search

mandiant / ThreatPursuit-VM

Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and hunting designed for intel and malware analysts as well as threat hunters to get up and running quickly.
Other
1.24k stars 248 forks source link

Docker Error During/Post Install #5

Open cyberstag22 opened 4 years ago

cyberstag22 commented 4 years ago

Trying to install this on a VirtualBox VM, both host and VM are Windows 10. The install seemed to be going along fine, and possibly finished, as I am not seeing a shell anymore. I am however getting a docker error "System.InvalidOperationException: Failed to deploy distro docker-desktop to C:\Users\User\AppData\Local\Docker\wsl\distro: exit code: -1 stdout: Please enable the Virtual Machine Platform Windows feature and ensure virtualization is enabled in the BIOS.......", Full error message attached. Full Docker Error Message.txt

In troubleshooting I have confirmed that windows features Hyper-V and Windows Virtual Platform are enabled, and stay enabled through a reboot. In the Virtual Box settings I have both PAE/NX and Nested VT-x/AMD-V enabled. Also Confirmed that I am using WSL Version 2, but when I check on it' status it remains "Stopped".

Running Windows 10 Enterprise Evaluation Version 2004

What am I missing?

I am attaching the diagnostic log referenced in the docker error to this post as well. diagnostics[1].log

Museon23 commented 4 years ago

Same on my end regarding the docker error, but I am using VMWare Workstation Pro. Windows 1903

itzdan commented 4 years ago

Will try reproduce the error on Virtualbox VM. Wait out..

itzdan commented 4 years ago

Same on my end regarding the docker error, but I am using VMWare Workstation Pro. Windows 1903

Same error or a different error for the setup and running of MISP in docker? Can you provide more detail please.

Nexx1c commented 4 years ago

Same issue running on a Windows 10 1903 in Azure.

itzdan commented 4 years ago

Same issue running on a Windows 10 1903 in Azure.

Hey @Nexx1c

I don't believe virtualization hosting providers, particularly on shared computing infrastructure that provide vCPU's, would allow access to Hardware CPU Counters, due to the isolation goal, and concern of exposing special-purpose registers. Which may be a factor. Any more details on virtualisation support provided with your Azure instance??

timjgallo commented 4 years ago

@itzdan I'm getting the same error as @cyberstag22 with VmBox, WIndows Guest version is 20H2 Build 19042.572. PAE/NX and Nested VT-x/AMD-V are both enabled on the machine, as is Nested Paging (Paravirtualization interface is set to default) Going to try a re-run of the install script from snapshot with those features turned off to see if I get the same issue.

day1player commented 4 years ago

@cyberstag22 @Museon23 @timjgallo please see this corresponding issue for commando vm: https://github.com/fireeye/commando-vm/issues/94

Docker Desktop is not supported on VMware Workstation (that is, a Windows HOST machine)

day1player commented 4 years ago

@Nexx1c I have never tried running the VMs inside of Azure but I would imagine that it is the same issue (https://github.com/fireeye/commando-vm/issues/94) that keeps it from working since Azure is most likely using Windows Servers.

There is something to do with VMware workstation and Docker Desktop both requiring some of the host's HyperV functionality that makes them incompatible.

timjgallo commented 4 years ago

@cyberstag22 @Museon23 @timjgallo please see this corresponding issue for commando vm: fireeye/commando-vm#94

Docker Desktop is not supported on VMware Workstation (that is, a Windows HOST machine)

Thanks @day1player - It looks like there may be a workaround by installing Docker ToolBox on the Host...https://medium.com/@peorth/using-docker-with-virtualbox-and-windows-10-b351e7a34adc If that doesn't work it looks like VMBox may be out of the question for Windows Host/Guest Combos?

day1player commented 4 years ago

@timjgallo Thank you for the post, I will look into that. Unfortunately yes, you are right, it isn't likely that you will be able to get the Windows Host + Windows VM + Docker Desktop to work, however it is possible, we just arent able to provide support for that since Docker themselves dont support it. I have seen it work though. I would recommend reading through the above issue as there is a lot of info in the thread that could help you with a work around for getting actual Docker Desktop to run.

Meanwhile we can look into the Docker Toolbox suggestion.

day1player commented 4 years ago

@timjgallo Something else to look into is setting up WSL2 on your distro, and configuring Docker Desktop to use WSL2.. That actually might fix Docker Desktop (I do not have a windows host machine for testing 😞)

itzdan commented 4 years ago

My setup running MISP docker on TPVM, on Windows 10 Pro N host.

Windows 10 Pro N Host

Processor AMD FX-9370 Eight Core Windows Pro N 2004 19041.572 VMware Workstation Pro 14.1.3 build-9474260

Installed packages...

My docker diagnostic logs.. cpuinfo.txt log.txt

Docker Desktop, General -> Resources

win10_vmworkstation_config

MISP containers up and running on Docker.

TPVM Win10
itzdan commented 4 years ago

@cyberstag22 @timjgallo @day1player

I have reproduced the issue on VirtualBox running on Windows 10 Eval Edition (on same hardware that was mentioned previously)

Having enabled the HyperV feature via DISM, I rebooted and still receive a generic error regarding Hyper-V. Not much is revealed here. (this step was not needed via VMware Player or Workstation)

cyberstag22 commented 4 years ago

@itzdan I just got done with the install in VMWare Player and I am not getting the Docker error, and at least fresh off of the install, docker is up and healthy. Seems I'll just run it in there instead for the time being. Appreciate the support!

minotaurus201 commented 4 years ago

image I am install on VirtualBox. I had problem with docker.

darioongit commented 3 years ago

I think the script should install this https://wslstorestorage.blob.core.windows.net/wslblob/wsl_update_x64.msi, after that this message disappears image