Unable to set ephemeral port range in Dockerfile

[t-bzhan]

There seem to be some issues with setting the ephemeral port range in a Dockerfile for a Windows container.

Using the Dockerfile below:

# Use the Windows Server Core image
FROM mcr.microsoft.com/windows/servercore:ltsc2022

# Run the netsh command to set the dynamic port range
RUN netsh int ipv4 set dynamicport tcp start=1025 num=64511

CMD ["cmd.exe"]

Below is my docker build output:

λ docker build . -t portchange:1.0
Sending build context to Docker daemon  2.048kB
Step 1/3 : FROM mcr.microsoft.com/windows/servercore:ltsc2022
ltsc2022: Pulling from windows/servercore
2c91985a0408: Pull complete
166fe75ceb2a: Pull complete
Digest: sha256:cd409960f9b87fcc02e1c236fea3852e1323ffb16d9522bf693330ebf878f5c0
Status: Downloaded newer image for mcr.microsoft.com/windows/servercore:ltsc2022
 ---> 16f22363f4ac
Step 2/3 : RUN netsh int ipv4 set dynamicport tcp start=1025 num=64511
 ---> Running in 60be39df2c67
Ok.

 ---> Removed intermediate container 60be39df2c67
 ---> d83c6c98ad8e
Step 3/3 : CMD ["cmd.exe"]
 ---> Running in 4031d7193cda
 ---> Removed intermediate container 4031d7193cda
 ---> 7a6cbff3611a
Successfully built 7a6cbff3611a
Successfully tagged portchange:1.0

The netsh command does not appear to persist. If I run a container with the image, netsh int ipv4 show dynamicport tcp still shows the unchanged value. However, if I manually run the command in the container, it works as expected.

Is this a known limitation in Windows containers?

[github-actions]

Thank you for creating an Issue. Please note that GitHub is not an official channel for Microsoft support requests. To create an official support request, please open a ticket here. Microsoft and the GitHub Community strive to provide a best effort in answering questions and supporting Issues on GitHub.

[t-bzhan]

One more thing: even though I set the ephemeral port range in the container, it still seems to be using the default port range. Does this mean the setting is not available in Windows containers, or is it just a red herring?