Vendor Microsoft/hcsshim@4dd3466f

Signed-off-by: John Howard <jhoward@microsoft.com>

10 files changed, 706 insertions, 12 deletions

diff --git a/vendor.conf b/vendor.conf
index 805f89626e..a1cbad89f7 100644
--- a/vendor.conf
+++ b/vendor.conf
@@ -1,6 +1,6 @@
 # the following lines are in sorted order, FYI
 github.com/Azure/go-ansiterm d6e3b3328b783f23731bc4d058875b0371ff8109
-github.com/Microsoft/hcsshim v0.8.6
+github.com/Microsoft/hcsshim 4dd3466fb47933ff5df526e7751cdf1f6315bfcf
 github.com/Microsoft/go-winio v0.4.11
 github.com/docker/libtrust 9cbd2a1374f46905c68a4eb3694a130610adc62a
 github.com/go-check/check 4ed411733c5785b40214c70bce814c3a3a689609 https://github.com/cpuguy83/check.git
diff --git a/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/doc.go b/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/doc.go
new file mode 100644
index 0000000000..0684d05963
--- /dev/null
+++ b/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/doc.go
@@ -0,0 +1 @@
+package options
diff --git a/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.pb.go b/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.pb.go
new file mode 100644
index 0000000000..45177c17a5
--- /dev/null
+++ b/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.pb.go
@@ -0,0 +1,617 @@
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.proto
+
+/*
+	Package options is a generated protocol buffer package.
+
+	It is generated from these files:
+		github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.proto
+
+	It has these top-level messages:
+		Options
+*/
+package options
+
+import proto "github.com/gogo/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
+// skipping weak import gogoproto "github.com/gogo/protobuf/gogoproto"
+
+import strings "strings"
+import reflect "reflect"
+
+import io "io"
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
+
+type Options_DebugType int32
+
+const (
+	Options_NPIPE Options_DebugType = 0
+	Options_FILE  Options_DebugType = 1
+	Options_ETW   Options_DebugType = 2
+)
+
+var Options_DebugType_name = map[int32]string{
+	0: "NPIPE",
+	1: "FILE",
+	2: "ETW",
+}
+var Options_DebugType_value = map[string]int32{
+	"NPIPE": 0,
+	"FILE":  1,
+	"ETW":   2,
+}
+
+func (x Options_DebugType) String() string {
+	return proto.EnumName(Options_DebugType_name, int32(x))
+}
+func (Options_DebugType) EnumDescriptor() ([]byte, []int) { return fileDescriptorRunhcs, []int{0, 0} }
+
+type Options_SandboxIsolation int32
+
+const (
+	Options_PROCESS    Options_SandboxIsolation = 0
+	Options_HYPERVISOR Options_SandboxIsolation = 1
+)
+
+var Options_SandboxIsolation_name = map[int32]string{
+	0: "PROCESS",
+	1: "HYPERVISOR",
+}
+var Options_SandboxIsolation_value = map[string]int32{
+	"PROCESS":    0,
+	"HYPERVISOR": 1,
+}
+
+func (x Options_SandboxIsolation) String() string {
+	return proto.EnumName(Options_SandboxIsolation_name, int32(x))
+}
+func (Options_SandboxIsolation) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptorRunhcs, []int{0, 1}
+}
+
+type Options struct {
+	// enable debug tracing
+	Debug bool `protobuf:"varint,1,opt,name=debug,proto3" json:"debug,omitempty"`
+	// debug tracing output type
+	DebugType Options_DebugType `protobuf:"varint,2,opt,name=debug_type,json=debugType,proto3,enum=containerd.runhcs.v1.Options_DebugType" json:"debug_type,omitempty"`
+	// registry key root for storage of the runhcs container state
+	RegistryRoot string `protobuf:"bytes,3,opt,name=registry_root,json=registryRoot,proto3" json:"registry_root,omitempty"`
+	// sandbox_image is the image to use for the sandbox that matches the
+	// sandbox_platform.
+	SandboxImage string `protobuf:"bytes,4,opt,name=sandbox_image,json=sandboxImage,proto3" json:"sandbox_image,omitempty"`
+	// sandbox_platform is a CRI setting that specifies the platform
+	// architecture for all sandbox's in this runtime. Values are
+	// 'windows/amd64' and 'linux/amd64'.
+	SandboxPlatform string `protobuf:"bytes,5,opt,name=sandbox_platform,json=sandboxPlatform,proto3" json:"sandbox_platform,omitempty"`
+	// sandbox_isolation is a CRI setting that specifies the isolation level of
+	// the sandbox. For Windows runtime PROCESS and HYPERVISOR are valid. For
+	// LCOW only HYPERVISOR is valid and default if omitted.
+	SandboxIsolation Options_SandboxIsolation `protobuf:"varint,6,opt,name=sandbox_isolation,json=sandboxIsolation,proto3,enum=containerd.runhcs.v1.Options_SandboxIsolation" json:"sandbox_isolation,omitempty"`
+	// boot_files_root_path is the path to the directory containing the LCOW
+	// kernel and root FS files.
+	BootFilesRootPath string `protobuf:"bytes,7,opt,name=boot_files_root_path,json=bootFilesRootPath,proto3" json:"boot_files_root_path,omitempty"`
+}
+
+func (m *Options) Reset()                    { *m = Options{} }
+func (*Options) ProtoMessage()               {}
+func (*Options) Descriptor() ([]byte, []int) { return fileDescriptorRunhcs, []int{0} }
+
+func init() {
+	proto.RegisterType((*Options)(nil), "containerd.runhcs.v1.Options")
+	proto.RegisterEnum("containerd.runhcs.v1.Options_DebugType", Options_DebugType_name, Options_DebugType_value)
+	proto.RegisterEnum("containerd.runhcs.v1.Options_SandboxIsolation", Options_SandboxIsolation_name, Options_SandboxIsolation_value)
+}
+func (m *Options) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Options) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if m.Debug {
+		dAtA[i] = 0x8
+		i++
+		if m.Debug {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if m.DebugType != 0 {
+		dAtA[i] = 0x10
+		i++
+		i = encodeVarintRunhcs(dAtA, i, uint64(m.DebugType))
+	}
+	if len(m.RegistryRoot) > 0 {
+		dAtA[i] = 0x1a
+		i++
+		i = encodeVarintRunhcs(dAtA, i, uint64(len(m.RegistryRoot)))
+		i += copy(dAtA[i:], m.RegistryRoot)
+	}
+	if len(m.SandboxImage) > 0 {
+		dAtA[i] = 0x22
+		i++
+		i = encodeVarintRunhcs(dAtA, i, uint64(len(m.SandboxImage)))
+		i += copy(dAtA[i:], m.SandboxImage)
+	}
+	if len(m.SandboxPlatform) > 0 {
+		dAtA[i] = 0x2a
+		i++
+		i = encodeVarintRunhcs(dAtA, i, uint64(len(m.SandboxPlatform)))
+		i += copy(dAtA[i:], m.SandboxPlatform)
+	}
+	if m.SandboxIsolation != 0 {
+		dAtA[i] = 0x30
+		i++
+		i = encodeVarintRunhcs(dAtA, i, uint64(m.SandboxIsolation))
+	}
+	if len(m.BootFilesRootPath) > 0 {
+		dAtA[i] = 0x3a
+		i++
+		i = encodeVarintRunhcs(dAtA, i, uint64(len(m.BootFilesRootPath)))
+		i += copy(dAtA[i:], m.BootFilesRootPath)
+	}
+	return i, nil
+}
+
+func encodeVarintRunhcs(dAtA []byte, offset int, v uint64) int {
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return offset + 1
+}
+func (m *Options) Size() (n int) {
+	var l int
+	_ = l
+	if m.Debug {
+		n += 2
+	}
+	if m.DebugType != 0 {
+		n += 1 + sovRunhcs(uint64(m.DebugType))
+	}
+	l = len(m.RegistryRoot)
+	if l > 0 {
+		n += 1 + l + sovRunhcs(uint64(l))
+	}
+	l = len(m.SandboxImage)
+	if l > 0 {
+		n += 1 + l + sovRunhcs(uint64(l))
+	}
+	l = len(m.SandboxPlatform)
+	if l > 0 {
+		n += 1 + l + sovRunhcs(uint64(l))
+	}
+	if m.SandboxIsolation != 0 {
+		n += 1 + sovRunhcs(uint64(m.SandboxIsolation))
+	}
+	l = len(m.BootFilesRootPath)
+	if l > 0 {
+		n += 1 + l + sovRunhcs(uint64(l))
+	}
+	return n
+}
+
+func sovRunhcs(x uint64) (n int) {
+	for {
+		n++
+		x >>= 7
+		if x == 0 {
+			break
+		}
+	}
+	return n
+}
+func sozRunhcs(x uint64) (n int) {
+	return sovRunhcs(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *Options) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Options{`,
+		`Debug:` + fmt.Sprintf("%v", this.Debug) + `,`,
+		`DebugType:` + fmt.Sprintf("%v", this.DebugType) + `,`,
+		`RegistryRoot:` + fmt.Sprintf("%v", this.RegistryRoot) + `,`,
+		`SandboxImage:` + fmt.Sprintf("%v", this.SandboxImage) + `,`,
+		`SandboxPlatform:` + fmt.Sprintf("%v", this.SandboxPlatform) + `,`,
+		`SandboxIsolation:` + fmt.Sprintf("%v", this.SandboxIsolation) + `,`,
+		`BootFilesRootPath:` + fmt.Sprintf("%v", this.BootFilesRootPath) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringRunhcs(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *Options) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowRunhcs
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Options: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Options: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Debug", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRunhcs
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Debug = bool(v != 0)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DebugType", wireType)
+			}
+			m.DebugType = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRunhcs
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.DebugType |= (Options_DebugType(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RegistryRoot", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRunhcs
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRunhcs
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RegistryRoot = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SandboxImage", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRunhcs
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRunhcs
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SandboxImage = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SandboxPlatform", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRunhcs
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRunhcs
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SandboxPlatform = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SandboxIsolation", wireType)
+			}
+			m.SandboxIsolation = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRunhcs
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.SandboxIsolation |= (Options_SandboxIsolation(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BootFilesRootPath", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRunhcs
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRunhcs
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.BootFilesRootPath = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipRunhcs(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthRunhcs
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipRunhcs(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowRunhcs
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowRunhcs
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+			return iNdEx, nil
+		case 1:
+			iNdEx += 8
+			return iNdEx, nil
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowRunhcs
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			iNdEx += length
+			if length < 0 {
+				return 0, ErrInvalidLengthRunhcs
+			}
+			return iNdEx, nil
+		case 3:
+			for {
+				var innerWire uint64
+				var start int = iNdEx
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return 0, ErrIntOverflowRunhcs
+					}
+					if iNdEx >= l {
+						return 0, io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					innerWire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				innerWireType := int(innerWire & 0x7)
+				if innerWireType == 4 {
+					break
+				}
+				next, err := skipRunhcs(dAtA[start:])
+				if err != nil {
+					return 0, err
+				}
+				iNdEx = start + next
+			}
+			return iNdEx, nil
+		case 4:
+			return iNdEx, nil
+		case 5:
+			iNdEx += 4
+			return iNdEx, nil
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+	}
+	panic("unreachable")
+}
+
+var (
+	ErrInvalidLengthRunhcs = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowRunhcs   = fmt.Errorf("proto: integer overflow")
+)
+
+func init() {
+	proto.RegisterFile("github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.proto", fileDescriptorRunhcs)
+}
+
+var fileDescriptorRunhcs = []byte{
+	// 424 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x92, 0x3b, 0x8f, 0xd3, 0x40,
+	0x10, 0x80, 0xbd, 0x97, 0xcb, 0xe5, 0x32, 0xc0, 0xe1, 0x5b, 0xa5, 0xb0, 0x28, 0xac, 0x28, 0x14,
+	0xe4, 0x8a, 0x78, 0x75, 0x50, 0xd2, 0x01, 0x8e, 0x08, 0x02, 0x62, 0x39, 0x27, 0x9e, 0x85, 0xe5,
+	0x57, 0xec, 0x95, 0x62, 0x8f, 0xb5, 0xbb, 0x39, 0x91, 0x8e, 0x5f, 0x87, 0xae, 0xa4, 0xa4, 0xe4,
+	0xf2, 0x4b, 0xd0, 0xfa, 0x11, 0x24, 0x84, 0x68, 0xa8, 0x3c, 0xfe, 0xe6, 0xf3, 0x3c, 0xac, 0x81,
+	0x65, 0xc6, 0x55, 0xbe, 0x8d, 0x9c, 0x18, 0x0b, 0xf6, 0x86, 0xc7, 0x02, 0x25, 0xae, 0x15, 0xcb,
+	0x63, 0x29, 0x73, 0x5e, 0xb0, 0xb8, 0x48, 0x58, 0x8c, 0xa5, 0x0a, 0x79, 0x99, 0x8a, 0x64, 0xa6,
+	0xd9, 0x4c, 0x6c, 0xcb, 0x3c, 0x96, 0xb3, 0xeb, 0x4b, 0x86, 0x95, 0xe2, 0x58, 0x4a, 0xd6, 0x10,
+	0xa7, 0x12, 0xa8, 0x90, 0x8e, 0x7e, 0xfb, 0x4e, 0x9b, 0xb8, 0xbe, 0x7c, 0x30, 0xca, 0x30, 0xc3,
+	0x5a, 0x60, 0x3a, 0x6a, 0xdc, 0xc9, 0xb7, 0x1e, 0x0c, 0x96, 0x4d, 0x11, 0x3a, 0x82, 0x7e, 0x92,
+	0x46, 0xdb, 0xcc, 0x22, 0x63, 0x32, 0x3d, 0xf5, 0x9b, 0x17, 0x3a, 0x07, 0xa8, 0x83, 0x40, 0xed,
+	0xaa, 0xd4, 0x3a, 0x1a, 0x93, 0xe9, 0xd9, 0xe3, 0x47, 0xce, 0xdf, 0x5a, 0x38, 0x6d, 0x21, 0xe7,
+	0x85, 0xf6, 0xaf, 0x76, 0x55, 0xea, 0x0f, 0x93, 0x2e, 0xa4, 0x0f, 0xe1, 0x9e, 0x48, 0x33, 0x2e,
+	0x95, 0xd8, 0x05, 0x02, 0x51, 0x59, 0xbd, 0x31, 0x99, 0x0e, 0xfd, 0xbb, 0x1d, 0xf4, 0x11, 0x95,
+	0x96, 0x64, 0x58, 0x26, 0x11, 0x7e, 0x09, 0x78, 0x11, 0x66, 0xa9, 0x75, 0xdc, 0x48, 0x2d, 0x5c,
+	0x68, 0x46, 0x2f, 0xc0, 0xec, 0xa4, 0x6a, 0x13, 0xaa, 0x35, 0x8a, 0xc2, 0xea, 0xd7, 0xde, 0xfd,
+	0x96, 0x7b, 0x2d, 0xa6, 0x9f, 0xe1, 0xfc, 0x50, 0x4f, 0xe2, 0x26, 0xd4, 0xf3, 0x59, 0x27, 0xf5,
+	0x0e, 0xce, 0xbf, 0x77, 0x58, 0xb5, 0x1d, 0xbb, 0xaf, 0xfc, 0xae, 0xe7, 0x81, 0x50, 0x06, 0xa3,
+	0x08, 0x51, 0x05, 0x6b, 0xbe, 0x49, 0x65, 0xbd, 0x53, 0x50, 0x85, 0x2a, 0xb7, 0x06, 0xf5, 0x2c,
+	0xe7, 0x3a, 0x37, 0xd7, 0x29, 0xbd, 0x99, 0x17, 0xaa, 0x7c, 0x72, 0x01, 0xc3, 0xc3, 0xaf, 0xa1,
+	0x43, 0xe8, 0xbf, 0xf5, 0x16, 0x9e, 0x6b, 0x1a, 0xf4, 0x14, 0x8e, 0xe7, 0x8b, 0xd7, 0xae, 0x49,
+	0xe8, 0x00, 0x7a, 0xee, 0xd5, 0x7b, 0xf3, 0x68, 0xc2, 0xc0, 0xfc, 0x73, 0x02, 0x7a, 0x07, 0x06,
+	0x9e, 0xbf, 0x7c, 0xee, 0xae, 0x56, 0xa6, 0x41, 0xcf, 0x00, 0x5e, 0x7e, 0xf4, 0x5c, 0xff, 0xdd,
+	0x62, 0xb5, 0xf4, 0x4d, 0xf2, 0x2c, 0xb9, 0xb9, 0xb5, 0x8d, 0x1f, 0xb7, 0xb6, 0xf1, 0x75, 0x6f,
+	0x93, 0x9b, 0xbd, 0x4d, 0xbe, 0xef, 0x6d, 0xf2, 0x73, 0x6f, 0x93, 0x4f, 0xaf, 0xfe, 0xff, 0xbe,
+	0x9e, 0xb6, 0xcf, 0x0f, 0x46, 0x74, 0x52, 0xdf, 0xcd, 0x93, 0x5f, 0x01, 0x00, 0x00, 0xff, 0xff,
+	0x7a, 0x2e, 0x4a, 0xea, 0xb6, 0x02, 0x00, 0x00,
+}
diff --git a/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.proto b/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.proto
new file mode 100644
index 0000000000..9a8ec1e2d5
--- /dev/null
+++ b/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.proto
@@ -0,0 +1,47 @@
+syntax = "proto3";
+
+package containerd.runhcs.v1;
+
+import weak "gogoproto/gogo.proto";
+
+option go_package = "github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options;options";
+
+message Options {
+	// enable debug tracing
+	bool debug = 1;
+
+	enum DebugType {
+		NPIPE = 0;
+		FILE = 1;
+		ETW = 2;
+	}
+
+	// debug tracing output type
+	DebugType debug_type = 2;
+
+	// registry key root for storage of the runhcs container state
+	string registry_root = 3;
+
+	// sandbox_image is the image to use for the sandbox that matches the
+	// sandbox_platform.
+	string sandbox_image = 4;
+
+	// sandbox_platform is a CRI setting that specifies the platform
+	// architecture for all sandbox's in this runtime. Values are
+	// 'windows/amd64' and 'linux/amd64'.
+	string sandbox_platform = 5;
+
+	enum SandboxIsolation {
+		PROCESS = 0;
+		HYPERVISOR = 1;
+	}
+
+	// sandbox_isolation is a CRI setting that specifies the isolation level of
+	// the sandbox. For Windows runtime PROCESS and HYPERVISOR are valid. For
+	// LCOW only HYPERVISOR is valid and default if omitted.
+	SandboxIsolation sandbox_isolation = 6;
+
+	// boot_files_root_path is the path to the directory containing the LCOW
+	// kernel and root FS files.
+	string boot_files_root_path = 7;
+}
diff --git a/vendor/github.com/Microsoft/hcsshim/internal/hcs/process.go b/vendor/github.com/Microsoft/hcsshim/internal/hcs/process.go
index 41e20bbf99..0a9c9199c9 100644
--- a/vendor/github.com/Microsoft/hcsshim/internal/hcs/process.go
+++ b/vendor/github.com/Microsoft/hcsshim/internal/hcs/process.go
@@ -276,15 +276,20 @@ func (process *Process) ExitCode() (_ int, err error) {
 
 	properties, err := process.Properties()
 	if err != nil {
-		return 0, makeProcessError(process, operation, err, nil)
+		return -1, makeProcessError(process, operation, err, nil)
 	}
 
 	if properties.Exited == false {
-		return 0, makeProcessError(process, operation, ErrInvalidProcessState, nil)
+		return -1, makeProcessError(process, operation, ErrInvalidProcessState, nil)
 	}
 
 	if properties.LastWaitResult != 0 {
-		return 0, makeProcessError(process, operation, syscall.Errno(properties.LastWaitResult), nil)
+		logrus.WithFields(logrus.Fields{
+			logfields.ContainerID: process.SystemID(),
+			logfields.ProcessID:   process.processID,
+			"wait-result":         properties.LastWaitResult,
+		}).Warn("hcsshim::Process::ExitCode - Non-zero last wait result")
+		return -1, nil
 	}
 
 	return int(properties.ExitCode), nil
@@ -450,7 +455,7 @@ func (process *Process) unregisterCallback() error {
 	closeChannels(context.channels)
 
 	callbackMapLock.Lock()
-	callbackMap[callbackNumber] = nil
+	delete(callbackMap, callbackNumber)
 	callbackMapLock.Unlock()
 
 	handle = 0
diff --git a/vendor/github.com/Microsoft/hcsshim/internal/hcs/system.go b/vendor/github.com/Microsoft/hcsshim/internal/hcs/system.go
index 20b242524d..8fa0c7b658 100644
--- a/vendor/github.com/Microsoft/hcsshim/internal/hcs/system.go
+++ b/vendor/github.com/Microsoft/hcsshim/internal/hcs/system.go
@@ -280,7 +280,7 @@ func (computeSystem *System) Shutdown() (err error) {
 	operation := "hcsshim::ComputeSystem::Shutdown"
 	computeSystem.logOperationBegin(operation)
 	defer func() {
-		if IsAlreadyStopped(err) {
+		if IsAlreadyStopped(err) || IsPending(err) {
 			computeSystem.logOperationEnd(operation, nil)
 		} else {
 			computeSystem.logOperationEnd(operation, err)
@@ -640,7 +640,7 @@ func (computeSystem *System) unregisterCallback() error {
 	closeChannels(context.channels)
 
 	callbackMapLock.Lock()
-	callbackMap[callbackNumber] = nil
+	delete(callbackMap, callbackNumber)
 	callbackMapLock.Unlock()
 
 	handle = 0
diff --git a/vendor/github.com/Microsoft/hcsshim/internal/hcs/waithelper.go b/vendor/github.com/Microsoft/hcsshim/internal/hcs/waithelper.go
index 91e212c574..c7d660cc74 100644
--- a/vendor/github.com/Microsoft/hcsshim/internal/hcs/waithelper.go
+++ b/vendor/github.com/Microsoft/hcsshim/internal/hcs/waithelper.go
@@ -17,6 +17,11 @@ func processAsyncHcsResult(err error, resultp *uint16, callbackNumber uintptr, e
 
 func waitForNotification(callbackNumber uintptr, expectedNotification hcsNotification, timeout *time.Duration) error {
 	callbackMapLock.RLock()
+	if _, ok := callbackMap[callbackNumber]; !ok {
+		callbackMapLock.RUnlock()
+		logrus.Errorf("failed to waitForNotification: callbackNumber %d does not exist in callbackMap", callbackNumber)
+		return ErrHandleClose
+	}
 	channels := callbackMap[callbackNumber].channels
 	callbackMapLock.RUnlock()
 
diff --git a/vendor/github.com/Microsoft/hcsshim/internal/hns/hnsnetwork.go b/vendor/github.com/Microsoft/hcsshim/internal/hns/hnsnetwork.go
index 7e859de912..b7ae96fddd 100644
--- a/vendor/github.com/Microsoft/hcsshim/internal/hns/hnsnetwork.go
+++ b/vendor/github.com/Microsoft/hcsshim/internal/hns/hnsnetwork.go
@@ -2,9 +2,9 @@ package hns
 
 import (
 	"encoding/json"
-	"net"
-
+	"errors"
 	"github.com/sirupsen/logrus"
+	"net"
 )
 
 // Subnet is assoicated with a network and represents a list
@@ -98,6 +98,12 @@ func (network *HNSNetwork) Create() (*HNSNetwork, error) {
 	title := "hcsshim::HNSNetwork::" + operation
 	logrus.Debugf(title+" id=%s", network.Id)
 
+	for _, subnet := range network.Subnets {
+		if (subnet.AddressPrefix != "") && (subnet.GatewayAddress == "") {
+			return nil, errors.New("network create error, subnet has address prefix but no gateway specified")
+		}
+	}
+
 	jsonString, err := json.Marshal(network)
 	if err != nil {
 		return nil, err
diff --git a/vendor/github.com/Microsoft/hcsshim/internal/schema2/plan9_share.go b/vendor/github.com/Microsoft/hcsshim/internal/schema2/plan9_share.go
index eb171817a6..41f8fdea02 100644
--- a/vendor/github.com/Microsoft/hcsshim/internal/schema2/plan9_share.go
+++ b/vendor/github.com/Microsoft/hcsshim/internal/schema2/plan9_share.go
@@ -10,7 +10,6 @@
 package hcsschema
 
 type Plan9Share struct {
-
 	Name string `json:"Name,omitempty"`
 
 	//  The name by which the guest operation system can access this share, via  the aname parameter in the Plan9 protocol.
@@ -30,4 +29,6 @@ type Plan9Share struct {
 	ReadOnly bool `json:"ReadOnly,omitempty"`
 
 	UseShareRootIdentity bool `json:"UseShareRootIdentity,omitempty"`
+
+	AllowedFiles []string `json:"AllowedFiles,omitempty"`
 }
diff --git a/vendor/github.com/Microsoft/hcsshim/vendor.conf b/vendor/github.com/Microsoft/hcsshim/vendor.conf
index 6e0ed15662..f6bb5dc7c9 100644
--- a/vendor/github.com/Microsoft/hcsshim/vendor.conf
+++ b/vendor/github.com/Microsoft/hcsshim/vendor.conf
@@ -1,13 +1,20 @@
 github.com/blang/semver v3.1.0
 github.com/containerd/console c12b1e7919c14469339a5d38f2f8ed9b64a9de23
+github.com/containerd/containerd faec567304bbdf6864b1663d4f813641b5880a4a
 github.com/containerd/go-runc 5a6d9f37cfa36b15efba46dc7ea349fa9b7143c3
+github.com/containerd/ttrpc 2a805f71863501300ae1976d29f0454ae003e85a
+github.com/containerd/typeurl a93fcdb778cd272c6e9b3028b2f42d813e785d40
+github.com/gogo/protobuf v1.0.0
+github.com/golang/protobuf v1.1.0
 github.com/hashicorp/errwrap 7554cd9344cec97297fa6649b055a8c98c2a1e55
 github.com/hashicorp/go-multierror ed905158d87462226a13fe39ddf685ea65f1c11f
 github.com/konsorten/go-windows-terminal-sequences v1.0.1
 github.com/linuxkit/virtsock 8e79449dea0735c1c056d814934dd035734cc97c
 github.com/Microsoft/go-winio 16cfc975803886a5e47c4257a24c8d8c52e178b2
 github.com/Microsoft/opengcs v0.3.9
-github.com/opencontainers/runtime-spec eba862dc2470385a233c7507392675cbeadf7353
+github.com/opencontainers/go-digest c9281466c8b2f606084ac71339773efd177436e7
+github.com/opencontainers/runc 12f6a991201fdb8f82579582d5e00e28fba06d0a
+github.com/opencontainers/runtime-spec 29686dbc5559d93fb1ef402eeda3e35c38d75af4
 github.com/opencontainers/runtime-tools 1d69bd0f9c39677d0630e50664fbc3154ae61b88
 github.com/pkg/errors v0.8.1
 github.com/sirupsen/logrus v1.3.0
@@ -17,5 +24,10 @@ github.com/xeipuuv/gojsonpointer 4e3ac2762d5f479393488629ee9370b50873b3a6
 github.com/xeipuuv/gojsonreference bd5ef7bd5415a7ac448318e64f11a24cd21e594b
 github.com/xeipuuv/gojsonschema 1d523034197ff1f222f6429836dd36a2457a1874
 golang.org/x/crypto ff983b9c42bc9fbf91556e191cc8efb585c16908
+golang.org/x/net ed066c81e75eba56dd9bd2139ade88125b855585
 golang.org/x/sync 37e7f081c4d4c64e13b10787722085407fe5d15f
-golang.org/x/sys e5ecc2a6747ce8d4af18ed98b3de5ae30eb3a5bb
\ No newline at end of file
+golang.org/x/sys e5ecc2a6747ce8d4af18ed98b3de5ae30eb3a5bb
+golang.org/x/text d14c52b222ee852cdba8b07206ca0c614b389876
+google.golang.org/genproto d80a6e20e776b0b17a324d0ba1ab50a39c8e8944
+google.golang.org/grpc v1.12.0
+k8s.io/kubernetes v1.13.0