Skip to content

Fix Hyper-V sandbox image for Windows Server 2025 compatibility#557

Merged
k8s-ci-robot merged 1 commit intokubernetes-sigs:masterfrom
rzlink:fix/hyperv-sandbox-image
Apr 24, 2026
Merged

Fix Hyper-V sandbox image for Windows Server 2025 compatibility#557
k8s-ci-robot merged 1 commit intokubernetes-sigs:masterfrom
rzlink:fix/hyperv-sandbox-image

Conversation

@rzlink
Copy link
Copy Markdown
Contributor

@rzlink rzlink commented Apr 22, 2026

The VHD marketplace images bake pause:3.10 (or 3.10.1) as the containerd sandbox_image, but these versions lack a Windows Server 2025 manifest. On Server 2025 hosts with Hyper-V isolation, this causes containerd to boot a Server 2022 UVM from the pause image while selecting Server 2025 app image layers (based on host OS), resulting in HCS_E_IMAGE_MISMATCH when mounting 2025 layers inside the 2022 UVM.

This fix patches the containerd config to use pause:3.10.2 (which includes Server 2025 variant) during Windows node provisioning when HYPERV=true. It also pre-pulls the image since the VHD only ships with older pause versions.

pause:3.10.2 is backward-compatible — it includes all platform variants from pause:3.10 plus Server 2025 (26100.6899).

@k8s-ci-robot k8s-ci-robot requested a review from andyzhangx April 22, 2026 22:17
@k8s-ci-robot k8s-ci-robot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Apr 22, 2026
@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Apr 22, 2026
@k8s-ci-robot
Copy link
Copy Markdown
Contributor

k8s-ci-robot commented Apr 22, 2026

Hi @rzlink. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Apr 22, 2026
zylxjtu
zylxjtu reviewed Apr 22, 2026
View reviewed changes
Comment thread capz/templates/windows-base.yaml Outdated
Comment thread capz/templates/windows-base.yaml
Comment thread capz/templates/windows-base.yaml Outdated
zylxjtu
zylxjtu reviewed Apr 22, 2026
View reviewed changes
Comment thread capz/templates/windows-base.yaml
@rzlink rzlink force-pushed the fix/hyperv-sandbox-image branch from de96bab to e6f8909 Compare April 22, 2026 23:27
@rzlink
Fix Hyper-V sandbox image for Windows Server 2025 compatibility
68fba5f 
The VHD marketplace images bake pause:3.10 (or 3.10.1) as the containerd
sandbox_image, but these versions lack a Windows Server 2025 manifest.
On Server 2025 hosts with Hyper-V isolation, this causes containerd to
boot a Server 2022 UVM from the pause image while selecting Server 2025
app image layers (based on host OS), resulting in HCS_E_IMAGE_MISMATCH
when mounting 2025 layers inside the 2022 UVM.

This fix patches the containerd config to use pause:3.10.2 (which
includes Server 2025 variant) during Windows node provisioning when
HYPERV=true. It also pre-pulls the image since the VHD only ships with
older pause versions.

pause:3.10.2 is backward-compatible — it includes all platform variants
from pause:3.10 plus Server 2025 (26100.6899).
@rzlink rzlink force-pushed the fix/hyperv-sandbox-image branch from e6f8909 to 68fba5f Compare April 23, 2026 19:15
@zylxjtu
Copy link
Copy Markdown
Contributor

zylxjtu commented Apr 24, 2026

/test

@zylxjtu
Copy link
Copy Markdown
Contributor

zylxjtu commented Apr 24, 2026

/test all

@zylxjtu
Copy link
Copy Markdown
Contributor

zylxjtu commented Apr 24, 2026

/lgtm
/approve
/hold for test run

@k8s-ci-robot k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 24, 2026
@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 24, 2026
@k8s-ci-robot
Copy link
Copy Markdown
Contributor

k8s-ci-robot commented Apr 24, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rzlink, zylxjtu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 24, 2026
@zylxjtu
Copy link
Copy Markdown
Contributor

zylxjtu commented Apr 24, 2026

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Apr 24, 2026
@rzlink
Copy link
Copy Markdown
Contributor Author

rzlink commented Apr 24, 2026

/hold cancel

@k8s-ci-robot k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 24, 2026
@k8s-ci-robot k8s-ci-robot merged commit b80edaf into kubernetes-sigs:master Apr 24, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zylxjtu zylxjtu zylxjtu left review comments

@andyzhangx andyzhangx Awaiting requested review from andyzhangx

@claudiubelu claudiubelu Awaiting requested review from claudiubelu

Assignees

@zylxjtu zylxjtu

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@rzlink @k8s-ci-robot @zylxjtu