CreateComputeSystem refuses to work with volumes that are not block storage devices

[hach-que]

Describe the bug
When CreateComputeSystem is called with a spec like this:

{
    "Owner": "containerd-shim-runhcs-v1.exe",
    "SchemaVersion": {
        "Major": 2,
        "Minor": 1
    },
    "Container": {
        "GuestOs": {
            "HostName": "uefs-test-attach"
        },
        "Storage": {
            "Layers": [
                {
                    "Id": "9e6302af-4082-5230-ac0e-efe1e3828954",
                    "Path": "C:\\RKM\\hawkeye-638128459583006246\\containerd\\root\\io.containerd.snapshotter.v1.windows\\snapshots\\28"
                },
                {
                    "Id": "b312b1d4-d749-5cc3-97e7-e272c3e9edf7",
                    "Path": "C:\\RKM\\hawkeye-638128459583006246\\containerd\\root\\io.containerd.snapshotter.v1.windows\\snapshots\\27"
                },
                {
                    "Id": "0366d7a7-bfaf-5a58-bfed-6eb916450ea5",
                    "Path": "C:\\RKM\\hawkeye-638128459583006246\\containerd\\root\\io.containerd.snapshotter.v1.windows\\snapshots\\26"
                },
                {
                    "Id": "ccdd871c-d89e-5f7b-a641-ef72794a2f01",
                    "Path": "C:\\RKM\\hawkeye-638128459583006246\\containerd\\root\\io.containerd.snapshotter.v1.windows\\snapshots\\25"
                },
                {
                    "Id": "e67d9508-fe76-54e0-b098-cabfb7356fd7",
                    "Path": "C:\\RKM\\hawkeye-638128459583006246\\containerd\\root\\io.containerd.snapshotter.v1.windows\\snapshots\\24"
                },
                {
                    "Id": "e3732ab4-a8b2-5962-8e88-a0a76ee83d86",
                    "Path": "C:\\RKM\\hawkeye-638128459583006246\\containerd\\root\\io.containerd.snapshotter.v1.windows\\snapshots\\23"
                },
                {
                    "Id": "51d377df-069c-5b3a-8cb0-e86be7e7cfbe",
                    "Path": "C:\\RKM\\hawkeye-638128459583006246\\containerd\\root\\io.containerd.snapshotter.v1.windows\\snapshots\\22"
                },
                {
                    "Id": "994b900c-05b9-5a61-b236-35342d301241",
                    "Path": "C:\\RKM\\hawkeye-638128459583006246\\containerd\\root\\io.containerd.snapshotter.v1.windows\\snapshots\\21"
                },
                {
                    "Id": "f6f9524c-e3f0-5be2-978d-7e09e0b21299",
                    "Path": "C:\\RKM\\hawkeye-638128459583006246\\containerd\\root\\io.containerd.snapshotter.v1.windows\\snapshots\\15"
                }
            ],
            "Path": "\\\\?\\Volume{e274e341-9153-4cd5-9797-b227fa446fd5}\\"
        },
        "MappedDirectories": [
            {
                "HostPath": "\\\\?\\Volume{0939cd41-c421-11ed-95fe-b927779c0d60}\\",
                "ContainerPath": "C:\\UnrealEngine"
            },
            {
                "HostPath": "\\\\?\\Volume{5e674112-16b9-4bbe-90f0-543cba700a9c}\\RKM\\hawkeye-638128459583006246\\kubernetes-node\\state\\pods\\f93c820a-321c-4d43-97a7-eb4207bd616d\\containers\\uefs-test-attach\\e2c6609f",
                "ContainerPath": "c:\\dev\\termination-log"
            },
            {
                "HostPath": "\\\\?\\Volume{5e674112-16b9-4bbe-90f0-543cba700a9c}\\RKM\\hawkeye-638128459583006246\\kubernetes-node\\state\\pods\\f93c820a-321c-4d43-97a7-eb4207bd616d\\volumes\\kubernetes.io~projected\\kube-api-access-gdlvz",
                "ContainerPath": "c:\\var\\run\\secrets\\kubernetes.io\\serviceaccount",
                "ReadOnly": true
            },
            {
                "HostPath": "\\\\?\\Volume{5e674112-16b9-4bbe-90f0-543cba700a9c}\\RKM\\hawkeye-638128459583006246\\kubernetes-node\\state\\pods\\f93c820a-321c-4d43-97a7-eb4207bd616d\\etc-hosts",
                "ContainerPath": "C:\\Windows\\System32\\drivers\\etc\\hosts"
            }
        ],
        "Processor": {},
        "Networking": {
            "Namespace": "6458ddcd-f383-4cbd-a00f-2c3473e863cc"
        }
    },
    "ShouldTerminateOnLastHandleClosed": true
}

and the target volume \\?\Volume{0939cd41-c421-11ed-95fe-b927779c0d60}\ for the path is backed by something like WinFsp, CreateComputeSystem fails with "Do not attach the filter to the volume at this time."

To Reproduce
Download the WinFsp examples and use e.g. ntptfs like so:

ntptfs-x64 -p C:\SomePathOnTheHost -m C:\SomeTargetPathOnTheHost

Then create a container with C:\SomeTargetPathOnTheHost as the HostPath.

Expected behavior
The container should successfully be created.

Configuration:

• Edition: Windows 11 22000
• Base Image being used: Nano Server
• Container engine: containerd
• Container Engine version: 16.8

Additional context
cc @fady-azmy-msft This is tangentially related to the ProjFS issue a few months ago, though in this case the mount isn't being handled by the container, it's a host path that is failing to be used by CreateComputeSystem.

Also, on my development computer, attempting to use a mount like this causes a blue screen, but on another machine where I attached a kernel debugger I just got Do not attach the filter to the volume at this time. instead, so I haven't been able to get a call stack for the blue screen (I do know it's an IRQL_NOT_LESS_OR_EQUAL though).

[fady-azmy-msft]

Hey @hach-que , I created an internal ticket to track this (#43866428) and someone follow up when I find the right person.

[fady-azmy-msft]

Hello @hach-que, I spoke with the team who drives this and it looks like WinFsp is a custom filesystem that's providing FUSE like functionality. The bind filter does not support custom filesystems, which means it's not supported at the moment. I've let shared this FR to the team for them to consider in the future.

[hach-que]

@fady-azmy-msft Is there a way we can skip the bind filter for the volume mount?

[microsoft-github-policy-service]

This issue has been open for 30 days with no updates.
no assignees, please provide an update or close this issue.

[microsoft-github-policy-service]

This issue has been open for 30 days with no updates.
no assignees, please provide an update or close this issue.

[fady-azmy-msft]

Tagging @shaheedchagani to answer your question.

Since this is by design, I'm going to move this request as a FR and close it (we've shared this signal to the team).