Paul Payne
4d983819c9
feat(synapse): update ingress to use traefik ingress class and bump version feat(syncthing-discovery): introduce syncthing discovery service with deployment and ingress feat(syncthing-relay): add syncthing relay server with deployment and ingress configuration fix(taiga): update liveness and readiness probes to use tcpSocket for health checks fix(taiga): change PVC access mode to ReadWriteMany for media and static storage feat(traefik): add icon and ignore rules for traefik service docs(ushahidi): add notes for Redis configuration and Laravel startup probe adjustments feat(ushahidi): implement dedicated Redis deployment for Ushahidi fix(vllm): update deployment strategy and readiness/liveness probes for improved stability fix(writefreely): pin writefreely image version to v0.15.1 for consistency docs(zulip): add notes for TLS-terminating reverse proxy configuration and expected behavior
45 lines
1.2 KiB
Markdown
45 lines
1.2 KiB
Markdown
# linuxserver.io / s6-overlay images
|
|
|
|
## Security context
|
|
|
|
Images using the s6-overlay init system (all linuxserver.io images) must run as root and need full capabilities to switch to their internal `abc` user. **Do not drop capabilities** — s6-overlay's user-switching will fail.
|
|
|
|
```yaml
|
|
spec:
|
|
template:
|
|
spec:
|
|
securityContext: # pod level
|
|
runAsNonRoot: false
|
|
runAsUser: 0
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: app
|
|
securityContext: # container level — only this field
|
|
readOnlyRootFilesystem: false
|
|
```
|
|
|
|
Do NOT set `allowPrivilegeEscalation: false` or `capabilities.drop: ALL` for these images.
|
|
|
|
Suppress `WC-SC-POD` and `WC-SC-CTR` in `app.yaml`:
|
|
|
|
```yaml
|
|
ignoreRules:
|
|
- WC-SC-POD # s6-overlay requires root
|
|
- WC-SC-CTR # s6-overlay requires full capabilities
|
|
```
|
|
|
|
## PUID / PGID
|
|
|
|
linuxserver.io images accept `PUID` and `PGID` env vars to set the internal `abc` user's UID/GID. Set them explicitly for consistent file ownership on PVCs:
|
|
|
|
```yaml
|
|
env:
|
|
- name: PUID
|
|
value: "1000"
|
|
- name: PGID
|
|
value: "1000"
|
|
```
|
|
|
|
**Affected apps**: BookStack, and any app using a linuxserver.io image.
|