Troubleshooting guide Windows Server

Fix "Access is denied" when Docker downloads images on Windows Server

When you install or update Gluesync on Windows Server, Docker can stop partway through downloading the images with a failed to register layer …​ Access is denied error. This guide shows you how to find what blocks Docker, remove the block, and start Gluesync.

In this guide

  • Recognize the error and understand what causes it.

  • Find the security software or setting that blocks Docker.

  • Exclude Docker from security scanning.

  • Move Docker to a new, empty data folder if the error persists.

  • Start Gluesync and confirm that it runs.

Goal

Download the Gluesync images and start the platform on a Windows Server host

Audience

Windows Server administrators who install or update Gluesync

Level

Intermediate

Time

15–30 minutes, plus the time your security team needs to add an exclusion

Area

Windows Server, Docker Engine, Windows containers

Applies to

Gluesync 2.2 kits for Windows containers

What the error looks like

The error appears while the kit downloads the Gluesync images, for example when you run run.ps1:

failed to register layer: rename C:\ProgramData\docker\image\windowsfilter\layerdb\tmp\write-set-3181704858 C:\ProgramData\docker\image\windowsfilter\layerdb\sha256\8c9d41e5dc497513a5164801f1f02bedbd4a950f37905b159a59dc5258d38eef: Access is denied.

Docker unpacks each image layer into a temporary write-set-<number> folder, then renames the folder to its final name. Windows refuses the rename when another program has a file in that folder open, or when a security policy blocks the change. The cause is on the host, not in Gluesync, and the error often moves to a different layer each time you retry.

The most common causes are:

  • Endpoint security software, such as Microsoft Defender or a third-party antivirus or EDR agent, scanning Docker’s files while Docker writes them.

  • Defender’s Controlled folder access feature blocking dockerd.exe.

  • Half-written layer folders left behind by an earlier, interrupted download.

run.ps1 can still print Gluesync stack started (detached). after this error. The platform is not running in that case. Scroll up in the PowerShell window for Docker errors before you assume the start succeeded.

Before you begin

  1. A PowerShell session opened with Run as administrator.

  2. Permission to change Docker Engine settings and restart the Docker service on the host.

  3. A contact in the team that manages endpoint security on the host, if a third-party security product is installed.

Guide steps

Check what can block Docker

PowerShell

  1. Check Defender’s Controlled folder access setting and its existing exclusions:

    Get-MpPreference | Select-Object EnableControlledFolderAccess, ExclusionPath, ExclusionProcess

  2. Check that exactly one Docker Engine process is running:

    Get-Process dockerd

  3. List the file system filters installed on the host. Security, backup, and replication products each install one:

    fltmc

  4. Compare the fltmc output with the following table.

    Filter name What it is

    WdFilter

    Microsoft Defender.

    ElasticEndpointDriver

    Elastic Defend.

    CSAgent

    CrowdStrike Falcon.

    SentinelMonitor

    SentinelOne.

    SysmonDrv

    Microsoft Sysmon. It records file activity and blocks files only when its configuration uses file block rules.

    bindflt, bfs, CldFlt, FileCrypt, FileInfo, FsDepends, luafv, npsvctrig, storqosflt, UnionFS, wcifs, Wof

    Windows components. These are expected on a Windows container host.

    Treat any other filter as a possible cause and identify the product that installed it.

Expected result

You know which security products are active on the host, whether Controlled folder access is on (1) or off (0), and whether Docker is already excluded from Defender scanning. If Get-Process dockerd lists more than one process, two Docker engines are running on the host. Stop one of them before you continue.

Exclude Docker from security scanning

PowerShell

  1. If Defender is active, exclude Docker’s data folder and the Docker Engine process. Replace the path if Docker uses a different data folder:

    Add-MpPreference -ExclusionPath "C:\ProgramData\docker"
Add-MpPreference -ExclusionProcess (Get-Process dockerd).Path

  2. If Controlled folder access is on, allow the Docker Engine process:

    Add-MpPreference -ControlledFolderAccessAllowedApplications (Get-Process dockerd).Path

  3. If fltmc lists a third-party security product, print the full path of the Docker Engine process:

    (Get-Process dockerd).Path

  4. Ask the team that manages that product to trust this process and to exclude Docker’s data folder from scanning. In Elastic Defend, add the process as a trusted application. If Elastic Security shows alerts that blocked dockerd.exe, also add an endpoint exception for those alerts.

  5. Restart the Docker service:

    Restart-Service docker

A Defender exclusion has no effect on a third-party security product. Each product installed on the host needs its own exclusion.
Expected result

Get-MpPreference lists Docker’s data folder under ExclusionPath and dockerd.exe under ExclusionProcess, and your security team has confirmed the exclusion in their product.

Move Docker to a new data folder if the error persists

PowerShell

Do this step if the error comes back after you add the exclusions. A new, empty data folder removes any half-written layers from earlier attempts. It is also a supported way to keep the Docker images, which take several gigabytes, off the system drive.

Choose a folder that meets these conditions:

  • It is on a local NTFS volume. Windows containers do not support ReFS volumes, Dev Drives, network shares, or removable disks.

  • It is outside the Gluesync installation folder. run.ps1 changes the permissions of everything inside the installation folder, which interferes with Docker’s own files.

  • It is new and empty. Do not copy the old C:\ProgramData\docker folder into it: Docker downloads the images again.

    1. Stop the Docker service:

      Stop-Service docker

    2. Create the new folder. This guide uses D:\docker-data:

      New-Item -ItemType Directory -Path D:\docker-data

    3. Open C:\ProgramData\docker\config\daemon.json, or create it if it does not exist. The file stays in this location after you move the data folder.

    4. Add the data-root setting, and keep any settings the file already contains. Write each backslash in the path twice:

      {
  "data-root": "D:\\docker-data",
  "max-concurrent-downloads": 1
}

      max-concurrent-downloads is optional. It makes Docker download one layer at a time instead of three, which reduces how many files security software has to scan at once. Downloads take longer.

    5. Check that the file is valid JSON. The command prints the settings back, or an error that points at the problem:

      Get-Content C:\ProgramData\docker\config\daemon.json -Raw | ConvertFrom-Json

    6. On Docker Engine 23.0 or later, check that Docker accepts the settings. The command prints configuration OK:

      dockerd --validate --config-file C:\ProgramData\docker\config\daemon.json

    7. Start the Docker service:

      Start-Service docker

    8. Confirm the data folder that Docker uses:

      docker info --format '{{.DockerRootDir}}'

    9. Exclude the new folder from security scanning, as in the previous step:

      Add-MpPreference -ExclusionPath "D:\docker-data"

If the host runs Docker Desktop instead of Docker Engine, add the same settings in Settings > Docker Engine and select Apply & restart.

For all Docker Engine settings on Windows, see Microsoft’s Configure Docker in Windows.

Expected result

docker info prints D:\docker-data, and the Docker service is running.

Start Gluesync

PowerShell

  1. Go to your Gluesync installation folder, the folder that contains run.ps1. The default is C:\Program Files\Gluesync:

    cd "C:\Program Files\Gluesync"

  2. Start Gluesync:

    .\run.ps1
Expected result

Docker downloads every image without a failed to register layer error, and the script ends with Gluesync stack started (detached).

Verify the result

  • docker info --format '{{.DockerRootDir}}' prints the data folder you expect.

  • docker-compose ps, run in the installation folder, lists every Gluesync service as running.

  • The Control Plane opens at https://localhost.

Troubleshooting

Problem Possible cause What to do

The error still shows C:\ProgramData\docker after you set a new data folder

Docker was not restarted, daemon.json is in a different folder, or the host runs Docker Desktop

Restart the Docker service and run docker info again. The file must be C:\ProgramData\docker\config\daemon.json. With Docker Desktop, change the settings in Settings > Docker Engine.

The Docker service stops right after you edit daemon.json

The file is not valid JSON, for example because a path contains single backslashes, or a setting refers to something that does not exist

Open Event Viewer, go to Windows Logs > Application, and look for errors from the source docker. The message names the setting Docker rejected. For example, lookup account docker-users: not found means the group setting names a group that does not exist on the host: create the group or remove the setting.

The error persists on a new, empty data folder

A security product still blocks Docker

Run Microsoft’s Process Monitor with the filter Path contains write-set, then run run.ps1 until the error appears. The processes other than dockerd.exe that open those files just before the denied rename are the ones to exclude. Share their names with your security team.

run.ps1 reports that the stack started, but the Control Plane does not open

The script continues after Docker reports an error

Scroll up in the PowerShell window for Docker errors, and run docker-compose ps in the installation folder to see which services are missing.

Related guides

If the error persists, collect the logs with collect-logs.ps1 from the installation folder and open a ticket on the support portal. Include the full error message and the output of fltmc.