Process Isolation ws2025 - container fails to shutdown gracefully

[gabrielalb]

Hello,

I know it hasn't been available for long, but I was very eager to try out the new ltsc2025 image and to finally have the same kernel build between my Win11 machine and the container, and for that reason I tried process isolation. Using the official image as base and nothing else, I am able to start the container up with no issues at all, however the problem appears when I attempt to shut it down. It just takes around 10 minutes for it to stop, and even after that happens, it appears some resources remain locked as I ran into the error "object is being used by another process" thrown by docker desktop when I attempt to restart it. Completely rebooting the machine and recreating the container seems to be the only way to reset everything back to normal so far. Never had this issue with ltsc2022.

I am running both the host and the container with OS Build 10.0.26100.2314. Any thoughts or suggestions would be much appreciated.

[github-actions]

Thank you for creating an Issue. Please note that GitHub is not an official channel for Microsoft support requests. To create an official support request, please open a ticket here. Microsoft and the GitHub Community strive to provide a best effort in answering questions and supporting Issues on GitHub.

[gabrielalb]

After further investigation this seems not related to the base ltsc2025 image itself but having IIS installed on top of the image (something I missed during my initial testing). I previously had IIS installed on the host, but I tried uninstalling it and that did not fix the issue either.

Test scenario:
docker pull mcr.microsoft.com/windows/servercore/iis:windowsservercore-ltsc2025
docker run -d -p 8000:80 --name my-test-iis --isolation=process mcr.microsoft.com/windows/servercore/iis:windowsservercore-ltsc2025
docker stop my-test-iis

This is the collection of errors I am seeing in Event Viewer:

failed to shutdown container, and subsequent terminate also failed [container=1e4c6f9513a2d75887edafbf3299a1a9a1f126c9a881ca718de8a7c73b3150e1 module=libcontainerd namespace=moby error=container 1e4c6f9513a2d75887edafbf3299a1a9a1f126c9a881ca718de8a7c73b3150e1 encountered an error during hcsshim::ComputeSystem::Wait: hcsshim: timeout waiting for notification]

1e4c6f9513a2d75887edafbf3299a1a9a1f126c9a881ca718de8a7c73b3150e1 cleanup: failed to delete container from containerd: failed to shutdown container: container 1e4c6f9513a2d75887edafbf3299a1a9a1f126c9a881ca718de8a7c73b3150e1 encountered an error during hcsshim::ComputeSystem::Wait: hcsshim: timeout waiting for notification: subsequent terminate failed container 1e4c6f9513a2d75887edafbf3299a1a9a1f126c9a881ca718de8a7c73b3150e1 encountered an error during hcsshim::ComputeSystem::Wait: hcsshim: timeout waiting for notification

error unmounting container [error=hcsshim::UnprepareLayer failed in Win32: Do not detach the filter from the volume at this time. (0x801f0010) container=1e4c6f9513a2d75887edafbf3299a1a9a1f126c9a881ca718de8a7c73b3150e1]

Additionally, I tried the same test scenario with ltsc2022 and it's working fine.

[johnstep]

@gabrielalb, thanks for the instructions. With the latest Windows 11, IIS image, and Docker, the container exits within a few seconds here. This is after making a request to the web server to confirm success. How long was the container running before being stopped? Is there any antimalware software installed or any other that might include filter drivers?

PS C:\> cmd /c ver
Microsoft Windows [Version 10.0.26100.2605]

PS C:\> docker history mcr.microsoft.com/windows/servercore/iis:windowsservercore-ltsc2025
IMAGE          CREATED       CREATED BY                                      SIZE      COMMENT
87bd0d28d376   8 hours ago   cmd /S /C #(nop)  ENTRYPOINT ["C:\\ServiceMo…   41kB
<missing>      8 hours ago   cmd /S /C #(nop)  EXPOSE 80                     41kB
<missing>      8 hours ago   cmd /S /C powershell -Command     Add-Window…   137MB
<missing>      2 days ago    Apply image 10.0.26100.2605                     5.14GB

PS C:\> docker version
Client:
 Version:           27.4.0
 API version:       1.47
 Go version:        go1.22.10
 Git commit:        bde2b89
 Built:             Sat Dec  7 10:40:21 2024
 OS/Arch:           windows/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          27.4.0
  API version:      1.47 (minimum version 1.24)
  Go version:       go1.22.10
  Git commit:       92a8393
  Built:            Sat Dec  7 10:39:14 2024
  OS/Arch:          windows/amd64
  Experimental:     false

PS C:\> docker run -d -p 8000:80 --name my-test-iis --isolation=process mcr.microsoft.com/windows/servercore/iis:windowsservercore-ltsc2025
f1fe388d8fa10f02f1d5ee2972c92744965b2a397d1675038a1bbf413115cc66

PS C:\> (iwr http://localhost:8000).StatusCode
200

PS C:\> (Measure-Command { docker stop my-test-iis | Out-Host }).TotalSeconds
my-test-iis
3.7241262

[gabrielalb]

@johnstep Thank you for taking the time to look into this. After testing multiple times I can confirm that I cannot reproduce the issue anymore. Seems to have been solved by upgrading to Docker Desktop 4.37.0 (which has the same build numbers for the client and engine as you posted).

Closing the issue.