Remove pause containers for process isolated containers

[Kirtana Ashok (kiashok)]

PR does the following:

• Introduces new HostComputeNamespace.ReadyOnCreate field and sets it for HNS versions that support pause container removal
• Removes pause container creation while creating process isolated pods for HNS versions that support removal of pause containers

The changes have been manually tested with the supported HNS versions.

[Kevin Parsons (kevpar)]

This seems like it will break port forwarding in containerd, as it depends on execing wincat in the pause container (code). Is there a plan for addressing that?

[Kirtana Ashok (kiashok)]

This seems like it will break port forwarding in containerd, as it depends on execing wincat in the pause container (code). Is there a plan for addressing that?

yes I already have changes for the same. Waiting to complete the k8s e2e local testing with the supported HNS version. Plan to send out the PR for this early next week

[Kirtana Ashok (kiashok)]

This seems like it will break port forwarding in containerd, as it depends on execing wincat in the pause container (code). Is there a plan for addressing that?

yes I already have changes for the same. Waiting to complete the k8s e2e local testing with the supported HNS version. Plan to send out the PR for this early next week

port forwarding for windows was checked in yesterday containerd/containerd@b97ef91 . We should now be good to remove pause containers when supported.

[Kirtana Ashok (kiashok)]

Kevin Parsons (@kevpar)Amit Barve (@ambarve) could you please take a look when you have some time? Thanks!

[Kevin Parsons (kevpar)]

Is the assumption that the shim version with this change will only be used with a containerd version that also supports pause container removal? Is that something we can rely on?

If not, do we need some way to configure that pause containers should/shouldn't be used?

[Kevin Parsons (kevpar)]

We should have someone from Sravanth's team review for the hcn change. Other than that and my other comment, this looks good.

[Kirtana Ashok (kiashok)]

We should have someone from Sravanth's team review for the hcn change. Other than that and my other comment, this looks good.

I think Sravanth has already taken a look at these changes. sbangari can you confirm please? Thanks!

[Kirtana Ashok (kiashok)]

Is the assumption that the shim version with this change will only be used with a containerd version that also supports pause container removal? Is that something we can rely on?

If not, do we need some way to configure that pause containers should/shouldn't be used?

On upstream, containerd/2.0 (currently the main branch) is the only one that will support pause container removal as port forwarding feature changes cannot be backported to release branches. Once this PR is merged, we should cherry-pick to hcsshim/release/0.12 branch and vendor in the changes to containerd/main.
Windows port forwarding is the only thing on containerd that depends on pause container containers and the pause image as of today.