The Karakeep compose user shared confirms every container in LXC 104
uses host bind-mounts of /mnt/pve/unas/services/<svc>/<vol> directly.
No driver_opts, no CIFS, no per-volume credentials. The earlier
SMB-as-docker-volume proposal in this repo was over-fitting to the
Nextcloud-specific NFS issue and is withdrawn.
The Nextcloud failure was Nextcloud-specific: its setup tooling chowns
the data dir to www-data, which fails against root_squash exports.
Normal containers don't trigger that path, so plain bind-mounts work
fine.
Changes:
- docs/09 §Step 3: compose block dropped from ~30 lines (volume,
driver_opts, CIFS device, credentials env) to a one-line bind-mount
+ env_file. Added a pre-deploy `mkdir -p` for the UNAS service +
backup paths. Explanatory note retained for future agents.
- docs/12 #27 marked withdrawn pointing to #31. #31 rewritten with the
bind-mount pattern (was SMB-default). #36 (UNAS audit) now looks for
`- /var/lib/docker/...` or anonymous volumes as the non-compliant
signal.
- CLAUDE.md storage block: bind-mount is the standard, SMB is
documented escape-hatch only.
- docs/11: Q19 moved into Resolved with the new framing. Q12 + Q20
grouped under a new "## Backups" section header (the now-empty
"Verification needed" section removed).
- docs/13 Task 1 struck through with done-marker pointing to docs/09.
Net: Phase-3.1 deployment YAML is now actually deployable as written.
Claude
a8446f8371