Unable to run `mcr.microsoft.com/windows/nanoserver:ltsc2025` based containers with custom users

[qasim-sajid-snkeos]

Describe the bug
Unable to run mcr.microsoft.com/windows/nanoserver:ltsc2025 based containers with custom users.

To Reproduce
Steps to reproduce the behavior:

1. Create the following dockerfile:

FROM mcr.microsoft.com/windows/nanoserver:ltsc2025

USER ContainerAdministrator

RUN net accounts /MaxPWAge:unlimited && \
 net user /add "MyCustomUser" /expires:never && \
 net localgroup "Network Configuration Operators" "MyCustomUser" /add

USER MyCustomUser

ENTRYPOINT ["CMD"]

2. Build an image using the above dockerfile:
   docker build -f Dockerfile -t my-test-image .

3. Run the container:
   docker run my-test-image

4. Output:

$ docker run my-test-image
b8a23122bd391ac7db803793a98b55752372d44e06af5b8a5ddf1fa74f614b62
docker: Error response from daemon: container b8a23122bd391ac7db803793a98b55752372d44e06af5b8a5ddf1fa74f614b62 encountered an error during hcs::System::CreateProcess: CMD: failure in a Windows system call: The specified domain either does not exist or could not be contacted. (0x54b)

Run 'docker run --help' for more information

Expected behavior
The container should run successfully like it does for mcr.microsoft.com/windows/servercore:ltsc2022.

Configuration:

• Edition: Windows Server 2025
• Base Image being used: mcr.microsoft.com/windows/nanoserver:ltsc2025
• Container engine: Docker
• Container Engine version:

PS C:\Users\Administrator> docker version
Client:
 Version: 29.1.5
 API version: 1.52
 Go version: go1.25.6
 Git commit: 0e6fee6
 Built: Fri Jan 16 12:51:08 2026
 OS/Arch: windows/amd64
 Context: default

Server: Docker Engine - Community
 Engine:
 Version: 29.1.5
 API version: 1.52 (minimum version 1.44)
 Go version: go1.25.6
 Git commit: 3b01d641
 Built: Fri Jan 16 12:48:28 2026
 OS/Arch: windows/amd64
 Experimental: false

Additional context
The same dockerfile but with the default ContainerUser works fine. Also, the exact same dockerfile but with the mcr.microsoft.com/windows/nanoserver:ltsc2022 image works fine as well.

[github-actions]

Thank you for creating an Issue. Please note that GitHub is not an official channel for Microsoft support requests. To create an official support request, please open a ticket here. Microsoft and the GitHub Community strive to provide a best effort in answering questions and supporting Issues on GitHub.

[rawahars]

Root cause: nanoserver:ltsc2025 ships with an empty LSA "Primary Domain" name. A custom local user (net user) does a real local logon that requires this value to be non-empty, so it fails with ERROR_NO_SUCH_DOMAIN (0x54b). Built-in ContainerUser/ContainerAdministrator are virtual accounts that skip that path (so they work), and ltsc2022 sets the value to WORKGROUP (so it works there).

Workarounds: use ContainerUser, or ltsc2022, or set a non-empty Primary Domain name at build time (before the USER switch) with a tiny helper.

setpd.c (~15 lines):

#include <windows.h>
#include <ntsecapi.h>
#include <wchar.h>

int wmain(int argc, wchar_t **argv) {
 wchar_t *name = argc > 1 ? argv[1] : L"WORKGROUP";
 LSA_OBJECT_ATTRIBUTES oa = {0};
 LSA_HANDLE h;
 if (LsaOpenPolicy(0, &oa, POLICY_TRUST_ADMIN | POLICY_VIEW_LOCAL_INFORMATION, &h)) return 1;
 POLICY_PRIMARY_DOMAIN_INFO pd = {0};
 pd.Name.Buffer = name;
 pd.Name.Length = (USHORT)(wcslen(name) * 2);
 pd.Name.MaximumLength = pd.Name.Length + 2;
 return LsaSetInformationPolicy(h, PolicyPrimaryDomainInformation, &pd) ? 2 : 0;
}

Build a static exe (runs on Nano Server, no CRT deps):

x86_64-w64-mingw32-gcc setpd.c -o setpd.exe -municode -ladvapi32 -static

Fixed Dockerfile:

FROM mcr.microsoft.com/windows/nanoserver:ltsc2025
USER ContainerAdministrator
RUN net accounts /MaxPWAge:unlimited && \
 net user /add "MyCustomUser" /expires:never && \
 net localgroup "Network Configuration Operators" "MyCustomUser" /add
COPY setpd.exe C:\setpd.exe
RUN C:\setpd.exe WORKGROUP
USER MyCustomUser
ENTRYPOINT ["CMD"]

[qasim-sajid-snkeos]

Harsh Rawat (@rawahars) thanks for the quick and detailed response.
I tried your solution and it worked, so closing the issue.