Windows in a Docker Container

by keepamovin • 2 years ago

86 66 2 years ago

andix2• 2 years ago

So it's Windows in a Linux Docker container. Windows Docker containers are already a thing for a long time. Not the best thing, but they exist.

https://hub.docker.com/_/microsoft-windows-nanoserver

sebazzz• 2 years ago

Windows in a Linux Docker container running KVM (Kernel Virtual Machine).

deadfece2• 2 years ago

My main advice on Windows Containers is to avoid them at all costs.

A lot of the things that ran in Windows Nano Server worked even better in Linux containers, and a full Windows Server Core container is usually only necessary for .NET Framework, where you will need all of the luck in the world help you with that problem.

Packer and Ansible are also much harder to use for Windows Containers, so if you're already using those to configure VM images and Ansible to perform config mgmt on VMs, get ready for some headaches to make that work against Windows Containers.

stackskipton• 2 years ago

Former Windows Container wrangler. First off, why are you using Ansible/Packer against Windows Container images? You wouldn't fault Linux Containers for being terrible to use with Packer/Ansible because you shouldn't be doing that.

Second, Yea, it's only use is Windows specific languages like .Net Framework and various Win32 API applications. Windows Containers works well enough if you are good enough with Powershell to handle various levels of bullshit that comes Windows.

atum473• 2 years ago

I think that would have helped me the other day. I needed to debug a PWA on safari and i don't own any apple products. So i downloaded a windows VM machine and installed safari on it. It worked out but it was a pain.

janosdebugs3• 2 years ago

Huh? Safari exists for Windows? Isn't that like a super old version?

SbEpUBz22• 2 years ago

What? You tested a PWA against a Safari version from 2012 and it worked? That's funny.

Asmod4n2• 2 years ago

Last release was from 2015.

atum473• 2 years ago

It was an odd bug related to starting a session in PHP, it involved cookies.

But all of you are right. The safari version that i tested don't even support arrow functions.

evilduck• 2 years ago

You'd be better off testing against something more recent if you wanted any useful information about bugs happening on modern user devices. Safari isn't a greenfield release-every-two-weeks browser, but they have major annual updates and have been known to regularly add features in point releases between major versions, it's changed quite a lot since the last Windows Safari release a decade ago or more.

You can get much more recent Safari (and iOS simulator Safari) releases through macOS virtualization, https://github.com/sickcodes/Docker-OSX though this skirts some Apple EULAs. If you want desktop Webkit rendering and JS interpreter parity, https://webkit.org/downloads/ also offers several Linux webkit browser options that would also likely be more accurate than Safari v5.

atum473• 2 years ago

Clarification: it was a problem with PHP not starting a session. It worked on chrome and ff, but my friends on iphones were facing issues.

xyst• 2 years ago

So it’s a Windows VM contained inside a Linux VM and managed by Docker?

Not a bad way to do penetration testing or sandbox a potential worm or malware.

candiddevmike• 2 years ago

It's a Windows VM running in a QEMU container. No Linux VM, unless the container host is a Linux VM I guess.

mgaunard3• 2 years ago

A docker container is essentially a sandboxed process, not a VM.

blibble• 2 years ago

here it's both

nyrikki3• 2 years ago

This may be pendantry but containers aren't sandboxes, they are namespaces.

It is pid remapping etc.. and any other features that even approximate a sandbox are from secomp, apparmor, /proc masking etc...

Namespaces not being jails or sandboxes is an important concept.

dijit6• 2 years ago

Well… qemu is a process.

janosdebugs3• 2 years ago

I wish most of the software I use wouldn't need access to a GPU. Unfortunately, the only thing keeping me on Windows right now are graphics-related things (Adobe and friends).

binkHN2• 2 years ago

While not ideal, you could always relegate Windows to a virtual machine and allow it GPU pass through.

nicce• 2 years ago

For that you need two GPUs if you want to control host as well. (Of course, one could use ssh as well, if command-line is enough…)

giancarlostoro• 2 years ago

I keep a Mac around for this sort of thing honestly. Otherwise I am on Linux and never looking back unless Microsoft makes a flavor of Windows for people who dont want a zillion telemetry and invasive features. Just not gonna happen any time soon.

MarkSweep• 2 years ago

From the Dockerfile:

    FROM scratch
    COPY --from=qemux/qemu-docker:4.14 / /

Is this different than the following?

    FROM qemux/qemu-docker:4.14

skissane• 2 years ago

The first example collapses all the layers into one, which can result in a smaller image than the second

If a layer creates a file and then a subsequent layer deletes it, the deleted file is still present in the image taking up space. If you squash the layers, the deleted file is gone

“scratch” used to be an empty layer, but in newer versions is now just syntax to state that you want a layer without a parent layer

minasmorath• 2 years ago

It's different in that it's creating a new unique intermediate layer, but admittedly I'm struggling to see the value for most workflows. I assume there's an important detail I'm missing, as is the usual case with interesting Dockerfiles.

charles_f• 2 years ago

I think it's meant to remove a layer, as you're modifying the base layer rather than altering it through a second layer. Probably to limit size. (but that's a theory)

Guillaume86• 2 years ago

I suppose the goal is not inheriting environment variables, entrypoint definition etc, not sure

CSMastermind• 2 years ago

Not an expert but I believe the first approach doesn't inherit the metadata, configuration, or layering history from the original image, it just copies the files and folders.

andix2• 2 years ago

It removes the references to the base image.

I don’t see any benefits. Security scanners have a harder time to track issues, because they can’t just detect the image is depending on an insecure base image.

It also strips the possibility to deduplicate some base layers, or a partial pull if you already have one of the base layers in the cache (Debian or Ubuntu are very common, you might have even the exact same version already in the layer cache).

c-hendricks• 2 years ago

Would any changes to the tag get pulled with `docker build --pull`?

kroese4• 2 years ago

I did this to prevent inheriting environment variables from the base image. Unfortunately Docker does not provide a way to do this when using FROM.

oneplane• 2 years ago

So it's mostly "a virtual machine managed as a Dockerfile", which you can then use to run a virtual machine that runs Windows but it could run any OS.

reactordev• 2 years ago

   “devices:
         - /dev/kvm”

Well yeah, sure, you’re running a qemu vm in a container, that’s not exactly the same thing here.

No one will (should) ever expose /dev/kvm to containers in production.

tkubacki• 2 years ago

Isn’t that just easy way to run Windows on my laptop ? Docker is not about security, but about lazyness.

teaearlgraycold• 2 years ago

Some people see the word “containerization” and confuse it with “sandboxing”. It’s about defining your requirements on a filesystem level. Not security.

vbezhenar• 2 years ago

You can use qemu for pure userspace emulation, without passing /dev/kvm. It'll be slow. Probably unusable for Windows. However I used this kind of emulation to build images with qemu from arm host and it worked OK, like few minutes to boot from Linux image, install some packages, run some commands and shutdown.

Docker is actually great for that kind of applications, because you can run it everywhere: Mac, Windows with one single-line. The only problem is that it's not very convenient to use docker images just as file containers, but it works.

NexRebular• 2 years ago

Docker is actually not that great because you can't run it everywhere. BSD and illumos have no native docker support for example.

k8svet• 2 years ago

Docker is literally doing nothing there but getting you a qemu binary. There are countless better, more efficient ways to do that. Namely nix.

If "running a VM" is somehow simpler with docker, you should really think about what Docker is supposedly doing for you.

nicklecompte3• 2 years ago

ETA: I jumped to conclusions a bit - I thought the Bob Pony ISO distributions were shadier than they were and misread part of the installation details. See the discussion below about the challenges with hosting these older Windows ISOs.

From the README:

Is this project legal?
Yes, this project contains only open-source code and does not distribute any copyrighted material. Neither does it try to circumvent any copyright protection measures. So under all applicable laws, this project would be considered legal.

From install.sh:

  if [[ "${VERSION,,}" == "win7x64" ]]; then
    DETECTED="win7x64"
 
  VERSION="https://dl.bobpony.com/windows/7/
  en_windows_7_enterprise_with_sp1_x64_dvd_u_677651.iso"
  fi

Along with other similarly shady links.

Look, IANAL, nor am I hooting and hollering for Microsoft's profits. But that README seems dishonest, any competent user should be suspicious of a "bobpony"-distributed Windows ISO.

dijit6• 2 years ago

Theres no easy solution there, directly linking windows ISOs is a direct violation of the TOS on the website, but there is permission to host the ISOs for your own reasons.

Agree that this should be in the documentation, but you can get into legal trouble if you directly link against microsoft.com in distributed code or binaries.

nicklecompte3• 2 years ago

You can also get in legal trouble if you download and install a flagrantly pirated Windows ISO :)

AFAICT this software would solve all its legal problems[1] if it replaced these hard links to clearly unlawful websites with user variables, $URI_TO_WIN10ISO or something. The fact that the README is basically lying to its users makes things even worse. I would go so far as to call this malware.

[1] In the sense of "successfully foisting legal difficulties onto end users"

justsomehnguy2• 2 years ago

but there is permission to host the ISOs for your own reasons

I'm not searching for the exact wording, but hosting for an unlimited and unrestricted access is a distribution in a legal sense and is not allowed

mystifyingpoi• 2 years ago

It is way worse. Search for `local_key` in the source.

dijit6• 2 years ago

I found what you are referring to on line 76 of the assets/win7x64.xml answer file (under the “Key” directive).

So I googled the key to see if it was a widely circulated known cracked key I found.

It turned up on this site: https://www.windowsafg.com/keys.html which implies (strongly) that its a placeholder key that doesn't activate windows, they’re used for installation only.

kotaKat• 2 years ago

Oh, that's the generic install key used for volume activation later. Same thing that happens when you click "Skip product key" in Windows setup.

kroese4• 2 years ago

It downloads all the ISOs from the official Microsoft servers for every recent version. For older versions like Win7/Vista/XP it is impossible to download them from Microsoft, because they are not available anymore on their servers.

So for those I had to use an alternative mirror (BobPony), but I checked all the SHA256 checksums to make sure they are unmodified retail versions. If someone does not trust it, they can check the checksums of the downloaded ISO themselves or just dont use this container for anything below Windows 8.1.

theanonymousone2• 2 years ago

Sorry if this is too silly of a question, but is there the same container, but "running linux", i.e. you can use rdp to connect to a graphical system?

Bonus if it can be a different architecture from the host machine.

kroese4• 2 years ago

You can use my other project, https://github.com/qemus/qemu-docker for that.

theanonymousone2• 2 years ago

Amazing. Many thanks.

Windows in a Docker Container

Related Stories