moby: New-SmbGlobalMapping don't continued working in Container

Hi, Just use the -RequirePrivacy $true along with the New-SMBGlobalMapping.

MUP cache seems to be a problem here. The MUP cache clears every 15 minutes and the credentials to the SMB File Share are not saved.

New commands looks like - New-SMBGlobalMapping -RemotePath \contosofileserver\share1 -LocalPath G: -RequirePrivacy $true

I was able to resolve this on Windows Server 2019 with these steps:

1. Create the New-SmbGlobalMapping (as z:)
2. Create a new folder on a local hard drive to “host” the share as a symbolic link (c:\hostfolder)
3. In powershell, use New-Item -ItemType SymbolicLink to from the z:\ to c:\hostfolder as ZDrive
4. Mount c:\hostfolder\ZDrive as volume in docker.

I’ve experienced the same issue when I was testing IIS containers with application which requires access to the resources on SMB shares (Azure File Share). For now, the workaround could be running the containers with hyper-v isolation mode where the bind mount to the mapped drive seems to be working without any issues.

The process and hyperv isolation modes accessing a docker daemon host file system using different logic: read more what could suggest that on process mode something on docker host is recognizing the container process as not permitted for accessing the share drive and blocks this access. The Windows Defender is disabled and no other security tool is running on VM so this looks really strange.

Output of docker version:

Client: Docker Engine - Enterprise
 Version:           18.09.5
 API version:       1.39
 Go version:        go1.10.8
 Git commit:        be4553c277
 Built:             04/11/2019 06:44:52
 OS/Arch:           windows/amd64
 Experimental:      false

Server: Docker Engine - Enterprise
 Engine:
  Version:          18.09.5
  API version:      1.39 (minimum version 1.24)
  Go version:       go1.10.8
  Git commit:       be4553c277
  Built:            04/11/2019 06:43:04
  OS/Arch:          windows/amd64
  Experimental:     false

Output of docker info:

Containers: 10
 Running: 1
 Paused: 0
 Stopped: 9
Images: 389
Server Version: 18.09.5
Storage Driver: windowsfilter
 Windows:
Logging Driver: json-file
Plugins:
 Volume: local
 Network: ics l2bridge l2tunnel nat null overlay transparent
 Log: awslogs etwlogs fluentd gelf json-file local logentries splunk syslog
Swarm: inactive
Default Isolation: process
Kernel Version: 10.0 17763 (17763.1.amd64fre.rs5_release.180914-1434)
Operating System: Windows Server 2019 Datacenter Version 1809 (OS Build 17763.437)
OSType: windows
Architecture: x86_64
CPUs: 4
Total Memory: 16GiB
Name: xxxxxx
ID: WMGI:BKNH:5MRT:7ETP:DVRB:4M2M:VGYC:2VIW:YXLL:HBP6:YHQ7:GL3G
Docker Root Dir: C:\ProgramData\docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false

Additional environment details (AWS, VirtualBox, physical, etc.):

Docker Host is Azure VM, Running Windows Server 2019 Datacenter Version 1809 (OS Build 17763.437)

PS C:\WINDOWS\system32> systeminfo

Host Name:                 xxxxxx
OS Name:                   Microsoft Windows Server 2019 Datacenter
OS Version:                10.0.17763 N/A Build 17763
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Member Server
OS Build Type:             Multiprocessor Free
Registered Owner:          N/A
Registered Organization:   N/A
Product ID:                00430-00000-00000-AA500
Original Install Date:     2/20/2019, 2:47:58 PM
System Boot Time:          4/25/2019, 2:24:02 PM
System Manufacturer:       Microsoft Corporation
System Model:              Virtual Machine
System Type:               x64-based PC
Processor(s):              1 Processor(s) Installed.
                           [01]: Intel64 Family 6 Model 79 Stepping 1 GenuineIntel ~2295 Mhz
BIOS Version:              American Megatrends Inc. 090007 , 6/2/2017
Windows Directory:         C:\windows
System Directory:          C:\windows\system32
Boot Device:               \Device\HarddiskVolume1
System Locale:             en-us;English (United States)
Input Locale:              en-us;English (United States)
Time Zone:                 (UTC) Coordinated Universal Time
Total Physical Memory:     16,384 MB
Available Physical Memory: 10,738 MB
Virtual Memory: Max Size:  18,816 MB
Virtual Memory: Available: 9,683 MB
Virtual Memory: In Use:    9,133 MB
Page File Location(s):     D:\pagefile.sys
Domain:                    xxxxx
Logon Server:              \\xxxxx
Hotfix(s):                 7 Hotfix(s) Installed.
                           [01]: KB4486553
                           [02]: KB4470788
                           [03]: KB4480056
                           [04]: KB4489907
                           [05]: KB4493478
                           [06]: KB4493510
                           [07]: KB4493509
Network Card(s):           3 NIC(s) Installed.
                           [01]: Microsoft Hyper-V Network Adapter
                                 Connection Name: Ethernet
                                 DHCP Enabled:    Yes
                                 DHCP Server:     xx.xx.xx.xx
                                 IP address(es)
                                 [01]: xx.xx.xx.xx
                                 [02]: xxxx::xxxx:xxxx:xxxx:xxxx
                           [02]: Mellanox ConnectX-3 Virtual Function Ethernet Adapter
                                 Connection Name: Ethernet 2
                                 DHCP Enabled:    No
                                 IP address(es)
                           [03]: Hyper-V Virtual Ethernet Adapter
                                 Connection Name: vEthernet (nat)
                                 DHCP Enabled:    No
                                 IP address(es)
                                 [01]: xx.xx.xx.xx
                                 [02]: xxxx::xxxx:xxxx:xxxx:xxxx
Hyper-V Requirements:      A hypervisor has been detected. Features required for Hyper-V will not be displayed.

I’m following these advises but still confused. Tried using both New-SmbGlobalMapping -RemotePath "\\10.0.0.4\data" -Credential $credentialObject -LocalPath Z: -FullAccess @( "NT AUTHORITY\SYSTEM", "NT AUTHORITY\NetworkService" ) -Persistent $true -RequirePrivacy $true

and

New-SmbGlobalMapping -RemotePath "\\10.0.0.4\share" -Credential $credentialObject -LocalPath Z: -RequirePrivacy $true

Then docker run -d --name webserver -v Z:\content\:C:\inetpub\wwwroot -p 80:80 microsoft/iis

But getting access denied if trying to go to that folder in the container (or 500 in the webserver). Accessing Z: in windows or writing files to it is no problem at all. 10.0.0.4, in this case, is a SAMBA server from an ubuntu machine. And mounting any local drive like D: works fine too.

EDIT: Ok, so this works for me as a workaround. I’m mounting the SMB drive INSIDE the container instead. I’m not sure what the drawbacks would be but it seems to work.

1. docker run -d --name webserver -p 80:80 microsoft/iis
2. docker exec -it webserver powershell
3. $StoragePassword = “secretpass”
4. [SecureString]$secureString = $StoragePassword | ConvertTo-SecureString -AsPlainText -Force
5. [PSCredential]$credentialObject = New-Object System.Management.Automation.PSCredential -ArgumentList “10.0.0.4\username”, $secureString
6. New-SmbGlobalMapping -RemotePath “\10.0.0.4\share” -Credential $credentialObject -LocalPath Z: -Persistent $true -RequirePrivacy $true
7. rm .\inetpub\wwwroot
8. New-Item -ItemType SymbolicLink -Path C:\inetpub\wwwroot -Target Z:\

@jjohnson-33 I tried your solution of using a SymLink but I got the same behavior which is that it works for about 12 minutes in my case and then something must change or timeout and I start getting Access denied.

Were there any other steps at all you might have took to get this working?

This is on Windows Server 2019 with DockerEE 19.03.2.

I ran into the similar problem. There were two kinds of result, The parameter is incorrect. and Access is denied.. I think this is a network-timeout related issue.

As long as I tested,

• The problem always reproduces if I sign out and wait for fifteen minutes.
• The problem doesn’t reproduce in the case of local machine’s share, like “\\–1.ipv6-literal.net\share1”.
• The problem also reproduces in the case of file server in the same LAN.
• The problem doesn’t reproduce if some containers on the same machine periodically access to the mounted volume.
• The problem doesn’t reproduce on AKS Kubernetes.
• The problem doesn’t reproduce in Hyper-V containers(As SheGe told in the above).
• The problem sometimes reproduce if I keep signing in and open an Explorer window.
• The problem reproduces in both ServerCore and Nano Server containers.

Something similar happens in my environment. A single container, after a running time, displays Access Denied.

In my case the service has a healtcheck enabled, then the container returns to air quickly.

but is normal users complain that they fell from the system because of this situation