davescodemusings/samba-anon repository overview

samba-anon -- Easy Anonymous SMB/CIFS Shares for Raspberry Pi and More.

Multi-arch package with arm7, arm64, and x86_64.

⁠How do I run it?

You can run the container like this:

docker run -d -p 445:445 -v /srv/media:/srv/media -v /srv/public:/srv/public -v /srv/shared:/srv/shared davescodemusings/samba-anon:latest

Or you can use a docker-compose file like this:

services:
    samba:
        image: davescodemusings/samba-anon
        hostname: samba
        restart: unless-stopped
        ports:
            - '445:445'
        volumes:
            - /srv/public:/srv/public
            - /srv/media:/srv/media
            - /srv/shared:/srv/shared

Both methods assume you have created media, public, and shared directories under the /srv directory on your server. If the directories are located somewhere else, adjust the -v bind-mount paths (or volumes) to match what you have.

Running the container starts a Samba server in standalone mode with a workgroup of WORKGROUP. Three shares are created.

• media
• public
• shared

⁠Great, so what do I do with it?

When a user browses the network, the public share will appear. For example if you have a server named neuromancer, entering \\neuromancer in an Explorer window (or using a command like net view neuromancer or smbclient -L neuromancer -U guest -N) will show the public share. Inside that public directory you could create a batch file like this:

@echo off
net use m: \\neuromancer\media /persistent:yes
net use p: \\neuromancer\public /persistent:yes
net use s: \\neuromancer\shared /persistent:yes

Users can execute the batch file to map all of the possible shares onto their PC. Of course, you can be selective about the shares, too. For example, if you have a media server, you probably only want to access the media share and not public or shared.

⁠Why not one big share?

Each share is configured a little differently. Here's how it breaks down:

• media -- read-only, hidden
• public -- read-only, browsable
• shared -- read-write, hidden

Media is read-only mostly to prevent accidental deleting or moving of files. Any changes have to be made from the server, not over the SMB network. Public is read-only for the same reason. Shared has read-write share permissions, but access can still be controlled at the filesystem level. This allows anybody to create a file, but only change or delete things that have filesystem write permission. One way you can take advantage of these permissions is to upload a new movie or music file to shared, where there is write permission, and then log into the server console to move the file to media where it will be protected from accidental erasure.

⁠Why are some hidden?

The only reason media and shared are hidden is to keep them out of the browse list if you don't want to use them. There is no added security benefit or anything like that. It's simply a matter of not showing a share that may not have anything in it. Maybe you only listen to vinyl and watch movies on LaserDisc and shun the idea of ever using the media share for anything (gasp) digital. That's fine. Just adjust the example batch file in the public directory so users will get drives mapped to whatever shares are being used and not the ones that are sitting empty.

⁠Can I take it apart and see what's inside?

Even if you don't care about Samba, seeing how a server can be containerized is educational and fun for all. See https://github.com/DavesCodeMusings/samba-anon⁠ for info on changes and how the container is built.