Attching gMSA credentials to windows container failed.

Dinesh Sharma 21

We generated a .json file using New-CredentialSpec command.
when we try to attach it to a windows container it gives error "docker: Error response from daemon: security option not supported: CredentialSpecs." Google for this error but did not find any relevant information to resolve this. Some Info About the env:
PS C:\Users> docker images REPOSITORY TAG IMAGE ID CREATED SIZE
gitlab/gitlab-runner-helper x86_64-2ebc4dc4-servercore1809 4049173eb4be 2 days ago 5.8GB
mcr.microsoft.com/windows/servercore ltsc2019 31902e4b25a6 2 weeks ago 5.21GB
mcr.microsoft.com/windows/servercore 1809 623c6707de60 2 weeks ago 5.21GB
mcr.microsoft.com/windows/nanoserver 1809 f524b7260f3c 3 weeks ago 252MB PS

C:\Users> docker --version Docker version 19.03.14, build e820475

Dinesh Sharma 21 Reputation points

2021-02-25T03:53:43.25+00:00

Command we used for attaching gMSA credentials is -
docker run -it --security-opt "--security-opt=credentialspec=file://labnet_win_docker.json" mcr.microsoft.com/windows/servercore:ltsc2019 powershell
prmanhas-MSFT 17,901 Reputation points Microsoft Employee

2021-03-01T07:13:12.637+00:00

@Dinesh Sharma Just following up to check if you need any further help on the issue or not?

Do let me know in case of any queries.

Thanks
Dinesh Sharma 76 Reputation points Microsoft Employee

2021-03-01T07:23:56.643+00:00

Hi @prmanhas-MSFT
Thank you for the response.

How to build an image with "Group Managed Server Accounts"? Basically I am calling docker image from another tool (GitLab) that just pick up the image.

I usually run it on host with below command -

docker run -it --security-opt "--security-opt=credentialspec=file://labnet_win_docker.json" mcr.microsoft.com/windows/servercore:ltsc2019 powershell

How can I include " --security-opt "--security-opt=credentialspec=file://labnet_win_docker.json" this part of command while building the image?

Thanks.
prmanhas-MSFT 17,901 Reputation points Microsoft Employee

2021-03-01T12:07:17.08+00:00

@Dinesh Sharma Thank you for the details!!!

I have reached out to our internal team on this and will keep you posted once I have an update.

Thanks
Dinesh Sharma 76 Reputation points Microsoft Employee

2021-03-01T18:35:47.917+00:00

Thank you @prmanhas-MSFT
Dinesh Sharma 76 Reputation points Microsoft Employee

2021-03-02T11:41:00.583+00:00

Hi @prmanhas-MSFT
Any luck on above query?

Thanks
prmanhas-MSFT 17,901 Reputation points Microsoft Employee

2021-03-04T05:33:43.037+00:00

@Dinesh Sharma I am yet to get information from internal team. Trying to expedite issue from my side as well.Thank you for your patience over the matter.
Dinesh Sharma 21 Reputation points

2021-03-16T08:41:05.35+00:00

Hi @prmanhas-MSFT
Did you get any update on this?

Looking forward to hear from you soon.

Thanks

Accepted answer

Dinesh Sharma 76 Reputation points Microsoft Employee

2021-02-26T08:04:29.577+00:00

Uninstall the docker from the server and installed docker desktop on windows server and then switched it windows container mode solve the issue.
I am still not sure was was the issue but for now it is resolved.
Please sign in to rate this answer.
Dinesh Sharma 76 Reputation points Microsoft Employee

2021-03-01T11:31:44.507+00:00

Hello,
Need a small help here as well -

I have build an image from DockerFile, everything else works but --security-opt does seems to be working.

Build command:
docker build --security-opt "credentialspec=file://labnet_svcdocker.json" -t dswindowsservercore1809 .

DockerFile:

Getting baseImage

FROM mcr.microsoft.com/windows/servercore:1809

SHELL ["powershell"]

Successfully build the image but --security-opt does seems to be working.

Would appreciate if I get some guidance on this. Thank you!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Attching gMSA credentials to windows container failed.

Getting baseImage

0 additional answers

Your answer