`nerdctl -d -t` detached containers immediately exit with code 3221225786 (0xc000013a) on Windows

[mcayland-ntx]

Description

When attempting to create a detached Windows container, the container exits immediately with code 3221225786 (0xc000013a):

C:\Users\mark>nerdctl run -d -t mcr.microsoft.com/windows/nanoserver:ltsc2025
369992f8d96f29ab0412dc800b3eff24c8a3a29596bbf5ba3629450f2dd709fc

C:\Users\mark>nerdctl ps -a
CONTAINER ID    IMAGE                                            COMMAND                     CREATED          STATUS                               PORTS    NAMES
369992f8d96f    mcr.microsoft.com/windows/nanoserver:ltsc2025    "c:\\windows\\system32…"    5 seconds ago    Exited (3221225786) 2 seconds ago             nanoserver-36999

The container starts and runs fine if used in interactive mode (i.e. not daemonised) via nerdctl run --rm -it mcr.microsoft.com/windows/nanoserver:ltsc2025.

Some initial research shows that code 3221225786 (0xc000013a) or STATUS_CONTROL_C_EXIT suggesting that the container has generated the equivalent of CTRL-C which causes it to exit prematurely.

Steps to reproduce the issue

1. Open a command prompt in Windows and enter nerdctl run -d -t mcr.microsoft.com/windows/nanoserver:ltsc2025
2. Check the status of the container with nerdctl ps -a
3. Note that the container has exited immediately with code 3221225786 (0xc000013a)

Describe the results you received and expected

The container should still be running, and hence visible via nerdctl ps.

What version of nerdctl are you using?

C:\Users\mark>nerdctl version
time="2026-05-14T10:54:50+01:00" level=warning msg="unable to determine buildctl version" error="exec: \"buildctl\": executable file not found in %PATH%"
time="2026-05-14T10:54:51+01:00" level=warning msg="unable to determine runc version" error="exec: \"runc\": executable file not found in %PATH%"
Client:
 Version:       v2.2.0
 OS/Arch:       windows/amd64
 Git commit:    4eb4cbdb6b7ae82ab864a9829d1162a20eb61f81
 buildctl:
  Version:

Server:
 containerd:
  Version:      v2.2.0
  GitCommit:    1c4457e00facac03ce1d75f7b6777a7a851e5c41
 runc:
  Version:

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

Host information

C:\Users\mark>nerdctl info
Client:
 Namespace:     default
 Debug Mode:    false

Server:
 Server Version: v2.2.0
 Storage Driver: windows
 Logging Driver: json-file
 Plugins:
  Log:     fluentd journald json-file none syslog
  Storage: windows-lcow cimfs windows
 Kernel Version:   10.0 26100 (26100.1.amd64fre.ge_release.240331-1435)
 Operating System: Microsoft Windows Version 24H2 (OS Build 26100.8457)
 OSType:           windows
 Architecture:     x86_64
 CPUs:             2
 Total Memory:     7.916GiB
 Name:             AZ-
 ID:               6442774b-b723-4cac-b2e3-a29a35c0406b

[mcayland-ntx]

Amazingly I've found that if I run nerdctl run -d -t mcr.microsoft.com/windows/nanoserver:ltsc2025 enough times then it eventually works! It seems to work in about 1 in every 30 attempts or so on my setup here.

If I run nerdctl with --debug-full during a failed attempt, then nothing at all gets logged in the log file(!) which suggests something is failing very early on. I'm not overly familiar with nerdctl/containerd or Go, but I'll try and do some more digging.

Given that this is racy, I'm starting to wonder if this is a possible dupe of #3437?

[mcayland-ntx]

With a bit more work I was able to obtain logs from the output of "C:\Program Files\containerd\bin\containerd.exe" -l debug for both the good (working) and bad (non-working) cases:

• containerd-debug-bad.txt

• containerd-debug-good.txt

There is an obvious difference between the good and bad cases visible in the log output at the point where the task starts at the log entry marked name=containerd.task.v2.Task.Start:

GOOD:

ime="2026-05-14T10:24:11.787475900+01:00" level=info msg=Span duration=1.6286126s endTime="2026-05-14T10:24:13.416088500+01:00" name=containerd.task.v2.Task.Start parentSpanID=0000000000000000 spanID=d5933c2558c86cae spanKind=server startTime="2026-05-14T10:24:11.787475900+01:00" traceID=782f68f2546355d7ac5755ca6866d930
time="2026-05-14T10:24:12.386803300+01:00" level=info msg=Span duration=966.1185ms eid= endTime="2026-05-14T10:24:13.352921800+01:00" exitStatus=255 exitedAt="seconds:-62135596800" name=State parentSpanID=9f9b2c01284c1c8e spanID=00365ecabc3f14be startTime="2026-05-14T10:24:12.386803300+01:00" status=RUNNING tid=909a5bb8564a594071bc78f1dfccf059b8b1d231a4906d7146ea32972d4363f2 traceID=ca59f5dd376b373ca0ce34056da57154
time="2026-05-14T10:24:12.386803300+01:00" level=info msg=Span duration=1.1142318s endTime="2026-05-14T10:24:13.501035100+01:00" name=containerd.task.v2.Task.State parentSpanID=0000000000000000 spanID=9f9b2c01284c1c8e spanKind=server startTime="2026-05-14T10:24:12.386803300+01:00" traceID=ca59f5dd376b373ca0ce34056da57154
time="2026-05-14T10:24:11.813339100+01:00" level=info msg=Span duration=1.5395824s eid= endTime="2026-05-14T10:24:13.352921500+01:00" exitStatus=255 exitedAt="seconds:-62135596800" name=State parentSpanID=dd66c96efe642c2e spanID=3e01fb379358245e startTime="2026-05-14T10:24:11.813339100+01:00" status=RUNNING tid=909a5bb8564a594071bc78f1dfccf059b8b1d231a4906d7146ea32972d4363f2 traceID=6349de65ef871f2a3d39f8fce5fb2915
time="2026-05-14T10:24:11.813339100+01:00" level=info msg=Span duration=1.7213863s endTime="2026-05-14T10:24:13.534725400+01:00" name=containerd.task.v2.Task.State parentSpanID=0000000000000000 spanID=dd66c96efe642c2e spanKind=server startTime="2026-05-14T10:24:11.813339100+01:00" traceID=6349de65ef871f2a3d39f8fce5fb2915
time="2026-05-14T10:24:13.516636200+01:00" level=info msg=Span duration=0s eid= endTime="2026-05-14T10:24:13.516636200+01:00" exitStatus=255 exitedAt="seconds:-62135596800" name=State parentSpanID=a76eb94acee8db0d spanID=0809eb1363dcd33d startTime="2026-05-14T10:24:13.516636200+01:00" status=RUNNING tid=909a5bb8564a594071bc78f1dfccf059b8b1d231a4906d7146ea32972d4363f2 traceID=845e6dfa5344a9e16947b3574b45ae07
time="2026-05-14T10:24:13.516636200+01:00" level=info msg=Span duration=36.5578ms endTime="2026-05-14T10:24:13.553194000+01:00" name=containerd.task.v2.Task.State parentSpanID=0000000000000000 spanID=a76eb94acee8db0d spanKind=server startTime="2026-05-14T10:24:13.516636200+01:00" traceID=845e6dfa5344a9e16947b3574b45ae07
time="2026-05-14T10:24:13.553193600+01:00" level=info msg=Span duration=0s eid= endTime="2026-05-14T10:24:13.553193600+01:00" exitStatus=255 exitedAt="seconds:-62135596800" name=State parentSpanID=69a31cddf7cfcb6d spanID=ca3d4ea68cc3c39d startTime="2026-05-14T10:24:13.553193600+01:00" status=RUNNING tid=909a5bb8564a594071bc78f1dfccf059b8b1d231a4906d7146ea32972d4363f2 traceID=076958019e98c49605b2bb038cd27c25
time="2026-05-14T10:24:13.553193600+01:00" level=info msg=Span duration=9.3476ms endTime="2026-05-14T10:24:13.562541200+01:00" name=containerd.task.v2.Task.State parentSpanID=0000000000000000 spanID=69a31cddf7cfcb6d spanKind=server startTime="2026-05-14T10:24:13.553193600+01:00" traceID=076958019e98c49605b2bb038cd27c25

BAD:

time="2026-05-14T10:21:20.199332800+01:00" level=info msg=Span duration=1.6852016s endTime="2026-05-14T10:21:21.884534400+01:00" name=containerd.task.v2.Task.Start parentSpanID=0000000000000000 spanID=b8ef573c9316262f spanKind=server startTime="2026-05-14T10:21:20.199332800+01:00" traceID=2c8edd60812956de3a9f99204f925c64
time="2026-05-14T10:21:21.867618600+01:00" level=info msg=Span duration=0s endTime="2026-05-14T10:21:21.867618600+01:00" name=HcsGetProcessProperties parentSpanID=48b69b52e772429d spanID=1a2f64d571fe056b startTime="2026-05-14T10:21:21.867618600+01:00" traceID=88ffa4480a374b1805ecd2586f48d3f3
time="2026-05-14T10:21:21.793534300+01:00" level=info msg=Span cid=3c65cfe61aafeffe45bc9884c78365aa7328e0ca37ea21f97f85155b2b8a3789 duration=117.9515ms endTime="2026-05-14T10:21:21.911485800+01:00" name="hcs::Process::waitBackground" parentSpanID=0000000000000000 pid=568 spanID=48b69b52e772429d startTime="2026-05-14T10:21:21.793534300+01:00" traceID=88ffa4480a374b1805ecd2586f48d3f3
time="2026-05-14T10:21:21.884533800+01:00" level=info msg=Span cid=3c65cfe61aafeffe45bc9884c78365aa7328e0ca37ea21f97f85155b2b8a3789 duration=26.952ms endTime="2026-05-14T10:21:21.911485800+01:00" name="hcs::Process::CloseStdout" parentSpanID=0000000000000000 pid=568 spanID=836bc81637c4e751 startTime="2026-05-14T10:21:21.884533800+01:00" traceID=623cb671b4377d9275dc470ac13d9b5d
time="2026-05-14T10:21:21.911485400+01:00" level=info msg=Span duration=0s eid= endTime="2026-05-14T10:21:21.911485400+01:00" exitStatus=3221225786 exitedAt="seconds:1778750481 nanos:911485400" name=State parentSpanID=eca72c58fc89c938 spanID=55e49099c14fab1f startTime="2026-05-14T10:21:21.911485400+01:00" status=STOPPED tid=3c65cfe61aafeffe45bc9884c78365aa7328e0ca37ea21f97f85155b2b8a3789 traceID=a2059e17f694e4ab6e98c89c4653fd71
time="2026-05-14T10:21:21.911485400+01:00" level=info msg=Span duration=28.5768ms endTime="2026-05-14T10:21:21.940062200+01:00" name=containerd.task.v2.Task.State parentSpanID=0000000000000000 spanID=eca72c58fc89c938 spanKind=server startTime="2026-05-14T10:21:21.911485400+01:00" traceID=a2059e17f694e4ab6e98c89c4653fd71
time="2026-05-14T10:21:20.239280800+01:00" level=info msg=Span duration=1.628338s eid= endTime="2026-05-14T10:21:21.867618800+01:00" exitStatus=255 exitedAt="seconds:-62135596800" name=State parentSpanID=d24b42ca47d0f733 spanID=3b88a60b0d96d91a startTime="2026-05-14T10:21:20.239280800+01:00" status=RUNNING tid=3c65cfe61aafeffe45bc9884c78365aa7328e0ca37ea21f97f85155b2b8a3789 traceID=1db6b99bcb9ab866386f1a154efbb01b
time="2026-05-14T10:21:20.223103900+01:00" level=info msg=Span duration=1.6445151s eid= endTime="2026-05-14T10:21:21.867619000+01:00" exitStatus=255 exitedAt="seconds:-62135596800" name=State parentSpanID=2e5ab1c432b97098 spanID=97961506f87e527f startTime="2026-05-14T10:21:20.223103900+01:00" status=RUNNING tid=3c65cfe61aafeffe45bc9884c78365aa7328e0ca37ea21f97f85155b2b8a3789 traceID=c1ac89f7190e0fde9d60568efa02fc3b

It seems that in the bad case, as soon as the task starts there are log entries for name=HcsGetProcessProperties, name="hcs::Process::waitBackground" and name="hcs::Process::CloseStdout" followed by name=State with exitStatus=3221225786 which is our failure exit code. None of these entries are present in the good case.

Questions:

• Given that these events are generated in the containerd logging ouput, is the bug actually somewhere in containerd and/or hcsshim as opposed to nerdctl?
• Is there some kind of async callback that inadvertently invokes HcsGetProcessProperties during a critical section within the task startup process that is causing the issue? Is this internal to containerd or could this occur due to an external call from nerdctl during task startup? Alternatively perhaps some event on stdout/stderr during initial setup causes the equivalent of a CTRL_C event to be generated?
• Who would be the right people to contact to get some further pointers as to how to debug this?

[mcayland-ntx]

The logs for the bad case suggest we're ending up in hcs::Process::waitBackground which is part of hcsshim: https://github.com/microsoft/hcsshim/blob/main/internal/hcs/process.go#L207.

This suggests that we must be returning from waitNotification with hcsNotificationProcessExited almost immediately in order to call into HcsGetProcessProperties just after the process starts. Possibly we get here via CreateProcess at https://github.com/microsoft/hcsshim/blob/main/internal/hcs/system.go#L788?