Dotnet-docker: Unable to start docker container using the given sample

[shashijeevan]

Steps to reproduce the issue

1. I am using Docker Desktop on Windows 10.
2. Enabled Windows containers option
3. Tried to run sample asp.net core app using the instructions given in the following link (Windows using Windows containers section)
   https://github.com/dotnet/dotnet-docker/blob/master/samples/aspnetapp/aspnetcore-docker-https.md
4. I was able to create the dev-certs and trust it.
5. Pulled the image successfully
6. When do docker run using the given command I am getting Cryptographic exception.

Following is the command
docker run --rm -it -p 8000:80 -p 8001:443 -e ASPNETCORE_URLS="https://+;http://+" -e ASPNETCORE_HTTPS_PORT=8001 -e ASPNETCORE_Kestrel__Certificates__Default__Password="crypticpassword" -e ASPNETCORE_Kestrel__Certificates__Default__Path=\https\aspnetapp.pfx -v %USERPROFILE%.aspnet\https:C:\https\ microsoft/dotnet-samples:aspnetapp

Expected behavior

I expected the docker container to start and be able to browse the site using http and https urls.

Actual behavior

The docker run command failed to launch the container. It generated the following exception

crit: Microsoft.AspNetCore.Server.Kestrel[0]
Unable to start Kestrel.
Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException: An internal error occurred
at Internal.Cryptography.Pal.CertificatePal.FilterPFXStore(Byte[] rawData, SafePasswordHandle password, PfxCertStoreFlags pfxCertStoreFlags)
at Internal.Cryptography.Pal.CertificatePal.FromBlobOrFile(Byte[] rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
at System.Security.Cryptography.X509Certificates.X509Certificate..ctor(String fileName, String password, X509KeyStorageFlags keyStorageFlags)
at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(String fileName, String password)
at Microsoft.AspNetCore.Server.Kestrel.KestrelConfigurationLoader.LoadCertificate(CertificateConfig certInfo, String endpointName)
at Microsoft.AspNetCore.Server.Kestrel.KestrelConfigurationLoader.LoadDefaultCert(ConfigurationReader configReader)
at Microsoft.AspNetCore.Server.Kestrel.KestrelConfigurationLoader.Load()
at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer.ValidateOptions()
at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer.StartAsyncTContext

Unhandled Exception: Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException: An internal error occurred
at Internal.Cryptography.Pal.CertificatePal.FilterPFXStore(Byte[] rawData, SafePasswordHandle password, PfxCertStoreFlags pfxCertStoreFlags)
at Internal.Cryptography.Pal.CertificatePal.FromBlobOrFile(Byte[] rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
at System.Security.Cryptography.X509Certificates.X509Certificate..ctor(String fileName, String password, X509KeyStorageFlags keyStorageFlags)
at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(String fileName, String password)
at Microsoft.AspNetCore.Server.Kestrel.KestrelConfigurationLoader.LoadCertificate(CertificateConfig certInfo, String endpointName)
at Microsoft.AspNetCore.Server.Kestrel.KestrelConfigurationLoader.LoadDefaultCert(ConfigurationReader configReader)
at Microsoft.AspNetCore.Server.Kestrel.KestrelConfigurationLoader.Load()
at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer.ValidateOptions()
at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer.StartAsyncTContext
at Microsoft.AspNetCore.Hosting.Internal.WebHost.StartAsync(CancellationToken cancellationToken)
at Microsoft.AspNetCore.Hosting.WebHostExtensions.RunAsync(IWebHost host, CancellationToken token, String shutdownMessage)
at Microsoft.AspNetCore.Hosting.WebHostExtensions.RunAsync(IWebHost host, CancellationToken token)
at Microsoft.AspNetCore.Hosting.WebHostExtensions.Run(IWebHost host)
at aspnetapp.Program.Main(String[] args) in C:\app\aspnetapp\Program.cs:line 18

Additional information (e.g. issue happens only occasionally)

This issue happens every time I run this command.

Output of docker version

Client: Docker Engine - Community
 Version:           18.09.1
 API version:       1.39
 Go version:        go1.10.6
 Git commit:        4c52b90
 Built:             Wed Jan  9 19:34:26 2019
 OS/Arch:           windows/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          18.09.1
  API version:      1.39 (minimum version 1.24)
  Go version:       go1.10.6
  Git commit:       4c52b90
  Built:            Wed Jan  9 19:50:10 2019
  OS/Arch:          windows/amd64
  Experimental:     false

Output of docker info

Containers: 12
 Running: 2
 Paused: 0
 Stopped: 10
Images: 33
Server Version: 18.09.1
Storage Driver: windowsfilter
 Windows:
Logging Driver: json-file
Plugins:
 Volume: local
 Network: ics l2bridge l2tunnel nat null overlay transparent
 Log: awslogs etwlogs fluentd gelf json-file local logentries splunk syslog
Swarm: inactive
Default Isolation: hyperv
Kernel Version: 10.0 17134 (17134.1.amd64fre.rs4_release.180410-1804)
Operating System: Windows 10 Pro Version 1803 (OS Build 17134.523)
OSType: windows
Architecture: x86_64
CPUs: 4
Total Memory: 7.91GiB
Name: TEKFRIDAY188
ID: QGHB:KNRR:HOIE:ACYQ:SGHG:PT2E:UNX6:HOAH:4UW6:NX26:ZYEE:U56M
Docker Root Dir: C:\ProgramData\Docker
Debug Mode (client): false
Debug Mode (server): true
 File Descriptors: -1
 Goroutines: 24
 System Time: 2019-02-01T19:57:48.700843+05:30
 EventsListeners: 1
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false
Product License: Community Engine

[MichaelSimons]

@shashijeevan - I wanted to check if you verified some of the following basic sources of issues:

1. Did you verify that your cert is in the image at the expected path?
2. Did you verify that the correct password is specified?

[shashijeevan]

@MichaelSimons -

I just followed the exact steps given in the document.

How to verify that cert in the image?

[MichaelSimons]

To verify the cert in the image run you image and override the entrypoint and then interactively use the cmd prompt to inspect the cert exists and is what you expect.

docker run -it --rm -v %USERPROFILE%.aspnet\https:C:\https\ --entrypoint cmd microsoft/dotnet-samples:aspnetapp

[MichaelSimons]

@shashijeevan - Were you able to verify the cert exists in the image?

[dozer75]

@shashijeevan - Take a look at @MichaelSimons answer in #1048 it may be the same issue for you? Try running with --user ContainerAdministrator

[mthalman]

@shashijeevan - Have you tried adding --user ContainerAdministrator to your docker run command to see whether that resolves the issue? That would be a good data point to know whether this is related to #1048.

[MichaelSimons]

Closing due to inactivity. If --user ContainerAdministrator does not help feel free to reopen or log a new issue.

[davidmosborne]

I had the same issue. --user ContainerAdministrator with docker run worked for me.

[p1p3]

If you are using the default dockerfile from visual studio this is the line you have to add
....
FROM microsoft/dotnet:2.2-aspnetcore-runtime-nanoserver-1803 AS base
USER ContainerAdministrator
WORKDIR /app
EXPOSE 80
EXPOSE 443

[shashijeevan]

Sorry for the late reply. I just verified and it works without the ContainerAdministrator option as well. Do not know what has changed.

[dingbell]

neither of them works. I tried adding it to dockerfile and after docker run.

[robertmuehsig]

Just had the same problem using 'mcr.microsoft.com/dotnet/core/aspnet:3.1-nanoserver-1809' and the "ContainerAdministrator" switched worked for me. Without I got "Object not found".