Skip to content

daemon: Ensure buildkit created container's isolation mode is consistent with daemon's config in Windows#50942

Merged
vvoland merged 1 commit intomoby:masterfrom
Vigilans:vigilans/buildkit-windows-isolation
Nov 10, 2025
Merged

daemon: Ensure buildkit created container's isolation mode is consistent with daemon's config in Windows#50942
vvoland merged 1 commit intomoby:masterfrom
Vigilans:vigilans/buildkit-windows-isolation

Conversation

@Vigilans
Copy link
Contributor

@Vigilans Vigilans commented Sep 9, 2025

- What I did

Currently, when enabling buildkit in Windows, the intermediate container created by buildlkit when building image will not follow docker daemon's configuration but stick to process isolation. This will cause bug in machines that does not support process isolation, making them unable to build images with buildkit.

This PR fixes this issue to ensure buildkit created container's isolation mode consistent with daemon's config.

- How I did it

  1. Add SpecOpts to ExecutorOption (Done in buildkit's repository: Support custom OCI spec options in containerd executor buildkit#6206, superseded by Support HyperVIsolation option in containerd executor in Windows buildkit#6224)
  2. Expose DefaultIsolation field of docker daemon
  3. Add WithWindowsHyperV specOpts when daemon's default isolation mode is hyperv.

- How to verify it

  1. Follow this setup to enable buildkit in windows: https://gist.github.com/profnandaa/9ad40dbd90ebad99896ee0fed2916406
  2. In a machine that does not support process isolation mode, run docker buildx build .
  3. Will see errors like:
ERROR: failed to build: failed to solve: process "cmd /S /C echo \"hello wolrd"\" did not complete successfully: failed to create shim task: hcs:CreateComputeSystem hcdqcsa2mflizmrzrt2z9yox: 
The container operating system does not match the host operating system.

- Human readable description for the release notes

Windows: Fix BuildKit creating containers which isolation mode is inconsistent with the daemon's config

- A picture of a cute animal (not mandatory but encouraged)

yasha

Copy link
Contributor

@vvoland vvoland left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks! (but will leave a blocking review until the Buildkit changes are vendored)

@Vigilans Vigilans force-pushed the vigilans/buildkit-windows-isolation branch from 61bc0b0 to f08224d Compare September 9, 2025 16:41
@Vigilans Vigilans force-pushed the vigilans/buildkit-windows-isolation branch from f08224d to 6ebad69 Compare October 14, 2025 03:11
@github-actions github-actions bot added the area/daemon Core Engine label Oct 14, 2025
@Vigilans
Copy link
Contributor Author

Hi @vvoland, Buildkit changes in moby/buildkit#6224 has been vendored.

The SpecOpts option has been replaced by HypervIsolation boolean switch due to security consideration by buildkit maintainers.

… with daemon's config

- Introduced DefaultIsolation method in the Daemon to return the daemon configured isolation mode for Windows.

Signed-off-by: Vigilans <vigilans@foxmail.com>
@vvoland vvoland force-pushed the vigilans/buildkit-windows-isolation branch from 6ebad69 to d192a63 Compare November 10, 2025 15:49
@vvoland
Copy link
Contributor

vvoland commented Nov 10, 2025

Rebased the PR

Copy link
Contributor

@vvoland vvoland left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@vvoland vvoland merged commit c5e3c19 into moby:master Nov 10, 2025
211 of 212 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants