Unable to run mcr.microsoft.com/windows/servercore:ltsc2025 container on windows-2025 runner

[yosifkit]

Description

The newest Windows docker image for ltsc2025 (mcr.microsoft.com/windows/servercore:ltsc2025) is too new to run on the windows-2025 runner image and so fails with the following error:

docker: Error response from daemon: container [sha] encountered an error during hcs::System::Start: failure in a Windows system call: The virtual machine or container exited unexpectedly. (0xc0370106).

As far as I can find, this is because the host (runner image) has an older OS version than the container image and so can't run it. The host kernel version must be equal to or newer than the Docker image. The runner full version is 10.0.26100.2894 while the recently updated ltsc2025 container is 10.0.26100.3194. The container image was updated in the last few days because we have successful builds from ~5 days ago that are failing today.

On a related note (since it is relevant for Windows containers), it would be helpful if the "Set up job" step printed the "full" version (including the "Update Build Revision") and not just 10.0.26100 in the "Operation System" details.

Platforms affected

• Azure DevOps
• GitHub Actions - Standard Runners
• GitHub Actions - Larger Runners

Runner images affected

• Ubuntu 20.04
• Ubuntu 22.04
• Ubuntu 24.04
• macOS 13
• macOS 13 Arm64
• macOS 14
• macOS 14 Arm64
• macOS 15
• macOS 15 Arm64
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025

Image version and build link

• https://github.com/yosifkit/fuzzy-octo-engine/actions/runs/13274607521/job/37061601289 (docker run)
• https://github.com/docker-library/golang/actions/runs/13271060856/job/37054617305?pr=549 (docker build)
• https://github.com/docker-library/pypy/actions/runs/13271365103/job/37051333899 (docker build)
• https://github.com/docker-library/pypy/actions/runs/13190291735/job/36821815786 (successful version of the previous link)

Is it regression?

no

Expected behavior

The mcr.microsoft.com/windows/servercore:ltsc2025 should run (e.g., via docker build or docker run).

Successful docker image (from a build ~5 days ago):

• mcr.microsoft.com/windows/servercore:ltsc2025@sha256:f6153b44882e7ada8fa17123cfca1da3f29ea7fbe062c9e931240dc837aa4256
• created date from image config: 2025-01-13T03:08:16.9200244Z
• "os.version": "10.0.26100.2894"

$ $Version = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
$ echo "Version $($Version.ReleaseId) (OS Build $ $($Version.CurrentMajorVersionNumber).$($Version.CurrentMinorVersionNumber).$($Version.CurrentBuildNumber).$($Version.UBR))"
Version 2009 (OS Build 10.0.26100.2894)
$ docker run -i --rm mcr.microsoft.com/windows/servercore:ltsc2025@sha256:f6153b44882e7ada8fa17123cfca1da3f29ea7fbe062c9e931240dc837aa4256 powershell -command '$Version = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"; echo "Version $($Version.ReleaseId) (OS Build $($Version.CurrentMajorVersionNumber).$($Version.CurrentMinorVersionNumber).$($Version.CurrentBuildNumber).$($Version.UBR))"'
Version 2009 (OS Build 10.0.26100.2894)

Actual behavior

Failing docker image:

• mcr.microsoft.com/windows/servercore:ltsc2025 (sha256:44b2884c5db9f03d57b7494371706cf95d4345c75399c420e63b5f5609313ee6)
• created date from image config: 2025-02-08T22:54:28.3301623Z
• "os.version": "10.0.26100.3194"

$ $Version = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
$ echo "Version $($Version.ReleaseId) (OS Build $ $($Version.CurrentMajorVersionNumber).$($Version.CurrentMinorVersionNumber).$($Version.CurrentBuildNumber).$($Version.UBR))"
Version 2009 (OS Build 10.0.26100.2894)
$ docker run -i --rm mcr.microsoft.com/windows/servercore:ltsc2025 powershell -command '$Version = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"; echo "Version $($Version.ReleaseId) (OS Build $($Version.CurrentMajorVersionNumber).$($Version.CurrentMinorVersionNumber).$($Version.CurrentBuildNumber).$($Version.UBR))"'
docker: Error response from daemon: container c5ace0ad02bb10d19a82b1543d1c0e11086f2b3c6da9715bca407ff450cf535d encountered an error during hcs::System::Start: failure in a Windows system call: The virtual machine or container exited unexpectedly. (0xc0370106).
Error: Process completed with exit code 1.

Repro steps

runs-on: windows-2025
steps:
  - run: |
      docker run -i --rm mcr.microsoft.com/windows/servercore:ltsc2025 cmd /c ver

[vidyasagarnimmagaddi]

Hi @yosifkit , Thank you for bringing this issue to our attention. We will look into this issue and will update you after investigating.

[tianon]

This is a critical problem that makes the Windows Server 2025-based images mostly unusable for containers (without jumping through hoops to use an older base image that doesn't include this week's likely security-related updates), so please make sure to keep that priority in your mind as you review/investigate ❤️

[subir0071]

The image should get updated to the latest version.
Could you please synch and let us know if it is working?

[tianon]

Definitely still broken 🙈

https://github.com/docker-library/golang/actions/runs/13337261786/job/37256949775

[tianon]

Actually, https://github.com/yosifkit/fuzzy-octo-engine/actions/runs/13337543892/job/37255952236#step:2:21 is a better link, because it shows that the runner image isn't actually updated from the 10.0.26100.2894 that @yosifkit reported/tested above 🙈

[tianon]

(it would be really helpful, as a sidenote, if "Operating System" in that "Set up job" block could be updated to show the specific patch level of the OS 😅)

Edit: to be clear, this is resurfacing/highlighting this note from the OP: ❤️

On a related note (since it is relevant for Windows containers), it would be helpful if the "Set up job" step printed the "full" version (including the "Update Build Revision") and not just 10.0.26100 in the "Operation System" details.

[subir0071]

As a workaround the older image version can be pinned.
Once the runner image upgrades, then can continue to use the latest version.

[tianon]

https://support.microsoft.com/en-us/topic/february-11-2025-kb5051987-os-build-26100-3194-63fb007d-3f52-4b47-85ea-28414a24be2d

(It's a security update, and the list of fixes isn't exactly short, so updating should really be a very high priority even without the container aspect reported here.)