Samba in Docker: enable audit

docker-compose.yml

# Tested on Debian 13

services:
  # https://github.com/ServerContainers/samba
  samba:
    image: ghcr.io/servercontainers/samba:a3.23.2-s4.22.6-r0 # https://github.com/servercontainers/samba/pkgs/container/samba/versions

    # ...

    environment:
      SAMBA_GLOBAL_CONFIG_vfs_SPACE_objects: full_audit
      SAMBA_GLOBAL_CONFIG_full_audit_COLON_prefix: "%u|%I|%S"
      SAMBA_GLOBAL_CONFIG_full_audit_COLON_failure: none
      SAMBA_GLOBAL_CONFIG_full_audit_COLON_success: fdopendir, pread_recv, pwrite_recv, create_file, unlinkat, connect
      # SAMBA_GLOBAL_CONFIG_full_audit_COLON_success: all

      # ...

    volumes:
      - /etc/avahi/services/:/external/avahi
      - /dev/log:/dev/log # this is required

# end of docker-compose.yml

# docker compose up samba
# check audit logs on host machine via:
# sudo journalctl -f | grep smbd_audit