@@ -115,12 +115,12 @@ github.com/googleapis/gax-go v2.0.0

 google.golang.org/genproto 694d95ba50e67b2e363f3483057db5d4910c18f9

 # containerd

-github.com/containerd/containerd v1.2.0-beta.2

+github.com/containerd/containerd d97a907f7f781c0ab8340877d8e6b53cc7f1c2f6

 github.com/containerd/fifo 3d5202aec260678c48179c56f40e6f38a095738c

-github.com/containerd/continuity c7c5070e6f6e090ab93b0a61eb921f2196fc3383

+github.com/containerd/continuity f44b615e492bdfb371aae2f76ec694d9da1db537

 github.com/containerd/cgroups 5e610833b72089b37d0e615de9a92dfc043757c2

 github.com/containerd/console c12b1e7919c14469339a5d38f2f8ed9b64a9de23

-github.com/containerd/go-runc edcf3de1f4971445c42d61f20d506b30612aa031

+github.com/containerd/go-runc 5a6d9f37cfa36b15efba46dc7ea349fa9b7143c3

 github.com/containerd/typeurl a93fcdb778cd272c6e9b3028b2f42d813e785d40

 github.com/containerd/ttrpc 94dde388801693c54f88a6596f713b51a8b30b2d

 github.com/gogo/googleapis 08a7655d27152912db7aaf4f983275eaf8d128ef

@@ -2,6 +2,7 @@

 [![GoDoc](https://godoc.org/github.com/containerd/containerd?status.svg)](https://godoc.org/github.com/containerd/containerd)

 [![Build Status](https://travis-ci.org/containerd/containerd.svg?branch=master)](https://travis-ci.org/containerd/containerd)

+[![Windows Build Status](https://ci.appveyor.com/api/projects/status/github/containerd/containerd?branch=master&svg=true)](https://ci.appveyor.com/project/mlaventure/containerd-3g73f?branch=master)

 [![FOSSA Status](https://app.fossa.io/api/projects/git%2Bhttps%3A%2F%2Fgithub.com%2Fcontainerd%2Fcontainerd.svg?type=shield)](https://app.fossa.io/projects/git%2Bhttps%3A%2F%2Fgithub.com%2Fcontainerd%2Fcontainerd?ref=badge_shield)

 [![Go Report Card](https://goreportcard.com/badge/github.com/containerd/containerd)](https://goreportcard.com/report/github.com/containerd/containerd)

 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1271/badge)](https://bestpractices.coreinfrastructure.org/projects/1271)

@@ -223,7 +224,7 @@ This will be the best place to discuss design and implementation.

 For sync communication we have a community slack with a #containerd channel that everyone is welcome to join and chat about development.

-**Slack:** https://dockr.ly/community

+**Slack:** https://join.slack.com/t/dockercommunity/shared_invite/enQtNDM4NjAwNDMyOTUwLWZlMDZmYWRjZjk4Zjc5ZGQ5NWZkOWI1Yjk2NGE3ZWVlYjYxM2VhYjczOWIyZDFhZTE3NTUwZWQzMjhmNGYyZTg

 ### Reporting security issues

@@ -141,7 +141,7 @@ type EventsClient interface {

 	// Forward sends an event that has already been packaged into an envelope

 	// with a timestamp and namespace.

 	//

-	// This is useful if earlier timestamping is required or when fowarding on

+	// This is useful if earlier timestamping is required or when forwarding on

 	// behalf of another component, namespace or publisher.

 	Forward(ctx context.Context, in *ForwardRequest, opts ...grpc.CallOption) (*google_protobuf2.Empty, error)

 	// Subscribe to a stream of events, possibly returning only that match any

@@ -223,7 +223,7 @@ type EventsServer interface {

 	// Forward sends an event that has already been packaged into an envelope

 	// with a timestamp and namespace.

 	//

-	// This is useful if earlier timestamping is required or when fowarding on

+	// This is useful if earlier timestamping is required or when forwarding on

 	// behalf of another component, namespace or publisher.

 	Forward(context.Context, *ForwardRequest) (*google_protobuf2.Empty, error)

 	// Subscribe to a stream of events, possibly returning only that match any

@@ -20,7 +20,7 @@ service Events {

 	// Forward sends an event that has already been packaged into an envelope

 	// with a timestamp and namespace.

 	//

-	// This is useful if earlier timestamping is required or when fowarding on

+	// This is useful if earlier timestamping is required or when forwarding on

 	// behalf of another component, namespace or publisher.

 	rpc Forward(ForwardRequest) returns (google.protobuf.Empty);

@@ -141,6 +141,15 @@ func NewCreator(opts ...Opt) Creator {

 		if err != nil {

 			return nil, err

 		}

+		if streams.Stdin == nil {

+			fifos.Stdin = ""

+		}

+		if streams.Stdout == nil {

+			fifos.Stdout = ""

+		}

+		if streams.Stderr == nil {

+			fifos.Stderr = ""

+		}

 		return copyIO(fifos, streams)

 	}

 }

@@ -20,25 +20,21 @@ package containerd

 import (

 	"context"

-	"encoding/json"

 	"fmt"

 	"os"

 	"path/filepath"

 	"syscall"

-	"github.com/containerd/containerd/api/types"

 	"github.com/containerd/containerd/containers"

 	"github.com/containerd/containerd/content"

 	"github.com/containerd/containerd/errdefs"

 	"github.com/containerd/containerd/images"

 	"github.com/containerd/containerd/mount"

 	"github.com/containerd/containerd/platforms"

-	"github.com/containerd/containerd/runtime/linux/runctypes"

 	"github.com/gogo/protobuf/proto"

 	protobuf "github.com/gogo/protobuf/types"

 	"github.com/opencontainers/image-spec/identity"

 	"github.com/opencontainers/image-spec/specs-go/v1"

-	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

 	"github.com/pkg/errors"

 )

@@ -105,44 +101,6 @@ func WithCheckpoint(im Image, snapshotKey string) NewContainerOpts {

 	}

 }

-// WithTaskCheckpoint allows a task to be created with live runtime and memory data from a

-// previous checkpoint. Additional software such as CRIU may be required to

-// restore a task from a checkpoint

-func WithTaskCheckpoint(im Image) NewTaskOpts {

-	return func(ctx context.Context, c *Client, info *TaskInfo) error {

-		desc := im.Target()

-		id := desc.Digest

-		index, err := decodeIndex(ctx, c.ContentStore(), desc)

-		if err != nil {

-			return err

-		}

-		for _, m := range index.Manifests {

-			if m.MediaType == images.MediaTypeContainerd1Checkpoint {

-				info.Checkpoint = &types.Descriptor{

-					MediaType: m.MediaType,

-					Size_:     m.Size,

-					Digest:    m.Digest,

-				}

-				return nil

-			}

-		}

-		return fmt.Errorf("checkpoint not found in index %s", id)

-	}

-}

-

-func decodeIndex(ctx context.Context, store content.Provider, desc ocispec.Descriptor) (*v1.Index, error) {

-	var index v1.Index

-	p, err := content.ReadBlob(ctx, store, desc)

-	if err != nil {

-		return nil, err

-	}

-	if err := json.Unmarshal(p, &index); err != nil {

-		return nil, err

-	}

-

-	return &index, nil

-}

-

 // WithRemappedSnapshot creates a new snapshot and remaps the uid/gid for the

 // filesystem to be used by a container with user namespaces

 func WithRemappedSnapshot(id string, i Image, uid, gid uint32) NewContainerOpts {

@@ -221,19 +179,3 @@ func incrementFS(root string, uidInc, gidInc uint32) filepath.WalkFunc {

 		return os.Lchown(path, u, g)

 	}

 }

-

-// WithNoPivotRoot instructs the runtime not to you pivot_root

-func WithNoPivotRoot(_ context.Context, _ *Client, info *TaskInfo) error {

-	if info.Options == nil {

-		info.Options = &runctypes.CreateOptions{

-			NoPivotRoot: true,

-		}

-		return nil

-	}

-	copts, ok := info.Options.(*runctypes.CreateOptions)

-	if !ok {

-		return errors.New("invalid options type, expected runctypes.CreateOptions")

-	}

-	copts.NoPivotRoot = true

-	return nil

-}

@@ -33,6 +33,8 @@ import (

 	"github.com/containerd/containerd/errdefs"

 	"github.com/containerd/containerd/filters"

 	"github.com/containerd/containerd/log"

+

+	"github.com/containerd/continuity"

 	digest "github.com/opencontainers/go-digest"

 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

 	"github.com/pkg/errors"

@@ -651,5 +653,5 @@ func writeTimestampFile(p string, t time.Time) error {

 		return err

 	}

-	return ioutil.WriteFile(p, b, 0666)

+	return continuity.AtomicWriteFile(p, b, 0666)

 }

@@ -132,11 +132,11 @@ func (w *writer) Commit(ctx context.Context, size int64, expected digest.Digest,

 	// clean up!!

 	defer os.RemoveAll(w.path)

+	if _, err := os.Stat(target); err == nil {

+		// collision with the target file!

+		return errors.Wrapf(errdefs.ErrAlreadyExists, "content %v", dgst)

+	}

 	if err := os.Rename(ingest, target); err != nil {

-		if os.IsExist(err) {

-			// collision with the target file!

-			return errors.Wrapf(errdefs.ErrAlreadyExists, "content %v", dgst)

-		}

 		return err

 	}

 	commitTime := time.Now()

@@ -30,7 +30,7 @@ import (

 )

 // WithProfile receives the name of a file stored on disk comprising a json

-// formated seccomp profile, as specified by the opencontainers/runtime-spec.

+// formatted seccomp profile, as specified by the opencontainers/runtime-spec.

 // The profile is read from the file, unmarshaled, and set to the spec.

 func WithProfile(profile string) oci.SpecOpts {

 	return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error {

@@ -52,7 +52,7 @@ var _ events.Subscriber = &Exchange{}

 // Forward accepts an envelope to be direcly distributed on the exchange.

 //

-// This is useful when an event is forwaded on behalf of another namespace or

+// This is useful when an event is forwarded on behalf of another namespace or

 // when the event is propagated on behalf of another publisher.

 func (e *Exchange) Forward(ctx context.Context, envelope *events.Envelope) (err error) {

 	if err := validateEnvelope(envelope); err != nil {

new file mode 100644

@@ -0,0 +1,57 @@

+/*

+   Copyright The containerd Authors.

+

+   Licensed under the Apache License, Version 2.0 (the "License");

+   you may not use this file except in compliance with the License.

+   You may obtain a copy of the License at

+

+       http://www.apache.org/licenses/LICENSE-2.0

+

+   Unless required by applicable law or agreed to in writing, software

+   distributed under the License is distributed on an "AS IS" BASIS,

+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

+   See the License for the specific language governing permissions and

+   limitations under the License.

+*/

+

+package containerd

+

+import (

+	"context"

+	"io"

+

+	"github.com/containerd/containerd/images"

+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

+)

+

+type exportOpts struct {

+}

+

+// ExportOpt allows the caller to specify export-specific options

+type ExportOpt func(c *exportOpts) error

+

+func resolveExportOpt(opts ...ExportOpt) (exportOpts, error) {

+	var eopts exportOpts

+	for _, o := range opts {

+		if err := o(&eopts); err != nil {

+			return eopts, err

+		}

+	}

+	return eopts, nil

+}

+

+// Export exports an image to a Tar stream.

+// OCI format is used by default.

+// It is up to caller to put "org.opencontainers.image.ref.name" annotation to desc.

+// TODO(AkihiroSuda): support exporting multiple descriptors at once to a single archive stream.

+func (c *Client) Export(ctx context.Context, exporter images.Exporter, desc ocispec.Descriptor, opts ...ExportOpt) (io.ReadCloser, error) {

+	_, err := resolveExportOpt(opts...) // unused now

+	if err != nil {

+		return nil, err

+	}

+	pr, pw := io.Pipe()

+	go func() {

+		pw.CloseWithError(exporter.Export(ctx, c.ContentStore(), desc, pw))

+	}()

+	return pr, nil

+}

@@ -22,7 +22,6 @@ import (

 	"github.com/containerd/containerd/errdefs"

 	"github.com/containerd/containerd/images"

-	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

 )

 type importOpts struct {

@@ -84,35 +83,3 @@ func (c *Client) Import(ctx context.Context, importer images.Importer, reader io

 	}

 	return images, nil

 }

-

-type exportOpts struct {

-}

-

-// ExportOpt allows the caller to specify export-specific options

-type ExportOpt func(c *exportOpts) error

-

-func resolveExportOpt(opts ...ExportOpt) (exportOpts, error) {

-	var eopts exportOpts

-	for _, o := range opts {

-		if err := o(&eopts); err != nil {

-			return eopts, err

-		}

-	}

-	return eopts, nil

-}

-

-// Export exports an image to a Tar stream.

-// OCI format is used by default.

-// It is up to caller to put "org.opencontainers.image.ref.name" annotation to desc.

-// TODO(AkihiroSuda): support exporting multiple descriptors at once to a single archive stream.

-func (c *Client) Export(ctx context.Context, exporter images.Exporter, desc ocispec.Descriptor, opts ...ExportOpt) (io.ReadCloser, error) {

-	_, err := resolveExportOpt(opts...) // unused now

-	if err != nil {

-		return nil, err

-	}

-	pr, pw := io.Pipe()

-	go func() {

-		pw.CloseWithError(exporter.Export(ctx, c.ContentStore(), desc, pw))

-	}()

-	return pr, nil

-}

@@ -33,25 +33,14 @@ import (

 // Install a binary image into the opt service

 func (c *Client) Install(ctx context.Context, image Image, opts ...InstallOpts) error {

-	resp, err := c.IntrospectionService().Plugins(ctx, &introspectionapi.PluginsRequest{

-		Filters: []string{

-			"id==opt",

-		},

-	})

-	if err != nil {

-		return err

-	}

-	if len(resp.Plugins) != 1 {

-		return errors.New("opt service not enabled")

-	}

-	path := resp.Plugins[0].Exports["path"]

-	if path == "" {

-		return errors.New("opt path not exported")

-	}

 	var config InstallConfig

 	for _, o := range opts {

 		o(&config)

 	}

+	path, err := c.getInstallPath(ctx, config)

+	if err != nil {

+		return err

+	}

 	var (

 		cs       = image.ContentStore()

 		platform = platforms.Default()

@@ -89,3 +78,25 @@ func (c *Client) Install(ctx context.Context, image Image, opts ...InstallOpts)

 	}

 	return nil

 }

+

+func (c *Client) getInstallPath(ctx context.Context, config InstallConfig) (string, error) {

+	if config.Path != "" {

+		return config.Path, nil

+	}

+	resp, err := c.IntrospectionService().Plugins(ctx, &introspectionapi.PluginsRequest{

+		Filters: []string{

+			"id==opt",

+		},

+	})

+	if err != nil {

+		return "", err

+	}

+	if len(resp.Plugins) != 1 {

+		return "", errors.New("opt service not enabled")

+	}

+	path := resp.Plugins[0].Exports["path"]

+	if path == "" {

+		return "", errors.New("opt path not exported")

+	}

+	return path, nil

+}

@@ -25,6 +25,8 @@ type InstallConfig struct {

 	Libs bool

 	// Replace will overwrite existing binaries or libs in the opt directory

 	Replace bool

+	// Path to install libs and binaries to

+	Path string

 }

 // WithInstallLibs installs libs from the image

@@ -36,3 +38,10 @@ func WithInstallLibs(c *InstallConfig) {

 func WithInstallReplace(c *InstallConfig) {

 	c.Replace = true

 }

+

+// WithInstallPath sets the optional install path

+func WithInstallPath(path string) InstallOpts {

+	return func(c *InstallConfig) {

+		c.Path = path

+	}

+}

@@ -19,8 +19,8 @@ package metadata

 import (

 	"context"

-	"github.com/boltdb/bolt"

 	"github.com/pkg/errors"

+	bolt "go.etcd.io/bbolt"

 )

 type transactionKey struct{}

@@ -19,8 +19,8 @@ package boltutil

 import (

 	"time"

-	"github.com/boltdb/bolt"

 	"github.com/pkg/errors"

+	bolt "go.etcd.io/bbolt"

 )

 var (

@@ -17,11 +17,11 @@

 package metadata

 import (

-	"github.com/boltdb/bolt"

 	digest "github.com/opencontainers/go-digest"

+	bolt "go.etcd.io/bbolt"

 )

-// The layout where a "/" delineates a bucket is desribed in the following

+// The layout where a "/" delineates a bucket is described in the following

 // section. Please try to follow this as closely as possible when adding

 // functionality. We can bolster this with helpers and more structure if that

 // becomes an issue.

@@ -164,11 +164,11 @@ func getSnapshotterBucket(tx *bolt.Tx, namespace, snapshotter string) *bolt.Buck

 }

 func createBlobBucket(tx *bolt.Tx, namespace string, dgst digest.Digest) (*bolt.Bucket, error) {

-	bkt, err := createBucketIfNotExists(tx, bucketKeyVersion, []byte(namespace), bucketKeyObjectContent, bucketKeyObjectBlob, []byte(dgst.String()))

+	bkt, err := createBucketIfNotExists(tx, bucketKeyVersion, []byte(namespace), bucketKeyObjectContent, bucketKeyObjectBlob)

 	if err != nil {

 		return nil, err

 	}

-	return bkt, nil

+	return bkt.CreateBucket([]byte(dgst.String()))

 }

 func getBlobsBucket(tx *bolt.Tx, namespace string) *bolt.Bucket {

@@ -21,7 +21,6 @@ import (

 	"strings"

 	"time"

-	"github.com/boltdb/bolt"

 	"github.com/containerd/containerd/containers"

 	"github.com/containerd/containerd/errdefs"

 	"github.com/containerd/containerd/filters"

@@ -32,6 +31,7 @@ import (

 	"github.com/gogo/protobuf/proto"

 	"github.com/gogo/protobuf/types"

 	"github.com/pkg/errors"

+	bolt "go.etcd.io/bbolt"

 )

 type containerStore struct {

@@ -23,7 +23,6 @@ import (

 	"sync"

 	"time"

-	"github.com/boltdb/bolt"

 	"github.com/containerd/containerd/content"

 	"github.com/containerd/containerd/errdefs"

 	"github.com/containerd/containerd/filters"

@@ -34,6 +33,7 @@ import (

 	digest "github.com/opencontainers/go-digest"

 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

 	"github.com/pkg/errors"

+	bolt "go.etcd.io/bbolt"

 )

 type contentStore struct {

@@ -592,9 +592,6 @@ func (nw *namespacedWriter) commit(ctx context.Context, tx *bolt.Tx, size int64,

 		}

 		size = nw.desc.Size

 		actual = nw.desc.Digest

-		if getBlobBucket(tx, nw.namespace, actual) != nil {

-			return "", errors.Wrapf(errdefs.ErrAlreadyExists, "content %v", actual)

-		}

 	} else {

 		status, err := nw.w.Status()

 		if err != nil {

@@ -606,18 +603,16 @@ func (nw *namespacedWriter) commit(ctx context.Context, tx *bolt.Tx, size int64,

 		size = status.Offset

 		actual = nw.w.Digest()

-		if err := nw.w.Commit(ctx, size, expected); err != nil {

-			if !errdefs.IsAlreadyExists(err) {

-				return "", err

-			}

-			if getBlobBucket(tx, nw.namespace, actual) != nil {

-				return "", errors.Wrapf(errdefs.ErrAlreadyExists, "content %v", actual)

-			}

+		if err := nw.w.Commit(ctx, size, expected); err != nil && !errdefs.IsAlreadyExists(err) {

+			return "", err

 		}

 	}

 	bkt, err := createBlobBucket(tx, nw.namespace, actual)

 	if err != nil {

+		if err == bolt.ErrBucketExists {

+			return "", errors.Wrapf(errdefs.ErrAlreadyExists, "content %v", actual)

+		}

 		return "", err

 	}

@@ -23,12 +23,12 @@ import (

 	"sync"

 	"time"

-	"github.com/boltdb/bolt"

 	"github.com/containerd/containerd/content"

 	"github.com/containerd/containerd/gc"

 	"github.com/containerd/containerd/log"

 	"github.com/containerd/containerd/snapshots"

 	"github.com/pkg/errors"

+	bolt "go.etcd.io/bbolt"

 )

 const (

@@ -43,7 +43,7 @@ const (

 	// dbVersion represents updates to the schema

 	// version which are additions and compatible with

 	// prior version of the same schema.

-	dbVersion = 2

+	dbVersion = 3

 )

 // DB represents a metadata database backed by a bolt

@@ -23,10 +23,10 @@ import (

 	"strings"

 	"time"

-	"github.com/boltdb/bolt"

 	"github.com/containerd/containerd/gc"

 	"github.com/containerd/containerd/log"

 	"github.com/pkg/errors"

+	bolt "go.etcd.io/bbolt"

 )

 const (

@@ -23,7 +23,6 @@ import (

 	"strings"

 	"time"

-	"github.com/boltdb/bolt"

 	"github.com/containerd/containerd/errdefs"

 	"github.com/containerd/containerd/filters"

 	"github.com/containerd/containerd/images"

@@ -33,6 +32,7 @@ import (

 	digest "github.com/opencontainers/go-digest"

 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

 	"github.com/pkg/errors"

+	bolt "go.etcd.io/bbolt"

 )

 type imageStore struct {

@@ -20,7 +20,6 @@ import (

 	"context"

 	"time"

-	"github.com/boltdb/bolt"

 	"github.com/containerd/containerd/errdefs"

 	"github.com/containerd/containerd/filters"

 	"github.com/containerd/containerd/leases"

@@ -28,6 +27,7 @@ import (

 	"github.com/containerd/containerd/namespaces"

 	digest "github.com/opencontainers/go-digest"

 	"github.com/pkg/errors"

+	bolt "go.etcd.io/bbolt"

 )

 // LeaseManager manages the create/delete lifecyle of leases

@@ -16,7 +16,7 @@

 package metadata

-import "github.com/boltdb/bolt"

+import bolt "go.etcd.io/bbolt"

 type migration struct {

 	schema  string

@@ -45,6 +45,11 @@ var migrations = []migration{

 		version: 2,

 		migrate: migrateIngests,

 	},

+	{

+		schema:  "v1",

+		version: 3,

+		migrate: noOpMigration,

+	},

 }

 // addChildLinks Adds children key to the snapshotters to enforce snapshot

@@ -154,3 +159,10 @@ func migrateIngests(tx *bolt.Tx) error {

 	return nil

 }

+

+// noOpMigration was for a database change from boltdb/bolt which is no

+// longer being supported, to go.etcd.io/bbolt which is the currently

+// maintained repo for boltdb.

+func noOpMigration(tx *bolt.Tx) error {

+	return nil

+}

@@ -19,11 +19,11 @@ package metadata

 import (

 	"context"

-	"github.com/boltdb/bolt"

 	"github.com/containerd/containerd/errdefs"

 	l "github.com/containerd/containerd/labels"

 	"github.com/containerd/containerd/namespaces"

 	"github.com/pkg/errors"

+	bolt "go.etcd.io/bbolt"

 )

 type namespaceStore struct {

@@ -23,7 +23,6 @@ import (

 	"sync"

 	"time"

-	"github.com/boltdb/bolt"

 	"github.com/containerd/containerd/errdefs"

 	"github.com/containerd/containerd/labels"

 	"github.com/containerd/containerd/log"

@@ -32,6 +31,7 @@ import (

 	"github.com/containerd/containerd/namespaces"

 	"github.com/containerd/containerd/snapshots"

 	"github.com/pkg/errors"

+	bolt "go.etcd.io/bbolt"

 )

 type snapshotter struct {

@@ -32,6 +32,10 @@ var (

 // Mount to the provided target

 func (m *Mount) Mount(target string) error {

+	if m.Type != "windows-layer" {

+		return errors.Errorf("invalid windows mount type: '%s'", m.Type)

+	}

+

 	home, layerID := filepath.Split(m.Source)

 	parentLayerPaths, err := m.GetParentPaths()

@@ -18,11 +18,27 @@ package oci

 import (

 	"context"

+	"path/filepath"

+	"runtime"

+

+	"github.com/containerd/containerd/namespaces"

+	"github.com/containerd/containerd/platforms"

 	"github.com/containerd/containerd/containers"

 	specs "github.com/opencontainers/runtime-spec/specs-go"

 )

+const (

+	rwm               = "rwm"

+	defaultRootfsPath = "rootfs"

+)

+

+var (

+	defaultUnixEnv = []string{

+		"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",

+	}

+)

+

 // Spec is a type alias to the OCI runtime spec to allow third part SpecOpts

 // to be created without the "issues" with go vendoring and package imports

 type Spec = specs.Spec

@@ -30,12 +46,36 @@ type Spec = specs.Spec

 // GenerateSpec will generate a default spec from the provided image

 // for use as a containerd container

 func GenerateSpec(ctx context.Context, client Client, c *containers.Container, opts ...SpecOpts) (*Spec, error) {

-	s, err := createDefaultSpec(ctx, c.ID)

-	if err != nil {

+	return GenerateSpecWithPlatform(ctx, client, platforms.DefaultString(), c, opts...)

+}

+

+// GenerateSpecWithPlatform will generate a default spec from the provided image

+// for use as a containerd container in the platform requested.

+func GenerateSpecWithPlatform(ctx context.Context, client Client, platform string, c *containers.Container, opts ...SpecOpts) (*Spec, error) {

+	var s Spec

+	if err := generateDefaultSpecWithPlatform(ctx, platform, c.ID, &s); err != nil {

 		return nil, err

 	}

-	return s, ApplyOpts(ctx, client, c, s, opts...)

+	return &s, ApplyOpts(ctx, client, c, &s, opts...)

+}

+

+func generateDefaultSpecWithPlatform(ctx context.Context, platform, id string, s *Spec) error {

+	plat, err := platforms.Parse(platform)

+	if err != nil {

+		return err

+	}

+

+	if plat.OS == "windows" {

+		err = populateDefaultWindowsSpec(ctx, s, id)

+	} else {

+		err = populateDefaultUnixSpec(ctx, s, id)

+		if err == nil && runtime.GOOS == "windows" {

+			// To run LCOW we have a Linux and Windows section. Add an empty one now.

+			s.Windows = &specs.Windows{}

+		}

+	}

+	return err

 }

 // ApplyOpts applys the options to the given spec, injecting data from the

@@ -50,7 +90,173 @@ func ApplyOpts(ctx context.Context, client Client, c *containers.Container, s *S

 	return nil

 }

-func createDefaultSpec(ctx context.Context, id string) (*Spec, error) {

-	var s Spec

-	return &s, populateDefaultSpec(ctx, &s, id)

+func defaultUnixCaps() []string {

+	return []string{

+		"CAP_CHOWN",

+		"CAP_DAC_OVERRIDE",

+		"CAP_FSETID",

+		"CAP_FOWNER",

+		"CAP_MKNOD",

+		"CAP_NET_RAW",

+		"CAP_SETGID",

+		"CAP_SETUID",

+		"CAP_SETFCAP",

+		"CAP_SETPCAP",

+		"CAP_NET_BIND_SERVICE",

+		"CAP_SYS_CHROOT",

+		"CAP_KILL",

+		"CAP_AUDIT_WRITE",

+	}

+}

+

+func defaultUnixNamespaces() []specs.LinuxNamespace {

+	return []specs.LinuxNamespace{

+		{

+			Type: specs.PIDNamespace,

+		},

+		{

+			Type: specs.IPCNamespace,

+		},

+		{

+			Type: specs.UTSNamespace,

+		},

+		{

+			Type: specs.MountNamespace,

+		},

+		{

+			Type: specs.NetworkNamespace,

+		},

+	}

+}

+

+func populateDefaultUnixSpec(ctx context.Context, s *Spec, id string) error {

+	ns, err := namespaces.NamespaceRequired(ctx)

+	if err != nil {

+		return err

+	}

+

+	*s = Spec{

+		Version: specs.Version,

+		Root: &specs.Root{

+			Path: defaultRootfsPath,

+		},

+		Process: &specs.Process{

+			Env:             defaultUnixEnv,

+			Cwd:             "/",

+			NoNewPrivileges: true,

+			User: specs.User{

+				UID: 0,

+				GID: 0,

+			},

+			Capabilities: &specs.LinuxCapabilities{

+				Bounding:    defaultUnixCaps(),

+				Permitted:   defaultUnixCaps(),

+				Inheritable: defaultUnixCaps(),

+				Effective:   defaultUnixCaps(),

+			},

+			Rlimits: []specs.POSIXRlimit{

+				{

+					Type: "RLIMIT_NOFILE",

+					Hard: uint64(1024),

+					Soft: uint64(1024),

+				},

+			},

+		},

+		Mounts: []specs.Mount{

+			{

+				Destination: "/proc",

+				Type:        "proc",

+				Source:      "proc",

+			},

+			{

+				Destination: "/dev",

+				Type:        "tmpfs",

+				Source:      "tmpfs",

+				Options:     []string{"nosuid", "strictatime", "mode=755", "size=65536k"},

+			},

+			{

+				Destination: "/dev/pts",

+				Type:        "devpts",

+				Source:      "devpts",

+				Options:     []string{"nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620", "gid=5"},

+			},

+			{

+				Destination: "/dev/shm",

+				Type:        "tmpfs",

+				Source:      "shm",

+				Options:     []string{"nosuid", "noexec", "nodev", "mode=1777", "size=65536k"},

+			},

+			{

+				Destination: "/dev/mqueue",

+				Type:        "mqueue",

+				Source:      "mqueue",

+				Options:     []string{"nosuid", "noexec", "nodev"},

+			},

+			{

+				Destination: "/sys",

+				Type:        "sysfs",

+				Source:      "sysfs",

+				Options:     []string{"nosuid", "noexec", "nodev", "ro"},