reject task creation if the UVM does not support HPCs

Signed-off-by: Harsh Rawat <harshrawat@microsoft.com>

Author: rawahars

cmd/containerd-shim-runhcs-v1/pod.go

@@ -502,6 +502,11 @@ func (p *pod) updateConfigForHostProcessContainer(s *specs.Spec) error {
 		return errors.New("cannot create a host process container inside sandbox which has missing annotation: microsoft.com/hostprocess-container")
 	}
 
+	if isHypervisorIsolatedPrivilegedSandbox &&
+		p.host != nil && !p.host.HostProcessContainerSupported() {
+		return fmt.Errorf("UVM does not support HostProcess containers")
+	}
+
 	if isProcessIsolatedPrivilegedSandbox || (isHypervisorIsolatedPrivilegedSandbox && isHypervisorIsolatedPrivilegedContainer) {
 		if isProcessIsolatedPrivilegedSandbox && !isProcessIsolatedPrivilegedContainer {
 			// This is a short circuit to make sure that all containers in a pod will have

internal/gcs/guestcaps.go

@@ -104,3 +104,7 @@ func (w *WCOWGuestDefinedCapabilities) IsDeleteContainerStateSupported() bool {
 func (w *WCOWGuestDefinedCapabilities) IsLogForwardingSupported() bool {
 	return w.LogForwardingSupported
 }
+
+func (w *WCOWGuestDefinedCapabilities) IsHostProcessContainerSupported() bool {
+	return w.HostProcessContainerSupported
+}

internal/hcs/schema1/schema1.go

@@ -222,6 +222,7 @@ type GuestDefinedCapabilities struct {
 	DeleteContainerStateSupported bool `json:",omitempty"`
 	UpdateContainerSupported      bool `json:",omitempty"`
 	LogForwardingSupported        bool `json:",omitempty"`
+	HostProcessContainerSupported bool `json:",omitempty"`
 }
 
 // GuestConnectionInfo is the structure of an iterm return by a GuestConnection call on a utility VM

internal/uvm/capabilities.go

@@ -21,6 +21,17 @@ func (uvm *UtilityVM) DeleteContainerStateSupported() bool {
 	return uvm.guestCaps.IsDeleteContainerStateSupported()
 }
 
+// HostProcessContainerSupported returns if the WCOW UVM supports
+// running host process containers.
+func (uvm *UtilityVM) HostProcessContainerSupported() bool {
+	if uvm.OS() != "windows" {
+		return false
+	}
+
+	wcaps := gcs.GetWCOWCapabilities(uvm.gc.Capabilities())
+	return wcaps != nil && wcaps.HostProcessContainerSupported
+}
+
 // Capabilities returns the protocol version and the guest defined capabilities.
 // This should only be used for testing.
 func (uvm *UtilityVM) Capabilities() (uint32, gcs.GuestDefinedCapabilities) {