Overview

A small Debian container running Samba, with a folder from the external drive bind-mounted into it. Your Mac and Windows computers see it as a normal network drive.

Requirements

  • The external drive mounted on the Proxmox host (see the previous post.), with a share folder
  • A Debian LXC (unprivileged)

🌐 Prerequisite: the drive is mounted at /mnt/hdd_data and the folder /mnt/hdd_data/share exists. 🔒 Security: never forward the Samba ports (445) on your router. Keep it LAN-only.

Procedure

Step 1 · Give the container the folder

On the Proxmox host:

pct set <LXC_ID> -mp0 /mnt/hdd_data/share,mp=/srv/share,backup=0
pct reboot <LXC_ID>

Step 2 · Install Samba

Inside the container:

apt update && apt install -y samba

Step 3 · Create the user

Create a system user with a fixed UID of 1000 and no login:

useradd -M -s /usr/sbin/nologin -u 1000 -U smbuser
smbpasswd -a smbuser

Choose a long password. It is only used for Samba.

Step 4 · Fix ownership on the host

UID 1000 in the container is 101000 on the host. Back on the Proxmox host:

chown -R 101000:101000 /mnt/hdd_data/share

Step 5 · Configure the share

Inside the container, edit /etc/samba/smb.conf and replace its contents with:

[global]
   server string = Homelab
   server min protocol = SMB2_02
   map to guest = never
   hosts allow = 192.168.0. 127.0.0.1
   hosts deny = 0.0.0.0/0
[share]
   path = /srv/share
   read only = no
   valid users = smbuser
   create mask = 0664
   directory mask = 0775

Adjust hosts allow to your own network. Optional, for a smoother macOS experience, add these lines inside [global]:

   vfs objects = fruit streams_xattr
   fruit:metadata = stream

Check the file and restart:

testparm
systemctl restart smbd

Step 6 · Connect

macOS: Finder → Go → Connect to Server (⌘K)

smb://YOUR_SAMBA_IP/share

Windows: File Explorer address bar

\\YOUR_SAMBA_IP\share

Log in as smbuser.

Troubleshooting

Read-only file system when copying. The disk on the Proxmox host may have been remounted read-only after a power cut. Check with mount | grep hdd_data on the host (see the first post of this series). Access denied. Check that the folder is owned by 101000:101000 on the host, and that the user exists with UID 1000 inside the container (id smbuser). Can see the share but not write. Make sure read only = no and that the bind mount is not set to read-only. Test from inside the container:

smbclient -L localhost -U smbuser