Skip to content

Fix running Confidential ContainerPlat - #2484

Closed
DomAyre wants to merge 1 commit into
microsoft:mainfrom
DomAyre:domayre/fix-conf-containerplat
Closed

Fix running Confidential ContainerPlat#2484
DomAyre wants to merge 1 commit into
microsoft:mainfrom
DomAyre:domayre/fix-conf-containerplat

Conversation

@DomAyre

@DomAyre DomAyre commented Jul 25, 2025

Copy link
Copy Markdown
Contributor

Why

We discovered that running ContainerPlat using hcsshim/main was broken

A bisection pointed at this commit 8d81359

Rebuilding and using containerd-shim-runhcs-v1.exe solves the original issue I saw below but presented a new one.

When we parse HostComputeEndpoint into an LCOWNetworkAdapter in convertToLCOWReq() the endpoint has a default route (0.0.0.0/0) where the NextHop field is an empty string, which I believe is invalid, it either needs to be a real gateway or the empty gateway. I traced it back to the construction of the endpoint structure in hcnendpoint.go#getEndpoint() and saw the raw data

{
    …
    "Routes": [
        {
            "NextHop": "",
            "DestinationPrefix": "0.0.0.0/
        }
        …
}

While we might still be able to fix the empty string at source, I think fixing the parsing to ignore invalid routes like this is a suitable defensive approach either way.

@DomAyre
DomAyre requested a review from a team as a code owner July 25, 2025 14:50
@DomAyre DomAyre closed this Nov 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant