CCG Custom Plugin

Open

#544 opened on Oct 8, 2024 25 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 35/100

Issue type: Bug
Clarity: Needs clarification
Activity status: Active
Tech stack: docker, powershell
Domain: devops, infrastructure

Research direction

Start by reproducing the Docker command with the Windows Server Core ltsc2022 image and reviewing the Microsoft-Windows-Containers-CCG/Admin log alongside the Windows 11 and Docker 27.2.0 configuration. Done means identifying why the non-domain-joined container fails with the reported HCS error and documenting how to obtain or expose a more detailed diagnostic.

Written by the indexing model from the issue text.

Description

gMSA question transfer

What is your question?
I have been setting up a custom CCG plugin on my local machine to run a windows container as non-domain joined.

When starting the container, using the following command:
docker run -it --security-opt "CredentialSpec=file://gmsa.json" mcr.microsoft.com/windows/servercore:ltsc2022 powershell
I can see the following message in the Microsoft-Windows-Containers-CCG/Admin log:
Container Credential Guard instantiated the plugin: {3C0BED28-38FC-42A9-A6AC-967A4839DF61}

However the container doesn't start, but just gives the following error:
docker: Error response from daemon: hcs::CreateComputeSystem 566516d3912884945d031f7982c6fea1977f22c5d07d40766173354444fb7fc5: winapi error #3489661095.

What can I do to get a more detailed information regarding the error, as it is quite difficult to understand what is failing.

Configuration:

Edition: Windows 11
Container engine: docker
Container Engine version: 27.2.0

Dominant language: PowerShell
Stars: 551
Forks: 76
PR merge metrics: No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.