Can i install a driver in Windows Server Core docker container?

Question

We have an app that requires a driver. As an experiment and for testing purposes, we thought to deploy it using a docker image based on mcr.microsoft.com/windows/servercore:1903-amd64. The host operating system is Windows 10 1903 which is a dev laptop. The driver is a minifilter file system driver and it seems to be installed OK, but the startup fails. The application itself is a 32-bit portable executable that runs on an x64/x86.

Is it possible to install and run a minifilter file system driver in a Windows Server docker image?

The output from sc command running on the docker instance is as follows:

C:\>sc start foo
SERVICE_NAME: foo
        TYPE               : 2  FILE_SYSTEM_DRIVER
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1077  (0x435)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 0
        FLAGS              :
C:\>sc query foo
SERVICE_NAME: foo
        TYPE               : 2  FILE_SYSTEM_DRIVER
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1077  (0x435)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

C:\>fltmc
The FltMgr.sys driver is not currently loaded.

Answer 1

Currently there is no way to install drivers in Windows containers.

However containers on Windows can utilize drivers that are present on host OS.

Blog post from Unit42 on reverse engineering Windows containers, describes some internal workings of Windows containers. It states that the filtering occurs on system call level:

There are plenty of dangerous system calls and more than one kernel function to determine if the calling process or thread is inside a silo. For the specific case of loading drivers inside containers, I have found out that Windows does have a sufficient check in the kernel, which is relevant for many other system calls as well. In this case, IopLoadDriverImage which is the function NtLoadDriver calls to actually load a kernel driver image, simply returns a value indicating whether the calling process is inside a silo.

You can find the whole blog post here for more details:What I Learned from Reverse Engineering Windows Containers