Trouble with MSI installer in container

[jghal]

I'm trying to build a custom image with the CLI installed and there is an issue with installing the MSI. My Docker host is on Windows Server 2019.

FROM mcr.microsoft.com/dotnet/framework/sdk:4.8

SHELL ["powershell", "-Command", "Continue = 'Stop'; SilentlyContinue = 'SilentlyContinue';"]

RUN Invoke-WebRequest -Uri "https://awscli.amazonaws.com/AWSCLIV2.msi" -OutFile "AWSCLIV2.msi" -UseBasicParsing ; \
    Start-Process -Wait msiexec.exe -ArgumentList @('/i', 'AWSCLIV2.msi', '/qn', '/L*v', 'C:\\install.log') ; \
    Remove-Item -Force AWSCLIV2.msi

ENTRYPOINT ["signtool.exe"]

I think it's not really waiting for the install to complete. The build output looks ok

docker build -t code-sign:initial .
Sending build context to Docker daemon  45.62MB
Step 1/4 : FROM mcr.microsoft.com/dotnet/framework/sdk:4.8
 ---> bec6ad7833f7
Step 2/4 : SHELL ["powershell", "-Command", "Continue = 'Stop'; SilentlyContinue = 'SilentlyContinue';"]
 ---> Using cache
 ---> 54084da07108
Step 3/4 : RUN Invoke-WebRequest -Uri "https://awscli.amazonaws.com/AWSCLIV2.msi" -OutFile "AWSCLIV2.msi" -UseBasicParsing ;     Start-Process -Wait msiexec.
exe -ArgumentList @('/i', 'AWSCLIV2.msi', '/qn', '/L*v', 'C:\\install.log') ;     Remove-Item -Force AWSCLIV2.msi
 ---> Using cache
 ---> 5dc86b4aa385
Step 4/4 : ENTRYPOINT ["signtool.exe"]
 ---> Using cache
 ---> 85355ccfad6e
Successfully built 85355ccfad6e
Successfully tagged code-sign:initial

But the resulting image doesn't seem to have the CLI installed, or the log file from the installer

PS C:\> docker run --rm -it --entrypoint powershell code-sign:initial
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\> dir C:\

    Directory: C:\

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-r---        10/8/2024   5:57 PM                Program Files
d-----        10/8/2024   6:03 PM                Program Files (x86)
d-r---        10/4/2024   9:52 PM                Users
d-----        10/8/2024   5:49 PM                Windows
-a----         9/6/2024   1:02 AM           5647 License.txt

PS C:\> dir 'C:\Program Files\'

    Directory: C:\Program Files

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        9/15/2018   7:21 AM                common files
d-----        10/8/2024   5:57 PM                dotnet
d-----        10/8/2024   5:57 PM                IIS
d-----        9/15/2018   7:12 AM                internet explorer
d-----        10/8/2024   5:55 PM                NuGet
d-----        9/15/2018   7:12 AM                WindowsPowerShell

But if I run the same commands from the dockerfile to manually download and run the MSI installer inside a container and wait a few minutes then it works.

[uldyssian-sh]

This is a Windows Dockerfile quoting/PowerShell issue, not that msiexec “doesn’t wait”.

Your Dockerfile sets the shell to:

SHELL ["powershell", "-Command", "Continue = 'Stop'; SilentlyContinue = 'SilentlyContinue';"]

Those assignments are missing the $ErrorActionPreference variables, so they do nothing. That means failures in your RUN step can be ignored, and the layer can still be cached as “successful”. Also, you are using Start-Process without -PassThru, so you can’t inspect the exit code, and the MSI may be failing silently (common in Windows containers).

Use the canonical pattern for MSI installs in Windows containers: call msiexec directly and check $LASTEXITCODE, and set error preferences correctly.

Replace your RUN step with:

$ErrorActionPreference = 'Stop'
$ProgressPreference = 'SilentlyContinue'

Invoke-WebRequest -Uri "https://awscli.amazonaws.com/AWSCLIV2.msi" -OutFile "C:\AWSCLIV2.msi"

Start-Process -FilePath msiexec.exe -Wait -PassThru -ArgumentList @(
'/i','C:\AWSCLIV2.msi',
'/qn',
'/norestart',
'/L*v','C:\install.log'
) | Out-Null

if ($LASTEXITCODE -ne 0) { throw "msiexec failed with exit code $LASTEXITCODE" }

Remove-Item -Force C:\AWSCLIV2.msi

Also force a rebuild (disable cache) while testing, because your current build output shows the MSI step is coming from cache:

docker build --no-cache -t code-sign:initial .

Finally, AWS CLI v2 on Windows installs into Program Files and adds to PATH for a normal Windows environment, but in containers PATH changes can be inconsistent. After install, verify directly:

& "C:\Program Files\Amazon\AWSCLIV2\aws.exe" --version

and if needed add it to PATH explicitly:

setx /M PATH "$env:PATH;C:\Program Files\Amazon\AWSCLIV2"

Summary:

Your RUN step is likely failing silently and then being reused from cache. Set PowerShell error preferences correctly, run msiexec in a way that surfaces the exit code, and rebuild with --no-cache. Then verify aws.exe by its full path inside the container.

[uldyssian-sh]

Thanks! If this helps, please consider marking it as “Helpful” or “Accepted” 😊