fix(WCOW): fix file access failure for multistage builds

[billywr]

fix (WCOW) file access failure for multistage builds
Fixes: #5193

The failure occurs on Windows Client SKUs (e.g., Windows 11) but generally works on server SKUs like WS2022, although similar failures can also occur on WS2022 in some cases.

[profnandaa]

And fix the CI build failures.

Can add an explanation in the commit body and PR description that this failure is only observed on the Windows Client SKUs (e.g. Windows 11), but works okay on server e.g. WS2022. I however, came across some similar failure in WS2022 too but a different scenario, I'll need to check my notes and send to you.

[profnandaa]

as per the comments above.

[billywr]

WIP: working on a way to avoid lots of code duplication

[profnandaa]

And fix the CI build failures.

Can add an explanation in the commit body and PR description that this failure is only observed on the Windows Client SKUs (e.g. Windows 11), but works okay on server e.g. WS2022. I however, came across some similar failure in WS2022 too but a different scenario, I'll need to check my notes and send to you.

I could have mistaken, not found it. Found this that I had noted as a repro, but ran it on WS2022 and runs ok. Can just count-check on Win11 with your fix:

FROM mcr.microsoft.com/windows/nanoserver:ltsc2022 as base
USER ContainerAdministrator
RUN echo aa> /foo
WORKDIR /bar

FROM base as base1
COPY hello.txt .

FROM base as base2
COPY --from=base1 /bar/hello.txt .
RUN exit 0

FROM mcr.microsoft.com/windows/nanoserver:ltsc2022
COPY --from=base2 /foo /f

[profnandaa]

Just that minor nitpick, all else LGTM.

[gabriel-samfira]

I believe there was a list of paths which should be excluded if I remember correctly. A number of metadata files, some of which (if not all) are listed here:

https://github.com/containerd/continuity/blob/50fa7de4fc5d1529fed1c4d6e3efad231bf5a232/fs/fstest/compare_windows.go#L19

[profnandaa]

I opened an issue for that some time back #5011, I noticed that that list keeps growing and maintaining a whitelist is going to be a chase game. However, we can rethink it.