Performance issues noticed after upgrading to dotnet/framework/runtime:4.8-20260714-windowsservercore-ltsc2019

[SSanjeevi]

Describe the bug

Performance issues noticed after upgrading to dotnet/framework/4.8-20260714-windowsservercore-ltsc2019

Which .NET image(s) are you using?

dotnet/framework/runtime:4.8-20260714-windowsservercore-ltsc2019

Steps to reproduce

Once we upgraded our docker containers to July version - we are seeing performance degradation in large docker images - build jobs which takes 20 mins now takes 1 hour.

Anyone else facing this issue?

Other information

No errors or any other issues, but docker build jobs started crashing or taking longer time to build

We tried to revert back to May image version - it started recovering and build time back to normal 20 mins - with same build agents and no other docker file changes
4.8-20260512-windowsservercore-ltsc2019

Output of docker version

Output of docker info

[aholstrup1]

We're seeing a similar kind of issue on our side. We're publishing our own images based on mcr.microsoft.com/dotnet/framework/runtime but with some extra things installed on top e.g. SQL Server. The installation of SQL server just hangs and never completes.

@lbussell - If it's not an issue with the dotnet framework image but the base image, would you know who to contact about that? Right now, we can't publish new 2019 images.

Repro Steps
If you first download the base image from this month and last month

docker pull mcr.microsoft.com/dotnet/framework/runtime:4.8-20260714-windowsservercore-ltsc2019
docker pull mcr.microsoft.com/dotnet/framework/runtime:4.8-20260512-windowsservercore-ltsc2019

Then create this dockerfile that just downloads and installs dotnet hosting exe

ARG BASE=4.8-20260714-windowsservercore-ltsc2019
FROM mcr.microsoft.com/dotnet/framework/runtime:${BASE}

SHELL ["powershell", "-Command", "$ErrorActionPreference='Stop'; $ProgressPreference='SilentlyContinue';"]

RUN Invoke-WebRequest 'https://builds.dotnet.microsoft.com/dotnet/aspnetcore/Runtime/8.0.15/dotnet-hosting-8.0.15-win.exe' -OutFile 'C:\dotnet-hosting.exe' -UseBasicParsing ; \
    Start-Process -FilePath 'C:\dotnet-hosting.exe' -NoNewWindow -Wait -ArgumentList '/install','/quiet','/norestart' ; \
    Write-Host 'done'

Then try to build

# May 2026 image (OS 10.0.17763.8880) — FAST
Measure-Command { docker build --isolation=hyperv --memory 4G --build-arg BASE=4.8-20260512-windowsservercore-ltsc2019 -t repro:may . | Out-Host }

# July 2026 image (OS 10.0.17763.9020) — SLOW
Measure-Command { docker build --isolation=hyperv --memory 4G --build-arg BASE=4.8-20260714-windowsservercore-ltsc2019 -t repro:july . | Out-Host }

With these steps I'm able to build the May image in 30 seconds or so while the July image takes 30 minutes.

[lbussell]

The issue is with the latest update to the Windows base image. Something to do with ACLs. The Windows team recommended the following workaround, added as an instruction to your Dockerfile:

RUN powershell -NoProfile -Command "$q=[char]34; $n=[Environment]::NewLine; $k='MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache'; $s='D:(A;;KR;;;IU)(A;;KR;;;SU)(A;OICIIO;GA;;;SY)(A;;KA;;;SY)(A;;KR;;;BA)(A;;KR;;;BU)(A;;KA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;KR;;;AC)'; [IO.File]::WriteAllText('C:\f.inf','[Unicode]'+$n+'Unicode=yes'+$n+'[Version]'+$n+'signature='+$q+'$CHICAGO$'+$q+$n+'Revision=1'+$n+'[Registry Keys]'+$n+$q+$k+$q+',0,'+$q+$s+$q,[Text.Encoding]::Unicode); secedit /configure /db C:\f.sdb /cfg C:\f.inf /areas REGKEYS /quiet; Remove-Item C:\f.* -Force -EA 0; if(@((Get-Acl ('HKLM:\'+$k.Substring(8))).Access|Where-Object{-not $_.IsInherited}).Count -lt 8){throw 'StateRepository ACL repair failed'}"

/cc @pbozzay

I think the fix is currently targeting the August 11th release - if it's not ready by then, then we can probably apply this workaround directly in the .NET Framework image instead.