From d0a297bbf602c1f59bacbf75b7fe7fa1f9b1fe4b Mon Sep 17 00:00:00 2001 From: Tingmao Wang Date: Tue, 1 Sep 2026 15:21:07 +0000 Subject: [PATCH 1/3] containerd-shim-lcow-v2: Fix shimManager::Stop using wrong ID Assisted-by: GitHub-Copilot Signed-off-by: Tingmao Wang --- cmd/containerd-shim-lcow-v2/manager.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/cmd/containerd-shim-lcow-v2/manager.go b/cmd/containerd-shim-lcow-v2/manager.go index 6ab22af109..ed54461a36 100644 --- a/cmd/containerd-shim-lcow-v2/manager.go +++ b/cmd/containerd-shim-lcow-v2/manager.go @@ -213,11 +213,13 @@ func (m *shimManager) Stop(_ context.Context, id string) (resp shim.StopStatus, logrus.WithError(err).Warn("failed to open shim panic log") } + // The sandbox service creates the HCS system as @vm. + vmID := fmt.Sprintf("%s@vm", id) // Attempt to find the hcssystem for this bundle and terminate it. - if sys, _ := hcs.OpenComputeSystem(ctx, id); sys != nil { + if sys, _ := hcs.OpenComputeSystem(ctx, vmID); sys != nil { defer sys.Close() if err := sys.Terminate(ctx); err != nil { - fmt.Fprintf(os.Stderr, "failed to terminate %q: %v", id, err) + fmt.Fprintf(os.Stderr, "failed to terminate %q: %v", vmID, err) } else { ch := make(chan error, 1) go func() { ch <- sys.Wait() }() @@ -225,11 +227,11 @@ func (m *shimManager) Stop(_ context.Context, id string) (resp shim.StopStatus, select { case <-t.C: sys.Close() - return resp, fmt.Errorf("timed out waiting for %q to terminate", id) + return resp, fmt.Errorf("timed out waiting for %q to terminate", vmID) case err := <-ch: t.Stop() if err != nil { - fmt.Fprintf(os.Stderr, "failed to wait for %q to terminate: %v", id, err) + fmt.Fprintf(os.Stderr, "failed to wait for %q to terminate: %v", vmID, err) } } } From f599f2efc4141d335933029863266f7848671624 Mon Sep 17 00:00:00 2001 From: Tingmao Wang Date: Tue, 1 Sep 2026 16:20:49 +0000 Subject: [PATCH 2/3] builder/vm/lcow: Fix confidential vmgs always being removed before VM is started The cleanup code was meant to remove the VMGS if we errors, but currently it always remove it. Assisted-by: GitHub-Copilot Signed-off-by: Tingmao Wang --- internal/builder/vm/lcow/specs.go | 6 ++++-- internal/builder/vm/lcow/specs_test.go | 17 +++++++++++++++++ 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/internal/builder/vm/lcow/specs.go b/internal/builder/vm/lcow/specs.go index 552c699486..cc6ea3ae76 100644 --- a/internal/builder/vm/lcow/specs.go +++ b/internal/builder/vm/lcow/specs.go @@ -201,8 +201,10 @@ func BuildSandboxConfig( ) // Register cleanup method prior to checking for error. defer func() { - for _, file := range filesToCleanOnError { - _ = os.Remove(file) + if err != nil { + for _, file := range filesToCleanOnError { + _ = os.Remove(file) + } } }() diff --git a/internal/builder/vm/lcow/specs_test.go b/internal/builder/vm/lcow/specs_test.go index 075b23de6e..5c1879f839 100644 --- a/internal/builder/vm/lcow/specs_test.go +++ b/internal/builder/vm/lcow/specs_test.go @@ -611,10 +611,27 @@ func TestBuildSandboxConfig(t *testing.T) { // GuestState should be set in confidential mode if doc.VirtualMachine.GuestState == nil || doc.VirtualMachine.GuestState.GuestStateFilePath == "" { t.Error("expected GuestState file path to be set in confidential mode") + } else if _, err := os.Stat(doc.VirtualMachine.GuestState.GuestStateFilePath); err != nil { + t.Errorf("expected copied GuestState file to remain after successful build: %v", err) } // DM-Verity rootfs should be attached via SCSI if len(doc.VirtualMachine.Devices.Scsi) == 0 { t.Error("expected SCSI controllers to be configured in confidential mode") + } else { + foundRootfs := false + for _, controller := range doc.VirtualMachine.Devices.Scsi { + for _, attachment := range controller.Attachments { + if attachment.Path != "" { + foundRootfs = true + if _, err := os.Stat(attachment.Path); err != nil { + t.Errorf("expected copied rootfs file to remain after successful build: %v", err) + } + } + } + } + if !foundRootfs { + t.Error("expected a rootfs SCSI attachment") + } } }, }, From 980583ed7bdd699731659117cd9b9a61f904464e Mon Sep 17 00:00:00 2001 From: Tingmao Wang Date: Fri, 28 Aug 2026 11:16:50 +0100 Subject: [PATCH 3/3] guest: setupStandaloneContainerSpec: Support uvm:// mounts for standalone containers Assisted-by: GitHub-Copilot Signed-off-by: Tingmao Wang --- internal/guest/runtime/hcsv2/standalone_container.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/internal/guest/runtime/hcsv2/standalone_container.go b/internal/guest/runtime/hcsv2/standalone_container.go index 1ef2b02941..d2250f40f3 100644 --- a/internal/guest/runtime/hcsv2/standalone_container.go +++ b/internal/guest/runtime/hcsv2/standalone_container.go @@ -44,6 +44,10 @@ func setupStandaloneContainerSpec(ctx context.Context, id, rootDir string, spec } }() + if err = updateUVMMounts(spec); err != nil { + return errors.Wrapf(err, "failed to update uVM mounts for standalone container %v", id) + } + hostname := spec.Hostname if err = network.ValidateHostname(hostname); err != nil { return err