4.7.0 fails to start after upgrade from 4.6.1 - Windows Container mode

[CJCombrink]

• I have tried with the latest version of Docker Desktop
• I have tried disabling enabled experimental features
  - experimental features were never enabled
• I have uploaded Diagnostics
• Diagnostics ID: 9AB086F4-9AD3-4702-9D85-3B33BE648346/20220408090558

Actual behavior

Docker Desktop fails to start after upgrade from 4.6.1 to 4.7.0.
It looks like it upgraded without issue.
Starting throws an Error: "System.Exception: Paths contain symlinks"

Expected behavior

Docker starts without issue

Information

• Windows Version: Windows 10 Pro 20H2
• Docker Desktop Version: 4.7.0
• WSL2 or Hyper-V backend? Windows Containers
• Are you running inside a virtualized Windows e.g. on a cloud server or a VM: No - Physical Machine

Output of & "C:\Program Files\Docker\Docker\resources\com.docker.diagnose.exe" check

Will attach

Steps to reproduce the behavior

Estimated (did not try to reproduce):

1. Install Docker Desktop 4.6.1
2. Change to Windows Containers
3. Open TCP port
4. Upgrade to 4.7.0

[CJCombrink]

With the error shown I could "Switch to Linux Containers..." from the taskbar icon.
This enabled Docker Desktop to start again.

Switching back to "Windows Containers" throws the same exception again.

[CJCombrink]

The exception is:

System.Exception:
Paths contain symlinks
   at Docker.Core.PermissionUtils.CheckPath(String path, Boolean allowDockerAppData) in C:\workspaces\PR-17669\src\github.com\docker\pinata\win\src\Docker.Core\PermissionUtils.cs:line 250
   at Docker.Core.PermissionUtils.ApplyACLOnChildren(ILogger logger, String path, Int32 recurse) in C:\workspaces\PR-17669\src\github.com\docker\pinata\win\src\Docker.Core\PermissionUtils.cs:line 46
   at Docker.Core.PermissionUtils.ApplyACLOnChildren(ILogger logger, String path, Int32 recurse) in C:\workspaces\PR-17669\src\github.com\docker\pinata\win\src\Docker.Core\PermissionUtils.cs:line 70
   at Docker.Core.PermissionUtils.ApplyACLOnChildren(ILogger logger, String path, Int32 recurse) in C:\workspaces\PR-17669\src\github.com\docker\pinata\win\src\Docker.Core\PermissionUtils.cs:line 70
   at Docker.Core.PermissionUtils.ApplyACLOnChildren(ILogger logger, String path, Int32 recurse) in C:\workspaces\PR-17669\src\github.com\docker\pinata\win\src\Docker.Core\PermissionUtils.cs:line 70
   at Docker.Core.PermissionUtils.ApplyACLOnChildren(ILogger logger, String path, Int32 recurse) in C:\workspaces\PR-17669\src\github.com\docker\pinata\win\src\Docker.Core\PermissionUtils.cs:line 70
   at Docker.Backend.HttpAPI.WindowsContainersController.FixPermissions(String path) in C:\workspaces\PR-17669\src\github.com\docker\pinata\win\src\Docker.Backend\HttpAPI\WindowsContainersController.cs:line 72
   at Docker.Backend.HttpAPI.WindowsContainersController.Start(WindowsContainerStartRequest request) in C:\workspaces\PR-17669\src\github.com\docker\pinata\win\src\Docker.Backend\HttpAPI\WindowsContainersController.cs:line 35
   at System.Web.Http.Controllers.ReflectedHttpActionDescriptor.ActionExecutor.<>c__DisplayClass6_1.<GetExecutor>b__0(Object instance, Object[] methodParameters)
   at System.Web.Http.Controllers.ReflectedHttpActionDescriptor.ExecuteAsync(HttpControllerContext controllerContext, IDictionary`2 arguments, CancellationToken cancellationToken)
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Web.Http.Controllers.ApiControllerActionInvoker.<InvokeActionAsyncCore>d__1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Web.Http.Controllers.ActionFilterResult.<ExecuteAsync>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Web.Http.Dispatcher.HttpControllerDispatcher.<SendAsync>d__15.MoveNext()

[ebriney]

@CJCombrink Can you run this command in an admin cmd.exe please:
dir /AL /S C:\ProgramData\Docker

[CJCombrink]

@ebriney
Running the given command looks like it goes into an infinite loop, printing many many files and does not seem to stop

A quick snapshot during execution gives this:

 Directory of C:\ProgramData\Docker\windowsfilter\025959927e5eba113a9c47a58491a2b8a342f6e99300c7272d09ee94547461dc\Files\Users\All Users\Docker\windowsfilter\03ed636c65d64e5b71d80649aa8ba26fcc646762c8f39f7b83b5d9c2060b6a84\Files\Users

03/03/2022  10:32 AM    <DIR>          Administrator
12/07/2019  11:00 AM    <SYMLINKD>     All Users [C:\ProgramData]
03/03/2022  10:32 AM    <DIR>          ContainerUser
03/03/2022  10:32 AM    <DIR>          Default
12/07/2019  11:00 AM    <JUNCTION>     Default User [C:\Users\Default]
12/07/2019  10:49 AM             (174) desktop.ini
               1 File(s)            174 bytes

 Directory of C:\ProgramData\Docker\windowsfilter\025959927e5eba113a9c47a58491a2b8a342f6e99300c7272d09ee94547461dc\Files\Users\All Users\Docker\windowsfilter\03ed636c65d64e5b71d80649aa8ba26fcc646762c8f39f7b83b5d9c2060b6a84\Files\Users\All Users

03/19/2022  12:24 AM    <JUNCTION>     Application Data [C:\ProgramData]
03/19/2022  12:24 AM    <JUNCTION>     Desktop [C:\Users\Public\Desktop]
03/19/2022  12:24 AM    <JUNCTION>     Documents [C:\Users\Public\Documents]
03/19/2022  12:24 AM    <JUNCTION>     Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
03/19/2022  12:24 AM    <JUNCTION>     Templates [C:\ProgramData\Microsoft\Windows\Templates]
               0 File(s)              0 bytes

[ebriney]

Ok, thanks, it will be enough to do a fix, not sure why I didn't see it with my tests on windows containers.
What image do you use?
I'll send you ASAP a build with a fix (hopefully today).
Are you stuck?
If you can lose your layers just uninstall this version and reinstall previous version: https://desktop.docker.com/win/main/amd64/76265/Docker%20Desktop%20Installer.exe

[CJCombrink]

@ebriney
I base my images off mcr.microsoft.com/dotnet/framework/sdk:latest
No I am not stuck - Uninstalled Docker Desktop and re-installed 4.7.0 and it seems to be working now.
(I think I already lost all layers when I did the factory reset)

[fidokuba]

I seem to be in the same boat- updated to 4.7.0, first time it loaded up fine, managed to create a container.
However after restarting my pc later in the day and going to start Docker for Windows, the exact same exception was being thrown preventing it from running.

Have resorted to uninstalling and reverting back to 4.6.1 which seems to start up fine again.

[ebriney]

@CJCombrink @fidokuba I have a build with a patch that seems to work, can you test it and give me yourfeedback:
https://desktop-stage.docker.com/win/main/amd64/77294/Docker%20Desktop%20Installer.exe

Thanks, have a good week-end.

[MichaelKilden]

Same problem on startup: Docker.Core.PermissionUtils.ApplyACLOnChildren...
Patch solved my problem. Existing windows containers are running again.

[taurisjoe]

Thank you @ebriney for this quick fix. Your patch worked for me.

[CJCombrink]

@ebriney
Sorry for only being able to test now.

I updated another 4.6.1 install with the new patch provided and the upgrade went through without any issues.
Docker upgraded tot 4.7.0 (Build 77294) and started without issues

[mat007]

Thank you for confirming the fix everyone, we will release a Docker Desktop 4.7.1 with it.

[CJCombrink]

I am closing this issue since it seems like there is a fix and I have a working install again.
Unfortunately I won't be able to test the exact same setup (upgrading 4.6.1) with a 4.7.1 since all my installs are upgrade to 4.7.0 already