freddydk
commented
2 years ago Which Docker version are you running and how did you install it?
Closed StFalagar closed 2 years ago
freddydk
commented
2 years ago Which Docker version are you running and how did you install it?
StFalagar
commented
2 years ago I first ran the latest docker desktop which gave me this... I then changed to Docker Engine/Docker Daemon using your script... Getting the same on both.... I have also installed this on Windows 10 but getting some other permissions errors there so will try and replicate there... that said I am fairly convinced it is not a problem in Windows 10.
freddydk
commented
2 years ago I had the same problem when running the very first version of the docker engine installation script - caused by the fact that the script was modifying the PATH in the machine scope. I changed the script to NOT do that. I removed C:\program files\docker from the PATH in settings - then I was good (the script now does it in the user scope) Could you paste the docker engine installation script here (just want to see if you have the latest) Thanks.
StFalagar
commented
2 years ago Thanks Freddy
I also got it with Docker Desktop that I updated to the latest version yesterday... herewith the script...
Param(
[switch] $force,
[string] $envScope = "User"
)
$currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
if (-not $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
throw "This script needs to run as admin"
}
if ((Test-Path (Join-Path $env:ProgramFiles "Docker Desktop")) -or (Test-Path (Join-Path $env:ProgramFiles "DockerDesktop"))) {
throw "Docker Desktop is installed on this Computer, cannot run this script"
}
# Install Windows feature containers
$restartNeeded = $false
if (!(Get-WindowsOptionalFeature -FeatureName containers -Online).State -eq 'Enabled') {
$restartNeeded = (Enable-WindowsOptionalFeature -FeatureName containers -Online -NoRestart).RestartNeeded
if ($restartNeeded) {
Write-Host "A restart is needed before you can start the docker service after installation"
}
}
# Get Latest Stable version and URL
$latestZipFile = (Invoke-WebRequest -UseBasicParsing -uri "https://download.docker.com/win/static/stable/x86_64/").Content.split("`r`n") |
Where-Object { $_ -like "<a href=""docker-*"">docker-*" } |
ForEach-Object { $zipName = $_.Split('"')[1]; [Version]($zipName.SubString(7,$zipName.Length-11).Split('-')[0]) } |
Sort-Object | Select-Object -Last 1 | ForEach-Object { "docker-$_.zip" }
if (-not $latestZipFile) {
throw "Unable to locate latest stable docker download"
}
$latestZipFileUrl = "https://download.docker.com/win/static/stable/x86_64/$latestZipFile"
$latestVersion = [Version]($latestZipFile.SubString(7,$latestZipFile.Length-11))
Write-Host "Latest stable available Docker Engine version is $latestVersion"
# Check existing docker version
$dockerService = get-service docker -ErrorAction SilentlyContinue
if ($dockerService) {
if ($dockerService.Status -eq "Running") {
$dockerVersion = [Version](docker version -f "{{.Server.Version}}")
Write-Host "Current installed Docker Engine version $dockerVersion"
if ($latestVersion -le $dockerVersion) {
Write-Host "No new Docker Engine available"
Return
}
Write-Host "New Docker Engine available"
}
else {
Write-Host "Docker Service not running"
}
}
else {
Write-Host "Docker Engine not found"
}
if (!$force) {
Read-Host "Press Enter to Install new Docker Engine version (or Ctrl+C to break) ?"
}
if ($dockerService) {
Stop-Service docker
}
# Download new version
$tempFile = "$([System.IO.Path]::GetTempFileName()).zip"
Invoke-WebRequest -UseBasicParsing -Uri $latestZipFileUrl -OutFile $tempFile
Expand-Archive $tempFile -DestinationPath $env:ProgramFiles -Force
Remove-Item $tempFile -Force
$path = [System.Environment]::GetEnvironmentVariable("Path", $envScope)
if (";$path;" -notlike "*;$($env:ProgramFiles)\docker;*") {
[Environment]::SetEnvironmentVariable("Path", "$path;$env:ProgramFiles\docker", $envScope)
}
# Register service if necessary
if (-not $dockerService) {
$dockerdExe = 'C:\Program Files\docker\dockerd.exe'
& $dockerdExe --register-service
}
New-Item 'c:\ProgramData\Docker' -ItemType Directory -ErrorAction SilentlyContinue | Out-Null
Remove-Item 'c:\ProgramData\Docker\panic.log' -Force -ErrorAction SilentlyContinue | Out-Null
New-Item 'c:\ProgramData\Docker\panic.log' -ItemType File -ErrorAction SilentlyContinue | Out-Null
try {
Start-Service docker
}
catch {
Write-Host -ForegroundColor Red "Could not start docker service, you might need to reboot your computer."
}
Ok, yeah that is the latest. Question is whether the docker desktop installer is doing the same thing. What is the value of: [System.Environment]::GetEnvironmentVariable("Path", $envScope) with $envscope user and machine
StFalagar
commented
2 years ago At the moment I am using Docker Engine but I'll see if I can find out what those values are...
StFalagar
commented
2 years ago Is this correct?
Sorry the top one is machine...
freddydk
commented
2 years ago Yes, I think that is how it should be (same as mine) Are you getting defender popup when you create containers now?
StFalagar
commented
2 years ago Yes.,... unfortunately I am still getting it....
freddydk
commented
2 years ago Can we setup a Teams call and troubleshoot? Please email freddyk at microsoft dot com if possible, then we can find a good time.
StFalagar
commented
2 years ago Can we setup a Teams call and troubleshoot? Please email freddyk at microsoft dot com if possible, then we can find a good time.
Thanks for this Freddy... I have sent you a mail...
freddydk
commented
2 years ago freddydk
commented
2 years ago Nothing much we can do while waiting for Windows/Defender team.
StFalagar
commented
2 years ago Thanks Freddy... will switch to Hyper V
StFalagar
commented
2 years ago Freddy, I have set the Isolation parameter on the Run-ALPipeline to Hyper V but it is still installing the container as Process Isolation....
/ _| | | () | | ()
| | _ | | | |_ _ _
| | | '/ \/ _| __| | '_ \ / _ | / / | ' | / ` | | ' \ / \ '|
| |__| | | __/ (| | || | | | | (| | | ( () | | | | | (| | | | | | / |
\|| _|\,|_||| ||_, | _\/|| ||__,||| ||_|_|
_/ |
|/
Default parameter Isolation = HyperV
WARNING: Container name should not exceed 15 characters
BcContainerHelper is version 2.0.19-preview511
BcContainerHelper is running as administrator
Host is Microsoft Windows 11 Enterprise - 21H2
Docker Client Version is 20.10.10
Docker Server Version is 20.10.10
Removing bcvipimplementation-ci from container hosts file
Removing bcvipimplementation-ci-* from container hosts file
Removing C:\ProgramData\BcContainerHelper\Extensions\bcvipimplementation-ci
Fetching all docker images
Fetching all docker volumes
ArtifactUrl and ImageName specified
Image bcimage:sandbox-19.0.29894.30693-w1-mt already exists
Using image bcimage:sandbox-19.0.29894.30693-w1-mt
Creating Container bcvipimplementation-ci
Style: sandbox
Multitenant: Yes
Version: 19.0.29894.30693
Platform: 19.0.29884.30666
Generic Tag: 1.0.1.8
Container OS Version: 10.0.20348.350 (ltsc2022)
Host OS Version: 10.0.22000.318 (21H2)
Using process isolation
Using locale en-US
Disabling the standard eventlog dump to container log every 2 seconds (use -dumpEventLog to enable)
Using license file C:\Licenses\7083530-19.flf
Additional Parameters:
--volume "C:\Devops\1072ContactCreationDevelopment\BC Online and VIP Implementation:c:\sources"
--env customNavSettings=EnableTaskScheduler=False
Files in C:\ProgramData\BcContainerHelper\Extensions\bcvipimplementation-ci\my:
StFalagar
commented
2 years ago Here's the Config File...
{ "use7zipIfAvailable": true, "digestAlgorithm": "SHA256", "baseUrl": "https://businesscentral.dynamics.com", "DOCKER_SCAN_SUGGEST": false, "mapCountryCode": { "ae": "w1", "bd": "w1", "dz": "w1", "eg": "w1", "fo": "dk", "gl": "dk", "id": "w1", "ke": "w1", "lb": "w1", "lk": "w1", "lu": "w1", "ma": "w1", "mm": "w1", "mt": "w1", "my": "w1", "ng": "w1", "qa": "w1", "sa": "w1", "sg": "w1", "tn": "w1", "ua": "w1", "za": "w1" }, "hostHelperFolder": "C:\ProgramData\BcContainerHelper", "TraefikImage": "traefik:v1.7-windowsservercore-1809", "MicrosoftTelemetryConnectionString": "", "psSessionTimeout": 0, "defaultContainerName": "bcserver", "timeStampServer": "http://timestamp.digicert.com", "bcartifactsCacheFolder": "c:\bcartifacts.cache", "SendExtendedTelemetryToMicrosoft": false, "containerHelperFolder": "C:\ProgramData\BcContainerHelper", "ObjectIdForInternalUse": 88123, "apiBaseUrl": "https://api.businesscentral.dynamics.com", "PartnerTelemetryConnectionString": "", "sandboxContainersAreMultitenantByDefault": true, "usePsSession": true, "genericImageName": "mcr.microsoft.com/businesscentral:{0}", "useSharedEncryptionKeys": true, "TreatWarningsAsErrors": [ "AL1026" ], "TraefikUseDnsNameAsHostName": false, "genericImageNameFilesOnly": "mcr.microsoft.com/businesscentral:{0}-filesonly", "defaultNewContainerParameters": { "Isolation": "Hyperv" } }
freddydk
commented
2 years ago That was a bug on me. Just shipped a new version (v2.0.19) where hyperv isolation works.
StFalagar
commented
2 years ago Thanks Freddy, looks like it is working :)
freddydk
commented
2 years ago with defender update 1.353.1128.0 or later, this false positive is no longer. I also updated: https://freddysblog.com/2021/11/11/trojan-warning-when-creating-containers/
StFalagar
commented
2 years ago Thanks very much Freddy.... you were of great help as always!
When installing a new BC Container using the Local-DevEnv.ps1 script from the CICD Example, Windows Security picks up a threat as soon as the container is installed. Deleting the container solves the issue.... Mitigating procedures within Windows Security does not work. Threat as per below:
Scripts used to create container and cause the issue
Full output of scripts