Document FSCTL_EXTEND_VOLUME read-only issue

Author: aheck

content/manuals/desktop/troubleshoot-and-support/troubleshoot/topics.md

@@ -379,6 +379,39 @@ Note some third-party software such as Android emulators will disable Hyper-V on
 
 Your machine must have the following features for Docker Desktop to function correctly:
 
+### Docker Desktop with Windows Containers fails with "The media is write protected""
+
+#### Error message
+
+FSCTL_EXTEND_VOLUME \\?\Volume{GUID}: The media is write protected
+
+#### Cause
+
+If you're encountering failures when running Docker Desktop with Windows Containers, it might be due to
+a specific Windows configuration policy: FDVDenyWriteAccess.
+
+This policy, when enabled, causes Windows to mount all fixed drives not encrypted by BitLocker-encrypted as read-only.
+This also affects virtual machine volumes and as a result, Docker Desktop may not be able to start or run containers
+correctly because it requires read-write access to these volumes.
+
+FDVDenyWriteAccess is a Windows Group Policy setting that, when enabled, prevents write access to fixed data drives that are not protected
+by BitLocker. This is often used in security-conscious environments but can interfere with development tools like Docker.
+In the Windows registry it can be found at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FVE\FDVDenyWriteAccess.
+
+#### Solutions
+
+Docker Desktop does not support running Windows Containers on systems where FDVDenyWriteAccess is enabled. This setting interferes with the
+ability of Docker to mount volumes correctly, which is critical for container functionality.
+
+To use Docker Desktop with Windows Containers, ensure that FDVDenyWriteAccess is disabled. You can check and change this setting in the registry or through Group Policy Editor (gpedit.msc) under:
+
+Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Fixed Data Drives -> Deny write access to fixed drives not protected by BitLocker
+
+Set this policy to "Not Configured" or "Disabled".
+
+Note: Modifying Group Policy settings may require administrator privileges and should comply with your organization's IT policies. If the setting gets reset after some
+time this usually means that it got overriden by the centralized configuration of your IT department. Better talk to them before making any changes.
+
 ##### WSL 2 and Windows Home
 
 1. Virtual Machine Platform