Run Container Jobs as specific User

问题

We're trying to get our first containerized build running in Azure Devops Server.

The build runs fine in the container, but, unfortunately, it needs to access resources on another server. As such, I need this to be running as a domain user (GMSA account will work) so that it can authenticate the network share to access those resources.

I can't seem to find any documentation on running a containerized build as a specific user.

Can anyone point me to how to setup the yml for passing credentials, or gmsa account? That would be great.

Thanks in advance

回答1:

Alright... so I figured it out.

First you have to create a credential spec

In powershell New-CredentialSpec -AccountName GMSAAccountName

Then add this in the yml file beneath the container declaration:

options: --security-opt "credentialspec=file://Domain_GMSAAccountName.json"

That was it... and now it works.

回答2:

Have you tried using PAT(Personal Access Token) to run in agent build?

When setup asks for your authentication type, choose PAT. Then paste the PAT token you created into the command prompt window. https://docs.microsoft.com/en-us/azure/devops/pipelines/agents/v2-windows?view=azure-devops#permissions

来源：https://stackoverflow.com/questions/57150124/run-container-jobs-as-specific-user