func ContainerCheck(gardenAddr string, processes []ps.Process) error {
	var errMsg string
	stdout, _, err := RunCommand(`
$proc = Get-CimInstance Win32_Process -Filter "name = 'containerizer.exe'"
$result = Invoke-CimMethod -InputObject $proc -MethodName GetOwner
$result.User
`)
	if err != nil {
		return err
	}
	if strings.HasPrefix(stdout, "SYSTEM") {
		errMsg = batchLogonMessage
	} else {
		errMsg = localLogonMessage
	}

	client := gclient.New(gconnection.New("tcp", gardenAddr))
	container, err := client.Create(garden.ContainerSpec{})
	if container != nil {
		defer client.Destroy(container.Handle())
	}

	if err != nil {
		if err.Error() == logonFailure {
			return errors.New("Failed to create container\n" + errMsg)
		} else {
			return errors.New("Failed to create container\n" + err.Error())
		}
	}
	return nil
}

func main() {
	flag.Parse()

	gclient := client.New(connection.New("tcp", "localhost:7777"))

	var container garden.Container
	containers, err := gclient.Containers(garden.Properties{})
	must(err)
	for _, c := range containers {
		if c.Handle() == *containerHandle {
			container = c
			break
		}
	}
	if container == nil {
		panic("Container not found!")
	}

	process, err := container.Attach(uint32(*processId), garden.ProcessIO{})
	must(err)

	switch *signalType {
	case "term":
		fmt.Println("Signalling term")
		must(process.Signal(garden.SignalTerminate))
		break

	case "kill":
		fmt.Println("Signalling kill")
		must(process.Signal(garden.SignalKill))
		break
	}
}

func start(creator RunnerCreator, network, addr string, argv ...string) *RunningGarden {
	tmpDir := filepath.Join(
		os.TempDir(),
		fmt.Sprintf("test-garden-%d", ginkgo.GinkgoParallelNode()),
	)

	if GraphRoot == "" {
		GraphRoot = filepath.Join(tmpDir, "graph")
	}

	graphPath := filepath.Join(GraphRoot, fmt.Sprintf("node-%d", ginkgo.GinkgoParallelNode()))

	r := &RunningGarden{
		GraphRoot: GraphRoot,
		GraphPath: graphPath,
		tmpdir:    tmpDir,
		logger:    lagertest.NewTestLogger("garden-runner"),

		Client: client.New(connection.New(network, addr)),
	}

	c := cmd(tmpDir, graphPath, network, addr, GardenBin, BinPath, RootFSPath, argv...)
	r.process = ifrit.Invoke(creator.Create(c))
	r.Pid = c.Process.Pid

	return r
}

func start(network, addr string, argv ...string) *RunningGarden {
	tmpDir := filepath.Join(
		os.TempDir(),
		fmt.Sprintf("test-garden-%d", ginkgo.GinkgoParallelNode()),
	)
	Expect(os.MkdirAll(tmpDir, 0755)).To(Succeed())

	if GraphRoot == "" {
		GraphRoot = filepath.Join(tmpDir, "graph")
	}

	graphPath := filepath.Join(GraphRoot, fmt.Sprintf("node-%d", ginkgo.GinkgoParallelNode()))
	stateDirPath := filepath.Join(tmpDir, "state")
	depotPath := filepath.Join(tmpDir, "containers")
	snapshotsPath := filepath.Join(tmpDir, "snapshots")

	if err := os.MkdirAll(stateDirPath, 0755); err != nil {
		Expect(err).ToNot(HaveOccurred())
	}

	if err := os.MkdirAll(depotPath, 0755); err != nil {
		Expect(err).ToNot(HaveOccurred())
	}

	if err := os.MkdirAll(snapshotsPath, 0755); err != nil {
		Expect(err).ToNot(HaveOccurred())
	}

	MustMountTmpfs(graphPath)

	r := &RunningGarden{
		GraphRoot:     GraphRoot,
		GraphPath:     graphPath,
		StateDirPath:  stateDirPath,
		DepotPath:     depotPath,
		SnapshotsPath: snapshotsPath,
		tmpdir:        tmpDir,
		logger:        lagertest.NewTestLogger("garden-runner"),

		Client: client.New(connection.New(network, addr)),
	}

	c := cmd(stateDirPath, depotPath, snapshotsPath, graphPath, network, addr, GardenBin, BinPath, RootFSPath, argv...)
	r.runner = ginkgomon.New(ginkgomon.Config{
		Name:              "garden-linux",
		Command:           c,
		AnsiColorCode:     "31m",
		StartCheck:        "garden-linux.started",
		StartCheckTimeout: 30 * time.Second,
	})

	r.process = ifrit.Invoke(r.runner)
	r.Pid = c.Process.Pid

	return r
}

func (server *registrarSSHServer) heartbeatWorker(logger lager.Logger, worker atc.Worker, channel ssh.Channel) ifrit.Process {
	return ifrit.Background(tsa.NewHeartbeater(
		logger,
		server.heartbeatInterval,
		gclient.New(gconn.New("tcp", worker.Addr)),
		server.atcEndpoint,
		worker,
		channel,
	))
}

func main() {
	gardenClient := client.New(connection.New("tcp", "127.0.0.1:7777"))

	_ = gardenClient.Destroy("foo")
	foo, err := gardenClient.Create(garden.ContainerSpec{Handle: "foo"})
	failIf(err, "Create")

	err = foo.NetOut(garden.NetOutRule{
		Protocol: garden.ProtocolICMP,
		Networks: []garden.IPRange{garden.IPRangeFromIP(net.ParseIP("8.8.8.8"))},
	})
	failIf(err, "NetOut")

	restartGarden()

}

func main() {
	gardenClient := client.New(connection.New("tcp", "127.0.0.1:7777"))

	_ = gardenClient.Destroy("foo")
	container, err := gardenClient.Create(garden.ContainerSpec{
		Handle:     "foo",
		Env:        []string{"LANG=en_GB.iso885915"},
		RootFSPath: "docker:///debian#8",
	})
	failIf(err, "Create")

	var output bytes.Buffer
	process, err := container.Run(garden.ProcessSpec{
		Path: "sh",
		Args: []string{"-c", "echo $LANG"},
	}, garden.ProcessIO{Stdout: &output})
	failIf(err, "Run")
	process.Wait()
	fmt.Println(output.String())
}

func Start(bin, iodaemonBin, nstarBin string, argv ...string) *RunningGarden {
	network := "unix"
	addr := fmt.Sprintf("/tmp/garden_%d.sock", GinkgoParallelNode())
	tmpDir := filepath.Join(
		os.TempDir(),
		fmt.Sprintf("test-garden-%d", ginkgo.GinkgoParallelNode()),
	)

	if GraphRoot == "" {
		GraphRoot = filepath.Join(tmpDir, "graph")
	}

	graphPath := filepath.Join(GraphRoot, fmt.Sprintf("node-%d", ginkgo.GinkgoParallelNode()))
	depotDir := filepath.Join(tmpDir, "containers")

	MustMountTmpfs(graphPath)

	r := &RunningGarden{
		DepotDir: depotDir,

		GraphRoot: GraphRoot,
		GraphPath: graphPath,
		tmpdir:    tmpDir,
		logger:    lagertest.NewTestLogger("garden-runner"),

		Client: client.New(connection.New(network, addr)),
	}

	c := cmd(tmpDir, depotDir, graphPath, network, addr, bin, iodaemonBin, nstarBin, TarPath, RootFSPath, argv...)
	r.process = ifrit.Invoke(&ginkgomon.Runner{
		Name:              "guardian",
		Command:           c,
		AnsiColorCode:     "31m",
		StartCheck:        "guardian.started",
		StartCheckTimeout: 30 * time.Second,
	})

	r.Pid = c.Process.Pid

	return r
}

func GardenContainers(gardenAddr string, gardenNetwork string, raw bool, out io.Writer) error {
	client := client.New(connection.New(gardenNetwork, gardenAddr))
	containers, err := client.Containers(nil)
	if err != nil {
		return err
	}

	workPool, err := workpool.NewWorkPool(32)
	if err != nil {
		return err
	}

	lock := &sync.Mutex{}
	wg := &sync.WaitGroup{}
	wg.Add(len(containers))

	containerInfos := []ContainerInfo{}
	for _, container := range containers {
		container := container
		workPool.Submit(func() {
			defer wg.Done()
			info, err := container.Info()
			if err != nil {
				say.Println(1, say.Red("Failed to fetch container info: %s\n", container.Handle()))
				return
			}
			metrics, err := container.Metrics()
			if err != nil {
				say.Println(1, say.Red("Failed to fetch container metrics: %s\n", container.Handle()))
				return
			}

			lock.Lock()
			defer lock.Unlock()
			containerInfos = append(containerInfos, ContainerInfo{
				container.Handle(),
				info,
				metrics,
			})
		})
	}
	wg.Wait()

	if raw {
		encoded, err := json.MarshalIndent(containerInfos, "", "  ")

		if err != nil {
			return err
		}

		out.Write(encoded)
		return nil
	}

	if len(containerInfos) == 0 {
		say.Println(0, say.Red("No Containers"))
	}
	for _, containerInfo := range containerInfos {
		printContainer(out, containerInfo)
	}
	return nil
}

func Initialize(logger lager.Logger, config Configuration, clock clock.Clock) (executor.Client, grouper.Members, error) {
	gardenClient := GardenClient.New(GardenConnection.New(config.GardenNetwork, config.GardenAddr))
	err := waitForGarden(logger, gardenClient, clock)
	if err != nil {
		return nil, nil, err
	}

	containersFetcher := &executorContainers{
		gardenClient: gardenClient,
		owner:        config.ContainerOwnerName,
	}

	destroyContainers(gardenClient, containersFetcher, logger)

	workDir := setupWorkDir(logger, config.TempDir)

	transformer := initializeTransformer(
		logger,
		config.CachePath,
		workDir,
		config.MaxCacheSizeInBytes,
		uint(config.MaxConcurrentDownloads),
		maxConcurrentUploads,
		config.SkipCertVerify,
		config.ExportNetworkEnvVars,
		clock,
	)

	hub := event.NewHub()

	gardenStore, err := gardenstore.NewGardenStore(
		gardenClient,
		config.ContainerOwnerName,
		config.ContainerMaxCpuShares,
		config.ContainerInodeLimit,
		config.HealthyMonitoringInterval,
		config.UnhealthyMonitoringInterval,
		transformer,
		clock,
		hub,
		config.HealthCheckWorkPoolSize,
	)
	if err != nil {
		return nil, grouper.Members{}, err
	}

	allocationStore := allocationstore.NewAllocationStore(clock, hub)

	workPoolSettings := executor.WorkPoolSettings{
		CreateWorkPoolSize:  config.CreateWorkPoolSize,
		DeleteWorkPoolSize:  config.DeleteWorkPoolSize,
		ReadWorkPoolSize:    config.ReadWorkPoolSize,
		MetricsWorkPoolSize: config.MetricsWorkPoolSize,
	}

	depotClientProvider, err := depot.NewClientProvider(
		fetchCapacity(logger, gardenClient, config),
		allocationStore,
		gardenStore,
		hub,
		keyed_lock.NewLockManager(),
		workPoolSettings,
	)
	if err != nil {
		return nil, grouper.Members{}, err
	}

	metricsLogger := logger.Session("metrics-reporter")
	containerMetricsLogger := logger.Session("container-metrics-reporter")

	return depotClientProvider.WithLogger(logger),
		grouper.Members{
			{"metrics-reporter", &metrics.Reporter{
				ExecutorSource: depotClientProvider.WithLogger(metricsLogger),
				Interval:       metricsReportInterval,
				Logger:         metricsLogger,
			}},
			{"hub-closer", closeHub(hub)},
			{"registry-pruner", allocationStore.RegistryPruner(logger, config.RegistryPruningInterval)},
			{"container-metrics-reporter", containermetrics.NewStatsReporter(
				containerMetricsLogger,
				containerMetricsReportInterval,
				clock,
				depotClientProvider.WithLogger(containerMetricsLogger),
			)},
		},
		nil
}

	. "github.com/onsi/ginkgo"
	. "github.com/onsi/gomega"
	"github.com/onsi/gomega/gbytes"
)

func TestGardenAcceptance(t *testing.T) {
	RegisterFailHandler(Fail)
	RunSpecs(t, "Garden Acceptance Suite")
}

var gardenClient client.Client

var hostIP = "10.244.16.6"

var _ = BeforeSuite(func() {
	gardenClient = client.New(connection.New("tcp", hostIP+":7777"))
})

var _ = BeforeEach(func() {
	destroyAllContainers(gardenClient)
})

var _ = AfterEach(func() {
	destroyAllContainers(gardenClient)
})

var lsProcessSpec = garden.ProcessSpec{User: "root", Path: "ls", Args: []string{"-l", "/"}}
var silentProcessIO = garden.ProcessIO{Stdout: GinkgoWriter, Stderr: GinkgoWriter}

func recordedProcessIO(buffer *gbytes.Buffer) garden.ProcessIO {
	return garden.ProcessIO{

func client(c *cli.Context) garden.Client {
	target := c.GlobalString("target")
	return gclient.New(gconn.New("tcp", target))
}

var _ = Describe("Concurrent container creation", func() {

	BeforeEach(func() {
		runtime.GOMAXPROCS(runtime.NumCPU())
	})

	Measure("multiple concurrent creates", func(b Benchmarker) {
		handles := []string{}

		b.Time("concurrent creations", func() {
			chans := []chan string{}
			for i := 0; i < creates; i++ {
				ch := make(chan string, 1)
				go func(c chan string, index int) {
					defer GinkgoRecover()
					client := gclient.New(connection.New("tcp", "localhost:7777"))
					b.Time("create-"+strconv.Itoa(index), func() {
						ctr, err := client.Create(garden.ContainerSpec{})
						Expect(err).ToNot(HaveOccurred())
						c <- ctr.Handle()
					})
				}(ch, i)
				chans = append(chans, ch)
			}

			for _, ch := range chans {
				handle := <-ch
				if handle != "" {
					handles = append(handles, handle)

				}

		apiServer = server.New(
			"unix",
			socketPath,
			serverContainerGraceTime,
			serverBackend,
			logger,
		)

		err = apiServer.Start()
		Ω(err).ShouldNot(HaveOccurred())

		isRunning = true

		Eventually(ErrorDialing("unix", socketPath)).ShouldNot(HaveOccurred())

		apiClient = client.New(connection.New("unix", socketPath))
	})

	AfterEach(func() {
		if isRunning {
			apiServer.Stop()
		}
		if tmpdir != "" {
			os.RemoveAll(tmpdir)
		}
	})

	Context("and the client sends a PingRequest", func() {
		Context("and the backend ping succeeds", func() {
			It("does not error", func() {
				Ω(apiClient.Ping()).ShouldNot(HaveOccurred())

							fakeBackend.ContainersStub = func(garden.Properties) ([]garden.Container, error) {
								return (<-stubs)()
							}
						})

						JustBeforeEach(func() {
							err := json.NewEncoder(sshStdin).Encode(workerPayload)
							Ω(err).ShouldNot(HaveOccurred())
						})

						It("forwards garden API calls through the tunnel", func() {
							registration := <-registered
							addr := registration.worker.Addr

							client := gclient.New(gconn.New("tcp", addr))

							fakeBackend.CreateReturns(new(gfakes.FakeContainer), nil)

							_, err := client.Create(garden.ContainerSpec{})
							Ω(err).ShouldNot(HaveOccurred())

							Ω(fakeBackend.CreateCallCount()).Should(Equal(1))
						})

						It("continuously registers it with the ATC as long as it works", func() {
							a := time.Now()
							registration := <-registered
							Ω(registration.ttl).Should(Equal(2 * heartbeatInterval))

							// shortcut for equality w/out checking addr

func (r *Runner) NewClient() client.Client {
	return client.New(connection.New(r.network, r.addr))
}

func (maker ComponentMaker) GardenClient() garden.Client {
	return gardenclient.New(gardenconnection.New("tcp", maker.Addresses.GardenLinux))
}

		info, err := container.Info()
		Expect(err).ToNot(HaveOccurred())

		nestedGardenAddress := fmt.Sprintf("%s:7778", info.ContainerIP)
		Eventually(nestedServerOutput, "60s").Should(gbytes.Say("garden-linux.started"))

		return container, nestedGardenAddress
	}

	It("can start a nested garden-linux and run a container inside it", func() {
		container, nestedGardenAddress := startNestedGarden()
		defer func() {
			Expect(client.Destroy(container.Handle())).To(Succeed())
		}()

		nestedClient := gclient.New(gconn.New("tcp", nestedGardenAddress))
		nestedContainer, err := nestedClient.Create(garden.ContainerSpec{})
		Expect(err).ToNot(HaveOccurred())

		nestedOutput := gbytes.NewBuffer()
		_, err = nestedContainer.Run(garden.ProcessSpec{
			User: "root",
			Path: "/bin/echo",
			Args: []string{
				"I am nested!",
			},
		}, garden.ProcessIO{Stdout: nestedOutput, Stderr: nestedOutput})
		Expect(err).ToNot(HaveOccurred())

		Eventually(nestedOutput, "60s").Should(gbytes.Say("I am nested!"))
	})

func main() {
	const (
		tunnelPort     = 10
		tunnelID       = 101
		bridgeName     = "ovs-bridge"
		tunnelPortName = "remote-tun"
	)
	var (
		containerIP            string
		containerMAC           string
		containerIPAddressMask = 24
		containerMTU           = 1400
		cleanup                bool
		containerOVSPort       int
		remoteContainerIP      string
		remoteContainerMAC     string

		remoteHostIP string
	)

	flag.BoolVar(&debug, "debug", false, "print executed commands for debug")
	flag.StringVar(&containerIP, "containerIP", "", "create a container with this IP address on the OVS network")
	flag.StringVar(&containerMAC, "containerMAC", "", "use this MAC address on the OVS network for the container")
	flag.StringVar(&remoteHostIP, "remoteHostIP", "", "create an OVS tunnel to a remote host")
	flag.StringVar(&remoteContainerIP, "remoteContainerIP", "", "the IP address of the garden container on the remote host")
	flag.StringVar(&remoteContainerMAC, "remoteContainerMAC", "", "the MAC address of the garden container on the remote host")
	flag.IntVar(&containerOVSPort, "containerOVSPort", 0, "port number to attach to container on OVS switch")
	flag.BoolVar(&cleanup, "cleanup", false, "delete all containers")
	flag.Parse()

	if err := os.MkdirAll("/var/run/netns", 0644); err != nil {
		panic(err)
	}

	gardenClient := client.New(connection.New("tcp", "localhost:7777"))

	if cleanup {
		cleanupContainers(gardenClient)
		destroyTunnel(bridgeName)
		return
	}

	if containerIP != "" {
		if containerOVSPort == 0 {
			panic("need to set OVS port number for container")
		}
		if containerMAC == "" {
			panic("need to set MAC address for container on OVS network")
		}
		err := createContainerAndSetupOVS(gardenClient, containerMAC, containerIP, containerIPAddressMask, containerMTU, bridgeName, containerOVSPort, tunnelID, tunnelPort)
		if err != nil {
			panic(err)
		}
		return
	}

	if remoteHostIP != "" {
		err := setupTunnel(bridgeName, tunnelPortName, remoteHostIP, tunnelPort)
		if err != nil {
			panic(err)
		}
		return
	}

	if remoteContainerIP != "" {
		if remoteContainerMAC == "" {
			panic("need to set MAC for remote container")
		}
		err := addFlow(remoteContainerIP, remoteContainerMAC, bridgeName, tunnelPort, tunnelID)
		if err != nil {
			panic(err)
		}
		return
	}

	listContainers(gardenClient)
}