Testing buildkit 0.13 RC for Windows -> Access denied

[fabiang]

I currently testing the release candidate of Builkdit under Windows. Currently trying to build the example Dockerfile with buildkit from here: https://github.com/moby/buildkit/blob/5df020bb365aa943f3e475253988536c73db25b0/docs/windows.md#example-build

I've get the following error (either normal or admin console):

buildctl build `
>> --frontend=dockerfile.v0 `
>> --local context=. \ `
>> --local dockerfile=.

[+] Building 169.8s (7/7) FINISHED
 => [internal] load build definition from Dockerfile                                                                                                                                                                                    0.4s
 => => transferring dockerfile: 183B                                                                                                                                                                                                    0.0s
 => [internal] load metadata for mcr.microsoft.com/windows/nanoserver:ltsc2022                                                                                                                                                          1.8s
 => [internal] load .dockerignore                                                                                                                                                                                                       0.2s
 => => transferring context: 2B                                                                                                                                                                                                         0.0s
 => [1/3] FROM mcr.microsoft.com/windows/nanoserver:ltsc2022@sha256:64b22e42a69ebcdb86e49bf50780b64156431a508f7f06ac3050c71920fe57b7                                                                                                  142.8s
 => => resolve mcr.microsoft.com/windows/nanoserver:ltsc2022@sha256:64b22e42a69ebcdb86e49bf50780b64156431a508f7f06ac3050c71920fe57b7                                                                                                    0.5s
 => => sha256:0de484043f1248d5382233de81d1687426c4c64b6507d0f768eff763724f1bac 116.97MB / 116.97MB                                                                                                                                     23.3s
 => => extracting sha256:0de484043f1248d5382233de81d1687426c4c64b6507d0f768eff763724f1bac                                                                                                                                             116.7s
 => [internal] load build context                                                                                                                                                                                                       2.0s
 => => transferring context: 133B                                                                                                                                                                                                       0.0s
 => [2/3] COPY hello.txt C:/                                                                                                                                                                                                            2.9s
 => ERROR [3/3] RUN echo "Goodbye!" >> hello.txt                                                                                                                                                                                       20.1s
------
 > [3/3] RUN echo "Goodbye!" >> hello.txt:
16.81 Access is denied.

Containerd and Buildkit are both running as services:

containerd.exe --version
containerd github.com/containerd/containerd v1.7.13 7c3aca7a610df76212171d200ca3811ff6096eb8

buildkitd.exe --version
buildkitd github.com/moby/buildkit v0.13.0-rc3 7b23ff0766d3c639a9a0ff9ff0af630089a12eb8

[System.Environment]::OSVersion.Version

Major  Minor  Build  Revision
-----  -----  -----  --------
10     0      20348  0

I guess I need to adjust the ACL for the folder or its parent, but I don't see how, since the service users and administrators have full access:

PS C:\sample_dockerfile> Get-Acl | Format-List

Path   : Microsoft.PowerShell.Core\FileSystem::C:\sample_dockerfile
Owner  : BUILTIN\Administrators
Group  : DOMAIN\Domain Users
Access : NT AUTHORITY\SYSTEM Allow  FullControl
         BUILTIN\Administrators Allow  FullControl
         BUILTIN\Users Allow  ReadAndExecute, Synchronize
         BUILTIN\Users Allow  AppendData
         BUILTIN\Users Allow  CreateFiles
         CREATOR OWNER Allow  268435456
Audit  :
Sddl   : O:BAG:DUD:AI(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;CIID;LC;;;BU)(A;CIID;DC;;;BU)(A;OICIIOID;GA;;;CO)

[profnandaa]

@fabiang -- thanks for looking at the release. This is something I'm currently investigating to ascertain why the difference in the handling of the ACL (ownership transfer). With the current sample at docs/windows.md:

• WS2019 - builds successfully
• WS2022 - "access denied" error // same build error with docker build
• Windows 11 - builds successfully

I get the same build error too with docker build, meaning it shouldn't be treated as a regression; but we might need to handle the discrepancy from the platform / Windows side.

The sample was meant to just do a quick test for buildctl build but I'm glad it unearthed this issue.

The quick workaround, add USER ContainerAdministrator after FROM ... (since the default user for nanoserver is low-priv ContainerUser) or change to servercore from nanoserver; just to meet the purpose of the guide.

I'm going to open a tracking issue for this and update the docs.

[profnandaa]

Here is the tracking issue #4731 and the fix PR #4732

[fabiang]

Thank you, I was able to build the example.

[profnandaa]

welcome!