none
Sysmon preventing docker build RRS feed

  • Question

  • Hi!

    Whenever I install sysmon64.exe  

    .\Sysmon64.exe -accepteula -i

    on windows server 2019 it breaks docker build

    re-exec error: exit status 1: output: time="2020-07-31T09:37:31Z" level=error msg="hcsshim::ImportLayer - failed failed in Win32: The system cannot find the path specified. (0x3)" error="hcsshim::ImportLayer - failed failed in Win32: The system cannot find the path specified. (0x3)" importFolderPath="C:\\ProgramData\\docker\\tmp\\hcs126273955" path="\\\\?\\C:\\ProgramData\\docker\\windowsfilter\\bba851fab7f7b9db530399b034befb46f3f58120e15c63687e4d2e88673deb25"
    Removing sysmon64 brings docker build back to normal. What may be a root cause and how this can be fixed?

    Friday, July 31, 2020 9:44 AM

All replies

  • Hello

    thanks for reporting this issue. I tried it using Docker Destop on my Windows 10 machine and that built correctly. I have added this to the backlog so that we can retest on Server 2019.

    Can I just confirm that you are using Sysmon 11.11?

    MarkC(MSFT)

    Friday, July 31, 2020 12:30 PM
  • Hi,
    Yes it is 11.11. Got it as described at https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
    >I tried it using Docker Destop on my Windows 10 machine and that built correctly.

    I am using windows server 2019 datacenter.
    Here is a sample dockerfile (just a copy-paste from some resource as an example) which allows to reproduce the issue (at least for me):

    FROM mcr.microsoft.com/windows/servercore:ltsc2019

    LABEL maintainer="jshelton@contoso.com" RUN dism.exe /online /enable-feature /all /featurename:iis-webserver /NoRestart RUN echo "Hello World - Dockerfile" > c:\inetpub\wwwroot\index.html CMD [ "cmd" ]



    docker build -t test .
    Sending build context to Docker daemon  2.048kB
    Step 1/5 : FROM mcr.microsoft.com/windows/servercore:ltsc2019
     ---> 987b1d5e0abf
    Step 2/5 : LABEL maintainer="jshelton@contoso.com"
     ---> Running in d181a71b3466
    re-exec error: exit status 1: output: time="2020-07-31T12:48:39Z" level=error msg="hcsshim::ImportLayer - failed failed in Win32: The system cannot find the path specified. (0x3)" error="hcsshim::ImportLayer - failed failed in Win32:
     The system cannot find the path specified. (0x3)" importFolderPath="C:\\ProgramData\\docker\\tmp\\hcs216902771" path="\\\\?\\C:\\ProgramData\\docker\\windowsfilter\\f5b651740f9a136f54ba046904b9c31ca041098d16d36fa3348496a377e1fe3f"
    hcsshim::ImportLayer - failed failed in Win32: The system cannot find the path specified. (0x3)


    docker version

    Docker version 19.03.5, build 2ee0c57608


    • Edited by ezhik666 Friday, July 31, 2020 9:01 PM
    Friday, July 31, 2020 12:50 PM
  • Also stopping sysmon via 'Services' does not fix build issue. Only uninstall
    • Edited by ezhik666 Friday, July 31, 2020 1:40 PM
    Friday, July 31, 2020 1:39 PM
  • also just unloaded sysmondrv via

     fltMC.exe unload SysmonDrv
    but sysmon process  was alive... and docker build  was successful.

    Friday, July 31, 2020 1:45 PM