Propose running init/rm command on hyperv machine in elevated mode when required by lstocchi · Pull Request #27932 · podman-container-tools/podman

lstocchi · 2026-01-21T17:20:31Z

This PR adds automatic UAC elevation prompts for HyperV machine when administrator privileges are required. Similar to what happens on WSL when we need to install WSL features.
Previously, users had to manually run Podman as administrator when creating the first machine or removing the last machine, which requires Windows Registry modifications.

it fixes #27627

Checklist

Ensure you have completed the following checklist for your pull request to be reviewed:

Certify you wrote the patch or otherwise have the right to pass it on as an open-source patch by signing all
commits. (git commit -s). (If needed, use git commit -s --amend). The author email must match
the sign-off email address. See CONTRIBUTING.md
for more information.
Referenced issues using Fixes: #00000 in commit message (if applicable)
Tests have been added/updated (or no tests are needed)
Documentation has been updated (or no documentation changes are needed)
All commits pass make validatepr (format/lint checks)
Release note entered in the section below (or None if no user-facing changes)

Does this PR introduce a user-facing change?

The `podman machine init` and `podman machine rm` commands on Windows using the HyperV provider now automatically prompt for UAC elevation when administrator privileges are required, eliminating the need to manually run Podman as administrator for these operations.

packit-as-a-service · 2026-01-21T17:23:35Z

[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore.

lstocchi · 2026-01-21T17:24:26Z

@l0rd related to this there are the start/stop actions on legacy machines. User should execute them as admin. Should we update start/stop and "mess up" the code a bit for a use case which is marginal? Or, as they are legacy stuff, it is ok for the user to run podman as admin if they want to work on old machines?

l0rd · 2026-01-21T17:38:46Z

@l0rd related to this there are the start/stop actions on legacy machines. User should execute them as admin. Should we update start/stop and "mess up" the code a bit for a use case which is marginal? Or, as they are legacy stuff, it is ok for the user to run podman as admin if they want to work on old machines?

I would not care about legacy machines. There is no request for that.

l0rd · 2026-01-21T17:48:26Z

Adding label No New Tests as there is no way to automatically test the e2e scenario right now.

lstocchi · 2026-01-23T09:11:34Z

I would not care about legacy machines. There is no request for that.

Ah great, so this can be tested then

l0rd

Thank you @lstocchi for this PR. It looks good except for a couple of things when machine init is re-executed:

The image gets pulled and extracted twice (these steps should be skipped when --reexec)
The message that informs the user that the command completed successfully, and how to start the machine, gets lost

I have added a few minor comments too.

lstocchi · 2026-01-26T06:36:40Z

Thank you @lstocchi for this PR. It looks good except for a couple of things when machine init is re-executed:

The image gets pulled and extracted twice (these steps should be skipped when --reexec)

The message that informs the user that the command completed successfully, and how to start the machine, gets lost

I have added a few minor comments too.

Updated. Good point for the image pulled twice 👍
My only concern is that if the elevated process fails the user does not see a user-friendly error message but ShellExecuteExW does not allow to return it afaik

l0rd · 2026-01-26T14:13:59Z

My only concern is that if the elevated process fails the user does not see a user-friendly error message but ShellExecuteExW does not allow to return it afaik

What about using the mechanism used for the WSL install with an output file created and printed in case of error?

lstocchi · 2026-01-27T15:18:46Z

What about using the mechanism used for the WSL install with an output file created and printed in case of error?

Updated👍

github-actions · 2026-02-27T00:16:05Z

A friendly reminder that this PR had no activity for 30 days.

l0rd

@lstocchi I have tested again, and the PR now works fine. Thank you. I have added a few notes/questions.

l0rd · 2026-04-02T15:01:04Z

+		// Do not clean up on relaunch: the elevated child process
+		// completed init successfully and is using the resources
+		// (e.g. the disk image) that cleanup would remove.


go callbackFuncs.CleanOnSignal() has the same problem: when a user hits CTRL+C, then the callbackfuncs.Clean() will be invoked for the original, non-privileged, init. What about ensuring that the cleanup is done by the same process that performed the action (created the lock, downloaded the image, etc.)?

My bad. The error cleanup is skipped only if the error is ErrRelaunchSucceed because that's not really an error.

l0rd · 2026-04-02T17:09:51Z

+		lpFile:       uintptr(unsafe.Pointer(exe)),
+		lpParameters: uintptr(unsafe.Pointer(arg)),
+		lpDirectory:  uintptr(unsafe.Pointer(cwd)),
+		nShow:        syscall.SW_SHOWNORMAL,


What about SW_HIDE? Opening another window may annoy the user. This code already existed, but it may still be better to hide it. What do you think?

After testing, we decided to keep SW_SHOWNORMAL. Otherwise, commands that required an interaction (such as podman machine rm) would hang forever.

Signed-off-by: lstocchi <lstocchi@redhat.com>

lstocchi · 2026-04-03T14:10:29Z

@l0rd it should be ready. To summarize what are the new changes we agreed in the call.

the callbackFuncs to delete the image has been moved inside the if !opts.reExec clause so the process that download the image also delete it
ErrRelaunchAttempt has been renamed ErrLaunchSucceeded and all comments where it is used updated to avoid confusion

This commit adds automatic UAC elevation prompts for HyperV machine init/rm actions when administrator privileges are required. Previously, users had to manually run Podman as administrator when creating the first machine or removing the last machine, which requires Windows Registry modifications. When the HyperV command gets relaunched as elevated, the error of the elevated process is saved on a file to be displayed by the caller. The implementation is the same as that used by WSL. Signed-off-by: lstocchi <lstocchi@redhat.com>

…ror handling The old ErrRelaunchAttempt name was ambiguous — it reads as though the relaunch attempt failed, when it actually signals success. Rename to ErrRelaunchSucceeded and update comments at every call site to clarify that this is not a real error but a sentinel indicating the elevated child process completed the operation successfully. Also fix a bug in WSL's launchElevate where a failed elevated process was incorrectly wrapped with the sentinel, causing callers to treat the failure as success and print "Machine init complete." Signed-off-by: lstocchi <lstocchi@redhat.com>

l0rd

LGTM

l0rd · 2026-04-03T21:47:08Z

@containers/podman-maintainers PTAL

Honny1

Code LGTM, defer to Windows experts.

Luca remarkable knowledge of the Windows virtualization platform would be beneficial for reviewing PRs and triaging issues. lstocchi contributions: - #28535 - #27932 - #27931 - #27885 - #27650 - #26277 - #26201 - #20478 Signed-off-by: Mario Loriedo <mario.loriedo@gmail.com>

Luca remarkable knowledge of the Windows virtualization platform would be beneficial for reviewing PRs and triaging issues. lstocchi contributions: - podman-container-tools#28535 - podman-container-tools#27932 - podman-container-tools#27931 - podman-container-tools#27885 - podman-container-tools#27650 - podman-container-tools#26277 - podman-container-tools#26201 - podman-container-tools#20478 Signed-off-by: Mario Loriedo <mario.loriedo@gmail.com>

github-actions Bot added the machine label Jan 21, 2026

lstocchi force-pushed the i27627 branch from c43582b to 13cac9e Compare January 21, 2026 17:26

l0rd added the No New Tests Allow PR to proceed without adding regression tests label Jan 21, 2026

lstocchi marked this pull request as ready for review January 23, 2026 09:11

l0rd reviewed Jan 23, 2026

View reviewed changes

Comment thread pkg/machine/hyperv/stubber.go Outdated

Comment thread pkg/machine/hyperv/stubber.go Outdated

Comment thread pkg/machine/hyperv/stubber.go Outdated

Comment thread pkg/machine/hyperv/stubber.go Outdated

lstocchi force-pushed the i27627 branch from 13cac9e to 2e19158 Compare January 26, 2026 06:34

lstocchi force-pushed the i27627 branch 2 times, most recently from 058ff14 to 958a6e9 Compare January 27, 2026 14:50

github-actions Bot added the stale-pr label Feb 27, 2026

lstocchi force-pushed the i27627 branch from 958a6e9 to 5b3d5b3 Compare March 10, 2026 10:54

github-actions Bot removed the stale-pr label Mar 11, 2026

l0rd reviewed Apr 2, 2026

View reviewed changes

move wsl' util_windows to windows package so it can be reused by hyperv

5b0ec91

Signed-off-by: lstocchi <lstocchi@redhat.com>

lstocchi force-pushed the i27627 branch 2 times, most recently from cd1110f to 9b00d75 Compare April 3, 2026 14:05

lstocchi added 2 commits April 3, 2026 18:37

lstocchi force-pushed the i27627 branch from 9b00d75 to a9a9eda Compare April 3, 2026 16:37

l0rd approved these changes Apr 3, 2026

View reviewed changes

Honny1 approved these changes Apr 10, 2026

View reviewed changes

l0rd merged commit e3b5d0f into podman-container-tools:main Apr 10, 2026
89 checks passed

lstocchi deleted the i27627 branch April 15, 2026 16:29

l0rd mentioned this pull request Apr 22, 2026

Add lstocchi as Podman Reviewer #28568

Merged

6 tasks

Uh oh!

Conversation

lstocchi commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Does this PR introduce a user-facing change?

Uh oh!

packit-as-a-service Bot commented Jan 21, 2026

Uh oh!

lstocchi commented Jan 21, 2026

Uh oh!

l0rd commented Jan 21, 2026

Uh oh!

l0rd commented Jan 21, 2026

Uh oh!

lstocchi commented Jan 23, 2026

Uh oh!

l0rd left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lstocchi commented Jan 26, 2026

Uh oh!

l0rd commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lstocchi commented Jan 27, 2026

Uh oh!

github-actions Bot commented Feb 27, 2026

Uh oh!

l0rd left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

l0rd Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

l0rd Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

l0rd Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

l0rd Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

lstocchi commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

l0rd left a comment

Choose a reason for hiding this comment

Uh oh!

l0rd commented Apr 3, 2026

Uh oh!

Honny1 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lstocchi commented Jan 21, 2026 •

edited

Loading

l0rd commented Jan 26, 2026 •

edited

Loading

lstocchi commented Apr 3, 2026 •

edited

Loading