceDisconnect"
+	default:
+		return fmt.Sprintf("Unknown: %d", hn)
+	}
+}
+
 type notificationChannel chan error
 
 type notifcationWatcherContext struct {
 	channels notificationChannels
-	handle   hcsCallback
+	handle   vmcompute.HcsCallback
+
+	systemID  string
+	processID int
 }
 
 type notificationChannels map[hcsNotification]notificationChannel
 
-func newChannels() notificationChannels {
+func newSystemChannels() notificationChannels {
 	channels := make(notificationChannels)
+	for _, notif := range []hcsNotification{
+		hcsNotificationServiceDisconnect,
+		hcsNotificationSystemExited,
+		hcsNotificationSystemCreateCompleted,
+		hcsNotificationSystemStartCompleted,
+		hcsNotificationSystemPauseCompleted,
+		hcsNotificationSystemResumeCompleted,
+	} {
+		channels[notif] = make(notificationChannel, 1)
+	}
+	return channels
+}
 
-	channels[hcsNotificationSystemExited] = make(notificationChannel, 1)
+func newProcessChannels() notificationChannels {
-	channels[hcsNotificationSystemCreateCompleted] = make(notificationChannel, 1)
+	channels := make(notificationChannels)
-	channels[hcsNotificationSystemStartCompleted] = make(notificationChannel, 1)
+	for _, notif := range []hcsNotification{
-	channels[hcsNotificationSystemPauseCompleted] = make(notificationChannel, 1)
+		hcsNotificationServiceDisconnect,
-	channels[hcsNotificationSystemResumeCompleted] = make(notificationChannel, 1)
+		hcsNotificationProcessExited,
-	channels[hcsNotificationProcessExited] = make(notificationChannel, 1)
+	} {
-	channels[hcsNotificationServiceDisconnect] = make(notificationChannel, 1)
+		channels[notif] = make(notificationChannel, 1)
-	channels[hcsNotificationSystemCrashReport] = make(notificationChannel, 1)
+	}
-	channels[hcsNotificationSystemSiloJobCreated] = make(notificationChannel, 1)
-	channels[hcsNotificationSystemSaveCompleted] = make(notificationChannel, 1)
-	channels[hcsNotificationSystemRdpEnhancedModeStateChanged] = make(notificationChannel, 1)
-	channels[hcsNotificationSystemShutdownFailed] = make(notificationChannel, 1)
-	channels[hcsNotificationSystemGetPropertiesCompleted] = make(notificationChannel, 1)
-	channels[hcsNotificationSystemModifyCompleted] = make(notificationChannel, 1)
-	channels[hcsNotificationSystemCrashInitiated] = make(notificationChannel, 1)
-	channels[hcsNotificationSystemGuestConnectionClosed] = make(notificationChannel, 1)
-
 	return channels
 }
 
@@ -92,12 +143,17 @@ func notificationWatcher(notificationType hcsNotification, callbackNumber uintpt
 		return 0
 	}
 
+	log := logrus.WithFields(logrus.Fields{
+		"notification-type": notificationType.String(),
+		"system-id":         context.systemID,
+	})
+	if context.processID != 0 {
+		log.Data[logfields.ProcessID] = context.processID
+	}
+	log.Debug("HCS notification")
+
 	if channel, ok := context.channels[notificationType]; ok {
 		channel <- result
-	} else {
-		logrus.WithFields(logrus.Fields{
-			"notification-type": notificationType,
-		}).Warn("Received a callback of an unsupported type")
 	}
 
 	return 0

vendor/github.com/Microsoft/hcsshim/internal/hcs/errors.go

@@ -1,14 +1,14 @@
 package hcs
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"net"
 	"syscall"
 
-	"github.com/Microsoft/hcsshim/internal/interop"
+	"github.com/Microsoft/hcsshim/internal/log"
-	"github.com/Microsoft/hcsshim/internal/logfields"
-	"github.com/sirupsen/logrus"
 )
 
 var (
@@ -117,17 +117,11 @@ func (ev *ErrorEvent) String() string {
 	return evs
 }
 
-func processHcsResult(resultp *uint16) []ErrorEvent {
+func processHcsResult(ctx context.Context, resultJSON string) []ErrorEvent {
-	if resultp != nil {
+	if resultJSON != "" {
-		resultj := interop.ConvertAndFreeCoTaskMemString(resultp)
-		logrus.WithField(logfields.JSON, resultj).
-			Debug("HCS Result")
 		result := &hcsResult{}
-		if err := json.Unmarshal([]byte(resultj), result); err != nil {
+		if err := json.Unmarshal([]byte(resultJSON), result); err != nil {
-			logrus.WithFields(logrus.Fields{
+			log.G(ctx).WithError(err).Warning("Could not unmarshal HCS result")
-				logfields.JSON:  resultj,
-				logrus.ErrorKey: err,
-			}).Warning("Could not unmarshal HCS result")
 			return nil
 		}
 		return result.ErrorEvents
@@ -141,6 +135,8 @@ type HcsError struct {
 	Events []ErrorEvent
 }
 
+var _ net.Error = &HcsError{}
+
 func (e *HcsError) Error() string {
 	s := e.Op + ": " + e.Err.Error()
 	for _, ev := range e.Events {
@@ -149,6 +145,16 @@ func (e *HcsError) Error() string {
 	return s
 }
 
+func (e *HcsError) Temporary() bool {
+	err, ok := e.Err.(net.Error)
+	return ok && err.Temporary()
+}
+
+func (e *HcsError) Timeout() bool {
+	err, ok := e.Err.(net.Error)
+	return ok && err.Timeout()
+}
+
 // ProcessError is an error encountered in HCS during an operation on a Process object
 type ProcessError struct {
 	SystemID string
@@ -158,6 +164,8 @@ type ProcessError struct {
 	Events   []ErrorEvent
 }
 
+var _ net.Error = &ProcessError{}
+
 // SystemError is an error encountered in HCS during an operation on a Container object
 type SystemError struct {
 	ID     string
@@ -167,6 +175,8 @@ type SystemError struct {
 	Events []ErrorEvent
 }
 
+var _ net.Error = &SystemError{}
+
 func (e *SystemError) Error() string {
 	s := e.Op + " " + e.ID + ": " + e.Err.Error()
 	for _, ev := range e.Events {
@@ -178,6 +188,16 @@ func (e *SystemError) Error() string {
 	return s
 }
 
+func (e *SystemError) Temporary() bool {
+	err, ok := e.Err.(net.Error)
+	return ok && err.Temporary()
+}
+
+func (e *SystemError) Timeout() bool {
+	err, ok := e.Err.(net.Error)
+	return ok && err.Timeout()
+}
+
 func makeSystemError(system *System, op string, extra string, err error, events []ErrorEvent) error {
 	// Don't double wrap errors
 	if _, ok := err.(*SystemError); ok {
@@ -200,6 +220,16 @@ func (e *ProcessError) Error() string {
 	return s
 }
 
+func (e *ProcessError) Temporary() bool {
+	err, ok := e.Err.(net.Error)
+	return ok && err.Temporary()
+}
+
+func (e *ProcessError) Timeout() bool {
+	err, ok := e.Err.(net.Error)
+	return ok && err.Timeout()
+}
+
 func makeProcessError(process *Process, op string, err error, events []ErrorEvent) error {
 	// Don't double wrap errors
 	if _, ok := err.(*ProcessError); ok {
@@ -242,6 +272,9 @@ func IsPending(err error) bool {
 // IsTimeout returns a boolean indicating whether the error is caused by
 // a timeout waiting for the operation to complete.
 func IsTimeout(err error) bool {
+	if err, ok := err.(net.Error); ok && err.Timeout() {
+		return true
+	}
 	err = getInnerError(err)
 	return err == ErrTimeout
 }
@@ -272,6 +305,13 @@ func IsNotSupported(err error) bool {
 		err == ErrVmcomputeUnknownMessage
 }
 
+// IsOperationInvalidState returns true when err is caused by
+// `ErrVmcomputeOperationInvalidState`.
+func IsOperationInvalidState(err error) bool {
+	err = getInnerError(err)
+	return err == ErrVmcomputeOperationInvalidState
+}
+
 func getInnerError(err error) error {
 	switch pe := err.(type) {
 	case nil:
@@ -285,3 +325,12 @@ func getInnerError(err error) error {
 	}
 	return err
 }
+
+func getOperationLogResult(err error) (string, error) {
+	switch err {
+	case nil:
+		return "Success", nil
+	default:
+		return "Error", err
+	}
+}

vendor/github.com/Microsoft/hcsshim/internal/hcs/hcs.go

@@ -1,48 +0,0 @@
-// Shim for the Host Compute Service (HCS) to manage Windows Server
-// containers and Hyper-V containers.
-
-package hcs
-
-import (
-	"syscall"
-)
-
-//go:generate go run ../../mksyscall_windows.go -output zsyscall_windows.go hcs.go
-
-//sys hcsEnumerateComputeSystems(query string, computeSystems **uint16, result **uint16) (hr error) = vmcompute.HcsEnumerateComputeSystems?
-//sys hcsCreateComputeSystem(id string, configuration string, identity syscall.Handle, computeSystem *hcsSystem, result **uint16) (hr error) = vmcompute.HcsCreateComputeSystem?
-//sys hcsOpenComputeSystem(id string, computeSystem *hcsSystem, result **uint16) (hr error) = vmcompute.HcsOpenComputeSystem?
-//sys hcsCloseComputeSystem(computeSystem hcsSystem) (hr error) = vmcompute.HcsCloseComputeSystem?
-//sys hcsStartComputeSystem(computeSystem hcsSystem, options string, result **uint16) (hr error) = vmcompute.HcsStartComputeSystem?
-//sys hcsShutdownComputeSystem(computeSystem hcsSystem, options string, result **uint16) (hr error) = vmcompute.HcsShutdownComputeSystem?
-//sys hcsTerminateComputeSystem(computeSystem hcsSystem, options string, result **uint16) (hr error) = vmcompute.HcsTerminateComputeSystem?
-//sys hcsPauseComputeSystem(computeSystem hcsSystem, options string, result **uint16) (hr error) = vmcompute.HcsPauseComputeSystem?
-//sys hcsResumeComputeSystem(computeSystem hcsSystem, options string, result **uint16) (hr error) = vmcompute.HcsResumeComputeSystem?
-//sys hcsGetComputeSystemProperties(computeSystem hcsSystem, propertyQuery string, properties **uint16, result **uint16) (hr error) = vmcompute.HcsGetComputeSystemProperties?
-//sys hcsModifyComputeSystem(computeSystem hcsSystem, configuration string, result **uint16) (hr error) = vmcompute.HcsModifyComputeSystem?
-//sys hcsRegisterComputeSystemCallback(computeSystem hcsSystem, callback uintptr, context uintptr, callbackHandle *hcsCallback) (hr error) = vmcompute.HcsRegisterComputeSystemCallback?
-//sys hcsUnregisterComputeSystemCallback(callbackHandle hcsCallback) (hr error) = vmcompute.HcsUnregisterComputeSystemCallback?
-
-//sys hcsCreateProcess(computeSystem hcsSystem, processParameters string, processInformation *hcsProcessInformation, process *hcsProcess, result **uint16) (hr error) = vmcompute.HcsCreateProcess?
-//sys hcsOpenProcess(computeSystem hcsSystem, pid uint32, process *hcsProcess, result **uint16) (hr error) = vmcompute.HcsOpenProcess?
-//sys hcsCloseProcess(process hcsProcess) (hr error) = vmcompute.HcsCloseProcess?
-//sys hcsTerminateProcess(process hcsProcess, result **uint16) (hr error) = vmcompute.HcsTerminateProcess?
-//sys hcsSignalProcess(process hcsProcess, options string, result **uint16) (hr error) = vmcompute.HcsTerminateProcess?
-//sys hcsGetProcessInfo(process hcsProcess, processInformation *hcsProcessInformation, result **uint16) (hr error) = vmcompute.HcsGetProcessInfo?
-//sys hcsGetProcessProperties(process hcsProcess, processProperties **uint16, result **uint16) (hr error) = vmcompute.HcsGetProcessProperties?
-//sys hcsModifyProcess(process hcsProcess, settings string, result **uint16) (hr error) = vmcompute.HcsModifyProcess?
-//sys hcsGetServiceProperties(propertyQuery string, properties **uint16, result **uint16) (hr error) = vmcompute.HcsGetServiceProperties?
-//sys hcsRegisterProcessCallback(process hcsProcess, callback uintptr, context uintptr, callbackHandle *hcsCallback) (hr error) = vmcompute.HcsRegisterProcessCallback?
-//sys hcsUnregisterProcessCallback(callbackHandle hcsCallback) (hr error) = vmcompute.HcsUnregisterProcessCallback?
-
-type hcsSystem syscall.Handle
-type hcsProcess syscall.Handle
-type hcsCallback syscall.Handle
-
-type hcsProcessInformation struct {
-	ProcessId uint32
-	Reserved  uint32
-	StdInput  syscall.Handle
-	StdOutput syscall.Handle
-	StdError  syscall.Handle
-}

vendor/github.com/Microsoft/hcsshim/internal/hcs/log.go

@@ -1,20 +0,0 @@
-package hcs
-
-import "github.com/sirupsen/logrus"
-
-func logOperationBegin(ctx logrus.Fields, msg string) {
-	logrus.WithFields(ctx).Debug(msg)
-}
-
-func logOperationEnd(ctx logrus.Fields, msg string, err error) {
-	// Copy the log and fields first.
-	log := logrus.WithFields(ctx)
-	if err == nil {
-		log.Debug(msg)
-	} else {
-		// Edit only the copied field data to avoid race conditions on the
-		// write.
-		log.Data[logrus.ErrorKey] = err
-		log.Error(msg)
-	}
-}

vendor/github.com/Microsoft/hcsshim/internal/hcs/process.go

@@ -1,52 +1,45 @@
 package hcs
 
 import (
+	"context"
 	"encoding/json"
 	"io"
 	"sync"
 	"syscall"
 	"time"
 
-	"github.com/Microsoft/hcsshim/internal/guestrequest"
+	"github.com/Microsoft/hcsshim/internal/log"
-	"github.com/Microsoft/hcsshim/internal/interop"
+	"github.com/Microsoft/hcsshim/internal/oc"
-	"github.com/Microsoft/hcsshim/internal/logfields"
+	"github.com/Microsoft/hcsshim/internal/vmcompute"
-	"github.com/sirupsen/logrus"
+	"go.opencensus.io/trace"
 )
 
 // ContainerError is an error encountered in HCS
 type Process struct {
 	handleLock     sync.RWMutex
-	handle         hcsProcess
+	handle         vmcompute.HcsProcess
 	processID      int
 	system         *System
-	cachedPipes    *cachedPipes
+	stdin          io.WriteCloser
+	stdout         io.ReadCloser
+	stderr         io.ReadCloser
 	callbackNumber uintptr
 
-	logctx logrus.Fields
+	closedWaitOnce sync.Once
-
+	waitBlock      chan struct{}
-	waitBlock chan struct{}
+	exitCode       int
-	waitError error
+	waitError      error
 }
 
-func newProcess(process hcsProcess, processID int, computeSystem *System) *Process {
+func newProcess(process vmcompute.HcsProcess, processID int, computeSystem *System) *Process {
 	return &Process{
 		handle:    process,
 		processID: processID,
 		system:    computeSystem,
-		logctx: logrus.Fields{
-			logfields.ContainerID: computeSystem.ID(),
-			logfields.ProcessID:   processID,
-		},
 		waitBlock: make(chan struct{}),
 	}
 }
 
-type cachedPipes struct {
-	stdIn  syscall.Handle
-	stdOut syscall.Handle
-	stdErr syscall.Handle
-}
-
 type processModifyRequest struct {
 	Operation   string
 	ConsoleSize *consoleSize `json:",omitempty"`
@@ -62,7 +55,7 @@ type closeHandle struct {
 	Handle string
 }
 
-type ProcessStatus struct {
+type processStatus struct {
 	ProcessID      uint32
 	Exited         bool
 	ExitCode       uint32
@@ -90,134 +83,153 @@ func (process *Process) SystemID() string {
 	return process.system.ID()
 }
 
-func (process *Process) logOperationBegin(operation string) {
+func (process *Process) processSignalResult(ctx context.Context, err error) (bool, error) {
-	logOperationBegin(
+	switch err {
-		process.logctx,
+	case nil:
-		operation+" - Begin Operation")
+		return true, nil
-}
+	case ErrVmcomputeOperationInvalidState, ErrComputeSystemDoesNotExist, ErrElementNotFound:
-
+		select {
-func (process *Process) logOperationEnd(operation string, err error) {
+		case <-process.waitBlock:
-	var result string
+			// The process exit notification has already arrived.
-	if err == nil {
+		default:
-		result = "Success"
+			// The process should be gone, but we have not received the notification.
-	} else {
+			// After a second, force unblock the process wait to work around a possible
-		result = "Error"
+			// deadlock in the HCS.
+			go func() {
+				time.Sleep(time.Second)
+				process.closedWaitOnce.Do(func() {
+					log.G(ctx).WithError(err).Warn("force unblocking process waits")
+					process.exitCode = -1
+					process.waitError = err
+					close(process.waitBlock)
+				})
+			}()
+		}
+		return false, nil
+	default:
+		return false, err
 	}
-
-	logOperationEnd(
-		process.logctx,
-		operation+" - End Operation - "+result,
-		err)
 }
 
 // Signal signals the process with `options`.
-func (process *Process) Signal(options guestrequest.SignalProcessOptions) (err error) {
+//
+// For LCOW `guestrequest.SignalProcessOptionsLCOW`.
+//
+// For WCOW `guestrequest.SignalProcessOptionsWCOW`.
+func (process *Process) Signal(ctx context.Context, options interface{}) (bool, error) {
 	process.handleLock.RLock()
 	defer process.handleLock.RUnlock()
 
 	operation := "hcsshim::Process::Signal"
-	process.logOperationBegin(operation)
-	defer func() { process.logOperationEnd(operation, err) }()
 
 	if process.handle == 0 {
-		return makeProcessError(process, operation, ErrAlreadyClosed, nil)
+		return false, makeProcessError(process, operation, ErrAlreadyClosed, nil)
 	}
 
 	optionsb, err := json.Marshal(options)
 	if err != nil {
-		return err
+		return false, err
 	}
 
-	optionsStr := string(optionsb)
+	resultJSON, err := vmcompute.HcsSignalProcess(ctx, process.handle, string(optionsb))
-
+	events := processHcsResult(ctx, resultJSON)
-	var resultp *uint16
+	delivered, err := process.processSignalResult(ctx, err)
-	syscallWatcher(process.logctx, func() {
-		err = hcsSignalProcess(process.handle, optionsStr, &resultp)
-	})
-	events := processHcsResult(resultp)
 	if err != nil {
-		return makeProcessError(process, operation, err, events)
+		err = makeProcessError(process, operation, err, events)
 	}
-
+	return delivered, err
-	return nil
 }
 
 // Kill signals the process to terminate but does not wait for it to finish terminating.
-func (process *Process) Kill() (err error) {
+func (process *Process) Kill(ctx context.Context) (bool, error) {
 	process.handleLock.RLock()
 	defer process.handleLock.RUnlock()
 
 	operation := "hcsshim::Process::Kill"
-	process.logOperationBegin(operation)
-	defer func() { process.logOperationEnd(operation, err) }()
 
 	if process.handle == 0 {
-		return makeProcessError(process, operation, ErrAlreadyClosed, nil)
+		return false, makeProcessError(process, operation, ErrAlreadyClosed, nil)
 	}
 
-	var resultp *uint16
+	resultJSON, err := vmcompute.HcsTerminateProcess(ctx, process.handle)
-	syscallWatcher(process.logctx, func() {
+	events := processHcsResult(ctx, resultJSON)
-		err = hcsTerminateProcess(process.handle, &resultp)
+	delivered, err := process.processSignalResult(ctx, err)
-	})
-	events := processHcsResult(resultp)
 	if err != nil {
-		return makeProcessError(process, operation, err, events)
+		err = makeProcessError(process, operation, err, events)
 	}
-
+	return delivered, err
-	return nil
 }
 
 // waitBackground waits for the process exit notification. Once received sets
-// `process.waitError` (if any) and unblocks all `Wait` and `WaitTimeout` calls.
+// `process.waitError` (if any) and unblocks all `Wait` calls.
 //
-// This MUST be called exactly once per `process.handle` but `Wait` and
+// This MUST be called exactly once per `process.handle` but `Wait` is safe to
-// `WaitTimeout` are safe to call multiple times.
+// call multiple times.
 func (process *Process) waitBackground() {
-	process.waitError = waitForNotification(process.callbackNumber, hcsNotificationProcessExited, nil)
+	operation := "hcsshim::Process::waitBackground"
-	close(process.waitBlock)
+	ctx, span := trace.StartSpan(context.Background(), operation)
+	defer span.End()
+	span.AddAttributes(
+		trace.StringAttribute("cid", process.SystemID()),
+		trace.Int64Attribute("pid", int64(process.processID)))
+
+	var (
+		err      error
+		exitCode = -1
+	)
+
+	err = waitForNotification(ctx, process.callbackNumber, hcsNotificationProcessExited, nil)
+	if err != nil {
+		err = makeProcessError(process, operation, err, nil)
+		log.G(ctx).WithError(err).Error("failed wait")
+	} else {
+		process.handleLock.RLock()
+		defer process.handleLock.RUnlock()
+
+		// Make sure we didnt race with Close() here
+		if process.handle != 0 {
+			propertiesJSON, resultJSON, err := vmcompute.HcsGetProcessProperties(ctx, process.handle)
+			events := processHcsResult(ctx, resultJSON)
+			if err != nil {
+				err = makeProcessError(process, operation, err, events)
+			} else {
+				properties := &processStatus{}
+				err = json.Unmarshal([]byte(propertiesJSON), properties)
+				if err != nil {
+					err = makeProcessError(process, operation, err, nil)
+				} else {
+					if properties.LastWaitResult != 0 {
+						log.G(ctx).WithField("wait-result", properties.LastWaitResult).Warning("non-zero last wait result")
+					} else {
+						exitCode = int(properties.ExitCode)
+					}
+				}
+			}
+		}
+	}
+	log.G(ctx).WithField("exitCode", exitCode).Debug("process exited")
+
+	process.closedWaitOnce.Do(func() {
+		process.exitCode = exitCode
+		process.waitError = err
+		close(process.waitBlock)
+	})
+	oc.SetSpanStatus(span, err)
 }
 
 // Wait waits for the process to exit. If the process has already exited returns
 // the pervious error (if any).
-func (process *Process) Wait() (err error) {
+func (process *Process) Wait() error {
-	operation := "hcsshim::Process::Wait"
-	process.logOperationBegin(operation)
-	defer func() { process.logOperationEnd(operation, err) }()
-
 	<-process.waitBlock
-	if process.waitError != nil {
+	return process.waitError
-		return makeProcessError(process, operation, err, nil)
-	}
-	return nil
-}
-
-// WaitTimeout waits for the process to exit or the duration to elapse. If the
-// process has already exited returns the pervious error (if any). If a timeout
-// occurs returns `ErrTimeout`.
-func (process *Process) WaitTimeout(timeout time.Duration) (err error) {
-	operation := "hcssshim::Process::WaitTimeout"
-	process.logOperationBegin(operation)
-	defer func() { process.logOperationEnd(operation, err) }()
-
-	select {
-	case <-process.waitBlock:
-		if process.waitError != nil {
-			return makeProcessError(process, operation, process.waitError, nil)
-		}
-		return nil
-	case <-time.After(timeout):
-		return makeProcessError(process, operation, ErrTimeout, nil)
-	}
 }
 
 // ResizeConsole resizes the console of the process.
-func (process *Process) ResizeConsole(width, height uint16) (err error) {
+func (process *Process) ResizeConsole(ctx context.Context, width, height uint16) error {
 	process.handleLock.RLock()
 	defer process.handleLock.RUnlock()
 
 	operation := "hcsshim::Process::ResizeConsole"
-	process.logOperationBegin(operation)
-	defer func() { process.logOperationEnd(operation, err) }()
 
 	if process.handle == 0 {
 		return makeProcessError(process, operation, ErrAlreadyClosed, nil)
@@ -236,11 +248,8 @@ func (process *Process) ResizeConsole(width, height uint16) (err error) {
 		return err
 	}
 
-	modifyRequestStr := string(modifyRequestb)
+	resultJSON, err := vmcompute.HcsModifyProcess(ctx, process.handle, string(modifyRequestb))
-
+	events := processHcsResult(ctx, resultJSON)
-	var resultp *uint16
-	err = hcsModifyProcess(process.handle, modifyRequestStr, &resultp)
-	events := processHcsResult(resultp)
 	if err != nil {
 		return makeProcessError(process, operation, err, events)
 	}
@@ -248,109 +257,46 @@ func (process *Process) ResizeConsole(width, height uint16) (err error) {
 	return nil
 }
 
-func (process *Process) Properties() (_ *ProcessStatus, err error) {
-	process.handleLock.RLock()
-	defer process.handleLock.RUnlock()
-
-	operation := "hcsshim::Process::Properties"
-	process.logOperationBegin(operation)
-	defer func() { process.logOperationEnd(operation, err) }()
-
-	if process.handle == 0 {
-		return nil, makeProcessError(process, operation, ErrAlreadyClosed, nil)
-	}
-
-	var (
-		resultp     *uint16
-		propertiesp *uint16
-	)
-	syscallWatcher(process.logctx, func() {
-		err = hcsGetProcessProperties(process.handle, &propertiesp, &resultp)
-	})
-	events := processHcsResult(resultp)
-	if err != nil {
-		return nil, makeProcessError(process, operation, err, events)
-	}
-
-	if propertiesp == nil {
-		return nil, ErrUnexpectedValue
-	}
-	propertiesRaw := interop.ConvertAndFreeCoTaskMemBytes(propertiesp)
-
-	properties := &ProcessStatus{}
-	if err := json.Unmarshal(propertiesRaw, properties); err != nil {
-		return nil, makeProcessError(process, operation, err, nil)
-	}
-
-	return properties, nil
-}
-
 // ExitCode returns the exit code of the process. The process must have
 // already terminated.
-func (process *Process) ExitCode() (_ int, err error) {
+func (process *Process) ExitCode() (int, error) {
-	operation := "hcsshim::Process::ExitCode"
+	select {
-	process.logOperationBegin(operation)
+	case <-process.waitBlock:
-	defer func() { process.logOperationEnd(operation, err) }()
+		if process.waitError != nil {
-
+			return -1, process.waitError
-	properties, err := process.Properties()
+		}
-	if err != nil {
+		return process.exitCode, nil
-		return -1, makeProcessError(process, operation, err, nil)
+	default:
+		return -1, makeProcessError(process, "hcsshim::Process::ExitCode", ErrInvalidProcessState, nil)
 	}
-
-	if properties.Exited == false {
-		return -1, makeProcessError(process, operation, ErrInvalidProcessState, nil)
-	}
-
-	if properties.LastWaitResult != 0 {
-		logrus.WithFields(logrus.Fields{
-			logfields.ContainerID: process.SystemID(),
-			logfields.ProcessID:   process.processID,
-			"wait-result":         properties.LastWaitResult,
-		}).Warn("hcsshim::Process::ExitCode - Non-zero last wait result")
-		return -1, nil
-	}
-
-	return int(properties.ExitCode), nil
 }
 
-// Stdio returns the stdin, stdout, and stderr pipes, respectively. Closing
+// StdioLegacy returns the stdin, stdout, and stderr pipes, respectively. Closing
-// these pipes does not close the underlying pipes; it should be possible to
+// these pipes does not close the underlying pipes; but this function can only
-// call this multiple times to get multiple interfaces.
+// be called once on each Process.
-func (process *Process) Stdio() (_ io.WriteCloser, _ io.ReadCloser, _ io.ReadCloser, err error) {
+func (process *Process) StdioLegacy() (_ io.WriteCloser, _ io.ReadCloser, _ io.ReadCloser, err error) {
+	operation := "hcsshim::Process::StdioLegacy"
+	ctx, span := trace.StartSpan(context.Background(), operation)
+	defer span.End()
+	defer func() { oc.SetSpanStatus(span, err) }()
+	span.AddAttributes(
+		trace.StringAttribute("cid", process.SystemID()),
+		trace.Int64Attribute("pid", int64(process.processID)))
+
 	process.handleLock.RLock()
 	defer process.handleLock.RUnlock()
 
-	operation := "hcsshim::Process::Stdio"
-	process.logOperationBegin(operation)
-	defer func() { process.logOperationEnd(operation, err) }()
-
 	if process.handle == 0 {
 		return nil, nil, nil, makeProcessError(process, operation, ErrAlreadyClosed, nil)
 	}
 
-	var stdIn, stdOut, stdErr syscall.Handle
+	processInfo, resultJSON, err := vmcompute.HcsGetProcessInfo(ctx, process.handle)
-
+	events := processHcsResult(ctx, resultJSON)
-	if process.cachedPipes == nil {
+	if err != nil {
-		var (
+		return nil, nil, nil, makeProcessError(process, operation, err, events)
-			processInfo hcsProcessInformation
-			resultp     *uint16
-		)
-		err = hcsGetProcessInfo(process.handle, &processInfo, &resultp)
-		events := processHcsResult(resultp)
-		if err != nil {
-			return nil, nil, nil, makeProcessError(process, operation, err, events)
-		}
-
-		stdIn, stdOut, stdErr = processInfo.StdInput, processInfo.StdOutput, processInfo.StdError
-	} else {
-		// Use cached pipes
-		stdIn, stdOut, stdErr = process.cachedPipes.stdIn, process.cachedPipes.stdOut, process.cachedPipes.stdErr
-
-		// Invalidate the cache
-		process.cachedPipes = nil
 	}
 
-	pipes, err := makeOpenFiles([]syscall.Handle{stdIn, stdOut, stdErr})
+	pipes, err := makeOpenFiles([]syscall.Handle{processInfo.StdInput, processInfo.StdOutput, processInfo.StdError})
 	if err != nil {
 		return nil, nil, nil, makeProcessError(process, operation, err, nil)
 	}
@@ -358,15 +304,19 @@ func (process *Process) Stdio() (_ io.WriteCloser, _ io.ReadCloser, _ io.ReadClo
 	return pipes[0], pipes[1], pipes[2], nil
 }
 
+// Stdio returns the stdin, stdout, and stderr pipes, respectively.
+// To close them, close the process handle.
+func (process *Process) Stdio() (stdin io.Writer, stdout, stderr io.Reader) {
+	return process.stdin, process.stdout, process.stderr
+}
+
 // CloseStdin closes the write side of the stdin pipe so that the process is
 // notified on the read side that there is no more data in stdin.
-func (process *Process) CloseStdin() (err error) {
+func (process *Process) CloseStdin(ctx context.Context) error {
 	process.handleLock.RLock()
 	defer process.handleLock.RUnlock()
 
 	operation := "hcsshim::Process::CloseStdin"
-	process.logOperationBegin(operation)
-	defer func() { process.logOperationEnd(operation, err) }()
 
 	if process.handle == 0 {
 		return makeProcessError(process, operation, ErrAlreadyClosed, nil)
@@ -384,93 +334,113 @@ func (process *Process) CloseStdin() (err error) {
 		return err
 	}
 
-	modifyRequestStr := string(modifyRequestb)
+	resultJSON, err := vmcompute.HcsModifyProcess(ctx, process.handle, string(modifyRequestb))
-
+	events := processHcsResult(ctx, resultJSON)
-	var resultp *uint16
-	err = hcsModifyProcess(process.handle, modifyRequestStr, &resultp)
-	events := processHcsResult(resultp)
 	if err != nil {
 		return makeProcessError(process, operation, err, events)
 	}
 
+	if process.stdin != nil {
+		process.stdin.Close()
+	}
 	return nil
 }
 
 // Close cleans up any state associated with the process but does not kill
 // or wait on it.
 func (process *Process) Close() (err error) {
+	operation := "hcsshim::Process::Close"
+	ctx, span := trace.StartSpan(context.Background(), operation)
+	defer span.End()
+	defer func() { oc.SetSpanStatus(span, err) }()
+	span.AddAttributes(
+		trace.StringAttribute("cid", process.SystemID()),
+		trace.Int64Attribute("pid", int64(process.processID)))
+
 	process.handleLock.Lock()
 	defer process.handleLock.Unlock()
 
-	operation := "hcsshim::Process::Close"
-	process.logOperationBegin(operation)
-	defer func() { process.logOperationEnd(operation, err) }()
-
 	// Don't double free this
 	if process.handle == 0 {
 		return nil
 	}
 
-	if err = process.unregisterCallback(); err != nil {
+	if process.stdin != nil {
+		process.stdin.Close()
+	}
+	if process.stdout != nil {
+		process.stdout.Close()
+	}
+	if process.stderr != nil {
+		process.stderr.Close()
+	}
+
+	if err = process.unregisterCallback(ctx); err != nil {
 		return makeProcessError(process, operation, err, nil)
 	}
 
-	if err = hcsCloseProcess(process.handle); err != nil {
+	if err = vmcompute.HcsCloseProcess(ctx, process.handle); err != nil {
 		return makeProcessError(process, operation, err, nil)
 	}
 
 	process.handle = 0
+	process.closedWaitOnce.Do(func() {
+		process.exitCode = -1
+		process.waitError = ErrAlreadyClosed
+		close(process.waitBlock)
+	})
 
 	return nil
 }
 
-func (process *Process) registerCallback() error {
+func (process *Process) registerCallback(ctx context.Context) error {
-	context := &notifcationWatcherContext{
+	callbackContext := &notifcationWatcherContext{
-		channels: newChannels(),
+		channels:  newProcessChannels(),
+		systemID:  process.SystemID(),
+		processID: process.processID,
 	}
 
 	callbackMapLock.Lock()
 	callbackNumber := nextCallback
 	nextCallback++
-	callbackMap[callbackNumber] = context
+	callbackMap[callbackNumber] = callbackContext
 	callbackMapLock.Unlock()
 
-	var callbackHandle hcsCallback
+	callbackHandle, err := vmcompute.HcsRegisterProcessCallback(ctx, process.handle, notificationWatcherCallback, callbackNumber)
-	err := hcsRegisterProcessCallback(process.handle, notificationWatcherCallback, callbackNumber, &callbackHandle)
 	if err != nil {
 		return err
 	}
-	context.handle = callbackHandle
+	callbackContext.handle = callbackHandle
 	process.callbackNumber = callbackNumber
 
 	return nil
 }
 
-func (process *Process) unregisterCallback() error {
+func (process *Process) unregisterCallback(ctx context.Context) error {
 	callbackNumber := process.callbackNumber
 
 	callbackMapLock.RLock()
-	context := callbackMap[callbackNumber]
+	callbackContext := callbackMap[callbackNumber]
 	callbackMapLock.RUnlock()
 
-	if context == nil {
+	if callbackContext == nil {
 		return nil
 	}
 
-	handle := context.handle
+	handle := callbackContext.handle
 
 	if handle == 0 {
 		return nil
 	}
 
-	// hcsUnregisterProcessCallback has its own syncronization
+	// vmcompute.HcsUnregisterProcessCallback has its own synchronization to
-	// to wait for all callbacks to complete. We must NOT hold the callbackMapLock.
+	// wait for all callbacks to complete. We must NOT hold the callbackMapLock.
-	err := hcsUnregisterProcessCallback(handle)
+	err := vmcompute.HcsUnregisterProcessCallback(ctx, handle)
 	if err != nil {
 		return err
 	}
 
-	closeChannels(context.channels)
+	closeChannels(callbackContext.channels)
 
 	callbackMapLock.Lock()
 	delete(callbackMap, callbackNumber)

vendor/github.com/Microsoft/hcsshim/internal/hcs/system.go

@@ -1,18 +1,23 @@
 package hcs
 
 import (
+	"context"
 	"encoding/json"
+	"errors"
 	"os"
 	"strconv"
+	"strings"
 	"sync"
 	"syscall"
 	"time"
 
-	"github.com/Microsoft/hcsshim/internal/interop"
+	"github.com/Microsoft/hcsshim/internal/cow"
-	"github.com/Microsoft/hcsshim/internal/logfields"
+	"github.com/Microsoft/hcsshim/internal/log"
+	"github.com/Microsoft/hcsshim/internal/oc"
 	"github.com/Microsoft/hcsshim/internal/schema1"
 	"github.com/Microsoft/hcsshim/internal/timeout"
-	"github.com/sirupsen/logrus"
+	"github.com/Microsoft/hcsshim/internal/vmcompute"
+	"go.opencensus.io/trace"
 )
 
 // currentContainerStarts is used to limit the number of concurrent container
@@ -38,53 +43,37 @@ func init() {
 
 type System struct {
 	handleLock     sync.RWMutex
-	handle         hcsSystem
+	handle         vmcompute.HcsSystem
 	id             string
 	callbackNumber uintptr
 
-	logctx logrus.Fields
+	closedWaitOnce sync.Once
+	waitBlock      chan struct{}
+	waitError      error
+	exitError      error
 
-	waitBlock chan struct{}
+	os, typ string
-	waitError error
 }
 
 func newSystem(id string) *System {
 	return &System{
-		id: id,
+		id:        id,
-		logctx: logrus.Fields{
-			logfields.ContainerID: id,
-		},
 		waitBlock: make(chan struct{}),
 	}
 }
 
-func (computeSystem *System) logOperationBegin(operation string) {
-	logOperationBegin(
-		computeSystem.logctx,
-		operation+" - Begin Operation")
-}
-
-func (computeSystem *System) logOperationEnd(operation string, err error) {
-	var result string
-	if err == nil {
-		result = "Success"
-	} else {
-		result = "Error"
-	}
-
-	logOperationEnd(
-		computeSystem.logctx,
-		operation+" - End Operation - "+result,
-		err)
-}
-
 // CreateComputeSystem creates a new compute system with the given configuration but does not start it.
-func CreateComputeSystem(id string, hcsDocumentInterface interface{}) (_ *System, err error) {
+func CreateComputeSystem(ctx context.Context, id string, hcsDocumentInterface interface{}) (_ *System, err error) {
 	operation := "hcsshim::CreateComputeSystem"
 
+	// hcsCreateComputeSystemContext is an async operation. Start the outer span
+	// here to measure the full create time.
+	ctx, span := trace.StartSpan(ctx, operation)
+	defer span.End()
+	defer func() { oc.SetSpanStatus(span, err) }()
+	span.AddAttributes(trace.StringAttribute("cid", id))
+
 	computeSystem := newSystem(id)
-	computeSystem.logOperationBegin(operation)
-	defer func() { computeSystem.logOperationEnd(operation, err) }()
 
 	hcsDocumentB, err := json.Marshal(hcsDocumentInterface)
 	if err != nil {
@@ -93,129 +82,114 @@ func CreateComputeSystem(id string, hcsDocumentInterface interface{}) (_ *System
 
 	hcsDocument := string(hcsDocumentB)
 
-	logrus.WithFields(computeSystem.logctx).
-		WithField(logfields.JSON, hcsDocument).
-		Debug("HCS ComputeSystem Document")
-
 	var (
-		resultp     *uint16
 		identity    syscall.Handle
+		resultJSON  string
 		createError error
 	)
-	syscallWatcher(computeSystem.logctx, func() {
+	computeSystem.handle, resultJSON, createError = vmcompute.HcsCreateComputeSystem(ctx, id, hcsDocument, identity)
-		createError = hcsCreateComputeSystem(id, hcsDocument, identity, &computeSystem.handle, &resultp)
-	})
-
 	if createError == nil || IsPending(createError) {
-		if err = computeSystem.registerCallback(); err != nil {
+		defer func() {
+			if err != nil {
+				computeSystem.Close()
+			}
+		}()
+		if err = computeSystem.registerCallback(ctx); err != nil {
 			// Terminate the compute system if it still exists. We're okay to
 			// ignore a failure here.
-			computeSystem.Terminate()
+			computeSystem.Terminate(ctx)
 			return nil, makeSystemError(computeSystem, operation, "", err, nil)
 		}
 	}
 
-	events, err := processAsyncHcsResult(createError, resultp, computeSystem.callbackNumber, hcsNotificationSystemCreateCompleted, &timeout.SystemCreate)
+	events, err := processAsyncHcsResult(ctx, createError, resultJSON, computeSystem.callbackNumber, hcsNotificationSystemCreateCompleted, &timeout.SystemCreate)
 	if err != nil {
 		if err == ErrTimeout {
 			// Terminate the compute system if it still exists. We're okay to
 			// ignore a failure here.
-			computeSystem.Terminate()
+			computeSystem.Terminate(ctx)
 		}
 		return nil, makeSystemError(computeSystem, operation, hcsDocument, err, events)
 	}
-
 	go computeSystem.waitBackground()
-
+	if err = computeSystem.getCachedProperties(ctx); err != nil {
+		return nil, err
+	}
 	return computeSystem, nil
 }
 
 // OpenComputeSystem opens an existing compute system by ID.
-func OpenComputeSystem(id string) (_ *System, err error) {
+func OpenComputeSystem(ctx context.Context, id string) (*System, error) {
 	operation := "hcsshim::OpenComputeSystem"
 
 	computeSystem := newSystem(id)
-	computeSystem.logOperationBegin(operation)
+	handle, resultJSON, err := vmcompute.HcsOpenComputeSystem(ctx, id)
-	defer func() {
+	events := processHcsResult(ctx, resultJSON)
-		if IsNotExist(err) {
-			computeSystem.logOperationEnd(operation, nil)
-		} else {
-			computeSystem.logOperationEnd(operation, err)
-		}
-	}()
-
-	var (
-		handle  hcsSystem
-		resultp *uint16
-	)
-	err = hcsOpenComputeSystem(id, &handle, &resultp)
-	events := processHcsResult(resultp)
 	if err != nil {
 		return nil, makeSystemError(computeSystem, operation, "", err, events)
 	}
-
 	computeSystem.handle = handle
-
+	defer func() {
-	if err = computeSystem.registerCallback(); err != nil {
+		if err != nil {
+			computeSystem.Close()
+		}
+	}()
+	if err = computeSystem.registerCallback(ctx); err != nil {
 		return nil, makeSystemError(computeSystem, operation, "", err, nil)
 	}
 	go computeSystem.waitBackground()
-
+	if err = computeSystem.getCachedProperties(ctx); err != nil {
+		return nil, err
+	}
 	return computeSystem, nil
 }
 
+func (computeSystem *System) getCachedProperties(ctx context.Context) error {
+	props, err := computeSystem.Properties(ctx)
+	if err != nil {
+		return err
+	}
+	computeSystem.typ = strings.ToLower(props.SystemType)
+	computeSystem.os = strings.ToLower(props.RuntimeOSType)
+	if computeSystem.os == "" && computeSystem.typ == "container" {
+		// Pre-RS5 HCS did not return the OS, but it only supported containers
+		// that ran Windows.
+		computeSystem.os = "windows"
+	}
+	return nil
+}
+
+// OS returns the operating system of the compute system, "linux" or "windows".
+func (computeSystem *System) OS() string {
+	return computeSystem.os
+}
+
+// IsOCI returns whether processes in the compute system should be created via
+// OCI.
+func (computeSystem *System) IsOCI() bool {
+	return computeSystem.os == "linux" && computeSystem.typ == "container"
+}
+
 // GetComputeSystems gets a list of the compute systems on the system that match the query
-func GetComputeSystems(q schema1.ComputeSystemQuery) (_ []schema1.ContainerProperties, err error) {
+func GetComputeSystems(ctx context.Context, q schema1.ComputeSystemQuery) ([]schema1.ContainerProperties, error) {
 	operation := "hcsshim::GetComputeSystems"
-	fields := logrus.Fields{}
-	logOperationBegin(
-		fields,
-		operation+" - Begin Operation")
-
-	defer func() {
-		var result string
-		if err == nil {
-			result = "Success"
-		} else {
-			result = "Error"
-		}
-
-		logOperationEnd(
-			fields,
-			operation+" - End Operation - "+result,
-			err)
-	}()
 
 	queryb, err := json.Marshal(q)
 	if err != nil {
 		return nil, err
 	}
 
-	query := string(queryb)
+	computeSystemsJSON, resultJSON, err := vmcompute.HcsEnumerateComputeSystems(ctx, string(queryb))
-
+	events := processHcsResult(ctx, resultJSON)
-	logrus.WithFields(fields).
-		WithField(logfields.JSON, query).
-		Debug("HCS ComputeSystem Query")
-
-	var (
-		resultp         *uint16
-		computeSystemsp *uint16
-	)
-
-	syscallWatcher(fields, func() {
-		err = hcsEnumerateComputeSystems(query, &computeSystemsp, &resultp)
-	})
-	events := processHcsResult(resultp)
 	if err != nil {
 		return nil, &HcsError{Op: operation, Err: err, Events: events}
 	}
 
-	if computeSystemsp == nil {
+	if computeSystemsJSON == "" {
 		return nil, ErrUnexpectedValue
 	}
-	computeSystemsRaw := interop.ConvertAndFreeCoTaskMemBytes(computeSystemsp)
 	computeSystems := []schema1.ContainerProperties{}
-	if err = json.Unmarshal(computeSystemsRaw, &computeSystems); err != nil {
+	if err = json.Unmarshal([]byte(computeSystemsJSON), &computeSystems); err != nil {
 		return nil, err
 	}
 
@@ -223,16 +197,21 @@ func GetComputeSystems(q schema1.ComputeSystemQuery) (_ []schema1.ContainerPrope
 }
 
 // Start synchronously starts the computeSystem.
-func (computeSystem *System) Start() (err error) {
+func (computeSystem *System) Start(ctx context.Context) (err error) {
+	operation := "hcsshim::System::Start"
+
+	// hcsStartComputeSystemContext is an async operation. Start the outer span
+	// here to measure the full start time.
+	ctx, span := trace.StartSpan(ctx, operation)
+	defer span.End()
+	defer func() { oc.SetSpanStatus(span, err) }()
+	span.AddAttributes(trace.StringAttribute("cid", computeSystem.id))
+
 	computeSystem.handleLock.RLock()
 	defer computeSystem.handleLock.RUnlock()
 
-	operation := "hcsshim::ComputeSystem::Start"
-	computeSystem.logOperationBegin(operation)
-	defer func() { computeSystem.logOperationEnd(operation, err) }()
-
 	if computeSystem.handle == 0 {
-		return makeSystemError(computeSystem, "Start", "", ErrAlreadyClosed, nil)
+		return makeSystemError(computeSystem, operation, "", ErrAlreadyClosed, nil)
 	}
 
 	// This is a very simple backoff-retry loop to limit the number
@@ -261,13 +240,10 @@ func (computeSystem *System) Start() (err error) {
 		}()
 	}
 
-	var resultp *uint16
+	resultJSON, err := vmcompute.HcsStartComputeSystem(ctx, computeSystem.handle, "")
-	syscallWatcher(computeSystem.logctx, func() {
+	events, err := processAsyncHcsResult(ctx, err, resultJSON, computeSystem.callbackNumber, hcsNotificationSystemStartCompleted, &timeout.SystemStart)
-		err = hcsStartComputeSystem(computeSystem.handle, "", &resultp)
-	})
-	events, err := processAsyncHcsResult(err, resultp, computeSystem.callbackNumber, hcsNotificationSystemStartCompleted, &timeout.SystemStart)
 	if err != nil {
-		return makeSystemError(computeSystem, "Start", "", err, events)
+		return makeSystemError(computeSystem, operation, "", err, events)
 	}
 
 	return nil
@@ -278,270 +254,258 @@ func (computeSystem *System) ID() string {
 	return computeSystem.id
 }
 
-// Shutdown requests a compute system shutdown, if IsPending() on the error returned is true,
+// Shutdown requests a compute system shutdown.
-// it may not actually be shut down until Wait() succeeds.
+func (computeSystem *System) Shutdown(ctx context.Context) error {
-func (computeSystem *System) Shutdown() (err error) {
 	computeSystem.handleLock.RLock()
 	defer computeSystem.handleLock.RUnlock()
 
-	operation := "hcsshim::ComputeSystem::Shutdown"
+	operation := "hcsshim::System::Shutdown"
-	computeSystem.logOperationBegin(operation)
-	defer func() {
-		if IsAlreadyStopped(err) || IsPending(err) {
-			computeSystem.logOperationEnd(operation, nil)
-		} else {
-			computeSystem.logOperationEnd(operation, err)
-		}
-	}()
 
 	if computeSystem.handle == 0 {
-		return makeSystemError(computeSystem, "Shutdown", "", ErrAlreadyClosed, nil)
+		return nil
 	}
 
-	var resultp *uint16
+	resultJSON, err := vmcompute.HcsShutdownComputeSystem(ctx, computeSystem.handle, "")
-	syscallWatcher(computeSystem.logctx, func() {
+	events := processHcsResult(ctx, resultJSON)
-		err = hcsShutdownComputeSystem(computeSystem.handle, "", &resultp)
+	switch err {
-	})
+	case nil, ErrVmcomputeAlreadyStopped, ErrComputeSystemDoesNotExist, ErrVmcomputeOperationPending:
-	events := processHcsResult(resultp)
+	default:
-	if err != nil {
+		return makeSystemError(computeSystem, operation, "", err, events)
-		return makeSystemError(computeSystem, "Shutdown", "", err, events)
 	}
-
 	return nil
 }
 
-// Terminate requests a compute system terminate, if IsPending() on the error returned is true,
+// Terminate requests a compute system terminate.
-// it may not actually be shut down until Wait() succeeds.
+func (computeSystem *System) Terminate(ctx context.Context) error {
-func (computeSystem *System) Terminate() (err error) {
 	computeSystem.handleLock.RLock()
 	defer computeSystem.handleLock.RUnlock()
 
-	operation := "hcsshim::ComputeSystem::Terminate"
+	operation := "hcsshim::System::Terminate"
-	computeSystem.logOperationBegin(operation)
-	defer func() {
-		if IsPending(err) {
-			computeSystem.logOperationEnd(operation, nil)
-		} else {
-			computeSystem.logOperationEnd(operation, err)
-		}
-	}()
 
 	if computeSystem.handle == 0 {
-		return makeSystemError(computeSystem, "Terminate", "", ErrAlreadyClosed, nil)
+		return nil
 	}
 
-	var resultp *uint16
+	resultJSON, err := vmcompute.HcsTerminateComputeSystem(ctx, computeSystem.handle, "")
-	syscallWatcher(computeSystem.logctx, func() {
+	events := processHcsResult(ctx, resultJSON)
-		err = hcsTerminateComputeSystem(computeSystem.handle, "", &resultp)
+	switch err {
-	})
+	case nil, ErrVmcomputeAlreadyStopped, ErrComputeSystemDoesNotExist, ErrVmcomputeOperationPending:
-	events := processHcsResult(resultp)
+	default:
-	if err != nil && err != ErrVmcomputeAlreadyStopped {
+		return makeSystemError(computeSystem, operation, "", err, events)
-		return makeSystemError(computeSystem, "Terminate", "", err, events)
 	}
-
 	return nil
 }
 
 // waitBackground waits for the compute system exit notification. Once received
-// sets `computeSystem.waitError` (if any) and unblocks all `Wait`,
+// sets `computeSystem.waitError` (if any) and unblocks all `Wait` calls.
-// `WaitExpectedError`, and `WaitTimeout` calls.
 //
-// This MUST be called exactly once per `computeSystem.handle` but `Wait`,
+// This MUST be called exactly once per `computeSystem.handle` but `Wait` is
-// `WaitExpectedError`, and `WaitTimeout` are safe to call multiple times.
+// safe to call multiple times.
 func (computeSystem *System) waitBackground() {
-	computeSystem.waitError = waitForNotification(computeSystem.callbackNumber, hcsNotificationSystemExited, nil)
+	operation := "hcsshim::System::waitBackground"
-	close(computeSystem.waitBlock)
+	ctx, span := trace.StartSpan(context.Background(), operation)
+	defer span.End()
+	span.AddAttributes(trace.StringAttribute("cid", computeSystem.id))
+
+	err := waitForNotification(ctx, computeSystem.callbackNumber, hcsNotificationSystemExited, nil)
+	switch err {
+	case nil:
+		log.G(ctx).Debug("system exited")
+	case ErrVmcomputeUnexpectedExit:
+		log.G(ctx).Debug("unexpected system exit")
+		computeSystem.exitError = makeSystemError(computeSystem, operation, "", err, nil)
+		err = nil
+	default:
+		err = makeSystemError(computeSystem, operation, "", err, nil)
+	}
+	computeSystem.closedWaitOnce.Do(func() {
+		computeSystem.waitError = err
+		close(computeSystem.waitBlock)
+	})
+	oc.SetSpanStatus(span, err)
 }
 
 // Wait synchronously waits for the compute system to shutdown or terminate. If
 // the compute system has already exited returns the previous error (if any).
-func (computeSystem *System) Wait() (err error) {
+func (computeSystem *System) Wait() error {
-	operation := "hcsshim::ComputeSystem::Wait"
-	computeSystem.logOperationBegin(operation)
-	defer func() { computeSystem.logOperationEnd(operation, err) }()
-
 	<-computeSystem.waitBlock
-	if computeSystem.waitError != nil {
+	return computeSystem.waitError
-		return makeSystemError(computeSystem, "Wait", "", computeSystem.waitError, nil)
-	}
-
-	return nil
 }
 
-// WaitExpectedError synchronously waits for the compute system to shutdown or
+// ExitError returns an error describing the reason the compute system terminated.
-// terminate and returns the error (if any) as long as it does not match
+func (computeSystem *System) ExitError() error {
-// `expected`. If the compute system has already exited returns the previous
-// error (if any) as long as it does not match `expected`.
-func (computeSystem *System) WaitExpectedError(expected error) (err error) {
-	operation := "hcsshim::ComputeSystem::WaitExpectedError"
-	computeSystem.logOperationBegin(operation)
-	defer func() { computeSystem.logOperationEnd(operation, err) }()
-
-	<-computeSystem.waitBlock
-	if computeSystem.waitError != nil && getInnerError(computeSystem.waitError) != expected {
-		return makeSystemError(computeSystem, "WaitExpectedError", "", computeSystem.waitError, nil)
-	}
-	return nil
-}
-
-// WaitTimeout synchronously waits for the compute system to terminate or the
-// duration to elapse. If the timeout expires, `IsTimeout(err) == true`. If
-// the compute system has already exited returns the previous error (if any).
-func (computeSystem *System) WaitTimeout(timeout time.Duration) (err error) {
-	operation := "hcsshim::ComputeSystem::WaitTimeout"
-	computeSystem.logOperationBegin(operation)
-	defer func() { computeSystem.logOperationEnd(operation, err) }()
-
 	select {
 	case <-computeSystem.waitBlock:
 		if computeSystem.waitError != nil {
-			return makeSystemError(computeSystem, "WaitTimeout", "", computeSystem.waitError, nil)
+			return computeSystem.waitError
 		}
-		return nil
+		return computeSystem.exitError
-	case <-time.After(timeout):
+	default:
-		return makeSystemError(computeSystem, "WaitTimeout", "", ErrTimeout, nil)
+		return errors.New("container not exited")
 	}
 }
 
-func (computeSystem *System) Properties(types ...schema1.PropertyType) (_ *schema1.ContainerProperties, err error) {
+func (computeSystem *System) Properties(ctx context.Context, types ...schema1.PropertyType) (*schema1.ContainerProperties, error) {
 	computeSystem.handleLock.RLock()
 	defer computeSystem.handleLock.RUnlock()
 
-	operation := "hcsshim::ComputeSystem::Properties"
+	operation := "hcsshim::System::Properties"
-	computeSystem.logOperationBegin(operation)
-	defer func() { computeSystem.logOperationEnd(operation, err) }()
 
-	queryj, err := json.Marshal(schema1.PropertyQuery{types})
+	queryBytes, err := json.Marshal(schema1.PropertyQuery{PropertyTypes: types})
 	if err != nil {
-		return nil, makeSystemError(computeSystem, "Properties", "", err, nil)
+		return nil, makeSystemError(computeSystem, operation, "", err, nil)
 	}
 
-	logrus.WithFields(computeSystem.logctx).
+	propertiesJSON, resultJSON, err := vmcompute.HcsGetComputeSystemProperties(ctx, computeSystem.handle, string(queryBytes))
-		WithField(logfields.JSON, queryj).
+	events := processHcsResult(ctx, resultJSON)
-		Debug("HCS ComputeSystem Properties Query")
-
-	var resultp, propertiesp *uint16
-	syscallWatcher(computeSystem.logctx, func() {
-		err = hcsGetComputeSystemProperties(computeSystem.handle, string(queryj), &propertiesp, &resultp)
-	})
-	events := processHcsResult(resultp)
 	if err != nil {
-		return nil, makeSystemError(computeSystem, "Properties", "", err, events)
+		return nil, makeSystemError(computeSystem, operation, "", err, events)
 	}
 
-	if propertiesp == nil {
+	if propertiesJSON == "" {
 		return nil, ErrUnexpectedValue
 	}
-	propertiesRaw := interop.ConvertAndFreeCoTaskMemBytes(propertiesp)
 	properties := &schema1.ContainerProperties{}
-	if err := json.Unmarshal(propertiesRaw, properties); err != nil {
+	if err := json.Unmarshal([]byte(propertiesJSON), properties); err != nil {
-		return nil, makeSystemError(computeSystem, "Properties", "", err, nil)
+		return nil, makeSystemError(computeSystem, operation, "", err, nil)
 	}
 
 	return properties, nil
 }
 
 // Pause pauses the execution of the computeSystem. This feature is not enabled in TP5.
-func (computeSystem *System) Pause() (err error) {
+func (computeSystem *System) Pause(ctx context.Context) (err error) {
+	operation := "hcsshim::System::Pause"
+
+	// hcsPauseComputeSystemContext is an async peration. Start the outer span
+	// here to measure the full pause time.
+	ctx, span := trace.StartSpan(ctx, operation)
+	defer span.End()
+	defer func() { oc.SetSpanStatus(span, err) }()
+	span.AddAttributes(trace.StringAttribute("cid", computeSystem.id))
+
 	computeSystem.handleLock.RLock()
 	defer computeSystem.handleLock.RUnlock()
 
-	operation := "hcsshim::ComputeSystem::Pause"
-	computeSystem.logOperationBegin(operation)
-	defer func() { computeSystem.logOperationEnd(operation, err) }()
-
 	if computeSystem.handle == 0 {
-		return makeSystemError(computeSystem, "Pause", "", ErrAlreadyClosed, nil)
+		return makeSystemError(computeSystem, operation, "", ErrAlreadyClosed, nil)
 	}
 
-	var resultp *uint16
+	resultJSON, err := vmcompute.HcsPauseComputeSystem(ctx, computeSystem.handle, "")
-	syscallWatcher(computeSystem.logctx, func() {
+	events, err := processAsyncHcsResult(ctx, err, resultJSON, computeSystem.callbackNumber, hcsNotificationSystemPauseCompleted, &timeout.SystemPause)
-		err = hcsPauseComputeSystem(computeSystem.handle, "", &resultp)
-	})
-	events, err := processAsyncHcsResult(err, resultp, computeSystem.callbackNumber, hcsNotificationSystemPauseCompleted, &timeout.SystemPause)
 	if err != nil {
-		return makeSystemError(computeSystem, "Pause", "", err, events)
+		return makeSystemError(computeSystem, operation, "", err, events)
 	}
 
 	return nil
 }
 
 // Resume resumes the execution of the computeSystem. This feature is not enabled in TP5.
-func (computeSystem *System) Resume() (err error) {
+func (computeSystem *System) Resume(ctx context.Context) (err error) {
+	operation := "hcsshim::System::Resume"
+
+	// hcsResumeComputeSystemContext is an async operation. Start the outer span
+	// here to measure the full restore time.
+	ctx, span := trace.StartSpan(ctx, operation)
+	defer span.End()
+	defer func() { oc.SetSpanStatus(span, err) }()
+	span.AddAttributes(trace.StringAttribute("cid", computeSystem.id))
+
 	computeSystem.handleLock.RLock()
 	defer computeSystem.handleLock.RUnlock()
 
-	operation := "hcsshim::ComputeSystem::Resume"
-	computeSystem.logOperationBegin(operation)
-	defer func() { computeSystem.logOperationEnd(operation, err) }()
-
 	if computeSystem.handle == 0 {
-		return makeSystemError(computeSystem, "Resume", "", ErrAlreadyClosed, nil)
+		return makeSystemError(computeSystem, operation, "", ErrAlreadyClosed, nil)
 	}
 
-	var resultp *uint16
+	resultJSON, err := vmcompute.HcsResumeComputeSystem(ctx, computeSystem.handle, "")
-	syscallWatcher(computeSystem.logctx, func() {
+	events, err := processAsyncHcsResult(ctx, err, resultJSON, computeSystem.callbackNumber, hcsNotificationSystemResumeCompleted, &timeout.SystemResume)
-		err = hcsResumeComputeSystem(computeSystem.handle, "", &resultp)
-	})
-	events, err := processAsyncHcsResult(err, resultp, computeSystem.callbackNumber, hcsNotificationSystemResumeCompleted, &timeout.SystemResume)
 	if err != nil {
-		return makeSystemError(computeSystem, "Resume", "", err, events)
+		return makeSystemError(computeSystem, operation, "", err, events)
 	}
 
 	return nil
 }
 
-// CreateProcess launches a new process within the computeSystem.
+func (computeSystem *System) createProcess(ctx context.Context, operation string, c interface{}) (*Process, *vmcompute.HcsProcessInformation, error) {
-func (computeSystem *System) CreateProcess(c interface{}) (_ *Process, err error) {
 	computeSystem.handleLock.RLock()
 	defer computeSystem.handleLock.RUnlock()
 
-	operation := "hcsshim::ComputeSystem::CreateProcess"
-	computeSystem.logOperationBegin(operation)
-	defer func() { computeSystem.logOperationEnd(operation, err) }()
-
-	var (
-		processInfo   hcsProcessInformation
-		processHandle hcsProcess
-		resultp       *uint16
-	)
-
 	if computeSystem.handle == 0 {
-		return nil, makeSystemError(computeSystem, "CreateProcess", "", ErrAlreadyClosed, nil)
+		return nil, nil, makeSystemError(computeSystem, operation, "", ErrAlreadyClosed, nil)
 	}
 
 	configurationb, err := json.Marshal(c)
 	if err != nil {
-		return nil, makeSystemError(computeSystem, "CreateProcess", "", err, nil)
+		return nil, nil, makeSystemError(computeSystem, operation, "", err, nil)
 	}
 
 	configuration := string(configurationb)
-
+	processInfo, processHandle, resultJSON, err := vmcompute.HcsCreateProcess(ctx, computeSystem.handle, configuration)
-	logrus.WithFields(computeSystem.logctx).
+	events := processHcsResult(ctx, resultJSON)
-		WithField(logfields.JSON, configuration).
-		Debug("HCS ComputeSystem Process Document")
-
-	syscallWatcher(computeSystem.logctx, func() {
-		err = hcsCreateProcess(computeSystem.handle, configuration, &processInfo, &processHandle, &resultp)
-	})
-	events := processHcsResult(resultp)
 	if err != nil {
-		return nil, makeSystemError(computeSystem, "CreateProcess", configuration, err, events)
+		return nil, nil, makeSystemError(computeSystem, operation, configuration, err, events)
 	}
 
-	logrus.WithFields(computeSystem.logctx).
+	log.G(ctx).WithField("pid", processInfo.ProcessId).Debug("created process pid")
-		WithField(logfields.ProcessID, processInfo.ProcessId).
+	return newProcess(processHandle, int(processInfo.ProcessId), computeSystem), &processInfo, nil
-		Debug("HCS ComputeSystem CreateProcess PID")
+}
 
-	process := newProcess(processHandle, int(processInfo.ProcessId), computeSystem)
+// CreateProcessNoStdio launches a new process within the computeSystem. The
-	process.cachedPipes = &cachedPipes{
+// Stdio handles are not cached on the process struct.
-		stdIn:  processInfo.StdInput,
+func (computeSystem *System) CreateProcessNoStdio(c interface{}) (_ cow.Process, err error) {
-		stdOut: processInfo.StdOutput,
+	operation := "hcsshim::System::CreateProcessNoStdio"
-		stdErr: processInfo.StdError,
+	ctx, span := trace.StartSpan(context.Background(), operation)
+	defer span.End()
+	defer func() { oc.SetSpanStatus(span, err) }()
+	span.AddAttributes(trace.StringAttribute("cid", computeSystem.id))
+
+	process, processInfo, err := computeSystem.createProcess(ctx, operation, c)
+	if err != nil {
+		return nil, err
 	}
+	defer func() {
+		if err != nil {
+			process.Close()
+		}
+	}()
 
-	if err = process.registerCallback(); err != nil {
+	// We don't do anything with these handles. Close them so they don't leak.
-		return nil, makeSystemError(computeSystem, "CreateProcess", "", err, nil)
+	syscall.Close(processInfo.StdInput)
+	syscall.Close(processInfo.StdOutput)
+	syscall.Close(processInfo.StdError)
+
+	if err = process.registerCallback(ctx); err != nil {
+		return nil, makeSystemError(computeSystem, operation, "", err, nil)
+	}
+	go process.waitBackground()
+
+	return process, nil
+}
+
+// CreateProcess launches a new process within the computeSystem.
+func (computeSystem *System) CreateProcess(ctx context.Context, c interface{}) (cow.Process, error) {
+	operation := "hcsshim::System::CreateProcess"
+	process, processInfo, err := computeSystem.createProcess(ctx, operation, c)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if err != nil {
+			process.Close()
+		}
+	}()
+
+	pipes, err := makeOpenFiles([]syscall.Handle{processInfo.StdInput, processInfo.StdOutput, processInfo.StdError})
+	if err != nil {
+		return nil, makeSystemError(computeSystem, operation, "", err, nil)
+	}
+	process.stdin = pipes[0]
+	process.stdout = pipes[1]
+	process.stderr = pipes[2]
+
+	if err = process.registerCallback(ctx); err != nil {
+		return nil, makeSystemError(computeSystem, operation, "", err, nil)
 	}
 	go process.waitBackground()
 
@@ -549,38 +513,25 @@ func (computeSystem *System) CreateProcess(c interface{}) (_ *Process, err error
 }
 
 // OpenProcess gets an interface to an existing process within the computeSystem.
-func (computeSystem *System) OpenProcess(pid int) (_ *Process, err error) {
+func (computeSystem *System) OpenProcess(ctx context.Context, pid int) (*Process, error) {
 	computeSystem.handleLock.RLock()
 	defer computeSystem.handleLock.RUnlock()
 
-	// Add PID for the context of this operation
+	operation := "hcsshim::System::OpenProcess"
-	computeSystem.logctx[logfields.ProcessID] = pid
-	defer delete(computeSystem.logctx, logfields.ProcessID)
-
-	operation := "hcsshim::ComputeSystem::OpenProcess"
-	computeSystem.logOperationBegin(operation)
-	defer func() { computeSystem.logOperationEnd(operation, err) }()
-
-	var (
-		processHandle hcsProcess
-		resultp       *uint16
-	)
 
 	if computeSystem.handle == 0 {
-		return nil, makeSystemError(computeSystem, "OpenProcess", "", ErrAlreadyClosed, nil)
+		return nil, makeSystemError(computeSystem, operation, "", ErrAlreadyClosed, nil)
 	}
 
-	syscallWatcher(computeSystem.logctx, func() {
+	processHandle, resultJSON, err := vmcompute.HcsOpenProcess(ctx, computeSystem.handle, uint32(pid))
-		err = hcsOpenProcess(computeSystem.handle, uint32(pid), &processHandle, &resultp)
+	events := processHcsResult(ctx, resultJSON)
-	})
-	events := processHcsResult(resultp)
 	if err != nil {
-		return nil, makeSystemError(computeSystem, "OpenProcess", "", err, events)
+		return nil, makeSystemError(computeSystem, operation, "", err, events)
 	}
 
 	process := newProcess(processHandle, pid, computeSystem)
-	if err = process.registerCallback(); err != nil {
+	if err = process.registerCallback(ctx); err != nil {
-		return nil, makeSystemError(computeSystem, "OpenProcess", "", err, nil)
+		return nil, makeSystemError(computeSystem, operation, "", err, nil)
 	}
 	go process.waitBackground()
 
@@ -589,68 +540,72 @@ func (computeSystem *System) OpenProcess(pid int) (_ *Process, err error) {
 
 // Close cleans up any state associated with the compute system but does not terminate or wait for it.
 func (computeSystem *System) Close() (err error) {
+	operation := "hcsshim::System::Close"
+	ctx, span := trace.StartSpan(context.Background(), operation)
+	defer span.End()
+	defer func() { oc.SetSpanStatus(span, err) }()
+	span.AddAttributes(trace.StringAttribute("cid", computeSystem.id))
+
 	computeSystem.handleLock.Lock()
 	defer computeSystem.handleLock.Unlock()
 
-	operation := "hcsshim::ComputeSystem::Close"
-	computeSystem.logOperationBegin(operation)
-	defer func() { computeSystem.logOperationEnd(operation, err) }()
-
 	// Don't double free this
 	if computeSystem.handle == 0 {
 		return nil
 	}
 
-	if err = computeSystem.unregisterCallback(); err != nil {
+	if err = computeSystem.unregisterCallback(ctx); err != nil {
-		return makeSystemError(computeSystem, "Close", "", err, nil)
+		return makeSystemError(computeSystem, operation, "", err, nil)
 	}
 
-	syscallWatcher(computeSystem.logctx, func() {
+	err = vmcompute.HcsCloseComputeSystem(ctx, computeSystem.handle)
-		err = hcsCloseComputeSystem(computeSystem.handle)
-	})
 	if err != nil {
-		return makeSystemError(computeSystem, "Close", "", err, nil)
+		return makeSystemError(computeSystem, operation, "", err, nil)
 	}
 
 	computeSystem.handle = 0
+	computeSystem.closedWaitOnce.Do(func() {
+		computeSystem.waitError = ErrAlreadyClosed
+		close(computeSystem.waitBlock)
+	})
 
 	return nil
 }
 
-func (computeSystem *System) registerCallback() error {
+func (computeSystem *System) registerCallback(ctx context.Context) error {
-	context := &notifcationWatcherContext{
+	callbackContext := &notifcationWatcherContext{
-		channels: newChannels(),
+		channels: newSystemChannels(),
+		systemID: computeSystem.id,
 	}
 
 	callbackMapLock.Lock()
 	callbackNumber := nextCallback
 	nextCallback++
-	callbackMap[callbackNumber] = context
+	callbackMap[callbackNumber] = callbackContext
 	callbackMapLock.Unlock()
 
-	var callbackHandle hcsCallback
+	callbackHandle, err := vmcompute.HcsRegisterComputeSystemCallback(ctx, computeSystem.handle, notificationWatcherCallback, callbackNumber)
-	err := hcsRegisterComputeSystemCallback(computeSystem.handle, notificationWatcherCallback, callbackNumber, &callbackHandle)
 	if err != nil {
 		return err
 	}
-	context.handle = callbackHandle
+	callbackContext.handle = callbackHandle
 	computeSystem.callbackNumber = callbackNumber
 
 	return nil
 }
 
-func (computeSystem *System) unregisterCallback() error {
+func (computeSystem *System) unregisterCallback(ctx context.Context) error {
 	callbackNumber := computeSystem.callbackNumber
 
 	callbackMapLock.RLock()
-	context := callbackMap[callbackNumber]
+	callbackContext := callbackMap[callbackNumber]
 	callbackMapLock.RUnlock()
 
-	if context == nil {
+	if callbackContext == nil {
 		return nil
 	}
 
-	handle := context.handle
+	handle := callbackContext.handle
 
 	if handle == 0 {
 		return nil
@@ -658,12 +613,12 @@ func (computeSystem *System) unregisterCallback() error {
 
 	// hcsUnregisterComputeSystemCallback has its own syncronization
 	// to wait for all callbacks to complete. We must NOT hold the callbackMapLock.
-	err := hcsUnregisterComputeSystemCallback(handle)
+	err := vmcompute.HcsUnregisterComputeSystemCallback(ctx, handle)
 	if err != nil {
 		return err
 	}
 
-	closeChannels(context.channels)
+	closeChannels(callbackContext.channels)
 
 	callbackMapLock.Lock()
 	delete(callbackMap, callbackNumber)
@@ -675,36 +630,26 @@ func (computeSystem *System) unregisterCallback() error {
 }
 
 // Modify the System by sending a request to HCS
-func (computeSystem *System) Modify(config interface{}) (err error) {
+func (computeSystem *System) Modify(ctx context.Context, config interface{}) error {
 	computeSystem.handleLock.RLock()
 	defer computeSystem.handleLock.RUnlock()
 
-	operation := "hcsshim::ComputeSystem::Modify"
+	operation := "hcsshim::System::Modify"
-	computeSystem.logOperationBegin(operation)
-	defer func() { computeSystem.logOperationEnd(operation, err) }()
 
 	if computeSystem.handle == 0 {
-		return makeSystemError(computeSystem, "Modify", "", ErrAlreadyClosed, nil)
+		return makeSystemError(computeSystem, operation, "", ErrAlreadyClosed, nil)
 	}
 
-	requestJSON, err := json.Marshal(config)
+	requestBytes, err := json.Marshal(config)
 	if err != nil {
 		return err
 	}
 
-	requestString := string(requestJSON)
+	requestJSON := string(requestBytes)
-
+	resultJSON, err := vmcompute.HcsModifyComputeSystem(ctx, computeSystem.handle, requestJSON)
-	logrus.WithFields(computeSystem.logctx).
+	events := processHcsResult(ctx, resultJSON)
-		WithField(logfields.JSON, requestString).
-		Debug("HCS ComputeSystem Modify Document")
-
-	var resultp *uint16
-	syscallWatcher(computeSystem.logctx, func() {
-		err = hcsModifyComputeSystem(computeSystem.handle, requestString, &resultp)
-	})
-	events := processHcsResult(resultp)
 	if err != nil {
-		return makeSystemError(computeSystem, "Modify", requestString, err, events)
+		return makeSystemError(computeSystem, operation, requestJSON, err, events)
 	}
 
 	return nil

vendor/github.com/Microsoft/hcsshim/internal/hcs/waithelper.go

@@ -1,25 +1,26 @@
 package hcs
 
 import (
+	"context"
 	"time"
 
-	"github.com/sirupsen/logrus"
+	"github.com/Microsoft/hcsshim/internal/log"
 )
 
-func processAsyncHcsResult(err error, resultp *uint16, callbackNumber uintptr, expectedNotification hcsNotification, timeout *time.Duration) ([]ErrorEvent, error) {
+func processAsyncHcsResult(ctx context.Context, err error, resultJSON string, callbackNumber uintptr, expectedNotification hcsNotification, timeout *time.Duration) ([]ErrorEvent, error) {
-	events := processHcsResult(resultp)
+	events := processHcsResult(ctx, resultJSON)
 	if IsPending(err) {
-		return nil, waitForNotification(callbackNumber, expectedNotification, timeout)
+		return nil, waitForNotification(ctx, callbackNumber, expectedNotification, timeout)
 	}
 
 	return events, err
 }
 
-func waitForNotification(callbackNumber uintptr, expectedNotification hcsNotification, timeout *time.Duration) error {
+func waitForNotification(ctx context.Context, callbackNumber uintptr, expectedNotification hcsNotification, timeout *time.Duration) error {
 	callbackMapLock.RLock()
 	if _, ok := callbackMap[callbackNumber]; !ok {
 		callbackMapLock.RUnlock()
-		logrus.Errorf("failed to waitForNotification: callbackNumber %d does not exist in callbackMap", callbackNumber)
+		log.G(ctx).WithField("callbackNumber", callbackNumber).Error("failed to waitForNotification: callbackNumber does not exist in callbackMap")
 		return ErrHandleClose
 	}
 	channels := callbackMap[callbackNumber].channels
@@ -27,7 +28,7 @@ func waitForNotification(callbackNumber uintptr, expectedNotification hcsNotific
 
 	expectedChannel := channels[expectedNotification]
 	if expectedChannel == nil {
-		logrus.Errorf("unknown notification type in waitForNotification %x", expectedNotification)
+		log.G(ctx).WithField("type", expectedNotification).Error("unknown notification type in waitForNotification")
 		return ErrInvalidNotificationType
 	}
 

vendor/github.com/Microsoft/hcsshim/internal/hcs/watcher.go

@@ -1,41 +0,0 @@
-package hcs
-
-import (
-	"context"
-
-	"github.com/Microsoft/hcsshim/internal/logfields"
-	"github.com/Microsoft/hcsshim/internal/timeout"
-	"github.com/sirupsen/logrus"
-)
-
-// syscallWatcher is used as a very simple goroutine around calls into
-// the platform. In some cases, we have seen HCS APIs not returning due to
-// various bugs, and the goroutine making the syscall ends up not returning,
-// prior to its async callback. By spinning up a syscallWatcher, it allows
-// us to at least log a warning if a syscall doesn't complete in a reasonable
-// amount of time.
-//
-// Usage is:
-//
-// syscallWatcher(logContext, func() {
-//    err = <syscall>(args...)
-// })
-//
-
-func syscallWatcher(logContext logrus.Fields, syscallLambda func()) {
-	ctx, cancel := context.WithTimeout(context.Background(), timeout.SyscallWatcher)
-	defer cancel()
-	go watchFunc(ctx, logContext)
-	syscallLambda()
-}
-
-func watchFunc(ctx context.Context, logContext logrus.Fields) {
-	select {
-	case <-ctx.Done():
-		if ctx.Err() != context.Canceled {
-			logrus.WithFields(logContext).
-				WithField(logfields.Timeout, timeout.SyscallWatcher).
-				Warning("Syscall did not complete within operation timeout. This may indicate a platform issue. If it appears to be making no forward progress, obtain the stacks and see if there is a syscall stuck in the platform API for a significant length of time.")
-		}
-	}
-}

vendor/github.com/Microsoft/hcsshim/internal/hns/hnsendpoint.go

@@ -3,6 +3,7 @@ package hns
 import (
 	"encoding/json"
 	"net"
+	"strings"
 
 	"github.com/sirupsen/logrus"
 )
@@ -94,6 +95,27 @@ func GetHNSEndpointByName(endpointName string) (*HNSEndpoint, error) {
 	return nil, EndpointNotFoundError{EndpointName: endpointName}
 }
 
+type endpointAttachInfo struct {
+	SharedContainers json.RawMessage `json:",omitempty"`
+}
+
+func (endpoint *HNSEndpoint) IsAttached(vID string) (bool, error) {
+	attachInfo := endpointAttachInfo{}
+	err := hnsCall("GET", "/endpoints/"+endpoint.Id, "", &attachInfo)
+
+	// Return false allows us to just return the err
+	if err != nil {
+		return false, err
+	}
+
+	if strings.Contains(strings.ToLower(string(attachInfo.SharedContainers)), strings.ToLower(vID)) {
+		return true, nil
+	}
+
+	return false, nil
+
+}
+
 // Create Endpoint by sending EndpointRequest to HNS. TODO: Create a separate HNS interface to place all these methods
 func (endpoint *HNSEndpoint) Create() (*HNSEndpoint, error) {
 	operation := "Create"

vendor/github.com/Microsoft/hcsshim/internal/hns/hnsfuncs.go

@@ -9,23 +9,30 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
-func hnsCall(method, path, request string, returnResponse interface{}) error {
+func hnsCallRawResponse(method, path, request string) (*hnsResponse, error) {
 	var responseBuffer *uint16
 	logrus.Debugf("[%s]=>[%s] Request : %s", method, path, request)
 
 	err := _hnsCall(method, path, request, &responseBuffer)
 	if err != nil {
-		return hcserror.New(err, "hnsCall ", "")
+		return nil, hcserror.New(err, "hnsCall ", "")
 	}
 	response := interop.ConvertAndFreeCoTaskMemString(responseBuffer)
 
 	hnsresponse := &hnsResponse{}
 	if err = json.Unmarshal([]byte(response), &hnsresponse); err != nil {
-		return err
+		return nil, err
 	}
+	return hnsresponse, nil
+}
 
+func hnsCall(method, path, request string, returnResponse interface{}) error {
+	hnsresponse, err := hnsCallRawResponse(method, path, request)
+	if err != nil {
+		return fmt.Errorf("failed during hnsCallRawResponse: %v", err)
+	}
 	if !hnsresponse.Success {
-		return fmt.Errorf("HNS failed with error : %s", hnsresponse.Error)
+		return fmt.Errorf("hns failed with error : %s", hnsresponse.Error)
 	}
 
 	if len(hnsresponse.Output) == 0 {

vendor/github.com/Microsoft/hcsshim/internal/interop/interop.go

@@ -15,10 +15,6 @@ func ConvertAndFreeCoTaskMemString(buffer *uint16) string {
 	return str
 }
 
-func ConvertAndFreeCoTaskMemBytes(buffer *uint16) []byte {
-	return []byte(ConvertAndFreeCoTaskMemString(buffer))
-}
-
 func Win32FromHresult(hr uintptr) syscall.Errno {
 	if hr&0x1fff0000 == 0x00070000 {
 		return syscall.Errno(hr & 0xffff)

vendor/github.com/Microsoft/hcsshim/internal/log/g.go

@@ -0,0 +1,23 @@
+package log
+
+import (
+	"context"
+
+	"github.com/sirupsen/logrus"
+	"go.opencensus.io/trace"
+)
+
+// G returns a `logrus.Entry` with the `TraceID, SpanID` from `ctx` if `ctx`
+// contains an OpenCensus `trace.Span`.
+func G(ctx context.Context) *logrus.Entry {
+	span := trace.FromContext(ctx)
+	if span != nil {
+		sctx := span.SpanContext()
+		return logrus.WithFields(logrus.Fields{
+			"traceID": sctx.TraceID.String(),
+			"spanID":  sctx.SpanID.String(),
+			// "parentSpanID": TODO: JTERRY75 - Try to convince OC to export this?
+		})
+	}
+	return logrus.NewEntry(logrus.StandardLogger())
+}

vendor/github.com/Microsoft/hcsshim/internal/oc/exporter.go

@@ -0,0 +1,43 @@
+package oc
+
+import (
+	"github.com/sirupsen/logrus"
+	"go.opencensus.io/trace"
+)
+
+var _ = (trace.Exporter)(&LogrusExporter{})
+
+// LogrusExporter is an OpenCensus `trace.Exporter` that exports
+// `trace.SpanData` to logrus output.
+type LogrusExporter struct {
+}
+
+// ExportSpan exports `s` based on the the following rules:
+//
+// 1. All output will contain `s.Attributes`, `s.TraceID`, `s.SpanID`,
+// `s.ParentSpanID` for correlation
+//
+// 2. Any calls to .Annotate will not be supported.
+//
+// 3. The span itself will be written at `logrus.InfoLevel` unless
+// `s.Status.Code != 0` in which case it will be written at `logrus.ErrorLevel`
+// providing `s.Status.Message` as the error value.
+func (le *LogrusExporter) ExportSpan(s *trace.SpanData) {
+	// Combine all span annotations with traceID, spanID, parentSpanID
+	baseEntry := logrus.WithFields(logrus.Fields(s.Attributes))
+	baseEntry.Data["traceID"] = s.TraceID.String()
+	baseEntry.Data["spanID"] = s.SpanID.String()
+	baseEntry.Data["parentSpanID"] = s.ParentSpanID.String()
+	baseEntry.Data["startTime"] = s.StartTime
+	baseEntry.Data["endTime"] = s.EndTime
+	baseEntry.Data["duration"] = s.EndTime.Sub(s.StartTime).String()
+	baseEntry.Data["name"] = s.Name
+	baseEntry.Time = s.StartTime
+
+	level := logrus.InfoLevel
+	if s.Status.Code != 0 {
+		level = logrus.ErrorLevel
+		baseEntry.Data[logrus.ErrorKey] = s.Status.Message
+	}
+	baseEntry.Log(level, "Span")
+}

vendor/github.com/Microsoft/hcsshim/internal/oc/span.go

@@ -0,0 +1,17 @@
+package oc
+
+import (
+	"go.opencensus.io/trace"
+)
+
+// SetSpanStatus sets `span.SetStatus` to the proper status depending on `err`. If
+// `err` is `nil` assumes `trace.StatusCodeOk`.
+func SetSpanStatus(span *trace.Span, err error) {
+	status := trace.Status{}
+	if err != nil {
+		// TODO: JTERRY75 - Handle errors in a non-generic way
+		status.Code = trace.StatusCodeUnknown
+		status.Message = err.Error()
+	}
+	span.SetStatus(status)
+}

vendor/github.com/Microsoft/hcsshim/internal/regstate/regstate.go

@@ -0,0 +1,287 @@
+package regstate
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"os"
+	"path/filepath"
+	"reflect"
+	"syscall"
+
+	"golang.org/x/sys/windows/registry"
+)
+
+//go:generate go run $GOROOT/src/syscall/mksyscall_windows.go -output zsyscall_windows.go regstate.go
+
+//sys	regCreateKeyEx(key syscall.Handle, subkey *uint16, reserved uint32, class *uint16, options uint32, desired uint32, sa *syscall.SecurityAttributes, result *syscall.Handle, disposition *uint32) (regerrno error) = advapi32.RegCreateKeyExW
+
+const (
+	_REG_OPTION_VOLATILE = 1
+
+	_REG_CREATED_NEW_KEY     = 1
+	_REG_OPENED_EXISTING_KEY = 2
+)
+
+type Key struct {
+	registry.Key
+	Name string
+}
+
+var localMachine = &Key{registry.LOCAL_MACHINE, "HKEY_LOCAL_MACHINE"}
+var localUser = &Key{registry.CURRENT_USER, "HKEY_CURRENT_USER"}
+
+var rootPath = `SOFTWARE\Microsoft\runhcs`
+
+type NotFoundError struct {
+	Id string
+}
+
+func (err *NotFoundError) Error() string {
+	return fmt.Sprintf("ID '%s' was not found", err.Id)
+}
+
+func IsNotFoundError(err error) bool {
+	_, ok := err.(*NotFoundError)
+	return ok
+}
+
+type NoStateError struct {
+	ID  string
+	Key string
+}
+
+func (err *NoStateError) Error() string {
+	return fmt.Sprintf("state '%s' is not present for ID '%s'", err.Key, err.ID)
+}
+
+func createVolatileKey(k *Key, path string, access uint32) (newk *Key, openedExisting bool, err error) {
+	var (
+		h syscall.Handle
+		d uint32
+	)
+	fullpath := filepath.Join(k.Name, path)
+	err = regCreateKeyEx(syscall.Handle(k.Key), syscall.StringToUTF16Ptr(path), 0, nil, _REG_OPTION_VOLATILE, access, nil, &h, &d)
+	if err != nil {
+		return nil, false, &os.PathError{Op: "RegCreateKeyEx", Path: fullpath, Err: err}
+	}
+	return &Key{registry.Key(h), fullpath}, d == _REG_OPENED_EXISTING_KEY, nil
+}
+
+func hive(perUser bool) *Key {
+	r := localMachine
+	if perUser {
+		r = localUser
+	}
+	return r
+}
+
+func Open(root string, perUser bool) (*Key, error) {
+	k, _, err := createVolatileKey(hive(perUser), rootPath, registry.ALL_ACCESS)
+	if err != nil {
+		return nil, err
+	}
+	defer k.Close()
+
+	k2, _, err := createVolatileKey(k, url.PathEscape(root), registry.ALL_ACCESS)
+	if err != nil {
+		return nil, err
+	}
+	return k2, nil
+}
+
+func RemoveAll(root string, perUser bool) error {
+	k, err := hive(perUser).open(rootPath)
+	if err != nil {
+		return err
+	}
+	defer k.Close()
+	r, err := k.open(url.PathEscape(root))
+	if err != nil {
+		return err
+	}
+	defer r.Close()
+	ids, err := r.Enumerate()
+	if err != nil {
+		return err
+	}
+	for _, id := range ids {
+		err = r.Remove(id)
+		if err != nil {
+			return err
+		}
+	}
+	r.Close()
+	return k.Remove(root)
+}
+
+func (k *Key) Close() error {
+	err := k.Key.Close()
+	k.Key = 0
+	return err
+}
+
+func (k *Key) Enumerate() ([]string, error) {
+	escapedIDs, err := k.ReadSubKeyNames(0)
+	if err != nil {
+		return nil, err
+	}
+	var ids []string
+	for _, e := range escapedIDs {
+		id, err := url.PathUnescape(e)
+		if err == nil {
+			ids = append(ids, id)
+		}
+	}
+	return ids, nil
+}
+
+func (k *Key) open(name string) (*Key, error) {
+	fullpath := filepath.Join(k.Name, name)
+	nk, err := registry.OpenKey(k.Key, name, registry.ALL_ACCESS)
+	if err != nil {
+		return nil, &os.PathError{Op: "RegOpenKey", Path: fullpath, Err: err}
+	}
+	return &Key{nk, fullpath}, nil
+}
+
+func (k *Key) openid(id string) (*Key, error) {
+	escaped := url.PathEscape(id)
+	fullpath := filepath.Join(k.Name, escaped)
+	nk, err := k.open(escaped)
+	if perr, ok := err.(*os.PathError); ok && perr.Err == syscall.ERROR_FILE_NOT_FOUND {
+		return nil, &NotFoundError{id}
+	}
+	if err != nil {
+		return nil, &os.PathError{Op: "RegOpenKey", Path: fullpath, Err: err}
+	}
+	return nk, nil
+}
+
+func (k *Key) Remove(id string) error {
+	escaped := url.PathEscape(id)
+	err := registry.DeleteKey(k.Key, escaped)
+	if err != nil {
+		if err == syscall.ERROR_FILE_NOT_FOUND {
+			return &NotFoundError{id}
+		}
+		return &os.PathError{Op: "RegDeleteKey", Path: filepath.Join(k.Name, escaped), Err: err}
+	}
+	return nil
+}
+
+func (k *Key) set(id string, create bool, key string, state interface{}) error {
+	var sk *Key
+	var err error
+	if create {
+		var existing bool
+		eid := url.PathEscape(id)
+		sk, existing, err = createVolatileKey(k, eid, registry.ALL_ACCESS)
+		if err != nil {
+			return err
+		}
+		defer sk.Close()
+		if existing {
+			sk.Close()
+			return fmt.Errorf("container %s already exists", id)
+		}
+	} else {
+		sk, err = k.openid(id)
+		if err != nil {
+			return err
+		}
+		defer sk.Close()
+	}
+	switch reflect.TypeOf(state).Kind() {
+	case reflect.Bool:
+		v := uint32(0)
+		if state.(bool) {
+			v = 1
+		}
+		err = sk.SetDWordValue(key, v)
+	case reflect.Int:
+		err = sk.SetQWordValue(key, uint64(state.(int)))
+	case reflect.String:
+		err = sk.SetStringValue(key, state.(string))
+	default:
+		var js []byte
+		js, err = json.Marshal(state)
+		if err != nil {
+			return err
+		}
+		err = sk.SetBinaryValue(key, js)
+	}
+	if err != nil {
+		if err == syscall.ERROR_FILE_NOT_FOUND {
+			return &NoStateError{id, key}
+		}
+		return &os.PathError{Op: "RegSetValueEx", Path: sk.Name + ":" + key, Err: err}
+	}
+	return nil
+}
+
+func (k *Key) Create(id, key string, state interface{}) error {
+	return k.set(id, true, key, state)
+}
+
+func (k *Key) Set(id, key string, state interface{}) error {
+	return k.set(id, false, key, state)
+}
+
+func (k *Key) Clear(id, key string) error {
+	sk, err := k.openid(id)
+	if err != nil {
+		return err
+	}
+	defer sk.Close()
+	err = sk.DeleteValue(key)
+	if err != nil {
+		if err == syscall.ERROR_FILE_NOT_FOUND {
+			return &NoStateError{id, key}
+		}
+		return &os.PathError{Op: "RegDeleteValue", Path: sk.Name + ":" + key, Err: err}
+	}
+	return nil
+}
+
+func (k *Key) Get(id, key string, state interface{}) error {
+	sk, err := k.openid(id)
+	if err != nil {
+		return err
+	}
+	defer sk.Close()
+
+	var js []byte
+	switch reflect.TypeOf(state).Elem().Kind() {
+	case reflect.Bool:
+		var v uint64
+		v, _, err = sk.GetIntegerValue(key)
+		if err == nil {
+			*state.(*bool) = v != 0
+		}
+	case reflect.Int:
+		var v uint64
+		v, _, err = sk.GetIntegerValue(key)
+		if err == nil {
+			*state.(*int) = int(v)
+		}
+	case reflect.String:
+		var v string
+		v, _, err = sk.GetStringValue(key)
+		if err == nil {
+			*state.(*string) = string(v)
+		}
+	default:
+		js, _, err = sk.GetBinaryValue(key)
+	}
+	if err != nil {
+		if err == syscall.ERROR_FILE_NOT_FOUND {
+			return &NoStateError{id, key}
+		}
+		return &os.PathError{Op: "RegQueryValueEx", Path: sk.Name + ":" + key, Err: err}
+	}
+	if js != nil {
+		err = json.Unmarshal(js, state)
+	}
+	return err
+}

vendor/github.com/Microsoft/hcsshim/internal/regstate/zsyscall_windows.go

@@ -0,0 +1,51 @@
+// Code generated by 'go generate'; DO NOT EDIT.
+
+package regstate
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+var _ unsafe.Pointer
+
+// Do the interface allocations only once for common
+// Errno values.
+const (
+	errnoERROR_IO_PENDING = 997
+)
+
+var (
+	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
+)
+
+// errnoErr returns common boxed Errno values, to prevent
+// allocations at runtime.
+func errnoErr(e syscall.Errno) error {
+	switch e {
+	case 0:
+		return nil
+	case errnoERROR_IO_PENDING:
+		return errERROR_IO_PENDING
+	}
+	// TODO: add more here, after collecting data on the common
+	// error values see on Windows. (perhaps when running
+	// all.bat?)
+	return e
+}
+
+var (
+	modadvapi32 = windows.NewLazySystemDLL("advapi32.dll")
+
+	procRegCreateKeyExW = modadvapi32.NewProc("RegCreateKeyExW")
+)
+
+func regCreateKeyEx(key syscall.Handle, subkey *uint16, reserved uint32, class *uint16, options uint32, desired uint32, sa *syscall.SecurityAttributes, result *syscall.Handle, disposition *uint32) (regerrno error) {
+	r0, _, _ := syscall.Syscall9(procRegCreateKeyExW.Addr(), 9, uintptr(key), uintptr(unsafe.Pointer(subkey)), uintptr(reserved), uintptr(unsafe.Pointer(class)), uintptr(options), uintptr(desired), uintptr(unsafe.Pointer(sa)), uintptr(unsafe.Pointer(result)), uintptr(unsafe.Pointer(disposition)))
+	if r0 != 0 {
+		regerrno = syscall.Errno(r0)
+	}
+	return
+}

vendor/github.com/Microsoft/hcsshim/internal/runhcs/container.go

@@ -0,0 +1,71 @@
+package runhcs
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"syscall"
+	"time"
+
+	"github.com/Microsoft/go-winio/pkg/guid"
+)
+
+// ContainerState represents the platform agnostic pieces relating to a
+// running container's status and state
+type ContainerState struct {
+	// Version is the OCI version for the container
+	Version string `json:"ociVersion"`
+	// ID is the container ID
+	ID string `json:"id"`
+	// InitProcessPid is the init process id in the parent namespace
+	InitProcessPid int `json:"pid"`
+	// Status is the current status of the container, running, paused, ...
+	Status string `json:"status"`
+	// Bundle is the path on the filesystem to the bundle
+	Bundle string `json:"bundle"`
+	// Rootfs is a path to a directory containing the container's root filesystem.
+	Rootfs string `json:"rootfs"`
+	// Created is the unix timestamp for the creation time of the container in UTC
+	Created time.Time `json:"created"`
+	// Annotations is the user defined annotations added to the config.
+	Annotations map[string]string `json:"annotations,omitempty"`
+	// The owner of the state directory (the owner of the container).
+	Owner string `json:"owner"`
+}
+
+// GetErrorFromPipe returns reads from `pipe` and verifies if the operation
+// returned success or error. If error converts that to an error and returns. If
+// `p` is not nill will issue a `Kill` and `Wait` for exit.
+func GetErrorFromPipe(pipe io.Reader, p *os.Process) error {
+	serr, err := ioutil.ReadAll(pipe)
+	if err != nil {
+		return err
+	}
+
+	if bytes.Equal(serr, ShimSuccess) {
+		return nil
+	}
+
+	extra := ""
+	if p != nil {
+		p.Kill()
+		state, err := p.Wait()
+		if err != nil {
+			panic(err)
+		}
+		extra = fmt.Sprintf(", exit code %d", state.Sys().(syscall.WaitStatus).ExitCode)
+	}
+	if len(serr) == 0 {
+		return fmt.Errorf("unknown shim failure%s", extra)
+	}
+
+	return errors.New(string(serr))
+}
+
+// VMPipePath returns the named pipe path for the vm shim.
+func VMPipePath(hostUniqueID guid.GUID) string {
+	return SafePipePath("runhcs-vm-" + hostUniqueID.String())
+}

vendor/github.com/Microsoft/hcsshim/internal/runhcs/util.go

@@ -0,0 +1,16 @@
+package runhcs
+
+import "net/url"
+
+const (
+	SafePipePrefix = `\\.\pipe\ProtectedPrefix\Administrators\`
+)
+
+// ShimSuccess is the byte stream returned on a successful operation.
+var ShimSuccess = []byte{0, 'O', 'K', 0}
+
+func SafePipePath(name string) string {
+	// Use a pipe in the Administrators protected prefixed to prevent malicious
+	// squatting.
+	return SafePipePrefix + url.PathEscape(name)
+}

vendor/github.com/Microsoft/hcsshim/internal/runhcs/vm.go

@@ -0,0 +1,43 @@
+package runhcs
+
+import (
+	"encoding/json"
+
+	"github.com/Microsoft/go-winio"
+)
+
+// VMRequestOp is an operation that can be issued to a VM shim.
+type VMRequestOp string
+
+const (
+	// OpCreateContainer is a create container request.
+	OpCreateContainer VMRequestOp = "create"
+	// OpSyncNamespace is a `cni.NamespaceTypeGuest` sync request with the UVM.
+	OpSyncNamespace VMRequestOp = "sync"
+	// OpUnmountContainer is a container unmount request.
+	OpUnmountContainer VMRequestOp = "unmount"
+	// OpUnmountContainerDiskOnly is a container unmount disk request.
+	OpUnmountContainerDiskOnly VMRequestOp = "unmount-disk"
+)
+
+// VMRequest is an operation request that is issued to a VM shim.
+type VMRequest struct {
+	ID string
+	Op VMRequestOp
+}
+
+// IssueVMRequest issues a request to a shim at the given pipe.
+func IssueVMRequest(pipepath string, req *VMRequest) error {
+	pipe, err := winio.DialPipe(pipepath, nil)
+	if err != nil {
+		return err
+	}
+	defer pipe.Close()
+	if err := json.NewEncoder(pipe).Encode(req); err != nil {
+		return err
+	}
+	if err := GetErrorFromPipe(pipe, nil); err != nil {
+		return err
+	}
+	return nil
+}

vendor/github.com/Microsoft/hcsshim/internal/schema1/schema1.go

@@ -4,7 +4,8 @@ import (
 	"encoding/json"
 	"time"
 
-	"github.com/Microsoft/hcsshim/internal/schema2"
+	"github.com/Microsoft/go-winio/pkg/guid"
+	hcsschema "github.com/Microsoft/hcsshim/internal/schema2"
 )
 
 // ProcessConfig is used as both the input of Container.CreateProcess
@@ -62,7 +63,7 @@ type MappedVirtualDisk struct {
 	CreateInUtilityVM bool   `json:",omitempty"`
 	ReadOnly          bool   `json:",omitempty"`
 	Cache             string `json:",omitempty"` // "" (Unspecified); "Disabled"; "Enabled"; "Private"; "PrivateAllowSharing"
-	AttachOnly        bool   `json:",omitempty:`
+	AttachOnly        bool   `json:",omitempty"`
 }
 
 // AssignedDevice represents a device that has been directly assigned to a container
@@ -133,9 +134,10 @@ type ContainerProperties struct {
 	State                        string
 	Name                         string
 	SystemType                   string
+	RuntimeOSType                string `json:"RuntimeOsType,omitempty"`
 	Owner                        string
 	SiloGUID                     string                              `json:"SiloGuid,omitempty"`
-	RuntimeID                    string                              `json:"RuntimeId,omitempty"`
+	RuntimeID                    guid.GUID                           `json:"RuntimeId,omitempty"`
 	IsRuntimeTemplate            bool                                `json:",omitempty"`
 	RuntimeImagePath             string                              `json:",omitempty"`
 	Stopped                      bool                                `json:",omitempty"`
@@ -214,6 +216,7 @@ type MappedVirtualDiskController struct {
 type GuestDefinedCapabilities struct {
 	NamespaceAddRequestSupported bool `json:",omitempty"`
 	SignalProcessSupported       bool `json:",omitempty"`
+	DumpStacksSupported          bool `json:",omitempty"`
 }
 
 // GuestConnectionInfo is the structure of an iterm return by a GuestConnection call on a utility VM

vendor/github.com/Microsoft/hcsshim/internal/schema2/attachment.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type Attachment struct {
-
 	Type_ string `json:"Type,omitempty"`
 
 	Path string `json:"Path,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/cache_query_stats_response.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type CacheQueryStatsResponse struct {
-
 	L3OccupancyBytes int32 `json:"L3OccupancyBytes,omitempty"`
 
 	L3TotalBwBytes int32 `json:"L3TotalBwBytes,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/close_handle.go

@@ -10,6 +10,5 @@
 package hcsschema
 
 type CloseHandle struct {
-
 	Handle string `json:"Handle,omitempty"`
 }

vendor/github.com/Microsoft/hcsshim/internal/schema2/com_port.go

@@ -11,7 +11,6 @@ package hcsschema
 
 //  ComPort specifies the named pipe that will be used for the port, with empty string indicating a disconnected port.
 type ComPort struct {
-
 	NamedPipe string `json:"NamedPipe,omitempty"`
 
 	OptimizeForDebugger bool `json:"OptimizeForDebugger,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/compute_system.go

@@ -10,14 +10,13 @@
 package hcsschema
 
 type ComputeSystem struct {
-
 	Owner string `json:"Owner,omitempty"`
 
 	SchemaVersion *Version `json:"SchemaVersion,omitempty"`
 
 	HostingSystemId string `json:"HostingSystemId,omitempty"`
 
-	HostedSystem *HostedSystem `json:"HostedSystem,omitempty"`
+	HostedSystem interface{} `json:"HostedSystem,omitempty"`
 
 	Container *Container `json:"Container,omitempty"`
 

vendor/github.com/Microsoft/hcsshim/internal/schema2/configuration.go

@@ -25,37 +25,37 @@ func (c contextKey) String() string {
 
 var (
 	// ContextOAuth2 takes a oauth2.TokenSource as authentication for the request.
-	ContextOAuth2    	= contextKey("token")
+	ContextOAuth2 = contextKey("token")
 
 	// ContextBasicAuth takes BasicAuth as authentication for the request.
-	ContextBasicAuth 	= contextKey("basic")
+	ContextBasicAuth = contextKey("basic")
 
 	// ContextAccessToken takes a string oauth2 access token as authentication for the request.
-	ContextAccessToken 	= contextKey("accesstoken")
+	ContextAccessToken = contextKey("accesstoken")
 
 	// ContextAPIKey takes an APIKey as authentication for the request
- 	ContextAPIKey 		= contextKey("apikey")
+	ContextAPIKey = contextKey("apikey")
 )
 
 // BasicAuth provides basic http authentication to a request passed via context using ContextBasicAuth
 type BasicAuth struct {
-	UserName      string            `json:"userName,omitempty"`
+	UserName string `json:"userName,omitempty"`
-	Password      string            `json:"password,omitempty"`	
+	Password string `json:"password,omitempty"`
 }
 
 // APIKey provides API key based authentication to a request passed via context using ContextAPIKey
 type APIKey struct {
-	Key 	string
+	Key    string
-	Prefix	string
+	Prefix string
 }
 
 type Configuration struct {
-	BasePath      string            	`json:"basePath,omitempty"`
+	BasePath      string            `json:"basePath,omitempty"`
-	Host          string            	`json:"host,omitempty"`
+	Host          string            `json:"host,omitempty"`
-	Scheme        string            	`json:"scheme,omitempty"`
+	Scheme        string            `json:"scheme,omitempty"`
-	DefaultHeader map[string]string 	`json:"defaultHeader,omitempty"`
+	DefaultHeader map[string]string `json:"defaultHeader,omitempty"`
-	UserAgent     string            	`json:"userAgent,omitempty"`
+	UserAgent     string            `json:"userAgent,omitempty"`
-	HTTPClient 	  *http.Client
+	HTTPClient    *http.Client
 }
 
 func NewConfiguration() *Configuration {

vendor/github.com/Microsoft/hcsshim/internal/schema2/console_size.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type ConsoleSize struct {
-
 	Height int32 `json:"Height,omitempty"`
 
 	Width int32 `json:"Width,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/container.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type Container struct {
-
 	GuestOs *GuestOs `json:"GuestOs,omitempty"`
 
 	Storage *Storage `json:"Storage,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/container_memory_information.go

@@ -11,7 +11,6 @@ package hcsschema
 
 //  memory usage as viewed from within the container
 type ContainerMemoryInformation struct {
-
 	TotalPhysicalBytes int32 `json:"TotalPhysicalBytes,omitempty"`
 
 	TotalUsage int32 `json:"TotalUsage,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/devices.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type Devices struct {
-
 	ComPorts map[string]ComPort `json:"ComPorts,omitempty"`
 
 	Scsi map[string]Scsi `json:"Scsi,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/enhanced_mode_video.go

@@ -10,6 +10,5 @@
 package hcsschema
 
 type EnhancedModeVideo struct {
-
 	ConnectionOptions *RdpConnectionOptions `json:"ConnectionOptions,omitempty"`
 }

vendor/github.com/Microsoft/hcsshim/internal/schema2/flexible_io_device.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type FlexibleIoDevice struct {
-
 	EmulatorId string `json:"EmulatorId,omitempty"`
 
 	HostingModel string `json:"HostingModel,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/guest_crash_reporting.go

@@ -10,6 +10,5 @@
 package hcsschema
 
 type GuestCrashReporting struct {
-
 	WindowsCrashSettings *WindowsCrashReporting `json:"WindowsCrashSettings,omitempty"`
 }

vendor/github.com/Microsoft/hcsshim/internal/schema2/guest_os.go

@@ -10,6 +10,5 @@
 package hcsschema
 
 type GuestOs struct {
-
 	HostName string `json:"HostName,omitempty"`
 }

vendor/github.com/Microsoft/hcsshim/internal/schema2/hosted_system.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type HostedSystem struct {
-
 	SchemaVersion *Version `json:"SchemaVersion,omitempty"`
 
 	Container *Container `json:"Container,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/hv_socket.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type HvSocket struct {
-
 	Config *HvSocketSystemConfig `json:"Config,omitempty"`
 
 	EnablePowerShellDirect bool `json:"EnablePowerShellDirect,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/hv_socket_2.go

@@ -11,6 +11,5 @@ package hcsschema
 
 //  HvSocket configuration for a VM
 type HvSocket2 struct {
-
 	HvSocketConfig *HvSocketSystemConfig `json:"HvSocketConfig,omitempty"`
 }

vendor/github.com/Microsoft/hcsshim/internal/schema2/layer.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type Layer struct {
-
 	Id string `json:"Id,omitempty"`
 
 	Path string `json:"Path,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/mapped_directory.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type MappedDirectory struct {
-
 	HostPath string `json:"HostPath,omitempty"`
 
 	HostPathType string `json:"HostPathType,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/mapped_pipe.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type MappedPipe struct {
-
 	ContainerPipeName string `json:"ContainerPipeName,omitempty"`
 
 	HostPath string `json:"HostPath,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/memory.go

@@ -10,6 +10,5 @@
 package hcsschema
 
 type Memory struct {
-
 	SizeInMB int32 `json:"SizeInMB,omitempty"`
 }

vendor/github.com/Microsoft/hcsshim/internal/schema2/memory_information_for_vm.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type MemoryInformationForVm struct {
-
 	VirtualNodeCount int32 `json:"VirtualNodeCount,omitempty"`
 
 	VirtualMachineMemory *VmMemory `json:"VirtualMachineMemory,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/memory_stats.go

@@ -11,7 +11,6 @@ package hcsschema
 
 //  Memory runtime statistics
 type MemoryStats struct {
-
 	MemoryUsageCommitBytes int32 `json:"MemoryUsageCommitBytes,omitempty"`
 
 	MemoryUsageCommitPeakBytes int32 `json:"MemoryUsageCommitPeakBytes,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/network_adapter.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type NetworkAdapter struct {
-
 	EndpointId string `json:"EndpointId,omitempty"`
 
 	MacAddress string `json:"MacAddress,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/networking.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type Networking struct {
-
 	AllowUnqualifiedDnsQuery bool `json:"AllowUnqualifiedDnsQuery,omitempty"`
 
 	DnsSearchList string `json:"DnsSearchList,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/pause_notification.go

@@ -11,6 +11,5 @@ package hcsschema
 
 //  Notification data that is indicated to components running in the Virtual Machine.
 type PauseNotification struct {
-
 	Reason string `json:"Reason,omitempty"`
 }

vendor/github.com/Microsoft/hcsshim/internal/schema2/pause_options.go

@@ -11,7 +11,6 @@ package hcsschema
 
 //  Options for HcsPauseComputeSystem
 type PauseOptions struct {
-
 	SuspensionLevel string `json:"SuspensionLevel,omitempty"`
 
 	HostedNotification *PauseNotification `json:"HostedNotification,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/plan9.go

@@ -10,6 +10,5 @@
 package hcsschema
 
 type Plan9 struct {
-
 	Shares []Plan9Share `json:"Shares,omitempty"`
 }

vendor/github.com/Microsoft/hcsshim/internal/schema2/process_details.go

@@ -15,7 +15,6 @@ import (
 
 //  Information about a process running in a container
 type ProcessDetails struct {
-
 	ProcessId int32 `json:"ProcessId,omitempty"`
 
 	ImageName string `json:"ImageName,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/process_modify_request.go

@@ -11,7 +11,6 @@ package hcsschema
 
 //  Passed to HcsRpc_ModifyProcess
 type ProcessModifyRequest struct {
-
 	Operation string `json:"Operation,omitempty"`
 
 	ConsoleSize *ConsoleSize `json:"ConsoleSize,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/process_parameters.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type ProcessParameters struct {
-
 	ApplicationName string `json:"ApplicationName,omitempty"`
 
 	CommandLine string `json:"CommandLine,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/process_status.go

@@ -11,7 +11,6 @@ package hcsschema
 
 //  Status of a process running in a container
 type ProcessStatus struct {
-
 	ProcessId int32 `json:"ProcessId,omitempty"`
 
 	Exited bool `json:"Exited,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/processor.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type Processor struct {
-
 	Count int32 `json:"Count,omitempty"`
 
 	Maximum int32 `json:"Maximum,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/processor_2.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type Processor2 struct {
-
 	Count int32 `json:"Count,omitempty"`
 
 	Limit int32 `json:"Limit,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/processor_stats.go

@@ -11,7 +11,6 @@ package hcsschema
 
 //  CPU runtime statistics
 type ProcessorStats struct {
-
 	TotalRuntime100ns int32 `json:"TotalRuntime100ns,omitempty"`
 
 	RuntimeUser100ns int32 `json:"RuntimeUser100ns,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/properties.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type Properties struct {
-
 	Id string `json:"Id,omitempty"`
 
 	SystemType string `json:"SystemType,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/property_query.go

@@ -11,6 +11,5 @@ package hcsschema
 
 //   By default the basic properties will be returned. This query provides a way to  request specific properties.
 type PropertyQuery struct {
-
 	PropertyTypes []string `json:"PropertyTypes,omitempty"`
 }

vendor/github.com/Microsoft/hcsshim/internal/schema2/rdp_connection_options.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type RdpConnectionOptions struct {
-
 	AccessSids []string `json:"AccessSids,omitempty"`
 
 	NamedPipe string `json:"NamedPipe,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/registry_changes.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type RegistryChanges struct {
-
 	AddValues []RegistryValue `json:"AddValues,omitempty"`
 
 	DeleteKeys []RegistryKey `json:"DeleteKeys,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/registry_key.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type RegistryKey struct {
-
 	Hive string `json:"Hive,omitempty"`
 
 	Name string `json:"Name,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/registry_value.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type RegistryValue struct {
-
 	Key *RegistryKey `json:"Key,omitempty"`
 
 	Name string `json:"Name,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/shared_memory_configuration.go

@@ -10,6 +10,5 @@
 package hcsschema
 
 type SharedMemoryConfiguration struct {
-
 	Regions []SharedMemoryRegion `json:"Regions,omitempty"`
 }

vendor/github.com/Microsoft/hcsshim/internal/schema2/shared_memory_region.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type SharedMemoryRegion struct {
-
 	SectionName string `json:"SectionName,omitempty"`
 
 	StartOffset int32 `json:"StartOffset,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/shared_memory_region_info.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type SharedMemoryRegionInfo struct {
-
 	SectionName string `json:"SectionName,omitempty"`
 
 	GuestPhysicalAddress int32 `json:"GuestPhysicalAddress,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/silo_properties.go

@@ -11,7 +11,6 @@ package hcsschema
 
 //  Silo job information
 type SiloProperties struct {
-
 	Enabled bool `json:"Enabled,omitempty"`
 
 	JobName string `json:"JobName,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/statistics.go

@@ -15,7 +15,6 @@ import (
 
 //  Runtime statistics for a container
 type Statistics struct {
-
 	Timestamp time.Time `json:"Timestamp,omitempty"`
 
 	ContainerStartTime time.Time `json:"ContainerStartTime,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/storage_qo_s.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type StorageQoS struct {
-
 	IopsMaximum int32 `json:"IopsMaximum,omitempty"`
 
 	BandwidthMaximum int32 `json:"BandwidthMaximum,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/storage_stats.go

@@ -11,7 +11,6 @@ package hcsschema
 
 //  Storage runtime statistics
 type StorageStats struct {
-
 	ReadCountNormalized int32 `json:"ReadCountNormalized,omitempty"`
 
 	ReadSizeBytes int32 `json:"ReadSizeBytes,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/topology.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type Topology struct {
-
 	Memory *Memory2 `json:"Memory,omitempty"`
 
 	Processor *Processor2 `json:"Processor,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/uefi.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type Uefi struct {
-
 	EnableDebugger bool `json:"EnableDebugger,omitempty"`
 
 	SecureBootTemplateId string `json:"SecureBootTemplateId,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/uefi_boot_entry.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type UefiBootEntry struct {
-
 	DeviceType string `json:"DeviceType,omitempty"`
 
 	DevicePath string `json:"DevicePath,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/version.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type Version struct {
-
 	Major int32 `json:"Major,omitempty"`
 
 	Minor int32 `json:"Minor,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/video_monitor.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type VideoMonitor struct {
-
 	HorizontalResolution int32 `json:"HorizontalResolution,omitempty"`
 
 	VerticalResolution int32 `json:"VerticalResolution,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/virtual_node_info.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type VirtualNodeInfo struct {
-
 	VirtualNodeIndex int32 `json:"VirtualNodeIndex,omitempty"`
 
 	PhysicalNodeNumber int32 `json:"PhysicalNodeNumber,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/virtual_p_mem_device.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type VirtualPMemDevice struct {
-
 	HostPath string `json:"HostPath,omitempty"`
 
 	ReadOnly bool `json:"ReadOnly,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/virtual_smb.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type VirtualSmb struct {
-
 	Shares []VirtualSmbShare `json:"Shares,omitempty"`
 
 	DirectFileMappingInMB int64 `json:"DirectFileMappingInMB,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/virtual_smb_share.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type VirtualSmbShare struct {
-
 	Name string `json:"Name,omitempty"`
 
 	Path string `json:"Path,omitempty"`

vendor/github.com/Microsoft/hcsshim/internal/schema2/virtual_smb_share_options.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type VirtualSmbShareOptions struct {
-
 	ReadOnly bool `json:"ReadOnly,omitempty"`
 
 	//  convert exclusive access to shared read access

vendor/github.com/Microsoft/hcsshim/internal/schema2/vm_memory.go

@@ -10,7 +10,6 @@
 package hcsschema
 
 type VmMemory struct {
-
 	AvailableMemory int32 `json:"AvailableMemory,omitempty"`
 
 	AvailableMemoryBuffer int32 `json:"AvailableMemoryBuffer,omitempty"`