Active Directory with Windows Containers

Examples for getting started with Windows containers and AD. The commands below have been adopted by following basic steps in this gist to configure AD properly.

Unless otherwise noted, the majority of these scenarios have been tested using SAC 1709 and 1803, running as windows server containers (process isolation, not hyper-v containers).

Keep in mind the following points when using container versions earlier that 1809 (Windows Server 2019).

1. The container host VMs must be equal to or greater than the version of the container running. If the container host VMs is running a version greater than the container itself, the container must be run in hyper-v isolation mode. (For these scenarios, we matched our containers to the container host VMs, as GMSAs do not work when using hyper-v isolation for 1709/1803 containers.)
2. Prior to Server 2019, GMSA functionality required them to be matched 1:1 to each container. This limits the ability to scale a containerized application easily. All these scenarios assume only one container per GMSA will be running.

To get started:

1. Clone this repo. The commands below where written and run from the WSL.

2. Set up AD

   • Create Domain Controller
   • Create Domain Joined VM
   • Configure AD with gMSA

3. Run Samples

   • IIS
   • IIS on Azure Service Fabric
   • MSMQ Monolith
   • MSMQ Persistent Volume on Host
   • MSMQ Persistent Volume on Host with Azure File SMB
   • MSMQ Persistent Volume on Host with Azure File SMB with Multiple Hosts

Links

References to concepts and additional supporting documentation.

1. Windows Containers Networking
2. Windows Containers Volumes
3. IIS on Docker Hub
4. GMSA Windows Containers
5. Deploying Windows Containers
6. Version Compatibility
7. NSG Ports
8. GMSA Set up Reference
9. Remote Debugging
10. SQL Server Setup Notes

Remote Debugging (Optional)

Remote debugging by installing VS debugger in the container. (Blog post in reference list above.)

Samples

To build the samples (using WSL) run the commands below (be sure to use your images in commands for each example). Alternatively you can use the provided docker images on my docker hub repo.

WSL

./auth-examples/build.sh <your-docker-repo>

Powershell

./auth-examples/build.ps1 <your-docker-repo>

To publish to a docker repository:

WSL

docker login
./auth-examples/push.sh <your-docker-repo>

Powershell

docker login
./auth-examples/push.ps1 <your-docker-repo>

---

Environment variables for MSMQ Samples

• QUEUE_NAME - This will be the path for the queue. E.g. for private queue .\private$\TestQueue for public queue worker\TestQueue
• DIRECT_FORMAT_PROTOCOL - This will be the direct format protocol. It can be something like OS, TCP, etc. See the direct format naming for appropriate protocols.
• USER - This will search for a UPN to try to impersonate.