Share Host Storage over Samba from an LXC Container

Create a new unprivileged LXC.
Set up a mount point to ZFS (PVE host shell).

Edit the config:
```
nano /etc/pve/lxc/[id].conf
```
Add a new line for the mountpoint:
```
mp0: /zfs1/shared,mp=/mnt/pve/shared
```
Save and exit (Ctrl+S, Ctrl+X).
Set up the user/group (LXC container shell).

Create the user/group:
```
groupadd -g 10419 nas
useradd nas -u 10419 -g 10419
```
Add root to the group and reload groups for root:
```
usermod -aG nas root
su root
```

Install Samba in the container (LXC container shell).

Install Samba:

apt update
apt install samba samba-common-bin

Edit the Samba config:

nano /etc/samba/smb.conf

Add the shared folder:

[Shared]
   path = /mnt/pve/shared
   writable = yes
   guest ok = no
   valid users = @nas

Add nas to Samba (and enter a password):

smbpasswd -a nas

Set up host users and subordinate permission mapping (PVE host shell).

Create the user and group with ID 10419:
```
groupadd -g 10419 nas
useradd nas -u 10419 -g 10419
```
Set the group as owner of the folder to be shared:
```
chown -R nas:nas /zfs1/shared
```
Allow root to map this user/group by adding them to subuid/subgid:
```
echo "root:10419:1" >> /etc/subuid
echo "root:10419:1" >> /etc/subgid
```

Set up container uid/gid mappings (PVE host shell).

Edit the container config:

nano /etc/pve/lxc/[id].conf

Add new lines for mapping group/user ID 10419:

lxc.idmap: u 0 100000 10419
lxc.idmap: g 0 100000 10419
lxc.idmap: u 10419 10419 1
lxc.idmap: g 10419 10419 1
lxc.idmap: u 10420 110420 55116
lxc.idmap: g 10420 110420 55116

Save and exit (Ctrl+S, Ctrl+X).

Optional: repeat steps 2, 3, and 6 for each LXC container that needs access to the same files.

The ACL way (alternative, not sure if needed)

# install ACL tools
apt install acl

# set ZFS pool ACL type
zfs set acltype=posixacl zfs1
zfs set xattr=sa zfs1

# grant permissions to the share user (the capital X means only give to dirs)
setfacl -R -m u:sambashareuser:rwX /some/folder/path/

The ACL way (alternative, not sure if needed)​

The ACL way (alternative, not sure if needed)