@@ -17,7 +17,7 @@ import (

 // ImageComponent provides an interface for working with images

 type ImageComponent interface {

 	SquashImage(from string, to string) (string, error)

-	TagImageWithReference(image.ID, string, reference.Named) error

+	TagImageWithReference(image.ID, reference.Named) error

 }

 // Builder defines interface for running a build

@@ -3,11 +3,9 @@ package build

 import (

 	"fmt"

 	"io"

-	"runtime"

 	"github.com/docker/distribution/reference"

 	"github.com/docker/docker/image"

-	"github.com/docker/docker/pkg/system"

 	"github.com/pkg/errors"

 )

@@ -35,12 +33,7 @@ func NewTagger(backend ImageComponent, stdout io.Writer, names []string) (*Tagge

 // TagImages creates image tags for the imageID

 func (bt *Tagger) TagImages(imageID image.ID) error {

 	for _, rt := range bt.repoAndTags {

-		// TODO @jhowardmsft LCOW support. Will need revisiting.

-		platform := runtime.GOOS

-		if system.LCOWSupported() {

-			platform = "linux"

-		}

-		if err := bt.imageComponent.TagImageWithReference(imageID, platform, rt); err != nil {

+		if err := bt.imageComponent.TagImageWithReference(imageID, rt); err != nil {

 			return err

 		}

 		fmt.Fprintf(bt.stdout, "Successfully tagged %s\n", reference.FamiliarString(rt))

@@ -44,7 +44,7 @@ type Backend interface {

 	// ContainerCreateWorkdir creates the workdir

 	ContainerCreateWorkdir(containerID string) error

-	CreateImage(config []byte, parent string, platform string) (Image, error)

+	CreateImage(config []byte, parent string) (Image, error)

 	ImageCacheBuilder

 }

@@ -79,7 +79,7 @@ type Result struct {

 // ImageCacheBuilder represents a generator for stateful image cache.

 type ImageCacheBuilder interface {

 	// MakeImageCache creates a stateful image cache.

-	MakeImageCache(cacheFrom []string, platform string) ImageCache

+	MakeImageCache(cacheFrom []string) ImageCache

 }

 // ImageCache abstracts an image cache.

@@ -102,6 +102,6 @@ type Image interface {

 type ReleaseableLayer interface {

 	Release() error

 	Mount() (containerfs.ContainerFS, error)

-	Commit(platform string) (ReleaseableLayer, error)

+	Commit() (ReleaseableLayer, error)

 	DiffID() layer.DiffID

 }

@@ -123,7 +123,7 @@ func (bm *BuildManager) Build(ctx context.Context, config backend.BuildConfig) (

 		PathCache:      bm.pathCache,

 		IDMappings:     bm.idMappings,

 	}

-	return newBuilder(ctx, builderOptions, os).build(source, dockerfile)

+	return newBuilder(ctx, builderOptions).build(source, dockerfile)

 }

 func (bm *BuildManager) initializeClientSession(ctx context.Context, cancel func(), options *types.ImageBuildOptions) (builder.Source, error) {

@@ -190,7 +190,7 @@ type Builder struct {

 }

 // newBuilder creates a new Dockerfile builder from an optional dockerfile and a Options.

-func newBuilder(clientCtx context.Context, options builderOptions, os string) *Builder {

+func newBuilder(clientCtx context.Context, options builderOptions) *Builder {

 	config := options.Options

 	if config == nil {

 		config = new(types.ImageBuildOptions)

@@ -207,7 +207,7 @@ func newBuilder(clientCtx context.Context, options builderOptions, os string) *B

 		idMappings:       options.IDMappings,

 		imageSources:     newImageSources(clientCtx, options),

 		pathCache:        options.PathCache,

-		imageProber:      newImageProber(options.Backend, config.CacheFrom, os, config.NoCache),

+		imageProber:      newImageProber(options.Backend, config.CacheFrom, config.NoCache),

 		containerManager: newContainerManager(options.Backend),

 	}

@@ -357,7 +357,10 @@ func addNodesForLabelOption(dockerfile *parser.Node, labels map[string]string) {

 // coming from the query parameter of the same name.

 //

 // TODO: Remove?

-func BuildFromConfig(config *container.Config, changes []string) (*container.Config, error) {

+func BuildFromConfig(config *container.Config, changes []string, os string) (*container.Config, error) {

+	if !system.IsOSSupported(os) {

+		return nil, errdefs.InvalidParameter(system.ErrNotSupportedOperatingSystem)

+	}

 	if len(changes) == 0 {

 		return config, nil

 	}

@@ -367,14 +370,9 @@ func BuildFromConfig(config *container.Config, changes []string) (*container.Con

 		return nil, errdefs.InvalidParameter(err)

 	}

-	os := runtime.GOOS

-	if dockerfile.OS != "" {

-		os = dockerfile.OS

-	}

-

 	b := newBuilder(context.Background(), builderOptions{

 		Options: &types.ImageBuildOptions{NoCache: true},

-	}, os)

+	})

 	// ensure that the commands are valid

 	for _, n := range dockerfile.AST.Children {

@@ -400,6 +398,7 @@ func BuildFromConfig(config *container.Config, changes []string) (*container.Con

 	// We make mutations to the configuration, ensure we have a copy

 	dispatchRequest.state.runConfig = copyRunConfig(config)

 	dispatchRequest.state.imageID = config.Image

+	dispatchRequest.state.operatingSystem = os

 	for _, cmd := range commands {

 		err := dispatch(dispatchRequest, cmd)

 		if err != nil {

@@ -28,7 +28,7 @@ func newContainerManager(docker builder.ExecBackend) *containerManager {

 }

 // Create a container

-func (c *containerManager) Create(runConfig *container.Config, hostConfig *container.HostConfig, platform string) (container.ContainerCreateCreatedBody, error) {

+func (c *containerManager) Create(runConfig *container.Config, hostConfig *container.HostConfig) (container.ContainerCreateCreatedBody, error) {

 	container, err := c.backend.ContainerCreate(types.ContainerCreateConfig{

 		Config:     runConfig,

 		HostConfig: hostConfig,

@@ -156,7 +156,9 @@ func initializeStage(d dispatchRequest, cmd *instructions.Stage) error {

 		return err

 	}

 	state := d.state

-	state.beginStage(cmd.Name, image)

+	if err := state.beginStage(cmd.Name, image); err != nil {

+		return err

+	}

 	if len(state.runConfig.OnBuild) > 0 {

 		triggers := state.runConfig.OnBuild

 		state.runConfig.OnBuild = nil

@@ -261,8 +263,8 @@ func dispatchOnbuild(d dispatchRequest, c *instructions.OnbuildCommand) error {

 func dispatchWorkdir(d dispatchRequest, c *instructions.WorkdirCommand) error {

 	runConfig := d.state.runConfig

 	var err error

-	optionsOS := system.ParsePlatform(d.builder.options.Platform).OS

-	runConfig.WorkingDir, err = normalizeWorkdir(optionsOS, runConfig.WorkingDir, c.Path)

+	baseImageOS := system.ParsePlatform(d.state.operatingSystem).OS

+	runConfig.WorkingDir, err = normalizeWorkdir(baseImageOS, runConfig.WorkingDir, c.Path)

 	if err != nil {

 		return err

 	}

@@ -278,7 +280,7 @@ func dispatchWorkdir(d dispatchRequest, c *instructions.WorkdirCommand) error {

 	}

 	comment := "WORKDIR " + runConfig.WorkingDir

-	runConfigWithCommentCmd := copyRunConfig(runConfig, withCmdCommentString(comment, optionsOS))

+	runConfigWithCommentCmd := copyRunConfig(runConfig, withCmdCommentString(comment, baseImageOS))

 	containerID, err := d.builder.probeAndCreate(d.state, runConfigWithCommentCmd)

 	if err != nil || containerID == "" {

 		return err

@@ -290,10 +292,10 @@ func dispatchWorkdir(d dispatchRequest, c *instructions.WorkdirCommand) error {

 	return d.builder.commitContainer(d.state, containerID, runConfigWithCommentCmd)

 }

-func resolveCmdLine(cmd instructions.ShellDependantCmdLine, runConfig *container.Config, platform string) []string {

+func resolveCmdLine(cmd instructions.ShellDependantCmdLine, runConfig *container.Config, os string) []string {

 	result := cmd.CmdLine

 	if cmd.PrependShell && result != nil {

-		result = append(getShell(runConfig, platform), result...)

+		result = append(getShell(runConfig, os), result...)

 	}

 	return result

 }

@@ -309,10 +311,11 @@ func resolveCmdLine(cmd instructions.ShellDependantCmdLine, runConfig *container

 // RUN [ "echo", "hi" ] # echo hi

 //

 func dispatchRun(d dispatchRequest, c *instructions.RunCommand) error {

-

+	if !system.IsOSSupported(d.state.operatingSystem) {

+		return system.ErrNotSupportedOperatingSystem

+	}

 	stateRunConfig := d.state.runConfig

-	optionsOS := system.ParsePlatform(d.builder.options.Platform).OS

-	cmdFromArgs := resolveCmdLine(c.ShellDependantCmdLine, stateRunConfig, optionsOS)

+	cmdFromArgs := resolveCmdLine(c.ShellDependantCmdLine, stateRunConfig, d.state.operatingSystem)

 	buildArgs := d.state.buildArgs.FilterAllowed(stateRunConfig.Env)

 	saveCmd := cmdFromArgs

@@ -31,7 +31,7 @@ func newBuilderWithMockBackend() *Builder {

 			Options: &types.ImageBuildOptions{Platform: runtime.GOOS},

 			Backend: mockBackend,

 		}),

-		imageProber:      newImageProber(mockBackend, nil, runtime.GOOS, false),

+		imageProber:      newImageProber(mockBackend, nil, false),

 		containerManager: newContainerManager(mockBackend),

 	}

 	return b

@@ -427,10 +427,10 @@ func TestRunWithBuildArgs(t *testing.T) {

 	}

 	mockBackend := b.docker.(*MockBackend)

-	mockBackend.makeImageCacheFunc = func(_ []string, _ string) builder.ImageCache {

+	mockBackend.makeImageCacheFunc = func(_ []string) builder.ImageCache {

 		return imageCache

 	}

-	b.imageProber = newImageProber(mockBackend, nil, runtime.GOOS, false)

+	b.imageProber = newImageProber(mockBackend, nil, false)

 	mockBackend.getImageFunc = func(_ string) (builder.Image, builder.ReleaseableLayer, error) {

 		return &mockImage{

 			id:     "abcdef",

@@ -21,6 +21,7 @@ package dockerfile

 import (

 	"reflect"

+	"runtime"

 	"strconv"

 	"strings"

@@ -104,13 +105,14 @@ func dispatch(d dispatchRequest, cmd instructions.Command) (err error) {

 // dispatchState is a data object which is modified by dispatchers

 type dispatchState struct {

-	runConfig  *container.Config

-	maintainer string

-	cmdSet     bool

-	imageID    string

-	baseImage  builder.Image

-	stageName  string

-	buildArgs  *buildArgs

+	runConfig       *container.Config

+	maintainer      string

+	cmdSet          bool

+	imageID         string

+	baseImage       builder.Image

+	stageName       string

+	buildArgs       *buildArgs

+	operatingSystem string

 }

 func newDispatchState(baseArgs *buildArgs) *dispatchState {

@@ -210,9 +212,16 @@ func (s *dispatchState) hasFromImage() bool {

 	return s.imageID != "" || (s.baseImage != nil && s.baseImage.ImageID() == "")

 }

-func (s *dispatchState) beginStage(stageName string, image builder.Image) {

+func (s *dispatchState) beginStage(stageName string, image builder.Image) error {

 	s.stageName = stageName

 	s.imageID = image.ImageID()

+	s.operatingSystem = image.OperatingSystem()

+	if s.operatingSystem == "" { // In case it isn't set

+		s.operatingSystem = runtime.GOOS

+	}

+	if !system.IsOSSupported(s.operatingSystem) {

+		return system.ErrNotSupportedOperatingSystem

+	}

 	if image.RunConfig() != nil {

 		// copy avoids referencing the same instance when 2 stages have the same base

@@ -224,12 +233,13 @@ func (s *dispatchState) beginStage(stageName string, image builder.Image) {

 	s.setDefaultPath()

 	s.runConfig.OpenStdin = false

 	s.runConfig.StdinOnce = false

+	return nil

 }

 // Add the default PATH to runConfig.ENV if one exists for the operating system and there

 // is no PATH set. Note that Windows containers on Windows won't have one as it's set by HCS

 func (s *dispatchState) setDefaultPath() {

-	defaultPath := system.DefaultPathEnv(s.baseImage.OperatingSystem())

+	defaultPath := system.DefaultPathEnv(s.operatingSystem)

 	if defaultPath == "" {

 		return

 	}

@@ -19,13 +19,13 @@ type imageProber struct {

 	cacheBusted bool

 }

-func newImageProber(cacheBuilder builder.ImageCacheBuilder, cacheFrom []string, platform string, noCache bool) ImageProber {

+func newImageProber(cacheBuilder builder.ImageCacheBuilder, cacheFrom []string, noCache bool) ImageProber {

 	if noCache {

 		return &nopProber{}

 	}

 	reset := func() builder.ImageCache {

-		return cacheBuilder.MakeImageCache(cacheFrom, platform)

+		return cacheBuilder.MakeImageCache(cacheFrom)

 	}

 	return &imageProber{cache: reset(), reset: reset}

 }

@@ -125,8 +125,7 @@ func (b *Builder) commitContainer(dispatchState *dispatchState, id string, conta

 }

 func (b *Builder) exportImage(state *dispatchState, imageMount *imageMount, runConfig *container.Config) error {

-	optionsPlatform := system.ParsePlatform(b.options.Platform)

-	newLayer, err := imageMount.Layer().Commit(optionsPlatform.OS)

+	newLayer, err := imageMount.Layer().Commit()

 	if err != nil {

 		return err

 	}

@@ -154,7 +153,7 @@ func (b *Builder) exportImage(state *dispatchState, imageMount *imageMount, runC

 		return errors.Wrap(err, "failed to encode image config")

 	}

-	exportedImage, err := b.docker.CreateImage(config, state.imageID, parentImage.OS)

+	exportedImage, err := b.docker.CreateImage(config, state.imageID)

 	if err != nil {

 		return errors.Wrapf(err, "failed to export image")

 	}

@@ -502,15 +501,13 @@ func (b *Builder) probeAndCreate(dispatchState *dispatchState, runConfig *contai

 	}

 	// Set a log config to override any default value set on the daemon

 	hostConfig := &container.HostConfig{LogConfig: defaultLogConfig}

-	optionsPlatform := system.ParsePlatform(b.options.Platform)

-	container, err := b.containerManager.Create(runConfig, hostConfig, optionsPlatform.OS)

+	container, err := b.containerManager.Create(runConfig, hostConfig)

 	return container.ID, err

 }

 func (b *Builder) create(runConfig *container.Config) (string, error) {

 	hostConfig := hostConfigFromOptions(b.options)

-	optionsPlatform := system.ParsePlatform(b.options.Platform)

-	container, err := b.containerManager.Create(runConfig, hostConfig, optionsPlatform.OS)

+	container, err := b.containerManager.Create(runConfig, hostConfig)

 	if err != nil {

 		return "", err

 	}

@@ -20,7 +20,7 @@ type MockBackend struct {

 	containerCreateFunc func(config types.ContainerCreateConfig) (container.ContainerCreateCreatedBody, error)

 	commitFunc          func(string, *backend.ContainerCommitConfig) (string, error)

 	getImageFunc        func(string) (builder.Image, builder.ReleaseableLayer, error)

-	makeImageCacheFunc  func(cacheFrom []string, platform string) builder.ImageCache

+	makeImageCacheFunc  func(cacheFrom []string) builder.ImageCache

 }

 func (m *MockBackend) ContainerAttachRaw(cID string, stdin io.ReadCloser, stdout, stderr io.Writer, stream bool, attached chan struct{}) error {

@@ -73,14 +73,14 @@ func (m *MockBackend) GetImageAndReleasableLayer(ctx context.Context, refOrID st

 	return &mockImage{id: "theid"}, &mockLayer{}, nil

 }

-func (m *MockBackend) MakeImageCache(cacheFrom []string, platform string) builder.ImageCache {

+func (m *MockBackend) MakeImageCache(cacheFrom []string) builder.ImageCache {

 	if m.makeImageCacheFunc != nil {

-		return m.makeImageCacheFunc(cacheFrom, platform)

+		return m.makeImageCacheFunc(cacheFrom)

 	}

 	return nil

 }

-func (m *MockBackend) CreateImage(config []byte, parent string, platform string) (builder.Image, error) {

+func (m *MockBackend) CreateImage(config []byte, parent string) (builder.Image, error) {

 	return nil, nil

 }

@@ -127,7 +127,7 @@ func (l *mockLayer) Mount() (containerfs.ContainerFS, error) {

 	return containerfs.NewLocalContainerFS("mountPath"), nil

 }

-func (l *mockLayer) Commit(string) (builder.ReleaseableLayer, error) {

+func (l *mockLayer) Commit() (builder.ReleaseableLayer, error) {

 	return nil, nil

 }

@@ -2,7 +2,6 @@ package daemon

 import (

 	"io"

-	"runtime"

 	"github.com/docker/distribution/reference"

 	"github.com/docker/docker/api/types"

@@ -13,6 +12,7 @@ import (

 	"github.com/docker/docker/pkg/containerfs"

 	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/stringid"

+	"github.com/docker/docker/pkg/system"

 	"github.com/docker/docker/registry"

 	"github.com/pkg/errors"

 	"github.com/sirupsen/logrus"

@@ -55,7 +55,7 @@ func (rl *releaseableLayer) Mount() (containerfs.ContainerFS, error) {

 	return mountPath, nil

 }

-func (rl *releaseableLayer) Commit(os string) (builder.ReleaseableLayer, error) {

+func (rl *releaseableLayer) Commit() (builder.ReleaseableLayer, error) {

 	var chainID layer.ChainID

 	if rl.roLayer != nil {

 		chainID = rl.roLayer.ChainID()

@@ -67,7 +67,7 @@ func (rl *releaseableLayer) Commit(os string) (builder.ReleaseableLayer, error)

 	}

 	defer stream.Close()

-	newLayer, err := rl.layerStore.Register(stream, chainID, layer.OS(os))

+	newLayer, err := rl.layerStore.Register(stream, chainID)

 	if err != nil {

 		return nil, err

 	}

@@ -142,7 +142,7 @@ func newReleasableLayerForImage(img *image.Image, layerStore layer.Store) (build

 }

 // TODO: could this use the regular daemon PullImage ?

-func (daemon *Daemon) pullForBuilder(ctx context.Context, name string, authConfigs map[string]types.AuthConfig, output io.Writer, platform string) (*image.Image, error) {

+func (daemon *Daemon) pullForBuilder(ctx context.Context, name string, authConfigs map[string]types.AuthConfig, output io.Writer, os string) (*image.Image, error) {

 	ref, err := reference.ParseNormalizedNamed(name)

 	if err != nil {

 		return nil, err

@@ -161,7 +161,7 @@ func (daemon *Daemon) pullForBuilder(ctx context.Context, name string, authConfi

 		pullRegistryAuth = &resolvedConfig

 	}

-	if err := daemon.pullImageWithReference(ctx, ref, platform, nil, pullRegistryAuth, output); err != nil {

+	if err := daemon.pullImageWithReference(ctx, ref, os, nil, pullRegistryAuth, output); err != nil {

 		return nil, err

 	}

 	return daemon.GetImage(name)

@@ -172,7 +172,10 @@ func (daemon *Daemon) pullForBuilder(ctx context.Context, name string, authConfi

 // leaking of layers.

 func (daemon *Daemon) GetImageAndReleasableLayer(ctx context.Context, refOrID string, opts backend.GetImageAndLayerOptions) (builder.Image, builder.ReleaseableLayer, error) {

 	if refOrID == "" {

-		layer, err := newReleasableLayerForImage(nil, daemon.stores[opts.OS].layerStore)

+		if !system.IsOSSupported(opts.OS) {

+			return nil, nil, system.ErrNotSupportedOperatingSystem

+		}

+		layer, err := newReleasableLayerForImage(nil, daemon.layerStores[opts.OS])

 		return nil, layer, err

 	}

@@ -183,7 +186,10 @@ func (daemon *Daemon) GetImageAndReleasableLayer(ctx context.Context, refOrID st

 		}

 		// TODO: shouldn't we error out if error is different from "not found" ?

 		if image != nil {

-			layer, err := newReleasableLayerForImage(image, daemon.stores[opts.OS].layerStore)

+			if !system.IsOSSupported(image.OperatingSystem()) {

+				return nil, nil, system.ErrNotSupportedOperatingSystem

+			}

+			layer, err := newReleasableLayerForImage(image, daemon.layerStores[image.OperatingSystem()])

 			return image, layer, err

 		}

 	}

@@ -192,29 +198,29 @@ func (daemon *Daemon) GetImageAndReleasableLayer(ctx context.Context, refOrID st

 	if err != nil {

 		return nil, nil, err

 	}

-	layer, err := newReleasableLayerForImage(image, daemon.stores[opts.OS].layerStore)

+	if !system.IsOSSupported(image.OperatingSystem()) {

+		return nil, nil, system.ErrNotSupportedOperatingSystem

+	}

+	layer, err := newReleasableLayerForImage(image, daemon.layerStores[image.OperatingSystem()])

 	return image, layer, err

 }

 // CreateImage creates a new image by adding a config and ID to the image store.

 // This is similar to LoadImage() except that it receives JSON encoded bytes of

 // an image instead of a tar archive.

-func (daemon *Daemon) CreateImage(config []byte, parent string, platform string) (builder.Image, error) {

-	if platform == "" {

-		platform = runtime.GOOS

-	}

-	id, err := daemon.stores[platform].imageStore.Create(config)

+func (daemon *Daemon) CreateImage(config []byte, parent string) (builder.Image, error) {

+	id, err := daemon.imageStore.Create(config)

 	if err != nil {

 		return nil, errors.Wrapf(err, "failed to create image")

 	}

 	if parent != "" {

-		if err := daemon.stores[platform].imageStore.SetParent(id, image.ID(parent)); err != nil {

+		if err := daemon.imageStore.SetParent(id, image.ID(parent)); err != nil {

 			return nil, errors.Wrapf(err, "failed to set parent %s", parent)

 		}

 	}

-	return daemon.stores[platform].imageStore.Get(id)

+	return daemon.imageStore.Get(id)

 }

 // IDMappings returns uid/gid mappings for the builder

@@ -7,12 +7,12 @@ import (

 )

 // MakeImageCache creates a stateful image cache.

-func (daemon *Daemon) MakeImageCache(sourceRefs []string, platform string) builder.ImageCache {

+func (daemon *Daemon) MakeImageCache(sourceRefs []string) builder.ImageCache {

 	if len(sourceRefs) == 0 {

-		return cache.NewLocal(daemon.stores[platform].imageStore)

+		return cache.NewLocal(daemon.imageStore)

 	}

-	cache := cache.New(daemon.stores[platform].imageStore)

+	cache := cache.New(daemon.imageStore)

 	for _, ref := range sourceRefs {

 		img, err := daemon.GetImage(ref)

@@ -17,6 +17,7 @@ import (

 	"github.com/docker/docker/image"

 	"github.com/docker/docker/layer"

 	"github.com/docker/docker/pkg/ioutils"

+	"github.com/docker/docker/pkg/system"

 	"github.com/pkg/errors"

 )

@@ -149,12 +150,15 @@ func (daemon *Daemon) Commit(name string, c *backend.ContainerCommitConfig) (str

 		daemon.containerPause(container)

 		defer daemon.containerUnpause(container)

 	}

+	if !system.IsOSSupported(container.OS) {

+		return "", system.ErrNotSupportedOperatingSystem

+	}

 	if c.MergeConfigs && c.Config == nil {

 		c.Config = container.Config

 	}

-	newConfig, err := dockerfile.BuildFromConfig(c.Config, c.Changes)

+	newConfig, err := dockerfile.BuildFromConfig(c.Config, c.Changes, container.OS)

 	if err != nil {

 		return "", err

 	}

@@ -180,17 +184,17 @@ func (daemon *Daemon) Commit(name string, c *backend.ContainerCommitConfig) (str

 		parent = new(image.Image)

 		parent.RootFS = image.NewRootFS()

 	} else {

-		parent, err = daemon.stores[container.OS].imageStore.Get(container.ImageID)

+		parent, err = daemon.imageStore.Get(container.ImageID)

 		if err != nil {

 			return "", err

 		}

 	}

-	l, err := daemon.stores[container.OS].layerStore.Register(rwTar, parent.RootFS.ChainID(), layer.OS(container.OS))

+	l, err := daemon.layerStores[container.OS].Register(rwTar, parent.RootFS.ChainID())

 	if err != nil {

 		return "", err

 	}

-	defer layer.ReleaseAndLog(daemon.stores[container.OS].layerStore, l)

+	defer layer.ReleaseAndLog(daemon.layerStores[container.OS], l)

 	containerConfig := c.ContainerConfig

 	if containerConfig == nil {

@@ -209,13 +213,13 @@ func (daemon *Daemon) Commit(name string, c *backend.ContainerCommitConfig) (str

 		return "", err

 	}

-	id, err := daemon.stores[container.OS].imageStore.Create(config)

+	id, err := daemon.imageStore.Create(config)

 	if err != nil {

 		return "", err

 	}

 	if container.ImageID != "" {

-		if err := daemon.stores[container.OS].imageStore.SetParent(id, container.ImageID); err != nil {

+		if err := daemon.imageStore.SetParent(id, container.ImageID); err != nil {

 			return "", err

 		}

 	}

@@ -234,7 +238,7 @@ func (daemon *Daemon) Commit(name string, c *backend.ContainerCommitConfig) (str

 				return "", err

 			}

 		}

-		if err := daemon.TagImageWithReference(id, container.OS, newTag); err != nil {

+		if err := daemon.TagImageWithReference(id, newTag); err != nil {

 			return "", err

 		}

 		imageRef = reference.FamiliarString(newTag)

@@ -251,13 +255,14 @@ func (daemon *Daemon) Commit(name string, c *backend.ContainerCommitConfig) (str

 }

 func (daemon *Daemon) exportContainerRw(container *container.Container) (arch io.ReadCloser, err error) {

-	rwlayer, err := daemon.stores[container.OS].layerStore.GetRWLayer(container.ID)

+	// Note: Indexing by OS is safe as only called from `Commit` which has already performed validation

+	rwlayer, err := daemon.layerStores[container.OS].GetRWLayer(container.ID)

 	if err != nil {

 		return nil, err

 	}

 	defer func() {

 		if err != nil {

-			daemon.stores[container.OS].layerStore.ReleaseRWLayer(rwlayer)

+			daemon.layerStores[container.OS].ReleaseRWLayer(rwlayer)

 		}

 	}()

@@ -278,7 +283,7 @@ func (daemon *Daemon) exportContainerRw(container *container.Container) (arch io

 	return ioutils.NewReadCloserWrapper(archive, func() error {

 			archive.Close()

 			err = rwlayer.Unmount()

-			daemon.stores[container.OS].layerStore.ReleaseRWLayer(rwlayer)

+			daemon.layerStores[container.OS].ReleaseRWLayer(rwlayer)

 			return err

 		}),

 		nil

@@ -257,7 +257,7 @@ func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig)

 func (daemon *Daemon) setRWLayer(container *container.Container) error {

 	var layerID layer.ChainID

 	if container.ImageID != "" {

-		img, err := daemon.stores[container.OS].imageStore.Get(container.ImageID)

+		img, err := daemon.imageStore.Get(container.ImageID)

 		if err != nil {

 			return err

 		}

@@ -270,7 +270,9 @@ func (daemon *Daemon) setRWLayer(container *container.Container) error {

 		StorageOpt: container.HostConfig.StorageOpt,

 	}

-	rwLayer, err := daemon.stores[container.OS].layerStore.CreateRWLayer(container.ID, layerID, rwLayerOpts)

+	// Indexing by OS is safe here as validation of OS has already been performed in create() (the only

+	// caller), and guaranteed non-nil

+	rwLayer, err := daemon.layerStores[container.OS].CreateRWLayer(container.ID, layerID, rwLayerOpts)

 	if err != nil {

 		return err

 	}

@@ -69,50 +69,46 @@ var (

 	errSystemNotSupported = errors.New("the Docker daemon is not supported on this platform")

 )

-type daemonStore struct {

-	graphDriver               string

-	imageRoot                 string

-	imageStore                image.Store

-	layerStore                layer.Store

-	distributionMetadataStore dmetadata.Store

-}

-

 // Daemon holds information about the Docker daemon.

 type Daemon struct {

-	ID                    string

-	repository            string

-	containers            container.Store

-	containersReplica     container.ViewDB

-	execCommands          *exec.Store

-	downloadManager       *xfer.LayerDownloadManager

-	uploadManager         *xfer.LayerUploadManager

-	trustKey              libtrust.PrivateKey

-	idIndex               *truncindex.TruncIndex

-	configStore           *config.Config

-	statsCollector        *stats.Collector

-	defaultLogConfig      containertypes.LogConfig

-	RegistryService       registry.Service

-	EventsService         *events.Events

-	netController         libnetwork.NetworkController

-	volumes               *store.VolumeStore

-	discoveryWatcher      discovery.Reloader

-	root                  string

-	seccompEnabled        bool

-	apparmorEnabled       bool

-	shutdown              bool

-	idMappings            *idtools.IDMappings

-	stores                map[string]daemonStore // By container target platform

-	referenceStore        refstore.Store

-	PluginStore           *plugin.Store // todo: remove

-	pluginManager         *plugin.Manager

-	linkIndex             *linkIndex

-	containerd            libcontainerd.Client

-	containerdRemote      libcontainerd.Remote

-	defaultIsolation      containertypes.Isolation // Default isolation mode on Windows

-	clusterProvider       cluster.Provider

-	cluster               Cluster

-	genericResources      []swarm.GenericResource

-	metricsPluginListener net.Listener

+	ID                        string

+	repository                string

+	containers                container.Store

+	containersReplica         container.ViewDB

+	execCommands              *exec.Store

+	downloadManager           *xfer.LayerDownloadManager

+	uploadManager             *xfer.LayerUploadManager

+	trustKey                  libtrust.PrivateKey

+	idIndex                   *truncindex.TruncIndex

+	configStore               *config.Config

+	statsCollector            *stats.Collector

+	defaultLogConfig          containertypes.LogConfig

+	RegistryService           registry.Service

+	EventsService             *events.Events

+	netController             libnetwork.NetworkController

+	volumes                   *store.VolumeStore

+	discoveryWatcher          discovery.Reloader

+	root                      string

+	seccompEnabled            bool

+	apparmorEnabled           bool

+	shutdown                  bool

+	idMappings                *idtools.IDMappings

+	graphDrivers              map[string]string // By operating system

+	referenceStore            refstore.Store

+	imageStore                image.Store

+	imageRoot                 string

+	layerStores               map[string]layer.Store // By operating system

+	distributionMetadataStore dmetadata.Store

+	PluginStore               *plugin.Store // todo: remove

+	pluginManager             *plugin.Manager

+	linkIndex                 *linkIndex

+	containerd                libcontainerd.Client

+	containerdRemote          libcontainerd.Remote

+	defaultIsolation          containertypes.Isolation // Default isolation mode on Windows

+	clusterProvider           cluster.Provider

+	cluster                   Cluster

+	genericResources          []swarm.GenericResource

+	metricsPluginListener     net.Listener

 	machineMemory uint64

@@ -159,11 +155,14 @@ func (daemon *Daemon) restore() error {

 			logrus.Errorf("Failed to load container %v: %v", id, err)

 			continue

 		}

-

+		if !system.IsOSSupported(container.OS) {

+			logrus.Errorf("Failed to load container %v: %s (%q)", id, system.ErrNotSupportedOperatingSystem, container.OS)

+			continue

+		}

 		// Ignore the container if it does not support the current driver being used by the graph

-		currentDriverForContainerOS := daemon.stores[container.OS].graphDriver

+		currentDriverForContainerOS := daemon.graphDrivers[container.OS]

 		if (container.Driver == "" && currentDriverForContainerOS == "aufs") || container.Driver == currentDriverForContainerOS {

-			rwlayer, err := daemon.stores[container.OS].layerStore.GetRWLayer(container.ID)

+			rwlayer, err := daemon.layerStores[container.OS].GetRWLayer(container.ID)

 			if err != nil {

 				logrus.Errorf("Failed to load container mount %v: %v", id, err)

 				continue

@@ -706,11 +705,12 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 	// lcow. Unix platforms however run a single graphdriver for all containers, and it can

 	// be set through an environment variable, a daemon start parameter, or chosen through

 	// initialization of the layerstore through driver priority order for example.

-	d.stores = make(map[string]daemonStore)

+	d.graphDrivers = make(map[string]string)

+	d.layerStores = make(map[string]layer.Store)

 	if runtime.GOOS == "windows" {

-		d.stores["windows"] = daemonStore{graphDriver: "windowsfilter"}

+		d.graphDrivers[runtime.GOOS] = "windowsfilter"

 		if system.LCOWSupported() {

-			d.stores["linux"] = daemonStore{graphDriver: "lcow"}

+			d.graphDrivers["linux"] = "lcow"

 		}

 	} else {

 		driverName := os.Getenv("DOCKER_DRIVER")

@@ -719,7 +719,7 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 		} else {

 			logrus.Infof("Setting the storage driver from the $DOCKER_DRIVER environment variable (%s)", driverName)

 		}

-		d.stores[runtime.GOOS] = daemonStore{graphDriver: driverName} // May still be empty. Layerstore init determines instead.

+		d.graphDrivers[runtime.GOOS] = driverName // May still be empty. Layerstore init determines instead.

 	}

 	d.RegistryService = registryService

@@ -750,12 +750,11 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 		return nil, errors.Wrap(err, "couldn't create plugin manager")

 	}

-	var graphDrivers []string

-	for operatingSystem, ds := range d.stores {

-		ls, err := layer.NewStoreFromOptions(layer.StoreOptions{

-			StorePath:                 config.Root,

+	for operatingSystem, gd := range d.graphDrivers {

+		d.layerStores[operatingSystem], err = layer.NewStoreFromOptions(layer.StoreOptions{

+			Root: config.Root,

 			MetadataStorePathTemplate: filepath.Join(config.Root, "image", "%s", "layerdb"),

-			GraphDriver:               ds.graphDriver,

+			GraphDriver:               gd,

 			GraphDriverOptions:        config.GraphOptions,

 			IDMappings:                idMappings,

 			PluginGetter:              d.PluginStore,

@@ -765,40 +764,37 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 		if err != nil {

 			return nil, err

 		}

-		ds.graphDriver = ls.DriverName() // As layerstore may set the driver

-		ds.layerStore = ls

-		d.stores[operatingSystem] = ds

-		graphDrivers = append(graphDrivers, ls.DriverName())

 	}

-	// Configure and validate the kernels security support

-	if err := configureKernelSecuritySupport(config, graphDrivers); err != nil {

+	// As layerstore initialization may set the driver

+	for os := range d.graphDrivers {

+		d.graphDrivers[os] = d.layerStores[os].DriverName()

+	}

+

+	// Configure and validate the kernels security support. Note this is a Linux/FreeBSD

+	// operation only, so it is safe to pass *just* the runtime OS graphdriver.

+	if err := configureKernelSecuritySupport(config, d.graphDrivers[runtime.GOOS]); err != nil {

 		return nil, err

 	}

 	logrus.Debugf("Max Concurrent Downloads: %d", *config.MaxConcurrentDownloads)

-	lsMap := make(map[string]layer.Store)

-	for operatingSystem, ds := range d.stores {

-		lsMap[operatingSystem] = ds.layerStore

-	}

-	d.downloadManager = xfer.NewLayerDownloadManager(lsMap, *config.MaxConcurrentDownloads)

+	d.downloadManager = xfer.NewLayerDownloadManager(d.layerStores, *config.MaxConcurrentDownloads)

 	logrus.Debugf("Max Concurrent Uploads: %d", *config.MaxConcurrentUploads)

 	d.uploadManager = xfer.NewLayerUploadManager(*config.MaxConcurrentUploads)

-	for operatingSystem, ds := range d.stores {

-		imageRoot := filepath.Join(config.Root, "image", ds.graphDriver)

-		ifs, err := image.NewFSStoreBackend(filepath.Join(imageRoot, "imagedb"))

-		if err != nil {

-			return nil, err

-		}

-		var is image.Store

-		is, err = image.NewImageStore(ifs, operatingSystem, ds.layerStore)

-		if err != nil {

-			return nil, err

-		}

-		ds.imageRoot = imageRoot

-		ds.imageStore = is

-		d.stores[operatingSystem] = ds

+	d.imageRoot = filepath.Join(config.Root, "image", d.graphDrivers[runtime.GOOS])

+	ifs, err := image.NewFSStoreBackend(filepath.Join(d.imageRoot, "imagedb"))

+	if err != nil {

+		return nil, err

+	}

+

+	lgrMap := make(map[string]image.LayerGetReleaser)

+	for os, ls := range d.layerStores {

+		lgrMap[os] = ls

+	}

+	d.imageStore, err = image.NewImageStore(ifs, lgrMap)

+	if err != nil {

+		return nil, err

 	}

 	// Configure the volumes driver

@@ -830,30 +826,25 @@ func NewDaemon(config *config.Config, registryService registry.Service, containe

 	// operating systems, the list of graphdrivers available isn't user configurable.

 	// For backwards compatibility, we just put it under the windowsfilter

 	// directory regardless.

-	refStoreLocation := filepath.Join(d.stores[runtime.GOOS].imageRoot, `repositories.json`)

+	refStoreLocation := filepath.Join(d.imageRoot, `repositories.json`)

 	rs, err := refstore.NewReferenceStore(refStoreLocation)

 	if err != nil {

 		return nil, fmt.Errorf("Couldn't create reference store repository: %s", err)

 	}

 	d.referenceStore = rs

-	for platform, ds := range d.stores {

-		dms, err := dmetadata.NewFSMetadataStore(filepath.Join(ds.imageRoot, "distribution"), platform)

-		if err != nil {

-			return nil, err

-		}

-

-		ds.distributionMetadataStore = dms

-		d.stores[platform] = ds

+	d.distributionMetadataStore, err = dmetadata.NewFSMetadataStore(filepath.Join(d.imageRoot, "distribution"))

+	if err != nil {

+		return nil, err

+	}

-		// No content-addressability migration on Windows as it never supported pre-CA

-		if runtime.GOOS != "windows" {