Misc. containerd-shim-lcow-v2 fixes for confidential

cmd/containerd-shim-lcow-v2/manager.go

@@ -213,23 +213,25 @@ func (m *shimManager) Stop(_ context.Context, id string) (resp shim.StopStatus,
 		logrus.WithError(err).Warn("failed to open shim panic log")
 	}
 
+	// The sandbox service creates the HCS system as <sandboxID>@vm.
+	vmID := fmt.Sprintf("%s@vm", id)
 	// Attempt to find the hcssystem for this bundle and terminate it.
-	if sys, _ := hcs.OpenComputeSystem(ctx, id); sys != nil {
+	if sys, _ := hcs.OpenComputeSystem(ctx, vmID); sys != nil {
 		defer sys.Close()
 		if err := sys.Terminate(ctx); err != nil {
-			fmt.Fprintf(os.Stderr, "failed to terminate %q: %v", id, err)
+			fmt.Fprintf(os.Stderr, "failed to terminate %q: %v", vmID, err)
 		} else {
 			ch := make(chan error, 1)
 			go func() { ch <- sys.Wait() }()
 			t := time.NewTimer(time.Second * 30)
 			select {
 			case <-t.C:
 				sys.Close()
-				return resp, fmt.Errorf("timed out waiting for %q to terminate", id)
+				return resp, fmt.Errorf("timed out waiting for %q to terminate", vmID)
 			case err := <-ch:
 				t.Stop()
 				if err != nil {
-					fmt.Fprintf(os.Stderr, "failed to wait for %q to terminate: %v", id, err)
+					fmt.Fprintf(os.Stderr, "failed to wait for %q to terminate: %v", vmID, err)
 				}
 			}
 		}

internal/builder/vm/lcow/specs.go

@@ -201,8 +201,10 @@ func BuildSandboxConfig(
 			)
 		// Register cleanup method prior to checking for error.
 		defer func() {
-			for _, file := range filesToCleanOnError {
-				_ = os.Remove(file)
+			if err != nil {
+				for _, file := range filesToCleanOnError {
+					_ = os.Remove(file)
+				}
 			}
 		}()
 

internal/builder/vm/lcow/specs_test.go

@@ -611,10 +611,27 @@ func TestBuildSandboxConfig(t *testing.T) {
 				// GuestState should be set in confidential mode
 				if doc.VirtualMachine.GuestState == nil || doc.VirtualMachine.GuestState.GuestStateFilePath == "" {
 					t.Error("expected GuestState file path to be set in confidential mode")
+				} else if _, err := os.Stat(doc.VirtualMachine.GuestState.GuestStateFilePath); err != nil {
+					t.Errorf("expected copied GuestState file to remain after successful build: %v", err)
 				}
 				// DM-Verity rootfs should be attached via SCSI
 				if len(doc.VirtualMachine.Devices.Scsi) == 0 {
 					t.Error("expected SCSI controllers to be configured in confidential mode")
+				} else {
+					foundRootfs := false
+					for _, controller := range doc.VirtualMachine.Devices.Scsi {
+						for _, attachment := range controller.Attachments {
+							if attachment.Path != "" {
+								foundRootfs = true
+								if _, err := os.Stat(attachment.Path); err != nil {
+									t.Errorf("expected copied rootfs file to remain after successful build: %v", err)
+								}
+							}
+						}
+					}
+					if !foundRootfs {
+						t.Error("expected a rootfs SCSI attachment")
+					}
 				}
 			},
 		},

internal/guest/runtime/hcsv2/standalone_container.go

@@ -44,6 +44,10 @@ func setupStandaloneContainerSpec(ctx context.Context, id, rootDir string, spec
 		}
 	}()
 
+	if err = updateUVMMounts(spec); err != nil {
+		return errors.Wrapf(err, "failed to update uVM mounts for standalone container %v", id)
+	}
+
 	hostname := spec.Hostname
 	if err = network.ValidateHostname(hostname); err != nil {
 		return err