First Commit

image/Dockerfile

@@ -0,0 +1,91 @@
+# syntax=docker/dockerfile:1.7
+# -------------------------------------------------------------------------------------
+# Samba 4.22 Active Directory Domain Controller on Debian 13 (trixie)
+#
+# One `samba` process serves the whole DC role:
+#   DNS 53          LDAP 389 / LDAPS 636      Global Catalog 3268 / 3269
+#   Kerberos 88     kpasswd 464               RPC epmapper 135     SMB 445 (SYSVOL/NETLOGON)
+#   MS-SNTP 123  (Windows clients sync time from the DC after domain join)
+#
+# Build:   docker build -t local/samba-ad-dc:4.22-debian13 -f image/Dockerfile .
+# -------------------------------------------------------------------------------------
+FROM debian:trixie-slim
+
+# Pin every Samba-built package to the SAME version string (they carry exact-version
+# depends on each other, so pinning only `samba` produces unsatisfiable deps once the
+# archive carries two point releases). Empty => whatever trixie+security currently offer.
+ARG SAMBA_VERSION=2:4.22.11+dfsg-0+deb13u1
+
+LABEL org.opencontainers.image.title="samba-ad-dc" \
+      org.opencontainers.image.description="Samba AD Domain Controller (Windows 11 join compatible) on Debian 13" \
+      org.opencontainers.image.source="https://github.com/local/samba-ad-dc" \
+      org.opencontainers.image.licenses="GPL-3.0-or-later"
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Package postinsts must never try to start services during an image build.
+RUN printf '#!/bin/sh\nexit 101\n' > /usr/sbin/policy-rc.d && chmod 0755 /usr/sbin/policy-rc.d
+
+RUN set -eux; \
+    pin=""; \
+    if [ -n "${SAMBA_VERSION}" ]; then pin="=${SAMBA_VERSION}"; fi; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends \
+        "samba${pin}" \
+        "samba-ad-dc${pin}" \
+        "samba-common${pin}" \
+        "samba-common-bin${pin}" \
+        "samba-dsdb-modules${pin}" \
+        "samba-ad-provision${pin}" \
+        "python3-samba${pin}" \
+        "winbind${pin}" \
+        python3-setproctitle \
+        krb5-user \
+        libsasl2-modules-gssapi-mit \
+        ldap-utils \
+        smbclient \
+        bind9-dnsutils \
+        python3-dnspython \
+        ca-certificates \
+        openssl \
+        iproute2 \
+        procps \
+        tzdata; \
+    rm -f /usr/sbin/policy-rc.d; \
+    rm -rf /var/lib/apt/lists/*; \
+    # The stock smb.conf/krb5.conf shipped by the packages must NOT exist:
+    # the entrypoint uses their absence to detect a virgin data volume, and named
+    # volumes would otherwise be seeded with the stock (non-AD) config.
+    rm -f /etc/samba/smb.conf /etc/krb5.conf; \
+    mkdir -p /etc/samba /var/backups/ad-dc /run/ad-secrets; \
+    # Leave the AD state dir EMPTY. Docker seeds named volumes from the image's content,
+    # and `samba-tool domain backup restore` refuses a non-empty target dir. Provisioning
+    # creates these directories itself.
+    rm -rf /var/lib/samba; \
+    mkdir -p /var/lib/samba; \
+    # sanity: this image is useless without the AD DC bits
+    test -x /usr/sbin/samba; \
+    /usr/bin/samba-tool --help >/dev/null; \
+    # the AD schema lives in a separate Debian package (samba-ad-provision) - fail the
+    # build here rather than at first-run provisioning
+    ls /usr/share/samba/setup/ad-schema/AD_DS_Attributes_Windows_Server_v1903.ldf >/dev/null; \
+    # ldap-client GSSAPI and smbclient are used by the verification scripts
+    ls /usr/lib/*/sasl2/libgssapiv2.so >/dev/null; \
+    command -v smbclient >/dev/null; \
+    command -v kvno >/dev/null; \
+    samba -V
+
+COPY image/ad-entrypoint.sh /usr/local/bin/ad-entrypoint
+COPY image/ad-healthcheck.sh /usr/local/bin/ad-healthcheck
+COPY image/ad-dnsupdate.sh /usr/local/bin/ad-dnsupdate
+RUN chmod 0755 /usr/local/bin/ad-entrypoint /usr/local/bin/ad-healthcheck /usr/local/bin/ad-dnsupdate
+
+# Documentation only (real ports come from the network mode you choose).
+EXPOSE 53/tcp 53/udp 88/tcp 88/udp 123/udp 135/tcp 137/udp 138/udp 139/tcp \
+       389/tcp 445/tcp 464/tcp 464/udp 636/tcp 3268/tcp 3269/tcp
+
+# start_period is generous: first-run provisioning takes ~30-90s.
+HEALTHCHECK --interval=30s --timeout=20s --start-period=120s --retries=4 \
+    CMD ["/usr/local/bin/ad-healthcheck"]
+
+ENTRYPOINT ["/usr/local/bin/ad-entrypoint"]