samba

Samba (smbd) container image for the TechnoTUT NAS. It runs on our Kubernetes cluster; the manifests live in TechnoTUT/Infra under k8s/manifest/nas/.

Image: ghcr.io/technotut/samba

What is in the image

• Based on debian:trixie-slim, with Samba from the Debian packages.
• Runs smbd only, on TCP 445. NetBIOS (nmbd), winbind and the AD DC are not used.
• The image holds no configuration and no accounts. Both are supplied at runtime.

Usage

Path	Contents
/etc/samba/smb.conf	Samba configuration. Mount over the default (a ConfigMap on Kubernetes).
/run/secrets/samba/smbpasswd	Accounts in smbpasswd format (a Secret on Kubernetes). Override the path with SAMBA_ACCOUNTS_FILE.

The accounts file has one account per line. Lines exported from an existing Samba server with pdbedit -L -w can be used as is, so no plaintext password is stored.

<user>:<uid>:<LM hash>:<NT hash>:[U          ]:LCT-<hex>:

At startup, the entrypoint creates a UNIX user for each account, with a primary group of the same name and a GID equal to the UID, and imports the accounts into Samba's password database. The database exists only inside the container, so a password changed inside it (for example with smbpasswd) is lost on restart. To change a password, replace the accounts file.

To generate a line for a new account:

podman run --rm -it --entrypoint sh ghcr.io/technotut/samba:main -c \
  'useradd -M -u 1000 technotut && smbpasswd -a technotut >/dev/null && pdbedit -L -w'

To try it locally:

podman build -t samba:test -f Containerfile .
podman run --rm -p 4445:445 \
  -v ./smb.conf:/etc/samba/smb.conf:ro,Z \
  -v ./secrets:/run/secrets/samba:ro,Z \
  -v ./share:/nas:Z \
  samba:test

Tags

Tag	Contents
main	Latest build of main
sha-<commit>	One per commit. Pin the cluster to one of these.
<YYYYMMDD>	Weekly rebuild that picks up Debian security updates
<version>	Pushed when a v* tag is created

GitHub Actions (.github/workflows/release-container.yml) builds and pushes the image.