adstec/irf-samba-dc repository overview

⁠Samba Active Directory Domain Controller for ADS-TEC IRF3000

Sample container by ADS-TEC Industrial IT: Samba 4.22 (Debian trixie) as Active Directory domain controller in the rootless Docker of the IRF3000 industrial firewalls.

Provides DNS, Kerberos, LDAP/LDAPS, Global Catalog, sysvol/netlogon for group policies and the RPC services for an OT segment. Clients reach the domain controller at the IRF LAN address; the IRF forwards the AD ports into the container.

Rootless Docker on the IRF cannot store the extended attributes and POSIX ACLs a standard Samba DC needs. This image stores the file ACLs of sysvol in a Samba database (vfs_xattr_tdb with stable vfs_fileid keys) and adapts the ID range to the rootless user mapping.

⁠Quick start

docker run -d --name samba-dc --hostname dc1 --restart unless-stopped \
  --network host -v samba-dc-data:/var/lib/samba \
  -e REALM=IRF.LAN -e DOMAIN=IRF -e DC_HOSTNAME=DC1 \
  -e HOST_IP=192.168.0.254 \
  adstec/irf-samba-dc
docker logs samba-dc | grep -A2 "Generated Administrator password"

No --privileged, no additional capabilities.

The IRF has to forward DNS, Kerberos, RPC, NetBIOS, LDAP, SMB, kpasswd, LDAPS, Global Catalog and the dynamic RPC range to the container. Setup, port forwarding, backup rules and an assessment of the database-based ACL storage are described in the Docker Application Note of ADS-TEC Industrial IT.

⁠Links

• Source files on GitHub⁠ - Dockerfile, IRF setup script and README
• IRF3000 industrial firewall⁠ - product page of ADS-TEC Industrial IT

⁠Platforms and license

linux/arm64 (IRF3000), linux/arm/v7. Samba is licensed under GPLv3.