Domain Join as computer account about windows-containers

[vrapolinario]

This issue is being evaluated as we plan for updates on gMSA. Given the nature of the Windows containers composition, we don't plan to provide support for domain-join. We do however want to solve for this: Allow containers to be domain joined even if the host is not.

Assigning the appropriate people and providing the right tags.

[ohault]

There is a big confusion here. To bring a real answer to this question, the current single-tenant LSASS architecture should be reconsidered completely. As long as, a real kernel implementation of namespaces or sub-env will not be designed, all answers will be pseudo solutions. ReactOS could be a good starting point to illustrate how to implement it.

[msftbot]

This issue has been open for 30 days with no updates.
@vrapolinario, please provide an update or close this issue.

[msftbot]

This issue has been open for 30 days with no updates.
@vrapolinario, please provide an update or close this issue.

[msftbot]

This issue has been open for 30 days with no updates.
@vrapolinario, please provide an update or close this issue.

[msftbot]

This issue has been open for 30 days with no updates.
@vrapolinario, please provide an update or close this issue.

[msftbot]

This issue has been open for 30 days with no updates.
@vrapolinario, please provide an update or close this issue.

[immuzz]

@mapalko Can you comment here on the plans for gMSA and if this would be accommodated?

[vrapolinario]

We recently released a blog post with some new information on gMSA updates. Please check: https://techcommunity.microsoft.com/t5/containers/what-s-new-for-windows-containers-on-windows-server-2022/ba-p/2167036

As part of the update, we will support gMSA on non-domain joined container hosts. I believe this satisfies the requirements from this issue. We'll close the issue for now.