How to run application under secondary GMSA in Docker container?

Leonard de Ruijter

6/28/24, 7:19 PM

The Microsoft documentation about creating GMSA's for Docker containers reads:

Containers can also be configured with additional gMSAs, in case you want to run a service or application in the container as a different identity from the container computer account.

This is exactly what I want to do. So I created a credential spec like this:

New-CredentialSpec -AccountName WebApp01 -AdditionalAccounts LogAgentSvc

Now I want to run an application under the LogAgentSvc service account, but how can I do that? When reading the Configure your app docs, you aren't supposed to run an application under a GMSA directly. Instead, you are advised to run the application (or service) under "NT AUTHORITY\NETWORK SERVICE". Whilst the introduction of the docs on that page mention the ability to run an application under a secondary GMSA, the steps to do that aren't outlined. I have tried to run the service in question under the GMSA directly, but that gives me an usual logon error.

0 + 0

docker

managed-service-accounts

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How to run application under secondary GMSA in Docker container?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.