Pin flaresolverr runAsUser/runAsGroup to 1000

The image declares its non-root user by name only, which the kubelet's
runAsNonRoot check cannot verify (CreateContainerConfigError); pinning
the uid/gid numerically satisfies the check.
This commit is contained in:
jklein committed 2026-08-24 13:41:46 +02:00
1 parent d1933e0b53
commit 1ed70e31dd
1 file changed
+5 -1
+5 -1
View File
@@ -300,11 +300,15 @@ flaresolverr:
memory: 512Mi
ephemeralStorage: 200Mi
# The image runs as its own non-root user; chromium's writable paths (/tmp,
# /dev/shm) are emptyDirs, so the full hardening baseline holds.
# /dev/shm) are emptyDirs, so the full hardening baseline holds. runAsUser/
# runAsGroup pin the image's "flaresolverr" user numerically (uid/gid 1000,
# the image declares it by name only, which runAsNonRoot cannot verify).
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
capabilities:
drop:
- ALL