@@ -17,7 +17,7 @@ import (

 // ImageComponent provides an interface for working with images

 type ImageComponent interface {

 	SquashImage(from string, to string) (string, error)

-	TagImageWithReference(image.ID, reference.Named) error

+	TagImageWithReference(image.ID, string, reference.Named) error

 }

 // Backend provides build functionality to the API router

@@ -3,9 +3,11 @@ package build

 import (

 	"fmt"

 	"io"

+	"runtime"

 	"github.com/docker/distribution/reference"

 	"github.com/docker/docker/image"

+	"github.com/docker/docker/pkg/system"

 	"github.com/pkg/errors"

 )

@@ -33,7 +35,12 @@ func NewTagger(backend ImageComponent, stdout io.Writer, names []string) (*Tagge

 // TagImages creates image tags for the imageID

 func (bt *Tagger) TagImages(imageID image.ID) error {

 	for _, rt := range bt.repoAndTags {

-		if err := bt.imageComponent.TagImageWithReference(imageID, rt); err != nil {

+		// TODO @jhowardmsft LCOW support. Will need revisiting.

+		platform := runtime.GOOS

+		if platform == "windows" && system.LCOWSupported() {

+			platform = "linux"

+		}

+		if err := bt.imageComponent.TagImageWithReference(imageID, platform, rt); err != nil {

 			return err

 		}

 		fmt.Fprintf(bt.stdout, "Successfully tagged %s\n", reference.FamiliarString(rt))

@@ -320,6 +320,7 @@ type ContainerJSONBase struct {

 	Name            string

 	RestartCount    int

 	Driver          string

+	Platform        string

 	MountLabel      string

 	ProcessLabel    string

 	AppArmorProfile string

@@ -267,12 +267,6 @@ func (cli *DaemonCli) start(opts *daemonOptions) (err error) {

 	logrus.Info("Daemon has completed initialization")

-	logrus.WithFields(logrus.Fields{

-		"version":     dockerversion.Version,

-		"commit":      dockerversion.GitCommit,

-		"graphdriver": d.GraphDriverName(),

-	}).Info("Docker daemon")

-

 	cli.d = d

 	initRouter(api, d, c)

@@ -2,6 +2,7 @@ package daemon

 import (

 	"io"

+	"runtime"

 	"github.com/Sirupsen/logrus"

 	"github.com/docker/distribution/reference"

@@ -147,7 +148,8 @@ func (daemon *Daemon) GetImageAndReleasableLayer(ctx context.Context, refOrID st

 		image, _ := daemon.GetImage(refOrID)

 		// TODO: shouldn't we error out if error is different from "not found" ?

 		if image != nil {

-			layer, err := newReleasableLayerForImage(image, daemon.layerStore)

+			// TODO LCOW @jhowardmsft. For now using runtime.GOOS for this, will need enhancing for platform when porting the builder

+			layer, err := newReleasableLayerForImage(image, daemon.stores[runtime.GOOS].layerStore)

 			return image, layer, err

 		}

 	}

@@ -156,7 +158,8 @@ func (daemon *Daemon) GetImageAndReleasableLayer(ctx context.Context, refOrID st

 	if err != nil {

 		return nil, nil, err

 	}

-	layer, err := newReleasableLayerForImage(image, daemon.layerStore)

+	// TODO LCOW @jhowardmsft. For now using runtime.GOOS for this, will need enhancing for platform when porting the builder

+	layer, err := newReleasableLayerForImage(image, daemon.stores[runtime.GOOS].layerStore)

 	return image, layer, err

 }

@@ -1,6 +1,8 @@

 package daemon

 import (

+	"runtime"

+

 	"github.com/Sirupsen/logrus"

 	"github.com/docker/docker/builder"

 	"github.com/docker/docker/image/cache"

@@ -9,10 +11,12 @@ import (

 // MakeImageCache creates a stateful image cache.

 func (daemon *Daemon) MakeImageCache(sourceRefs []string) builder.ImageCache {

 	if len(sourceRefs) == 0 {

-		return cache.NewLocal(daemon.imageStore)

+		// TODO @jhowardmsft LCOW. For now, assume it is the OS of the host

+		return cache.NewLocal(daemon.stores[runtime.GOOS].imageStore)

 	}

-	cache := cache.New(daemon.imageStore)

+	// TODO @jhowardmsft LCOW. For now, assume it is the OS of the host

+	cache := cache.New(daemon.stores[runtime.GOOS].imageStore)

 	for _, ref := range sourceRefs {

 		img, err := daemon.GetImage(ref)

@@ -160,26 +160,21 @@ func (daemon *Daemon) Commit(name string, c *backend.ContainerCommitConfig) (str

 	}()

 	var parent *image.Image

-	os := runtime.GOOS

 	if container.ImageID == "" {

 		parent = new(image.Image)

 		parent.RootFS = image.NewRootFS()

 	} else {

-		parent, err = daemon.imageStore.Get(container.ImageID)

+		parent, err = daemon.stores[container.Platform].imageStore.Get(container.ImageID)

 		if err != nil {

 			return "", err

 		}

-		// To support LCOW, Windows needs to pass the platform in when registering the layer in the store

-		if runtime.GOOS == "windows" {

-			os = parent.OS

-		}

 	}

-	l, err := daemon.layerStore.Register(rwTar, parent.RootFS.ChainID(), layer.Platform(os))

+	l, err := daemon.stores[container.Platform].layerStore.Register(rwTar, rootFS.ChainID(), layer.Platform(container.Platform))

 	if err != nil {

 		return "", err

 	}

-	defer layer.ReleaseAndLog(daemon.layerStore, l)

+	defer layer.ReleaseAndLog(daemon.stores[container.Platform].layerStore, l)

 	containerConfig := c.ContainerConfig

 	if containerConfig == nil {

@@ -198,13 +193,13 @@ func (daemon *Daemon) Commit(name string, c *backend.ContainerCommitConfig) (str

 		return "", err

 	}

-	id, err := daemon.imageStore.Create(config)

+	id, err := daemon.stores[container.Platform].imageStore.Create(config)

 	if err != nil {

 		return "", err

 	}

 	if container.ImageID != "" {

-		if err := daemon.imageStore.SetParent(id, container.ImageID); err != nil {

+		if err := daemon.stores[container.Platform].imageStore.SetParent(id, container.ImageID); err != nil {

 			return "", err

 		}

 	}

@@ -223,7 +218,7 @@ func (daemon *Daemon) Commit(name string, c *backend.ContainerCommitConfig) (str

 				return "", err

 			}

 		}

-		if err := daemon.TagImageWithReference(id, newTag); err != nil {

+		if err := daemon.TagImageWithReference(id, container.Platform, newTag); err != nil {

 			return "", err

 		}

 		imageRef = reference.FamiliarString(newTag)

@@ -4,6 +4,7 @@ import (

 	"fmt"

 	"os"

 	"path/filepath"

+	"runtime"

 	"time"

 	"github.com/docker/docker/api/errors"

@@ -144,8 +145,10 @@ func (daemon *Daemon) newContainer(name string, config *containertypes.Config, h

 	base.ImageID = imgID

 	base.NetworkSettings = &network.Settings{IsAnonymousEndpoint: noExplicitName}

 	base.Name = name

-	base.Driver = daemon.GraphDriverName()

-

+	// TODO @jhowardmsft LCOW - Get it from the platform of the container. For now, assume it is the OS of the host

+	base.Driver = daemon.GraphDriverName(runtime.GOOS)

+	// TODO @jhowardmsft LCOW - Similarly on this field. To solve this it will need a CLI/REST change in a subsequent PR during LCOW development

+	base.Platform = runtime.GOOS

 	return base, err

 }

@@ -215,7 +215,7 @@ func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig)

 func (daemon *Daemon) setRWLayer(container *container.Container) error {

 	var layerID layer.ChainID

 	if container.ImageID != "" {

-		img, err := daemon.imageStore.Get(container.ImageID)

+		img, err := daemon.stores[container.Platform].imageStore.Get(container.ImageID)

 		if err != nil {

 			return err

 		}

@@ -228,7 +228,7 @@ func (daemon *Daemon) setRWLayer(container *container.Container) error {

 		StorageOpt: container.HostConfig.StorageOpt,

 	}

-	rwLayer, err := daemon.layerStore.CreateRWLayer(container.ID, layerID, rwLayerOpts)

+	rwLayer, err := daemon.stores[container.Platform].layerStore.CreateRWLayer(container.ID, layerID, rwLayerOpts)

 	if err != nil {

 		return err

 	}

@@ -69,43 +69,49 @@ var (

 	errSystemNotSupported = errors.New("The Docker daemon is not supported on this platform.")

 )

+type daemonStore struct {

+	graphDriver               string

+	imageRoot                 string

+	imageStore                image.Store

+	layerStore                layer.Store

+	distributionMetadataStore dmetadata.Store

+	referenceStore            refstore.Store

+}

+

 // Daemon holds information about the Docker daemon.

 type Daemon struct {

-	ID                        string

-	repository                string

-	containers                container.Store

-	execCommands              *exec.Store

-	referenceStore            refstore.Store

-	downloadManager           *xfer.LayerDownloadManager

-	uploadManager             *xfer.LayerUploadManager

-	distributionMetadataStore dmetadata.Store

-	trustKey                  libtrust.PrivateKey

-	idIndex                   *truncindex.TruncIndex

-	configStore               *config.Config

-	statsCollector            *stats.Collector

-	defaultLogConfig          containertypes.LogConfig

-	RegistryService           registry.Service

-	EventsService             *events.Events

-	netController             libnetwork.NetworkController

-	volumes                   *store.VolumeStore

-	discoveryWatcher          discovery.Reloader

-	root                      string

-	seccompEnabled            bool

-	apparmorEnabled           bool

-	shutdown                  bool

-	idMappings                *idtools.IDMappings

-	layerStore                layer.Store

-	imageStore                image.Store

-	PluginStore               *plugin.Store // todo: remove

-	pluginManager             *plugin.Manager

-	nameIndex                 *registrar.Registrar

-	linkIndex                 *linkIndex

-	containerd                libcontainerd.Client

-	containerdRemote          libcontainerd.Remote

-	defaultIsolation          containertypes.Isolation // Default isolation mode on Windows

-	clusterProvider           cluster.Provider

-	cluster                   Cluster

-	metricsPluginListener     net.Listener

+	ID                    string

+	repository            string

+	containers            container.Store

+	execCommands          *exec.Store

+	downloadManager       *xfer.LayerDownloadManager

+	uploadManager         *xfer.LayerUploadManager

+	trustKey              libtrust.PrivateKey

+	idIndex               *truncindex.TruncIndex

+	configStore           *config.Config

+	statsCollector        *stats.Collector

+	defaultLogConfig      containertypes.LogConfig

+	RegistryService       registry.Service

+	EventsService         *events.Events

+	netController         libnetwork.NetworkController

+	volumes               *store.VolumeStore

+	discoveryWatcher      discovery.Reloader

+	root                  string

+	seccompEnabled        bool

+	apparmorEnabled       bool

+	shutdown              bool

+	idMappings            *idtools.IDMappings

+	stores                map[string]daemonStore // By container target platform

+	PluginStore           *plugin.Store          // todo: remove

+	pluginManager         *plugin.Manager

+	nameIndex             *registrar.Registrar

+	linkIndex             *linkIndex

+	containerd            libcontainerd.Client

+	containerdRemote      libcontainerd.Remote

+	defaultIsolation      containertypes.Isolation // Default isolation mode on Windows

+	clusterProvider       cluster.Provider

+	cluster               Cluster

+	metricsPluginListener net.Listener

 	machineMemory uint64

@@ -137,10 +143,7 @@ func (daemon *Daemon) HasExperimental() bool {

 }

 func (daemon *Daemon) restore() error {

-	var (

-		currentDriver = daemon.GraphDriverName()

-		containers    = make(map[string]*container.Container)

-	)

+	containers := make(map[string]*container.Container)

 	logrus.Info("Loading containers: start.")

@@ -158,8 +161,9 @@ func (daemon *Daemon) restore() error {

 		}

 		// Ignore the container if it does not support the current driver being used by the graph

-		if (container.Driver == "" && currentDriver == "aufs") || container.Driver == currentDriver {

-			rwlayer, err := daemon.layerStore.GetRWLayer(container.ID)

+		currentDriverForContainerPlatform := daemon.stores[container.Platform].graphDriver

+		if (container.Driver == "" && currentDriverForContainerPlatform == "aufs") || container.Driver == currentDriverForContainerPlatform {

+			rwlayer, err := daemon.stores[container.Platform].layerStore.GetRWLayer(container.ID)

 			if err != nil {

 				logrus.Errorf("Failed to load container mount %v: %v", id, err)

 				continue

@@ -595,9 +599,24 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 		}

 	}

-	driverName := os.Getenv("DOCKER_DRIVER")

-	if driverName == "" {

-		driverName = config.GraphDriver

+	// On Windows we don't support the environment variable, or a user supplied graphdriver

+	// as Windows has no choice in terms of which graphdrivers to use. It's a case of

+	// running Windows containers on Windows - windowsfilter, running Linux containers on Windows,

+	// lcow. Unix platforms however run a single graphdriver for all containers, and it can

+	// be set through an environment variable, a daemon start parameter, or chosen through

+	// initialization of the layerstore through driver priority order for example.

+	d.stores = make(map[string]daemonStore)

+	if runtime.GOOS == "windows" {

+		d.stores["windows"] = daemonStore{graphDriver: "windowsfilter"}

+		if system.LCOWSupported() {

+			d.stores["linux"] = daemonStore{graphDriver: "lcow"}

+		}

+	} else {

+		driverName := os.Getenv("DOCKER_DRIVER")

+		if driverName == "" {

+			driverName = config.GraphDriver

+		}

+		d.stores[runtime.GOOS] = daemonStore{graphDriver: driverName} // May still be empty. Layerstore init determines instead.

 	}

 	d.RegistryService = registryService

@@ -625,42 +644,55 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 		return nil, errors.Wrap(err, "couldn't create plugin manager")

 	}

-	d.layerStore, err = layer.NewStoreFromOptions(layer.StoreOptions{

-		StorePath:                 config.Root,

-		MetadataStorePathTemplate: filepath.Join(config.Root, "image", "%s", "layerdb"),

-		GraphDriver:               driverName,

-		GraphDriverOptions:        config.GraphOptions,

-		IDMappings:                idMappings,

-		PluginGetter:              d.PluginStore,

-		ExperimentalEnabled:       config.Experimental,

-	})

-	if err != nil {

-		return nil, err

+	var graphDrivers []string

+	for platform, ds := range d.stores {

+		ls, err := layer.NewStoreFromOptions(layer.StoreOptions{

+			StorePath:                 config.Root,

+			MetadataStorePathTemplate: filepath.Join(config.Root, "image", "%s", "layerdb"),

+			GraphDriver:               ds.graphDriver,

+			GraphDriverOptions:        config.GraphOptions,

+			IDMappings:                idMappings,

+			PluginGetter:              d.PluginStore,

+			ExperimentalEnabled:       config.Experimental,

+		})

+		if err != nil {

+			return nil, err

+		}

+		ds.graphDriver = ls.DriverName() // As layerstore may set the driver

+		ds.layerStore = ls

+		d.stores[platform] = ds

+		graphDrivers = append(graphDrivers, ls.DriverName())

 	}

-	graphDriver := d.layerStore.DriverName()

-	imageRoot := filepath.Join(config.Root, "image", graphDriver)

-

 	// Configure and validate the kernels security support

-	if err := configureKernelSecuritySupport(config, graphDriver); err != nil {

+	if err := configureKernelSecuritySupport(config, graphDrivers); err != nil {

 		return nil, err

 	}

 	logrus.Debugf("Max Concurrent Downloads: %d", *config.MaxConcurrentDownloads)

-	d.downloadManager = xfer.NewLayerDownloadManager(d.layerStore, *config.MaxConcurrentDownloads)

+	lsMap := make(map[string]layer.Store)

+	for platform, ds := range d.stores {

+		lsMap[platform] = ds.layerStore

+	}

+	d.downloadManager = xfer.NewLayerDownloadManager(lsMap, *config.MaxConcurrentDownloads)

 	logrus.Debugf("Max Concurrent Uploads: %d", *config.MaxConcurrentUploads)

 	d.uploadManager = xfer.NewLayerUploadManager(*config.MaxConcurrentUploads)

-	ifs, err := image.NewFSStoreBackend(filepath.Join(imageRoot, "imagedb"))

-	if err != nil {

-		return nil, err

-	}

+	for platform, ds := range d.stores {

+		imageRoot := filepath.Join(config.Root, "image", ds.graphDriver)

+		ifs, err := image.NewFSStoreBackend(filepath.Join(imageRoot, "imagedb"))

+		if err != nil {

+			return nil, err

+		}

-	// TODO LCOW @jhowardmsft. For now assume it's the runtime OS. This will be modified

-	// as the stores are split in a follow-up commit.

-	d.imageStore, err = image.NewImageStore(ifs, runtime.GOOS, d.layerStore)

-	if err != nil {

-		return nil, err

+		var is image.Store

+		is, err = image.NewImageStore(ifs, platform, ds.layerStore)

+		if err != nil {

+			return nil, err

+		}

+		ds.imageRoot = imageRoot

+		ds.imageStore = is

+		d.stores[platform] = ds

 	}

 	// Configure the volumes driver

@@ -680,23 +712,31 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 		return nil, err

 	}

-	distributionMetadataStore, err := dmetadata.NewFSMetadataStore(filepath.Join(imageRoot, "distribution"))

-	if err != nil {

-		return nil, err

-	}

-

 	eventsService := events.New()

-	referenceStore, err := refstore.NewReferenceStore(filepath.Join(imageRoot, "repositories.json"))

-	if err != nil {

-		return nil, fmt.Errorf("Couldn't create Tag store repositories: %s", err)

-	}

+	for platform, ds := range d.stores {

+		dms, err := dmetadata.NewFSMetadataStore(filepath.Join(ds.imageRoot, "distribution"), platform)

+		if err != nil {

+			return nil, err

+		}

-	migrationStart := time.Now()

-	if err := v1.Migrate(config.Root, graphDriver, d.layerStore, d.imageStore, referenceStore, distributionMetadataStore); err != nil {

-		logrus.Errorf("Graph migration failed: %q. Your old graph data was found to be too inconsistent for upgrading to content-addressable storage. Some of the old data was probably not upgraded. We recommend starting over with a clean storage directory if possible.", err)

+		rs, err := refstore.NewReferenceStore(filepath.Join(ds.imageRoot, "repositories.json"), platform)

+		if err != nil {

+			return nil, fmt.Errorf("Couldn't create Tag store repositories: %s", err)

+		}

+		ds.distributionMetadataStore = dms

+		ds.referenceStore = rs

+		d.stores[platform] = ds

+

+		// No content-addressability migration on Windows as it never supported pre-CA

+		if runtime.GOOS != "windows" {

+			migrationStart := time.Now()

+			if err := v1.Migrate(config.Root, ds.graphDriver, ds.layerStore, ds.imageStore, rs, dms); err != nil {

+				logrus.Errorf("Graph migration failed: %q. Your old graph data was found to be too inconsistent for upgrading to content-addressable storage. Some of the old data was probably not upgraded. We recommend starting over with a clean storage directory if possible.", err)

+			}

+			logrus.Infof("Graph migration to content-addressability took %.2f seconds", time.Since(migrationStart).Seconds())

+		}

 	}

-	logrus.Infof("Graph migration to content-addressability took %.2f seconds", time.Since(migrationStart).Seconds())

 	// Discovery is only enabled when the daemon is launched with an address to advertise.  When

 	// initialized, the daemon is registered and we can store the discovery backend as it's read-only

@@ -715,8 +755,6 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 	d.repository = daemonRepo

 	d.containers = container.NewMemoryStore()

 	d.execCommands = exec.NewStore()

-	d.referenceStore = referenceStore

-	d.distributionMetadataStore = distributionMetadataStore

 	d.trustKey = trustKey

 	d.idIndex = truncindex.NewTruncIndex([]string{})

 	d.statsCollector = d.newStatsCollector(1 * time.Second)

@@ -763,6 +801,22 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 	engineCpus.Set(float64(info.NCPU))

 	engineMemory.Set(float64(info.MemTotal))

+	gd := ""

+	for platform, ds := range d.stores {

+		if len(gd) > 0 {

+			gd += ", "

+		}

+		gd += ds.graphDriver

+		if len(d.stores) > 1 {

+			gd = fmt.Sprintf("%s (%s)", gd, platform)

+		}

+	}

+	logrus.WithFields(logrus.Fields{

+		"version":        dockerversion.Version,

+		"commit":         dockerversion.GitCommit,

+		"graphdriver(s)": gd,

+	}).Info("Docker daemon")

+

 	return d, nil

 }

@@ -869,7 +923,7 @@ func (daemon *Daemon) Shutdown() error {

 				logrus.Errorf("Stop container error: %v", err)

 				return

 			}

-			if mountid, err := daemon.layerStore.GetMountID(c.ID); err == nil {

+			if mountid, err := daemon.stores[c.Platform].layerStore.GetMountID(c.ID); err == nil {

 				daemon.cleanupMountsByID(mountid)

 			}

 			logrus.Debugf("container stopped %s", c.ID)

@@ -882,9 +936,11 @@ func (daemon *Daemon) Shutdown() error {

 		}

 	}

-	if daemon.layerStore != nil {

-		if err := daemon.layerStore.Cleanup(); err != nil {

-			logrus.Errorf("Error during layer Store.Cleanup(): %v", err)

+	for platform, ds := range daemon.stores {

+		if ds.layerStore != nil {

+			if err := ds.layerStore.Cleanup(); err != nil {

+				logrus.Errorf("Error during layer Store.Cleanup(): %v %s", err, platform)

+			}

 		}

 	}

@@ -927,7 +983,7 @@ func (daemon *Daemon) Mount(container *container.Container) error {

 		if container.BaseFS != "" && runtime.GOOS != "windows" {

 			daemon.Unmount(container)

 			return fmt.Errorf("Error: driver %s is returning inconsistent paths for container %s ('%s' then '%s')",

-				daemon.GraphDriverName(), container.ID, container.BaseFS, dir)

+				daemon.GraphDriverName(container.Platform), container.ID, container.BaseFS, dir)

 		}

 	}

 	container.BaseFS = dir // TODO: combine these fields

@@ -969,8 +1025,8 @@ func (daemon *Daemon) Subnets() ([]net.IPNet, []net.IPNet) {

 }

 // GraphDriverName returns the name of the graph driver used by the layer.Store

-func (daemon *Daemon) GraphDriverName() string {

-	return daemon.layerStore.DriverName()

+func (daemon *Daemon) GraphDriverName(platform string) string {

+	return daemon.stores[platform].layerStore.DriverName()

 }

 // prepareTempDir prepares and returns the default directory to use

@@ -353,7 +353,7 @@ func configureMaxThreads(config *Config) error {

 }

 // configureKernelSecuritySupport configures and validate security support for the kernel

-func configureKernelSecuritySupport(config *Config, driverName string) error {

+func configureKernelSecuritySupport(config *config.Config, driverNames []string) error {

 	return nil

 }

@@ -702,14 +702,22 @@ func overlaySupportsSelinux() (bool, error) {

 }

 // configureKernelSecuritySupport configures and validates security support for the kernel

-func configureKernelSecuritySupport(config *config.Config, driverName string) error {

+func configureKernelSecuritySupport(config *config.Config, driverNames []string) error {

 	if config.EnableSelinuxSupport {

 		if !selinuxEnabled() {

 			logrus.Warn("Docker could not enable SELinux on the host system")

 			return nil

 		}

-		if driverName == "overlay" || driverName == "overlay2" {

+		overlayFound := false

+		for _, d := range driverNames {

+			if d == "overlay" || d == "overlay2" {

+				overlayFound = true

+				break

+			}

+		}

+

+		if overlayFound {

 			// If driver is overlay or overlay2, make sure kernel

 			// supports selinux with overlay.

 			supported, err := overlaySupportsSelinux()

@@ -718,7 +726,7 @@ func configureKernelSecuritySupport(config *config.Config, driverName string) er

 			}

 			if !supported {

-				logrus.Warnf("SELinux is not supported with the %s graph driver on this kernel", driverName)

+				logrus.Warnf("SELinux is not supported with the %v graph driver on this kernel", driverNames)

 			}

 		}

 	} else {

@@ -260,7 +260,7 @@ func checkSystem() error {

 }

 // configureKernelSecuritySupport configures and validate security support for the kernel

-func configureKernelSecuritySupport(config *config.Config, driverName string) error {

+func configureKernelSecuritySupport(config *config.Config, driverNames []string) error {

 	return nil

 }

@@ -115,10 +115,10 @@ func (daemon *Daemon) cleanupContainer(container *container.Container, forceRemo

 	// When container creation fails and `RWLayer` has not been created yet, we

 	// do not call `ReleaseRWLayer`

 	if container.RWLayer != nil {

-		metadata, err := daemon.layerStore.ReleaseRWLayer(container.RWLayer)

+		metadata, err := daemon.stores[container.Platform].layerStore.ReleaseRWLayer(container.RWLayer)

 		layer.LogReleaseMetadata(metadata)

 		if err != nil && err != layer.ErrMountDoesNotExist {

-			return errors.Wrapf(err, "driver %q failed to remove root filesystem for %s", daemon.GraphDriverName(), container.ID)

+			return errors.Wrapf(err, "driver %q failed to remove root filesystem for %s", daemon.GraphDriverName(container.Platform), container.ID)

 		}

 	}

@@ -15,12 +15,12 @@ import (

 	"github.com/opencontainers/go-digest"

 )

-func (daemon *Daemon) getLayerRefs() map[layer.ChainID]int {

-	tmpImages := daemon.imageStore.Map()

+func (daemon *Daemon) getLayerRefs(platform string) map[layer.ChainID]int {

+	tmpImages := daemon.stores[platform].imageStore.Map()

 	layerRefs := map[layer.ChainID]int{}

 	for id, img := range tmpImages {

 		dgst := digest.Digest(id)

-		if len(daemon.referenceStore.References(dgst)) == 0 && len(daemon.imageStore.Children(id)) != 0 {

+		if len(daemon.stores[platform].referenceStore.References(dgst)) == 0 && len(daemon.stores[platform].imageStore.Children(id)) != 0 {

 			continue

 		}

@@ -53,6 +53,7 @@ func (daemon *Daemon) SystemDiskUsage(ctx context.Context) (*types.DiskUsage, er

 	}

 	// Get all top images with extra attributes

+	// TODO @jhowardmsft LCOW. This may need revisiting

 	allImages, err := daemon.Images(filters.NewArgs(), false, true)

 	if err != nil {

 		return nil, fmt.Errorf("failed to retrieve image list: %v", err)

@@ -94,23 +95,26 @@ func (daemon *Daemon) SystemDiskUsage(ctx context.Context) (*types.DiskUsage, er

 	}

 	// Get total layers size on disk

-	layerRefs := daemon.getLayerRefs()

-	allLayers := daemon.layerStore.Map()

 	var allLayersSize int64

-	for _, l := range allLayers {

-		select {

-		case <-ctx.Done():

-			return nil, ctx.Err()

-		default:

-			size, err := l.DiffSize()

-			if err == nil {

-				if _, ok := layerRefs[l.ChainID()]; ok {

-					allLayersSize += size

+	for platform := range daemon.stores {

+		layerRefs := daemon.getLayerRefs(platform)

+		allLayers := daemon.stores[platform].layerStore.Map()

+		var allLayersSize int64

+		for _, l := range allLayers {

+			select {

+			case <-ctx.Done():

+				return nil, ctx.Err()

+			default:

+				size, err := l.DiffSize()

+				if err == nil {

+					if _, ok := layerRefs[l.ChainID()]; ok {

+						allLayersSize += size

+					} else {

+						logrus.Warnf("found leaked image layer %v platform %s", l.ChainID(), platform)

+					}

 				} else {

-					logrus.Warnf("found leaked image layer %v", l.ChainID())

+					logrus.Warnf("failed to get diff size for layer %v %s", l.ChainID(), platform)

 				}

-			} else {

-				logrus.Warnf("failed to get diff size for layer %v", l.ChainID())

 			}

 		}

 	}

@@ -3,6 +3,8 @@

 package daemon

 import (

+	"runtime"

+

 	"github.com/Sirupsen/logrus"

 )

@@ -13,17 +15,17 @@ func (daemon *Daemon) getSize(containerID string) (int64, int64) {

 		err                error

 	)

-	rwlayer, err := daemon.layerStore.GetRWLayer(containerID)

+	rwlayer, err := daemon.stores[runtime.GOOS].layerStore.GetRWLayer(containerID)

 	if err != nil {

 		logrus.Errorf("Failed to compute size of container rootfs %v: %v", containerID, err)

 		return sizeRw, sizeRootfs

 	}

-	defer daemon.layerStore.ReleaseRWLayer(rwlayer)

+	defer daemon.stores[runtime.GOOS].layerStore.ReleaseRWLayer(rwlayer)

 	sizeRw, err = rwlayer.Size()

 	if err != nil {

 		logrus.Errorf("Driver %s couldn't return diff size of container %s: %s",

-			daemon.GraphDriverName(), containerID, err)

+			daemon.GraphDriverName(runtime.GOOS), containerID, err)

 		// FIXME: GetSize should return an error. Not changing it now in case

 		// there is a side-effect.

 		sizeRw = -1

@@ -1,6 +1,7 @@

 package register

 import (

-	// register the windows graph driver

+	// register the windows graph drivers

+	_ "github.com/docker/docker/daemon/graphdriver/lcow"

 	_ "github.com/docker/docker/daemon/graphdriver/windows"

 )

@@ -94,6 +94,10 @@ func InitFilter(home string, options []string, uidMaps, gidMaps []idtools.IDMap)

 		return nil, fmt.Errorf("%s is on an ReFS volume - ReFS volumes are not supported", home)

 	}

+	if err := idtools.MkdirAllAs(home, 0700, 0, 0); err != nil {

+		return nil, fmt.Errorf("windowsfilter failed to create '%s': %v", home, err)

+	}

+

 	d := &Driver{

 		info: hcsshim.DriverInfo{

 			HomeDir: home,

@@ -21,37 +21,43 @@ func (e ErrImageDoesNotExist) Error() string {

 	return fmt.Sprintf("No such image: %s", reference.FamiliarString(ref))

 }

-// GetImageID returns an image ID corresponding to the image referred to by

+// GetImageIDAndPlatform returns an image ID and platform corresponding to the image referred to by

 // refOrID.

-func (daemon *Daemon) GetImageID(refOrID string) (image.ID, error) {

+func (daemon *Daemon) GetImageIDAndPlatform(refOrID string) (image.ID, string, error) {

 	ref, err := reference.ParseAnyReference(refOrID)

 	if err != nil {

-		return "", err

+		return "", "", err

 	}

 	namedRef, ok := ref.(reference.Named)

 	if !ok {

 		digested, ok := ref.(reference.Digested)

 		if !ok {

-			return "", ErrImageDoesNotExist{ref}

+			return "", "", ErrImageDoesNotExist{ref}

 		}

 		id := image.IDFromDigest(digested.Digest())

-		if _, err := daemon.imageStore.Get(id); err != nil {

-			return "", ErrImageDoesNotExist{ref}

+		for platform := range daemon.stores {

+			if _, err = daemon.stores[platform].imageStore.Get(id); err == nil {

+				return id, platform, nil

+			}

 		}

-		return id, nil

+		return "", "", ErrImageDoesNotExist{ref}

 	}

-	if id, err := daemon.referenceStore.Get(namedRef); err == nil {

-		return image.IDFromDigest(id), nil

+	for platform := range daemon.stores {

+		if id, err := daemon.stores[platform].referenceStore.Get(namedRef); err == nil {

+			return image.IDFromDigest(id), platform, nil

+		}

 	}

 	// deprecated: repo:shortid https://github.com/docker/docker/pull/799

 	if tagged, ok := namedRef.(reference.Tagged); ok {

 		if tag := tagged.Tag(); stringid.IsShortID(stringid.TruncateID(tag)) {

-			if id, err := daemon.imageStore.Search(tag); err == nil {

-				for _, storeRef := range daemon.referenceStore.References(id.Digest()) {

-					if storeRef.Name() == namedRef.Name() {

-						return id, nil

+			for platform := range daemon.stores {

+				if id, err := daemon.stores[platform].imageStore.Search(tag); err == nil {

+					for _, storeRef := range daemon.stores[platform].referenceStore.References(id.Digest()) {

+						if storeRef.Name() == namedRef.Name() {

+							return id, platform, nil

+						}

 					}

 				}

 			}

@@ -59,18 +65,20 @@ func (daemon *Daemon) GetImageID(refOrID string) (image.ID, error) {

 	}

 	// Search based on ID

-	if id, err := daemon.imageStore.Search(refOrID); err == nil {

-		return id, nil

+	for platform := range daemon.stores {

+		if id, err := daemon.stores[platform].imageStore.Search(refOrID); err == nil {

+			return id, platform, nil

+		}

 	}

-	return "", ErrImageDoesNotExist{ref}

+	return "", "", ErrImageDoesNotExist{ref}

 }

 // GetImage returns an image corresponding to the image referred to by refOrID.

 func (daemon *Daemon) GetImage(refOrID string) (*image.Image, error) {

-	imgID, err := daemon.GetImageID(refOrID)

+	imgID, platform, err := daemon.GetImageIDAndPlatform(refOrID)

 	if err != nil {

 		return nil, err

 	}

-	return daemon.imageStore.Get(imgID)

+	return daemon.stores[platform].imageStore.Get(imgID)

 }

@@ -65,12 +65,12 @@ func (daemon *Daemon) ImageDelete(imageRef string, force, prune bool) ([]types.I

 	start := time.Now()

 	records := []types.ImageDeleteResponseItem{}

-	imgID, err := daemon.GetImageID(imageRef)

+	imgID, platform, err := daemon.GetImageIDAndPlatform(imageRef)

 	if err != nil {

 		return nil, daemon.imageNotExistToErrcode(err)

 	}

-	repoRefs := daemon.referenceStore.References(imgID.Digest())

+	repoRefs := daemon.stores[platform].referenceStore.References(imgID.Digest())

 	var removedRepositoryRef bool

 	if !isImageIDPrefix(imgID.String(), imageRef) {

@@ -94,7 +94,7 @@ func (daemon *Daemon) ImageDelete(imageRef string, force, prune bool) ([]types.I

 			return nil, err

 		}

-		parsedRef, err = daemon.removeImageRef(parsedRef)

+		parsedRef, err = daemon.removeImageRef(platform, parsedRef)

 		if err != nil {

 			return nil, err

 		}

@@ -104,7 +104,7 @@ func (daemon *Daemon) ImageDelete(imageRef string, force, prune bool) ([]types.I

 		daemon.LogImageEvent(imgID.String(), imgID.String(), "untag")

 		records = append(records, untaggedRecord)

-		repoRefs = daemon.referenceStore.References(imgID.Digest())

+		repoRefs = daemon.stores[platform].referenceStore.References(imgID.Digest())

 		// If a tag reference was removed and the only remaining

 		// references to the same repository are digest references,

@@ -122,7 +122,7 @@ func (daemon *Daemon) ImageDelete(imageRef string, force, prune bool) ([]types.I

 				remainingRefs := []reference.Named{}

 				for _, repoRef := range repoRefs {

 					if _, repoRefIsCanonical := repoRef.(reference.Canonical); repoRefIsCanonical && parsedRef.Name() == repoRef.Name() {

-						if _, err := daemon.removeImageRef(repoRef); err != nil {

+						if _, err := daemon.removeImageRef(platform, repoRef); err != nil {

 							return records, err

 						}

@@ -152,12 +152,12 @@ func (daemon *Daemon) ImageDelete(imageRef string, force, prune bool) ([]types.I

 			if !force {

 				c |= conflictSoft &^ conflictActiveReference

 			}

-			if conflict := daemon.checkImageDeleteConflict(imgID, c); conflict != nil {

+			if conflict := daemon.checkImageDeleteConflict(imgID, platform, c); conflict != nil {

 				return nil, conflict

 			}

 			for _, repoRef := range repoRefs {

-				parsedRef, err := daemon.removeImageRef(repoRef)