Extracting layer fails when container is running

[sesmith177]

When:

1. A container is running with a given image (e.g made up of layers A,B,C )
2. A new image is downloaded + extracted that shares a base layer with the given image (e.g. made up of layers A,D,E)

Then extracting the first new layer (layer D in this example) will fail.

To reproduce, run in one terminal:

PS C:\Users\vagrant> docker pull microsoft/windowsservercore:1709_KB4054517
1709_KB4054517: Pulling from microsoft/windowsservercore
5847a47b8593: Already exists
e50cc21fbc56: Already exists
Digest: sha256:65a11ae1d7096b850c02184cfe30b7ef5665357472a34098afdcda94546b91b8
Status: Downloaded newer image for microsoft/windowsservercore:1709_KB4054517
PS C:\Users\vagrant> docker run -it microsoft/windowsservercore:1709_KB4054517 cmd.exe

and then in a second terminal, pull a new version of the container image:

PS C:\Users\vagrant> docker pull microsoft/windowsservercore:1709_KB4056892
1709_KB4056892: Pulling from microsoft/windowsservercore
5847a47b8593: Already exists
9f887ccb8077: Extracting [==================================================>]  689.7MB/689.7MB
failed to register layer: re-exec error: exit status 1: output: remove \\?\C:\ProgramData\docker\windowsfilter\572e75dfac18f1e5a7cf134a584e3376fa75115d17e8508240d2f71a0cb9fa14\UtilityVM\Files\Windows\WinSxS\amd64_microsoft-windows-workstationservice_31bf3856ad364e35_10.0.16299.15_none_ef2643e047f6349e\wkssvc.dll: Access is denied.

From docker info:

Default Isolation: process
Kernel Version: 10.0 16299 (16299.15.amd64fre.rs3_release.170928-1534)

[darstahl]

Thanks for the report. It looks to me like this is a platform bug in the layer apply when removing a file that is in the parent. I have a repro, and I am investigating.

[sunjayBhatia]

Thanks @darrenstahlmsft, let us know if you need any more information from our environment

[sunjayBhatia]

@darrenstahlmsft any updates on this?

[darstahl]

We understand the issue here. It is a combination of a bug preventing deletion of hard links in some cases and a performance optimization that creates hard links that trigger the above bug. We're working on a platform fix to allow the deletion of hard links in this case, but in the mean time, I am looking into a mitigation for hcsshim that can prevent creating the hard links if they are not needed (so we don't have to delete any hard links during layer extraction).

I'll have more info or a fix either this week or next.

[darstahl]

I've submitted #160 to fix this

[sunjayBhatia]

sweet, thanks @darrenstahlmsft

[lowenna]

See moby/moby#36092 (comment). Fixed in #167