How to use the IIS Insider docker tag

I'd like to explain the basic usage of the microsoft-windows-servercore-iis-insider docker tag so that you can use it easily.

In addition, I want to introduce a new feature, which is currently available with the insider version of IIS docker tag.

The new feature is to make the docker log from IIS ETW logging so that you can get the IIS activity that is happenning inside of the docker container immediately.

Once you understand about how to use the new feature, you will also want to try the new feature with the other existing IIS tags and that is possible with making your own Dockerfile.

I have explained about how to apply the new feature with the existing iis tags as well here.

 

The new feature is powered by using the logmonitor.exe with a predefined LogMonitorConfig.json in order to expose the IIS Etw logging to the logmonitor.exe.

If you want to include other data, you can customze LogMonitorConfig.json, referring to the LogMonitor instruction.

Using the IIS Insider docker tag

1. Prepare a docker host machine referring to the microsoft-windows-servercore-insider instruction

NOTE: The current latest IIS insider tag is compatible to windowsservercore-10.0.19035.1

2. Run a IIS docker with running

docker run --name TestIisInsider --interactive --tty --rm --publish 5000:80 mcr.microsoft.com/windows/servercore/iis/insider:windowsservercore-10.0.19035.1

 

- Or -

 

docker run -n TestIisInsider -i -t --rm -p 5000:80 mcr.microsoft.com/windows/servercore/iis/insider:windowsservercore-10.0.19035.1

NOTE:

  • mcr.microsoft.com/windows/servercore/iis/insider:windowsservercore-10.0.19035.1

    This is the IIS Insider tag name. With the tag name, you can notice that it is made from a certain version (10.0..19351.1) of the windowsservcore insider tags

  • --name TestIisInsider

    This allows to set the docker id with "TestIisInsider" for the new docker container. This is optional if you don't use the docker id later.
  •  --interactive and --tty

    These options allow to send the docker control signals such as Ctrl-C. If you don't need to use the control signal, you don't need to specify these docker options
  • --rm

    This is to remove the docker container automatically when it is stopped. If you don't want to remove the docker container, you don't need to specify the docker option
  • --publish 5000:80

    This is to publish the tcp port 5000 of the host machine and map to the tcp port 50 of the docker container. If you want to use other port, you can adjust the port values

 

3. Open a web browser and send a request http://localhost:5000

4. If everything works, you will get the response from the Default Web Site of the newly created docker container and the console of the docker client will show the IIS ETW event log as the following example:

C:\> docker run --interactive --tty --rm -p 5000:80 mcr.microsoft.com/windows/servercore/iis/insider:windowsservercore-10.0.19035.1

…

 

<Source>EtwEvent</Source><Time>2020-02-03T19:44:22.000Z</Time><Provider idGuid="{7E8AD27F-B271-4EA2-A783-A47BDE29143B}"/

><DecodingSource>DecodingSourceXMLFile</DecodingSource><Execution ProcessID="8092" ThreadID="8792" /><Level>Information<

/Level><Keyword>0x8000000000000000</Keyword><EventID Qualifiers="6200">6200</EventID><EventData><EnabledFieldsFlags>2478

079</EnabledFieldsFlags><date>2020-02-03</date><time>19:44:19</time><c-ip>10.121.100.145</c-ip><cs-username>-</cs-userna

me><s-sitename>W3SVC1</s-sitename><s-computername>1b1ccba0391d</s-computername><s-ip>172.18.164.253</s-ip><cs-method>GET

...

<sc-substatus>0</sc-substatus><CustomFields></CustomFields></EventData>


 5. In order to stop the IIS docker, you can type Ctrl-C from the console of the docker client and you will see the docker container getting stopped automatically with the below log information.

…

CTRL signal received. The process will now terminate.

[2020-02-03T19:53:56.000Z][LOGMONITOR] INFO: Entrypoint processs exit code: -1073741510

NOTE:

  • You can also stop the IIS insider docker container with stopping the w3svc service with running "net stop w3svc" command as the following:

C:\> docker exec TestIisInsider net stop w3svc

The World Wide Web Publishing Service service is stopping.

The World Wide Web Publishing Service service was stopped successfully.

  

How to apply the new feature to existing IIS tags

In order to use the new feature with other existing IIS tags, you can write your own docker file with referring to the dockerfile of the IIS Insider docker tag.

Here is one example of the Dockerfile which enables the new feature to the existing mcr.microsoft.com/windows/servercore/iis docker tag.

# escape=`

 

FROM mcr.microsoft.com/windows/servercore/iis

 

# Install LogMonitor.exe and upgrade the ServiceMonitor.exe with the newer version

RUN powershell -Command `

    Add-WindowsFeature Web-Server; `

    New-Item -ItemType Directory C:\LogMonitor; `

    $downloads = `

    @( `

        @{ `

            uri = 'https://dotnetbinaries.blob.core.windows.net/servicemonitor/2.0.1.10/ServiceMonitor.exe'; `

            outFile = 'C:\ServiceMonitor.exe' `

        }, `

        @{ `

            uri = 'https://github.com/microsoft/windows-container-tools/releases/download/v1.1/LogMonitor.exe'; `

            outFile = 'C:\LogMonitor\LogMonitor.exe' `

        }, `

        @{ `

            uri = 'https://raw.githubusercontent.com/microsoft/iis-docker/master/windowsservercore-insider/LogMonitorConfig.json'; `

            outFile = 'C:\LogMonitor\LogMonitorConfig.json' `

        } `

    ); `

    $downloads.ForEach({ Invoke-WebRequest -UseBasicParsing -Uri $psitem.uri -OutFile $psitem.outFile })

 

# Change the startup type of the IIS service from Automatic to Manual

RUN sc config w3svc start=demand

 

# Enable ETW logging for Default Web Site on IIS

RUN c:\windows\system32\inetsrv\appcmd.exe set config -section:system.applicationHost/sites /"[name='Default Web Site'].logFile.logTargetW3C:"File,ETW"" /commit:apphost

 

EXPOSE 80

 

# Start "C:\LogMonitor\LogMonitor.exe C:\ServiceMonitor.exe w3svc"

ENTRYPOINT ["C:\\LogMonitor\\LogMonitor.exe", "C:\\ServiceMonitor.exe", "w3svc"]

  

No Comments