Windows-Container HyperV isolation Mode issue

Docker Desktop
,
1

I am am building the an image where an external network drive is required to be mapped. There is a strange difference in the way docker interacts with the volumes, when using hyperV isolation.

Case 1: HyperV isolation, LocalDrive C:\data

docker run -v "C:\data":"C:\images" -i --isolation hyperv dockerimage

This executes perfectly, and doesn’t cause trouble. This is not an ideal situation for my use-case, as the data is present in an local network on a server.

Case 2: a) HyperV isolation, RemoteDrive \192.xxx.0.xx\data

RemotePath is mapped locally to a local drive, using

New Smb-GlobalMapping -RemotePath \\192.xxx.0.xx\data -LocalPath H:

Docker image is run again ,

docker run -v "H:/":"C:/images" -i --isolation hyperv dockerimage

Gives the following error

   {
        "Id": "98efda4f99108b5b55a5294f4063e0178c4eb5cb0c4c90dff892b02a7cb53784",
        "Created": "2020-11-17T16:02:00.6358887Z",
        "Path": "cmd",
        "Args": [],
        "State": {
            "Status": "created",
            "Running": false,
            "Paused": false,
            "Restarting": false,
            "OOMKilled": false,
            "Dead": false,
            "Pid": 0,
            "ExitCode": 128,
            "Error": "hcsshim::CreateComputeSystem 98efda4f99108b5b55a5294f4063e0178c4eb5cb0c4c90dff892b02a7cb53784: The parameter is incorrect.\n(extra info: {\"SystemType\":\"Container\",\"Name\":\"98efda4f99108b5b55a5294f4063e0178c4eb5cb0c4c90dff892b02a7cb53784\",\"Owner\":\"docker\",\"IgnoreFlushesDuringBoot\":true,\"LayerFolderPath\":\"C:\\\\ProgramData\\\\Docker\\\\windowsfilter\\\\98efda4f99108b5b55a5294f4063e0178c4eb5cb0c4c90dff892b02a7cb53784\",\"Layers\":[{\"ID\":\"da562984-7fd6-595c-9fb2-dfc33bbbfc90\",\"Path\":\"C:\\\\ProgramData\\\\Docker\\\\windowsfilter\\\\859133db54b33dbe98f51e28660da06c3a299d417841a45ed5f00c3d3b2698fa\"},{\"ID\":\"86486f96-8a0d-5098-8d22-4115528554f8\",\"Path\":\"C:\\\\ProgramData\\\\Docker\\\\windowsfilter\\\\84f5ccf5da7976b5af2375bfdc76c65e1089ed84948278c2d3b0e6213d4cdc9d\"},{\"ID\":\"2fc30483-1251-5e25-b949-ba907b2555da\",\"Path\":\"C:\\\\ProgramData\\\\Docker\\\\windowsfilter\\\\50faff83b3942f7551a9b0538ace20126e7345efcf2992aa5972ae8885123baa\"},{\"ID\":\"5e04bd25-484e-5d28-9f1a-f61c08d3b89d\",\"Path\":\"C:\\\\ProgramData\\\\Docker\\\\windowsfilter\\\\b7b60b5fa26b4ad2835e8d10ceacc0c25e82c6a4f9ad296c8c11f7ecc9ab876c\"},{\"ID\":\"37385a8f-d779-5a3e-a4f1-2e10fc948496\",\"Path\":\"C:\\\\ProgramData\\\\Docker\\\\windowsfilter\\\\5491ad561bb73035517f646a522f506a1869f9d477915348409f1a3eb2cfba19\"},{\"ID\":\"8ee96973-01f4-5a0b-9be9-82725d7e25af\",\"Path\":\"C:\\\\ProgramData\\\\Docker\\\\windowsfilter\\\\cdd6f63701ab3d22ee79917d89a4e6c94149d5c29fa3f9db9114cd5d5c4bc264\"},{\"ID\":\"b2559eb2-1b51-5d04-a419-6d1393fbf21f\",\"Path\":\"C:\\\\ProgramData\\\\Docker\\\\windowsfilter\\\\d9964c2a8c1a800268f9d3d6d57ed20929499698e52e01c4a0ec77eda8e76505\"},{\"ID\":\"f9e55ff6-10ae-5d1c-9146-cb04fd16dc6f\",\"Path\":\"C:\\\\ProgramData\\\\Docker\\\\windowsfilter\\\\110665c19202b6e830ba27ba4ac9cda37da25b323c2bb4867136208b40c29e84\"},{\"ID\":\"3d845347-bfed-561e-b051-0a804df11edd\",\"Path\":\"C:\\\\ProgramData\\\\Docker\\\\windowsfilter\\\\e428b1c7d890891419929dc40bb5d891efe69dac7e70844976cb8466bb35094a\"},{\"ID\":\"ee1dce4e-c131-53c3-bb05-7223d917aca8\",\"Path\":\"C:\\\\ProgramData\\\\Docker\\\\windowsfilter\\\\22f70d8b8c8edd3710c1bcbc160487fb48c01a40cfb8d8b51c624947cbce42d5\"},{\"ID\":\"4b33e55b-aa1e-5574-91bc-cbdbb1857c6f\",\"Path\":\"C:\\\\ProgramData\\\\Docker\\\\windowsfilter\\\\b47e9eb54f5da950c1c1926e5e0df0b89a8852afab06a134373057c29b151f6f\"},{\"ID\":\"37460943-6f35-510d-8eac-d1884ca7b2e4\",\"Path\":\"C:\\\\ProgramData\\\\Docker\\\\windowsfilter\\\\8336953b188c7daad94e83b2c64ad652f1827d11818e07219a7a656010fd8efb\"},{\"ID\":\"0144cfde-366a-52d7-95cb-e872a47dc74e\",\"Path\":\"C:\\\\ProgramData\\\\Docker\\\\windowsfilter\\\\64c264e7affc657fe876cdef72289936eb63df4f31d1d76848f5453a43182e86\"}],\"HostName\":\"98efda4f9910\",\"MappedDirectories\":[{\"HostPath\":\"h:\\\\\",\"ContainerPath\":\"c:\\\\images\",\"ReadOnly\":false,\"BandwidthMaximum\":0,\"IOPSMaximum\":0,\"CreateInUtilityVM\":false}],\"HvPartition\":true,\"EndpointList\":[\"041D1842-5520-4BD7-A5F1-1F00A6EC724E\"],\"HvRuntime\":{\"ImagePath\":\"C:\\\\ProgramData\\\\Docker\\\\windowsfilter\\\\8336953b188c7daad94e83b2c64ad652f1827d11818e07219a7a656010fd8efb\\\\UtilityVM\"},\"AllowUnqualifiedDNSQuery\":true})",
            "StartedAt": "0001-01-01T00:00:00Z",
            "FinishedAt": "0001-01-01T00:00:00Z"
        },

b) Process isolation ,RemoteDrive \192.xxx.0.xx\data

docker run -v "H:/":"C:/images" -i --isolation process dockerimage

Runs perfectly fine. Link to the isolation modes : https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/hyperv-container

Is this something to do permissions inside the hyperV environment?, The Error message from docker unfortunately, does not give a clear picture. Using Hyper-V isolation is necessary in my case due to compatibility issues with Windows container OS and Host OS https://docs.microsoft.com/en-us/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2.

2

were you ever able to figure this out? I am running into a similar situation where my app runs fine with process isolation, but not in hyperv isolation

3

I was playing with Windows network sharing options a year ago and AFAIR the Smb-GlobalMapping network mapping is scoped only fir the host and its process including the process isolated docker machines. With hyperv docker you need to redefine in each container the network access. Pardon me that i remember only the results of my research…