Linux容器访问Windows域服务器的身份认证问题

Hey there! Let's break down how to solve your problem, starting with your preferred option: running the container as a specified user.

Depending on how you're deploying your containers (plain Docker, Docker Compose, or Kubernetes since you mentioned a Pod), here's how to set it up:

1. 用Docker Run命令指定用户 #

• If the user already exists in your container image, just add the --user flag when starting the container:

  docker run --user <username-or-UID> your-app-image
  

  For example: docker run --user appuser my-business-app
• If the user doesn't exist in the image, you can pre-create it in your Dockerfile so the image uses this user by default:

  # Create a non-root user with a home directory
  RUN useradd -m appuser
  # Switch to this user for all subsequent commands
  USER appuser
  

2. 用Docker Compose指定用户 #

Add the user field to your service definition in docker-compose.yml:

services:
  your-app-service:
    image: your-app-image
    # Use a username or UID:GID pair (e.g., 1000:1000 for a common non-root user ID)
    user: appuser

3. 在Kubernetes Pod中指定用户 #

Since you mentioned a Pod, you'll configure this via the Pod's securityContext in your YAML manifest:

apiVersion: v1
kind: Pod
metadata:
  name: your-business-pod
spec:
  containers:
  - name: your-app-container
    image: your-app-image
    securityContext:
      runAsUser: 1000  # Replace with your target user's UID
      runAsGroup: 1000 # Match with the user's GID
      # Optional: Enforce non-root execution for security
      runAsNonRoot: true

额外：访问AD域Windows服务器的特殊配置

If your Windows server is part of an Active Directory domain, you'll need to handle Kerberos authentication to let the container's user access domain resources. Here's a quick approach:

• Mount your host's Kerberos config file (/etc/krb5.conf) into the container
• Pass the domain user's credentials (via environment variables or secrets) when starting the container
• Use an image pre-configured for AD integration if possible, to avoid manual setup hassle

If running as a specified user doesn't work for your use case, you can adjust settings on the Windows side to allow access:

• Firewall rules: Add an inbound rule in Windows Firewall to allow traffic from your Docker host/container network to the target service port (e.g., SMB, your app's custom port)
• Resource permissions: Grant access rights to the user account (or Docker host's machine account) on the Windows server's resources (shared folders, application endpoints, etc.)
• Network connectivity: Ensure your Docker container's network can reach the Windows server's network. If using a custom Docker bridge, verify routing between the bridge subnet and the Windows server's subnet; using host network mode will let the container use the host's network directly.

内容的提问来源于stack exchange，提问作者Eitam Ring