wip: wcow: option to run builds in hyperv isolation

[profnandaa]

Add an option to run builds in hyper-v isolation mode for Windows images.

WIP Checklist:

• Test with basic image runs (works ok)
• Test with bind and cache mounts (works ok)
• Test with CNI capability (this will not work, needs to be documentated)
• Discuss which flags to use to expose this, --isolated like in ctr?

Fixes #5682

---

Basic Test

FROM mcr.microsoft.com/windows/nanoserver:ltsc2022

ENV BUILDKIT_HYPERV_ISOLATED=1

RUN ping -n 30 localhost >nul

When the build is at the RUN stage, on a different terminal, try to run:

> Get-Process ping

# should get this error, since ping is not running on the host
# it's hyper-v isolated:
# Get-Process: Cannot find a process with the name "ping"...

Now try to build the same image with ENV BUILDKIT_HYPERV_ISOLATED=0 or without the env variable,
should get something like:

> Get-Process ping

 NPM(K)    PM(M)      WS(M)     CPU(s)      Id  SI ProcessName
 ------    -----      -----     ------      --  -- -----------
      6     0.93       4.21       0.00   25220  32 PING

[riverar]

Looks like this boiled down to adding a flag, nice.

I can't generate binaries on my dev machine to test this (happy to try it if you supply some or have a friendlier Windows dev workflow).

Agree with your suggestion that we add a --isolated to match ctr but am not strongly attached to it. It should be Dockerfile agnostic, however.

[profnandaa]

@riverar -- you can get the binaries from the test-os/build stage "Upload Artifacts" here - https://github.com/moby/buildkit/actions/runs/13385668839/artifacts/2607353633

[riverar]

@profnandaa No issues so far, works as expected.

[slonopotamus]

Is there a reason why, unlike containerd and moby, isolation is specified via env variable instead of a command-line --isolation=... flag to buildctl? I kinda dislike current approach because it is not an image-specific requirement to run in Hyper-V isolation, but instead it is host specifics. It is very valid to use different isolation modes for exactly the same image depending on host machine.

Also, how this will interoperate with docker build --isolation=...?

[riverar]

I think it was the fastest way to prove out the concept in this draft PR and not indicative of any final design.

[profnandaa]

I think it was the fastest way to prove out the concept in this draft PR and not indicative of any final design.

yes, that's right, this was just a POC.