the virtual machine or container JSON document is invalid

[ningmingxiao]

Description
I'm trying to bump up containerd from v2.3.0-beta.1 to v2.3.0-beta.2 for nerdctl, but CI keeps failing

containerd/nerdctl#4853
=== FAIL: cmd/nerdctl/container TestListHyperVContainer (4.90s)
container_list_windows_test.go:77: assertion failed: res.ExitCode is not exitCode:
Command: C:\Users\runneradmin\go\bin\nerdctl.exe --namespace=nerdctl-test run --isolation hyperv -d --name nerdctl-testlisthypervcontainerlist --label nerdctl-testlisthypervcontainerlist=nerdctl-testlisthypervcontainerlist registry.k8s.io/e2e-test-images/nginx:1.14-2
ExitCode: 1
Error: exit status 1
Stdout:
Stderr: time="2026-04-19T16:32:00Z" level=warning msg="default network named "nat" does not have an internal nerdctl ID or nerdctl-managed config file, it was most likely NOT created by nerdctl"
time="2026-04-19T16:32:01Z" level=warning msg="default network named "nat" does not have an internal nerdctl ID or nerdctl-managed config file, it was most likely NOT created by nerdctl"
time="2026-04-19T16:32:04Z" level=fatal msg="failed to create shim task: failed to mount container storage: guest modify: guest RPC failure: The virtual machine or container JSON document is invalid."
https://github.com/containerd/nerdctl/actions/runs/24609842512/job/72025096572?pr=4853

Steps to reproduce the issue
Update containerd from v2.3.0-beta.1 to v2.3.0-beta.2
Run the Windows CI
TestListHyperVContainer fails
Describe the results you received and expected
Received: time="2026-04-19T16:32:04Z" level=fatal msg="failed to create shim task: failed to mount container storage: guest modify: guest RPC failure: The virtual machine or container JSON document is invalid."
Expected: no error

What version of containerd are you using?
v2.3.0-beta.2

Any other relevant information
No response

Show configuration if it is related to CRI plugin.
No response

see:containerd/containerd#13254

[ningmingxiao]

@dcantah can you take a look thanks?

[haytok]

Since d58d6bff, CombineLayersWCOW ships a FilterType field in the CombinedLayers modify request, but the field is not in the public HCS schema. vmcomputeagent.exe rejects the request with HCS_E_INVALID_JSON, which breaks TestListHyperVContainer.

Root cause

FilterType is unconditionally set even when it's the default WCIFS:

https://github.com/microsoft/hcsshim/blob/a4051da4aa70cb8082fb12d672e1b6b684da215f/internal/uvm/combine_layers.go#L39C3-L49C4

I captured the actual GCS bridge traffic by adding a debug log. The failing exchange (full payloads at the bottom of this comment):

Request.Settings = { "ContainerRootPath": ..., "Layers": [...], "FilterType": "WCIFS" }

Response.ErrorRecords[1]:
  Result:  -1070137075   (= HCS_E_INVALID_JSON)
  Message: "onecore\\internal\\vm\\inc\\MarshalUtilities.h(69)\\vmcomputeagent.exe!00007FF660EE8CE0: (caller: 00007FF660EE7816) Exception(1) tid(3d8) C037010D The virtual machine or container JSON document is invalid.\r\n    Msg:[$.FilterType] CallContext:[\\Bridge_ProcessMessage\\VmDirect_ModifySettings] \n"
  Module:  vmcomputeagent.exe

• Run: https://github.com/haytok/nerdctl/actions/runs/25112799848/job/73591256402
• Env: containerd v2.3.0-beta.2 / runner windows-2022 (image) / hcsshim built from d58d6bff

Proposed fix

diff --git a/internal/uvm/combine_layers.go b/internal/uvm/combine_layers.go
index 8c68c21f..6bb42f04 100644
--- a/internal/uvm/combine_layers.go
+++ b/internal/uvm/combine_layers.go
@@ -36,6 +36,9 @@ func (uvm *UtilityVM) CombineLayersWCOW(ctx context.Context, layerPaths []hcssch
                        },
                }
        } else {
+               if filterType == hcsschema.WCIFS {
+                       filterType = ""
+               }
                modifyRequest = &hcsschema.ModifySettingRequest{
                        GuestRequest: guestrequest.ModificationRequest{
                                ResourceType: guestresource.ResourceTypeCombinedLayers,

This skips Settings.FilterType when filterType == hcsschema.WCIFS, so the omitempty JSON tag drops the field from the wire format. With this applied, TestListHyperVContainer passes.

Question

Since FilterType doesn't appear in the public CombinedLayers schema at all, I'm not entirely sure whether the proposed fix above is the right direction. Could the maintainers please give us some advice?

---

Full Request payload (SEND id=8)

{
   "ContainerId":"00000000-0000-0000-0000-000000000000",
   "ActivityId":"00000000-0000-0000-0000-000000000000",
   "ocsc":{
      "TraceID":"eae82c99bd260771adc372877d53f74c",
      "SpanID":"d99bc509694eaec0",
      "TraceOptions":1
   },
   "Request":{
      "RequestType":"Add",
      "ResourceType":"CombinedLayers",
      "Settings":{
         "ContainerRootPath":"c:\\mounts\\scsi\\m0",
         "Layers":[
            {
               "Id":"f6f9524c-e3f0-5be2-978d-7e09e0b21299",
               "Path":"\\\\?\\VMSMB\\VSMB-{dcc079ae-60ba-4d07-847c-3493609c0870}\\s1"
            }
         ],
         "FilterType":"WCIFS"
      }
   }
}

Full Response payload (RECV id=8)

{
   "Result":-1070137075,
   "ActivityId":"00000000-0000-0000-0000-000000000000",
   "ErrorRecords":[
      {
         "Result":-1070137075,
         "Message":"$.FilterType",
         "ModuleName":"vmcomputeagent.exe",
         "FileName":"onecore\\internal\\vm\\inc\\MarshalUtilities.h",
         "Line":69
      },
      {
         "Result":-1070137075,
         "Message":"onecore\\internal\\vm\\inc\\MarshalUtilities.h(69)\\vmcomputeagent.exe!00007FF660EE8CE0: (caller: 00007FF660EE7816) Exception(1) tid(3d8) C037010D The virtual machine or container JSON document is invalid.\r\n    Msg:[$.FilterType] CallContext:[\\Bridge_ProcessMessage\\VmDirect_ModifySettings] \n",
         "ModuleName":"vmcomputeagent.exe",
         "FileName":"onecore\\vm\\compute\\common\\bridge\\bridgeclient.cpp",
         "Line":654
      }
   ]
}