[yosifkit]

Closes #561

[yosifkit]

Chasing the rabbit hole of the error:

testing golang:1.25rc1-nanoserver-ltsc2022
	'override-cmd' [1/2]...passed
go: open C:\Windows\TEMP: Access is denied.
	'golang-hello-world' [2/2]...failed

It seems that the new version of go tries to access the $TMP directory, which should be readable and writable by the running user.

nanoserver images have these values in their environment variables

TEMP=C:\Windows\TEMP
TMP=C:\Windows\TEMP
USERNAME=ContainerUser

😭 Every mcr.microsoft.com/windows/nanoserver image, from the first 1809 (aka ltsc2019) through ltsc2025 has TMP and TEMP set to the system temporary directory, but the default user (ContainerUser) doesn't have permission read its contents (or write to it).

Earlier nanoserver images (like 1803) have the correct setting based on the user (e.g C:\Users\ContainerUser\AppData\Local\Temp for the default user) and it auto adjusts if you run as ContainerAdministrator which is how the windows/servercore images work.

Adding -e TMP=C:\Users\ContainerUser\AppData\Local\Temp -w C:\Users\ContainerUser\AppData\Local\Temp is enough to get go working again (i.e., set the temp env var and make sure the directory exists).

So, we have a few options that I see:

• disable the nanoserver builds on 1.25-rc
• set TMP and TEMP via ENV in the Dockerfile (or maybe setx like PATH?)
  • what value works for any user?
• set USER ContainerAdministrator
  • 👎less secure
• give ContainerUser read/write permissions to C:\Windows\temp
  • this also seems less secure
• convince windows to fix the nanoserver images to auto set TMP and TEMP like they did in 1803

---

related:

• preview-nanoserver-1809 temp folder does not have list permissions PowerShell/PowerShell-Docker#188
• Docker sample does not work on Windows microsoft/artifacts-credprovider#448

[yosifkit]

For now, I've added a commit to disable nanoserver images for 1.25rc1 (which means we'll have to figure something out by rc2).

[lizthegrey]

Chasing the rabbit hole of the error:

• set TMP and TEMP via ENV in the Dockerfile (or maybe setx like PATH?)

This seems like the best solution.

[tianon]

I think the most correct fix would come from Microsoft, but I know better than to hold my breath for that. 😭

Do we know why it's broken now and works fine on 1.24? What's changed in 1.25 that causes the failure? 🤔

(Maybe we should also revisit Windows-based tip images so we can catch things like this sooner 😅 🙈 😭)

(moved to #563)