Non-Zero exit code from PowerShell provisioner does not terminate Docker build (Windows container)

[mloskot]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Overview of the Issue

There is no way to terminate build of Windows container on any kind of on PowerShell failure with non-zero exit.

I reported this issue more than a year ago as a comment

• Unable to get Powershell provisioner to cause packer fail #11198 (comment)

This PR seems to promise to fix it, as I hoped in #13334 (comment), but apparently it does not:

• Powershell Provisioner Error Handling #13334

Reproduction Steps

Steps to reproduce this issue:

1. Create Packer template building Windows container
2. Add PowerShell provisioner, inline or script, which exits with non-zero code
3. Run the build
4. Observe the non-zero exit code does not terminate the build

Packer version

From packer version: 1.14.x and 1.15.x

Simplified Packer Template

Here is sample of my Packer template building Windows container:

source "docker" "xxx" {
  commit            = true
  image             = "mcr.microsoft.com/windows/servercore:ltsc2022"
  windows_container = true
  ...
}

build {
  sources = [ "source.docker.xxx" ]

  provisioner "powershell" {
    inline = ["exit 7"]
  }

  provisioner "powershell" {
    inline = ["$global:LASTEXITCODE=9; exit $global:LASTEXITCODE"
    ]
  }

  provisioner "powershell" {
    scripts = [
      // $global:LASTEXITCODE = 1
      // exit $global:LASTEXITCODE
      "ExitWithNonZero.ps1"
    ]
  }

  provisioner "powershell" {
    scripts = [
      // $exitCode = 0
      // try {
      //     Invoke-WebRequest -Uri https://xxxnonexistent.blob.core.windows.net/app.exe -UseBasicParsing
      // } catch {
      //     $exitCode = 1
      //     Write-Host ('ERROR: {0}' -f $_.Exception.Message)
      // }
      // $global:LASTEXITCODE = $exitCode
      // exit $global:LASTEXITCODE
      "RequestNonExistentURL.ps1"
    ]
  }
}

Operating system and Environment details

Windows 11 Pro, 64-bit, Docker Desktop

Log Fragments and crash.log files

==> myapp.docker.xxx: Creating a temporary directory for sharing data...
==> myapp.docker.xxx: Pulling Docker image: mcr.microsoft.com/windows/servercore:ltsc2022
==> myapp.docker.xxx: ltsc2022: Pulling from windows/servercore
==> myapp.docker.xxx: Digest: sha256:a23b350061d76236e2c427e32175a2decfe3214200eee4ae9ee9cd9e98f26bf0
==> myapp.docker.xxx: Status: Image is up to date for mcr.microsoft.com/windows/servercore:ltsc2022
==> myapp.docker.xxx: mcr.microsoft.com/windows/servercore:ltsc2022
==> myapp.docker.xxx: Starting docker container...
==> myapp.docker.xxx: Run command: docker run -v C:\Users\mateusz.loskot\AppData\Roaming\packer.d\tmp3559940646:c:/packer-files -d -i -t --entrypoint=powershell -- mcr.microsoft.com/windows/servercore:ltsc2022
==> myapp.docker.xxx: Container ID: 9608d7b1f367468a44087349896d47ef4b4672c988909ed4ab720bd349528a0a
==> myapp.docker.xxx: Provisioning with Powershell...
==> myapp.docker.xxx: Provisioning with powershell script: C:\Users\MATEUS~1.LOS\AppData\Local\Temp\powershell-provisioner2718094017
==> myapp.docker.xxx: Provisioning with Powershell...
==> myapp.docker.xxx: Provisioning with powershell script: C:\Users\MATEUS~1.LOS\AppData\Local\Temp\powershell-provisioner4017954111
==> myapp.docker.xxx: Provisioning with Powershell...
==> myapp.docker.xxx: Provisioning with powershell script: C:\Users\MATEUS~1.LOS\AppData\Local\Temp\powershell-provisioner2073392119
==> myapp.docker.xxx: Provisioning with Powershell...
==> myapp.docker.xxx: Provisioning with powershell script: C:\Users\MATEUS~1.LOS\AppData\Local\Temp\powershell-provisioner2734450570
==> myapp.docker.xxx: ERROR: The remote name could not be resolved:
==> myapp.docker.xxx: 'xxxnonexistent.blob.core.windows.net'
==> myapp.docker.xxx: Committing the container
==> myapp.docker.xxx: Image ID: sha256:4f092bb34405c504478e2c9527b50b04c0a3dd430ed32a16cc7a26b353ef73aa
==> myapp.docker.xxx: Killing the container: 836101b8406e8c13b09240bb7accca43a0f96a8cf895f9c66a85740fae730234
==> myapp.docker.xxx: Running post-processor:  (type docker-tag)
==> myapp.docker.xxx (docker-tag): Tagging image: sha256:4f092bb34405c504478e2c9527b50b04c0a3dd430ed32a16cc7a26b353ef73aa
==> myapp.docker.xxx (docker-tag): Repository: myapp/servercore:9.8-11d03ea-ltsc2022
==> myapp.docker.xxx (docker-tag): Tagging image: sha256:4f092bb34405c504478e2c9527b50b04c0a3dd430ed32a16cc7a26b353ef73aa
==> myapp.docker.xxx (docker-tag): Repository: myapp/servercore:9.8

[hiSandog]

The minimal inline = ["exit 7"] case is a useful contract test because it avoids PowerShell preference-variable ambiguity. It would be worth running the same fixture for both inline and script provisioners and asserting behavior with the default and an explicit valid_exit_codes, so a fix preserves the intended escape hatch. Capturing the generated Windows-container exec command in the test should reveal where the process exit status is being dropped.