Paul Payne
4d983819c9
feat(synapse): update ingress to use traefik ingress class and bump version feat(syncthing-discovery): introduce syncthing discovery service with deployment and ingress feat(syncthing-relay): add syncthing relay server with deployment and ingress configuration fix(taiga): update liveness and readiness probes to use tcpSocket for health checks fix(taiga): change PVC access mode to ReadWriteMany for media and static storage feat(traefik): add icon and ignore rules for traefik service docs(ushahidi): add notes for Redis configuration and Laravel startup probe adjustments feat(ushahidi): implement dedicated Redis deployment for Ushahidi fix(vllm): update deployment strategy and readiness/liveness probes for improved stability fix(writefreely): pin writefreely image version to v0.15.1 for consistency docs(zulip): add notes for TLS-terminating reverse proxy configuration and expected behavior
1.2 KiB
1.2 KiB
linuxserver.io / s6-overlay images
Security context
Images using the s6-overlay init system (all linuxserver.io images) must run as root and need full capabilities to switch to their internal abc user. Do not drop capabilities — s6-overlay's user-switching will fail.
spec:
template:
spec:
securityContext: # pod level
runAsNonRoot: false
runAsUser: 0
seccompProfile:
type: RuntimeDefault
containers:
- name: app
securityContext: # container level — only this field
readOnlyRootFilesystem: false
Do NOT set allowPrivilegeEscalation: false or capabilities.drop: ALL for these images.
Suppress WC-SC-POD and WC-SC-CTR in app.yaml:
ignoreRules:
- WC-SC-POD # s6-overlay requires root
- WC-SC-CTR # s6-overlay requires full capabilities
PUID / PGID
linuxserver.io images accept PUID and PGID env vars to set the internal abc user's UID/GID. Set them explicitly for consistent file ownership on PVCs:
env:
- name: PUID
value: "1000"
- name: PGID
value: "1000"
Affected apps: BookStack, and any app using a linuxserver.io image.