Why lcow not support --privileged

[bangzhuzhu]

docker:
Storage Driver: windowsfilter (windows) lcow (linux)

I think the lcow is a mode that docker build a vm to run linux container, so get the host permission to create a privileged container is achievable way.
So I want to know some more detailed answer or a way to find answer.
Thank you.

[rimelek (Ákos Takács)]

I have just heard about lcow yesterday, and today I realized I heard about it before, but I totally forgot about that, since I have never used that. Now we have WSL2 on Windows 10 and 11 and you can run Virtual Machines on Windows Server or use Windows Server 2022 with WSL2. I have learned it from @vrapolinario

Linux container support on Windows servers

Not sure this is allowed, but for anyone interested on Linux containers on Windows Server, I’d love to chat more and understand the scenario. Please reach out. Here’s a workaround that is supported: You can use Hyper-V to install a Linux VM on Windows Server and run your containers there. This is not much different than what WSL does. Here’s another workaround that is supported: You can use WSL2 on Windows Server 2022 now: WSL2 now available on Windows Server 2022 (microsoft.com) Please note t…

As far as I know, lcow was an experimental project and discontinued. The privileged mode means you have unlimited access to the kernel. I don’t know how lcow worked, but maybe the nature of lcow did not allow to implement it easily. Buy the way, the privileged mode is something that was implemented long ago, and Justin Cormack, the CTO of Docker said it should not even exist, but it was required then. Well, I don’t remember his exact words (I think it was on DockerCon or in a YouTube video), but this leads us to your next question in the other topic:

Can --privileged perfectly replace all by --security-opt xxx and --cap-add xxx?

I want to run a specific container(k3s) need privileged mode in a windows docker with(lcow feature), but windows do not support --privileged. so Is there any way to replace it with --security-opt and --cap-add?

[vrapolinario (Vinicius Apolinario)]

This is correct. This was an experimental feature and is no longer supported. With LCOW, users could interact directly with the Docker deamon on a Linux container running on a Hyper-V isolated container, directly from the host. So from a user standpoint, Windows containers, and Linux containers would be running side by side on the same host. This is not supported anymore and there are two alternatives:

• You can build your own Linux VM on Hyper-V and just play with Docker in there just like you would on any system.
• You can use WSL2 on Windows Server 2022 and interact with Docker from the host via WSL2. I’m planning to blog on this to show how the process works, but haven’t yet.

This last one is new to me as I recently reached out to the WSL2 folks internally. The main thing is that it is recommended for development and testing only, not production.

[bangzhuzhu]

@vrapolinario

This last one is new to me as I recently reached out to the WSL2 folks internally. The main thing is that it is recommended for development and testing only, not production.

Is this way being possible to start a privileged container?

[vrapolinario (Vinicius Apolinario)]

I did not test that, but even if it works, it would be making changes to the WSL2 utility VM, not the Windows node.

[bangzhuzhu]

That make sense, but if it support privileged container, that would be so impressive.

[rimelek (Ákos Takács)]

Since WSL2 (in our point of view) is almost like a normal Linux with its own Linux kernel, you shouldn’t have any problem with privileged containers until you don’t want to access something that is usually the part of a Linux distribution but WSL2 does not have it. For example Systemd. If WSL2 in Windows Server works the same way as it works on a Windows 11 desktop, Docker will not start with the system and you need to start it by running service docker start An other common problem could be that the WSL2 distribution gets its IP address from the same IP range as Docker networks. So if you want to make sure everything works, you need to change the default Docker networks or the network of WSL2 which I could not figure out yet, but the point is that there is a solution and I think you will not have any problem with the privileged flag.