Windows support

[awakecoding]

I am looking for a way to use containerd on Windows Server 2019 with a Docker CLI replacement like this one. I see there are Linux builds, but has a Windows port been attempted?

Long story short, containerd for Windows should handle graceful shutdowns for containers, but the current version of Docker is still using HCS v1 + some really broken stuff under the hood, meaning Windows containers have never supported graceful shutdowns (microsoft/Windows-Containers#16).

There is no clear migration path for Docker to adopt containerd on Windows in the short term, so I would be fine with installing containerd on Windows (https://kubernetes.io/docs/setup/production-environment/container-runtimes/#install-containerd) but then I just need a proper CLI on top of it, other than 'ctr' which is very primitive and marked as unsupported/unstable.

I am not familiar with Go, but how difficult would it be to attempt a Windows port of this tool?

[AkihiroSuda]

Contribution is wanted 😃

[jsturtevant]

I took a quick look and it would be doable but would require some work, there are assumption that this would run on linux like (there are probably more):

nerdctl/exec.go

Line 229 in 06f3a7c

allCaps, err := cap.Current()

nerdctl/run.go

Lines 762 to 766 in 435f533

	for _, c := range cap.Known() {
	// "CAP_SYS_ADMIN" -> "sys_admin"
	s := strings.ToLower(strings.TrimPrefix(c, "CAP_"))
	fmt.Fprintln(w, s)
	}

nerdctl/pkg/lockutil/lockutil.go

Line 33 in 435f533

if err := Flock(dirFile, unix.LOCK_EX); err != nil {

nerdctl/pkg/containerinspector/containerinspector.go

Line 73 in 435f533

fn := func(_ ns.NetNS) error {

[jsturtevant]

I got started on this. Will likely want to break this down into many different PRs

[AkihiroSuda]

Thanks!

[jsturtevant]

Got it to build and connect 🚀

PS C:\projects\nerdctl\_output> .\nerdctl.exe ps -a
CONTAINER ID    IMAGE                                        COMMAND                   CREATED          STATUS                   PORTS    NAMES
multi-arch      k8s.gcr.io/pause:3.4.1                       "/pause.exe"              3 days ago       Created
multi-arch2     k8s.gcr.io/pause:3.4.1                       "/pause.exe"              8 minutes ago    Created
multi-arch3     k8s.gcr.io/pause:3.4.1                       "/pause.exe"              8 minutes ago    Up
test            mcr.microsoft.com/windows/nanoserver:20H2    "echo hello"              9 days ago       Exited (1) 9 days ago
test-1          mcr.microsoft.com/windows/nanoserver:20H2    "echo c:\\License.txt"    9 days ago       Exited (1) 9 days ago
test2           k8s.gcr.io/pause:3.4.1                       "/pause.exe"              7 days ago       Created

Needs some more work to be able to run containers

[jsturtevant]

I was able to get nerdctl run to work! But I did run into issues running multi-arch docker manifests (containerd/containerd#5297) which should be resolved by containerd/containerd#5298.

.\nerdctl.exe run --name nerdclttest1 mcr.microsoft.com/windows/nanoserver:20H2
Microsoft Windows [Version 10.0.19042.867] 
(c) 2019 Microsoft Corporation. All rights reserved.                                                                                                                                                                                            C:\Windows\system32>                     

Although it is rough, I opened #164 just to show the work involved. I would propose breaking this down into at least two PRs for easier reviewing:

1. split out the Logic that is tied to Linux to their separate files so that we can build the windows binary. This would allow producing and .exe but functionality would be limited. From my testing nerdctl ps would work and maybe some other basic commands.
2. Add in run support which requires a bit more refactoring.
3. After that we can approach each other functionality iteratively from there.

What do you think @AkihiroSuda?

[AkihiroSuda]

SGTM, thanks

[awakecoding]

I am revisiting this ticket since Rancher Desktop 0.5 just added initial nerdctl support. My understanding is that the latest version of nerdctl doesn't support Windows containers, unless one builds a branch from @jsturtevant from source + installs containerd.exe manually?

[AkihiroSuda]

I am revisiting this ticket since Rancher Desktop 0.5 just added initial nerdctl support. My understanding is that the latest version of nerdctl doesn't support Windows containers, unless one builds a branch from @jsturtevant from source + installs containerd.exe manually?

Yes. Help wanted to move #197 forward