Add ArgsEscaped support for CRI

This commit adds supports for the ArgsEscaped
value for the image got from the dockerfile.
It is used to evaluate and process the image
entrypoint/cmd and container entrypoint/cmd
options got from the podspec.

Signed-off-by: Kirtana Ashok <Kirtana.Ashok@microsoft.com>

integration/images/image_list.go

@@ -36,6 +36,7 @@ type ImageList struct {
 	ResourceConsumer string
 	VolumeCopyUp     string
 	VolumeOwnership  string
+	ArgsEscaped      string
 }
 
 var (
@@ -53,6 +54,7 @@ func initImages(imageListFile string) {
 		ResourceConsumer: "registry.k8s.io/e2e-test-images/resource-consumer:1.10",
 		VolumeCopyUp:     "ghcr.io/containerd/volume-copy-up:2.1",
 		VolumeOwnership:  "ghcr.io/containerd/volume-ownership:2.1",
+		ArgsEscaped:      "cplatpublic.azurecr.io/args-escaped-test-image-ns:latest",
 	}
 
 	if imageListFile != "" {
@@ -88,6 +90,8 @@ const (
 	VolumeCopyUp
 	// VolumeOwnership image
 	VolumeOwnership
+	// Test image for ArgsEscaped windows bug
+	ArgsEscaped
 )
 
 func initImageMap(imageList ImageList) map[int]string {
@@ -98,6 +102,7 @@ func initImageMap(imageList ImageList) map[int]string {
 	images[ResourceConsumer] = imageList.ResourceConsumer
 	images[VolumeCopyUp] = imageList.VolumeCopyUp
 	images[VolumeOwnership] = imageList.VolumeOwnership
+	images[ArgsEscaped] = imageList.ArgsEscaped
 	return images
 }
 

integration/images/image_list.sample.toml

@@ -3,3 +3,4 @@ busybox = "docker.io/library/busybox:latest"
 pause = "registry.k8s.io/pause:3.7"
 VolumeCopyUp = "ghcr.io/containerd/volume-copy-up:2.1"
 VolumeOwnership = "ghcr.io/containerd/volume-ownership:2.1"
+ArgsEscaped = "cplatpublic.azurecr.io/args-escaped-test-image-ns:latest"

integration/windows_hostprocess_test.go

@@ -21,12 +21,15 @@ package integration
 import (
 	"fmt"
 	"os"
+	"strconv"
 	"testing"
 	"time"
 
+	"github.com/Microsoft/hcsshim/osversion"
 	"github.com/containerd/containerd/integration/images"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/windows/registry"
 	runtime "k8s.io/cri-api/pkg/apis/runtime/v1"
 	v1 "k8s.io/cri-api/pkg/apis/runtime/v1"
 )
@@ -123,3 +126,65 @@ func runHostProcess(t *testing.T, expectErr bool, image string, action hpcAction
 
 	action(t, cn, containerConfig)
 }
+
+func startAndTestContainer(t *testing.T, sb string, sbConfig *runtime.PodSandboxConfig, cnConfig *runtime.ContainerConfig) {
+	t.Log("Create the container")
+	cn, err := runtimeService.CreateContainer(sb, cnConfig, sbConfig)
+	require.NoError(t, err)
+	t.Log("Start the container")
+	require.NoError(t, runtimeService.StartContainer(cn))
+
+	t.Log("Stop the container")
+	require.NoError(t, runtimeService.StopContainer(cn, 0))
+	t.Log("Remove the container")
+	require.NoError(t, runtimeService.RemoveContainer(cn))
+}
+
+func TestArgsEscapedImagesOnWindows(t *testing.T) {
+	// the ArgsEscaped test image is based on nanoserver:ltsc2022, so ensure we run on the correct OS version
+	k, err := registry.OpenKey(registry.LOCAL_MACHINE, `SOFTWARE\Microsoft\Windows NT\CurrentVersion`, registry.QUERY_VALUE)
+	if err != nil {
+		t.Skip("Error in getting OS version")
+	}
+	defer k.Close()
+
+	b, _, _ := k.GetStringValue("CurrentBuild")
+	buildNum, _ := strconv.Atoi(b)
+	if buildNum < osversion.V21H2Server {
+		t.Skip()
+	}
+
+	containerName := "test-container"
+	testImage := images.Get(images.ArgsEscaped)
+	sbConfig := &runtime.PodSandboxConfig{
+		Metadata: &runtime.PodSandboxMetadata{
+			Name:      "sandbox",
+			Namespace: testImage,
+		},
+		Windows: &runtime.WindowsPodSandboxConfig{},
+	}
+	sb, err := runtimeService.RunPodSandbox(sbConfig, *runtimeHandler)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		assert.NoError(t, runtimeService.StopPodSandbox(sb))
+		assert.NoError(t, runtimeService.RemovePodSandbox(sb))
+	})
+
+	EnsureImageExists(t, testImage)
+
+	cnConfigWithCtrCmd := ContainerConfig(
+		containerName,
+		testImage,
+		WithCommand("ping", "-t", "127.0.0.1"),
+		localSystemUsername,
+	)
+
+	cnConfigNoCtrCmd := ContainerConfig(
+		containerName,
+		testImage,
+		localSystemUsername,
+	)
+
+	startAndTestContainer(t, sb, sbConfig, cnConfigWithCtrCmd)
+	startAndTestContainer(t, sb, sbConfig, cnConfigNoCtrCmd)
+}