5 ms·
Windows in a Docker Container
- andix 3y agoSo it's Windows in a Linux Docker container. Windows Docker containers are already a thing for a long time. Not the best thing, but they exist. https://hub.docker.com/_/microsoft-windows-nanoserver https://hub.docker.com/_/microsoft-windows-nanoserver
- sebazzz 3y agoWindows in a Linux Docker container running KVM (Kernel Virtual Machine).
- deadfece 3y agoMy main advice on Windows Containers is to avoid them at all costs. A lot of the things that ran in Windows Nano Server worked even better in Linux containers, and a full Windows Server Core container is usually only necessary for .NET Framework, where you will need all of the luck in the world help you with that problem. Packer and Ansible are also much harder to use for Windows Containers, so if you're already using those to configure VM images and Ansible to perform config mgmt on VMs, get ready for some headaches to make that work against Windows Containers.
- stackskipton 3y agoFormer Windows Container wrangler. First off, why are you using Ansible/Packer against Windows Container images? You wouldn't fault Linux Containers for being terrible to use with Packer/Ansible because you shouldn't be doing that. Second, Yea, it's only use is Windows specific languages like .Net Framework and various Win32 API applications. Windows Containers works well enough if you are good enough with Powershell to handle various levels of bullshit that comes Windows.
- deadfece 3y ago> First off, why are you using Ansible/Packer against Windows Container images ? You wouldn't fault Linux Containers for being terrible to use with Packer/Ansible because you shouldn't be doing that. You can build Linux containers just fine with Packer/Ansible. But to your point I already stated why I use Ansible and Packer for container images: "if you're already using those to configure VM images and Ansible to perform config mgmt on VMs" I currently build a number of images with Packer and Ansible across Linux and Windows. I choose not to rewrite all of that from scratch in a crummy Dockerfile when I can just have Packer and Ansible make the images alongside everything else they're already making.
- atum47 3y agoI think that would have helped me the other day. I needed to debug a PWA on safari and i don't own any apple products. So i downloaded a windows VM machine and installed safari on it. It worked out but it was a pain.
- deleted 3y ago[deleted]
- janosdebugs 3y agoHuh? Safari exists for Windows? Isn't that like a super old version?
- SbEpUBz2 3y agoWhat? You tested a PWA against a Safari version from 2012 and it worked? That's funny.
- Asmod4n 3y agoLast release was from 2015.
- SbEpUBz2 3y agoIt looks like we're both wrong, time flies! >Safari 5.1.7 for Windows, released in 2010 and now outdated, was the last version made for Windows. https://support.apple.com/en-us/102665 https://support.apple.com/en-us/102665
- Asmod4n 3y agoSo he tested it on a version for the iPad 1? Safari didn’t have pwa features at that time, the concept of pwa's wasn’t even a thing then.
- atum47 3y agoIt was an odd bug related to starting a session in PHP, it involved cookies. But all of you are right. The safari version that i tested don't even support arrow functions.
- xyst 3y agoSo it’s a Windows VM contained inside a Linux VM and managed by Docker? Not a bad way to do penetration testing or sandbox a potential worm or malware.
- candiddevmike 3y agoIt's a Windows VM running in a QEMU container. No Linux VM, unless the container host is a Linux VM I guess.
- mgaunard 3y agoA docker container is essentially a sandboxed process, not a VM.
- blibble 3y agohere it's both
- nyrikki 3y agoThis may be pendantry but containers aren't sandboxes, they are namespaces. It is pid remapping etc.. and any other features that even approximate a sandbox are from secomp, apparmor, /proc masking etc... Namespaces not being jails or sandboxes is an important concept.
- mgaunard 3y agoBy running the process under a different filesystem namespace than "normal" processes, you're effectively sandboxing it.
- nyrikki 3y agoNot when I can read the root filesytem if mknod privilege isn't dropped, update firmware on the EFI partition, load kernel modules in the host namespace etc.... But it is really about the order namespaces start with almost no isolation and you add whatever you want. Sandboxes and Jails tend to start more restricted by default. As an example here is an older step by step example of the above. Note how disabling privileged containers at the docker server layer is still not possible as they decided user namespaces were their solution. https://stackoverflow.com/questions/36425230/privileged-containers-and-capabilities/44100971#44100971 https://stackoverflow.com/questions/36425230/privileged-cont...
- janosdebugs 3y agoI wish most of the software I use wouldn't need access to a GPU. Unfortunately, the only thing keeping me on Windows right now are graphics-related things (Adobe and friends).
- binkHN 3y agoWhile not ideal, you could always relegate Windows to a virtual machine and allow it GPU pass through.
- nicce 3y agoFor that you need two GPUs if you want to control host as well. (Of course, one could use ssh as well, if command-line is enough…)
- binkHN 3y agoI guess this depends on the GPU, and I should have probably mentioned using SR-IOV for this and not actually pass through.
- janosdebugs 3y agoDoes SR-IOV actually work in practice on consumer grade cards these days? Apart from WSL, I haven't done virtualization in a while.
- giancarlostoro 3y agoI keep a Mac around for this sort of thing honestly. Otherwise I am on Linux and never looking back unless Microsoft makes a flavor of Windows for people who dont want a zillion telemetry and invasive features. Just not gonna happen any time soon.
- MarkSweep 3y agoFrom the Dockerfile: FROM scratch COPY --from=qemux/qemu-docker:4.14 / / Is this different than the following? FROM qemux/qemu-docker:4.14
- skissane 3y agoThe first example collapses all the layers into one, which can result in a smaller image than the second If a layer creates a file and then a subsequent layer deletes it, the deleted file is still present in the image taking up space. If you squash the layers, the deleted file is gone “scratch” used to be an empty layer, but in newer versions is now just syntax to state that you want a layer without a parent layer
- minasmorath 3y agoIt's different in that it's creating a new unique intermediate layer, but admittedly I'm struggling to see the value for most workflows. I assume there's an important detail I'm missing, as is the usual case with interesting Dockerfiles.
- charles_f 3y agoI think it's meant to remove a layer, as you're modifying the base layer rather than altering it through a second layer. Probably to limit size. (but that's a theory)
- Guillaume86 3y agoI suppose the goal is not inheriting environment variables, entrypoint definition etc, not sure
- CSMastermind 3y agoNot an expert but I believe the first approach doesn't inherit the metadata, configuration, or layering history from the original image, it just copies the files and folders.
- andix 3y agoIt removes the references to the base image. I don’t see any benefits. Security scanners have a harder time to track issues, because they can’t just detect the image is depending on an insecure base image. It also strips the possibility to deduplicate some base layers, or a partial pull if you already have one of the base layers in the cache (Debian or Ubuntu are very common, you might have even the exact same version already in the layer cache).
- oneplane 3y agoSo it's mostly "a virtual machine managed as a Dockerfile", which you can then use to run a virtual machine that runs Windows but it could run any OS.
- reactordev 3y ago“devices: - /dev/kvm” Well yeah, sure, you’re running a qemu vm in a container, that’s not exactly the same thing here. No one will (should) ever expose /dev/kvm to containers in production.
- tkubacki 3y agoIsn’t that just easy way to run Windows on my laptop ? Docker is not about security, but about lazyness.
- teaearlgraycold 3y agoSome people see the word “containerization” and confuse it with “sandboxing”. It’s about defining your requirements on a filesystem level. Not security.
- Timber-6539 3y agoDocker gives you plenty of tools to sandbox & isolate your applications. Just like any other consumer-facing product you will have to roll your own security policy.
- vbezhenar 3y agoYou can use qemu for pure userspace emulation, without passing /dev/kvm. It'll be slow. Probably unusable for Windows. However I used this kind of emulation to build images with qemu from arm host and it worked OK, like few minutes to boot from Linux image, install some packages, run some commands and shutdown. Docker is actually great for that kind of applications, because you can run it everywhere: Mac, Windows with one single-line. The only problem is that it's not very convenient to use docker images just as file containers, but it works.
- NexRebular 3y agoDocker is actually not that great because you can't run it everywhere. BSD and illumos have no native docker support for example.
- nicklecompte 3y agoETA: I jumped to conclusions a bit - I thought the Bob Pony ISO distributions were shadier than they were and misread part of the installation details. See the discussion below about the challenges with hosting these older Windows ISOs. From the README: > Is this project legal? > Yes, this project contains only open-source code and does not distribute any copyrighted material. Neither does it try to circumvent any copyright protection measures. So under all applicable laws, this project would be considered legal. From install.sh: if [[ "${VERSION,,}" == "win7x64" ]]; then DETECTED="win7x64" VERSION="https://dl.bobpony.com/windows/7/ en_windows_7_enterprise_with_sp1_x64_dvd_u_677651.iso" fi Along with other similarly shady links. Look, IANAL, nor am I hooting and hollering for Microsoft's profits. But that README seems dishonest, any competent user should be suspicious of a "bobpony"-distributed Windows ISO.
- dijit 3y agoTheres no easy solution there, directly linking windows ISOs is a direct violation of the TOS on the website, but there is permission to host the ISOs for your own reasons. Agree that this should be in the documentation, but you can get into legal trouble if you directly link against microsoft.com in distributed code or binaries.
- nicklecompte 3y agoYou can also get in legal trouble if you download and install a flagrantly pirated Windows ISO :) AFAICT this software would solve all its legal problems[1] if it replaced these hard links to clearly unlawful websites with user variables, $URI_TO_WIN10ISO or something. The fact that the README is basically lying to its users makes things even worse. I would go so far as to call this malware. [1] In the sense of "successfully foisting legal difficulties onto end users"
- dijit 3y agoRehosting the same ISO is permitted though. Unless what you're saying is that this is a modified ISO to remove activation. if thats the case then, I agree wholeheartedly. Just explaining why you dont/cant use the standard microsoft.com links.
- theanonymousone 3y agoSorry if this is too silly of a question, but is there the same container, but "running linux", i.e. you can use rdp to connect to a graphical system? Bonus if it can be a different architecture from the host machine.
- kroese 3y agoYou can use my other project, https://github.com/qemus/qemu-docker https://github.com/qemus/qemu-docker for that.
- theanonymousone 3y agoAmazing. Many thanks.
- deleted 3y ago[deleted]