dperson / samba Goto Github PK

Hi there,

with this setup, impossible to login as a user :
Command : -u "sam;sam" -s "share;/home/sam/share;yes;no;no;sam" -t Europe/Paris

Logs :
smb_pam_account: PAM: UNKNOWN PAM ERROR (4) during Account Management for User: sam
smb_pam_accountcheck: PAM: Account Validation Failed - Rejecting User sam!

Any idea why ?

Thank you :)

I just detected that command (Start an instance creating users and shares)
is not working saying: Unknown option: -s.

OMG. I spent 3 hours believing I am doing something wrong!

I'd like to use the vfs_catia module in Samba to add translation of characters in filenames that are considered illegal in Windows (e.g. : - see this post for some background), which entails adding 2 new lines to a share section in smb.conf:

vfs objects = catia
catia:mappings = 0x22:0xa8,0x2a:0xa4

It's possible to specify a number of mappings of character=>different character in the catia:mappings line on modern versions of Samba, but when this feature was originally added the mapping was hardcoded.

I'd like to use this feature with your Samba image but I'm unsure of how (or the best way) it could be implemented. It could potentially be supported by adding an extra option to the image -s flag to specify a mapping list, which if populated would be added to smb.conf as described above.

What are your thoughts on adding such a feature? I could have a go at submitting a PR but my bash isn't great (although I imagine I could work it out based on your existing code).

Hi,
Does anyone here happen to know why nmbd browsing does not appear / show up on windows 10 client machine?

Everything is fine on mac and linux.

Have tried a number of so-called "solutions" on windows 10, but nothing worked.

Hi!
I would like to use NMBD with samba but I have an error when I start the container:

$ docker run --rm -it -v "/srv/share:/srv/share" --net=host --privileged --name "samba" dperson/samba -s "share;/srv/share" -u "foo;bar" -n
Added user foo.
ERROR: Can't log to stdout (-S) unless daemon is in foreground (-F) or interactive (-i)
smbd version 4.1.17-Debian started.
Copyright Andrew Tridgell and the Samba Team 1992-2013
standard input is not a socket, assuming -D option

NMBD cannot output log to stdout if started with daemon mode.

More of a feature request, can we have an armhf version of this?

I have a few questions and I'm not sure if this is the right place to ask. Here it is:

For -u argument: Where does [ID] go? is it -u "<username;password>[;ID]" ? Is this the linux User UID and what is it used for?

For -p argument: Admittedly a more samba-related question. On container start, samba.sh sets these permissions on the mounted volumes' files and directories.
chown = smbuser, files = 664, directories = 775
which corresponds to this on the host:
drwxrwxr-x 2 999 docker 4096 Oct 19 16:44 Directory1
However, this only applies to when the container is set up. When I create directories from another computer accessing the share, file permissions show on the host as:
drwxrwxr-x 2 999 users 4096 Oct 19 16:51 Directory2
Is there any way to set it so it is consistent or user settable so to maintain compatibility with other host and docker applications?

For -n argument: I am also unavailable to find my host on "network places" in windows. I can access my share through \ip_address\

Excuse me if it is a lack of understanding in my part. I am still new to docker! Thank you for your time reading all of this. If anyone can help I will greatly appreciate it.

I tried every possible way to start container from docker-compose, but without a way to configure it immediatly in docker-compose.yml. Can you give me some exampleif I want to share publicly two folders:

myname:
  image: dperson/samba
  volumes_from:
   - storage
  # command: -s "db;/var/lib/mysql" -s "www;/var/www" -s "data;/data"
  # entrypoint: ["samba.sh", '-s "data;/data"'] ???
  ports:
   - 139:139
   - 445:445

Help, please.
I just want to type docker-compose up -d, but cannot make it work.

This image is working great for me, the only issue is my logs are spammed with:

Unable to connect to CUPS server localhost:631 - Bad file descriptor
failed to retrieve printer list: NT_STATUS_UNSUCCESSFUL

I think adding

load printers = no

to the base smb.conf would be enough to quiet it.

I'd be happy to PR the Dockerfile change, but you may want to implement this as a new argument to samba.sh instead of hard-coding a lack of printer support in the image.

I have some trouble with connect to samba from Windows XP

samba's log show ntlm_password_check: NTLMv1 passwords NOT PERMITTED for user

It can be solved with add ntlm auth = yes to smb.conf or setting Only NTLMv2 in Windows (like this https://www.imss.caltech.edu/node/396)

after upgrading docker to 1.11.0 my samba container no longer seems to work. Here's the logs that keep repeating in its restart loop:

17/04/2016 10:37:13smbd version 4.1.17-Debian started.
17/04/2016 10:37:13Copyright Andrew Tridgell and the Samba Team 1992-2013
17/04/2016 10:37:13standard input is not a socket, assuming -D option
17/04/2016 10:37:22useradd: user 'notrealusername' already exists

here's the compose file I use to make this container:

samba:
ports:
- 139:139/tcp
- 445:445/tcp
command:
- -u
- notrealusername;notrealpassword
- -s
- share;/share;yes;no;no;notrealusername
- -s
- share2;/share2;yes;no;no;notrealusername
- -s
- private;/private;no;no;no;notrealusername
image: dperson/samba
volumes:
- /mnt/6tb/share/:/share
- /mnt/new6tb/share/:/share2
`- /mnt/6tb/privateshare/:/private/``

here's my docker version:

~$ docker version
Client:
Version: 1.11.0
API version: 1.23
Go version: go1.5.4
Git commit: 4dc5990
Built: Wed Apr 13 18:34:23 2016
OS/Arch: linux/amd64

Server:
Version: 1.11.0
API version: 1.23
Go version: go1.5.4
Git commit: 4dc5990
Built: Wed Apr 13 18:34:23 2016
OS/Arch: linux/amd64

Thanks for supplying the great image in the first place - let me know if you want any more details for looking into this :)

I'm writting a startup script for a samba container, as the snippet will be posted on a wiki I don't like having all passwords in plaintext there, it would be nice to be able to set the user password as a hash so the script can be public without security being compromised.

https://www.samba.org/samba/docs/man/manpages/vfs_recycle.8.html

Configure Like this.

vfs object = recycle
recycle:repository = .deleted/%U
recycle:keeptree = Yes
recycle:versions = Yes
recycle:maxsixe = 0

Thanks!

Hi, thanks for your great work of this samba container!
It's quite easy to use. However, it seems I cannot write into the shares on the client.
This is how I start it on the server:
docker run -it -p 139:139 -p 445:445 -v /tmp:/exports dperson/samba -s "public;/exports;no;no;no;foo" -u "foo;bar"

And on the client side I mounted the shares using:
sudo mount -t cifs -o username=foo,password=bar //10.192.68.131/public /mnt

Then on the client side, there is no permission to write to the mounted path.
Both server and client are ubuntu VMs.

Any suggestions? Thanks a lot!

The #51 patch contains Unicode 160s instead of ASCII 32, the parameter is garbled

The latest build 2 days ago appears to have broken things. Hopefully its something silly I am doing:

docker run -it -p 139:139 -p 445:445 dperson/samba:latest -u "jeremy;jeremy" -s "jeremy;/mount/users/jeremy;yes;yes;yes;jeremy"
Unknown parameter encountered: "security mask"
Ignoring unknown parameter "security mask"
Unknown parameter encountered: "force security mode"
Ignoring unknown parameter "force security mode"
Unknown parameter encountered: "directory security mask"
Ignoring unknown parameter "directory security mask"
Unknown parameter encountered: "force directory security mode"
Ignoring unknown parameter "force directory security mode"
Added user jeremy.
smbd version 4.4.7-Debian started.
Copyright Andrew Tridgell and the Samba Team 1992-2016
Unknown parameter encountered: "security mask"
Ignoring unknown parameter "security mask"
Unknown parameter encountered: "force security mode"
Ignoring unknown parameter "force security mode"
Unknown parameter encountered: "directory security mask"
Ignoring unknown parameter "directory security mask"
Unknown parameter encountered: "force directory security mode"
Ignoring unknown parameter "force directory security mode"
Unknown parameter encountered: "security mask"
Ignoring unknown parameter "security mask"
Unknown parameter encountered: "force security mode"
Ignoring unknown parameter "force security mode"
Unknown parameter encountered: "directory security mask"
Ignoring unknown parameter "directory security mask"
Unknown parameter encountered: "force directory security mode"
Ignoring unknown parameter "force directory security mode"
STATUS=daemon 'smbd' finished starting up and ready to serve connections
Unknown parameter encountered: "security mask"
Ignoring unknown parameter "security mask"
Unknown parameter encountered: "force security mode"
Ignoring unknown parameter "force security mode"
Unknown parameter encountered: "directory security mask"
Ignoring unknown parameter "directory security mask"
Unknown parameter encountered: "force directory security mode"
Ignoring unknown parameter "force directory security mode"

Samba allows to group users to simplify permissions editing.

Can you add this possibility?

For example now I add user using -u "username;password".
I could add him as -u "username;password:group" where group is optional

I run:

docker run -it --name samba -p 139:139 -p 445:445 -p 137:137/udp -p 138:138/udp -d dperson/samba -u "root;root" -s "samba;/mnt/data/test;yes;no;no;root"

I get:

groupadd: '' is not a valid group name
useradd: user 'root' already exists
Added user root.
smbd version 4.5.2-Debian started.
Copyright Andrew Tridgell and the Samba Team 1992-2016
STATUS=daemon 'smbd' finished starting up and ready to serve connections
canonicalize_connect_path failed for service samba, path /mnt/data/test

Directory structure

docker@default:/mnt/data$ ll / ; ll /mnt ; ll /mnt/data
...
drwxr-xr-x    9 root     root           180 Dec 14 21:23 mnt/
...
drwxr-xr-x    7 root     root          4096 Jan 19 06:26 data/
...
drwxrwxrwx    2 root     root          4096 Jan 19 06:26 test/

I've run the command both from inside the Host (with and without sudo) as well as from outside.

I can't figure out what's up. It would seem that all relevant directories are executable, satisfying Samba requirements.

I'm not sure if this is intentional, but in my case new files got created with a permission set of 0764.

I see that the Dockerfile contains the line force create mode = 0664 but it is missing a create mode = 0664 which, in my case, was causing the 0764 permissions.

Maybe samba.sh could add a flag to optionally add a create mode = 0664 line?

Thank you David for sharing this container.

I create a container with the root;root;0;0 key in order to assign ROOT user and ROOT group the new files.

docker run --rm -itd --net=host --name samba -v volume:/data/volume dperson/samba -n -u "root;root;0;0" -s "docker;/data;yes;no;no;all;root"

but when I create a file on a share, the permissions are

-rw-rw-r-- 1 root users    0 Mar 21 21:30 file.txt

how can I set the group to ROOT ?

Thank!

Hi,

can you please include/run nmdb? Some devices need nmdb to discover samba hosts, and unfortunately some devices also only support this kind of way of discovery (no manual connection to host).

Best,
Tit

After creating a container with a user, I'm unable to connect to the share using my windows 7 host with that username/password.

$ docker run -it -p 139:139 -p 445:445 dperson/samba -u "foo;bar" -s "public;/tmp;yes;no;no;foo"
Added user foo.
smbd version 4.5.2-Debian started.
Copyright Andrew Tridgell and the Samba Team 1992-2016
STATUS=daemon 'smbd' finished starting up and ready to serve connections

I'm running docker 1.12.0 docker-toolbox on windows 7.

On the other hand, I have no problems connecting to the share from my windows 7 host when started with this command.
$ docker run -it -p 139:139 -p 445:445 dperson/samba -u "foo;bar" -s "public;/tmp;yes;no;yes"

The error I see from my windows 7 samba client is
Logon failure: unknown user name or bad password

I tried running the following sudo docker run -it --name samba -p 139:139 -p 445:445 -p 137:137/udp -p 138:138/udp -v /data:/mount -d dperson/samba -n, but i get a format error, guessing its trying to run x86 or x64 code..

any chance you could add a tag for arm?

docker run -it -p 139:139 -p 445:445 -d dperson/samba
989af6ce2e162b4f405784ac0f5fae162078a6436ea34936819f63dde694a777
C:\Program Files\Docker\Docker\Resources\bin\docker.exe: Error response from daemon: driver failed programming external connectivity on endpoint amazing_shirley (979c8b63e6ad61f99a57754e4add7c248405380912c37e3eeacc618bb0ee8
b84): Error starting userland proxy: listen tcp 0.0.0.0:445: listen: address already in use.

Is there an easy fix for the above issue? I'm on Windows 10 x64. Can I assign a static IP to the container to avoid conflicts on port 445 between the container and the host?

I find it really handy to use the linuxserver containers, which have standardized on PUID and PGID for setting the default user & group for things. It would be awesome if I could run this:

sudo docker run -it \
    -e PUID=1000 -e PGID=1000 \
    -p 137:137/udp -p 138:138/udp -p 139:139 -p 445:445 \
    -v /path/to/directory:/media \
    -d dperson/samba \
    -s "media;/media;yes;no;yes"

If /path/to/directory is owned by 1000:1000 user on host, everyone on network has full access to media, and permissions stay read/writable (so I can link it to other docker containers that are also using PUID and PGID.)

They setup abc user/group via PUID & PGID in their base-images, so you can do stuff like this:

force user = abc
force group = abc

I started work on a container, but can't test until later tonight (limited networking.) It'd be rad to be able to do this directly with yours, though, and I'm happy to submit a PR once I can test.

Hi! I created a container and now I want to add a new user.

$ sudo docker exec -it samba samba.sh -u "new_user:new_password"
/usr/bin/samba.sh: line 132: 2: unbound variable

I'm misunderstanding something?

Thanks!

I'm using Docker in swarm mode and I want to create a service that runs Samba and shares a named data volume.

Hey! :)

This is my first time working with docker since I am using it for a school project.

I encountered a problem when I tried to connect to the samba server from another linux machine.

My ubuntu host uses the config

sudo docker run -it --name samba -p 139:139 -p 445:445 -d dperson/samba -n -s "public;/tmp;yes;no;yes" -w "WORKGROUP".

My host can find the server when I navigate to "Network - Windows-Network".

Whereas my ubuntu client cant find the server at "Network - Windows-Network".

My host has the IP 192.168.7.3 and my client has the IP 192.168.7.4, they can ping each other and my client can reach a docker-webserver my hostsystem is hosting.

Maybe you can help me find the mistake, I'm trying to get this working for 2 days now :D

I have several shares that should be read-only for most users but writeable to the few ones.

"admin users" doesn't allow to write to those folders, there is special directive "write list" which cannot be configured from your script.

I am having difficulties getting large media files to transfer completely between my Windows 10 system and my RHEL 7 server. Doing a little reading it might be because of the "strict locking" setting. Is it possible to expose this as a configurable item?

Hi! I'm running this container with -n

Bound ports:

0.0.0.0:139->139/tcp,
0.0.0.0:137-138->137-138/udp,
0.0.0.0:445->445/tcp

docker logs -f MY_CONTAINER_NAME:

[2017/08/21 00:11:58.179096,  0] ../source3/nmbd/nmbd_become_lmb.c:397(become_local_master_stage2)
  *****
  
  Samba name server KELLER is now a local master browser for workgroup WORKGROUP on subnet 172.17.0.2

Windows and GVFS-SMB's based client can't discover the server, but they can connects to direct IP: smb://192.168.x.x

When I ping "keller" on Windows it resolves to 172.17.0.2 but no response found :(
Whe I ping 172.17.0.2 from drocker's host works ok.

I don't understand how to map or route (if I must) this IP.

Can you helpme?
Thanks!

Related #59 ?

When using your image, I approached this:

$:~/docker-arm-samba$ sudo docker run --net=host -d arm-samba \
>             -u "example1;badpass" \
>             -u "example2;badpass" \
>             -s "public;/share" \
>             -s "users;/srv;no;no;no;example1,example2" \
>             -s "example1 private;/example1;no;no;no;example1" \
>             -s "example2 private;/example2;no;no;no;example2"
8902f3188de2bc74e14eaed5fe9e1574d3751607d0dfd60c58745ea81b788750


$:~/docker-arm-samba$ docker logs elated_engelbart 
Added user example1.
Added user example2.
smbd version 4.2.10-Debian started.
Copyright Andrew Tridgell and the Samba Team 1992-2014
STATUS=daemon 'smbd' finished starting up and ready to serve connections
Unable to connect to CUPS server localhost:631 - Bad file descriptor
failed to retrieve printer list: NT_STATUS_UNSUCCESSFUL
Failed to delete pidfile /var/run/samba/smbd.pid. Error was No such file or directory

I know it is rather samba configuration error, but I was thinking, that most people don't use samba for printer, so you could configurate your default config not to use it. (I tryed to reconfigure it, but I failed.)

Hi!

This might sound like a stuipd idea, but I am trying to test this image to create an Active Directory (AD) Domain Controller (DC).
Two issues I came across:

• samba-tool throws errors like "ldb: unable to stat module /usr/lib/x86_64-linux-gnu/samba/ldb : No such file or directory" and it wants 'xattr' to be present.
• Once samba-tool was used to setup the AD DC, the container would not start anymore throwing the message: "server role = 'active directory domain controller' not compatible with running smbd standalone. You should start 'samba' instead, and it will control starting smbd if required."

The first issue is quickly fixed by adding two more packages in the Dockerfile (samba-dsdb-modules and xattr). Depending on your intentions, this might be worth adding either way. I have a fork with a modification to the Dockerfiles.

The second issue may be completely against the purpose of the image and samba.sh ;-)

What are your thoughts?

Hi,

i actually use your image to be able to mount some volumes with docker compose on my mac os x.

samba:
        image: dperson/samba
        command: -u "root;root" -s "config;/config" -s "data;/data" -s "log;/log"
        restart: always
        ports:
            - "139:139"
            - "445:445"
        volumes:
            - data:/data
            - config:/config
            - log:/log

The problem is that data are in read only :-(
It's strange that permissions for all data is 700.

Any idea ?

Hi,

After last update i have now this error.

docker run --name samba --rm -it -p 139:139 -p 445:445 dperson/samba -s "public;/tmp;yes;no;yes;all"

samba_1        | smbd version 4.1.17-Debian started.
samba_1        | Copyright Andrew Tridgell and the Samba Team 1992-2013
samba_1        | standard input is not a socket, assuming -D option

Docker versions

Client:
 Version:      1.11.1
 API version:  1.23
 Go version:   go1.5.4
 Git commit:   5604cbe
 Built:        Wed Apr 27 00:34:42 2016
 OS/Arch:      linux/amd64

Server:
 Version:      1.11.1
 API version:  1.23
 Go version:   go1.5.4
 Git commit:   5604cbe
 Built:        Wed Apr 27 00:34:42 2016
 OS/Arch:      linux/amd64

Hey,

i want to report that i always get those 2 warnings in the console, the veto files option probably isn't supported anymore.

Unknown parameter encountered: "   veto files"
Ignoring unknown parameter "   veto files"

I want to request an option to enable symlinks in file shares.
Required changes to the config: http://unix.stackexchange.com/a/137192

Greetings

**
I liked just ready only no autentications folder backup, how i can solved this?
**
Tks advanced!

version: '2'
services:
    server:
        build: ./server
        image: pnick
        container_name: backend
        command: python  manage.py  runserver 0.0.0.0:8000
        volumes:
            - ./server:/server
        ports:
            - "8000:8000"
    samba:
        image: dperson/samba
        command: -u "root;root" -s "server/backup:yes;yes"
        restart: always
        ports:
            - "139:139"
            - "445:445"

root@myserver:# sudo docker run --name samba -p 139:139 -p 445:445 -d dperson/samba
5ebec29ef7779a5d65a098b32d91796d7fee5ca7a502b128de125f7590564203
root@myserver:# docker logs samba
smbd version 4.1.17-Debian started.
Copyright Andrew Tridgell and the Samba Team 1992-2013
standard input is not a socket, assuming -D option
STATUS=daemon 'smbd' finished starting up and ready to serve connectionsUnable to connect to CUPS server localhost:631 - Bad file descriptor
STATUS=daemon 'smbd' finished starting up and ready to serve connectionsfailed to retrieve printer list: NT_STATUS_UNSUCCESSFUL
root@myserver:~# docker version
Client:
Version: 1.9.1
API version: 1.21
Go version: go1.4.2
Git commit: a34a1d5
Built: Fri Nov 20 13:12:04 UTC 2015
OS/Arch: linux/amd64

Server:
Version: 1.9.1
API version: 1.21
Go version: go1.4.2
Git commit: a34a1d5
Built: Fri Nov 20 13:12:04 UTC 2015
OS/Arch: linux/amd64
root@myserver:~# docker images|grep dperson/samba
dperson/samba latest f9d853709237 38 hours ago 255 MB

Can't connected by linux client, but the windows client OK

Can not copy files larger than 2g.

Somethings gone wrong, the container is throwing an error now...

Error loading module '/usr/lib/x86_64-linux-gnu/samba/vfs/recycle.so': /usr/lib/x86_64-linux-gnu/samba/vfs/recycle.so: cannot open shared object file: No such file or directory
error probing vfs module 'recycle': NT_STATUS_UNSUCCESSFUL
smbd_vfs_init: vfs_init_custom failed for recycle
vfs_init failed for service IPC$

Hi!

I changed my old home server (Proxmox + Debian VM with Samba server) to a new hardware (Arch + Docker). They IO's perform are similar over SMB.

I want to share my benchmark:

Pentium G4560 @ B250 chipset with 8GB DDR4 2400 (4+4 in dual channel)
Storage0: raid10,f2 of 3 WD Blue 1TB drives.
Storage1: tmpfs 6GB
Test file: test.iso 5090MB

Write test:

$ time cp /mnt/ram_fs/test.iso /mnt/raid/
real	0m43.420s
user	0m0.000s
sys	0m9.458s

5090MB / 43s =~ 118MB/s

Read test:

$ time cp /mnt/raid/test.iso /mnt/ram_fs/

real	0m15.965s
user	0m0.017s
sys	0m6.999s

5090MB / 16s =~ 318MB/s

I have a Gigabit LAN:
Server with I219V (performs worst than old server's 8111GR, tested with IPerf: 930Mbit/s vs 980Mbit/s respectively)
Client with I219-LM with NVMe storage

IPerf between this two machines achieves 110MB/s (930Mbit/s)

I'm using SMB1 protocol:
Results:
60MB/s reading file from server
40MB/s writing file to server

Is this a decent value?
Is a SMB overhead?
Is a SMB+Docker overhead?

Thanks for your time!

Hi dperson,

I'm not a security expert but I researched a little on CVE-2017-7494.

On Debians security website (https://security-tracker.debian.org/tracker/CVE-2017-7494) the maintainers announce version 2:4.5.8+dfsg-2 as fixed and not vulnerable.

The current image on docker hub runs 2:4.5.8+dfsg-1:

root@36f7a7761ef8:/# dpkg -s samba
Package: samba
Status: install ok installed
Priority: optional
Section: net
Installed-Size: 10928
Maintainer: Debian Samba Maintainers <[email protected]>
Architecture: amd64
Version: 2:4.5.8+dfsg-1

If you come to the same conclusion that the version in your current image is probably vulnerable, could you trigger a rebuild of the image on docker hub? So that 2:4.5.8+dfsg-2 makes its way into the image?

Thanks in advance,

FillFeile

Please please please push the other versions and future versions as labels on docker hub. Don't only have latest. It makes it impossible to pin to a working version, which means one day I wake up and stuff is broken... like right now.

I see a commit from 5 days ago that might address the issue. Any chance it could be pushed to latest on docker hub?

$ /usr/bin/docker run -i -t --name samba -p 139:139 -p 445:445 -v /tank:/tank dperson/samba -u "craig;badpass" -s "craig;/tank/craig;yes;no;no;craig;craig"
Added user craig.
/usr/bin/samba.sh: line 142: NMBD: unbound variable
$

Adding -n appears to fix it.

First off, thank you David for creating this. Like others have mentioned, this is a great tool. Now to my issue (which, admittedly, is most likely user error or user misunderstanding). I am trying to mount an existing folder from the host machine and expose it as a samba mount. Everything works great, but I've noticed that whenever I edit a file that has executable permission from the samba client (mac os in my case), it becomes just read/write. Am I doing something wrong?

Here's my docker run command:
docker run -it --rm --name samba -p 139:139 -p 445:445 -v /data:/data --env USERID=1002 --env GROUPID=1002 --env TZ=America/New_York dperson/samba -u "user1:user1" -s "data;/data;yes;no;no;user1;user1"

User Id and Group Id 1002 are the ids for the user owning the files in /data on my host.

Thanks again!

Very nice image!
However, I seem to have an issue with read/write performance. I'm using OSX to connect. Any advice on how to improve the performance?

Hello, thanks for a great job, but...
I've got "permission denied" errors when I try to do write operations on the mounted share. I'm running the container in CoreOS using external USB drive. Here's my command line:

docker run -it -p 137:137 -p 139:139 -p 445:445 -v /storage/smb:/files -d --name samba --net host --restart always dperson/samba -n -s "files;/files;yes;yes;yes;paul" -u "paul;[my_password]"

/storage/smb is on the external drive; It has mode of 777; I can read/write on it when doing docker run -it samba bash.

Any ideas?

It would be very much appreciated if you could add an option to let people disable the recycle VFS module - I use your image without a persistent smb.conf, so there's currently no way to disable it other than rebuilding the image.

I'd also suggest that it may be a good idea to make it opt-in, rather than opt-out. Principle of least surprise and all that, a lot of people are going to be confused about why they're not reclaiming space when they delete their files.