Allow writable root filesystem for flaresolverr

The image copies and patches the chromedriver binary to the hardcoded
path /app/chromedriver at startup (no env override exists) and writes
chromedriver caches under /app, so readOnlyRootFilesystem cannot hold;
deviation documented in values.yaml. Reverts the HOME=/tmp workaround,
which only covered the cache path, not the binary patching.

freesailarr/templates/freesailarr.sfs.yaml

@@ -170,11 +170,6 @@ spec:
           env:
             - name: TZ
               value: {{ .Values.timezone | quote }}
-            # flaresolverr writes chromedriver caches under $HOME (image
-            # default /app, which is read-only); point HOME at the writable
-            # /tmp emptyDir so the root filesystem can stay read-only.
-            - name: HOME
-              value: /tmp
             {{- include "freesailarr.env" (dict "root" $ "env" .Values.flaresolverr.env) | nindent 12 }}
           ports:
             - containerPort: 8191

freesailarr/values.yaml

@@ -299,13 +299,17 @@ flaresolverr:
       cpu: 0.2
       memory: 512Mi
       ephemeralStorage: 200Mi
-  # The image runs as its own non-root user; chromium's writable paths (/tmp,
+  # Deviations from the hardening baseline, forced by the flaresolverr image:
-  # /dev/shm) are emptyDirs, so the full hardening baseline holds. runAsUser/
+  # - readOnlyRootFilesystem: false: on startup flaresolverr copies and
-  # runAsGroup pin the image's "flaresolverr" user numerically (uid/gid 1000,
+  #   patches the chromedriver binary to the hardcoded path /app/chromedriver
-  # the image declares it by name only, which runAsNonRoot cannot verify).
+  #   and writes chromedriver caches under /app (its home directory).
+  # - runAsUser/runAsGroup pin the image's "flaresolverr" user numerically
+  #   (uid/gid 1000; the image declares it by name only, which the kubelet's
+  #   runAsNonRoot check cannot verify).
+  # Chromium's scratch paths (/tmp, /dev/shm) are emptyDirs.
   securityContext:
     allowPrivilegeEscalation: false
-    readOnlyRootFilesystem: true
+    readOnlyRootFilesystem: false
     runAsNonRoot: true
     runAsUser: 1000
     runAsGroup: 1000