choco install magicsplat-tcl-tk fails with hcsshim::ImportLayer failed in Win32

まず、提供された Dockerfile で問題を再現し、magicsplat-tcl-tk の Chocolatey レシピと MSI の直接インストールを比較します。取得した Hyper-V Compute イベント ログと、hcsshim のコンテナー実行パスを確認します。hcsshim、Docker、パッケージ レシピのいずれに障害が属するのかを特定し、再現可能な修正または次の診断手順を文書化できれば完了です。

I recently added magicsplat-tcl-tk as a dependency to one of our docker images and failed our builds with

re-exec error: exit status 1: output: hcsshim::ImportLayer failed in Win32: The system cannot find the path specified. (0x3)

The full output of the run command is:

Step 5/5 : RUN choco install --yes magicsplat-tcl-tk
 ---> Running in 998b0ebbccb7
Chocolatey v2.2.2
Installing the following packages:
magicsplat-tcl-tk
By installing, you accept licenses for the packages.
Progress: Downloading magicsplat-tcl-tk 1.13.0... 100%

magicsplat-tcl-tk v1.13.0 [Approved]
magicsplat-tcl-tk package files install completed. Performing other installation steps.
Installing 64-bit magicsplat-tcl-tk...
magicsplat-tcl-tk has been installed.
  magicsplat-tcl-tk may be able to be automatically uninstalled.
Environment Vars (like PATH) have changed. Close/reopen your shell to
 see the changes (or in powershell/cmd.exe just type `refreshenv`).
 The install of magicsplat-tcl-tk was successful.
  Software installed as 'MSI', install location is likely default.

Chocolatey installed 1/1 packages.
 See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log).

C:\>re-exec error: exit status 1: output: hcsshim::ImportLayer failed in Win32: The system cannot find the path specified. (0x3)

Here is a minimal example to reproduce the issue:

FROM mcr.microsoft.com/dotnet/framework/runtime:4.8-windowsservercore-ltsc2022
SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
RUN wget "https://community.chocolatey.org/install.ps1" -OutFile choco_install.ps1
RUN ./choco_install.ps1
RUN choco install --yes magicsplat-tcl-tk
CMD ["cmd"]

Building without the choco install line works fine, and when I run the resulting image in an interactive container session, I can do it manually succesfully:

> choco install --yes magicsplat-tcl-tk
> refreshenv
> tclsh
% 

So I attempted to change the RUN call to also use cmd:

RUN cmd /c choco install --yes magicsplat-tcl-tk

I created a log output:

wevtutil.exe sl Microsoft-Windows-Hyper-V-Compute-Analytic /e:true /q:true
docker build -t test-shoeffner-tcl  . 
wevtutil.exe epl Microsoft-Windows-Hyper-V-Compute-Analytic tcl_fail.evtx
wevtutil.exe sl Microsoft-Windows-Hyper-V-Compute-Analytic /e:false /q:true

And while I cannot attach it easily, it shows the following errors (in order of appearance):

onecore\vm\compute\service\cexec\client\cexeclib.cpp(220)\vmcompute.exe!00007FF6DAB773B0: (caller: 00007FF6DAB19484) ReturnHr(108) tid(51b0) 8007052E The user name or password is incorrect.
    CallContext:[\HcsRpc_CreateProcess\ComputeSystemManager_ExecuteProcess\WindowsContainer_ExecuteProcess] 

onecore\vm\compute\management\orchestration\windowscontainer\containerprocessorchestrator.cpp(116)\vmcompute.exe!00007FF6DAB194C0: (caller: 00007FF6DABBB081) Exception(109) tid(51b0) 8007052E The user name or password is incorrect.
    CallContext:[\HcsRpc_CreateProcess\ComputeSystemManager_ExecuteProcess\WindowsContainer_ExecuteProcess] 

onecore\vm\compute\dll\lib\core\HcsRpcServer.h(261)\vmcompute.dll!00007FF80FAC3CC6: (caller: 00007FF80FAE43F0) ReturnHr(119) tid(2f50) 8007052E The user name or password is incorrect.
    CallContext:[\HcsClientApi] 

onecore\vm\compute\dll\legacy\src\graphdriver.cpp(1050)\vmcompute.dll!00007FF80FAD5723: (caller: 0000000000532B1E) Exception(12) tid(2dac) 800700B7 Cannot create a file when that file already exists.

onecore\vm\compute\dll\legacy\src\graphdriver.cpp(1054)\vmcompute.dll!00007FF80FB2EF0D: (caller: 0000000000532B1E) ReturnHr(120) tid(2dac) 800700B7 Cannot create a file when that file already exists.
    Msg:[onecore\vm\compute\dll\legacy\src\graphdriver.cpp(1050)\vmcompute.dll!00007FF80FAD5723: (caller: 0000000000532B1E) Exception(12) tid(2dac) 800700B7 Cannot create a file when that file already exists.
] 

onecore\vm\compute\dll\legacy\src\graphdriver.cpp(1120)\vmcompute.dll!00007FF80FAD590D: (caller: 0000000000532B1E) Exception(1) tid(3bc4) 80070003 The system cannot find the path specified.

onecore\vm\compute\dll\legacy\src\graphdriver.cpp(1125)\vmcompute.dll!00007FF80FB2EF70: (caller: 0000000000532B1E) ReturnHr(1) tid(3bc4) 80070003 The system cannot find the path specified.
    Msg:[onecore\vm\compute\dll\legacy\src\graphdriver.cpp(1120)\vmcompute.dll!00007FF80FAD590D: (caller: 0000000000532B1E) Exception(1) tid(3bc4) 80070003 The system cannot find the path specified.
] 

This is the output of the docker version:

Client:
 Cloud integration: v1.0.35+desktop.4
 Version:           24.0.6
 API version:       1.43
 Go version:        go1.20.7
 Git commit:        ed223bc
 Built:             Mon Sep  4 12:32:48 2023
 OS/Arch:           windows/amd64
 Context:           default

Server: Docker Desktop 4.23.0 (120376)
 Engine:
  Version:          24.0.6
  API version:      1.43 (minimum version 1.24)
  Go version:       go1.20.7
  Git commit:       1a79695
  Built:            Mon Sep  4 12:31:39 2023
  OS/Arch:          windows/amd64
  Experimental:     false

No other choco packages cause us any troubles so far, do you have an idea what could go wrong or how I could debug this further? Or is this an issue with the package?

Update:

I removed chocolatey from the equation by downloading and installing the msi directly:

FROM mcr.microsoft.com/dotnet/framework/runtime:4.8-windowsservercore-ltsc2022

SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
RUN wget "https://gigenet.dl.sourceforge.net/project/magicsplat/magicsplat-tcl/tcl-8.6.13-installer-1.13.0-x64.msi" -OutFile tcl-8.6.13-installer-1.13.0-x64.msi
RUN cmd /c tcl-8.6.13-installer-1.13.0-x64.msi ALLUSERS=1 APPLICATIONFOLDER=C:\Program~1\Tcl /qn /norestart /l*v log.log

CMD ["cmd"]

It worked fine and I can use the tclsh in the resulting container.

So the issue might be an interplay between choco and docker, in particular this recipe.
Here is the recipe: https://github.com/chtof/chocolatey-packages/blob/master/automatic/magicsplat-tcl-tk/

$ErrorActionPreference = 'Stop';
$toolsDir   = "$(Split-Path -parent $MyInvocation.MyCommand.Definition)"

$packageArgs = @{
  packageName   = $env:ChocolateyPackageName
  destination   = "$toolsDir"

  file          = "$toolsDir\tcl-8.6.13-installer-1.13.0-x86.msi"
  filetype      = 'MSI'
  file64        = "$toolsDir\tcl-8.6.13-installer-1.13.0-x64.msi"
  filetype64    = 'MSI'

  silentArgs    = "ALLUSERS=1 APPLICATIONFOLDER=C:\Progra~1\Tcl /qn /norestart /l*v `"$($env:TEMP)\$($packageName).$($env:chocolateyPackageVersion).MsiInstall.log`""
}

Install-ChocolateyInstallPackage @packageArgs

I am not familiar with the development of choco and could not find the source for Install-ChocolateyInstallPackage, so I do not know what exactly they do different from what I did. Any suggestions?