Ask questions.Net ASP.Net Webapp in Container loose Primary Domain Trust randomly after some days runtime

.Net ASP.Net and .Net Core ASP Webapplication in Container loose Primary Domain Trust randomly after some days of runtime

All Containers use the same GSMA Account(Credspec File), and Applications authenticate with kerberos.

After runtime of like 7 - 14 Days randomly or restart of a big bunch of container ~15 some application loose primary domain trust

In the Container itself, the Domain Trust seems to be there.

  • nltest /parentdomain is Successfully

  • Test-ComputerSecureChannel is also ok

Steps to get the Application working again

Restart the Container Instance(sometimes a double restart is needed)

Or we restart netlogon service in the container, then it starts working again!

Steps to reproduce the issue:

Hard do reproduce, when we restart all containers, randomly some of them got the domain trust error

Describe the results you received:

web application throw error on .net call .IsUserInRole(xxx), doesnt matter if code is in Core or full framework and its also not .Net Version Depending

Got follow trace

An unhandled exception has occurred: The trust relationship between this workstation and the primary domain failed,
System.ComponentModel.Win32Exception (0x80004005): The trust relationship between this workstation and the primary domain failed
,at System.Security.Principal.NTAccount.Translate(IdentityReferenceCollection sourceAccounts, Type targetType, Boolean& someFailed)
,at System.Security.Principal.NTAccount.Translate(IdentityReferenceCollection sourceAccounts, Type targetType, Boolean forceSuccess)
,at System.Security.Principal.WindowsPrincipal.IsInRole(String role)

Describe the results you expected:

Domain Trust is stable with GMSA Accounts

Output of docker version:

 Version:      18.05.0-ce
 API version:  1.30 (downgraded from 1.37)
 Go version:   go1.9.5
 Git commit:   f150324
 Built:        Wed May  9 22:12:05 2018
 OS/Arch:      windows/amd64
 Experimental: false
 Orchestrator: swarm

  Version:      17.06.2-ee-14
  API version:  1.30 (minimum version 1.24)
  Go version:   go1.8.7
  Git commit:   6345dd7
  Built:        Thu Jun 21 18:28:51 2018
  OS/Arch:      windows/amd64
  Experimental: false

Output of docker info:

Containers: 21
 Running: 21
 Paused: 0
 Stopped: 0
Images: 23
Server Version: 17.06.2-ee-14
Storage Driver: windowsfilter
Logging Driver: json-file
 Volume: local
 Network: l2bridge l2tunnel nat null overlay transparent
 Log: awslogs etwlogs fluentd json-file logentries splunk syslog
Swarm: inactive
Default Isolation: process
Kernel Version: 10.0 14393 (14393.2339.amd64fre.rs1_release_inmarket.180611-1502)
Operating System: Windows Server 2016 Standard
OSType: windows
Architecture: x86_64
CPUs: 4
Total Memory: 8GiB
Name: fj-v-docker1
Docker Root Dir: C:\ProgramData\docker
Debug Mode (client): false
Debug Mode (server): false
Experimental: false
Insecure Registries:
Live Restore Enabled: false

Updated Windows Server 2016 in a VMWare Cluster all Containers with multiple .Net Framwork and .Net Core Containers

Provision the container with ansible - docker_container module

All Containers have a dedicated IP with transparent docker network



Answer questions daBONDi

@Faheemitian you also reverseproxy with haproxy infront?


Related questions

Swarm restarts all containers hot 2
can not successfully install docker-ce on ubuntu 16.04 ? why ,Can you help me? hot 1
OCI runtime exec failed: exec failed: cannot exec a container that has stopped: unknown hot 1
Allow COPY command's --chown to be dynamically populated via ENV or ARG hot 1
windowsRS1 and windowsRS5-process are failing due to "Unable to delete '\gopath\src\\docker\docker" hot 1
Panic: runtime error: invalid memory address or nil pointer dereference hot 1
Error response from daemon: rpc error: code = DeadlineExceeded desc = context deadline exceeded hot 1
one container in the overlay network not available hot 1
Containers on overlay network cannot reach other containers hot 1
[Windows] windowsfilter folder impossible to delete hot 1
swarm node lost leader status hot 1
New-SmbGlobalMapping don't continued working in Container hot 1
failed to export image: failed to create image: failed to get layer: layer does not exist hot 1
"docker stack deploy">"rpc error: code = 3 desc = name must be valid as a DNS name component" hot 1
runc regression - EPERM running containers from selinux hot 1
Github User Rank List