Symlinks with executable targets on volume mounts cannot be executed by cmd

[structurefall]

Please fill out all the sections below for bug issues, otherwise it'll be closed as it won't be actionable for us to address.

Describe the bug
Within a Windows container, if a symlink targets an executable file that exists on a bind mounted volume, the symlink is not executable by cmd. Furthermore, if a symlink to a directory within a mounted volume contains an executable, that executable will not run if called from the symlink's inherited directory structure. If the symlink itself exists on the mounted volume, a file not found error is returned, however if the symlink is local to the container, it fails silently.

It does not matter whether the shell's CWD is within the mount or not. It also doesn't matter if any of the symlinks are relative or absolute. This affects .exe files, but does not affect .bat files. Error messages are different in Powershell but the behavior remains.

If a local symlink is made to a mounted directory that itself contains symlinked executables, those symlinked executables will work.

Here's a relatively complete example, working on a Python installation stored at C:\usr\bin\python311 on the host machine:

PS C:\> docker run --rm -ti -v C:\usr:C:\xusr mcr.microsoft.com/windows/servercore:ltsc2022
Microsoft Windows [Version 10.0.20348.4773]
(c) Microsoft Corporation. All rights reserved.

C:\>dir C:\xusr\bin\python311\python.exe
 Volume in drive C has no label.
 Volume Serial Number is DE63-E9F8

 Directory of C:\xusr\bin\python311

01/16/2025  04:18 PM            91,648 python.exe
               1 File(s)         91,648 bytes
               0 Dir(s)  178,053,509,120 bytes free

C:\>dir C:\xusr\bin\python311\python311.exe
 Volume in drive C has no label.
 Volume Serial Number is DE63-E9F8

 Directory of C:\xusr\bin\python311

01/16/2025  04:18 PM    <SYMLINK>      python311.exe [python.exe]
               1 File(s)              0 bytes
               0 Dir(s)  178,051,469,312 bytes free

C:\>C:\xusr\bin\python311\python.exe -V
Python 3.11.11

C:\>C:\xusr\bin\python311\python311.exe -V
The system cannot find the file C:\xusr\bin\python311\python311.exe.

C:\>dir xusr\bin\xpy*
 Volume in drive C has no label.
 Volume Serial Number is DE63-E9F8

 Directory of C:\xusr\bin

04/07/2026  03:07 PM    <SYMLINKD>     xpython311 [python311]

C:\>C:\xusr\bin\xpython311\python.exe -V
The system cannot find the file C:\xusr\bin\xpython311\python.exe.

C:\>mklink /d local_python C:\xusr\bin\python311
symbolic link created for local_python <<===>> C:\xusr\bin\python311

C:\>local_python\python311.exe -V
Python 3.11.11

C:\>powershell
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows

PS C:\> .\xusr\bin\python311\python311.exe
Program 'python311.exe' failed to run: Class not registeredAt line:1 char:1
+ .\xusr\bin\python311\python311.exe
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.
At line:1 char:1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (:) [], ApplicationFailedException
    + FullyQualifiedErrorId : NativeCommandFailed

PS C:\> .\xusr\bin\xpython311\python.exe
Program 'python.exe' failed to run: The system cannot find the path specifiedAt line:1 char:1
+ .\xusr\bin\xpython311\python.exe
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.
At line:1 char:1
+ .\xusr\bin\xpython311\python.exe
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (:) [], ApplicationFailedException
    + FullyQualifiedErrorId : NativeCommandFailed

PS C:\> .\local_python\python311.exe -V
Python 3.11.11

To Reproduce
Start a Windows container with a bind volume that contains either a symlinked executable or a symlinked directory containing an executable. From a command prompt in that container, call the symlinked executable or an executable in the symlinked directory through that symlink.

Expected behavior
In these cases, the executable should run.

Configuration:

• Edition: Tried on Windows 11 and Windows Server 2022, 21H2
• Base Image being used: mcr.microsoft.com/windows/servercore:ltsc2022
• Container engine: Docker
• Container Engine version: Docker Desktop v4.68.0 on Windows 11, Docker CE 24.0.9 on Windows Server

Additional context
We're using an old version of Docker Engine on the Windows Server instance because of this issue. The hash on the servercore image I'm testing on is 9bbf5a183232.

Apologies if my explanation is a bit unclear. This was a bit difficult to describe but easy to show, so hopefully the example will help.

[github-actions]

Thank you for creating an Issue. Please note that GitHub is not an official channel for Microsoft support requests. To create an official support request, please open a ticket here. Microsoft and the GitHub Community strive to provide a best effort in answering questions and supporting Issues on GitHub.