diff --git a/appveyor.yml b/appveyor.yml
index 590d67d7..45c7c2c4 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -17,19 +17,25 @@ environment:
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
     CONFIGURATION: Debug
     TESTING: Func
+    DOCKER_TESTING: None
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
     CONFIGURATION: Release
     TESTING: Func
+    DOCKER_TESTING: None
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2017
     CONFIGURATION: Release
     TESTING: Func
+    DOCKER_TESTING: None
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2019
     CONFIGURATION: Release
     TESTING: Func
+    DOCKER_TESTING: Func
   #- CONFIGURATION: Release
   #  TESTING: Avast
+  #  DOCKER_TESTING: None
   #- CONFIGURATION: Release
   #  TESTING: Perf
+  #  DOCKER_TESTING: None
 
 init:
 - ps: iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
@@ -81,6 +87,7 @@ test_script:
 - if %TESTING%==Func start /wait msiexec /i "Test.Filter.Driver\HCK Filter.Driver Content-x86_en-us.msi" /qn
 - if %TESTING%==Func tools\nmake-ext-test.bat %CONFIGURATION%
 #- ps: . "C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\gflags.exe" /k +spp *
+- if %DOCKER_TESTING%==Func docker run -d --name=Container0 --isolation=process "-vC:\Program Files (x86)\WinFsp:C:\Program Files (x86)\WinFsp:RO" "-vC:\projects:C:\projects:RO" mcr.microsoft.com/windows/servercore:ltsc2019 cmd.exe /c waitfor 7BF47D72F6664550B03248ECFE77C7DD
 - if %TESTING%==Func tools\run-tests.bat %CONFIGURATION%
 - if %TESTING%==Func tools\run-tests.bat %CONFIGURATION% ifstest
 - if %TESTING%==Func tools\run-tests.bat %CONFIGURATION% sample
@@ -88,6 +95,9 @@ test_script:
 - if %TESTING%==Avast choco install avastfreeantivirus && fltmc instances -v "C:"
 - if %TESTING%==Avast tools\run-tests.bat %CONFIGURATION% avast-tests
 - if %TESTING%==Perf tools\run-perf-tests.bat %CONFIGURATION% baseline > perf-tests.csv && type perf-tests.csv & appveyor PushArtifact perf-tests.csv
+- if %DOCKER_TESTING%==Func docker exec Container0 cmd.exe /c C:\projects\winfsp\build\VStudio\build\%CONFIGURATION%\winfsp-tests-x64.exe +*
+#- if %DOCKER_TESTING%==Func docker run -d --name=Container1 --isolation=process "-vC:\Program Files (x86)\WinFsp:C:\Program Files (x86)\WinFsp:RO" "-vC:\projects:C:\projects:RO" mcr.microsoft.com/windows/servercore:ltsc2019 cmd.exe /c waitfor 7BF47D72F6664550B03248ECFE77C7DD
+#- if %DOCKER_TESTING%==Func docker exec Container1 cmd.exe /c C:\projects\winfsp\build\VStudio\build\%CONFIGURATION%\winfsp-tests-x64.exe +*
 - choco uninstall winfsp -y
 
 on_finish:
diff --git a/src/sys/driver.c b/src/sys/driver.c
index 33ecea99..a8608d12 100644
--- a/src/sys/driver.c
+++ b/src/sys/driver.c
@@ -161,6 +161,10 @@ NTSTATUS DriverEntry(
         goto exit;
     InitDoneDevices = TRUE;
 
+    Result = FspSiloPostInitialize();
+    if (!NT_SUCCESS(Result))
+        goto exit;
+
     Result = STATUS_SUCCESS;
 
 exit:
diff --git a/src/sys/driver.h b/src/sys/driver.h
index 1b9e69b5..d63d5b73 100644
--- a/src/sys/driver.h
+++ b/src/sys/driver.h
@@ -765,6 +765,7 @@ NTSTATUS FspSiloGetGlobals(FSP_SILO_GLOBALS **PGlobals);
 VOID FspSiloDereferenceGlobals(FSP_SILO_GLOBALS *Globals);
 VOID FspSiloGetContainerId(GUID *ContainerId);
 NTSTATUS FspSiloInitialize(FSP_SILO_INIT_CALLBACK Init, FSP_SILO_FINI_CALLBACK Fini);
+NTSTATUS FspSiloPostInitialize(VOID);
 VOID FspSiloFinalize(VOID);
 
 /* process buffers */
diff --git a/src/sys/silo.c b/src/sys/silo.c
index 9ad9d033..0dfb6d41 100644
--- a/src/sys/silo.c
+++ b/src/sys/silo.c
@@ -22,9 +22,11 @@
 #include <sys/driver.h>
 
 NTSTATUS FspSiloInitialize(FSP_SILO_INIT_CALLBACK Init, FSP_SILO_FINI_CALLBACK Fini);
+NTSTATUS FspSiloPostInitialize(VOID);
 
 #ifdef ALLOC_PRAGMA
 #pragma alloc_text(INIT, FspSiloInitialize)
+#pragma alloc_text(INIT, FspSiloPostInitialize)
 #endif
 
 typedef PEJOB FSP_PESILO;
@@ -298,15 +300,11 @@ NTSTATUS FspSiloInitialize(FSP_SILO_INIT_CALLBACK Init, FSP_SILO_FINI_CALLBACK F
             if (!NT_SUCCESS(Result))
                 goto exit;
 
-            Result = CALL(PsStartSiloMonitor)(Monitor);
-            if (!NT_SUCCESS(Result))
-                goto exit;
-
             FspSiloMonitor = Monitor;
             FspSiloInitCallback = Init;
             FspSiloFiniCallback = Fini;
-
             FspSiloInitDone = TRUE;
+
             Result = STATUS_SUCCESS;
 
         exit:
@@ -321,10 +319,23 @@ NTSTATUS FspSiloInitialize(FSP_SILO_INIT_CALLBACK Init, FSP_SILO_FINI_CALLBACK F
     return Result;
 }
 
+NTSTATUS FspSiloPostInitialize(VOID)
+{
+    if (!FspSiloInitDone)
+        return STATUS_SUCCESS;
+
+    return CALL(PsStartSiloMonitor)(FspSiloMonitor);
+}
+
 VOID FspSiloFinalize(VOID)
 {
     if (!FspSiloInitDone)
         return;
 
     CALL(PsUnregisterSiloMonitor)(FspSiloMonitor);
+
+    FspSiloMonitor = 0;
+    FspSiloInitCallback = 0;
+    FspSiloFiniCallback = 0;
+    FspSiloInitDone = FALSE;
 }
diff --git a/tools/deploy.bat b/tools/deploy.bat
index a265469a..5777d22d 100755
--- a/tools/deploy.bat
+++ b/tools/deploy.bat
@@ -7,7 +7,8 @@ set Config=Debug
 set Suffix=x64
 set Deploy=C:\Deploy\winfsp
 set Target=Win10DBG
-set Chkpnt=winfsp
+set Chkpnt=docker+winfsp
+set CImage=mcr.microsoft.com/windows/servercore:1909
 if not X%1==X set Target=%1
 if not X%2==X set Chkpnt=%2
 
@@ -15,6 +16,10 @@ if not X%2==X set Chkpnt=%2
     echo regsvr32 /s winfsp-x64.dll
 ) > %~dp0..\build\VStudio\build\%Config%\deploy-setup.bat
 
+(
+    echo docker run -it --rm --isolation=process -v%Deploy%:%Deploy%:RW %CImage% cmd.exe /k cd %Deploy%
+) > %~dp0..\build\VStudio\build\%Config%\docker-run.bat
+
 set Files=
 for %%f in (
     %~dp0..\build\VStudio\build\%Config%\
@@ -23,6 +28,7 @@ for %%f in (
         winfsp-tests-%Suffix%.exe
         memfs-%Suffix%.exe
         deploy-setup.bat
+        docker-run.bat
     ) do (
     set File=%%~f
     if [!File:~-1!] == [\] (
diff --git a/tst/winfsp-tests/posix-test.c b/tst/winfsp-tests/posix-test.c
index d051bfd9..ee671284 100644
--- a/tst/winfsp-tests/posix-test.c
+++ b/tst/winfsp-tests/posix-test.c
@@ -158,7 +158,10 @@ static void posix_map_sid_test(void)
 
     CloseHandle(Token);
 
-    for (size_t i = 0; sizeof map / sizeof map[0] > i; i++)
+    size_t n = sizeof map / sizeof map[0];
+    if (RunningInContainer)
+        n -= 2; /* container: disable tests for "user manager\containeradministrator" */
+    for (size_t i = 0; n > i; i++)
     {
         Success = ConvertStringSidToSidW(map[i].SidStr, &Sid0);
         ASSERT(Success);
diff --git a/tst/winfsp-tests/volpath-test.c b/tst/winfsp-tests/volpath-test.c
index d6035a59..dd556db8 100644
--- a/tst/winfsp-tests/volpath-test.c
+++ b/tst/winfsp-tests/volpath-test.c
@@ -254,8 +254,13 @@ static void volpath_mount_test(void)
     /*
      * This test does FspFileSystemSetMountPoint and therefore
      * cannot be used with --external or --mountpoint.
+     *
+     * Also the MountMgr appears to be buggy and fail with spurious
+     * STATUS_NOT_SUPPORTED and STATUS_INVALID_PARAMETER error codes
+     * under Windows Containers (at least with ServerCore 1909). So
+     * disable if RunningInContainer.
      */
-    if (NtfsTests || OptMountPoint)
+    if (NtfsTests || OptMountPoint || RunningInContainer)
         return;
 
     if (WinFspDiskTests)
@@ -322,7 +327,12 @@ void volpath_tests(void)
     /*
      * This test does FspFileSystemSetMountPoint and therefore
      * cannot be used with --external or --mountpoint.
+     *
+     * Also the MountMgr appears to be buggy and fail with spurious
+     * STATUS_NOT_SUPPORTED and STATUS_INVALID_PARAMETER error codes
+     * under Windows Containers (at least with ServerCore 1909). So
+     * disable if RunningInContainer.
      */
-    if (!NtfsTests && !OptMountPoint)
+    if (!NtfsTests && !OptMountPoint && !RunningInContainer)
         TEST(volpath_mount_test);
 }
diff --git a/tst/winfsp-tests/winfsp-tests.c b/tst/winfsp-tests/winfsp-tests.c
index 8f633bc3..9a1ea1d9 100644
--- a/tst/winfsp-tests/winfsp-tests.c
+++ b/tst/winfsp-tests/winfsp-tests.c
@@ -32,6 +32,7 @@
 int NtfsTests = 0;
 int WinFspDiskTests = 1;
 int WinFspNetTests = 1;
+int RunningInContainer = 0;
 
 BOOLEAN OptExternal = FALSE;
 BOOLEAN OptFuseExternal = FALSE;
@@ -259,6 +260,12 @@ int main(int argc, char *argv[])
     if (0 == getenv("WINFSP_TESTS_EXCEPTION_FILTER_DISABLE"))
         SetUnhandledExceptionFilter(UnhandledExceptionHandler);
 
+    RunningInContainer = ERROR_SUCCESS == RegGetValueW(
+        HKEY_LOCAL_MACHINE, L"SYSTEM\\CurrentControlSet\\Control",
+        L"ContainerType",
+        RRF_RT_REG_DWORD, 0,
+        0, 0);
+
     for (int argi = 1; argc > argi; argi++)
     {
         const char *a = argv[argi];
@@ -267,6 +274,7 @@ int main(int argc, char *argv[])
             if (0 == strcmp("--ntfs", a) || 0 == strcmp("--external", a))
             {
                 OptExternal = TRUE;
+                OptFuseExternal = FALSE;
                 NtfsTests = 1;
                 WinFspDiskTests = 0;
                 WinFspNetTests = 0;
@@ -405,6 +413,10 @@ int main(int argc, char *argv[])
     if (!NtfsTests && OptShareName)
         ABORT("option --share requires --ntfs/--external");
 
+    if (RunningInContainer)
+        /* container: disable network file system tests */
+        WinFspNetTests = 0;
+
     DisableBackupRestorePrivileges();
 
     AddNetShareIfNeeded();
diff --git a/tst/winfsp-tests/winfsp-tests.h b/tst/winfsp-tests/winfsp-tests.h
index c44c00cd..69eef988 100644
--- a/tst/winfsp-tests/winfsp-tests.h
+++ b/tst/winfsp-tests/winfsp-tests.h
@@ -213,6 +213,7 @@ VOID GetTestDirectoryEx(PWSTR DirBuf, ULONG DirBufSize, PWSTR DriveBuf);
 extern int NtfsTests;
 extern int WinFspDiskTests;
 extern int WinFspNetTests;
+extern int RunningInContainer;
 
 extern BOOLEAN OptExternal;
 extern BOOLEAN OptFuseExternal;