WCOW: Handling of ACL / file ownership, compatibility issues between WS2019, WS2022 and Windows 11

[profnandaa]

First, this is not strictly a buildkit regression but something that I suspect is a coming from the platform side, it's by design.

When you follow the guide at b7d04a docs/windows.md, you get "access denied" error on only WS2022 but the build is successful both on Windows 11 and WS2019. It's the same case too with the classic docker build.

Current work-around, add USER ContainerAdministrator to the dockerfile (since the default user on nanoserver image is a low-priv ContainerUser); just to meet the purpose of the guide:

Set-Content Dockerfile @"
FROM mcr.microsoft.com/windows/nanoserver:ltsc2022
USER ContainerAdministrator
COPY hello.txt C:/
RUN echo "Goodbye!" >> hello.txt
CMD ["cmd", "/C", "type C:\\hello.txt"]
"@

This thankfully has unearthed something that we need to address.

[profnandaa]

Also see discussion here - #4729

[TBBle]

How does FROM mcr.microsoft.com/windows/nanoserver:ltsc2022 build successfully on Windows Server 2019? That shouldn't work with either process isolation or HyperV isolation, AFAIK.

The fact that the USER line fixes it suggests that the default user has somehow changed in the platform code, which would be annoying and probably break existing images that assume you're ContainerAdministrator at runtime.