@@ -1,5 +1,5 @@

 github.com/Azure/go-ansiterm                        d6e3b3328b783f23731bc4d058875b0371ff8109

-github.com/Microsoft/hcsshim                        b3f49c06ffaeef24d09c6c08ec8ec8425a0303e2

+github.com/Microsoft/hcsshim                        5bc557dd210ff2caf615e6e22d398123de77fc11 # v0.8.9

 github.com/Microsoft/go-winio                       6c72808b55902eae4c5943626030429ff20f3b63 # v0.4.14

 github.com/docker/libtrust                          9cbd2a1374f46905c68a4eb3694a130610adc62a

 github.com/golang/gddo                              9b12a26f3fbd7397dee4e20939ddca719d840d2a

@@ -2,7 +2,7 @@

 [![Build status](https://ci.appveyor.com/api/projects/status/nbcw28mnkqml0loa/branch/master?svg=true)](https://ci.appveyor.com/project/WindowsVirtualization/hcsshim/branch/master)

-This package contains the Golang interface for using the Windows [Host Compute Service](https://blogs.technet.microsoft.com/virtualization/2017/01/27/introducing-the-host-compute-service-hcs/) (HCS) to launch and manage [Windows Containers](https://docs.microsoft.com/en-us/virtualization/windowscontainers/about/). It also contains other helpers and functions for managing Windows Containers such as the Golang interface for the Host Network Service (HNS).

+This package contains the Golang interface for using the Windows [Host Compute Service](https://techcommunity.microsoft.com/t5/containers/introducing-the-host-compute-service-hcs/ba-p/382332) (HCS) to launch and manage [Windows Containers](https://docs.microsoft.com/en-us/virtualization/windowscontainers/about/). It also contains other helpers and functions for managing Windows Containers such as the Golang interface for the Host Network Service (HNS).

 It is primarily used in the [Moby Project](https://github.com/moby/moby), but it can be freely used by other projects as well.

@@ -16,6 +16,11 @@ When you submit a pull request, a CLA-bot will automatically determine whether y

 a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions

 provided by the bot. You will only need to do this once across all repos using our CLA.

+We also ask that contributors [sign their commits](https://git-scm.com/docs/git-commit) using `git commit -s` or `git commit --signoff` to certify they either authored the work themselves or otherwise have permission to use it in this project. 

+

+

+## Code of Conduct

+

 This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).

 For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or

 contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.

@@ -101,7 +101,21 @@ type Options struct {

 	SandboxIsolation Options_SandboxIsolation `protobuf:"varint,6,opt,name=sandbox_isolation,json=sandboxIsolation,proto3,enum=containerd.runhcs.v1.Options_SandboxIsolation" json:"sandbox_isolation,omitempty"`

 	// boot_files_root_path is the path to the directory containing the LCOW

 	// kernel and root FS files.

-	BootFilesRootPath    string   `protobuf:"bytes,7,opt,name=boot_files_root_path,json=bootFilesRootPath,proto3" json:"boot_files_root_path,omitempty"`

+	BootFilesRootPath string `protobuf:"bytes,7,opt,name=boot_files_root_path,json=bootFilesRootPath,proto3" json:"boot_files_root_path,omitempty"`

+	// vm_processor_count is the default number of processors to create for the

+	// hypervisor isolated utility vm.

+	//

+	// The platform default if omitted is 2, unless the host only has a single

+	// core in which case it is 1.

+	VmProcessorCount int32 `protobuf:"varint,8,opt,name=vm_processor_count,json=vmProcessorCount,proto3" json:"vm_processor_count,omitempty"`

+	// vm_memory_size_in_mb is the default amount of memory to assign to the

+	// hypervisor isolated utility vm.

+	//

+	// The platform default is 1024MB if omitted.

+	VmMemorySizeInMb int32 `protobuf:"varint,9,opt,name=vm_memory_size_in_mb,json=vmMemorySizeInMb,proto3" json:"vm_memory_size_in_mb,omitempty"`

+	// GPUVHDPath is the path to the gpu vhd to add to the uvm

+	// when a container requests a gpu

+	GPUVHDPath           string   `protobuf:"bytes,10,opt,name=GPUVHDPath,json=gPUVHDPath,proto3" json:"GPUVHDPath,omitempty"`

 	XXX_NoUnkeyedLiteral struct{} `json:"-"`

 	XXX_unrecognized     []byte   `json:"-"`

 	XXX_sizecache        int32    `json:"-"`

@@ -200,51 +214,56 @@ func init() {

 }

 var fileDescriptor_b643df6839c75082 = []byte{

-	// 704 bytes of a gzipped FileDescriptorProto

-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x54, 0x4d, 0x6f, 0xda, 0x48,

-	0x18, 0xc6, 0xe1, 0xd3, 0x6f, 0x96, 0xc4, 0x99, 0xe5, 0x80, 0xb2, 0xbb, 0x80, 0xc8, 0x21, 0x89,

-	0x76, 0x63, 0x43, 0xf6, 0xd8, 0x53, 0x09, 0xa0, 0xba, 0x6a, 0x83, 0x65, 0xa2, 0xa6, 0x1f, 0x07,

-	0xcb, 0xd8, 0x83, 0xb1, 0x82, 0x3d, 0xd6, 0xcc, 0x90, 0x86, 0x5b, 0x7f, 0x42, 0x7f, 0x55, 0x95,

-	0x63, 0x8f, 0x95, 0x2a, 0xa5, 0x0d, 0xbf, 0xa4, 0x9a, 0xb1, 0x49, 0xd4, 0x28, 0xea, 0xa5, 0x27,

-	0xc6, 0xcf, 0xf3, 0xbc, 0xcf, 0xfb, 0x29, 0x60, 0x14, 0x84, 0x7c, 0xb6, 0x98, 0xe8, 0x1e, 0x89,

-	0x8c, 0x97, 0xa1, 0x47, 0x09, 0x23, 0x53, 0x6e, 0xcc, 0x3c, 0xc6, 0x66, 0x61, 0x64, 0x78, 0x91,

-	0x6f, 0x78, 0x24, 0xe6, 0x6e, 0x18, 0x63, 0xea, 0x1f, 0x09, 0xec, 0x88, 0x2e, 0xe2, 0x99, 0xc7,

-	0x8e, 0x2e, 0xbb, 0x06, 0x49, 0x78, 0x48, 0x62, 0x66, 0xa4, 0x88, 0x9e, 0x50, 0xc2, 0x09, 0xaa,

-	0xdd, 0xeb, 0xf5, 0x8c, 0xb8, 0xec, 0xee, 0xd6, 0x02, 0x12, 0x10, 0x29, 0x30, 0xc4, 0x2b, 0xd5,

-	0xee, 0x36, 0x03, 0x42, 0x82, 0x39, 0x36, 0xe4, 0xd7, 0x64, 0x31, 0x35, 0x78, 0x18, 0x61, 0xc6,

-	0xdd, 0x28, 0x49, 0x05, 0xed, 0x4f, 0x79, 0x28, 0x8f, 0xd2, 0x2c, 0xa8, 0x06, 0x45, 0x1f, 0x4f,

-	0x16, 0x41, 0x5d, 0x69, 0x29, 0x07, 0x15, 0x3b, 0xfd, 0x40, 0x43, 0x00, 0xf9, 0x70, 0xf8, 0x32,

-	0xc1, 0xf5, 0x8d, 0x96, 0x72, 0xb0, 0x75, 0xbc, 0xaf, 0x3f, 0x56, 0x83, 0x9e, 0x19, 0xe9, 0x7d,

-	0xa1, 0x3f, 0x5b, 0x26, 0xd8, 0x56, 0xfd, 0xf5, 0x13, 0xed, 0x41, 0x95, 0xe2, 0x20, 0x64, 0x9c,

-	0x2e, 0x1d, 0x4a, 0x08, 0xaf, 0xe7, 0x5b, 0xca, 0x81, 0x6a, 0xff, 0xb1, 0x06, 0x6d, 0x42, 0xb8,

-	0x10, 0x31, 0x37, 0xf6, 0x27, 0xe4, 0xca, 0x09, 0x23, 0x37, 0xc0, 0xf5, 0x42, 0x2a, 0xca, 0x40,

-	0x53, 0x60, 0xe8, 0x10, 0xb4, 0xb5, 0x28, 0x99, 0xbb, 0x7c, 0x4a, 0x68, 0x54, 0x2f, 0x4a, 0xdd,

-	0x76, 0x86, 0x5b, 0x19, 0x8c, 0xde, 0xc1, 0xce, 0x9d, 0x1f, 0x23, 0x73, 0x57, 0xd4, 0x57, 0x2f,

-	0xc9, 0x1e, 0xf4, 0x5f, 0xf7, 0x30, 0xce, 0x32, 0xae, 0xa3, 0xec, 0x75, 0xce, 0x3b, 0x04, 0x19,

-	0x50, 0x9b, 0x10, 0xc2, 0x9d, 0x69, 0x38, 0xc7, 0x4c, 0xf6, 0xe4, 0x24, 0x2e, 0x9f, 0xd5, 0xcb,

-	0xb2, 0x96, 0x1d, 0xc1, 0x0d, 0x05, 0x25, 0x3a, 0xb3, 0x5c, 0x3e, 0x6b, 0x1f, 0x82, 0x7a, 0x37,

-	0x1a, 0xa4, 0x42, 0xf1, 0xd4, 0x32, 0xad, 0x81, 0x96, 0x43, 0x15, 0x28, 0x0c, 0xcd, 0x17, 0x03,

-	0x4d, 0x41, 0x65, 0xc8, 0x0f, 0xce, 0xce, 0xb5, 0x8d, 0xb6, 0x01, 0xda, 0xc3, 0x0a, 0xd0, 0x26,

-	0x94, 0x2d, 0x7b, 0x74, 0x32, 0x18, 0x8f, 0xb5, 0x1c, 0xda, 0x02, 0x78, 0xf6, 0xc6, 0x1a, 0xd8,

-	0xaf, 0xcc, 0xf1, 0xc8, 0xd6, 0x94, 0xf6, 0xd7, 0x3c, 0x6c, 0x59, 0x94, 0x78, 0x98, 0xb1, 0x3e,

-	0xe6, 0x6e, 0x38, 0x67, 0xe8, 0x1f, 0x00, 0x39, 0x44, 0x27, 0x76, 0x23, 0x2c, 0x97, 0xaa, 0xda,

-	0xaa, 0x44, 0x4e, 0xdd, 0x08, 0xa3, 0x13, 0x00, 0x8f, 0x62, 0x97, 0x63, 0xdf, 0x71, 0xb9, 0x5c,

-	0xec, 0xe6, 0xf1, 0xae, 0x9e, 0x1e, 0x8c, 0xbe, 0x3e, 0x18, 0xfd, 0x6c, 0x7d, 0x30, 0xbd, 0xca,

-	0xf5, 0x4d, 0x33, 0xf7, 0xf1, 0x5b, 0x53, 0xb1, 0xd5, 0x2c, 0xee, 0x29, 0x47, 0xff, 0x02, 0xba,

-	0xc0, 0x34, 0xc6, 0x73, 0x47, 0x5c, 0x96, 0xd3, 0xed, 0x74, 0x9c, 0x98, 0xc9, 0xd5, 0x16, 0xec,

-	0xed, 0x94, 0x11, 0x0e, 0xdd, 0x4e, 0xe7, 0x94, 0x21, 0x1d, 0xfe, 0x8c, 0x70, 0x44, 0xe8, 0xd2,

-	0xf1, 0x48, 0x14, 0x85, 0xdc, 0x99, 0x2c, 0x39, 0x66, 0x72, 0xc7, 0x05, 0x7b, 0x27, 0xa5, 0x4e,

-	0x24, 0xd3, 0x13, 0x04, 0x1a, 0x42, 0x2b, 0xd3, 0xbf, 0x27, 0xf4, 0x22, 0x8c, 0x03, 0x87, 0x61,

-	0xee, 0x24, 0x34, 0xbc, 0x74, 0x39, 0xce, 0x82, 0x8b, 0x32, 0xf8, 0xef, 0x54, 0x77, 0x9e, 0xca,

-	0xc6, 0x98, 0x5b, 0xa9, 0x28, 0xf5, 0xe9, 0x43, 0xf3, 0x11, 0x1f, 0x36, 0x73, 0x29, 0xf6, 0x33,

-	0x9b, 0x92, 0xb4, 0xf9, 0xeb, 0xa1, 0xcd, 0x58, 0x6a, 0x52, 0x97, 0xff, 0x00, 0x92, 0x74, 0xc0,

-	0x4e, 0xe8, 0xcb, 0x25, 0x57, 0x7b, 0xd5, 0xd5, 0x4d, 0x53, 0xcd, 0xc6, 0x6e, 0xf6, 0x6d, 0x35,

-	0x13, 0x98, 0x3e, 0xda, 0x07, 0x6d, 0xc1, 0x30, 0xfd, 0x69, 0x2c, 0x15, 0x99, 0xa4, 0x2a, 0xf0,

-	0xfb, 0xa1, 0xec, 0x41, 0x19, 0x5f, 0x61, 0x4f, 0x78, 0xaa, 0x62, 0x45, 0x3d, 0x58, 0xdd, 0x34,

-	0x4b, 0x83, 0x2b, 0xec, 0x99, 0x7d, 0xbb, 0x24, 0x28, 0xd3, 0xef, 0xf9, 0xd7, 0xb7, 0x8d, 0xdc,

-	0x97, 0xdb, 0x46, 0xee, 0xc3, 0xaa, 0xa1, 0x5c, 0xaf, 0x1a, 0xca, 0xe7, 0x55, 0x43, 0xf9, 0xbe,

-	0x6a, 0x28, 0x6f, 0x9f, 0xff, 0xfe, 0xdf, 0xcb, 0x93, 0xec, 0xf7, 0x75, 0x6e, 0x52, 0x92, 0x7b,

-	0xff, 0xff, 0x47, 0x00, 0x00, 0x00, 0xff, 0xff, 0xa3, 0x9a, 0x54, 0x17, 0xb5, 0x04, 0x00, 0x00,

+	// 777 bytes of a gzipped FileDescriptorProto

+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x54, 0xcd, 0x6f, 0xdb, 0x36,

+	0x1c, 0xb5, 0x9a, 0xf8, 0x43, 0xbf, 0x2e, 0xa9, 0xc2, 0xf9, 0x20, 0x64, 0x9b, 0x6d, 0xa4, 0x87,

+	0xa6, 0x58, 0x23, 0x25, 0xdd, 0x71, 0xa7, 0x39, 0x76, 0x56, 0x0d, 0x4b, 0x22, 0xc8, 0x59, 0xbb,

+	0x8f, 0x03, 0xa1, 0x0f, 0x46, 0x26, 0x6a, 0x8a, 0x02, 0x49, 0x7b, 0x71, 0x4f, 0xfb, 0x13, 0xf6,

+	0x47, 0xed, 0x90, 0xe3, 0x8e, 0x03, 0x06, 0x64, 0xab, 0xff, 0x92, 0x81, 0x94, 0x94, 0x62, 0x45,

+	0xb1, 0xcb, 0x4e, 0xa6, 0xde, 0x7b, 0x7c, 0xbf, 0x0f, 0x3e, 0x18, 0x2e, 0x73, 0xaa, 0xe6, 0xcb,

+	0xc4, 0x4b, 0x39, 0xf3, 0xcf, 0x69, 0x2a, 0xb8, 0xe4, 0xd7, 0xca, 0x9f, 0xa7, 0x52, 0xce, 0x29,

+	0xf3, 0x53, 0x96, 0xf9, 0x29, 0x2f, 0x54, 0x4c, 0x0b, 0x22, 0xb2, 0x23, 0x8d, 0x1d, 0x89, 0x65,

+	0x31, 0x4f, 0xe5, 0xd1, 0xea, 0xc4, 0xe7, 0xa5, 0xa2, 0xbc, 0x90, 0x7e, 0x85, 0x78, 0xa5, 0xe0,

+	0x8a, 0xa3, 0xfe, 0x3b, 0xbd, 0x57, 0x13, 0xab, 0x93, 0xfd, 0x7e, 0xce, 0x73, 0x6e, 0x04, 0xbe,

+	0x3e, 0x55, 0xda, 0xfd, 0x61, 0xce, 0x79, 0xbe, 0x20, 0xbe, 0xf9, 0x4a, 0x96, 0xd7, 0xbe, 0xa2,

+	0x8c, 0x48, 0x15, 0xb3, 0xb2, 0x12, 0x1c, 0xfc, 0xb6, 0x0d, 0xdd, 0xcb, 0xaa, 0x0a, 0xea, 0x43,

+	0x3b, 0x23, 0xc9, 0x32, 0x77, 0xad, 0x91, 0x75, 0xd8, 0x8b, 0xaa, 0x0f, 0x74, 0x06, 0x60, 0x0e,

+	0x58, 0xad, 0x4b, 0xe2, 0x3e, 0x18, 0x59, 0x87, 0xbb, 0xcf, 0x9f, 0x78, 0x1f, 0xea, 0xc1, 0xab,

+	0x8d, 0xbc, 0x89, 0xd6, 0x5f, 0xad, 0x4b, 0x12, 0xd9, 0x59, 0x73, 0x44, 0x8f, 0x61, 0x47, 0x90,

+	0x9c, 0x4a, 0x25, 0xd6, 0x58, 0x70, 0xae, 0xdc, 0xad, 0x91, 0x75, 0x68, 0x47, 0x1f, 0x35, 0x60,

+	0xc4, 0xb9, 0xd2, 0x22, 0x19, 0x17, 0x59, 0xc2, 0x6f, 0x30, 0x65, 0x71, 0x4e, 0xdc, 0xed, 0x4a,

+	0x54, 0x83, 0x81, 0xc6, 0xd0, 0x53, 0x70, 0x1a, 0x51, 0xb9, 0x88, 0xd5, 0x35, 0x17, 0xcc, 0x6d,

+	0x1b, 0xdd, 0xa3, 0x1a, 0x0f, 0x6b, 0x18, 0xfd, 0x04, 0x7b, 0xf7, 0x7e, 0x92, 0x2f, 0x62, 0xdd,

+	0x9f, 0xdb, 0x31, 0x33, 0x78, 0xff, 0x3d, 0xc3, 0xac, 0xae, 0xd8, 0xdc, 0x8a, 0x9a, 0x9a, 0xf7,

+	0x08, 0xf2, 0xa1, 0x9f, 0x70, 0xae, 0xf0, 0x35, 0x5d, 0x10, 0x69, 0x66, 0xc2, 0x65, 0xac, 0xe6,

+	0x6e, 0xd7, 0xf4, 0xb2, 0xa7, 0xb9, 0x33, 0x4d, 0xe9, 0xc9, 0xc2, 0x58, 0xcd, 0xd1, 0x33, 0x40,

+	0x2b, 0x86, 0x4b, 0xc1, 0x53, 0x22, 0x25, 0x17, 0x38, 0xe5, 0xcb, 0x42, 0xb9, 0xbd, 0x91, 0x75,

+	0xd8, 0x8e, 0x9c, 0x15, 0x0b, 0x1b, 0xe2, 0x54, 0xe3, 0xc8, 0x83, 0xfe, 0x8a, 0x61, 0x46, 0x18,

+	0x17, 0x6b, 0x2c, 0xe9, 0x1b, 0x82, 0x69, 0x81, 0x59, 0xe2, 0xda, 0x8d, 0xfe, 0xdc, 0x50, 0x33,

+	0xfa, 0x86, 0x04, 0xc5, 0x79, 0x82, 0x06, 0x00, 0x5f, 0x87, 0xdf, 0xbd, 0x7c, 0x31, 0xd1, 0xb5,

+	0x5c, 0x30, 0x4d, 0x40, 0x7e, 0x8f, 0x1c, 0x3c, 0x05, 0xfb, 0xfe, 0x61, 0x90, 0x0d, 0xed, 0x8b,

+	0x30, 0x08, 0xa7, 0x4e, 0x0b, 0xf5, 0x60, 0xfb, 0x2c, 0xf8, 0x76, 0xea, 0x58, 0xa8, 0x0b, 0x5b,

+	0xd3, 0xab, 0x57, 0xce, 0x83, 0x03, 0x1f, 0x9c, 0xf7, 0xe7, 0x47, 0x0f, 0xa1, 0x1b, 0x46, 0x97,

+	0xa7, 0xd3, 0xd9, 0xcc, 0x69, 0xa1, 0x5d, 0x80, 0x17, 0x3f, 0x84, 0xd3, 0xe8, 0x65, 0x30, 0xbb,

+	0x8c, 0x1c, 0xeb, 0xe0, 0xcf, 0x2d, 0xd8, 0xad, 0xdb, 0x9f, 0x10, 0x15, 0xd3, 0x85, 0x44, 0x9f,

+	0x01, 0x98, 0x27, 0xc4, 0x45, 0xcc, 0x88, 0x89, 0x94, 0x1d, 0xd9, 0x06, 0xb9, 0x88, 0x19, 0x41,

+	0xa7, 0x00, 0xa9, 0x20, 0xb1, 0x22, 0x19, 0x8e, 0x95, 0x89, 0xd5, 0xc3, 0xe7, 0xfb, 0x5e, 0x15,

+	0x57, 0xaf, 0x89, 0xab, 0x77, 0xd5, 0xc4, 0x75, 0xdc, 0xbb, 0xbd, 0x1b, 0xb6, 0x7e, 0xfd, 0x6b,

+	0x68, 0x45, 0x76, 0x7d, 0xef, 0x2b, 0x85, 0x3e, 0x07, 0xf4, 0x9a, 0x88, 0x82, 0x2c, 0xb0, 0xce,

+	0x35, 0x3e, 0x39, 0x3e, 0xc6, 0x85, 0x34, 0xc1, 0xda, 0x8e, 0x1e, 0x55, 0x8c, 0x76, 0x38, 0x39,

+	0x3e, 0xbe, 0x90, 0xc8, 0x83, 0x8f, 0xeb, 0x65, 0xa6, 0x9c, 0x31, 0xaa, 0x70, 0xb2, 0x56, 0x44,

+	0x9a, 0x84, 0x6d, 0x47, 0x7b, 0x15, 0x75, 0x6a, 0x98, 0xb1, 0x26, 0xd0, 0x19, 0x8c, 0x6a, 0xfd,

+	0xcf, 0x5c, 0xbc, 0xa6, 0x45, 0x8e, 0x25, 0x51, 0xb8, 0x14, 0x74, 0x15, 0x2b, 0x52, 0x5f, 0x6e,

+	0x9b, 0xcb, 0x9f, 0x56, 0xba, 0x57, 0x95, 0x6c, 0x46, 0x54, 0x58, 0x89, 0x2a, 0x9f, 0x09, 0x0c,

+	0x3f, 0xe0, 0x23, 0xe7, 0xb1, 0x20, 0x59, 0x6d, 0xd3, 0x31, 0x36, 0x9f, 0xbc, 0x6f, 0x33, 0x33,

+	0x9a, 0xca, 0xe5, 0x19, 0x40, 0x1d, 0x1c, 0x4c, 0x33, 0x13, 0xb1, 0x9d, 0xf1, 0xce, 0xe6, 0x6e,

+	0x68, 0xd7, 0x6b, 0x0f, 0x26, 0x91, 0x5d, 0x0b, 0x82, 0x0c, 0x3d, 0x01, 0x67, 0x29, 0x89, 0xf8,

+	0xd7, 0x5a, 0x7a, 0xa6, 0xc8, 0x8e, 0xc6, 0xdf, 0x2d, 0xe5, 0x31, 0x74, 0xc9, 0x0d, 0x49, 0xb5,

+	0xa7, 0xce, 0x95, 0x3d, 0x86, 0xcd, 0xdd, 0xb0, 0x33, 0xbd, 0x21, 0x69, 0x30, 0x89, 0x3a, 0x9a,

+	0x0a, 0xb2, 0x71, 0x76, 0xfb, 0x76, 0xd0, 0xfa, 0xe3, 0xed, 0xa0, 0xf5, 0xcb, 0x66, 0x60, 0xdd,

+	0x6e, 0x06, 0xd6, 0xef, 0x9b, 0x81, 0xf5, 0xf7, 0x66, 0x60, 0xfd, 0xf8, 0xcd, 0xff, 0xff, 0x73,

+	0xfb, 0xb2, 0xfe, 0xfd, 0xbe, 0x95, 0x74, 0xcc, 0xbb, 0x7f, 0xf1, 0x4f, 0x00, 0x00, 0x00, 0xff,

+	0xff, 0xc9, 0xeb, 0xae, 0x6f, 0x33, 0x05, 0x00, 0x00,

 }

 func (m *Options) Marshal() (dAtA []byte, err error) {

@@ -306,6 +325,22 @@ func (m *Options) MarshalTo(dAtA []byte) (int, error) {

 		i = encodeVarintRunhcs(dAtA, i, uint64(len(m.BootFilesRootPath)))

 		i += copy(dAtA[i:], m.BootFilesRootPath)

 	}

+	if m.VmProcessorCount != 0 {

+		dAtA[i] = 0x40

+		i++

+		i = encodeVarintRunhcs(dAtA, i, uint64(m.VmProcessorCount))

+	}

+	if m.VmMemorySizeInMb != 0 {

+		dAtA[i] = 0x48

+		i++

+		i = encodeVarintRunhcs(dAtA, i, uint64(m.VmMemorySizeInMb))

+	}

+	if len(m.GPUVHDPath) > 0 {

+		dAtA[i] = 0x52

+		i++

+		i = encodeVarintRunhcs(dAtA, i, uint64(len(m.GPUVHDPath)))

+		i += copy(dAtA[i:], m.GPUVHDPath)

+	}

 	if m.XXX_unrecognized != nil {

 		i += copy(dAtA[i:], m.XXX_unrecognized)

 	}

@@ -423,6 +458,16 @@ func (m *Options) Size() (n int) {

 	if l > 0 {

 		n += 1 + l + sovRunhcs(uint64(l))

 	}

+	if m.VmProcessorCount != 0 {

+		n += 1 + sovRunhcs(uint64(m.VmProcessorCount))

+	}

+	if m.VmMemorySizeInMb != 0 {

+		n += 1 + sovRunhcs(uint64(m.VmMemorySizeInMb))

+	}

+	l = len(m.GPUVHDPath)

+	if l > 0 {

+		n += 1 + l + sovRunhcs(uint64(l))

+	}

 	if m.XXX_unrecognized != nil {

 		n += len(m.XXX_unrecognized)

 	}

@@ -494,6 +539,9 @@ func (this *Options) String() string {

 		`SandboxPlatform:` + fmt.Sprintf("%v", this.SandboxPlatform) + `,`,

 		`SandboxIsolation:` + fmt.Sprintf("%v", this.SandboxIsolation) + `,`,

 		`BootFilesRootPath:` + fmt.Sprintf("%v", this.BootFilesRootPath) + `,`,

+		`VmProcessorCount:` + fmt.Sprintf("%v", this.VmProcessorCount) + `,`,

+		`VmMemorySizeInMb:` + fmt.Sprintf("%v", this.VmMemorySizeInMb) + `,`,

+		`GPUVHDPath:` + fmt.Sprintf("%v", this.GPUVHDPath) + `,`,

 		`XXX_unrecognized:` + fmt.Sprintf("%v", this.XXX_unrecognized) + `,`,

 		`}`,

 	}, "")

@@ -741,6 +789,76 @@ func (m *Options) Unmarshal(dAtA []byte) error {

 			}

 			m.BootFilesRootPath = string(dAtA[iNdEx:postIndex])

 			iNdEx = postIndex

+		case 8:

+			if wireType != 0 {

+				return fmt.Errorf("proto: wrong wireType = %d for field VmProcessorCount", wireType)

+			}

+			m.VmProcessorCount = 0

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowRunhcs

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := dAtA[iNdEx]

+				iNdEx++

+				m.VmProcessorCount |= int32(b&0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+		case 9:

+			if wireType != 0 {

+				return fmt.Errorf("proto: wrong wireType = %d for field VmMemorySizeInMb", wireType)

+			}

+			m.VmMemorySizeInMb = 0

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowRunhcs

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := dAtA[iNdEx]

+				iNdEx++

+				m.VmMemorySizeInMb |= int32(b&0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+		case 10:

+			if wireType != 2 {

+				return fmt.Errorf("proto: wrong wireType = %d for field GPUVHDPath", wireType)

+			}

+			var stringLen uint64

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowRunhcs

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := dAtA[iNdEx]

+				iNdEx++

+				stringLen |= uint64(b&0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+			intStringLen := int(stringLen)

+			if intStringLen < 0 {

+				return ErrInvalidLengthRunhcs

+			}

+			postIndex := iNdEx + intStringLen

+			if postIndex < 0 {

+				return ErrInvalidLengthRunhcs

+			}

+			if postIndex > l {

+				return io.ErrUnexpectedEOF

+			}

+			m.GPUVHDPath = string(dAtA[iNdEx:postIndex])

+			iNdEx = postIndex

 		default:

 			iNdEx = preIndex

 			skippy, err := skipRunhcs(dAtA[iNdEx:])

@@ -46,6 +46,23 @@ message Options {

 	// boot_files_root_path is the path to the directory containing the LCOW

 	// kernel and root FS files.

 	string boot_files_root_path = 7;

+

+	// vm_processor_count is the default number of processors to create for the

+	// hypervisor isolated utility vm.

+	//

+	// The platform default if omitted is 2, unless the host only has a single

+	// core in which case it is 1.

+	int32 vm_processor_count = 8;

+

+	// vm_memory_size_in_mb is the default amount of memory to assign to the

+	// hypervisor isolated utility vm.

+	//

+	// The platform default is 1024MB if omitted.

+	int32 vm_memory_size_in_mb = 9;

+

+	// GPUVHDPath is the path to the gpu vhd to add to the uvm

+	// when a container requests a gpu

+	string GPUVHDPath = 10; 

 }

 // ProcessDetails contains additional information about a process. This is the additional

@@ -4,34 +4,32 @@ go 1.13

 require (

 	github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5

-	github.com/blang/semver v3.1.0+incompatible // indirect

 	github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f

 	github.com/containerd/console v0.0.0-20180822173158-c12b1e7919c1

-	github.com/containerd/containerd v1.3.0-beta.2.0.20190828155532-0293cbd26c69

+	github.com/containerd/containerd v1.3.2

 	github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc // indirect

 	github.com/containerd/fifo v0.0.0-20190226154929-a9fb20d87448 // indirect

 	github.com/containerd/go-runc v0.0.0-20180907222934-5a6d9f37cfa3

 	github.com/containerd/ttrpc v0.0.0-20190828154514-0e0f228740de

 	github.com/containerd/typeurl v0.0.0-20180627222232-a93fcdb778cd

-	github.com/gogo/protobuf v1.2.1

-	github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce // indirect

-	github.com/hashicorp/go-multierror v0.0.0-20161216184304-ed905158d874 // indirect

+	github.com/gogo/protobuf v1.3.1

+	github.com/golang/protobuf v1.3.2 // indirect

+	github.com/kr/pretty v0.1.0 // indirect

 	github.com/opencontainers/go-digest v0.0.0-20180430190053-c9281466c8b2 // indirect

 	github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f // indirect

 	github.com/opencontainers/runtime-spec v0.1.2-0.20190507144316-5b71a03e2700

-	github.com/opencontainers/runtime-tools v0.0.0-20181011054405-1d69bd0f9c39

 	github.com/pkg/errors v0.8.1

-	github.com/prometheus/procfs v0.0.5 // indirect

-	github.com/sirupsen/logrus v1.4.1

-	github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8 // indirect

+	github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7 // indirect

+	github.com/sirupsen/logrus v1.4.2

+	github.com/stretchr/testify v1.4.0 // indirect

 	github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5

-	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect

-	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect

-	github.com/xeipuuv/gojsonschema v0.0.0-20180618132009-1d523034197f // indirect

 	go.opencensus.io v0.22.0

-	golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6

+	golang.org/x/net v0.0.0-20191004110552-13f9640d40b9 // indirect

+	golang.org/x/sync v0.0.0-20190423024810-112230192c58

 	golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3

-	google.golang.org/grpc v1.20.1

+	google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873 // indirect

+	google.golang.org/grpc v1.23.1

+	gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 // indirect

+	gopkg.in/yaml.v2 v2.2.8 // indirect

 	gotest.tools v2.2.0+incompatible // indirect

-	k8s.io/kubernetes v1.13.0

 )

@@ -21,8 +21,11 @@ const (

 	OutboundNat          = hns.OutboundNat

 	ExternalLoadBalancer = hns.ExternalLoadBalancer

 	Route                = hns.Route

+	Proxy                = hns.Proxy

 )

+type ProxyPolicy = hns.ProxyPolicy

+

 type NatPolicy = hns.NatPolicy

 type QosPolicy = hns.QosPolicy

deleted file mode 100644

@@ -1,7 +0,0 @@

-package hcs

-

-import "C"

-

-// This import is needed to make the library compile as CGO because HCSSHIM

-// only works with CGO due to callbacks from HCS comming back from a C thread

-// which is not supported without CGO. See https://github.com/golang/go/issues/10973

new file mode 100644

@@ -0,0 +1,5 @@

+package hcs

+

+//go:generate go run ../../mksyscall_windows.go -output zsyscall_windows.go syscall.go

+

+//sys hcsFormatWritableLayerVhd(handle uintptr) (hr error) = computestorage.HcsFormatWritableLayerVhd

@@ -4,12 +4,9 @@ import (

 	"context"

 	"encoding/json"

 	"errors"

-	"os"

-	"strconv"

 	"strings"

 	"sync"

 	"syscall"

-	"time"

 	"github.com/Microsoft/hcsshim/internal/cow"

 	"github.com/Microsoft/hcsshim/internal/log"

@@ -21,27 +18,6 @@ import (

 	"go.opencensus.io/trace"

 )

-// currentContainerStarts is used to limit the number of concurrent container

-// starts.

-var currentContainerStarts containerStarts

-

-type containerStarts struct {

-	maxParallel int

-	inProgress  int

-	sync.Mutex

-}

-

-func init() {

-	mpsS := os.Getenv("HCSSHIM_MAX_PARALLEL_START")

-	if len(mpsS) > 0 {

-		mpsI, err := strconv.Atoi(mpsS)

-		if err != nil || mpsI < 0 {

-			return

-		}

-		currentContainerStarts.maxParallel = mpsI

-	}

-}

-

 type System struct {

 	handleLock     sync.RWMutex

 	handle         vmcompute.HcsSystem

@@ -215,32 +191,6 @@ func (computeSystem *System) Start(ctx context.Context) (err error) {

 		return makeSystemError(computeSystem, operation, "", ErrAlreadyClosed, nil)

 	}

-	// This is a very simple backoff-retry loop to limit the number

-	// of parallel container starts if environment variable

-	// HCSSHIM_MAX_PARALLEL_START is set to a positive integer.

-	// It should generally only be used as a workaround to various

-	// platform issues that exist between RS1 and RS4 as of Aug 2018

-	if currentContainerStarts.maxParallel > 0 {

-		for {

-			currentContainerStarts.Lock()

-			if currentContainerStarts.inProgress < currentContainerStarts.maxParallel {

-				currentContainerStarts.inProgress++

-				currentContainerStarts.Unlock()

-				break

-			}

-			if currentContainerStarts.inProgress == currentContainerStarts.maxParallel {

-				currentContainerStarts.Unlock()

-				time.Sleep(100 * time.Millisecond)

-			}

-		}

-		// Make sure we decrement the count when we are done.

-		defer func() {

-			currentContainerStarts.Lock()

-			currentContainerStarts.inProgress--

-			currentContainerStarts.Unlock()

-		}()

-	}

-

 	resultJSON, err := vmcompute.HcsStartComputeSystem(ctx, computeSystem.handle, "")

 	events, err := processAsyncHcsResult(ctx, err, resultJSON, computeSystem.callbackNumber, hcsNotificationSystemStartCompleted, &timeout.SystemStart)

 	if err != nil {

@@ -1,10 +1,14 @@

 package hcs

 import (

+	"context"

 	"io"

 	"syscall"

 	"github.com/Microsoft/go-winio"

+	diskutil "github.com/Microsoft/go-winio/vhd"

+	"github.com/pkg/errors"

+	"golang.org/x/sys/windows"

 )

 // makeOpenFiles calls winio.MakeOpenFile for each handle in a slice but closes all the handles

@@ -31,3 +35,27 @@ func makeOpenFiles(hs []syscall.Handle) (_ []io.ReadWriteCloser, err error) {

 	}

 	return fs, nil

 }

+

+// creates a VHD formatted with NTFS of size `sizeGB` at the given `vhdPath`.

+func CreateNTFSVHD(ctx context.Context, vhdPath string, sizeGB uint32) (err error) {

+	if err := diskutil.CreateVhdx(vhdPath, sizeGB, 1); err != nil {

+		return errors.Wrap(err, "failed to create VHD")

+	}

+

+	vhd, err := diskutil.OpenVirtualDisk(vhdPath, diskutil.VirtualDiskAccessNone, diskutil.OpenVirtualDiskFlagNone)

+	if err != nil {

+		return errors.Wrap(err, "failed to open VHD")

+	}

+	defer func() {

+		err2 := windows.CloseHandle(windows.Handle(vhd))

+		if err == nil {

+			err = errors.Wrap(err2, "failed to close VHD")

+		}

+	}()

+

+	if err := hcsFormatWritableLayerVhd(uintptr(vhd)); err != nil {

+		return errors.Wrap(err, "failed to format VHD")

+	}

+

+	return nil

+}

new file mode 100644

@@ -0,0 +1,54 @@

+// Code generated mksyscall_windows.exe DO NOT EDIT

+

+package hcs

+

+import (

+	"syscall"

+	"unsafe"

+

+	"golang.org/x/sys/windows"

+)

+

+var _ unsafe.Pointer

+

+// Do the interface allocations only once for common

+// Errno values.

+const (

+	errnoERROR_IO_PENDING = 997

+)

+

+var (

+	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)

+)

+

+// errnoErr returns common boxed Errno values, to prevent

+// allocations at runtime.

+func errnoErr(e syscall.Errno) error {

+	switch e {

+	case 0:

+		return nil

+	case errnoERROR_IO_PENDING:

+		return errERROR_IO_PENDING

+	}

+	// TODO: add more here, after collecting data on the common

+	// error values see on Windows. (perhaps when running

+	// all.bat?)

+	return e

+}

+

+var (

+	modcomputestorage = windows.NewLazySystemDLL("computestorage.dll")

+

+	procHcsFormatWritableLayerVhd = modcomputestorage.NewProc("HcsFormatWritableLayerVhd")

+)

+

+func hcsFormatWritableLayerVhd(handle uintptr) (hr error) {

+	r0, _, _ := syscall.Syscall(procHcsFormatWritableLayerVhd.Addr(), 1, uintptr(handle), 0, 0)

+	if int32(r0) < 0 {

+		if r0&0x1fff0000 == 0x00070000 {

+			r0 &= 0xffff

+		}

+		hr = syscall.Errno(r0)

+	}

+	return

+}

@@ -173,6 +173,27 @@ func (endpoint *HNSEndpoint) ApplyACLPolicy(policies ...*ACLPolicy) error {

 	return err

 }

+// ApplyProxyPolicy applies a set of Proxy Policies on the Endpoint

+func (endpoint *HNSEndpoint) ApplyProxyPolicy(policies ...*ProxyPolicy) error {

+	operation := "ApplyProxyPolicy"

+	title := "hcsshim::HNSEndpoint::" + operation

+	logrus.Debugf(title+" id=%s", endpoint.Id)

+

+	for _, policy := range policies {

+		if policy == nil {

+			continue

+		}

+		jsonString, err := json.Marshal(policy)

+		if err != nil {

+			return err

+		}

+		endpoint.Policies = append(endpoint.Policies, jsonString)

+	}

+

+	_, err := endpoint.Update()

+	return err

+}

+

 // ContainerAttach attaches an endpoint to container

 func (endpoint *HNSEndpoint) ContainerAttach(containerID string, compartmentID uint16) error {

 	operation := "ContainerAttach"

@@ -17,6 +17,7 @@ const (

 	OutboundNat          PolicyType = "OutBoundNAT"

 	ExternalLoadBalancer PolicyType = "ELB"

 	Route                PolicyType = "ROUTE"

+	Proxy                PolicyType = "PROXY"

 )

 type NatPolicy struct {

@@ -60,6 +61,15 @@ type OutboundNatPolicy struct {

 	Destinations []string `json:",omitempty"`

 }

+type ProxyPolicy struct {

+	Type          PolicyType `json:"Type"`

+	IP            string     `json:",omitempty"`

+	Port          string     `json:",omitempty"`

+	ExceptionList []string   `json:",omitempty"`

+	Destination   string     `json:",omitempty"`

+	OutboundNat   bool       `json:",omitempty"`

+}

+

 type ActionType string

 type DirectionType string

 type RuleType string

@@ -214,9 +214,10 @@ type MappedVirtualDiskController struct {

 // GuestDefinedCapabilities is part of the GuestConnectionInfo returned by a GuestConnection call on a utility VM

 type GuestDefinedCapabilities struct {

-	NamespaceAddRequestSupported bool `json:",omitempty"`

-	SignalProcessSupported       bool `json:",omitempty"`

-	DumpStacksSupported          bool `json:",omitempty"`

+	NamespaceAddRequestSupported  bool `json:",omitempty"`

+	SignalProcessSupported        bool `json:",omitempty"`

+	DumpStacksSupported           bool `json:",omitempty"`

+	DeleteContainerStateSupported bool `json:",omitempty"`

 }

 // GuestConnectionInfo is the structure of an iterm return by a GuestConnection call on a utility VM

@@ -39,4 +39,8 @@ type Devices struct {

 	FlexibleIov map[string]FlexibleIoDevice `json:"FlexibleIov,omitempty"`

 	SharedMemory *SharedMemoryConfiguration `json:"SharedMemory,omitempty"`

+

+	// TODO: This is pre-release support in schema 2.3. Need to add build number

+	// docs when a public build with this is out.

+	VirtualPci map[string]VirtualPciDevice `json:",omitempty"`

 }

@@ -27,4 +27,23 @@ type Memory2 struct {

 	// to the VM, allowing it to trim non-zeroed pages from the working set (if supported by

 	// the guest operating system).

 	EnableColdDiscardHint bool `json:"EnableColdDiscardHint,omitempty"`

+

+	// LowMmioGapInMB is the low MMIO region allocated below 4GB.

+	//

+	// TODO: This is pre-release support in schema 2.3. Need to add build number

+	// docs when a public build with this is out.

+	LowMMIOGapInMB uint64 `json:"LowMmioGapInMB,omitempty"`

+

+	// HighMmioBaseInMB is the high MMIO region allocated above 4GB (base and

+	// size).

+	//

+	// TODO: This is pre-release support in schema 2.3. Need to add build number

+	// docs when a public build with this is out.

+	HighMMIOBaseInMB uint64 `json:"HighMmioBaseInMB,omitempty"`

+

+	// HighMmioGapInMB is the high MMIO region.

+	//

+	// TODO: This is pre-release support in schema 2.3. Need to add build number

+	// docs when a public build with this is out.

+	HighMMIOGapInMB uint64 `json:"HighMmioGapInMB,omitempty"`

 }

new file mode 100644

@@ -0,0 +1,16 @@

+/*

+ * HCS API

+ *

+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)

+ *

+ * API version: 2.3

+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)

+ */

+

+package hcsschema

+

+// TODO: This is pre-release support in schema 2.3. Need to add build number

+// docs when a public build with this is out.

+type VirtualPciDevice struct {

+	Functions []VirtualPciFunction `json:",omitempty"`

+}

new file mode 100644

@@ -0,0 +1,18 @@

+/*

+ * HCS API

+ *

+ * No description provided (generated by Swagger Codegen https://github.com/swagger-api/swagger-codegen)

+ *

+ * API version: 2.3

+ * Generated by: Swagger Codegen (https://github.com/swagger-api/swagger-codegen.git)

+ */

+

+package hcsschema

+

+// TODO: This is pre-release support in schema 2.3. Need to add build number

+// docs when a public build with this is out.

+type VirtualPciFunction struct {

+	DeviceInstancePath string `json:",omitempty"`

+

+	VirtualFunction uint16 `json:",omitempty"`

+}

@@ -1,28 +1,23 @@

 package wclayer

 import (

+	"context"

+

 	"github.com/Microsoft/hcsshim/internal/hcserror"

-	"github.com/sirupsen/logrus"

+	"github.com/Microsoft/hcsshim/internal/oc"

+	"go.opencensus.io/trace"

 )

 // ActivateLayer will find the layer with the given id and mount it's filesystem.

 // For a read/write layer, the mounted filesystem will appear as a volume on the

 // host, while a read-only layer is generally expected to be a no-op.

 // An activated layer must later be deactivated via DeactivateLayer.

-func ActivateLayer(path string) (err error) {

+func ActivateLayer(ctx context.Context, path string) (err error) {

 	title := "hcsshim::ActivateLayer"

-	fields := logrus.Fields{

-		"path": path,

-	}

-	logrus.WithFields(fields).Debug(title)

-	defer func() {

-		if err != nil {

-			fields[logrus.ErrorKey] = err

-			logrus.WithFields(fields).Error(err)

-		} else {

-			logrus.WithFields(fields).Debug(title + " - succeeded")

-		}

-	}()

+	ctx, span := trace.StartSpan(ctx, title)

+	defer span.End()

+	defer func() { oc.SetSpanStatus(span, err) }()

+	span.AddAttributes(trace.StringAttribute("path", path))

 	err = activateLayer(&stdDriverInfo, path)

 	if err != nil {

@@ -1,6 +1,7 @@

 package wclayer

 import (

+	"context"

 	"errors"

 	"os"

 	"path/filepath"

@@ -8,10 +9,15 @@ import (

 	"github.com/Microsoft/go-winio"

 	"github.com/Microsoft/hcsshim/internal/hcserror"

+	"github.com/Microsoft/hcsshim/internal/oc"

 	"github.com/Microsoft/hcsshim/internal/safefile"

+	"go.opencensus.io/trace"

 )

 type baseLayerWriter struct {

+	ctx context.Context

+	s   *trace.Span

+

 	root         *os.File

 	f            *os.File

 	bw           *winio.BackupFileWriter

@@ -136,12 +142,15 @@ func (w *baseLayerWriter) Write(b []byte) (int, error) {

 	return n, err

 }

-func (w *baseLayerWriter) Close() error {

+func (w *baseLayerWriter) Close() (err error) {

+	defer w.s.End()

+	defer func() { oc.SetSpanStatus(w.s, err) }()

 	defer func() {

 		w.root.Close()

 		w.root = nil

 	}()

-	err := w.closeCurrentFile()

+

+	err = w.closeCurrentFile()

 	if err != nil {

 		return err

 	}

@@ -153,7 +162,7 @@ func (w *baseLayerWriter) Close() error {

 			return err

 		}

-		err = ProcessBaseLayer(w.root.Name())

+		err = ProcessBaseLayer(w.ctx, w.root.Name())

 		if err != nil {

 			return err

 		}

@@ -163,7 +172,7 @@ func (w *baseLayerWriter) Close() error {

 			if err != nil {

 				return err

 			}

-			err = ProcessUtilityVMImage(filepath.Join(w.root.Name(), "UtilityVM"))

+			err = ProcessUtilityVMImage(w.ctx, filepath.Join(w.root.Name(), "UtilityVM"))

 			if err != nil {

 				return err

 			}

@@ -1,27 +1,23 @@

 package wclayer

 import (

+	"context"

+

 	"github.com/Microsoft/hcsshim/internal/hcserror"

-	"github.com/sirupsen/logrus"

+	"github.com/Microsoft/hcsshim/internal/oc"

+	"go.opencensus.io/trace"

 )

 // CreateLayer creates a new, empty, read-only layer on the filesystem based on

 // the parent layer provided.

-func CreateLayer(path, parent string) (err error) {

+func CreateLayer(ctx context.Context, path, parent string) (err error) {

 	title := "hcsshim::CreateLayer"

-	fields := logrus.Fields{

-		"parent": parent,

-		"path":   path,

-	}

-	logrus.WithFields(fields).Debug(title)

-	defer func() {

-		if err != nil {

-			fields[logrus.ErrorKey] = err

-			logrus.WithFields(fields).Error(err)

-		} else {

-			logrus.WithFields(fields).Debug(title + " - succeeded")

-		}

-	}()

+	ctx, span := trace.StartSpan(ctx, title)

+	defer span.End()

+	defer func() { oc.SetSpanStatus(span, err) }()

+	span.AddAttributes(

+		trace.StringAttribute("path", path),

+		trace.StringAttribute("parent", parent))

 	err = createLayer(&stdDriverInfo, path, parent)

 	if err != nil {

@@ -1,31 +1,29 @@

 package wclayer

 import (

+	"context"

+	"strings"

+

 	"github.com/Microsoft/hcsshim/internal/hcserror"

-	"github.com/sirupsen/logrus"

+	"github.com/Microsoft/hcsshim/internal/oc"

+	"go.opencensus.io/trace"

 )

 // CreateScratchLayer creates and populates new read-write layer for use by a container.

 // This requires both the id of the direct parent layer, as well as the full list

 // of paths to all parent layers up to the base (and including the direct parent

 // whose id was provided).

-func CreateScratchLayer(path string, parentLayerPaths []string) (err error) {

+func CreateScratchLayer(ctx context.Context, path string, parentLayerPaths []string) (err error) {

 	title := "hcsshim::CreateScratchLayer"

-	fields := logrus.Fields{

-		"path": path,