SQL Server 2017 Docker构建时预安装CU26补丁未生效问题咨询

Docker环境下安装SQL Server 2017时，提前解压CU26补丁并在PrepareImage阶段指定更新源集成补丁，整个安装流程无报错，但最终实例版本为RTM原始版本，未检测到补丁生效。

执行操作代码 #

cd Install
.\SQLServer2017-DEV-x64-ENU.exe /x:SQLServer2017-DEV-x64-ENU /u
.\SQLServer2017-KB5005226-x64.exe /x:SQLServer2017_CU /u
C:\INSTALL\SQLServer2017-DEV-x64-ENU\SETUP.exe /q /IAcceptSQLServerLicenseTerms=1 /ACTION=PrepareImage /UpdateEnabled=True /UpdateSource=c:\INSTALL\SQLServer2017_CU /INSTANCEID=MSSQlSERVER /FEATURES=SQLEngine

# 执行输出（部分）
Microsoft .NET Framework CasPol 4.8.3761.0
for Microsoft .NET Framework version 4.8.3761.0
Copyright (C) Microsoft Corporation.  All rights reserved.

WARNING: The .NET Framework does not apply CAS policy by default. Any settings
shown or modified by CasPol will only affect applications that opt into using
CAS policy.
Success

C:\INSTALL\SQLServer2017-DEV-x64-ENU\SETUP.exe /Q /ACTION=INSTALL /FEATURES=SQLENGINE /INSTANCENAME=MSSQLSERVER /SECURITYMODE=SQL /SAPWD="oracle#1" /SQLSVCACCOUNT="NT AUTHORITY\System" /AGTSVCACCOUNT="NT AUTHORITY\System" /SQLSYSADMINACCOUNTS="BUILTIN\Administrators" /IACCEPTSQLSERVERLICENSETERMS=1 /TCPENABLED=1 /UPDATEENABLED=false

# 执行输出（部分）
SQL Server 2017 transmits information about your installation experience, as well as other usage and performance data, to Microsoft to help improve the product.
Microsoft (R) SQL Server 2017 14.00.1000.169
Copyright (c) 2017 Microsoft.  All rights reserved.
Success

版本查询结果 #

C:\Development\YADAMU>sqlcmd -Usa -Poracle#1
1> select @@version
2> go
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Microsoft SQL Server 2017 (RTM) - 14.0.1000.169 (X64)
        Aug 22 2017 17:04:49
        Copyright (C) 2017 Microsoft Corporation
        Developer Edition (64-bit) on Windows Server 2019 Datacenter 10.0 <X64> (Build 17763: ) (Hypervisor)
(1 rows affected)
1> quit

对应Dockerfile内容 #

FROM mcr.microsoft.com/windows/servercore:ltsc2019
#
ADD https://github.com/microsoft/windows-container-tools/releases/download/v1.1/LogMonitor.exe LogMonitor.exe 
#
# Download and install Visual C++ Redistributable
#
ADD https://aka.ms/vs/16/release/vc_redist.x64.exe .
RUN powershell -command Start-Process c:\vc_redist.x64.exe  -Wait -ArgumentList "/q"
RUN powershell -command Remove-Item c:\vc_redist.x64.exe
#
# Download and Install .NET Framework 4.8
#
ADD https://download.visualstudio.microsoft.com/download/pr/2d6bb6b2-226a-4baa-bdec-798822606ff1/8494001c276a4b96804cde7829c04d7f/ndp48-x86-x64-allos-enu.exe .
RUN powershell -command c:\ndp48-x86-x64-allos-enu.exe /q  /norestart
RUN powershell -command Remove-Item c:\ndp48-x86-x64-allos-enu.exe
#
RUN powershell -command New-Item -ItemType "directory" C:\INSTALL  
#
# Unpack SQL Server
#
WORKDIR c:/INSTALL
COPY SQLServer2017-DEV-x64-ENU.exe .
COPY SQLServer2017-DEV-x64-ENU.box .
RUN powershell -command .\SQLServer2017-DEV-x64-ENU.exe /x:SQLServer2017-DEV-x64-ENU /u
RUN powershell -command Remove-Item SQLServer2017-DEV-x64-ENU.exe
RUN powershell -command Remove-Item SQLServer2017-DEV-x64-ENU.box
#
# Unpack Cummulative update #26: SQLServer2017-KB5005226-x64
#
# ADD https://download.microsoft.com/download/C/4/F/C4F908C9-98ED-4E5F-88D5-7D6A5004AEBD/SQLServer2017-KB5005226-x64.exe  c:/SQLServer2017_CU.exe
COPY  SQLServer2017-KB5005226-x64.exe SQLServer2017_CU.exe 
RUN powershell -command .\SQLServer2017_CU.exe /x:SQLServer2017_CU /u
RUN powershell -command Remove-Item SQLServer2017_CU.exe
#
# Apply Cummlative Update for SQL Server to the Installation Directory
#
RUN C:\INSTALL\SQLServer2017-DEV-x64-ENU\SETUP.exe /q /IAcceptSQLServerLicenseTerms=1 /ACTION=PrepareImage /UpdateEnabled=True /UpdateSource=c:\INSTALL\SQLServer2017_CU /INSTANCEID=MSSQLSERVER /FEATURES=SQLEngine
#
# Install SQL Server
#
RUN C:\INSTALL\SQLServer2017-DEV-x64-ENU\SETUP.exe /Q /ACTION=INSTALL /FEATURES=SQLENGINE /INSTANCENAME=MSSQLSERVER /SECURITYMODE=SQL /SAPWD="oracle#1" /SQLSVCACCOUNT="NT AUTHORITY\System" /AGTSVCACCOUNT="NT AUTHORITY\System" /SQLSYSADMINACCOUNTS="BUILTIN\Administrators" /IACCEPTSQLSERVERLICENSETERMS=1 /TCPENABLED=1 /UPDATEENABLED=false 
#
WORKDIR c:/
COPY prepareMounts.ps1 .docker 
RUN powershell -command Set-Service  -Name "MSSQLSERVER" -StartupType "Manual"
RUN powershell -command Stop-Service -Name "MSSQLSERVER"
RUN powershell -command c:\prepareMounts.ps1
RUN powershell -command Remove-Item c:\prepareMounts.ps1
#
SHELL [ "powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
COPY Start.ps1 .
#ENTRYPOINT [ "powershell","c:\\Start.ps1","-ACCEPT_EULA $ENV:ACCEPT_EULA","-SA_PASSWORD $ENV:SA_PASSWORD"]
ENTRYPOINT powershell "c:\\Start.ps1 -ACCEPT_EULA $ENV:ACCEPT_EULA -SA_PASSWORD $ENV:SA_PASSWORD
#ENTRYPOINT ["powershell","wait-event"]

1. 安装动作逻辑不匹配：ACTION=PrepareImage是SQL Server系统准备（SysPrep）场景的第一步，作用是将SQL Server二进制文件和指定补丁打到待部署映像中，后续必须通过ACTION=CompleteImage来完成实例的初始化，才能继承PrepareImage阶段打好的补丁。你后续直接执行ACTION=INSTALL相当于跳过了之前准备好的带补丁映像，直接用原始RTM安装源执行了全新安装，PrepareImage阶段的操作完全没有生效。
2. 安装阶段关闭了更新检测：你在ACTION=INSTALL的命令中指定了/UPDATEENABLED=false参数，该参数会强制安装程序跳过所有更新扫描，即便是你在安装命令中指定了更新源也不会生效，直接安装原始RTM版本。

方案一（沿用SysPrep逻辑，推荐） #

删除原有ACTION=INSTALL的RUN命令，替换为ACTION=CompleteImage命令，示例如下：

RUN C:\INSTALL\SQLServer2017-DEV-x64-ENU\SETUP.exe /Q /ACTION=CompleteImage /INSTANCENAME=MSSQLSERVER /SECURITYMODE=SQL /SAPWD="oracle#1" /SQLSVCACCOUNT="NT AUTHORITY\System" /AGTSVCACCOUNT="NT AUTHORITY\System" /SQLSYSADMINACCOUNTS="BUILTIN\Administrators" /IACCEPTSQLSERVERLICENSETERMS=1 /TCPENABLED=1

不需要再加/UPDATEENABLED参数，直接继承PrepareImage阶段打好的CU26补丁。

方案二（单步安装，简化流程） #

删除ACTION=PrepareImage的RUN命令，修改ACTION=INSTALL命令的参数，开启更新并指定更新源即可：

RUN C:\INSTALL\SQLServer2017-DEV-x64-ENU\SETUP.exe /Q /ACTION=INSTALL /FEATURES=SQLENGINE /INSTANCENAME=MSSQLSERVER /SECURITYMODE=SQL /SAPWD="oracle#1" /SQLSVCACCOUNT="NT AUTHORITY\System" /AGTSVCACCOUNT="NT AUTHORITY\System" /SQLSYSADMINACCOUNTS="BUILTIN\Administrators" /IACCEPTSQLSERVERLICENSETERMS=1 /TCPENABLED=1 /UPDATEENABLED=True /UpdateSource=c:\INSTALL\SQLServer2017_CU

内容的提问来源于stack exchange，提问作者mark d drake