@@ -435,6 +435,11 @@ func (container *Container) ShouldRestart() bool {

 // AddMountPointWithVolume adds a new mount point configured with a volume to the container.

 func (container *Container) AddMountPointWithVolume(destination string, vol volume.Volume, rw bool) {

+	operatingSystem := container.Platform

+	if operatingSystem == "" {

+		operatingSystem = runtime.GOOS

+	}

+	volumeParser := volume.NewParser(operatingSystem)

 	container.MountPoints[destination] = &volume.MountPoint{

 		Type:        mounttypes.TypeVolume,

 		Name:        vol.Name(),

@@ -442,7 +447,7 @@ func (container *Container) AddMountPointWithVolume(destination string, vol volu

 		Destination: destination,

 		RW:          rw,

 		Volume:      vol,

-		CopyData:    volume.DefaultCopyMode,

+		CopyData:    volumeParser.DefaultCopyMode(),

 	}

 }

@@ -68,6 +68,7 @@ func (container *Container) BuildHostnameFile() error {

 func (container *Container) NetworkMounts() []Mount {

 	var mounts []Mount

 	shared := container.HostConfig.NetworkMode.IsContainer()

+	parser := volume.NewParser(container.Platform)

 	if container.ResolvConfPath != "" {

 		if _, err := os.Stat(container.ResolvConfPath); err != nil {

 			logrus.Warnf("ResolvConfPath set to %q, but can't stat this filename (err = %v); skipping", container.ResolvConfPath, err)

@@ -83,7 +84,7 @@ func (container *Container) NetworkMounts() []Mount {

 				Source:      container.ResolvConfPath,

 				Destination: "/etc/resolv.conf",

 				Writable:    writable,

-				Propagation: string(volume.DefaultPropagationMode),

+				Propagation: string(parser.DefaultPropagationMode()),

 			})

 		}

 	}

@@ -102,7 +103,7 @@ func (container *Container) NetworkMounts() []Mount {

 				Source:      container.HostnamePath,

 				Destination: "/etc/hostname",

 				Writable:    writable,

-				Propagation: string(volume.DefaultPropagationMode),

+				Propagation: string(parser.DefaultPropagationMode()),

 			})

 		}

 	}

@@ -121,7 +122,7 @@ func (container *Container) NetworkMounts() []Mount {

 				Source:      container.HostsPath,

 				Destination: "/etc/hosts",

 				Writable:    writable,

-				Propagation: string(volume.DefaultPropagationMode),

+				Propagation: string(parser.DefaultPropagationMode()),

 			})

 		}

 	}

@@ -196,6 +197,7 @@ func (container *Container) UnmountIpcMount(unmount func(pth string) error) erro

 // IpcMounts returns the list of IPC mounts

 func (container *Container) IpcMounts() []Mount {

 	var mounts []Mount

+	parser := volume.NewParser(container.Platform)

 	if container.HasMountFor("/dev/shm") {

 		return mounts

@@ -209,7 +211,7 @@ func (container *Container) IpcMounts() []Mount {

 		Source:      container.ShmPath,

 		Destination: "/dev/shm",

 		Writable:    true,

-		Propagation: string(volume.DefaultPropagationMode),

+		Propagation: string(parser.DefaultPropagationMode()),

 	})

 	return mounts

@@ -429,6 +431,7 @@ func copyOwnership(source, destination string) error {

 // TmpfsMounts returns the list of tmpfs mounts

 func (container *Container) TmpfsMounts() ([]Mount, error) {

+	parser := volume.NewParser(container.Platform)

 	var mounts []Mount

 	for dest, data := range container.HostConfig.Tmpfs {

 		mounts = append(mounts, Mount{

@@ -439,7 +442,7 @@ func (container *Container) TmpfsMounts() ([]Mount, error) {

 	}

 	for dest, mnt := range container.MountPoints {

 		if mnt.Type == mounttypes.TypeTmpfs {

-			data, err := volume.ConvertTmpfsOptions(mnt.Spec.TmpfsOptions, mnt.Spec.ReadOnly)

+			data, err := parser.ConvertTmpfsOptions(mnt.Spec.TmpfsOptions, mnt.Spec.ReadOnly)

 			if err != nil {

 				return nil, err

 			}

@@ -4,6 +4,7 @@ package daemon

 import (

 	"github.com/docker/docker/container"

+	"github.com/docker/docker/volume"

 )

 // checkIfPathIsInAVolume checks if the path is in a volume. If it is, it

@@ -11,8 +12,9 @@ import (

 // cannot be configured with a read-only rootfs.

 func checkIfPathIsInAVolume(container *container.Container, absPath string) (bool, error) {

 	var toVolume bool

+	parser := volume.NewParser(container.Platform)

 	for _, mnt := range container.MountPoints {

-		if toVolume = mnt.HasResource(absPath); toVolume {

+		if toVolume = parser.HasResource(mnt, absPath); toVolume {

 			if mnt.RW {

 				break

 			}

@@ -26,10 +26,10 @@ func (daemon *Daemon) createContainerPlatformSpecificSettings(container *contain

 		}

 		hostConfig.Isolation = "hyperv"

 	}

-

+	parser := volume.NewParser(container.Platform)

 	for spec := range config.Volumes {

-		mp, err := volume.ParseMountRaw(spec, hostConfig.VolumeDriver)

+		mp, err := parser.ParseMountRaw(spec, hostConfig.VolumeDriver)

 		if err != nil {

 			return fmt.Errorf("Unrecognised volume spec: %v", err)

 		}

@@ -612,8 +612,9 @@ func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *containertypes.

 		return warnings, fmt.Errorf("Unknown runtime specified %s", hostConfig.Runtime)

 	}

+	parser := volume.NewParser(runtime.GOOS)

 	for dest := range hostConfig.Tmpfs {

-		if err := volume.ValidateTmpfsMountDestination(dest); err != nil {

+		if err := parser.ValidateTmpfsMountDestination(dest); err != nil {

 			return warnings, err

 		}

 	}

@@ -498,6 +498,7 @@ func setMounts(daemon *Daemon, s *specs.Spec, c *container.Container, mounts []c

 	// Filter out mounts from spec

 	noIpc := c.HostConfig.IpcMode.IsNone()

+	// Filter out mounts that are overridden by user supplied mounts

 	var defaultMounts []specs.Mount

 	_, mountDev := userMounts["/dev"]

 	for _, m := range s.Mounts {

@@ -524,7 +525,8 @@ func setMounts(daemon *Daemon, s *specs.Spec, c *container.Container, mounts []c

 		if m.Source == "tmpfs" {

 			data := m.Data

-			options := []string{"noexec", "nosuid", "nodev", string(volume.DefaultPropagationMode)}

+			parser := volume.NewParser("linux")

+			options := []string{"noexec", "nosuid", "nodev", string(parser.DefaultPropagationMode())}

 			if data != "" {

 				options = append(options, strings.Split(data, ",")...)

 			}

@@ -4,6 +4,7 @@ import (

 	"fmt"

 	"io/ioutil"

 	"path/filepath"

+	"runtime"

 	"strings"

 	containertypes "github.com/docker/docker/api/types/container"

@@ -108,6 +109,11 @@ func (daemon *Daemon) createSpec(c *container.Container) (*specs.Spec, error) {

 		if !mount.Writable {

 			m.Options = append(m.Options, "ro")

 		}

+		if img.OS != runtime.GOOS {

+			m.Type = "bind"

+			m.Options = append(m.Options, "rbind")

+			m.Options = append(m.Options, fmt.Sprintf("uvmpath=/tmp/gcs/%s/binds", c.ID))

+		}

 		s.Mounts = append(s.Mounts, m)

 	}

@@ -75,6 +75,7 @@ func (m mounts) parts(i int) int {

 func (daemon *Daemon) registerMountPoints(container *container.Container, hostConfig *containertypes.HostConfig) (retErr error) {

 	binds := map[string]bool{}

 	mountPoints := map[string]*volume.MountPoint{}

+	parser := volume.NewParser(container.Platform)

 	defer func() {

 		// clean up the container mountpoints once return with error

 		if retErr != nil {

@@ -103,7 +104,7 @@ func (daemon *Daemon) registerMountPoints(container *container.Container, hostCo

 	// 2. Read volumes from other containers.

 	for _, v := range hostConfig.VolumesFrom {

-		containerID, mode, err := volume.ParseVolumesFrom(v)

+		containerID, mode, err := parser.ParseVolumesFrom(v)

 		if err != nil {

 			return err

 		}

@@ -118,7 +119,7 @@ func (daemon *Daemon) registerMountPoints(container *container.Container, hostCo

 				Type:        m.Type,

 				Name:        m.Name,

 				Source:      m.Source,

-				RW:          m.RW && volume.ReadWrite(mode),

+				RW:          m.RW && parser.ReadWrite(mode),

 				Driver:      m.Driver,

 				Destination: m.Destination,

 				Propagation: m.Propagation,

@@ -140,7 +141,7 @@ func (daemon *Daemon) registerMountPoints(container *container.Container, hostCo

 	// 3. Read bind mounts

 	for _, b := range hostConfig.Binds {

-		bind, err := volume.ParseMountRaw(b, hostConfig.VolumeDriver)

+		bind, err := parser.ParseMountRaw(b, hostConfig.VolumeDriver)

 		if err != nil {

 			return err

 		}

@@ -172,7 +173,7 @@ func (daemon *Daemon) registerMountPoints(container *container.Container, hostCo

 	}

 	for _, cfg := range hostConfig.Mounts {

-		mp, err := volume.ParseMountSpec(cfg)

+		mp, err := parser.ParseMountSpec(cfg)

 		if err != nil {

 			return validationError{err}

 		}

@@ -217,7 +218,7 @@ func (daemon *Daemon) registerMountPoints(container *container.Container, hostCo

 	// 4. Cleanup old volumes that are about to be reassigned.

 	for _, m := range mountPoints {

-		if m.BackwardsCompatible() {

+		if parser.IsBackwardCompatible(m) {

 			if mp, exists := container.MountPoints[m.Destination]; exists && mp.Volume != nil {

 				daemon.volumes.Dereference(mp.Volume, container.ID)

 			}

@@ -252,6 +253,8 @@ func (daemon *Daemon) backportMountSpec(container *container.Container) {

 	container.Lock()

 	defer container.Unlock()

+	parser := volume.NewParser(container.Platform)

+

 	maybeUpdate := make(map[string]bool)

 	for _, mp := range container.MountPoints {

 		if mp.Spec.Source != "" && mp.Type != "" {

@@ -270,7 +273,7 @@ func (daemon *Daemon) backportMountSpec(container *container.Container) {

 	binds := make(map[string]*volume.MountPoint, len(container.HostConfig.Binds))

 	for _, rawSpec := range container.HostConfig.Binds {

-		mp, err := volume.ParseMountRaw(rawSpec, container.HostConfig.VolumeDriver)

+		mp, err := parser.ParseMountRaw(rawSpec, container.HostConfig.VolumeDriver)

 		if err != nil {

 			logrus.WithError(err).Error("Got unexpected error while re-parsing raw volume spec during spec backport")

 			continue

@@ -280,7 +283,7 @@ func (daemon *Daemon) backportMountSpec(container *container.Container) {

 	volumesFrom := make(map[string]volume.MountPoint)

 	for _, fromSpec := range container.HostConfig.VolumesFrom {

-		from, _, err := volume.ParseVolumesFrom(fromSpec)

+		from, _, err := parser.ParseVolumesFrom(fromSpec)

 		if err != nil {

 			logrus.WithError(err).WithField("id", container.ID).Error("Error reading volumes-from spec during mount spec backport")

 			continue

@@ -1,6 +1,7 @@

 package daemon

 import (

+	"runtime"

 	"testing"

 	"github.com/docker/docker/volume"

@@ -20,8 +21,10 @@ func TestParseVolumesFrom(t *testing.T) {

 		{"foobar:baz", "", "", true},

 	}

+	parser := volume.NewParser(runtime.GOOS)

+

 	for _, c := range cases {

-		id, mode, err := volume.ParseVolumesFrom(c.spec)

+		id, mode, err := parser.ParseVolumesFrom(c.spec)

 		if c.fail {

 			if err == nil {

 				t.Fatalf("Expected error, was nil, for spec %s\n", c.spec)

@@ -7,6 +7,7 @@ import (

 	"io"

 	"io/ioutil"

 	"os"

+	"path"

 	"path/filepath"

 	"regexp"

 	"strings"

@@ -388,11 +389,101 @@ func (clnt *client) createLinux(containerID string, checkpoint string, checkpoin

 		configuration.NetworkSharedContainerName = spec.Windows.Network.NetworkSharedContainerName

 	}

+	// Add the mounts (volumes, bind mounts etc) to the structure. We have to do

+	// some translation for both the mapped directories passed into HCS and in

+	// the spec.

+	//

+	// For HCS, we only pass in the mounts from the spec which are type "bind".

+	// Further, the "ContainerPath" field (which is a little mis-leadingly

+	// named when it applies to the utility VM rather than the container in the

+	// utility VM) is moved to under /tmp/gcs/<ID>/binds, where this is passed

+	// by the caller through a 'uvmpath' option.

+	//

+	// We do similar translation for the mounts in the spec by stripping out

+	// the uvmpath option, and translating the Source path to the location in the

+	// utility VM calculated above.

+	//

+	// From inside the utility VM, you would see a 9p mount such as in the following

+	// where a host folder has been mapped to /target. The line with /tmp/gcs/<ID>/binds

+	// specifically:

+	//

+	//	/ # mount

+	//	rootfs on / type rootfs (rw,size=463736k,nr_inodes=115934)

+	//	proc on /proc type proc (rw,relatime)

+	//	sysfs on /sys type sysfs (rw,relatime)

+	//	udev on /dev type devtmpfs (rw,relatime,size=498100k,nr_inodes=124525,mode=755)

+	//	tmpfs on /run type tmpfs (rw,relatime)

+	//	cgroup on /sys/fs/cgroup type cgroup (rw,relatime,cpuset,cpu,cpuacct,blkio,memory,devices,freezer,net_cls,perf_event,net_prio,hugetlb,pids,rdma)

+	//	mqueue on /dev/mqueue type mqueue (rw,relatime)

+	//	devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000)

+	//	/binds/b3ea9126d67702173647ece2744f7c11181c0150e9890fc9a431849838033edc/target on /binds/b3ea9126d67702173647ece2744f7c11181c0150e9890fc9a431849838033edc/target type 9p (rw,sync,dirsync,relatime,trans=fd,rfdno=6,wfdno=6)

+	//	/dev/pmem0 on /tmp/gcs/b3ea9126d67702173647ece2744f7c11181c0150e9890fc9a431849838033edc/layer0 type ext4 (ro,relatime,block_validity,delalloc,norecovery,barrier,dax,user_xattr,acl)

+	//	/dev/sda on /tmp/gcs/b3ea9126d67702173647ece2744f7c11181c0150e9890fc9a431849838033edc/scratch type ext4 (rw,relatime,block_validity,delalloc,barrier,user_xattr,acl)

+	//	overlay on /tmp/gcs/b3ea9126d67702173647ece2744f7c11181c0150e9890fc9a431849838033edc/rootfs type overlay (rw,relatime,lowerdir=/tmp/base/:/tmp/gcs/b3ea9126d67702173647ece2744f7c11181c0150e9890fc9a431849838033edc/layer0,upperdir=/tmp/gcs/b3ea9126d67702173647ece2744f7c11181c0150e9890fc9a431849838033edc/scratch/upper,workdir=/tmp/gcs/b3ea9126d67702173647ece2744f7c11181c0150e9890fc9a431849838033edc/scratch/work)

+	//

+	//  /tmp/gcs/b3ea9126d67702173647ece2744f7c11181c0150e9890fc9a431849838033edc # ls -l

+	//	total 16

+	//	drwx------    3 0        0               60 Sep  7 18:54 binds

+	//	-rw-r--r--    1 0        0             3345 Sep  7 18:54 config.json

+	//	drwxr-xr-x   10 0        0             4096 Sep  6 17:26 layer0

+	//	drwxr-xr-x    1 0        0             4096 Sep  7 18:54 rootfs

+	//	drwxr-xr-x    5 0        0             4096 Sep  7 18:54 scratch

+	//

+	//	/tmp/gcs/b3ea9126d67702173647ece2744f7c11181c0150e9890fc9a431849838033edc # ls -l binds

+	//	total 0

+	//	drwxrwxrwt    2 0        0             4096 Sep  7 16:51 target

+

+	mds := []hcsshim.MappedDir{}

+	specMounts := []specs.Mount{}

+	for _, mount := range spec.Mounts {

+		specMount := mount

+		if mount.Type == "bind" {

+			// Strip out the uvmpath from the options

+			updatedOptions := []string{}

+			uvmPath := ""

+			readonly := false

+			for _, opt := range mount.Options {

+				dropOption := false

+				elements := strings.SplitN(opt, "=", 2)

+				switch elements[0] {

+				case "uvmpath":

+					uvmPath = elements[1]

+					dropOption = true

+				case "rw":

+				case "ro":

+					readonly = true

+				case "rbind":

+				default:

+					return fmt.Errorf("unsupported option %q", opt)

+				}

+				if !dropOption {

+					updatedOptions = append(updatedOptions, opt)

+				}

+			}

+			mount.Options = updatedOptions

+			if uvmPath == "" {

+				return fmt.Errorf("no uvmpath for bind mount %+v", mount)

+			}

+			md := hcsshim.MappedDir{

+				HostPath:          mount.Source,

+				ContainerPath:     path.Join(uvmPath, mount.Destination),

+				CreateInUtilityVM: true,

+				ReadOnly:          readonly,

+			}

+			mds = append(mds, md)

+			specMount.Source = path.Join(uvmPath, mount.Destination)

+		}

+		specMounts = append(specMounts, specMount)

+	}

+	configuration.MappedDirectories = mds

+

 	hcsContainer, err := hcsshim.CreateContainer(containerID, configuration)

 	if err != nil {

 		return err

 	}

+	spec.Mounts = specMounts

+

 	// Construct a container object for calling start on it.

 	container := &container{

 		containerCommon: containerCommon{

@@ -7,8 +7,6 @@ import (

 	"github.com/docker/docker/api/types/container"

 	networktypes "github.com/docker/docker/api/types/network"

 	"github.com/docker/docker/pkg/sysinfo"

-	"github.com/docker/docker/volume"

-	"github.com/pkg/errors"

 )

 // ContainerDecoder implements httputils.ContainerDecoder

@@ -46,11 +44,6 @@ func decodeContainerConfig(src io.Reader) (*container.Config, *container.HostCon

 		if w.Config.Volumes == nil {

 			w.Config.Volumes = make(map[string]struct{})

 		}

-

-		// Now validate all the volumes and binds

-		if err := validateMountSettings(w.Config, hc); err != nil {

-			return nil, nil, nil, err

-		}

 	}

 	// Certain parameters need daemon-side validation that cannot be done

@@ -86,23 +79,3 @@ func decodeContainerConfig(src io.Reader) (*container.Config, *container.HostCon

 	return w.Config, hc, w.NetworkingConfig, nil

 }

-

-// validateMountSettings validates each of the volumes and bind settings

-// passed by the caller to ensure they are valid.

-func validateMountSettings(c *container.Config, hc *container.HostConfig) error {

-	// it is ok to have len(hc.Mounts) > 0 && (len(hc.Binds) > 0 || len (c.Volumes) > 0 || len (hc.Tmpfs) > 0 )

-

-	// Ensure all volumes and binds are valid.

-	for spec := range c.Volumes {

-		if _, err := volume.ParseMountRaw(spec, hc.VolumeDriver); err != nil {

-			return errors.Wrapf(err, "invalid volume spec %q", spec)

-		}

-	}

-	for _, spec := range hc.Binds {

-		if _, err := volume.ParseMountRaw(spec, hc.VolumeDriver); err != nil {

-			return errors.Wrapf(err, "invalid bind mount spec %q", spec)

-		}

-	}

-

-	return nil

-}

@@ -9,12 +9,9 @@ import (

 	"strings"

 	"testing"

-	"os"

-

 	"github.com/docker/docker/api/types/container"

 	networktypes "github.com/docker/docker/api/types/network"

 	"github.com/docker/docker/api/types/strslice"

-	"github.com/gotestyourself/gotestyourself/skip"

 	"github.com/stretchr/testify/assert"

 	"github.com/stretchr/testify/require"

 )

@@ -143,103 +140,6 @@ func callDecodeContainerConfigIsolation(isolation string) (*container.Config, *c

 	return decodeContainerConfig(bytes.NewReader(b))

 }

-func TestDecodeContainerConfigWithVolumes(t *testing.T) {

-	var testcases = []decodeConfigTestcase{

-		{

-			doc:         "no paths volume",

-			wrapper:     containerWrapperWithVolume(":"),

-			expectedErr: `invalid volume specification: ':'`,

-		},

-		{

-			doc:         "no paths bind",

-			wrapper:     containerWrapperWithBind(":"),

-			expectedErr: `invalid volume specification: ':'`,

-		},

-		{

-			doc:         "no paths or mode volume",

-			wrapper:     containerWrapperWithVolume("::"),

-			expectedErr: `invalid volume specification: '::'`,

-		},

-		{

-			doc:         "no paths or mode bind",

-			wrapper:     containerWrapperWithBind("::"),

-			expectedErr: `invalid volume specification: '::'`,

-		},

-	}

-	for _, testcase := range testcases {

-		t.Run(testcase.doc, runDecodeContainerConfigTestCase(testcase))

-	}

-}

-

-func TestDecodeContainerConfigWithVolumesUnix(t *testing.T) {

-	skip.IfCondition(t, runtime.GOOS == "windows")

-

-	baseErr := `invalid mount config for type "volume": invalid specification: `

-	var testcases = []decodeConfigTestcase{

-		{

-			doc:         "root to root volume",

-			wrapper:     containerWrapperWithVolume("/:/"),

-			expectedErr: `invalid volume specification: '/:/'`,

-		},

-		{

-			doc:         "root to root bind",

-			wrapper:     containerWrapperWithBind("/:/"),

-			expectedErr: `invalid volume specification: '/:/'`,

-		},

-		{

-			doc:         "no destination path volume",

-			wrapper:     containerWrapperWithVolume(`/tmp:`),

-			expectedErr: ` invalid volume specification: '/tmp:'`,

-		},

-		{

-			doc:         "no destination path bind",

-			wrapper:     containerWrapperWithBind(`/tmp:`),

-			expectedErr: ` invalid volume specification: '/tmp:'`,

-		},

-		{

-			doc:         "no destination path or mode volume",

-			wrapper:     containerWrapperWithVolume(`/tmp::`),

-			expectedErr: `invalid mount config for type "bind": field Target must not be empty`,

-		},

-		{

-			doc:         "no destination path or mode bind",

-			wrapper:     containerWrapperWithBind(`/tmp::`),

-			expectedErr: `invalid mount config for type "bind": field Target must not be empty`,

-		},

-		{

-			doc:         "too many sections volume",

-			wrapper:     containerWrapperWithVolume(`/tmp:/tmp:/tmp:/tmp`),

-			expectedErr: `invalid volume specification: '/tmp:/tmp:/tmp:/tmp'`,

-		},

-		{

-			doc:         "too many sections bind",

-			wrapper:     containerWrapperWithBind(`/tmp:/tmp:/tmp:/tmp`),

-			expectedErr: `invalid volume specification: '/tmp:/tmp:/tmp:/tmp'`,

-		},

-		{

-			doc:         "just root volume",

-			wrapper:     containerWrapperWithVolume("/"),

-			expectedErr: baseErr + `destination can't be '/'`,

-		},

-		{

-			doc:         "just root bind",

-			wrapper:     containerWrapperWithBind("/"),

-			expectedErr: baseErr + `destination can't be '/'`,

-		},

-		{

-			doc:     "bind mount passed as a volume",

-			wrapper: containerWrapperWithVolume(`/foo:/bar`),

-			expectedConfig: &container.Config{

-				Volumes: map[string]struct{}{`/foo:/bar`: {}},

-			},

-			expectedHostConfig: &container.HostConfig{NetworkMode: "default"},

-		},

-	}

-	for _, testcase := range testcases {

-		t.Run(testcase.doc, runDecodeContainerConfigTestCase(testcase))

-	}

-}

-

 type decodeConfigTestcase struct {

 	doc                string

 	wrapper            ContainerConfigWrapper

@@ -266,89 +166,6 @@ func runDecodeContainerConfigTestCase(testcase decodeConfigTestcase) func(t *tes

 	}

 }

-func TestDecodeContainerConfigWithVolumesWindows(t *testing.T) {

-	skip.IfCondition(t, runtime.GOOS != "windows")

-

-	tmpDir := os.Getenv("TEMP")

-	systemDrive := os.Getenv("SystemDrive")

-	var testcases = []decodeConfigTestcase{

-		{

-			doc:         "root to root volume",

-			wrapper:     containerWrapperWithVolume(systemDrive + `\:c:\`),

-			expectedErr: `invalid volume specification: `,

-		},

-		{

-			doc:         "root to root bind",

-			wrapper:     containerWrapperWithBind(systemDrive + `\:c:\`),

-			expectedErr: `invalid volume specification: `,

-		},

-		{

-			doc:         "no destination path volume",

-			wrapper:     containerWrapperWithVolume(tmpDir + `\:`),

-			expectedErr: `invalid volume specification: `,

-		},

-		{

-			doc:         "no destination path bind",

-			wrapper:     containerWrapperWithBind(tmpDir + `\:`),

-			expectedErr: `invalid volume specification: `,

-		},

-		{

-			doc:         "no destination path or mode volume",

-			wrapper:     containerWrapperWithVolume(tmpDir + `\::`),

-			expectedErr: `invalid volume specification: `,

-		},

-		{

-			doc:         "no destination path or mode bind",

-			wrapper:     containerWrapperWithBind(tmpDir + `\::`),

-			expectedErr: `invalid volume specification: `,

-		},

-		{

-			doc:         "too many sections volume",

-			wrapper:     containerWrapperWithVolume(tmpDir + ":" + tmpDir + ":" + tmpDir + ":" + tmpDir),

-			expectedErr: `invalid volume specification: `,

-		},

-		{

-			doc:         "too many sections bind",

-			wrapper:     containerWrapperWithBind(tmpDir + ":" + tmpDir + ":" + tmpDir + ":" + tmpDir),

-			expectedErr: `invalid volume specification: `,

-		},

-		{

-			doc:         "no drive letter volume",

-			wrapper:     containerWrapperWithVolume(`\tmp`),

-			expectedErr: `invalid volume specification: `,

-		},

-		{

-			doc:         "no drive letter bind",

-			wrapper:     containerWrapperWithBind(`\tmp`),

-			expectedErr: `invalid volume specification: `,

-		},

-		{

-			doc:         "root to c-drive volume",

-			wrapper:     containerWrapperWithVolume(systemDrive + `\:c:`),

-			expectedErr: `invalid volume specification: `,

-		},

-		{

-			doc:         "root to c-drive bind",

-			wrapper:     containerWrapperWithBind(systemDrive + `\:c:`),

-			expectedErr: `invalid volume specification: `,

-		},

-		{

-			doc:         "container path without driver letter volume",

-			wrapper:     containerWrapperWithVolume(`c:\windows:\somewhere`),

-			expectedErr: `invalid volume specification: `,

-		},

-		{

-			doc:         "container path without driver letter bind",

-			wrapper:     containerWrapperWithBind(`c:\windows:\somewhere`),

-			expectedErr: `invalid volume specification: `,

-		},

-	}

-

-	for _, testcase := range testcases {

-		t.Run(testcase.doc, runDecodeContainerConfigTestCase(testcase))

-	}

-}

-

 func marshal(t *testing.T, w ContainerConfigWrapper, doc string) []byte {

 	b, err := json.Marshal(w)

 	require.NoError(t, err, "%s: failed to encode config wrapper", doc)

new file mode 100644

@@ -0,0 +1,35 @@

+package volume

+

+import (

+	"errors"

+	"fmt"

+	"path"

+

+	"github.com/docker/docker/api/types/mount"

+)

+

+var lcowSpecificValidators mountValidator = func(m *mount.Mount) error {

+	if path.Clean(m.Target) == "/" {

+		return fmt.Errorf("invalid specification: destination can't be '/'")

+	}

+	if m.Type == mount.TypeNamedPipe {

+		return errors.New("Linux containers on Windows do not support named pipe mounts")

+	}

+	return nil

+}

+

+type lcowParser struct {

+	windowsParser

+}

+

+func (p *lcowParser) validateMountConfig(mnt *mount.Mount) error {

+	return p.validateMountConfigReg(mnt, rxLCOWDestination, lcowSpecificValidators)

+}

+

+func (p *lcowParser) ParseMountRaw(raw, volumeDriver string) (*MountPoint, error) {

+	return p.parseMountRaw(raw, volumeDriver, rxLCOWDestination, false, lcowSpecificValidators)

+}

+

+func (p *lcowParser) ParseMountSpec(cfg mount.Mount) (*MountPoint, error) {

+	return p.parseMountSpec(cfg, rxLCOWDestination, false, lcowSpecificValidators)

+}

new file mode 100644

@@ -0,0 +1,416 @@

+package volume

+

+import (

+	"errors"

+	"fmt"

+	"path"

+	"path/filepath"

+	"strings"

+

+	"github.com/docker/docker/api/types/mount"

+	"github.com/docker/docker/pkg/stringid"

+)

+

+type linuxParser struct {

+}

+

+func linuxSplitRawSpec(raw string) ([]string, error) {

+	if strings.Count(raw, ":") > 2 {

+		return nil, errInvalidSpec(raw)

+	}

+

+	arr := strings.SplitN(raw, ":", 3)

+	if arr[0] == "" {

+		return nil, errInvalidSpec(raw)

+	}

+	return arr, nil

+}

+

+func linuxValidateNotRoot(p string) error {

+	p = path.Clean(strings.Replace(p, `\`, `/`, -1))

+	if p == "/" {

+		return fmt.Errorf("invalid specification: destination can't be '/'")

+	}

+	return nil

+}

+func linuxValidateAbsolute(p string) error {

+	p = strings.Replace(p, `\`, `/`, -1)

+	if path.IsAbs(p) {

+		return nil

+	}

+	return fmt.Errorf("invalid mount path: '%s' mount path must be absolute", p)

+}

+func (p *linuxParser) validateMountConfig(mnt *mount.Mount) error {

+	// there was something looking like a bug in existing codebase:

+	// - validateMountConfig on linux was called with options skipping bind source existance when calling ParseMountRaw

+	// - but not when calling ParseMountSpec directly... nor when the unit test called it directly

+	return p.validateMountConfigImpl(mnt, true)

+}

+func (p *linuxParser) validateMountConfigImpl(mnt *mount.Mount, validateBindSourceExists bool) error {

+	if len(mnt.Target) == 0 {

+		return &errMountConfig{mnt, errMissingField("Target")}

+	}

+

+	if err := linuxValidateNotRoot(mnt.Target); err != nil {

+		return &errMountConfig{mnt, err}

+	}

+

+	if err := linuxValidateAbsolute(mnt.Target); err != nil {

+		return &errMountConfig{mnt, err}

+	}

+

+	switch mnt.Type {

+	case mount.TypeBind:

+		if len(mnt.Source) == 0 {

+			return &errMountConfig{mnt, errMissingField("Source")}

+		}

+		// Don't error out just because the propagation mode is not supported on the platform

+		if opts := mnt.BindOptions; opts != nil {

+			if len(opts.Propagation) > 0 && len(linuxPropagationModes) > 0 {

+				if _, ok := linuxPropagationModes[opts.Propagation]; !ok {

+					return &errMountConfig{mnt, fmt.Errorf("invalid propagation mode: %s", opts.Propagation)}

+				}

+			}

+		}

+		if mnt.VolumeOptions != nil {

+			return &errMountConfig{mnt, errExtraField("VolumeOptions")}

+		}

+

+		if err := linuxValidateAbsolute(mnt.Source); err != nil {

+			return &errMountConfig{mnt, err}

+		}

+

+		if validateBindSourceExists {

+			exists, _, _ := currentFileInfoProvider.fileInfo(mnt.Source)

+			if !exists {

+				return &errMountConfig{mnt, errBindNotExist}

+			}

+		}

+

+	case mount.TypeVolume:

+		if mnt.BindOptions != nil {

+			return &errMountConfig{mnt, errExtraField("BindOptions")}

+		}

+

+		if len(mnt.Source) == 0 && mnt.ReadOnly {

+			return &errMountConfig{mnt, fmt.Errorf("must not set ReadOnly mode when using anonymous volumes")}

+		}

+	case mount.TypeTmpfs:

+		if len(mnt.Source) != 0 {

+			return &errMountConfig{mnt, errExtraField("Source")}

+		}

+		if _, err := p.ConvertTmpfsOptions(mnt.TmpfsOptions, mnt.ReadOnly); err != nil {

+			return &errMountConfig{mnt, err}

+		}

+	default:

+		return &errMountConfig{mnt, errors.New("mount type unknown")}

+	}

+	return nil

+}

+

+// read-write modes

+var rwModes = map[string]bool{

+	"rw": true,

+	"ro": true,

+}

+

+// label modes

+var linuxLabelModes = map[string]bool{

+	"Z": true,

+	"z": true,

+}

+

+// consistency modes

+var linuxConsistencyModes = map[mount.Consistency]bool{

+	mount.ConsistencyFull:      true,

+	mount.ConsistencyCached:    true,

+	mount.ConsistencyDelegated: true,

+}

+var linuxPropagationModes = map[mount.Propagation]bool{

+	mount.PropagationPrivate:  true,

+	mount.PropagationRPrivate: true,

+	mount.PropagationSlave:    true,

+	mount.PropagationRSlave:   true,

+	mount.PropagationShared:   true,

+	mount.PropagationRShared:  true,

+}

+

+const linuxDefaultPropagationMode = mount.PropagationRPrivate

+

+func linuxGetPropagation(mode string) mount.Propagation {

+	for _, o := range strings.Split(mode, ",") {

+		prop := mount.Propagation(o)

+		if linuxPropagationModes[prop] {

+			return prop

+		}

+	}

+	return linuxDefaultPropagationMode

+}

+

+func linuxHasPropagation(mode string) bool {

+	for _, o := range strings.Split(mode, ",") {

+		if linuxPropagationModes[mount.Propagation(o)] {

+			return true

+		}

+	}

+	return false

+}

+

+func linuxValidMountMode(mode string) bool {

+	if mode == "" {

+		return true

+	}

+

+	rwModeCount := 0

+	labelModeCount := 0

+	propagationModeCount := 0

+	copyModeCount := 0

+	consistencyModeCount := 0

+

+	for _, o := range strings.Split(mode, ",") {

+		switch {

+		case rwModes[o]:

+			rwModeCount++

+		case linuxLabelModes[o]:

+			labelModeCount++

+		case linuxPropagationModes[mount.Propagation(o)]:

+			propagationModeCount++

+		case copyModeExists(o):

+			copyModeCount++

+		case linuxConsistencyModes[mount.Consistency(o)]:

+			consistencyModeCount++

+		default:

+			return false

+		}

+	}

+

+	// Only one string for each mode is allowed.

+	if rwModeCount > 1 || labelModeCount > 1 || propagationModeCount > 1 || copyModeCount > 1 || consistencyModeCount > 1 {

+		return false

+	}

+	return true

+}

+

+func (p *linuxParser) ReadWrite(mode string) bool {