Is it possible to run windows containers with --isolation=hyperv ?

[alsuren]

I am currently using GitHub actions for cargo-quick install builder, but I am unhappy with how their isolation works, because I am building untrusted code (see cargo-bins/cargo-quickinstall#49 for details).

It looks like you can have KVM isolated runners for linux (https://cirrus-ci.org/guide/linux/#kvm-enabled-privileged-containers
), and VM isolated macos runners, it I can't see whether it's possible to run windows runners with --isolation=hyperv (https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/hyperv-container)

Can anyone help me work out how the windows containers isolated from each other? It may be that they are already isolated with hyperv, in which case it might be enough to add a note about this to https://cirrus-ci.org/guide/windows/

[fkorotkov]

Hey @alsuren, Windows containers are already executed in separate ephemeral VMs without sharing resources with other tasks. Plus the VM or the task doesn't have any elevated access especially for PRs: GitHub token for cloning is read-only and scoped to the repository, Cirrus itself stores caches and other things in a separate namespace. So it already seems pretty secure without --isolation=hyperv.