Update hcsshim to v0.6.10

[darstahl]

- What I did

Update hcsshim to v0.6.10 which includes security fixes to address CVE-2018-8115

- Description for the changelog

Security: Change to address CVE-2018-8115

(Addition by @jhowardmsft): Replaces #36938 which vendored v0.6.9. Hence also: Fixes docker/for-win#1947. Fixes #36919 where files are in certain circumstances omitted from layers on commit during a build step on Windows. See microsoft/hcsshim#165 for more detail.

@carlfischer1 Both fixes should probably should be backported.

[darstahl]

This change only affects code that compiles on Windows so the other CI failures can be ignored. I'll restart them anyway, but they shouldn't matter.

This is also been tested by Docker Inc and Microsoft internally.

[lowenna]

LGTM. @johnstep PTAL

[thaJeztah]

The previous PR (#36938) did not have a test case, will that be included as part of this one?

[lowenna]

@thaJeztah TL;DR No.

This is already in EE. Others are free to add test cases if they have time. Resources are limited. This fixes a CVE plus a reported bug, both of which have been verified by both MS and Docker Inc independently. If there needs to be a follow-up PR for tests, that should not block this PR.

[lowenna]

@carlfischer1 FYI

[codecov]

Codecov Report

❗ No coverage uploaded for pull request base (master@51a9119). Click here to learn what that means.
The diff coverage is n/a.

@@            Coverage Diff            @@
##             master   #36985   +/-   ##
=========================================
  Coverage          ?   35.38%           
=========================================
  Files             ?      614           
  Lines             ?    45736           
  Branches          ?        0           
=========================================
  Hits              ?    16183           
  Misses            ?    27414           
  Partials          ?     2139

[johnstep]

LGTM

I found and fixed a separate bug (see microsoft/hcsshim#169) and also wrote an integration test that covers that issue, plus checks that $Recycle.Bin is not committed, and that files are not missing. After this PR is merged, I will vendor hcsshim v0.6.11 into my test branch and open a moby PR.

[thaJeztah]

lgtm

[mback2k]

Could we please also get a new preview version (like 17.10.0-ee-preview-3) with these bugfixes? I have to spent hours of building docker images locally and uploading them to my Windows Server 1709. Waiting for more than 1 hour between each test run due to slow build and upload time locally is very annoying. It would be very appreciated.

[mback2k]

@thaJeztah Could you please tell us if the new release of "18.03.1-ee-1 (2018-06-27)" includes hcsshim v0.6.11 or at least v0.6.10?

[thaJeztah]

@mback2k yes; all current versions of Docker (EE, CE) have the fix in place