Windows: Add Hyper-V isolation fields

Signed-off-by: John Howard <[email protected]>

Author: John Howard

config-windows.md

@@ -112,11 +112,30 @@ For more information about tooling to generate a gMSA, see [Deployment Overview]
 When a container terminates, the Host Compute Service indicates if a Windows update servicing operation is pending.
 You can indicate that a container should be started in a mode to apply pending servicing operations via the OPTIONAL `servicing` field of the Windows configuration.
 
-
 ### Example
 
 ```json
     "windows": {
         "servicing": true
     }
+```
+
+## <a name="configWindowsHyperV" />HyperV
+
+`hyperv` is an OPTIONAL field of the Windows configuration. If present, the container MUST be run with Hyper-V isolation. If omitted, the container MUST be run as a Windows Server container.
+
+The following parameters can be specified:
+
+* **`utilityvmpath`** *(string, OPTIONAL)* - specifies the path to the image used for the utility VM. If not supplied, the runtime will search the container filesystem layers from the bottom-most layer upwards, until it locates "UtilityVM", and default to that path.
+
+* **`sandboxpath`** *(string, REQUIRED)* - specifies the root of the path to the sandbox to be used for the container.
+
+### Example
+
+```json
+    "windows": {
+        "hyperv": {
+            "sandboxpath": "C:\\\\programdata\\\\docker\\\\windowsfilter"
+        }
+    }
 ```

schema/config-windows.json

@@ -73,6 +73,20 @@
             "servicing": {
                 "id": "https://opencontainers.org/schema/bundle/windows/servicing",
                 "type": "boolean"
+            },
+            "hyperv": {
+                "id": "https://opencontainers.org/schema/bundle/windows/hyperv",
+                "type": "object",
+                "properties": {
+                    "utilityvmpath": {
+                        "id": "https://opencontainers.org/schema/bundle/windows/hyperv/utilityvmpath",
+                        "type": "string"
+                    },
+                    "sandboxpath": {
+                        "id": "https://opencontainers.org/schema/bundle/windows/hyperv/sandboxpath",
+                        "type": "string"
+                    }
+                }
             }
         }
     }

specs-go/config.go

@@ -436,6 +436,8 @@ type Windows struct {
 	CredentialSpec interface{} `json:"credentialspec,omitempty"`
 	// Servicing indicates if the container is being started in a mode to apply a Windows Update servicing operation.
 	Servicing bool `json:"servicing,omitempty"`
+	// HyperV contains information for running a container with Hyper-V isolation.
+	HyperV *WindowsHyperV `json:"hyperv,omitempty"`
 }
 
 // WindowsResources has container runtime resource constraints for containers running on Windows.
@@ -482,6 +484,14 @@ type WindowsNetworkResources struct {
 	EgressBandwidth *uint64 `json:"egressBandwidth,omitempty"`
 }
 
+// WindowsHyperV contains information for configuring a container to run with Hyper-V isolation.
+type WindowsHyperV struct {
+	// UtilityVMPath is an optional path to the image used for the Utility VM.
+	UtilityVMPath string `json:"utilityvmpath,omitempty"`
+	// SandboxPath is a required host-path to the sandbox to be used by the container.
+	SandboxPath string `json:"sandboxpath"`
+}
+
 // LinuxSeccomp represents syscall restrictions
 type LinuxSeccomp struct {
 	DefaultAction LinuxSeccompAction `json:"defaultAction"`