Skip to content

Commit ef2db56

Browse files
author
John Howard
committed
Windows: Default to Hyper-V Containers on client
Signed-off-by: John Howard <jhoward@microsoft.com>
1 parent 4c68381 commit ef2db56

File tree

8 files changed

+63
-9
lines changed

8 files changed

+63
-9
lines changed

‎daemon/daemon_windows.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -470,6 +470,10 @@ func (daemon *Daemon) stats(c *container.Container) (*types.StatsJSON, error) {
470470
// daemon to run in. This is only applicable on Windows
471471
func (daemon *Daemon) setDefaultIsolation() error {
472472
daemon.defaultIsolation = containertypes.Isolation("process")
473+
// On client SKUs, default to Hyper-V
474+
if system.IsWindowsClient() {
475+
daemon.defaultIsolation = containertypes.Isolation("hyperv")
476+
}
473477
for _, option := range daemon.configStore.ExecOptions {
474478
key, val, err := parsers.ParseKeyValueOpt(option)
475479
if err != nil {
@@ -485,6 +489,12 @@ func (daemon *Daemon) setDefaultIsolation() error {
485489
if containertypes.Isolation(val).IsHyperV() {
486490
daemon.defaultIsolation = containertypes.Isolation("hyperv")
487491
}
492+
if containertypes.Isolation(val).IsProcess() {
493+
if system.IsWindowsClient() {
494+
return fmt.Errorf("Windows client operating systems only support Hyper-V containers")
495+
}
496+
daemon.defaultIsolation = containertypes.Isolation("process")
497+
}
488498
default:
489499
return fmt.Errorf("Unrecognised exec-opt '%s'\n", key)
490500
}

‎docs/reference/commandline/create.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,8 @@ Linux namespaces. On Microsoft Windows, you can specify these values:
164164

165165
| Value | Description |
166166
|-----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|
167-
| `default` | Use the value specified by the Docker daemon's `--exec-opt` . If the `daemon` does not specify an isolation technology, Microsoft Windows uses `process` as its default value. |
167+
| `default` | Use the value specified by the Docker daemon's `--exec-opt` . If the `daemon` does not specify an isolation technology, Microsoft Windows uses `process` as its default value if the
168+
daemon is running on Windows server, or `hyperv` if running on Windows client. |
168169
| `process` | Namespace isolation only. |
169170
| `hyperv` | Hyper-V hypervisor partition-based isolation. |
170171

‎docs/reference/commandline/dockerd.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -527,8 +527,9 @@ can specify default container isolation technology with this, for example:
527527

528528
$ dockerd --exec-opt isolation=hyperv
529529

530-
Will make `hyperv` the default isolation technology on Windows, without specifying
531-
isolation value on daemon start, Windows isolation technology will default to `process`.
530+
Will make `hyperv` the default isolation technology on Windows. If no isolation
531+
value is specified on daemon start, on Windows client, the default is
532+
`hyperv`, and on Windows server, the default is `process`.
532533

533534
## Daemon DNS options
534535

‎docs/reference/commandline/run.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -618,14 +618,16 @@ On Microsoft Windows, can take any of these values:
618618
| `process` | Namespace isolation only. |
619619
| `hyperv` | Hyper-V hypervisor partition-based isolation. |
620620

621-
In practice, when running on Microsoft Windows without a `daemon` option set, these two commands are equivalent:
622-
621+
On Windows, the default isolation for client is `hyperv`, and for server is
622+
`process`. Therefore when running on Windows server without a `daemon` option
623+
set, these two commands are equivalent:
623624
```
624625
$ docker run -d --isolation default busybox top
625626
$ docker run -d --isolation process busybox top
626627
```
627628

628-
If you have set the `--exec-opt isolation=hyperv` option on the Docker `daemon`, any of these commands also result in `hyperv` isolation:
629+
If you have set the `--exec-opt isolation=hyperv` option on the Docker `daemon`,
630+
if running on Windows server, any of these commands also result in `hyperv` isolation:
629631

630632
```
631633
$ docker run -d --isolation default busybox top

‎man/docker-create.1.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -197,7 +197,9 @@ two memory nodes.
197197
'host': use the host shared memory,semaphores and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure.
198198

199199
**--isolation**="*default*"
200-
Isolation specifies the type of isolation technology used by containers.
200+
Isolation specifies the type of isolation technology used by containers. Note
201+
that the default on Windows server is `process`, and the default on Windows client
202+
is `hyperv`. Linux only supports `default`.
201203

202204
**--kernel-memory**=""
203205
Kernel memory limit (format: `<number>[<unit>]`, where unit = b, k, m or g)

‎man/docker-run.1.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,9 @@ redirection on the host system.
297297
'host': use the host shared memory,semaphores and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure.
298298

299299
**--isolation**="*default*"
300-
Isolation specifies the type of isolation technology used by containers.
300+
Isolation specifies the type of isolation technology used by containers. Note
301+
that the default on Windows server is `process`, and the default on Windows client
302+
is `hyperv`. Linux only supports `default`.
301303

302304
**-l**, **--label**=[]
303305
Set metadata on the container (e.g., --label com.example.key=value)

‎man/dockerd.8.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ dockerd - Enable daemon mode
3939
[**--ip-masq**[=*true*]]
4040
[**--iptables**[=*true*]]
4141
[**--ipv6**]
42+
[**--isolation**[=*default*]]
4243
[**-l**|**--log-level**[=*info*]]
4344
[**--label**[=*[]*]]
4445
[**--log-driver**[=*json-file*]]
@@ -183,6 +184,11 @@ unix://[/path/to/socket] to use.
183184
**--ipv6**=*true*|*false*
184185
Enable IPv6 support. Default is false. Docker will create an IPv6-enabled bridge with address fe80::1 which will allow you to create IPv6-enabled containers. Use together with `--fixed-cidr-v6` to provide globally routable IPv6 addresses. IPv6 forwarding will be enabled if not used with `--ip-forward=false`. This may collide with your host's current IPv6 settings. For more information please consult the documentation about "Advanced Networking - IPv6".
185186

187+
**--isolation**="*default*"
188+
Isolation specifies the type of isolation technology used by containers. Note
189+
that the default on Windows server is `process`, and the default on Windows client
190+
is `hyperv`. Linux only supports `default`.
191+
186192
**-l**, **--log-level**="*debug*|*info*|*warn*|*error*|*fatal*"
187193
Set the logging level. Default is `info`.
188194

‎pkg/system/syscall_windows.go‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,13 @@ package system
33
import (
44
"syscall"
55
"unsafe"
6+
7+
"github.com/Sirupsen/logrus"
68
)
79

810
var (
9-
ntuserApiset = syscall.NewLazyDLL("ext-ms-win-ntuser-window-l1-1-0")
11+
ntuserApiset = syscall.NewLazyDLL("ext-ms-win-ntuser-window-l1-1-0")
12+
procGetVersionExW = modkernel32.NewProc("GetVersionExW")
1013
)
1114

1215
// OSVersion is a wrapper for Windows version information
@@ -18,6 +21,21 @@ type OSVersion struct {
1821
Build uint16
1922
}
2023

24+
// https://msdn.microsoft.com/en-us/library/windows/desktop/ms724833(v=vs.85).aspx
25+
type osVersionInfoEx struct {
26+
OSVersionInfoSize uint32
27+
MajorVersion uint32
28+
MinorVersion uint32
29+
BuildNumber uint32
30+
PlatformID uint32
31+
CSDVersion [128]uint16
32+
ServicePackMajor uint16
33+
ServicePackMinor uint16
34+
SuiteMask uint16
35+
ProductType byte
36+
Reserve byte
37+
}
38+
2139
// GetOSVersion gets the operating system version on Windows. Note that
2240
// docker.exe must be manifested to get the correct version information.
2341
func GetOSVersion() OSVersion {
@@ -34,6 +52,18 @@ func GetOSVersion() OSVersion {
3452
return osv
3553
}
3654

55+
// IsWindowsClient returns true if the SKU is client
56+
func IsWindowsClient() bool {
57+
osviex := &osVersionInfoEx{OSVersionInfoSize: 284}
58+
r1, _, err := procGetVersionExW.Call(uintptr(unsafe.Pointer(osviex)))
59+
if r1 == 0 {
60+
logrus.Warnf("GetVersionExW failed - assuming server SKU: %v", err)
61+
return false
62+
}
63+
const verNTWorkstation = 0x00000001
64+
return osviex.ProductType == verNTWorkstation
65+
}
66+
3767
// Unmount is a platform-specific helper function to call
3868
// the unmount syscall. Not supported on Windows
3969
func Unmount(dest string) error {

0 commit comments

Comments
 (0)