stanback / alpine-samba

Alpine Linux + Samba Docker image

Samba 4 + Alpine Linux Docker Image

This repository contains a basic Dockerfile for installing Samba 4 on Alpine Linux.

This is a solution for network filesharing. I use it on my self-built, zfs-based NAS server and connect up OSX, Linux, and Windows clients.

I was previously running Netatalk for Apple AFP support, however I've found that Samba works reasonably well for me and it appears that Apple may start prefering Samba over AFP.

Create Samba Configuration

Create the smb.conf configuration file. The following is an example:

[global]
  workgroup = WORKGROUP
  server string = %h server (Samba, Alpine)
  security = user
  map to guest = Bad User
  encrypt passwords = yes
  load printers = no
  printing = bsd
  printcap name = /dev/null
  disable spoolss = yes
  disable netbios = yes
  server role = standalone
  server services = -dns, -nbt
  smb ports = 445
  ;name resolve order = hosts
  ;log level = 3

[Dozer]
  path = /dozer
  comment = ZFS
  browseable = yes
  writable = yes
  valid users = carol

[Shared]
  path = /share
  comment = Shared Folder
  browseable = yes
  read only = yes
  write list = carol
  guest ok = yes

For added security, you can control which interfaces Samba binds to and which networks are allowed access. This is important if you're using --net=host because Samba will bind to all interfaces by default and may bind to an interface you hadn't intended. Add to the [global] section:

  hosts allow = 192.168.11.0/24 10.0.0.0/24
  hosts deny = 0.0.0.0/0
  interfaces = 192.168.11.0/24 10.0.0.0/24
  bind interfaces only = yes

I'm experimenting with the following settings (in the [global] section) to add default permissions for windows clients, to enable extended features for OSX clients, to enable recycle bins, and to be able to use ZFS's posix-style ACLs.:

  create mask = 0664
  directory mask = 0775
  veto files = /.DS_Store/
  nt acl support = no
  inherit acls = yes
  ea support = yes
  vfs objects = catia fruit streams_xattr recycle
  acl_xattr:ignore system acls = yes
  recycle:repository = .recycle
  recycle:keeptree = yes
  recycle:versions = yes

Running

Add/update the -v volumes below to match the shares defiend in your smb.conf file and run:

docker run -dt \
  -v $PWD/smb.conf:/etc/samba/smb.conf \
  -v $PWD/dozer:/dozer \
  -v $PWD/share:/share \
  -p 445:445 \
  --name samba \
  --restart=always \
  stanback/alpine-samba

You can replace -p 445:445 with --net=host above if you want to use your host's networking stack instead of Docker's proxy but it's not necessary. You can append additional arguments for smbd or append --help for a list of options.

Add Users

Once the server is running, you can add your users using the following:

docker exec -it samba adduser -s /sbin/nologin -h /home/samba -H -D carol
docker exec -it samba smbpasswd -a carol

Check Status

Check the logs for startup errors (adjust log level in smb.conf if needed), then connect a client and check the status:

docker logs -f --tail=100 samba
docker exec -it samba smbstatus

SSDP / ZeroConf Service Discovery

For auto-discovery on Linux and OSX machines, we can use the multicast-based mDNS and DNS-SD protocls (also known as Bonjour) using Avahi daemon.

The main use-case for this project is for a standalone, personal or small workgroup file server with a majority of clients on OSX or Linux. I've made a choice to not support legacy protocols, including NetBIOS, WINS, and the old Samba port 139. Some of the issues with NetBIOS include excessive broadcast packets, lack of IPV6 support, and easy spoofing.

Because of this, it means:

• For Windows clients, your Samba server won't be shown under network browsing. Microsoft has been adding support for DNS-SD functionality recently, so it's possible they will eventually support finding Samba shares using mDNS and DNS-SD. In the meantime, you can still connect directly to the IP or hostname to use the shares.

• Samba can act as a domain controller or join an NT domain but that is not supported with this configuration. I may put together a separate project that supports NetBIOS/WINS and can either join or act as a domain controller.

Configuring Avahi Services

To announce Samba on your network, setup a file called smb.services (below) in a new folder services/. You can announce more services here, such as SSH or SFTP.

<?xml version="1.0" standalone='no'?>
<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
<service-group>
 <name replace-wildcards="yes">%h</name>
 <service>
   <type>_smb._tcp</type>
   <port>445</port>
 </service>
 <service>
   <type>_device-info._tcp</type>
   <port>0</port>
   <txt-record>model=RackMac</txt-record>
 </service>
</service-group>

Running

docker run -d \
  -v $PWD/services:/etc/avahi/services \
  --net=host \
  --name=avahi \
  --restart=always \
  stanback/alpine-avahi

It's possible to not use --net=host, and instead specify the port mapping -p 5353:5353/udp and optionally giving your Docker container a hostname with --hostname=myhostname but I haven't gotten it to work correctly.

Client Configuration

Nothing special should need to happen on your clients, below are some settings that may be tweaked.

OSX

Disable writing .DS_Store files on network shares:

defaults write com.apple.desktopservices DSDontWriteNetworkStores true

Disable netbios (be careful with this one):

sudo launchctl disable system/netbiosd

alpine-samba's Issues

Users are not persisted

Having a hard time getting my users to stick after restarting the service.

Are there any elegant solutions?

little "s" to remove from readme

Hi here, thanks for the work!

Small note, in the avahi example provide on the readme, it is said to have the a file called "smb.services" created, beware is has to be "smb.service" with no "s" for avahi to recognize and use it.

Have a great day!

samba does not start

Hi there,
thanks for your docker files. I tried them today an ran into an issue. Samba would fail to start with the following message:

exit_daemon: STATUS=daemon failed to start: Failed to create session, error code 1

I found this info on stackoverflow: https://stackoverflow.com/questions/49357524/docker-alpine-samba-does-not-start
and could get it to run by using this command instead of the default one:

smbd --foreground --log-stdout --no-process-group

Container closes after a few seconds

Hey, I'm trying your docker image but on my host, it's always closing after a few seconds.
The command line I use:
docker run
-p 192.168.1.42:445:445
-d
--name=samba
--label namespace=Fileserver
stanback/alpine-samba:latest

Also the same if I mount a smb.conf
docker run
-v /vol_raidz1/docker/persistend/samba/smb.conf:/etc/samba/smb.conf
-p 192.168.1.42:445:445
-d
--name=samba
--label namespace=Fileserver
stanback/alpine-samba:latest

Any ide why this happens?

Cannot be discovered by Time Machine

Hi,

I'm running the docker and I can mount the shared folders but Time Machine cannot discover the disk. Is there any additional setup I should do?