From 1ed70e31dd4d8e2a92f1dd77a2b6c5d6ffad9681 Mon Sep 17 00:00:00 2001 From: jklein Date: Sun, 23 Aug 2026 00:01:15 +0200 Subject: [PATCH] Pin flaresolverr runAsUser/runAsGroup to 1000 The image declares its non-root user by name only, which the kubelet's runAsNonRoot check cannot verify (CreateContainerConfigError); pinning the uid/gid numerically satisfies the check. --- freesailarr/values.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/freesailarr/values.yaml b/freesailarr/values.yaml index 07b0ee4..1b5e395 100644 --- a/freesailarr/values.yaml +++ b/freesailarr/values.yaml @@ -300,11 +300,15 @@ flaresolverr: memory: 512Mi ephemeralStorage: 200Mi # The image runs as its own non-root user; chromium's writable paths (/tmp, - # /dev/shm) are emptyDirs, so the full hardening baseline holds. + # /dev/shm) are emptyDirs, so the full hardening baseline holds. runAsUser/ + # runAsGroup pin the image's "flaresolverr" user numerically (uid/gid 1000, + # the image declares it by name only, which runAsNonRoot cannot verify). securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 capabilities: drop: - ALL