45 lines
2.9 KiB
Docker
45 lines
2.9 KiB
Docker
# felhom-samba — the LAN SMB-sharing infra image for felhom-controller (R-7 slice 1).
|
|
#
|
|
# DUMB BY DESIGN: /etc/samba/smb.conf is bind-mounted READ-ONLY by the controller, which
|
|
# owns all rendering. This image templates nothing and bakes NO share name and NO password.
|
|
# The three-daemon discovery stack is the spike verdict
|
|
# (felhom.eu/documentation/audits/SPIKE-lan-discovery-2026-07-18.md, S4/S4b):
|
|
# - smbd : the SMB/CIFS server (445)
|
|
# - nmbd : NetBIOS name service — REQUIRED alongside wsdd. wsdd-only makes the box visible
|
|
# in Explorer but the double-click fails 0x80070035 (no flat-name resolution);
|
|
# nmbd is what makes \\<NAME> resolve + mount (S4b, proven live).
|
|
# - wsdd : WS-Discovery, so the box appears in Windows Explorer's Network view.
|
|
# - avahi : mDNS/Bonjour (v1.1.0) — THE macOS path. Windows and macOS do not share a
|
|
# discovery mechanism, and nmbd does not cover the Mac: captured live on
|
|
# 2026-07-20, macOS broadcasts a correct NBNS query for FELHOM<20>, the box
|
|
# answers correctly in 140us (flags 0x8580, RCODE=0, the right address), and
|
|
# macOS REFUSES TO ACT ON IT — no TCP follows. NetBIOS feeds legacy browsing
|
|
# there, not smb:// URL resolution. With mDNS, `smb://<NAME>.local` connects
|
|
# immediately — PROVEN live from a Mac on 2026-07-20.
|
|
# NOT proven: automatic appearance in the Finder sidebar. The _smb._tcp record
|
|
# is published and answers browse queries on the wire, but the test Mac's
|
|
# sidebar stayed empty (it had no Network/Bonjour section shown at all, which
|
|
# is a Finder Settings -> Sidebar toggle). Treat sidebar discovery as an OPEN
|
|
# question, not a shipped feature.
|
|
# Evidence: felhom.eu/documentation/audits/DIAG-sharing-2026-07-20.md.
|
|
# 1.2.0 (R-972): Alpine 3.24.2, pinned by digest — the same base as the hub. 3.21 carried 48 fixable high findings
|
|
# (audits/security-review-2026-10-12/scanners/). Same packages; scanner before → after in the controller's v0.323.0 CHANGELOG.
|
|
FROM alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
|
|
|
|
# samba = smbd + nmbd + smbpasswd/testparm (meta-package proven installable in the spike);
|
|
# wsdd = WS-Discovery daemon; tini = a proper PID1 to reap nmbd/wsdd/avahi and forward signals;
|
|
# avahi + dbus = mDNS/Bonjour (avahi-daemon talks to the system bus, so dbus is not optional).
|
|
RUN apk add --no-cache samba wsdd tini avahi dbus \
|
|
&& rm -rf /var/cache/apk/* \
|
|
&& rm -f /etc/samba/smb.conf \
|
|
&& rm -f /etc/avahi/services/*.service
|
|
|
|
# passdb on a named volume → the household SMB password survives container recreation
|
|
# (share add/remove re-renders + `compose up -d`, which recreates the container).
|
|
VOLUME ["/var/lib/samba"]
|
|
|
|
COPY entrypoint.sh /entrypoint.sh
|
|
RUN chmod +x /entrypoint.sh
|
|
|
|
ENTRYPOINT ["/sbin/tini", "--", "/entrypoint.sh"]
|