moby · billywr · Sep 24, 2024
diff --git a/cache/contenthash/checksum.go b/cache/contenthash/checksum.go
@@ -1034,7 +1034,7 @@ func (cc *cacheContext) scanPath(ctx context.Context, m *mount, p string, follow
 		scanPath = resolvedPath
 	}
 
-	err = filepath.Walk(scanPath, func(itemPath string, fi os.FileInfo, err error) error {
+	walkFunc := func(itemPath string, fi os.FileInfo, err error) error {
 		if scanCounterEnable {
 			scanCounter.Add(1)
 		}
@@ -1073,7 +1073,10 @@ func (cc *cacheContext) scanPath(ctx context.Context, m *mount, p string, follow
 			txn.Insert(k, cr)
 		}
 		return nil
-	})
+	}
+
+	err = cc.walk(scanPath, walkFunc)
+
 	if err != nil {
 		return err
 	}

diff --git a/cache/contenthash/checksum_unix.go b/cache/contenthash/checksum_unix.go
@@ -0,0 +1,10 @@
+//go:build !windows
+// +build !windows
+
+package contenthash
+
+import "path/filepath"
+
+func (cc *cacheContext) walk(scanPath string, walkFunc filepath.WalkFunc) error {
+	return filepath.Walk(scanPath, walkFunc)
+}
diff --git a/cache/contenthash/checksum_windows.go b/cache/contenthash/checksum_windows.go
@@ -0,0 +1,16 @@
+package contenthash
+
+import (
+	"path/filepath"
+
+	"github.com/Microsoft/go-winio"
+)
+
+func (cc *cacheContext) walk(scanPath string, walkFunc filepath.WalkFunc) error {
+	// elevating the admin privileges to walk special files/directory
+	// like `System Volume Information`, etc. See similar in #4994
+	privileges := []string{winio.SeBackupPrivilege}
+	return winio.RunWithPrivileges(privileges, func() error {
+		return filepath.Walk(scanPath, walkFunc)
+	})
+}
diff --git a/frontend/dockerfile/dockerfile_test.go b/frontend/dockerfile/dockerfile_test.go
@@ -2783,7 +2783,6 @@ ADD %s /dest/
 }
 
 func testDockerfileAddArchive(t *testing.T, sb integration.Sandbox) {
-	integration.SkipOnPlatform(t, "windows")
 	f := getFrontend(t, sb)
 	f.RequiresBuildctl(t)
 
@@ -2802,10 +2801,12 @@ func testDockerfileAddArchive(t *testing.T, sb integration.Sandbox) {
 	err = tw.Close()
 	require.NoError(t, err)
 
-	dockerfile := []byte(`
-FROM scratch
+	baseImage := integration.UnixOrWindows("scratch", "nanoserver")
+
+	dockerfile := []byte(fmt.Sprintf(`
+FROM %s
 ADD t.tar /
-`)
+`, baseImage))
 
 	dir := integration.Tmpdir(
 		t,
@@ -2833,10 +2834,10 @@ ADD t.tar /
 	err = gz.Close()
 	require.NoError(t, err)
 
-	dockerfile = []byte(`
-FROM scratch
+	dockerfile = []byte(fmt.Sprintf(`
+FROM %s
 ADD t.tar.gz /
-`)
+`, baseImage))
 
 	dir = integration.Tmpdir(
 		t,
@@ -2857,10 +2858,10 @@ ADD t.tar.gz /
 	require.Equal(t, expectedContent, dt)
 
 	// COPY doesn't extract
-	dockerfile = []byte(`
-FROM scratch
+	dockerfile = []byte(fmt.Sprintf(`
+FROM %s
 COPY t.tar.gz /
-`)
+`, baseImage))
 
 	dir = integration.Tmpdir(
 		t,
@@ -2892,9 +2893,9 @@ COPY t.tar.gz /
 	defer server.Close()
 
 	dockerfile = []byte(fmt.Sprintf(`
-FROM scratch
+FROM %s
 ADD %s /
-`, server.URL+"/t.tar.gz"))
+`, baseImage, server.URL+"/t.tar.gz"))
 
 	dir = integration.Tmpdir(
 		t,
@@ -2915,9 +2916,9 @@ ADD %s /
 
 	// https://github.com/moby/buildkit/issues/386
 	dockerfile = []byte(fmt.Sprintf(`
-FROM scratch
+FROM %s
 ADD %s /newname.tar.gz
-`, server.URL+"/t.tar.gz"))
+`, baseImage, server.URL+"/t.tar.gz"))
 
 	dir = integration.Tmpdir(
 		t,
@@ -3018,16 +3019,25 @@ ADD *.tar /dest
 }
 
 func testDockerfileAddChownExpand(t *testing.T, sb integration.Sandbox) {
-	integration.SkipOnPlatform(t, "windows")
 	f := getFrontend(t, sb)
 
-	dockerfile := []byte(`
+	dockerfile := []byte(integration.UnixOrWindows(
+		`
 FROM busybox
 ARG group
 ENV owner 1000
 ADD --chown=${owner}:${group} foo /
 RUN [ "$(stat -c "%u %G" /foo)" == "1000 nobody" ]
-`)
+`,
+		`
+FROM nanoserver
+ARG group
+ENV owner=1000
+ADD foo \bar
+RUN if not exist \bar (exit 1)
+RUN if "%owner%"=="" if "%group%"=="" (exit 1)
+`,
+	))
 
 	dir := integration.Tmpdir(
 		t,
@@ -4404,13 +4414,21 @@ COPY foo bar
 }
 
 func testMultiStageImplicitFrom(t *testing.T, sb integration.Sandbox) {
-	integration.SkipOnPlatform(t, "windows")
 	f := getFrontend(t, sb)
 
-	dockerfile := []byte(`
+	dockerfile := []byte(integration.UnixOrWindows(
+		`
 FROM scratch
 COPY --from=busybox /etc/passwd test
-`)
+`, `
+FROM nanoserver AS build
+USER ContainerAdministrator
+RUN echo test> test
+
+FROM nanoserver
+COPY --from=build /test /test
+`,
+	))
 
 	dir := integration.Tmpdir(
 		t,
@@ -4439,17 +4457,26 @@ COPY --from=busybox /etc/passwd test
 
 	dt, err := os.ReadFile(filepath.Join(destDir, "test"))
 	require.NoError(t, err)
-	require.Contains(t, string(dt), "root")
+	require.Contains(t, string(dt), integration.UnixOrWindows("root", "test"))
 
 	// testing masked image will load actual stage
 
-	dockerfile = []byte(`
+	dockerfile = []byte(integration.UnixOrWindows(
+		`
 FROM busybox AS golang
 RUN mkdir -p /usr/bin && echo -n foo > /usr/bin/go
 
 FROM scratch
 COPY --from=golang /usr/bin/go go
-`)
+`, `
+FROM nanoserver AS golang
+USER ContainerAdministrator
+RUN  echo foo> go
+
+FROM nanoserver
+COPY --from=golang /go /go
+`,
+	))
 
 	dir = integration.Tmpdir(
 		t,
@@ -4477,17 +4504,18 @@ COPY --from=golang /usr/bin/go go
 }
 
 func testMultiStageCaseInsensitive(t *testing.T, sb integration.Sandbox) {
-	integration.SkipOnPlatform(t, "windows")
 	f := getFrontend(t, sb)
 
-	dockerfile := []byte(`
-FROM scratch AS STAge0
+	dockerfileStr := `
+FROM %s AS STAge0
 COPY foo bar
-FROM scratch AS staGE1
+FROM %s AS staGE1
 COPY --from=staGE0 bar baz
-FROM scratch
+FROM %s
 COPY --from=stage1 baz bax
-`)
+`
+	baseImage := integration.UnixOrWindows("scratch", "nanoserver")
+	dockerfile := []byte(fmt.Sprintf(dockerfileStr, baseImage, baseImage, baseImage))
 	dir := integration.Tmpdir(
 		t,
 		fstest.CreateFile("Dockerfile", dockerfile, 0600),
@@ -4647,7 +4675,6 @@ RUN dir file1
 }
 
 func testOnBuildCleared(t *testing.T, sb integration.Sandbox) {
-	integration.SkipOnPlatform(t, "windows")
 	workers.CheckFeatureCompat(t, sb, workers.FeatureDirectPush)
 	f := getFrontend(t, sb)
 
@@ -4657,10 +4684,16 @@ func testOnBuildCleared(t *testing.T, sb integration.Sandbox) {
 	}
 	require.NoError(t, err)
 
-	dockerfile := []byte(`
+	dockerfile := []byte(integration.UnixOrWindows(
+		`
 FROM busybox
 ONBUILD RUN mkdir -p /out && echo -n 11 >> /out/foo
-`)
+`, `
+FROM nanoserver
+USER ContainerAdministrator
+ONBUILD RUN mkdir \out && echo 11>> \out\foo
+`,
+	))
 
 	dir := integration.Tmpdir(
 		t,
@@ -4720,9 +4753,9 @@ ONBUILD RUN mkdir -p /out && echo -n 11 >> /out/foo
 
 	dockerfile = []byte(fmt.Sprintf(`
 	FROM %s AS base
-	FROM scratch
+	FROM %s
 	COPY --from=base /out /
-	`, target2))
+	`, target2, integration.UnixOrWindows("scratch", "nanoserver")))
 
 	dir = integration.Tmpdir(
 		t,
@@ -4746,7 +4779,7 @@ ONBUILD RUN mkdir -p /out && echo -n 11 >> /out/foo
 
 	dt, err := os.ReadFile(filepath.Join(destDir, "foo"))
 	require.NoError(t, err)
-	require.Equal(t, "11", string(dt))
+	require.Equal(t, integration.UnixOrWindows("11", "11\r\n"), string(dt))
 }
 
 func testCacheMultiPlatformImportExport(t *testing.T, sb integration.Sandbox) {
@@ -5496,10 +5529,10 @@ COPY --from=build out .
 }
 
 func testBuiltinArgs(t *testing.T, sb integration.Sandbox) {
-	integration.SkipOnPlatform(t, "windows")
 	f := getFrontend(t, sb)
 
-	dockerfile := []byte(`
+	dockerfile := []byte(integration.UnixOrWindows(
+		`
 FROM busybox AS build
 ARG FOO
 ARG BAR
@@ -5508,7 +5541,18 @@ RUN echo -n $HTTP_PROXY::$NO_PROXY::$FOO::$BAR::$BAZ > /out
 FROM scratch
 COPY --from=build /out /
 
-`)
+`, `
+FROM nanoserver AS build
+USER ContainerAdministrator
+ARG FOO
+ARG BAR
+ARG BAZ=bazcontent
+RUN echo %HTTP_PROXY%::%NO_PROXY%::%FOO%::%BAR%::%BAZ%> out
+FROM nanoserver
+COPY --from=build out /
+`,
+	))
+
 	dir := integration.Tmpdir(
 		t,
 		fstest.CreateFile("Dockerfile", dockerfile, 0600),
@@ -5543,7 +5587,9 @@ COPY --from=build /out /
 
 	dt, err := os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
-	require.Equal(t, "hpvalue::npvalue::foocontents::::bazcontent", string(dt))
+	// Windows can't interpret empty env variables, %BAR% handles empty values.
+	expectedStr := integration.UnixOrWindows(`hpvalue::npvalue::foocontents::::bazcontent`, "hpvalue::npvalue::foocontents::%BAR%::bazcontent\r\n")
+	require.Equal(t, expectedStr, string(dt))
 
 	// repeat with changed default args should match the old cache
 	destDir = t.TempDir()
@@ -5570,7 +5616,8 @@ COPY --from=build /out /
 
 	dt, err = os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
-	require.Equal(t, "hpvalue::npvalue::foocontents::::bazcontent", string(dt))
+	expectedStr = integration.UnixOrWindows("hpvalue::npvalue::foocontents::::bazcontent", "hpvalue::npvalue::foocontents::%BAR%::bazcontent\r\n")
+	require.Equal(t, expectedStr, string(dt))
 
 	// changing actual value invalidates cache
 	destDir = t.TempDir()
@@ -5597,7 +5644,8 @@ COPY --from=build /out /
 
 	dt, err = os.ReadFile(filepath.Join(destDir, "out"))
 	require.NoError(t, err)
-	require.Equal(t, "hpvalue2::::foocontents2::::bazcontent", string(dt))
+	expectedStr = integration.UnixOrWindows("hpvalue2::::foocontents2::::bazcontent", "hpvalue2::%NO_PROXY%::foocontents2::%BAR%::bazcontent\r\n")
+	require.Equal(t, expectedStr, string(dt))
 }
 
 func testTarContext(t *testing.T, sb integration.Sandbox) {
@@ -5713,15 +5761,15 @@ COPY foo bar
 }
 
 func testFrontendUseForwardedSolveResults(t *testing.T, sb integration.Sandbox) {
-	integration.SkipOnPlatform(t, "windows")
 	c, err := client.New(sb.Context(), sb.Address())
 	require.NoError(t, err)
 	defer c.Close()
 
-	dockerfile := []byte(`
-FROM scratch
+	dockerfileStr := `
+FROM %s
 COPY foo foo2
-`)
+`
+	dockerfile := []byte(fmt.Sprintf(dockerfileStr, integration.UnixOrWindows("scratch", "nanoserver")))
 	dir := integration.Tmpdir(
 		t,
 		fstest.CreateFile("Dockerfile", dockerfile, 0600),