Anyway to trick nano 2019 onto bare metal?

Question

I have a workload that could use the lowest possible attack surface, and that also requires nothing more than nano.

Installing nano in a container defeats the purpose because i need to install core to host that container and i’m left with core + nano so in that case i might as well run my code on the core instance.

I don’t care about the benefits of containers here, this is for a single instance, bare metal, one app using everything, performance and security critical app, so anything that can be trimmed off of windows is good. I’m surprised that it’s not possible to use nano 2019 bare metal while 2016 was and i’m wondering if there is a safe/working (i’m fine with unofficially supported as long as windows update works) way to trick it to install there / get a bare metal installer?

Answer 1

You may be able to do it by creating a .wim image on another server, then transferring the image to your bare metal hardware.

This blog post on Microsoft's website has the specifics, but for a rough description, these are the steps:

1. Create a .wim of a Windows Nano Server by using the New-NanoServerImage commandlet and making sure your -TargetPath parameter has a .wim extension.

2. Make a bootable usb or DVD with WinPE. Boot your server with it, and verify your .wim is readable.

3. From WinPE, use diskpart to clean and format your disk with 2 partitions, a 100mb FAT32 partition and the rest to a NTFS partition. Assign drive letters to both partitions, I'll use F: for FAT32 and N: for NTFS.

4. Use dism.exe /apply-image /imagefile:.\yourNanoServer.wim /index:1 /applydir:N:\ to copy your .wim to the drive you just formatted.

5. Use Bcdboot.exe n:\Windows /s F: to create the boot loader.

6. Remove the flash drive or dvd you used to load WinPE, then issue wpeutil.exe reboot to restart the server and hopefully load up your Windows Nano Server on bare metal.

These steps are from an older version of Windows Nano Server, so you may have to find an image from build 1607 or older for this to work. You'd have a lot of updating to do at that point... but hey, them's the breaks.