How to use Logmon when running as ContainerUser about windows-container-tools

[oobug]

The non-privileged user can be given access to ETW logs by adding the user to the "Performance Log Users" group. To deal with the Failed to stop or query status of service 'w3svc' error, set permissions on the w3svc service.

FROM mcr.microsoft.com/dotnet/framework/aspnet:4.8-windowsservercore-ltsc2022
SHELL [ "powershell", "-NoProfile", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue'; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]'Tls12'; " ]

# Add ContainerUser to Performance Log Users group to allow LogMonitor to access ETW logs
RUN Add-LocalGroupMember -Group 'Performance Log Users' -Member 'User Manager\ContainerUser'`

# Allow ContainerUser to start/stop/restart/read status of the IIS Windows Service
# (S-1-5-93-2-2 is user "User Manager\ContainerUser" in this container image)
RUN cmd.exe /C "sc.exe sdset w3svc 'D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)    (A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPDTLO;;;S-1-5-93-2-2)'"

Some of this information was originally sourced from the following links:

• https://stackoverflow.com/a/67502244/144713
• https://blogs.msmvps.com/erikr/2007/09/26/set-permissions-on-a-specific-service-windows/

[rigdal]

Sample of the Dockerfile used when receiving this.

FROM mcr.microsoft.com/dotnet/framework/sdk:4.8 AS build
WORKDIR /app

# copy csproj and restore as distinct layers
COPY *.sln .

#copy over our custom DLLs
COPY dlls/* ./dlls/

# copy csproj and restore as distinct layers
COPY OES_WebApp/*.csproj ./OES_WebApp/
COPY OES_WebApp/*.config ./OES_WebApp/
RUN nuget restore

# copy everything else and build app
COPY OES_WebApp/. ./OES_WebApp/
#RUN msbuild /p:Configuration=Release,RestorePackagesConfig=true -r:False -t:restore,build
RUN msbuild -t:build -p:RestorePackagesConfig=true

# Use a smaller image as base for runtime 
FROM mcr.microsoft.com/dotnet/framework/aspnet:4.8 AS runtime

# Set the shell to PowerShell
SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; Set-ExecutionPolicy Unrestricted -Force;"]

# Disable IIS auto start
RUN ["cmd", "/S", "/C", "sc", "config", "w3svc", "start=demand"]

# Update IIS config
# c:/windows/system32/inetsrv/appcmd.exe set config -section:system.applicationHost/sites /[name='Default Web Site'].logFile.logTargetW3C:File,ETW /commit:apphost ; 
# c:/windows/system32/inetsrv/appcmd.exe set config -section:system.applicationHost/sites /\"[name='Default Web Site'].logFile.logTargetW3C:\"File,ETW\"\" /commit:apphost ;
RUN \
    # Enable ETW logging for Default Web Site on IIS    
    c:/windows/system32/inetsrv/appcmd.exe set config -section:system.applicationHost/sites /\"[name='Default Web Site'].logFile.logTargetW3C:\"File,ETW\"\" /commit:apphost ;

# swap to unprivilaged - unable to use with Logmon? Errors when using ContainerUser
# USER ContainerUser

# Add Logmon to the image to export various sources to STDOUT - see LogMonConfig for details
COPY logmon/LogMonitor.exe logmon/LogMonitorConfig.json c:/LogMonitor/

# Pull in our built application from the 'build' base
WORKDIR /inetpub/wwwroot
COPY --from=build /app/OES_WebApp/. ./ 

# Start IIS Remote Management and monitor IIS
ENTRYPOINT ["C:\\LogMonitor\\LogMonitor.exe", "C:\\ServiceMonitor.exe", "w3svc"]

# TODO - need to start IIS after config and wrapping with logmon

EXPOSE 80

[bevinsunth]

We are having the same issue on AKS. The image is failing to start at the entry point with the below error.

INFO: Entrypoint processs exit code: 0
[LOGMONITOR] ERROR: Failed to wait for log file monitor to stop

Etrypoint we have in docker file:
ENTRYPOINT ["C:\\LogMonitor\\LogMonitor.exe", "dotnet.exe", "Application.dll"]

Below are the AKS details
v1.27.1 Windows Server 2019 Datacenter 10.0.17763.4974 containerd://1.6.21+azure

Any update on this issue?