How to Self-Host Samba in Docker Privately: SMB3 Encryption, No SMB1 and a Locked-Down Home Server Share

Description and use

Running Samba in Docker with mandatory SMB3 encryption, SMB1 disabled, and port 445 blocked creates a secure private file server for home use.

Problem

Running Samba in Docker on a home server can expose sensitive data if default settings are used, because SMB1 is enabled, encryption is optional, and port 445 may be publicly reachable.

Outcome

The hardened Samba container provides a private, encrypted file share that is discoverable on a LAN, inaccessible from the public internet, and compatible with modern clients while isolating legacy SMB1 devices.

Workflow

• 1. Choose a maintained Samba Docker image (e.g., crazymax/samba or ghcr.io/servercontainers/samba) and pin a specific tag.
• 2. Run the container with host networking (network_mode: host) to allow proper discovery and binding.
• 3. Mount a custom smb.conf that sets server min protocol = SMB3, server smb encrypt = required, ntlm auth = ntlmv2-only, and interfaces/bind interfaces only to a private interface.
• 4. Ensure no port 445 is forwarded to the public network; use firewall rules or VPN (WireGuard/Tailscale) to access the share remotely.
• 5. Verify configuration with testparm -sv and check active sessions with smbstatus to confirm SMB3 usage.
• 6. Optionally isolate legacy SMB1 devices on a separate share or VLAN if needed.
• 7. Enable audit logging with vfs_full_audit and set up snapshots or backups to protect against ransomware.

Evidence

Make SMB3 the minimum protocol, require encryption, run it on host networking with bound interfaces, and keep TCP port 445 off the public internet entirely.

Source

SMB1 is the protocol behind the 2017 WannaCry outbreak. It has no modern encryption and weak integrity protection.

Source

For a private home share, host networking is usually the right answer. It lets you bind Samba to one interface, such as your LAN or WireGuard adapter.

Source