Powershell: Enter-PSSession does not work from Container to Container

[tfenster]

Intention

I want to connect from one Windows container to another Windows container using Enter-PSSession -ContainerId ... like I can when connecting from the host to a container

Steps to reproduce

On a Windows Server 2019 (1809) machine with Docker installed (19.03.5), create two containers: The first will just be used to later try to connect to and is started like this:

docker run --name one -ti mcr.microsoft.com/powershell:lts-windowsservercore-1809

The second will be used to connect from, which is why the Docker engine is mounted, the Docker application binaries are mounted and because we need to copy a DLL, also c:\windows\system32 is mounted

docker run --name two -v c:\windows\system32:c:\temp -v "c:\program files\docker:c:\docker" -v \\.\pipe\docker_engine:\\.\pipe\docker_engine -ti mcr.microsoft.com/powershell:lts-windowsservercore-1809

When the pwsh session has started, make sure that both containers are actually up and running by using the following command. This and all following commands are run in the second container

PS C:\> C:\docker\docker.exe ps
CONTAINER ID        IMAGE                                                     COMMAND             CREATED             STATUS              PORTS               NAMES
420066d683d1        mcr.microsoft.com/powershell:lts-windowsservercore-1809   "pwsh.exe"          29 seconds ago      Up 27 seconds                           one
82c6cd3c4409        mcr.microsoft.com/powershell:lts-windowsservercore-1809   "pwsh.exe"          53 seconds ago      Up 52 seconds                           two

To get the full id needed for Enter-PSSession, use the following command

PS C:\> C:\docker\docker.exe ps --no-trunc -qf "name=two"
82c6cd3c440974030d4d1d4e452a9f76c6d27e2ad923677d0f128de923d18166

Use that id to try to connect from container one to container two, which results in a dll not found error

PS C:\> Enter-PSSession -ContainerId 82c6cd3c440974030d4d1d4e452a9f76c6d27e2ad923677d0f128de923d18166 -RunAsAdministrator
Enter-PSSession: Unable to load DLL 'vmcompute.dll' or one of its dependencies: The specified module could not be found. (0x8007007E)

To try and fix this, copy the dll from the host to the container

cp C:\temp\vmcompute.dll C:\windows\System32\

After that, I can successfully run the command, but something still not working as the command claims that the container doesn't run although I have just verified that it indeed runs

PS C:\> Enter-PSSession -ContainerId 82c6cd3c440974030d4d1d4e452a9f76c6d27e2ad923677d0f128de923d18166 -RunAsAdministrator
Enter-PSSession: The input ContainerId 82c6cd3c440974030d4d1d4e452a9f76c6d27e2ad923677d0f128de923d18166 does not exist, or the corresponding container is not running.

If I try the same on the host instead of inside of the container, it works

PS C:\> Enter-PSSession -ContainerId 82c6cd3c440974030d4d1d4e452a9f76c6d27e2ad923677d0f128de923d18166 -RunAsAdministrator
[82c6cd3c4409...]: PS C:\Users\ContainerAdministrator\Documents>

Expected behavior

Same as on the host, I expect the PowerShell session to be established

Actual behavior

The session is not established and the error message claims that the container doesn't exist or is not running

Environment data

PS C:\> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.0.0
PSEdition                      Core
GitCommitId                    7.0.0
OS                             Microsoft Windows 10.0.17763
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

[fMichaleczek]

I don't think it's possible by design.

When you use "Enter-PSSession -ContainerId", you use "Host Compute Service" (via vmcompute.dll) which is only available on the host :

You should use WinRM/SSHd, it's the only supported way to do it.

PS : there is also a possibility that what you want to do is not secure too.

[PaulHigin]

This is correct. PowerShellDirect connections work only from host to container, not container to container. As mentioned above, you need to use WinRM or SSH remoting.

[tfenster]

@fMichaleczek @PaulHigin thanks a lot for your quick and clear answer, very much appreciated. Should Container-to-Container WinRM work? So basically Enter-PSSession -ComputerName <containername>?

[fMichaleczek]

@tfenster "Windows Server Core" image has Windows PowerShell 5.1 and by default PowerShell Remoting is enable (over WinRM). The only requirement is a configured network. If you want PowerShell 7.0, you will have to install it and enable PSRemoting.

[tfenster]

@fMichaleczek once again, thanks a lot, I got that to work! I had to create a new local user on the "target" container and use basic auth with those credentials from the "source" container to connect which is a bit of a nuisance, but I guess there is no other way or do you see anything?

[fMichaleczek]

@tfenster If you upgrade to PowerShell 7.0 and install SSHd, you should able to implement a PSRemoting over SSH with a SSH public key authentication.

[tfenster]

@fMichaleczek Interesting idea, will look into that. Once more, thanks a lot for the quick and very helpful answers!