fix(WCOW): fix file access failure for multistage builds

[billywr]

fix (WCOW) file access failure for multistage builds
Fixes: #5193

The failure occurs on Windows Client SKUs (e.g., Windows 11) but generally works on server SKUs like WS2022, although similar failures can also occur on WS2022 in some cases.

[profnandaa]

And fix the CI build failures.

Can add an explanation in the commit body and PR description that this failure is only observed on the Windows Client SKUs (e.g. Windows 11), but works okay on server e.g. WS2022. I however, came across some similar failure in WS2022 too but a different scenario, I'll need to check my notes and send to you.

[profnandaa]

as per the comments above.

[billywr]

WIP: working on a way to avoid lots of code duplication

[profnandaa]

And fix the CI build failures.

Can add an explanation in the commit body and PR description that this failure is only observed on the Windows Client SKUs (e.g. Windows 11), but works okay on server e.g. WS2022. I however, came across some similar failure in WS2022 too but a different scenario, I'll need to check my notes and send to you.

I could have mistaken, not found it. Found this that I had noted as a repro, but ran it on WS2022 and runs ok. Can just count-check on Win11 with your fix:

FROM mcr.microsoft.com/windows/nanoserver:ltsc2022 as base
USER ContainerAdministrator
RUN echo aa> /foo
WORKDIR /bar

FROM base as base1
COPY hello.txt .

FROM base as base2
COPY --from=base1 /bar/hello.txt .
RUN exit 0

FROM mcr.microsoft.com/windows/nanoserver:ltsc2022
COPY --from=base2 /foo /f

[profnandaa]

Just that minor nitpick, all else LGTM.

[gabriel-samfira]

I believe there was a list of paths which should be excluded if I remember correctly. A number of metadata files, some of which (if not all) are listed here:

https://github.com/containerd/continuity/blob/50fa7de4fc5d1529fed1c4d6e3efad231bf5a232/fs/fstest/compare_windows.go#L19

[profnandaa]

I opened an issue for that some time back #5011, I noticed that that list keeps growing and maintaining a whitelist is going to be a chase game. However, we can rethink it.

[billywr]

@gabriel-samfira Can we proceed with this as is and handle the whitelisting part in the other open issue? This is currently blocking some integration tests for WCOW.

[gabriel-samfira]

Apologies for the delay. I completely missed your replies.

@profnandaa The best source of truth for that list of files is probably the server team at MSFT (you should be able to ping them). We need to mirror what they say we should exclude. But we do need to exclude those files. In some cases we can't walk them (and we shouldn't) even with elevated privileges.

[profnandaa]

Well noted, will follow up. Thanks!