Move snapshots/windows to plugins/snapshots/windows

Signed-off-by: Derek McGowan <derek@mcg.dev>

plugins/snapshots/windows/cimfs.go

@@ -0,0 +1,217 @@
+//go:build windows
+// +build windows
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package windows
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/Microsoft/hcsshim"
+	"github.com/Microsoft/hcsshim/pkg/cimfs"
+	cimlayer "github.com/Microsoft/hcsshim/pkg/ociwclayer/cim"
+	"github.com/containerd/containerd/v2/core/mount"
+	"github.com/containerd/containerd/v2/errdefs"
+	"github.com/containerd/containerd/v2/platforms"
+	"github.com/containerd/containerd/v2/plugins"
+	"github.com/containerd/containerd/v2/snapshots"
+	"github.com/containerd/containerd/v2/snapshots/storage"
+	"github.com/containerd/log"
+	"github.com/containerd/plugin"
+	"github.com/containerd/plugin/registry"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+// Composite image FileSystem (CimFS) is a new read-only filesystem (similar to overlayFS on Linux) created
+// specifically for storing container image layers on windows.  cimFSSnapshotter is a snapshotter that uses
+// CimFS to create read-only parent layer snapshots. Each snapshot is represented by a `<snapshot-id>.cim`
+// file and some other files (region & objectid files) which hold contents of that snapshot.  Once a cim file for a layer is created it
+// can only be used as a read-only layer by mounting it to a volume. Hence, CimFs will not be used when we are
+// creating writable layers for container scratch and such. (However, in the future scratch layer of a container can be
+// exported to a cim layer and then be used as a parent layer for another container).
+type cimFSSnapshotter struct {
+	*windowsBaseSnapshotter
+	// cimDir is the path to the directory which holds all of the layer cim files.  CimFS needs all the
+	// layer cim files to be present in the same directory. Hence, cim files of all the snapshots (even if
+	// they are of different images) will be kept in the same directory.
+	cimDir string
+}
+
+func init() {
+	registry.Register(&plugin.Registration{
+		Type: plugins.SnapshotPlugin,
+		ID:   "cimfs",
+		InitFn: func(ic *plugin.InitContext) (interface{}, error) {
+			ic.Meta.Platforms = []ocispec.Platform{platforms.DefaultSpec()}
+			return NewCimFSSnapshotter(ic.Properties[plugins.PropertyRootDir])
+		},
+	})
+}
+
+// NewCimFSSnapshotter returns a new CimFS based windows snapshotter
+func NewCimFSSnapshotter(root string) (snapshots.Snapshotter, error) {
+	if !cimfs.IsCimFSSupported() {
+		return nil, fmt.Errorf("host windows version doesn't support CimFS: %w", plugin.ErrSkipPlugin)
+	}
+
+	baseSn, err := newBaseSnapshotter(root)
+	if err != nil {
+		return nil, err
+	}
+
+	return &cimFSSnapshotter{
+		windowsBaseSnapshotter: baseSn,
+		cimDir:                 filepath.Join(baseSn.info.HomeDir, "cim-layers"),
+	}, nil
+}
+
+// getCimLayerPath returns the path of the cim file for the given snapshot. Note that this function doesn't
+// actually check if the cim layer exists it simply does string manipulation to generate the path isCimLayer
+// can be used to verify if it is actually a cim layer.
+func getCimLayerPath(cimDir, snID string) string {
+	return filepath.Join(cimDir, (snID + ".cim"))
+}
+
+// isCimLayer checks if the snapshot referred by the given key is actually a cim layer.  With CimFS
+// snapshotter all the read-only (i.e image) layers are stored in the cim format while we still use VHDs for
+// scratch layers.
+func (s *cimFSSnapshotter) isCimLayer(ctx context.Context, key string) (bool, error) {
+	id, _, _, err := storage.GetInfo(ctx, key)
+	if err != nil {
+		return false, fmt.Errorf("get snapshot info: %w", err)
+	}
+	snCimPath := getCimLayerPath(s.cimDir, id)
+	if _, err := os.Stat(snCimPath); err != nil {
+		if os.IsNotExist(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
+
+func (s *cimFSSnapshotter) Usage(ctx context.Context, key string) (snapshots.Usage, error) {
+	baseUsage, err := s.windowsBaseSnapshotter.Usage(ctx, key)
+	if err != nil {
+		return snapshots.Usage{}, err
+	}
+
+	ctx, t, err := s.ms.TransactionContext(ctx, false)
+	if err != nil {
+		return snapshots.Usage{}, err
+	}
+	defer t.Rollback()
+
+	id, _, _, err := storage.GetInfo(ctx, key)
+	if err != nil {
+		return snapshots.Usage{}, fmt.Errorf("failed to get snapshot info: %w", err)
+	}
+
+	if ok, err := s.isCimLayer(ctx, key); err != nil {
+		return snapshots.Usage{}, err
+	} else if ok {
+		cimUsage, err := cimfs.GetCimUsage(ctx, getCimLayerPath(s.cimDir, id))
+		if err != nil {
+			return snapshots.Usage{}, err
+		}
+		baseUsage.Size += int64(cimUsage)
+	}
+	return baseUsage, nil
+}
+
+func (s *cimFSSnapshotter) Prepare(ctx context.Context, key, parent string, opts ...snapshots.Opt) ([]mount.Mount, error) {
+	m, err := s.createSnapshot(ctx, snapshots.KindActive, key, parent, opts)
+	if err != nil {
+		return m, err
+	}
+	m[0].Type = "CimFS"
+	return m, nil
+}
+
+func (s *cimFSSnapshotter) View(ctx context.Context, key, parent string, opts ...snapshots.Opt) ([]mount.Mount, error) {
+	m, err := s.createSnapshot(ctx, snapshots.KindView, key, parent, opts)
+	if err != nil {
+		return m, err
+	}
+	m[0].Type = "CimFS"
+	return m, nil
+}
+
+func (s *cimFSSnapshotter) Mounts(ctx context.Context, key string) ([]mount.Mount, error) {
+	mounts, err := s.windowsBaseSnapshotter.Mounts(ctx, key)
+	if err != nil {
+		return nil, err
+	}
+	mounts[0].Type = "CimFS"
+	return mounts, nil
+}
+
+func (s *cimFSSnapshotter) Commit(ctx context.Context, name, key string, opts ...snapshots.Opt) error {
+	if !strings.Contains(key, snapshots.UnpackKeyPrefix) {
+		return fmt.Errorf("committing a scratch snapshot to read-only cim layer isn't supported yet")
+	}
+
+	return s.ms.WithTransaction(ctx, true, func(ctx context.Context) error {
+		usage, err := s.Usage(ctx, key)
+		if err != nil {
+			return fmt.Errorf("failed to get usage during commit: %w", err)
+		}
+		if _, err := storage.CommitActive(ctx, key, name, usage, opts...); err != nil {
+			return fmt.Errorf("failed to commit snapshot: %w", err)
+		}
+
+		return nil
+	})
+}
+
+// Remove abandons the transaction identified by key. All resources
+// associated with the key will be removed.
+func (s *cimFSSnapshotter) Remove(ctx context.Context, key string) error {
+	var ID, renamedID string
+
+	// collect original ID before preRemove
+	err := s.ms.WithTransaction(ctx, false, func(ctx context.Context) error {
+		var infoErr error
+		ID, _, _, infoErr = storage.GetInfo(ctx, key)
+		return infoErr
+	})
+	if err != nil {
+		return fmt.Errorf("%w: failed to get snapshot info: %s", errdefs.ErrFailedPrecondition, err)
+	}
+
+	renamedID, err = s.preRemove(ctx, key)
+	if err != nil {
+		// wrap as ErrFailedPrecondition so that cleanup of other snapshots can continue
+		return fmt.Errorf("%w: %s", errdefs.ErrFailedPrecondition, err)
+	}
+
+	if err := cimlayer.DestroyCimLayer(s.getSnapshotDir(ID)); err != nil {
+		// Must be cleaned up, any "rm-*" could be removed if no active transactions
+		log.G(ctx).WithError(err).WithField("ID", ID).Warnf("failed to cleanup cim files")
+	}
+
+	if err = hcsshim.DestroyLayer(s.info, renamedID); err != nil {
+		// Must be cleaned up, any "rm-*" could be removed if no active transactions
+		log.G(ctx).WithError(err).WithField("renamedID", renamedID).Warnf("failed to remove root filesystem")
+	}
+	return nil
+}

plugins/snapshots/windows/common.go

@@ -0,0 +1,419 @@
+//go:build windows
+// +build windows
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package windows
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/Microsoft/hcsshim"
+	"github.com/containerd/containerd/v2/core/mount"
+	"github.com/containerd/containerd/v2/snapshots"
+	"github.com/containerd/containerd/v2/snapshots/storage"
+	"github.com/containerd/continuity/fs"
+	"github.com/containerd/log"
+)
+
+// windowsBaseSnapshotter is a type that implements common functionality required by both windows & cimfs
+// snapshotters (sort of a base type that windows & cimfs snapshotter types derive from - however, windowsBaseSnapshotter does NOT impelement the full Snapshotter interface).  Some functions
+// (like Stat, Update) that are identical for both snapshotters are directly implemented in this base
+// snapshotter and such functions handle database transaction creation etc. However, the functions that are
+// not common don't create a transaction to allow the caller the flexibility of deciding whether to commit or
+// abort the transaction.
+type windowsBaseSnapshotter struct {
+	root string
+	ms   *storage.MetaStore
+	info hcsshim.DriverInfo
+}
+
+func newBaseSnapshotter(root string) (*windowsBaseSnapshotter, error) {
+	if err := os.MkdirAll(root, 0700); err != nil {
+		return nil, err
+	}
+
+	ms, err := storage.NewMetaStore(filepath.Join(root, "metadata.db"))
+	if err != nil {
+		return nil, err
+	}
+
+	if err := os.Mkdir(filepath.Join(root, "snapshots"), 0700); err != nil && !os.IsExist(err) {
+		return nil, err
+	}
+
+	return &windowsBaseSnapshotter{
+		root: root,
+		ms:   ms,
+		info: hcsshim.DriverInfo{HomeDir: filepath.Join(root, "snapshots")},
+	}, nil
+}
+
+func (w *windowsBaseSnapshotter) getSnapshotDir(id string) string {
+	return filepath.Join(w.root, "snapshots", id)
+}
+
+func (w *windowsBaseSnapshotter) parentIDsToParentPaths(parentIDs []string) []string {
+	parentLayerPaths := make([]string, 0, len(parentIDs))
+	for _, ID := range parentIDs {
+		parentLayerPaths = append(parentLayerPaths, w.getSnapshotDir(ID))
+	}
+	return parentLayerPaths
+}
+
+func (w *windowsBaseSnapshotter) Stat(ctx context.Context, key string) (info snapshots.Info, err error) {
+	err = w.ms.WithTransaction(ctx, false, func(ctx context.Context) error {
+		_, info, _, err = storage.GetInfo(ctx, key)
+		return err
+	})
+	if err != nil {
+		return snapshots.Info{}, err
+	}
+
+	return info, nil
+}
+
+func (w *windowsBaseSnapshotter) Update(ctx context.Context, info snapshots.Info, fieldpaths ...string) (_ snapshots.Info, err error) {
+	err = w.ms.WithTransaction(ctx, true, func(ctx context.Context) error {
+		info, err = storage.UpdateInfo(ctx, info, fieldpaths...)
+		return err
+	})
+	if err != nil {
+		return snapshots.Info{}, err
+	}
+
+	return info, nil
+}
+
+func (w *windowsBaseSnapshotter) Usage(ctx context.Context, key string) (usage snapshots.Usage, err error) {
+	var (
+		id   string
+		info snapshots.Info
+	)
+
+	err = w.ms.WithTransaction(ctx, false, func(ctx context.Context) error {
+		id, info, usage, err = storage.GetInfo(ctx, key)
+		return err
+	})
+	if err != nil {
+		return snapshots.Usage{}, err
+	}
+
+	if info.Kind == snapshots.KindActive {
+		path := w.getSnapshotDir(id)
+		du, err := fs.DiskUsage(ctx, path)
+		if err != nil {
+			return snapshots.Usage{}, err
+		}
+
+		usage = snapshots.Usage(du)
+	}
+
+	return usage, nil
+}
+
+func (w *windowsBaseSnapshotter) mounts(sn storage.Snapshot, key string) []mount.Mount {
+	var (
+		roFlag string
+	)
+
+	if sn.Kind == snapshots.KindView {
+		roFlag = "ro"
+	} else {
+		roFlag = "rw"
+	}
+
+	source := w.getSnapshotDir(sn.ID)
+	parentLayerPaths := w.parentIDsToParentPaths(sn.ParentIDs)
+
+	mountType := "windows-layer"
+
+	// error is not checked here, as a string array will never fail to Marshal
+	parentLayersJSON, _ := json.Marshal(parentLayerPaths)
+	parentLayersOption := mount.ParentLayerPathsFlag + string(parentLayersJSON)
+
+	options := []string{
+		roFlag,
+	}
+	if len(sn.ParentIDs) != 0 {
+		options = append(options, parentLayersOption)
+	}
+	mounts := []mount.Mount{
+		{
+			Source:  source,
+			Type:    mountType,
+			Options: options,
+		},
+	}
+
+	return mounts
+}
+
+// Mounts returns the mounts for the transaction identified by key. Can be
+// called on an read-write or readonly transaction.
+//
+// This can be used to recover mounts after calling View or Prepare.
+func (w *windowsBaseSnapshotter) Mounts(ctx context.Context, key string) (_ []mount.Mount, err error) {
+	var snapshot storage.Snapshot
+	err = w.ms.WithTransaction(ctx, false, func(ctx context.Context) error {
+		snapshot, err = storage.GetSnapshot(ctx, key)
+		if err != nil {
+			return fmt.Errorf("failed to get snapshot mount: %w", err)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return w.mounts(snapshot, key), nil
+}
+
+// Walk the committed snapshots.
+func (w *windowsBaseSnapshotter) Walk(ctx context.Context, fn snapshots.WalkFunc, fs ...string) error {
+	return w.ms.WithTransaction(ctx, false, func(ctx context.Context) error {
+		return storage.WalkInfo(ctx, fn, fs...)
+	})
+}
+
+// preRemove prepares for removal of a snapshot by first renaming the snapshot directory and if that succeeds
+// removing the snapshot info from the database. Then the caller can decide how to remove the actual renamed
+// snapshot directory. Returns the new 'ID' (i.e the directory name after rename).
+func (w *windowsBaseSnapshotter) preRemove(ctx context.Context, key string) (string, error) {
+	var (
+		renamed, path, renamedID string
+		restore                  bool
+	)
+
+	err := w.ms.WithTransaction(ctx, true, func(ctx context.Context) error {
+		id, _, err := storage.Remove(ctx, key)
+		if err != nil {
+			return fmt.Errorf("failed to remove: %w", err)
+		}
+
+		path = w.getSnapshotDir(id)
+		renamedID = "rm-" + id
+		renamed = w.getSnapshotDir(renamedID)
+		if err = os.Rename(path, renamed); err != nil && !os.IsNotExist(err) {
+			if !os.IsPermission(err) {
+				return err
+			}
+			// If permission denied, it's possible that the scratch is still mounted, an
+			// artifact after a hard daemon crash for example. Worth a shot to try deactivating it
+			// before retrying the rename.
+			var (
+				home, layerID = filepath.Split(path)
+				di            = hcsshim.DriverInfo{
+					HomeDir: home,
+				}
+			)
+
+			if deactivateErr := hcsshim.DeactivateLayer(di, layerID); deactivateErr != nil {
+				return fmt.Errorf("failed to deactivate layer following failed rename: %s: %w", deactivateErr, err)
+			}
+
+			if renameErr := os.Rename(path, renamed); renameErr != nil && !os.IsNotExist(renameErr) {
+				return fmt.Errorf("second rename attempt following detach failed: %s: %w", renameErr, err)
+			}
+		}
+
+		restore = true
+		return nil
+	})
+	if err != nil {
+		if restore { // failed to commit
+			if err1 := os.Rename(renamed, path); err1 != nil {
+				// May cause inconsistent data on disk
+				log.G(ctx).WithError(err1).WithField("path", renamed).Error("Failed to rename after failed commit")
+			}
+		}
+		return "", err
+	}
+	return renamedID, nil
+}
+
+// Close closes the snapshotter
+func (w *windowsBaseSnapshotter) Close() error {
+	return w.ms.Close()
+}
+
+func (w *windowsBaseSnapshotter) createSnapshot(ctx context.Context, kind snapshots.Kind, key, parent string, opts []snapshots.Opt) (_ []mount.Mount, err error) {
+	var newSnapshot storage.Snapshot
+	err = w.ms.WithTransaction(ctx, true, func(ctx context.Context) error {
+		newSnapshot, err = storage.CreateSnapshot(ctx, kind, key, parent, opts...)
+		if err != nil {
+			return fmt.Errorf("failed to create snapshot: %w", err)
+		}
+
+		log.G(ctx).Debug("createSnapshot")
+		// Create the new snapshot dir
+		snDir := w.getSnapshotDir(newSnapshot.ID)
+		if err = os.MkdirAll(snDir, 0700); err != nil {
+			return fmt.Errorf("failed to create snapshot dir %s: %w", snDir, err)
+		}
+
+		if strings.Contains(key, snapshots.UnpackKeyPrefix) {
+			// IO/disk space optimization: Do nothing
+			//
+			// We only need one sandbox.vhdx for the container. Skip making one for this
+			// snapshot if this isn't the snapshot that just houses the final sandbox.vhd
+			// that will be mounted as the containers scratch. Currently the key for a snapshot
+			// where a layer will be extracted to will have the string `extract-` in it.
+			return nil
+		}
+
+		if len(newSnapshot.ParentIDs) == 0 {
+			// A parentless snapshot a new base layer. Valid base layers must have a "Files" folder.
+			// When committed, there'll be some post-processing to fill in the rest
+			// of the metadata.
+			filesDir := filepath.Join(snDir, "Files")
+			if err := os.MkdirAll(filesDir, 0700); err != nil {
+				return fmt.Errorf("creating Files dir: %w", err)
+			}
+			return nil
+		}
+
+		parentLayerPaths := w.parentIDsToParentPaths(newSnapshot.ParentIDs)
+		var snapshotInfo snapshots.Info
+		for _, o := range opts {
+			o(&snapshotInfo)
+		}
+
+		var sizeInBytes uint64
+		if sizeGBstr, ok := snapshotInfo.Labels[rootfsSizeInGBLabel]; ok {
+			log.G(ctx).Warnf("%q label is deprecated, please use %q instead.", rootfsSizeInGBLabel, rootfsSizeInBytesLabel)
+
+			sizeInGB, err := strconv.ParseUint(sizeGBstr, 10, 32)
+			if err != nil {
+				return fmt.Errorf("failed to parse label %q=%q: %w", rootfsSizeInGBLabel, sizeGBstr, err)
+			}
+			sizeInBytes = sizeInGB * 1024 * 1024 * 1024
+		}
+
+		// Prefer the newer label in bytes over the deprecated Windows specific GB variant.
+		if sizeBytesStr, ok := snapshotInfo.Labels[rootfsSizeInBytesLabel]; ok {
+			sizeInBytes, err = strconv.ParseUint(sizeBytesStr, 10, 64)
+			if err != nil {
+				return fmt.Errorf("failed to parse label %q=%q: %w", rootfsSizeInBytesLabel, sizeBytesStr, err)
+			}
+		}
+
+		var makeUVMScratch bool
+		if _, ok := snapshotInfo.Labels[uvmScratchLabel]; ok {
+			makeUVMScratch = true
+		}
+
+		// This has to be run first to avoid clashing with the containers sandbox.vhdx.
+		if makeUVMScratch {
+			if err = w.createUVMScratchLayer(ctx, snDir, parentLayerPaths); err != nil {
+				return fmt.Errorf("failed to make UVM's scratch layer: %w", err)
+			}
+		}
+		if err = w.createScratchLayer(ctx, snDir, parentLayerPaths, sizeInBytes); err != nil {
+			return fmt.Errorf("failed to create scratch layer: %w", err)
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return w.mounts(newSnapshot, key), nil
+}
+
+// This is essentially a recreation of what HCS' CreateSandboxLayer does with some extra bells and
+// whistles like expanding the volume if a size is specified.
+func (w *windowsBaseSnapshotter) createScratchLayer(ctx context.Context, snDir string, parentLayers []string, sizeInBytes uint64) error {
+	parentLen := len(parentLayers)
+	if parentLen == 0 {
+		return errors.New("no parent layers present")
+	}
+
+	baseLayer := parentLayers[parentLen-1]
+	templateDiffDisk := filepath.Join(baseLayer, "blank.vhdx")
+	dest := filepath.Join(snDir, "sandbox.vhdx")
+	if err := copyScratchDisk(templateDiffDisk, dest); err != nil {
+		return err
+	}
+
+	if sizeInBytes != 0 {
+		if err := hcsshim.ExpandSandboxSize(w.info, filepath.Base(snDir), sizeInBytes); err != nil {
+			return fmt.Errorf("failed to expand sandbox vhdx size to %d bytes: %w", sizeInBytes, err)
+		}
+	}
+	return nil
+}
+
+// This handles creating the UVMs scratch layer.
+func (w *windowsBaseSnapshotter) createUVMScratchLayer(ctx context.Context, snDir string, parentLayers []string) error {
+	parentLen := len(parentLayers)
+	if parentLen == 0 {
+		return errors.New("no parent layers present")
+	}
+	baseLayer := parentLayers[parentLen-1]
+
+	// Make sure base layer has a UtilityVM folder.
+	uvmPath := filepath.Join(baseLayer, "UtilityVM")
+	if _, err := os.Stat(uvmPath); os.IsNotExist(err) {
+		return fmt.Errorf("failed to find UtilityVM directory in base layer %q: %w", baseLayer, err)
+	}
+
+	templateDiffDisk := filepath.Join(uvmPath, "SystemTemplate.vhdx")
+
+	// Check if SystemTemplate disk doesn't exist for some reason (this should be made during the unpacking
+	// of the base layer).
+	if _, err := os.Stat(templateDiffDisk); os.IsNotExist(err) {
+		return fmt.Errorf("%q does not exist in Utility VM image", templateDiffDisk)
+	}
+
+	// Move the sandbox.vhdx into a nested vm folder to avoid clashing with a containers sandbox.vhdx.
+	vmScratchDir := filepath.Join(snDir, "vm")
+	if err := os.MkdirAll(vmScratchDir, 0777); err != nil {
+		return fmt.Errorf("failed to make `vm` directory for vm's scratch space: %w", err)
+	}
+
+	return copyScratchDisk(templateDiffDisk, filepath.Join(vmScratchDir, "sandbox.vhdx"))
+}
+
+func copyScratchDisk(source, dest string) error {
+	scratchSource, err := os.OpenFile(source, os.O_RDWR, 0700)
+	if err != nil {
+		return fmt.Errorf("failed to open %s: %w", source, err)
+	}
+	defer scratchSource.Close()
+
+	f, err := os.OpenFile(dest, os.O_RDWR|os.O_CREATE, 0700)
+	if err != nil {
+		return fmt.Errorf("failed to create sandbox.vhdx in snapshot: %w", err)
+	}
+	defer f.Close()
+
+	if _, err := io.Copy(f, scratchSource); err != nil {
+		os.Remove(dest)
+		return fmt.Errorf("failed to copy cached %q to %q in snapshot: %w", source, dest, err)
+	}
+	return nil
+}

plugins/snapshots/windows/windows.go

@@ -0,0 +1,199 @@
+//go:build windows
+// +build windows
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package windows
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/Microsoft/go-winio"
+	winfs "github.com/Microsoft/go-winio/pkg/fs"
+	"github.com/Microsoft/hcsshim"
+	"github.com/Microsoft/hcsshim/pkg/ociwclayer"
+	"github.com/containerd/containerd/v2/core/mount"
+	"github.com/containerd/containerd/v2/errdefs"
+	"github.com/containerd/containerd/v2/platforms"
+	"github.com/containerd/containerd/v2/plugins"
+	"github.com/containerd/containerd/v2/snapshots"
+	"github.com/containerd/containerd/v2/snapshots/storage"
+	"github.com/containerd/continuity/fs"
+	"github.com/containerd/log"
+	"github.com/containerd/plugin"
+	"github.com/containerd/plugin/registry"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+func init() {
+	registry.Register(&plugin.Registration{
+		Type: plugins.SnapshotPlugin,
+		ID:   "windows",
+		InitFn: func(ic *plugin.InitContext) (interface{}, error) {
+			ic.Meta.Platforms = []ocispec.Platform{platforms.DefaultSpec()}
+			return NewWindowsSnapshotter(ic.Properties[plugins.PropertyRootDir])
+		},
+	})
+}
+
+const (
+	// Label to specify that we should make a scratch space for a UtilityVM.
+	uvmScratchLabel = "containerd.io/snapshot/io.microsoft.vm.storage.scratch"
+	// Label to control a containers scratch space size (sandbox.vhdx).
+	//
+	// Deprecated: use rootfsSizeInBytesLabel
+	rootfsSizeInGBLabel = "containerd.io/snapshot/io.microsoft.container.storage.rootfs.size-gb"
+	// rootfsSizeInBytesLabel is a label to control a Windows containers scratch space
+	// size in bytes.
+	rootfsSizeInBytesLabel = "containerd.io/snapshot/windows/rootfs.sizebytes"
+)
+
+// snapshotter for legacy windows layers
+type wcowSnapshotter struct {
+	*windowsBaseSnapshotter
+}
+
+// NewWindowsSnapshotter returns a new windows snapshotter
+func NewWindowsSnapshotter(root string) (snapshots.Snapshotter, error) {
+	fsType, err := winfs.GetFileSystemType(root)
+	if err != nil {
+		return nil, err
+	}
+	if strings.ToLower(fsType) != "ntfs" {
+		return nil, fmt.Errorf("%s is not on an NTFS volume - only NTFS volumes are supported: %w", root, errdefs.ErrInvalidArgument)
+	}
+
+	baseSn, err := newBaseSnapshotter(root)
+	if err != nil {
+		return nil, err
+	}
+
+	return &wcowSnapshotter{
+		windowsBaseSnapshotter: baseSn,
+	}, nil
+}
+
+func (s *wcowSnapshotter) Prepare(ctx context.Context, key, parent string, opts ...snapshots.Opt) ([]mount.Mount, error) {
+	return s.createSnapshot(ctx, snapshots.KindActive, key, parent, opts)
+}
+
+func (s *wcowSnapshotter) View(ctx context.Context, key, parent string, opts ...snapshots.Opt) ([]mount.Mount, error) {
+	return s.createSnapshot(ctx, snapshots.KindView, key, parent, opts)
+}
+
+func (s *wcowSnapshotter) Commit(ctx context.Context, name, key string, opts ...snapshots.Opt) (retErr error) {
+	return s.ms.WithTransaction(ctx, true, func(ctx context.Context) error {
+		// grab the existing id
+		id, _, _, err := storage.GetInfo(ctx, key)
+		if err != nil {
+			return fmt.Errorf("failed to get storage info for %s: %w", key, err)
+		}
+
+		snapshot, err := storage.GetSnapshot(ctx, key)
+		if err != nil {
+			return err
+		}
+
+		path := s.getSnapshotDir(id)
+
+		// If (windowsDiff).Apply was used to populate this layer, then it's already in the 'committed' state.
+		// See createSnapshot below for more details
+		if !strings.Contains(key, snapshots.UnpackKeyPrefix) {
+			if len(snapshot.ParentIDs) == 0 {
+				if err = hcsshim.ConvertToBaseLayer(path); err != nil {
+					return err
+				}
+			} else if err := s.convertScratchToReadOnlyLayer(ctx, snapshot, path); err != nil {
+				return err
+			}
+		}
+
+		usage, err := fs.DiskUsage(ctx, path)
+		if err != nil {
+			return fmt.Errorf("failed to collect disk usage of snapshot storage: %s: %w", path, err)
+		}
+
+		if _, err := storage.CommitActive(ctx, key, name, snapshots.Usage(usage), opts...); err != nil {
+			return fmt.Errorf("failed to commit snapshot: %w", err)
+		}
+
+		return nil
+	})
+}
+
+// Remove abandons the transaction identified by key. All resources
+// associated with the key will be removed.
+func (s *wcowSnapshotter) Remove(ctx context.Context, key string) error {
+	renamedID, err := s.preRemove(ctx, key)
+	if err != nil {
+		// wrap as ErrFailedPrecondition so that cleanup of other snapshots can continue
+		return fmt.Errorf("%w: %s", errdefs.ErrFailedPrecondition, err)
+	}
+
+	if err = hcsshim.DestroyLayer(s.info, renamedID); err != nil {
+		// Must be cleaned up, any "rm-*" could be removed if no active transactions
+		log.G(ctx).WithError(err).WithField("renamedID", renamedID).Warnf("Failed to remove root filesystem")
+	}
+
+	return nil
+}
+
+// convertScratchToReadOnlyLayer reimports the layer over itself, to transfer the files from the sandbox.vhdx to the on-disk storage.
+func (s *wcowSnapshotter) convertScratchToReadOnlyLayer(ctx context.Context, snapshot storage.Snapshot, path string) (retErr error) {
+
+	// TODO darrenstahlmsft: When this is done isolated, we should disable these.
+	// it currently cannot be disabled, unless we add ref counting. Since this is
+	// temporary, leaving it enabled is OK for now.
+	// https://github.com/containerd/containerd/issues/1681
+	if err := winio.EnableProcessPrivileges([]string{winio.SeBackupPrivilege, winio.SeRestorePrivilege}); err != nil {
+		return fmt.Errorf("failed to enable necessary privileges: %w", err)
+	}
+
+	parentLayerPaths := s.parentIDsToParentPaths(snapshot.ParentIDs)
+	reader, writer := io.Pipe()
+
+	go func() {
+		err := ociwclayer.ExportLayerToTar(ctx, writer, path, parentLayerPaths)
+		writer.CloseWithError(err)
+	}()
+
+	// It seems that in certain situations, like having the containerd root and state on a file system hosted on a
+	// mounted VHDX, we need SeSecurityPrivilege when opening a file with winio.ACCESS_SYSTEM_SECURITY. This happens
+	// in the base layer writer in hcsshim when adding a new file.
+	if err := winio.RunWithPrivileges([]string{winio.SeSecurityPrivilege}, func() error {
+		_, err := ociwclayer.ImportLayerFromTar(ctx, reader, path, parentLayerPaths)
+		return err
+	}); err != nil {
+		return fmt.Errorf("failed to reimport snapshot: %w", err)
+	}
+
+	if _, err := io.Copy(io.Discard, reader); err != nil {
+		return fmt.Errorf("failed discarding extra data in import stream: %w", err)
+	}
+
+	// NOTE: We do not delete the sandbox.vhdx here, as that will break later calls to
+	// ociwclayer.ExportLayerToTar for this snapshot.
+	// As a consequence, the data for this layer is held twice, once on-disk and once
+	// in the sandbox.vhdx.
+	// TODO: This is either a bug or misfeature in hcsshim, so will need to be resolved
+	// there first.
+
+	return nil
+}

plugins/snapshots/windows/windows_test.go

@@ -0,0 +1,43 @@
+//go:build windows
+// +build windows
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package windows
+
+import (
+	"context"
+	"testing"
+
+	"github.com/containerd/containerd/v2/pkg/testutil"
+	"github.com/containerd/containerd/v2/snapshots"
+	"github.com/containerd/containerd/v2/snapshots/testsuite"
+)
+
+func newSnapshotter(ctx context.Context, root string) (snapshots.Snapshotter, func() error, error) {
+	snapshotter, err := NewWindowsSnapshotter(root)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return snapshotter, func() error { return snapshotter.Close() }, nil
+}
+
+func TestWindows(t *testing.T) {
+	testutil.RequiresRoot(t)
+	testsuite.SnapshotterSuite(t, "Windows", newSnapshotter)
+}