Windows - #189
Draft
samestep wants to merge 3 commits into
Draft
Conversation
Runs Windows 11 inside sandbox-amd64 via dockur/windows + nested KVM, reachable over the tailnet by RDP or by SSH into a PowerShell prompt (the same nested-SSH pattern as the Linux VMs). Documents the OpenSSH bootstrap (logon task + SeAssignPrimaryTokenPrivilege grant, since the service crashes as LocalSystem on this image) and passwordless key setup via administrators_authorized_keys. Also records why the ARM equivalent hangs at the Windows-ARM bootloader under nested virt. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018GfYK5A2H1RMYsLnjMjDJA
`ssh -J sandbox-amd64 -p 2222 agent@localhost` authenticates end-to-end, so the guest sees the *local* machine's key (not sandbox-amd64's) and falls back to a password. Instead add a `win-amd64` host alias that uses RemoteCommand to run the inner ssh on sandbox-amd64, so it authenticates with that host's key (which is in the guest's authorized_keys). tailnet now emits its hostname too. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018GfYK5A2H1RMYsLnjMjDJA
The guest is meant to run continuously, so its idle cost matters. Three changes, measured on sandbox-amd64 with nobody connected: - Drop CPU_CORES 4 -> 2. Most of the idle cost is per-vCPU ticking under double nesting, so this is the biggest single lever. - Run sshd from an -AtStartup task with an S4U principal instead of an -AtLogOn task with the default Interactive logon type. The interactive task inherited a console, and since Windows Terminal is the default console host, sshd ended up parented to a WindowsTerminal.exe that sat rendering forever (~8% of a core). It also coupled the two: closing that Terminal window killed sshd and locked you out of the guest. - Turn off autologon, which is only safe because of the S4U task. No interactive session means no explorer, no dwm compositing a desktop, and no taskbar weather widget running msedgewebview2. Also document what is not worth chasing: Hyper-V enlightenments are already fully enabled even nested, and KVM halt-polling is negligible. The residual ~32% is the nesting itself. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
wimdows