# linuxserver.io / s6-overlay images

## Security context

Images using the s6-overlay init system (all linuxserver.io images) must run as root and need full capabilities to switch to their internal `abc` user. **Do not drop capabilities** — s6-overlay's user-switching will fail.

```yaml
spec:
  template:
    spec:
      securityContext:        # pod level
        runAsNonRoot: false
        runAsUser: 0
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: app
          securityContext:    # container level — only this field
            readOnlyRootFilesystem: false
```

Do NOT set `allowPrivilegeEscalation: false` or `capabilities.drop: ALL` for these images.

Suppress `WC-SC-POD` and `WC-SC-CTR` in `app.yaml`:

```yaml
ignoreRules:
  - WC-SC-POD  # s6-overlay requires root
  - WC-SC-CTR  # s6-overlay requires full capabilities
```

## PUID / PGID

linuxserver.io images accept `PUID` and `PGID` env vars to set the internal `abc` user's UID/GID. Set them explicitly for consistent file ownership on PVCs:

```yaml
env:
  - name: PUID
    value: "1000"
  - name: PGID
    value: "1000"
```

**Affected apps**: BookStack, and any app using a linuxserver.io image.