diff --git a/config-windows.md b/config-windows.md index cb3849193..47a90e7ee 100644 --- a/config-windows.md +++ b/config-windows.md @@ -112,11 +112,30 @@ For more information about tooling to generate a gMSA, see [Deployment Overview] When a container terminates, the Host Compute Service indicates if a Windows update servicing operation is pending. You can indicate that a container should be started in a mode to apply pending servicing operations via the OPTIONAL `servicing` field of the Windows configuration. - ### Example ```json "windows": { "servicing": true } +``` + +## HyperV + +`hyperv` is an OPTIONAL field of the Windows configuration. If present, the container MUST be run with Hyper-V isolation. If omitted, the container MUST be run as a Windows Server container. + +The following parameters can be specified: + +* **`utilityvmpath`** *(string, OPTIONAL)* - specifies the path to the image used for the utility VM. If not supplied, the runtime will search the container filesystem layers from the bottom-most layer upwards, until it locates "UtilityVM", and default to that path. + +* **`sandboxpath`** *(string, REQUIRED)* - specifies the root of the path to the sandbox to be used for the container. + +### Example + +```json + "windows": { + "hyperv": { + "sandboxpath": "C:\\\\programdata\\\\docker\\\\windowsfilter" + } + } ``` \ No newline at end of file diff --git a/schema/config-windows.json b/schema/config-windows.json index 23b99f0de..74f3baa56 100644 --- a/schema/config-windows.json +++ b/schema/config-windows.json @@ -73,6 +73,20 @@ "servicing": { "id": "https://opencontainers.org/schema/bundle/windows/servicing", "type": "boolean" + }, + "hyperv": { + "id": "https://opencontainers.org/schema/bundle/windows/hyperv", + "type": "object", + "properties": { + "utilityvmpath": { + "id": "https://opencontainers.org/schema/bundle/windows/hyperv/utilityvmpath", + "type": "string" + }, + "sandboxpath": { + "id": "https://opencontainers.org/schema/bundle/windows/hyperv/sandboxpath", + "type": "string" + } + } } } } diff --git a/specs-go/config.go b/specs-go/config.go index f82905005..3c724eafe 100644 --- a/specs-go/config.go +++ b/specs-go/config.go @@ -436,6 +436,8 @@ type Windows struct { CredentialSpec interface{} `json:"credentialspec,omitempty"` // Servicing indicates if the container is being started in a mode to apply a Windows Update servicing operation. Servicing bool `json:"servicing,omitempty"` + // HyperV contains information for running a container with Hyper-V isolation. + HyperV *WindowsHyperV `json:"hyperv,omitempty"` } // WindowsResources has container runtime resource constraints for containers running on Windows. @@ -482,6 +484,14 @@ type WindowsNetworkResources struct { EgressBandwidth *uint64 `json:"egressBandwidth,omitempty"` } +// WindowsHyperV contains information for configuring a container to run with Hyper-V isolation. +type WindowsHyperV struct { + // UtilityVMPath is an optional path to the image used for the Utility VM. + UtilityVMPath string `json:"utilityvmpath,omitempty"` + // SandboxPath is a required host-path to the sandbox to be used by the container. + SandboxPath string `json:"sandboxpath"` +} + // LinuxSeccomp represents syscall restrictions type LinuxSeccomp struct { DefaultAction LinuxSeccompAction `json:"defaultAction"`