feat: Improve Windows XP configuration (#350)

chore(deps): update qemux/qemu-docker docker tag to v4.15

.github/workflows/build.yml

@@ -92,6 +92,13 @@ jobs:
         uses: action-pack/bump@v2
         with:
           token: ${{ secrets.REPO_ACCESS_TOKEN }}
+      -
+        name: Push to Gitlab mirror
+        uses: action-pack/gitlab-sync@v3
+        with:
+          url: ${{ secrets.GITLAB_URL }}
+          token: ${{ secrets.GITLAB_TOKEN }}
+          username: ${{ secrets.GITLAB_USERNAME }}
       -
         name: Send mail
         uses: action-pack/send-mail@v1

.github/workflows/check.yml

@@ -21,5 +21,5 @@ jobs:
         uses: hadolint/hadolint-action@v3.1.0
         with:
           dockerfile: Dockerfile
-          ignore: DL3008
+          ignore: DL3008,DL4006,SC3037
           failure-threshold: warning

Dockerfile

@@ -1,29 +1,32 @@
 FROM scratch
-COPY --from=qemux/qemu-docker:4.13 / /
+COPY --from=qemux/qemu-docker:4.20 / /
 
-ARG DEBCONF_NOWARNINGS="yes"
+ARG DEBCONF_NOWARNINGS "yes"
 ARG DEBIAN_FRONTEND "noninteractive"
 ARG DEBCONF_NONINTERACTIVE_SEEN "true"
 
-RUN apt-get update \
-    && apt-get --no-install-recommends -y install \
+RUN apt-get update && \
+    apt-get --no-install-recommends -y install \
         curl \
         7zip \
         wsdd \
         samba \
-        wimtools \
         dos2unix \
         cabextract \
         genisoimage \
-        libxml2-utils \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+        libxml2-utils && \
+    echo "deb http://deb.debian.org/debian/ sid main" >> /etc/apt/sources.list.d/sid.list && \
+    echo -e "Package: *\nPin: release n=trixie\nPin-Priority: 900\nPackage: *\nPin: release n=sid\nPin-Priority: 400" | tee /etc/apt/preferences.d/preferences > /dev/null && \
+    apt-get update && \
+    apt-get -t sid --no-install-recommends -y install wimtools && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
 COPY ./src /run/
 COPY ./assets /run/assets
 
-ADD https://raw.githubusercontent.com/christgau/wsdd/master/src/wsdd.py /usr/sbin/wsdd
-ADD https://github.com/qemus/virtiso/releases/download/v0.1.240/virtio-win-0.1.240.iso /run/drivers.iso
+ADD https://raw.githubusercontent.com/christgau/wsdd/v0.8/src/wsdd.py /usr/sbin/wsdd
+ADD https://github.com/qemus/virtiso/releases/download/v0.1.248/virtio-win-0.1.248.iso /run/drivers.iso
 
 RUN chmod +x /run/*.sh && chmod +x /usr/sbin/wsdd
 

docker-compose.yml

@@ -3,6 +3,8 @@ services:
   windows:
     image: dockurr/windows
     container_name: windows
+    environment:
+      VERSION: "win11"
     devices:
       - /dev/kvm
     cap_add:

readme.md

@@ -11,7 +11,7 @@
 
 </div></h1>
 
-Windows in a docker container.
+Windows in a Docker container.
 
 ## Features
 
@@ -19,6 +19,10 @@ Windows in a docker container.
  - KVM acceleration
  - Web-based viewer
 
+## Video
+
+[![Youtube](https://img.youtube.com/vi/xhGYobuG508/0.jpg)](https://www.youtube.com/watch?v=xhGYobuG508)
+
 ## Usage
 
 Via `docker-compose.yml`
@@ -29,6 +33,8 @@ services:
   windows:
     image: dockurr/windows
     container_name: windows
+    environment:
+      VERSION: "win11"
     devices:
       - /dev/kvm
     cap_add:
@@ -44,7 +50,7 @@ services:
 Via `docker run`
 
 ```bash
-docker run -it --rm -p 8006:8006 --device=/dev/kvm --cap-add NET_ADMIN --stop-timeout 120 dockurr/windows
+docker run -it --rm --name windows -p 8006:8006 --device=/dev/kvm --cap-add NET_ADMIN --stop-timeout 120 dockurr/windows
 ```
 
 ## FAQ
@@ -94,6 +100,14 @@ docker run -it --rm -p 8006:8006 --device=/dev/kvm --cap-add NET_ADMIN --stop-ti
 
   To install ARM64 versions of Windows use [dockur/windows-arm](https://github.com/dockur/windows-arm/).
 
+* ### How do I connect using RDP?
+
+  The web-viewer is mainly meant to be used during installation, as its picture quality is low, and it has no audio or clipboard for example.
+
+  So for a better experience you can connect using any Microsoft Remote Desktop client to the IP of the container, using the username `docker` and by leaving the password empty.
+
+  There is a good RDP client for [Android](https://play.google.com/store/apps/details?id=com.microsoft.rdc.androidx) available from the Play Store and one for [iOS](https://apps.apple.com/nl/app/microsoft-remote-desktop/id714464092?l=en-GB) in the Apple Store. For Linux you can use [FreeRDP](https://www.freerdp.com/) and on Windows just type `mstsc` in the search box.
+
 * ### How do I increase the amount of CPU or RAM?
 
   By default, 2 CPU cores and 4 GB of RAM are allocated to the container, as those are the minimum requirements of Windows 11.
@@ -136,7 +150,7 @@ docker run -it --rm -p 8006:8006 --device=/dev/kvm --cap-add NET_ADMIN --stop-ti
 
 * ### How do I install a custom image?
 
-  In order to download a custom ISO image, start a clean container with the URL specified in the `VERSION` environment variable:
+  In order to download a custom ISO image, start a clean container with the URL of the ISO specified in the `VERSION` environment variable:
   
   ```yaml
   environment:
@@ -219,6 +233,8 @@ docker run -it --rm -p 8006:8006 --device=/dev/kvm --cap-add NET_ADMIN --stop-ti
   ```yaml
   environment:
     DHCP: "Y"
+  devices:
+    - /dev/vhost-net
   device_cgroup_rules:
     - 'c *:* rwm'
   ```
@@ -264,7 +280,7 @@ docker run -it --rm -p 8006:8006 --device=/dev/kvm --cap-add NET_ADMIN --stop-ti
 
 * ### Is this project legal?
 
-  Yes, this project contains only open-source code and does not distribute any copyrighted material. Neither does it try to circumvent any copyright protection measures. So under all applicable laws, this project would be considered legal.
+  Yes, this project contains only open-source code and does not distribute any copyrighted material. Any product keys found in the code are just generic placeholders provided by Microsoft for trial purposes. So under all applicable laws, this project would be considered legal.
 
 ## Stars
 [![Stars](https://starchart.cc/dockur/windows.svg?variant=adaptive)](https://starchart.cc/dockur/windows)

src/entry.sh

@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
+: "${BOOT_MODE:="windows"}"
+
 APP="Windows"
-BOOT_MODE="windows"
 SUPPORT="https://github.com/dockur/windows"
 
 cd /run
@@ -23,6 +24,10 @@ trap - ERR
 info "Booting $APP using $VERS..."
 [[ "$DEBUG" == [Yy1]* ]] && echo "Arguments: $ARGS" && echo
 
+if [[ "$CONSOLE" == [Yy]* ]]; then
+  exec qemu-system-x86_64 ${ARGS:+ $ARGS}
+fi
+
 { qemu-system-x86_64 ${ARGS:+ $ARGS} >"$QEMU_OUT" 2>"$QEMU_LOG"; rc=$?; } || :
 (( rc != 0 )) && error "$(<"$QEMU_LOG")" && exit 15
 
@@ -31,4 +36,5 @@ tail -fn +0 "$QEMU_LOG" 2>/dev/null &
 cat "$QEMU_TERM" 2> /dev/null | tee "$QEMU_PTY" &
 wait $! || :
 
-sleep 1 && finish 0
+sleep 1 & wait $!
+finish 0

src/install.sh

@@ -72,7 +72,7 @@ fi
 
 if [[ "${VERSION,,}" == "winxpx86" ]]; then
   DETECTED="winxpx86"
-  VERSION="https://dl.bobpony.com/windows/xp/professional/en_windows_xp_professional_with_service_pack_3_x86_cd_vl_x14-73974.iso"
+  VERSION="https://dl.bobpony.com/windows/xp/professional/en_windows_xp_professional_with_service_pack_3_x86_cd_x14-80428.iso"
 fi
 
 if [[ "${VERSION,,}" == "core11" ]]; then
@@ -90,15 +90,9 @@ if [[ "${VERSION,,}" == "tiny10" ]]; then
   VERSION="https://archive.org/download/tiny-10-23-h2/tiny10%20x64%2023h2.iso"
 fi
 
-CUSTOM="custom.iso"
-
-[ ! -f "$STORAGE/$CUSTOM" ] && CUSTOM="Custom.iso"
-[ ! -f "$STORAGE/$CUSTOM" ] && CUSTOM="custom.ISO"
-[ ! -f "$STORAGE/$CUSTOM" ] && CUSTOM="CUSTOM.ISO"
-[ ! -f "$STORAGE/$CUSTOM" ] && CUSTOM="custom.img"
-[ ! -f "$STORAGE/$CUSTOM" ] && CUSTOM="Custom.img"
-[ ! -f "$STORAGE/$CUSTOM" ] && CUSTOM="custom.IMG"
-[ ! -f "$STORAGE/$CUSTOM" ] && CUSTOM="CUSTOM.IMG"
+CUSTOM=$(find "$STORAGE" -maxdepth 1 -type f -iname custom.iso -printf "%f\n" | head -n 1)
+[ -z "$CUSTOM" ] && CUSTOM=$(find "$STORAGE" -maxdepth 1 -type f -iname boot.iso -printf "%f\n" | head -n 1)
+[ -z "$CUSTOM" ] && CUSTOM=$(find "$STORAGE" -maxdepth 1 -type f -iname custom.img -printf "%f\n" | head -n 1)
 
 ESD_URL=""
 MACHINE="q35"
@@ -205,31 +199,6 @@ getVersion() {
   return 0
 }
 
-replaceXML() {
-
-  local dir="$1"
-  local asset="$2"
-
-  local path="$dir/autounattend.xml"
-  [ -f "$path" ] && cp "$asset" "$path"
-  path="$dir/Autounattend.xml"
-  [ -f "$path" ] && cp "$asset" "$path"
-  path="$dir/AutoUnattend.xml"
-  [ -f "$path" ] && cp "$asset" "$path"
-  path="$dir/autounattend.XML"
-  [ -f "$path" ] && cp "$asset" "$path"
-  path="$dir/Autounattend.XML"
-  [ -f "$path" ] && cp "$asset" "$path"
-  path="$dir/AutoUnattend.XML"
-  [ -f "$path" ] && cp "$asset" "$path"
-  path="$dir/AUTOUNATTEND.xml"
-  [ -f "$path" ] && cp "$asset" "$path"
-  path="$dir/AUTOUNATTEND.XML"
-  [ -f "$path" ] && cp "$asset" "$path"
-
-  return 0
-}
-
 hasDisk() {
 
   [ -b "${DEVICE:-}" ] && return 0
@@ -313,6 +282,7 @@ startInstall() {
 
     fi
 
+    [[ "${BASE,,}" == "boot."* ]] && BASE="windows.iso"
     [[ "${BASE,,}" == "custom."* ]] && BASE="windows.iso"
 
   fi
@@ -681,12 +651,19 @@ detectImage() {
     return 0
   fi
 
-  local tag result name name2 desc
-  local loc="$dir/sources/install.wim"
-  [ ! -f "$loc" ] && loc="$dir/sources/install.esd"
+  local src loc tag result name name2 desc
+  src=$(find "$dir" -maxdepth 1 -type d -iname sources | head -n 1)
+
+  if [ ! -d "$src" ]; then
+    warn "failed to locate 'sources' folder in ISO image, $FB"
+    BOOT_MODE="windows_legacy"
+    return 1
+  fi
+
+  loc=$(find "$src" -maxdepth 1 -type f -iname install.wim | head -n 1)
+  [ ! -f "$loc" ] && loc=$(find "$src" -maxdepth 1 -type f -iname install.esd | head -n 1)
 
   if [ ! -f "$loc" ]; then
-
     warn "failed to locate 'install.wim' or 'install.esd' in ISO image, $FB"
     BOOT_MODE="windows_legacy"
     return 1
@@ -786,17 +763,11 @@ prepareXP() {
   sed -i '/^\[SCSI\]/s/$/\niaStor=\"Intel\(R\) SATA RAID\/AHCI Controller\"/' "$target/TXTSETUP.SIF"
   sed -i '/^\[HardwareIdsDatabase\]/s/$/\nPCI\\VEN_8086\&DEV_2922\&CC_0106=\"iaStor\"/' "$target/TXTSETUP.SIF"
 
-  rm -f "$target/winnt.sif"
-  rm -f "$target/Winnt.sif"
-  rm -f "$target/winnt.SIF"
-  rm -f "$target/WinNT.sif"
-  rm -f "$target/WINNT.sif"
-  rm -f "$target/WINNT.SIF"
+  # Windows XP Pro generic key (no activation)
+  local key="DR8GV-C8V6J-BYXHG-7PYJR-DB66Y"
 
-  local key="M6TF9-8XQ2M-YQK9F-7TBB2-XGG88"
-  [[ "${arch,,}" == "amd64" ]] && key="B66VY-4D94T-TPPD4-43F72-8X4FY"
+  find "$target" -maxdepth 1 -type f -iname winnt.sif -exec rm {} \;
 
-  local sif="$target/WINNT.SIF"
   {       echo "[Data]"
           echo "AutoPartition=1"
           echo "MsDosInitiated=\"0\""
@@ -840,18 +811,72 @@ prepareXP() {
           echo "[Networking]"
           echo "InstallDefaultComponents=Yes"
           echo ""
+          echo "[Branding]"
+          echo "BrandIEUsingUnattended=Yes"
+          echo ""
           echo "[URL]"
           echo "Home_Page = http://www.google.com"
-          echo "Search_Page = http://www.google.com/ie_rsearch.html"
-          echo "AutoConfig = 0"
+          echo "Search_Page = http://www.google.com"
           echo ""
           echo "[RegionalSettings]"
           echo "Language=00000409"
           echo ""
           echo "[TerminalServices]"
           echo "AllowConnections=1"
-  } > "$sif"
+  } | unix2dos > "$target/WINNT.SIF"
 
+  {       echo "Windows Registry Editor Version 5.00"
+          echo ""
+          echo "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security]"
+          echo "\"FirstRunDisabled\"=dword:00000001"
+          echo "\"AntiVirusOverride\"=dword:00000001"
+          echo "\"FirewallOverride\"=dword:00000001"
+          echo "\"FirewallDisableNotify\"=dword:00000001"
+          echo "\"UpdatesDisableNotify\"=dword:00000001"
+          echo "\"AntiVirusDisableNotify\"=dword:00000001"
+          echo ""
+          echo "[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc]"
+          echo "\"Start\"=dword:00000004"
+          echo ""
+          echo "[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\StandardProfile]"
+          echo "\"EnableFirewall\"=dword:00000000"
+          echo ""
+          echo "[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]"
+          echo "\"Start\"=dword:00000004"
+          echo
+          echo "[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]"
+          echo "\"3389:TCP\"=\"3389:TCP:*:Enabled:@xpsp2res.dll,-22009\""
+          echo ""
+          echo "[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]"
+          echo "\"LimitBlankPasswordUse\"=dword:00000000"
+          echo ""
+          echo "[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Tour]"
+          echo "\"RunCount\"=dword:00000000"
+          echo ""
+          echo "[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]"
+          echo "\"HideFileExt\"=dword:00000000"
+          echo ""
+          echo "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]"
+          echo "\"DefaultUserName\"=\"Docker\""
+          echo "\"DefaultDomainName\"=\"Dockur\""
+          echo "\"AltDefaultUserName\"=\"Docker\""
+          echo "\"AltDefaultDomainName\"=\"Dockur\""
+          echo "\"AutoAdminLogon\"=\"1\""
+  } | unix2dos > "$dir/\$OEM\$/install.reg"
+
+  {       echo "Set WshShell = WScript.CreateObject(\"WScript.Shell\")"
+          echo "Set WshNetwork = WScript.CreateObject(\"WScript.Network\")"
+          echo "Set oMachine = GetObject(\"WinNT://\" & WshNetwork.ComputerName)"
+          echo "Set oInfoUser = GetObject(\"WinNT://\" & WshNetwork.ComputerName & \"/Administrator,user\")"
+          echo "Set oUser = oMachine.MoveHere(oInfoUser.ADsPath,\"Docker\")"
+  } | unix2dos > "$dir/\$OEM\$/admin.vbs"
+
+  {       echo "[COMMANDS]"
+          echo "\"REGEDIT /s install.reg\""
+          echo "\"Wscript admin.vbs\""
+  } | unix2dos > "$dir/\$OEM\$/cmdlines.txt"
+
+  rm -rf "$drivers"
   return 0
 }
 
@@ -863,6 +888,8 @@ prepareLegacy() {
   ETFS="boot.img"
   BOOT_MODE="windows_legacy"
 
+  rm -f "$dir/$ETFS"
+
   local len offset
   len=$(isoinfo -d -i "$iso" | grep "Nsect " | grep -o "[^ ]*$")
   offset=$(isoinfo -d -i "$iso" | grep "Bootoff " | grep -o "[^ ]*$")
@@ -880,7 +907,7 @@ prepareImage() {
   local iso="$1"
   local dir="$2"
 
-  if [[ "${BOOT_MODE,,}" == "windows" ]]; then
+  if [[ "${BOOT_MODE,,}" != "windows_legacy" ]]; then
     if [[ "${DETECTED,,}" != "winxp"* ]] && [[ "${DETECTED,,}" != "win2008"* ]]; then
       if [[ "${DETECTED,,}" != "winvista"* ]] && [[ "${DETECTED,,}" != "win7"* ]]; then
 
@@ -918,13 +945,23 @@ updateImage() {
   local iso="$1"
   local dir="$2"
   local asset="/run/assets/$3"
-  local index result
+  local path src loc index result
 
   [ ! -f "$asset" ] && return 0
-  replaceXML "$dir" "$asset"
 
-  local loc="$dir/sources/boot.wim"
-  [ ! -f "$loc" ] && loc="$dir/sources/boot.esd"
+  path=$(find "$dir" -maxdepth 1 -type f -iname autounattend.xml | head -n 1)
+  [ -n "$path" ] && cp "$asset" "$path"
+
+  src=$(find "$dir" -maxdepth 1 -type d -iname sources | head -n 1)
+
+  if [ ! -d "$src" ]; then
+    warn "failed to locate 'sources' folder in ISO image, $FB"
+    BOOT_MODE="windows_legacy"
+    return 1
+  fi
+
+  loc=$(find "$src" -maxdepth 1 -type f -iname boot.wim | head -n 1)
+  [ ! -f "$loc" ] && loc=$(find "$src" -maxdepth 1 -type f -iname boot.esd | head -n 1)
 
   if [ ! -f "$loc" ]; then
     warn "failed to locate 'boot.wim' or 'boot.esd' in ISO image, $FB"

src/mido.sh

@@ -571,7 +571,7 @@ verify_media() {
     # IMPORTANT: These checksums are not necessarily subject to being updated
     # Unfortunately, the maintenance burden would be too large and even if I did there would still be some time gap between Microsoft releasing a new ISO and me updating the checksum (also, users would have to update this script)
     # For these reasons, I've opted for a slightly more manual verification where you have to look up the checksum to see if it's a well-known Windows ISO checksum
-    # Ultimately, you have to trust Microsft because they could still include a backdoor in the verified ISO (keeping Windows air gapped could help with this)
+    # Ultimately, you have to trust Microsoft because they could still include a backdoor in the verified ISO (keeping Windows air gapped could help with this)
     # Community contributions for these checksums are welcome
     #
     # Leading backslash is to avoid prepending a newline while maintaining alignment

src/power.sh

@@ -50,6 +50,8 @@ finish() {
   local pid
   local reason=$1
 
+  touch "$QEMU_END"
+
   if [ -f "$QEMU_PID" ]; then
 
     pid=$(<"$QEMU_PID")

src/samba.sh

@@ -1,7 +1,11 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
+: "${SAMBA:="Y"}"
+
 [[ "$DHCP" == [Yy1]* ]] && return 0
+[[ "$SAMBA" != [Yy1]* ]] && return 0
+[[ "$NETWORK" != [Yy1]* ]] && return 0
 
 SHARE="$STORAGE/shared"
 
@@ -19,7 +23,7 @@ SAMBA="/etc/samba/smb.conf"
         echo "    security = user"
         echo "    guest account = nobody"
         echo "    map to guest = Bad User"
-        echo "    server min protocol = SMB2"
+        echo "    server min protocol = NT1"
         echo ""
         echo "    # disable printing services"
         echo "    load printers = no"
@@ -37,7 +41,7 @@ SAMBA="/etc/samba/smb.conf"
         echo "    force group = root"
 } > "$SAMBA"
 
-{      echo "--------------------------------------------------------" 
+{      echo "--------------------------------------------------------"
         echo " $APP for Docker v$(</run/version)..."
         echo " For support visit $SUPPORT"
         echo "--------------------------------------------------------"
@@ -57,7 +61,23 @@ SAMBA="/etc/samba/smb.conf"
         echo ""
 } | unix2dos > "$SHARE/readme.txt"
 
-smbd -D
-wsdd -i dockerbridge -p -n "host.lan" &
+! smbd && smbd --debug-stdout
+
+isXP="N"
+
+if [ -f "$STORAGE/windows.old" ]; then
+  MT=$(<"$STORAGE/windows.old")
+  if [[ "${MT,,}" == "pc-q35-2"* ]]; then
+    isXP="Y"
+  fi
+fi
+
+if [[ "$isXP" == [Yy1]* ]]; then
+  # Enable NetBIOS on Windows XP
+  ! nmbd && nmbd --debug-stdout
+else
+  # Enable Web Service Discovery
+  wsdd -i dockerbridge -p -n "host.lan" &
+fi
 
 return 0