Windows first-boot automation broken after Dockerfile changes for qemu-docker and wsdd

Description
After updating the OmniParser Dockerfile to work around two upstream changes, the Windows 11 VM still installs and boots to the desktop—but none of the first‑boot automation runs, and the Samba share (\\host.lan\\Data) is now inaccessible (permission denied).

What I did

1. The official Dockerfile’s
   COPY --from=qemux/qemu-docker:6.08 / /
   stopped working (image removed from Docker Hub).
   Workaround: changed to
   COPY --from=swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/qemu-docker:6.08 / /
2. wsdd was removed from Debian stable, so apt-get install wsdd failed. Added Sid and apt-pinning for wsdd only:

RUN echo "Package: wsdd" > /etc/apt/preferences.d/wsdd && \
    echo "Pin: release a=sid" >> /etc/apt/preferences.d/wsdd && \
    echo "Pin-Priority: 900" >> /etc/apt/preferences.d/wsdd && \
    echo "Package: *" >> /etc/apt/preferences.d/wsdd && \
    echo "Pin: release a=stable" >> /etc/apt/preferences.d/wsdd && \
    echo "Pin-Priority: 100" >> /etc/apt/preferences.d/wsdd

# Install packages
RUN apt-get update && \
    apt-get --no-install-recommends -y install \
        bc \
        ...

With only change 1, everything worked last week—Windows installed and first‑boot scripts ran. After adding change 2:

• Windows still installs and boots to the desktop
• No terminal or PowerShell window ever pops up
• \\host.lan\\Data now returns “Access to the path ‘\host.lan\Data’ is denied”
• No firstboot_log.txt appears in the share
• No errors in Docker or Samba logs

Steps to reproduce

1. Clone OmniParser and apply the Dockerfile edits above (or use the attached Dockerfile - remove the .txt extension)
2. ./scripts/manage_vm.sh create
3. Wait for Windows to install and boot to the desktop.
4. In the VM, open PowerShell (Admin) and run:

Test-Connection host.lan -Count 2    # succeeds
Get-ChildItem \\host.lan\Data        # fails with AccessDenied

Dockerfile.txt

Environment

• Host OS: Pop!_OS 24.04 LTS
• Docker Engine: 28.1.1 (Community)
• Base image: qemux/qemu-docker:6.08 (mirrored: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/qemu-docker:6.08)
• Windows image: Win11 Enterprise Eval

Notes / Possible causes

• Sid pinning for wsdd may have pulled in newer wimtools or related packages, altering the ISO injection logic.
• Samba’s guest-only share configuration may now be too restrictive.
• autounattend.xml or first‑logon task registration may have regressed.

Request
Could someone help verify that:

1. autounattend.xml is still correctly injected into the ISO and recognized by WinPE?
2. Samba is configured to allow guest access under the current container setup?
3. No regressions exist in the first‑boot injection logic after pulling parts of Sid?

Thank you!

Start with the attached Dockerfile and scripts/manage_vm.sh, then inspect how autounattend.xml and first-boot files are injected into the Windows ISO. Compare the Dockerfile changes involving the qemu-docker image, Sid wsdd pinning, and package installation with the resulting Docker and Samba logs. Done means first-boot automation runs and \host.lan\Data is accessible with firstboot_log.txt present.