Samba Conductor container images
Container images of Samba Conductor, built from the released and signed
packages, with compose files for a lab or evaluation stack. The images are
published on Docker Hub (docker.io/openbasalt/<image>) and on the GitHub
Container Registry (ghcr.io/openbasalt/<image>), with the same digests in
both. The guide to running them (networking, persistence, time,
permissions, secrets, backups, upgrades, Podman and SELinux, verification)
is containers.md
in the documentation repository.
| Image | Contents | Runs as | Support |
|---|
samba-conductor-dc | Samba AD DC (Debian 13 packages), chronyd, conductor-helper, conductor-backup (for restores), sc-dc-init | root in the container, nine capabilities | preview: labs, evaluation and small single-site domains; packages stay the recommended way for production DCs |
samba-conductor | conductor, Samba's samba-tool for GPO create and delete | UID 2093, no capabilities | same as the packages |
samba-conductor-idp | conductor-idp (distroless) | UID 2095, no capabilities | same as the packages |
samba-conductor-sync | conductor-sync (distroless) | UID 2094, no capabilities | same as the packages |
samba-conductor-backup | conductor-backup (distroless) | UID 2097, no capabilities | same as the packages |
samba-conductor-provisioner | conductor-provisioner (distroless): the delegated AD account behind invitations, password resets by e-mail and the Google-first plan | UID 2098, no capabilities | same as the packages |
Every container runs with a read-only root file system, no-new-privileges
and no privileged mode. The DC never gets CAP_SYS_ADMIN or CAP_SYS_TIME:
NT ACLs are kept in the user.NTACL extended attribute, and chronyd serves
the host's clock (-x) signed through Samba's ntp_signd. Passwords and
keys reach the containers only as files, never in environment variables.
Layout
| Path | What |
|---|
images/Containerfile | the six images (targets dc, conductor, idp, sync, backup, provisioner) |
versions.env | the component package versions, the Debian snapshot and the base image digests a build uses |
scripts/fetch-debs.sh | downloads the packages and verifies them: the APT repository's signed InRelease (the OpenBasalt packages subkey, keys/), the Packages index, each .deb |
cmd/sc-dc-init | the DC image's entry point (PID 1): first boot, refusals, supervision, health |
cmd/sc-setup | the one-shot configuration of the service containers |
compose/ | compose.yaml (a single DC with conductor) and add-ons (addons/) |
build-local.sh | local builds (nothing is pushed) |
scripts/ci-smoke.sh | the smoke test of CI and releases |
scripts/release-*.sh | the release steps: pinned tools, scans and SBOMs, tags, publishing |
vex/ | scan exceptions (OpenVEX) |
The DC entry point
sc-dc-init decides from a state file on the data volume what a start does:
| Volume | Start |
|---|
| empty | SC_MODE: provision (a new domain), join (an additional DC), restore (a full-forest recovery from a conductor-backup archive); run is refused with instructions |
| domain complete | runs it; SC_MODE is ignored; a different SC_REALM or SC_HOSTNAME is refused |
| first boot unfinished | refused; SC_RETRY_FIRST_BOOT=1 wipes what that first boot created and starts again |
| Samba data without a state file | refused (an existing data directory is never adopted) |
At every start it also writes the image's options into smb.conf, renews
the self-signed certificates when due, and compares the image's Samba with
the version that last ran the domain: a patch update starts and runs a
read-only samba-tool dbcheck --cross-ncs; a minor update needs
SC_ALLOW_SAMBA_UPGRADE=<new minor> and takes an offline copy of
private/ and sysvol/ first; a downgrade is refused. Unknown SC_*
variables and variables that look like secrets (*PASSWORD*, *SECRET*,
*_KEY) are refused.
Other commands: sc-dc-init health (the healthcheck), sc-dc-init account idp|sync|backup (service accounts; backup gets the three replication
rights and nothing else), sc-dc-init account provisioner [--ou DN]... [--google-first] (conductor-provisioner's account: sensitive, a member of
Domain Users only, with the reset-password entries inherited by the user
objects of each managed OU, default OU=People,<domain>, created when
missing; --google-first adds the rights of the Google-first plan),
sc-dc-init dns-name NAME...,
sc-dc-init show-initial-password and forget-initial-password.
Quick start (lab)
cd compose
cp .env.example .env # domain, NetBIOS name, host name, this host's address, image tag
./make-secrets.sh # random passwords in ./secrets (0600)
docker compose up -d dc # provisions the domain (about a minute)
docker compose run --rm conductor-setup
docker compose up -d
The images come from SC_IMAGE_PREFIX (docker.io/openbasalt/ in
.env.example; ghcr.io/openbasalt/ works the same) with the tag
SC_TAG, which defaults to this checkout's release (IMAGE_VERSION in
versions.env) and never to latest; set SC_TAG=testing to try a
release under test, or an empty SC_IMAGE_PREFIX and the --tag of
build-local.sh for local builds. conductor-setup waits for the DC to
be healthy and prints a one-time enrollment link for the first
administrator. Until it has run, conductor is created but not started: the
one-shot conductor-check stops docker compose up -d with an error, and
docker compose logs conductor-check says what to run. Add-ons are listed
in COMPOSE_FILE in .env (addons/idp.yaml, sync.yaml, backup.yaml,
provisioner.yaml, mail.yaml, host-network.yaml, ipvlan.yaml, macvlan.yaml, provided-tls.yaml,
join.yaml, restore.yaml); each file starts with the steps it needs.
The idp, sync, backup and provisioner add-ons hold their service back the
same way until its setup one-shot has run (idp-check, sync-check,
backup-check, provisioner-check, each naming the setup command), and
idp-setup, sync-setup and provisioner-setup wait for a healthy DC.
Invitations and password resets by e-mail need provisioner.yaml (its
provisioner-setup also lists conductor's role groups as privileged for
conductor-provisioner) and mail.yaml (mail-setup writes conductor's
[mail] section; run it again when the relay changes).
ipvlan.yaml and macvlan.yaml put the stack's network on a host
interface (SC_NET_PARENT, SC_NET_MODE, SC_NET_SUBNET,
SC_NET_GATEWAY, SC_NET_RANGE), with fixed addresses for the DC and
conductor on the LAN.
Building
./build-local.sh # the packages pinned in versions.env, from the APT repository
./build-local.sh --source local --debs DIR # packages you built (make package), with their SHA256SUMS
./build-local.sh --platform linux/arm64 --output none
make check runs the Go gates of sc-dc-init and sc-setup.
Releases
Images are released by the release workflow on a version tag, built from
the component packages pinned in versions.env, scanned, signed with
cosign (keyless) and published to Docker Hub and GHCR with SBOMs and
provenance attestations, first under the immutable tag and testing only.
Once that release has been tested, the promote workflow gives the same
digests the version tags (X.Y.Z, X.Y, X) and latest. How it works,
the settings it needs and how to verify an image: RELEASING.md.
License
Apache License 2.0, see LICENSE and NOTICE. The images
also contain Debian packages under their own licenses
(images/IMAGE-LICENSES).
