@@ -163,31 +163,9 @@ func (cli *DaemonCli) start(opts *daemonOptions) (err error) {

 	}

 	ctx, cancel := context.WithCancel(context.Background())

-	if cli.Config.ContainerdAddr == "" && runtime.GOOS != "windows" {

-		systemContainerdAddr, ok, err := systemContainerdRunning(cli.Config.IsRootless())

-		if err != nil {

-			cancel()

-			return errors.Wrap(err, "could not determine whether the system containerd is running")

-		}

-		if !ok {

-			opts, err := cli.getContainerdDaemonOpts()

-			if err != nil {

-				cancel()

-				return errors.Wrap(err, "failed to generate containerd options")

-			}

-

-			r, err := supervisor.Start(ctx, filepath.Join(cli.Config.Root, "containerd"), filepath.Join(cli.Config.ExecRoot, "containerd"), opts...)

-			if err != nil {

-				cancel()

-				return errors.Wrap(err, "failed to start containerd")

-			}

-			cli.Config.ContainerdAddr = r.Address()

-

-			// Try to wait for containerd to shutdown

-			defer r.WaitTimeout(10 * time.Second)

-		} else {

-			cli.Config.ContainerdAddr = systemContainerdAddr

-		}

+	if err := cli.initContainerD(ctx); err != nil {

+		cancel()

+		return err

 	}

 	defer cancel()

@@ -3,12 +3,14 @@

 package main

 import (

+	"context"

 	"fmt"

 	"net"

 	"os"

 	"os/signal"

 	"path/filepath"

 	"strconv"

+	"time"

 	"github.com/containerd/containerd/runtime/v1/linux"

 	"github.com/docker/docker/cmd/dockerd/hack"

@@ -18,6 +20,7 @@ import (

 	"github.com/docker/docker/pkg/homedir"

 	"github.com/docker/docker/rootless"

 	"github.com/docker/libnetwork/portallocator"

+	"github.com/pkg/errors"

 	"golang.org/x/sys/unix"

 )

@@ -145,3 +148,31 @@ func newCgroupParent(config *config.Config) string {

 	}

 	return cgroupParent

 }

+

+func (cli *DaemonCli) initContainerD(ctx context.Context) error {

+	if cli.Config.ContainerdAddr == "" {

+		systemContainerdAddr, ok, err := systemContainerdRunning(cli.Config.IsRootless())

+		if err != nil {

+			return errors.Wrap(err, "could not determine whether the system containerd is running")

+		}

+		if !ok {

+			opts, err := cli.getContainerdDaemonOpts()

+			if err != nil {

+				return errors.Wrap(err, "failed to generate containerd options")

+			}

+

+			r, err := supervisor.Start(ctx, filepath.Join(cli.Config.Root, "containerd"), filepath.Join(cli.Config.ExecRoot, "containerd"), opts...)

+			if err != nil {

+				return errors.Wrap(err, "failed to start containerd")

+			}

+			cli.Config.ContainerdAddr = r.Address()

+

+			// Try to wait for containerd to shutdown

+			defer r.WaitTimeout(10 * time.Second)

+		} else {

+			cli.Config.ContainerdAddr = systemContainerdAddr

+		}

+	}

+

+	return nil

+}

@@ -1,6 +1,7 @@

 package main

 import (

+	"context"

 	"fmt"

 	"net"

 	"os"

@@ -8,6 +9,7 @@ import (

 	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/libcontainerd/supervisor"

+	"github.com/docker/docker/pkg/system"

 	"github.com/sirupsen/logrus"

 	"golang.org/x/sys/windows"

 )

@@ -90,3 +92,8 @@ func wrapListeners(proto string, ls []net.Listener) []net.Listener {

 func newCgroupParent(config *config.Config) string {

 	return ""

 }

+

+func (cli *DaemonCli) initContainerD(_ context.Context) error {

+	system.InitContainerdRuntime(cli.Config.Experimental, cli.Config.ContainerdAddr)

+	return nil

+}

@@ -42,6 +42,7 @@ import (

 	"github.com/moby/buildkit/util/resolver"

 	"github.com/moby/buildkit/util/tracing"

 	"github.com/sirupsen/logrus"

+

 	// register graph drivers

 	_ "github.com/docker/docker/daemon/graphdriver/register"

 	"github.com/docker/docker/daemon/stats"

@@ -50,6 +51,7 @@ import (

 	"github.com/docker/docker/image"

 	"github.com/docker/docker/layer"

 	"github.com/docker/docker/libcontainerd"

+	libcontainerdtypes "github.com/docker/docker/libcontainerd/types"

 	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/locker"

 	"github.com/docker/docker/pkg/plugingetter"

@@ -105,7 +107,7 @@ type Daemon struct {

 	pluginManager         *plugin.Manager

 	linkIndex             *linkIndex

 	containerdCli         *containerd.Client

-	containerd            libcontainerd.Client

+	containerd            libcontainerdtypes.Client

 	defaultIsolation      containertypes.Isolation // Default isolation mode on Windows

 	clusterProvider       cluster.Provider

 	cluster               Cluster

@@ -351,11 +353,11 @@ func (daemon *Daemon) restore() error {

 						logrus.WithField("container", c.ID).WithField("state", s).

 							Info("restored container paused")

 						switch s {

-						case libcontainerd.StatusPaused, libcontainerd.StatusPausing:

+						case libcontainerdtypes.StatusPaused, libcontainerdtypes.StatusPausing:

 							// nothing to do

-						case libcontainerd.StatusStopped:

+						case libcontainerdtypes.StatusStopped:

 							alive = false

-						case libcontainerd.StatusUnknown:

+						case libcontainerdtypes.StatusUnknown:

 							logrus.WithField("container", c.ID).

 								Error("Unknown status for container during restore")

 						default:

@@ -502,6 +502,7 @@ func (daemon *Daemon) runAsHyperVContainer(hostConfig *containertypes.HostConfig

 // conditionalMountOnStart is a platform specific helper function during the

 // container start to call mount.

 func (daemon *Daemon) conditionalMountOnStart(container *container.Container) error {

+

 	// Bail out now for Linux containers. We cannot mount the containers filesystem on the

 	// host as it is a non-Windows filesystem.

 	if system.LCOWSupported() && container.OS != "windows" {

@@ -519,6 +520,7 @@ func (daemon *Daemon) conditionalMountOnStart(container *container.Container) er

 // conditionalUnmountOnCleanup is a platform specific helper function called

 // during the cleanup of a container to unmount.

 func (daemon *Daemon) conditionalUnmountOnCleanup(container *container.Container) error {

+

 	// Bail out now for Linux containers

 	if system.LCOWSupported() && container.OS != "windows" {

 		return nil

@@ -9,7 +9,7 @@ import (

 	containerpkg "github.com/docker/docker/container"

 	"github.com/docker/docker/errdefs"

-	"github.com/docker/docker/libcontainerd"

+	libcontainerdtypes "github.com/docker/docker/libcontainerd/types"

 	"github.com/docker/docker/pkg/signal"

 	"github.com/pkg/errors"

 	"github.com/sirupsen/logrus"

@@ -177,5 +177,5 @@ func (daemon *Daemon) killPossiblyDeadProcess(container *containerpkg.Container,

 }

 func (daemon *Daemon) kill(c *containerpkg.Container, sig int) error {

-	return daemon.containerd.SignalProcess(context.Background(), c.ID, libcontainerd.InitProcessName, sig)

+	return daemon.containerd.SignalProcess(context.Background(), c.ID, libcontainerdtypes.InitProcessName, sig)

 }

@@ -10,7 +10,7 @@ import (

 	"github.com/docker/docker/api/types"

 	"github.com/docker/docker/container"

-	"github.com/docker/docker/libcontainerd"

+	libcontainerdtypes "github.com/docker/docker/libcontainerd/types"

 	"github.com/docker/docker/restartmanager"

 	"github.com/sirupsen/logrus"

 )

@@ -27,14 +27,14 @@ func (daemon *Daemon) setStateCounter(c *container.Container) {

 }

 // ProcessEvent is called by libcontainerd whenever an event occurs

-func (daemon *Daemon) ProcessEvent(id string, e libcontainerd.EventType, ei libcontainerd.EventInfo) error {

+func (daemon *Daemon) ProcessEvent(id string, e libcontainerdtypes.EventType, ei libcontainerdtypes.EventInfo) error {

 	c, err := daemon.GetContainer(id)

 	if c == nil || err != nil {

 		return fmt.Errorf("no such container: %s", id)

 	}

 	switch e {

-	case libcontainerd.EventOOM:

+	case libcontainerdtypes.EventOOM:

 		// StateOOM is Linux specific and should never be hit on Windows

 		if runtime.GOOS == "windows" {

 			return errors.New("received StateOOM from libcontainerd on Windows. This should never happen")

@@ -48,7 +48,7 @@ func (daemon *Daemon) ProcessEvent(id string, e libcontainerd.EventType, ei libc

 		}

 		daemon.LogContainerEvent(c, "oom")

-	case libcontainerd.EventExit:

+	case libcontainerdtypes.EventExit:

 		if int(ei.Pid) == c.Pid {

 			c.Lock()

 			_, _, err := daemon.containerd.DeleteTask(context.Background(), c.ID)

@@ -140,7 +140,7 @@ func (daemon *Daemon) ProcessEvent(id string, e libcontainerd.EventType, ei libc

 				"exec-pid":  ei.Pid,

 			}).Warn("Ignoring Exit Event, no such exec command found")

 		}

-	case libcontainerd.EventStart:

+	case libcontainerdtypes.EventStart:

 		c.Lock()

 		defer c.Unlock()

@@ -159,7 +159,7 @@ func (daemon *Daemon) ProcessEvent(id string, e libcontainerd.EventType, ei libc

 			daemon.LogContainerEvent(c, "start")

 		}

-	case libcontainerd.EventPaused:

+	case libcontainerdtypes.EventPaused:

 		c.Lock()

 		defer c.Unlock()

@@ -172,7 +172,7 @@ func (daemon *Daemon) ProcessEvent(id string, e libcontainerd.EventType, ei libc

 			}

 			daemon.LogContainerEvent(c, "pause")

 		}

-	case libcontainerd.EventResumed:

+	case libcontainerdtypes.EventResumed:

 		c.Lock()

 		defer c.Unlock()

@@ -1,6 +1,7 @@

 package daemon // import "github.com/docker/docker/daemon"

 import (

+	"encoding/json"

 	"fmt"

 	"io/ioutil"

 	"path/filepath"

@@ -15,7 +16,7 @@ import (

 	"github.com/docker/docker/pkg/system"

 	"github.com/opencontainers/runtime-spec/specs-go"

 	"github.com/pkg/errors"

-	"golang.org/x/sys/windows"

+	"github.com/sirupsen/logrus"

 	"golang.org/x/sys/windows/registry"

 )

@@ -25,6 +26,7 @@ const (

 )

 func (daemon *Daemon) createSpec(c *container.Container) (*specs.Spec, error) {

+

 	img, err := daemon.imageService.GetImage(string(c.ImageID))

 	if err != nil {

 		return nil, err

@@ -219,11 +221,18 @@ func (daemon *Daemon) createSpec(c *container.Container) (*specs.Spec, error) {

 		return nil, fmt.Errorf("Unsupported platform %q", img.OS)

 	}

+	if logrus.IsLevelEnabled(logrus.DebugLevel) {

+		if b, err := json.Marshal(&s); err == nil {

+			logrus.Debugf("Generated spec: %s", string(b))

+		}

+	}

+

 	return (*specs.Spec)(&s), nil

 }

 // Sets the Windows-specific fields of the OCI spec

 func (daemon *Daemon) createSpecWindowsFields(c *container.Container, s *specs.Spec, isHyperV bool) error {

+

 	if len(s.Process.Cwd) == 0 {

 		// We default to C:\ to workaround the oddity of the case that the

 		// default directory for cmd running as LocalSystem (or

@@ -396,29 +405,37 @@ func setResourcesInSpec(c *container.Container, s *specs.Spec, isHyperV bool) {

 			}

 		}

 	}

-	memoryLimit := uint64(c.HostConfig.Memory)

-	s.Windows.Resources = &specs.WindowsResources{

-		CPU: &specs.WindowsCPUResources{

+

+	if cpuMaximum != 0 || cpuShares != 0 || cpuCount != 0 {

+		if s.Windows.Resources == nil {

+			s.Windows.Resources = &specs.WindowsResources{}

+		}

+		s.Windows.Resources.CPU = &specs.WindowsCPUResources{

 			Maximum: &cpuMaximum,

 			Shares:  &cpuShares,

 			Count:   &cpuCount,

-		},

-		Memory: &specs.WindowsMemoryResources{

+		}

+	}

+

+	memoryLimit := uint64(c.HostConfig.Memory)

+	if memoryLimit != 0 {

+		if s.Windows.Resources == nil {

+			s.Windows.Resources = &specs.WindowsResources{}

+		}

+		s.Windows.Resources.Memory = &specs.WindowsMemoryResources{

 			Limit: &memoryLimit,

-		},

-		Storage: &specs.WindowsStorageResources{

-			Bps:  &c.HostConfig.IOMaximumBandwidth,

-			Iops: &c.HostConfig.IOMaximumIOps,

-		},

+		}

 	}

-}

-func escapeArgs(args []string) []string {

-	escapedArgs := make([]string, len(args))

-	for i, a := range args {

-		escapedArgs[i] = windows.EscapeArg(a)

+	if c.HostConfig.IOMaximumBandwidth != 0 || c.HostConfig.IOMaximumIOps != 0 {

+		if s.Windows.Resources == nil {

+			s.Windows.Resources = &specs.WindowsResources{}

+		}

+		s.Windows.Resources.Storage = &specs.WindowsStorageResources{

+			Bps:  &c.HostConfig.IOMaximumBandwidth,

+			Iops: &c.HostConfig.IOMaximumIOps,

+		}

 	}

-	return escapedArgs

 }

 // mergeUlimits merge the Ulimits from HostConfig with daemon defaults, and update HostConfig

@@ -5,7 +5,7 @@ import (

 	"fmt"

 	"time"

-	"github.com/docker/docker/libcontainerd"

+	libcontainerdtypes "github.com/docker/docker/libcontainerd/types"

 )

 // ContainerResize changes the size of the TTY of the process running

@@ -20,7 +20,7 @@ func (daemon *Daemon) ContainerResize(name string, height, width int) error {

 		return errNotRunning(container.ID)

 	}

-	if err = daemon.containerd.ResizeTerminal(context.Background(), container.ID, libcontainerd.InitProcessName, width, height); err == nil {

+	if err = daemon.containerd.ResizeTerminal(context.Background(), container.ID, libcontainerdtypes.InitProcessName, width, height); err == nil {

 		attributes := map[string]string{

 			"height": fmt.Sprintf("%d", height),

 			"width":  fmt.Sprintf("%d", width),

@@ -1,11 +1,23 @@

 package daemon // import "github.com/docker/docker/daemon"

 import (

+	"github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options"

 	"github.com/Microsoft/opengcs/client"

 	"github.com/docker/docker/container"

+	"github.com/docker/docker/pkg/system"

 )

 func (daemon *Daemon) getLibcontainerdCreateOptions(container *container.Container) (interface{}, error) {

+

+	// Set the runtime options to debug regardless of current logging level.

+	if system.ContainerdRuntimeSupported() {

+		opts := &options.Options{Debug: true}

+		return opts, nil

+	}

+

+	// TODO @jhowardmsft (containerd) - Probably need to revisit LCOW options here

+	// rather than blindly ignoring them.

+

 	// LCOW options.

 	if container.OS == "linux" {

 		config := &client.Config{}

@@ -4,12 +4,12 @@ import (

 	"time"

 	"github.com/docker/docker/api/types/container"

-	"github.com/docker/docker/libcontainerd"

+	libcontainerdtypes "github.com/docker/docker/libcontainerd/types"

 	"github.com/opencontainers/runtime-spec/specs-go"

 )

-func toContainerdResources(resources container.Resources) *libcontainerd.Resources {

-	var r libcontainerd.Resources

+func toContainerdResources(resources container.Resources) *libcontainerdtypes.Resources {

+	var r libcontainerdtypes.Resources

 	r.BlockIO = &specs.LinuxBlockIO{

 		Weight: &resources.BlkioWeight,

@@ -2,10 +2,10 @@ package daemon // import "github.com/docker/docker/daemon"

 import (

 	"github.com/docker/docker/api/types/container"

-	"github.com/docker/docker/libcontainerd"

+	libcontainerdtypes "github.com/docker/docker/libcontainerd/types"

 )

-func toContainerdResources(resources container.Resources) *libcontainerd.Resources {

+func toContainerdResources(resources container.Resources) *libcontainerdtypes.Resources {

 	// We don't support update, so do nothing

 	return nil

 }

@@ -7,7 +7,7 @@ import (

 	"time"

 	"github.com/containerd/containerd"

-	"github.com/docker/docker/libcontainerd"

+	libcontainerdtypes "github.com/docker/docker/libcontainerd/types"

 	specs "github.com/opencontainers/runtime-spec/specs-go"

 )

@@ -18,19 +18,19 @@ type MockContainerdClient struct {

 func (c *MockContainerdClient) Version(ctx context.Context) (containerd.Version, error) {

 	return containerd.Version{}, nil

 }

-func (c *MockContainerdClient) Restore(ctx context.Context, containerID string, attachStdio libcontainerd.StdioCallback) (alive bool, pid int, err error) {

+func (c *MockContainerdClient) Restore(ctx context.Context, containerID string, attachStdio libcontainerdtypes.StdioCallback) (alive bool, pid int, err error) {

 	return false, 0, nil

 }

 func (c *MockContainerdClient) Create(ctx context.Context, containerID string, spec *specs.Spec, runtimeOptions interface{}) error {

 	return nil

 }

-func (c *MockContainerdClient) Start(ctx context.Context, containerID, checkpointDir string, withStdin bool, attachStdio libcontainerd.StdioCallback) (pid int, err error) {

+func (c *MockContainerdClient) Start(ctx context.Context, containerID, checkpointDir string, withStdin bool, attachStdio libcontainerdtypes.StdioCallback) (pid int, err error) {

 	return 0, nil

 }

 func (c *MockContainerdClient) SignalProcess(ctx context.Context, containerID, processID string, signal int) error {

 	return nil

 }

-func (c *MockContainerdClient) Exec(ctx context.Context, containerID, processID string, spec *specs.Process, withStdin bool, attachStdio libcontainerd.StdioCallback) (int, error) {

+func (c *MockContainerdClient) Exec(ctx context.Context, containerID, processID string, spec *specs.Process, withStdin bool, attachStdio libcontainerdtypes.StdioCallback) (int, error) {

 	return 0, nil

 }

 func (c *MockContainerdClient) ResizeTerminal(ctx context.Context, containerID, processID string, width, height int) error {

@@ -41,23 +41,23 @@ func (c *MockContainerdClient) CloseStdin(ctx context.Context, containerID, proc

 }

 func (c *MockContainerdClient) Pause(ctx context.Context, containerID string) error  { return nil }

 func (c *MockContainerdClient) Resume(ctx context.Context, containerID string) error { return nil }

-func (c *MockContainerdClient) Stats(ctx context.Context, containerID string) (*libcontainerd.Stats, error) {

+func (c *MockContainerdClient) Stats(ctx context.Context, containerID string) (*libcontainerdtypes.Stats, error) {

 	return nil, nil

 }

 func (c *MockContainerdClient) ListPids(ctx context.Context, containerID string) ([]uint32, error) {

 	return nil, nil

 }

-func (c *MockContainerdClient) Summary(ctx context.Context, containerID string) ([]libcontainerd.Summary, error) {

+func (c *MockContainerdClient) Summary(ctx context.Context, containerID string) ([]libcontainerdtypes.Summary, error) {

 	return nil, nil

 }

 func (c *MockContainerdClient) DeleteTask(ctx context.Context, containerID string) (uint32, time.Time, error) {

 	return 0, time.Time{}, nil

 }

 func (c *MockContainerdClient) Delete(ctx context.Context, containerID string) error { return nil }

-func (c *MockContainerdClient) Status(ctx context.Context, containerID string) (libcontainerd.Status, error) {

+func (c *MockContainerdClient) Status(ctx context.Context, containerID string) (libcontainerdtypes.Status, error) {

 	return "null", nil

 }

-func (c *MockContainerdClient) UpdateResources(ctx context.Context, containerID string, resources *libcontainerd.Resources) error {

+func (c *MockContainerdClient) UpdateResources(ctx context.Context, containerID string, resources *libcontainerdtypes.Resources) error {

 	return nil

 }

 func (c *MockContainerdClient) CreateCheckpoint(ctx context.Context, containerID, checkpointDir string, exit bool) error {

deleted file mode 100644

@@ -1,918 +0,0 @@

-// +build !windows

-

-package libcontainerd // import "github.com/docker/docker/libcontainerd"

-

-import (

-	"context"

-	"encoding/json"

-	"fmt"

-	"io"

-	"os"

-	"path/filepath"

-	"reflect"

-	"runtime"

-	"strings"

-	"sync"

-	"syscall"

-	"time"

-

-	"github.com/containerd/containerd"

-	apievents "github.com/containerd/containerd/api/events"

-	"github.com/containerd/containerd/api/types"

-	"github.com/containerd/containerd/archive"

-	"github.com/containerd/containerd/cio"

-	"github.com/containerd/containerd/content"

-	containerderrors "github.com/containerd/containerd/errdefs"

-	"github.com/containerd/containerd/events"

-	"github.com/containerd/containerd/images"

-	"github.com/containerd/containerd/runtime/linux/runctypes"

-	"github.com/containerd/typeurl"

-	"github.com/docker/docker/errdefs"

-	"github.com/docker/docker/pkg/ioutils"

-	v1 "github.com/opencontainers/image-spec/specs-go/v1"

-	specs "github.com/opencontainers/runtime-spec/specs-go"

-	"github.com/pkg/errors"

-	"github.com/sirupsen/logrus"

-	"google.golang.org/grpc/codes"

-	"google.golang.org/grpc/status"

-)

-

-// InitProcessName is the name given to the first process of a

-// container

-const InitProcessName = "init"

-

-type container struct {

-	mu sync.Mutex

-

-	bundleDir string

-	ctr       containerd.Container

-	task      containerd.Task

-	execs     map[string]containerd.Process

-	oomKilled bool

-}

-

-func (c *container) setTask(t containerd.Task) {

-	c.mu.Lock()

-	c.task = t

-	c.mu.Unlock()

-}

-

-func (c *container) getTask() containerd.Task {

-	c.mu.Lock()

-	t := c.task

-	c.mu.Unlock()

-	return t

-}

-

-func (c *container) addProcess(id string, p containerd.Process) {

-	c.mu.Lock()

-	if c.execs == nil {

-		c.execs = make(map[string]containerd.Process)

-	}

-	c.execs[id] = p

-	c.mu.Unlock()

-}

-

-func (c *container) deleteProcess(id string) {

-	c.mu.Lock()

-	delete(c.execs, id)

-	c.mu.Unlock()

-}

-

-func (c *container) getProcess(id string) containerd.Process {

-	c.mu.Lock()

-	p := c.execs[id]

-	c.mu.Unlock()

-	return p

-}

-

-func (c *container) setOOMKilled(killed bool) {

-	c.mu.Lock()

-	c.oomKilled = killed

-	c.mu.Unlock()

-}

-

-func (c *container) getOOMKilled() bool {

-	c.mu.Lock()

-	killed := c.oomKilled

-	c.mu.Unlock()

-	return killed

-}

-

-type client struct {

-	sync.RWMutex // protects containers map

-

-	client   *containerd.Client

-	stateDir string

-	logger   *logrus.Entry

-	ns       string

-

-	backend    Backend

-	eventQ     queue

-	containers map[string]*container

-}

-

-// NewClient creates a new libcontainerd client from a containerd client

-func NewClient(ctx context.Context, cli *containerd.Client, stateDir, ns string, b Backend) (Client, error) {

-	c := &client{

-		client:     cli,

-		stateDir:   stateDir,

-		logger:     logrus.WithField("module", "libcontainerd").WithField("namespace", ns),

-		ns:         ns,

-		backend:    b,

-		containers: make(map[string]*container),

-	}

-

-	go c.processEventStream(ctx, ns)

-

-	return c, nil

-}

-

-func (c *client) Version(ctx context.Context) (containerd.Version, error) {

-	return c.client.Version(ctx)

-}

-

-// Restore loads the containerd container.

-// It should not be called concurrently with any other operation for the given ID.

-func (c *client) Restore(ctx context.Context, id string, attachStdio StdioCallback) (alive bool, pid int, err error) {

-	c.Lock()

-	_, ok := c.containers[id]

-	if ok {

-		c.Unlock()

-		return false, 0, errors.WithStack(newConflictError("id already in use"))

-	}

-

-	cntr := &container{}

-	c.containers[id] = cntr

-	cntr.mu.Lock()

-	defer cntr.mu.Unlock()

-

-	c.Unlock()

-

-	defer func() {

-		if err != nil {

-			c.Lock()

-			delete(c.containers, id)

-			c.Unlock()

-		}

-	}()

-

-	var dio *cio.DirectIO

-	defer func() {

-		if err != nil && dio != nil {

-			dio.Cancel()

-			dio.Close()

-		}

-		err = wrapError(err)

-	}()

-

-	ctr, err := c.client.LoadContainer(ctx, id)

-	if err != nil {

-		return false, -1, errors.WithStack(wrapError(err))

-	}

-

-	attachIO := func(fifos *cio.FIFOSet) (cio.IO, error) {

-		// dio must be assigned to the previously defined dio for the defer above

-		// to handle cleanup

-		dio, err = cio.NewDirectIO(ctx, fifos)

-		if err != nil {

-			return nil, err

-		}

-		return attachStdio(dio)

-	}

-	t, err := ctr.Task(ctx, attachIO)

-	if err != nil && !containerderrors.IsNotFound(err) {

-		return false, -1, errors.Wrap(wrapError(err), "error getting containerd task for container")

-	}

-

-	if t != nil {

-		s, err := t.Status(ctx)

-		if err != nil {

-			return false, -1, errors.Wrap(wrapError(err), "error getting task status")

-		}

-

-		alive = s.Status != containerd.Stopped

-		pid = int(t.Pid())

-	}

-

-	cntr.bundleDir = filepath.Join(c.stateDir, id)

-	cntr.ctr = ctr

-	cntr.task = t

-	// TODO(mlaventure): load execs

-

-	c.logger.WithFields(logrus.Fields{

-		"container": id,

-		"alive":     alive,

-		"pid":       pid,

-	}).Debug("restored container")

-

-	return alive, pid, nil

-}

-

-func (c *client) Create(ctx context.Context, id string, ociSpec *specs.Spec, runtimeOptions interface{}) error {

-	if ctr := c.getContainer(id); ctr != nil {

-		return errors.WithStack(newConflictError("id already in use"))

-	}

-

-	bdir, err := prepareBundleDir(filepath.Join(c.stateDir, id), ociSpec)

-	if err != nil {

-		return errdefs.System(errors.Wrap(err, "prepare bundle dir failed"))

-	}

-

-	c.logger.WithField("bundle", bdir).WithField("root", ociSpec.Root.Path).Debug("bundle dir created")

-

-	cdCtr, err := c.client.NewContainer(ctx, id,

-		containerd.WithSpec(ociSpec),

-		// TODO(mlaventure): when containerd support lcow, revisit runtime value

-		containerd.WithRuntime(fmt.Sprintf("io.containerd.runtime.v1.%s", runtime.GOOS), runtimeOptions))

-	if err != nil {

-		return wrapError(err)

-	}

-

-	c.Lock()

-	c.containers[id] = &container{

-		bundleDir: bdir,

-		ctr:       cdCtr,

-	}

-	c.Unlock()

-

-	return nil

-}

-

-// Start create and start a task for the specified containerd id

-func (c *client) Start(ctx context.Context, id, checkpointDir string, withStdin bool, attachStdio StdioCallback) (int, error) {

-	ctr := c.getContainer(id)

-	if ctr == nil {

-		return -1, errors.WithStack(newNotFoundError("no such container"))

-	}

-	if t := ctr.getTask(); t != nil {

-		return -1, errors.WithStack(newConflictError("container already started"))

-	}

-

-	var (

-		cp             *types.Descriptor

-		t              containerd.Task

-		rio            cio.IO

-		err            error

-		stdinCloseSync = make(chan struct{})

-	)

-

-	if checkpointDir != "" {

-		// write checkpoint to the content store

-		tar := archive.Diff(ctx, "", checkpointDir)

-		cp, err = c.writeContent(ctx, images.MediaTypeContainerd1Checkpoint, checkpointDir, tar)

-		// remove the checkpoint when we're done

-		defer func() {

-			if cp != nil {

-				err := c.client.ContentStore().Delete(context.Background(), cp.Digest)

-				if err != nil {

-					c.logger.WithError(err).WithFields(logrus.Fields{

-						"ref":    checkpointDir,

-						"digest": cp.Digest,

-					}).Warnf("failed to delete temporary checkpoint entry")

-				}

-			}

-		}()

-		if err := tar.Close(); err != nil {

-			return -1, errors.Wrap(err, "failed to close checkpoint tar stream")

-		}

-		if err != nil {

-			return -1, errors.Wrapf(err, "failed to upload checkpoint to containerd")

-		}

-	}

-

-	spec, err := ctr.ctr.Spec(ctx)

-	if err != nil {

-		return -1, errors.Wrap(err, "failed to retrieve spec")

-	}

-	uid, gid := getSpecUser(spec)

-	t, err = ctr.ctr.NewTask(ctx,

-		func(id string) (cio.IO, error) {

-			fifos := newFIFOSet(ctr.bundleDir, InitProcessName, withStdin, spec.Process.Terminal)

-

-			rio, err = c.createIO(fifos, id, InitProcessName, stdinCloseSync, attachStdio)

-			return rio, err

-		},

-		func(_ context.Context, _ *containerd.Client, info *containerd.TaskInfo) error {

-			info.Checkpoint = cp

-			info.Options = &runctypes.CreateOptions{

-				IoUid:       uint32(uid),

-				IoGid:       uint32(gid),

-				NoPivotRoot: os.Getenv("DOCKER_RAMDISK") != "",

-			}

-			return nil

-		})

-	if err != nil {

-		close(stdinCloseSync)

-		if rio != nil {

-			rio.Cancel()

-			rio.Close()

-		}

-		return -1, wrapError(err)

-	}

-

-	ctr.setTask(t)

-

-	// Signal c.createIO that it can call CloseIO

-	close(stdinCloseSync)

-

-	if err := t.Start(ctx); err != nil {

-		if _, err := t.Delete(ctx); err != nil {

-			c.logger.WithError(err).WithField("container", id).

-				Error("failed to delete task after fail start")

-		}

-		ctr.setTask(nil)

-		return -1, wrapError(err)

-	}

-

-	return int(t.Pid()), nil

-}

-

-// Exec creates exec process.

-//

-// The containerd client calls Exec to register the exec config in the shim side.

-// When the client calls Start, the shim will create stdin fifo if needs. But

-// for the container main process, the stdin fifo will be created in Create not

-// the Start call. stdinCloseSync channel should be closed after Start exec

-// process.

-func (c *client) Exec(ctx context.Context, containerID, processID string, spec *specs.Process, withStdin bool, attachStdio StdioCallback) (int, error) {

-	ctr := c.getContainer(containerID)

-	if ctr == nil {

-		return -1, errors.WithStack(newNotFoundError("no such container"))

-	}

-	t := ctr.getTask()

-	if t == nil {

-		return -1, errors.WithStack(newInvalidParameterError("container is not running"))

-	}

-

-	if p := ctr.getProcess(processID); p != nil {

-		return -1, errors.WithStack(newConflictError("id already in use"))

-	}

-

-	var (

-		p              containerd.Process

-		rio            cio.IO

-		err            error

-		stdinCloseSync = make(chan struct{})

-	)

-

-	fifos := newFIFOSet(ctr.bundleDir, processID, withStdin, spec.Terminal)

-

-	defer func() {

-		if err != nil {

-			if rio != nil {

-				rio.Cancel()

-				rio.Close()

-			}

-		}

-	}()

-

-	p, err = t.Exec(ctx, processID, spec, func(id string) (cio.IO, error) {

-		rio, err = c.createIO(fifos, containerID, processID, stdinCloseSync, attachStdio)

-		return rio, err