How to change "Volume Serial Number" in Windows docker image?

Question

I am trying to change the "Volume Serial Number" of a docker image with Sysinternals VolumeId but I'm getting Error reading drive: The request is not supported. when I run Volumeid64.exe C: 1AAA-111A -nobanner -accepteula.

I've also tried with volumeid.exe. I'm quit new to Docker so it feels like I might be make a beginner mistake, or is this a limitation of Docker and/or Volumeid?

The complete Dockerfile looks as follows

FROM microsoft/windowsservercore

WORKDIR C:/sysinternals
RUN powershell -Command \
  Invoke-WebRequest -outfile VolumeId.zip "https://download.sysinternals.com/files/VolumeId.zip" -UseBasicParsing; ` \
  Expand-Archive VolumeId.zip -DestinationPath c:\sysinternals ; ` Remove-Item VolumeId.zip ; ` \
  Invoke-Expression 'c:\sysinternals\Volumeid64.exe C: 1AAA-111A -nobanner -accepteula'

CMD vol c:

Answer 1

This is old, but I had the exact same issue
and found Dmitriy Ivanov's answers extremely helpful, but not complete.

You'll need to find your image's base layer virtual drive, called blank.vhdx
it's stored in C:\ProgramData\Docker\windowsfilter, where there is a folder for each layer.

I found it by deleting all images except for one, and then there was only one folder with this file.

For the image mcr.microsoft.com/windows/servercore:ltsc2022
its the layer in the folder starting with c42094
and ending with b263c6
sorting by date may help you find the one you need. (should be the base layer)

Now I followed the blog post here:
https://osdfir.blogspot.com/2021/07/windows-container-forensics.html

Under the title "Block device layer", it is explained how to mount the vhdx but we need to mount blank.vhdx and not blank-base.vhdx

Mount-DiskImage -ImagePath C:\ProgramData\docker\windowsfilter\c42094[...]b263c6\blank.vhdx

Then we need to assign it a drive letter
Personally I used Disk Management to do this

After there is a drive letter, volumeid can be used to change it's Volume Serial Number. You'll need to remove the drive letter and re-add it to see the change

After removing the drive letter, unmount blank-base.vhdx with Dismount-DiskImage
and then you can run your docker, and the Volume Serial Number will be what you set it to be!
it will be the same for all images relaying on this layer.

Hope this helps!

Answer 2

Most probably it's a limitation of the windows docker implementation. There is blank-base.vhdx in the root layer of a Windows OS image (See C:\ProgramData\Docker\windowsfilter). Docker generates this file each time it pulls a root layer. I was managed to change the Volume ID inside by the next sequence:

• attach blank.vhdx which is relying on blank-base.vhdx
• assign a drive letter,
• change volume id by volumeid64.exe,
• detach.

And yes, all containers that inherently use the same windows OS root layer will have the same volume id.