App published as single file fails to run in Windows 10.0.17763 containers

[mthalman]

Description

Attempting to run the Hello World console app, that was published as a single file deployment, in a Windows 10.0.17763 container will fail with an error message similar to the following:

Failed to map file. CreateFileMappingW(C:\app\app.exe) failed with error 5
Failure processing application bundle.
Failed to map bundle file [C:\app\app.runtimeconfig.json]

This behavior applies to both 5.0 and 6.0. It works in .NET Core 2.1 and 3.1. And it only occurs when targeting a Windows 10.0.17763 container (this version maps to Windows 10 version 1809 and Windows Server 2019). Targeting newer or older versions of Windows containers also works. I've attempted to repro this outside of a container environment, just on a Windows Server 2019 machine directly and it worked fine. Things also work fine if you attempt to run an app that was published without the single file option so the failure is specific to that option.

Repro

On a machine with Docker installed and targeting Windows containers:

1. Create a new empty directory
2. Add a file named Dockerfile with the following content:

FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
WORKDIR /app

RUN dotnet new console

RUN dotnet publish -c release -o /out -r win-x64 /p:PublishSingleFile=true

FROM mcr.microsoft.com/windows/nanoserver:1809
WORKDIR /app
COPY --from=build /out .

ENTRYPOINT ["app"]

3. docker build -t app .
4. docker run --rm app

Configuration

The environment I'm running:

• Windows 10, version 21H1
• Docker

❯ docker version
Client:
 Cloud integration: 1.0.17
 Version:           20.10.7
 API version:       1.41
 Go version:        go1.16.4
 Git commit:        f0df350
 Built:             Wed Jun  2 12:00:56 2021
 OS/Arch:           windows/amd64
 Context:           desktop-windows
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          20.10.7
  API version:      1.41 (minimum version 1.24)
  Go version:       go1.13.15
  Git commit:       b0f5bc3
  Built:            Wed Jun  2 11:56:41 2021
  OS/Arch:          windows/amd64
  Experimental:     true

Regression?

This works in .NET Core 2.1 and 3.1. It started failing with 5.0.100.

Other information

Tagging subscribers to this area: @agocke, @vitek-karas, @VSadov
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

Attempting to run the Hello World console app, that was published as a single file deployment, to a Windows 10.0.17763 container will fail with an error message similar to the following:

Failed to map file. CreateFileMappingW(C:\app\app.exe) failed with error 5
Failure processing application bundle.
Failed to map bundle file [C:\app\app.runtimeconfig.json]

This behavior applies to both 5.0 and 6.0. It works in .NET Core 2.1 and 3.1. And it only occurs when targeting a Windows 10.0.17763 container (this version maps to Windows 10 version 1809 and Windows Server 2019). Targeting newer or older versions of Windows containers also works. I've attempted to repro this outside of a container environment, just on a Windows Server 2019 machine directly and it worked fine. Things also work fine if you attempt to run an app that was published without the single file option so the failure is specific to that option.

Repro

On a machine with Docker installed and targeting Windows containers:

1. Create a new empty directory
2. Add a file named Dockerfile with the following content:

FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
WORKDIR /app

RUN dotnet new console

RUN dotnet publish -c release -o /out -r win-x64 /p:PublishSingleFile=true

FROM mcr.microsoft.com/windows/nanoserver:1809
WORKDIR /app
COPY --from=build /out .

ENTRYPOINT ["app"]

3. docker build -t app .
4. docker run --rm app

Configuration

The environment I'm running:

• Windows 10, version 21H1
• Docker

❯ docker version
Client:
 Cloud integration: 1.0.17
 Version:           20.10.7
 API version:       1.41
 Go version:        go1.16.4
 Git commit:        f0df350
 Built:             Wed Jun  2 12:00:56 2021
 OS/Arch:           windows/amd64
 Context:           desktop-windows
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          20.10.7
  API version:      1.41 (minimum version 1.24)
  Go version:       go1.13.15
  Git commit:       b0f5bc3
  Built:            Wed Jun  2 11:56:41 2021
  OS/Arch:          windows/amd64
  Experimental:     true

Regression?

This works in .NET Core 2.1 and 3.1. It started failing with 5.0.100.

Other information

Author:	mthalman
Assignees:	-
Labels:	area-Single-File, untriaged
Milestone:	-

[Symbai]

Since .NET5 single file published apps no longer extract content to disk, instead load them from memory. Error 5 means access denied, its a permission issue. Likely missing SeCreateGlobalPrivilege permission (see last paragraph)?

[mthalman]

Since .NET5 single file published apps no longer extract content to disk, instead load them from memory. Error 5 means access denied, its a permission issue. Do you have SeCreateGlobalPrivilege permission (see last paragraph)?

I don't know how to check for that.

In the case of Nano Server, the default user is ContainerUser but in Windows Server Core the default user is ContainerAdministrator. And this scenario fails using Windows Server Core (e.g. mcr.microsoft.com/windows/servercore:ltsc2019). I've also tested adding USER ContainerAdministrator to my repro Dockerfile and it continues to fail. Note that this works in newer versions of Windows containers, such as mcr.microsoft.com/windows/nanoserver:2004, even when running as ContainerUser.

[agocke]

@VSadov Could you investigate and see if you can find the problem here?

[VSadov]

The confusing part is Targeting newer or older versions of Windows containers also works. - Is it just a particular version of Windows that is affected?
It sounds like it could be a configuration issue, but I cant think what causes it.

The file mappings that we create, I believe, are anonymous, so there is no "Global" name prefix.

[mthalman]

Yes, it only occurs for this particular Windows version but it's an LTS version so it's significant.

[VSadov]

My current theory is that this container version/configuration does not handle well a situation when a currently running exe opens a file mapping to itself with a copy-on-write view (PAGE_WRITECOPY).
It should be ok and works fine in other environments, but there could be something in that version of OS or in container settings that disallow such scenario. Maybe it is the size of page file or some permission is missing.

Anyways, I do not think we actually need COW on Windows. It is there to allow in-situ parsing of json config, which we do not do on windows anyways due to reasons related to UTF8 encoding. It is COW only for consistency with Unix,
I think I can use readonly mapping on Windows and that will have more chances to work.

As I am completely unfamiliar with Windows containers - what would be the simplest way to try running a different locally built app inside that same container?

[VSadov]

Another interesting part is that if I start a container, attach console and run the app interactively, only the first execution fails:

Microsoft Windows [Version 10.0.17763.2114]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\app>app.exe
Failed to map file. CreateFileMappingW(C:\app\app.exe) failed with error 5
Failure processing application bundle.
Failed to map bundle file [C:\app\app.runtimeconfig.json]

C:\app>app.exe
Hello, World!

C:\app>