cloudax/alpine-samba-server repository overview

[global]
    workgroup = WORKGROUP
    server role = standalone server
    security = user
    map to guest = Never
    disable netbios = yes
    server smb transports = tcp

[NAS]
    path = /mnt/nas
    read only = no
    guest ok = no
    valid users = youruser

services:
  samba:
    image: cloudax/alpine-samba-server
    ports:
      - "445:445/tcp"
    volumes:
      - ./smb.conf:/etc/samba/smb.conf:ro
      - ${HOME}/nas:/mnt/nas
    environment:
      USERNAME: youruser
      PASSWORD: change-this-password

docker compose up -d

# This baseline serves one authenticated share over TCP/445. The mounted host
# directory must be writable by the UID/GID assigned to each Samba user.

[global]
    workgroup = WORKGROUP
    server role = standalone server
    security = user
    passdb backend = tdbsam
    map to guest = Never
    unix charset = UTF-8

    # Keep these settings for TCP/445-only operation without NetBIOS.
    disable netbios = yes
    server smb transports = tcp

    # PROTOCOLS: explicit SMB2/SMB3-only policy. Modern Samba already disables
    # SMB1, but uncomment both lines to enforce this policy explicitly.
    # server min protocol = SMB2_02
    # server max protocol = SMB3

    # SIGNING: prevents tampering in transit but can reduce throughput.
    # server signing = mandatory

    # ENCRYPTION: use "desired" for compatible SMB3 clients or "required" to
    # reject any client that cannot encrypt. Enable only one line after tests.
    # server smb encrypt = desired
    # server smb encrypt = required

    # NETWORK: replace these LAN/VPN CIDRs with your actual client networks.
    # Do not enable it until you know the source addresses or you may lock out
    # valid clients.
    # hosts allow = 192.168.1.0/24 10.8.0.0/24

    # CONNECTIONS: disconnect idle clients after 30 minutes.
    # deadtime = 30

    # LOGGING: enable bounded per-client logs only while troubleshooting.
    # logging = file
    # log file = /var/log/samba/log.%m
    # max log size = 1000
    # log level = 1

[NAS]
    comment = NAS
    path = /mnt/nas
    browseable = yes
    read only = no
    guest ok = no
    valid users = youruser

    # MULTIPLE USERS: create the accounts using SAMBA_USERS below, then replace
    # the active line above with all users allowed to open this share.
    # valid users = alice bob viewer

    # READ-ONLY SHARE WITH EDITORS: replace "read only = no" above with this
    # line, then name the accounts allowed to write.
    # read only = yes
    # write list = alice bob

    # COLLABORATION: give editors the same GID in SAMBA_USERS and make the host
    # directory group-writable by it. The setgid bit preserves that group on
    # new files: chown -R :1001 ~/nas && chmod 2770 ~/nas

    # BLOCKED USERS: deny selected accounts when a broad valid-users list is
    # necessary.
    # invalid users = suspendeduser

    # FILE PERMISSIONS: inherit the host directory mode and ACLs for new files.
    # Enable when that host directory is already managed with suitable perms.
    # inherit permissions = yes
    # inherit acls = yes

    # SHARE LIMIT: cap simultaneous clients on this share.
    # max connections = 20

    # WINDOWS ACLS: keep Windows ACLs in filesystem xattrs. Requires xattr
    # support and backups compatible with xattrs.
    # vfs objects = acl_xattr
    # map acl inherit = yes
    # store dos attributes = yes

    # RECYCLE BIN: retain deletions in .recycle inside the share. Ensure there
    # is enough disk space. If ACL support is also enabled, combine modules as
    # "vfs objects = acl_xattr recycle" instead of using either line alone.
    # vfs objects = recycle
    # recycle:repository = .recycle
    # recycle:keeptree = yes

environment:
  SAMBA_USERS: >-
    [{"username":"alice","password":"alice-password","uid":"1001","gid":"1001"},{"username":"bob","password":"bob-password","uid":"1002","gid":"1001"}]