Merge pull request #2079 from adamrehn/windows-device-support

Port Windows device support from containerd

cmd/nerdctl/container_run_windows.go

@@ -18,7 +18,9 @@ package main
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"strings"
 
 	"github.com/containerd/containerd"
 	"github.com/containerd/containerd/containers"
@@ -132,6 +134,22 @@ func setPlatformOptions(
 		oci.WithWindowNetworksAllowUnqualifiedDNSQuery(),
 		oci.WithWindowsIgnoreFlushesDuringBoot())
 
+	device, err := cmd.Flags().GetStringSlice("device")
+	if err != nil {
+		return nil, err
+	}
+
+	for _, dev := range device {
+		idType, devID, ok := strings.Cut(dev, "://")
+		if !ok {
+			return nil, errors.New("devices must be in the format IDType://ID")
+		}
+		if idType == "" {
+			return nil, errors.New("devices must have a non-empty IDType")
+		}
+		opts = append(opts, oci.WithWindowsDevice(idType, devID))
+	}
+
 	return opts, nil
 }
 

cmd/nerdctl/container_run_windows_test.go

@@ -108,3 +108,20 @@ func TestRunProcessContainer(t *testing.T) {
 
 	assert.Assert(t, !strings.Contains(inspectOutput, "hyperv"))
 }
+
+// Note that the current implementation of this test is not ideal, since it relies on internal HCS details that
+// Microsoft could decide to change in the future (breaking both this unit test and the one in containerd itself):
+// https://github.com/containerd/containerd/pull/6618#discussion_r823302852
+func TestRunProcessContainerWithDevice(t *testing.T) {
+	testutil.DockerIncompatible(t)
+	base := testutil.NewBase(t)
+
+	base.Cmd(
+		"run",
+		"--rm",
+		"--isolation=process",
+		"--device", "class://5B45201D-F2F2-4F3B-85BB-30FF1F953599",
+		testutil.WindowsNano,
+		"cmd", "/S", "/C", "dir C:\\Windows\\System32\\HostDriverStore",
+	).AssertOutContains("FileRepository")
+}

docs/command-reference.md

@@ -205,7 +205,7 @@ Resource flags:
 - :whale: `--cgroupns=(host|private)`: Cgroup namespace to use
   - Default: "private" on cgroup v2 hosts, "host" on cgroup v1 hosts
 - :whale: `--cgroup-parent`: Optional parent cgroup for the container
-- :whale: `--device`: Add a host device to the container
+- :whale: :blue_square: `--device`: Add a host device to the container
 
 Intel RDT flags: