Allow writable root filesystem for the linuxserver.io containers

With readOnlyRootFilesystem the s6-overlay init cannot rewrite
/etc/passwd, so the containers silently kept the image's built-in
uid/gid 911 instead of the configured PUID/PGID (verified at runtime) -
breaking ownership on the shared media volumes. Drop the now-unneeded
/run and /tmp emptyDirs; deviation documented in values.yaml.

freesailarr/templates/freesailarr.sfs.yaml

@@ -134,12 +134,6 @@ spec:
               name: qbittorrent-config
             - mountPath: /downloads
               name: media-downloads
-            # Writable paths for s6-overlay so the root filesystem stays
-            # read-only (same pattern for all linuxserver.io containers).
-            - mountPath: /run
-              name: qbittorrent-run
-            - mountPath: /tmp
-              name: qbittorrent-tmp
         {{- end }}
         {{- if .Values.prowlarr.enabled }}
         - name: prowlarr
@@ -170,10 +164,6 @@ spec:
           volumeMounts:
             - mountPath: /config
               name: prowlarr-config
-            - mountPath: /run
-              name: prowlarr-run
-            - mountPath: /tmp
-              name: prowlarr-tmp
         {{- end }}
         {{- if .Values.flaresolverr.enabled }}
         - name: flaresolverr
@@ -239,10 +229,6 @@ spec:
               name: media-movies
             - mountPath: /downloads
               name: media-downloads
-            - mountPath: /run
-              name: radarr-run
-            - mountPath: /tmp
-              name: radarr-tmp
         {{- end }}
         {{- if .Values.recyclarr.enabled }}
         - name: recyclarr
@@ -307,10 +293,6 @@ spec:
               name: media-tv
             - mountPath: /downloads
               name: media-downloads
-            - mountPath: /run
-              name: sonarr-run
-            - mountPath: /tmp
-              name: sonarr-tmp
         {{- end }}
         {{- if .Values.seerr.enabled }}
         - name: seerr
@@ -375,10 +357,6 @@ spec:
               name: media-movies
             - mountPath: /tv
               name: media-tv
-            - mountPath: /run
-              name: bazarr-run
-            - mountPath: /tmp
-              name: bazarr-tmp
         {{- end }}
       restartPolicy: Always
       volumes:
@@ -402,18 +380,6 @@ spec:
           persistentVolumeClaim:
             claimName: {{ required "media.tv.existingClaim is required when sonarr or bazarr is enabled" .Values.media.tv.existingClaim }}
         {{- end }}
-        {{- if .Values.qbittorrent.enabled }}
-        - name: qbittorrent-run
-          emptyDir: {}
-        - name: qbittorrent-tmp
-          emptyDir: {}
-        {{- end }}
-        {{- if .Values.prowlarr.enabled }}
-        - name: prowlarr-run
-          emptyDir: {}
-        - name: prowlarr-tmp
-          emptyDir: {}
-        {{- end }}
         {{- if .Values.flaresolverr.enabled }}
         - name: flaresolverr-tmp
           emptyDir: {}
@@ -422,32 +388,14 @@ spec:
             medium: Memory
             sizeLimit: 512Mi
         {{- end }}
-        {{- if .Values.radarr.enabled }}
-        - name: radarr-run
-          emptyDir: {}
-        - name: radarr-tmp
-          emptyDir: {}
-        {{- end }}
         {{- if .Values.recyclarr.enabled }}
         - name: recyclarr-tmp
           emptyDir: {}
         {{- end }}
-        {{- if .Values.sonarr.enabled }}
-        - name: sonarr-run
-          emptyDir: {}
-        - name: sonarr-tmp
-          emptyDir: {}
-        {{- end }}
         {{- if .Values.seerr.enabled }}
         - name: seerr-tmp
           emptyDir: {}
         {{- end }}
-        {{- if .Values.bazarr.enabled }}
-        - name: bazarr-run
-          emptyDir: {}
-        - name: bazarr-tmp
-          emptyDir: {}
-        {{- end }}
   # Config volumes for gluetun and the enabled apps. NOTE: volumeClaimTemplates
   # are immutable - toggling an app's enabled flag later requires recreating
   # the StatefulSet once (kubectl delete statefulset <name> --cascade=orphan

freesailarr/values.yaml

@@ -192,17 +192,22 @@ qbittorrent:
       ephemeralStorage: 100Mi
   # Deviations from the hardening baseline, forced by the linuxserver.io
   # images (s6-overlay init that starts as root and drops to PUID/PGID):
-  # - no runAsNonRoot: s6-overlay must start as root to create the abc user
-  #   from PUID/PGID and chown /config.
+  # - no runAsNonRoot: s6-overlay must start as root to apply PUID/PGID and
+  #   chown /config.
+  # - readOnlyRootFilesystem: false: the s6 init applies PUID/PGID by
+  #   rewriting /etc/passwd and /etc/group and stages runtime state on the
+  #   root filesystem. With a read-only root filesystem the containers still
+  #   start, but silently keep the image's built-in uid/gid (911) instead of
+  #   PUID/PGID (verified at runtime) - unacceptable for the shared media
+  #   volumes.
   # - capabilities: ALL dropped except what the s6-overlay init needs:
   #   CHOWN/FOWNER/DAC_OVERRIDE (taking ownership of /config and /run) and
   #   SETUID/SETGID (dropping from root to the PUID/PGID user).
-  # readOnlyRootFilesystem stays true: the writable paths (/run, /tmp) are
-  # mounted as emptyDirs. (Same block for all linuxserver.io containers:
-  # qbittorrent, prowlarr, radarr, sonarr, bazarr.)
+  # (Same block for all linuxserver.io containers: qbittorrent, prowlarr,
+  # radarr, sonarr, bazarr.)
   securityContext:
     allowPrivilegeEscalation: false
-    readOnlyRootFilesystem: true
+    readOnlyRootFilesystem: false
     capabilities:
       drop:
         - ALL
@@ -255,7 +260,7 @@ prowlarr:
   # linuxserver.io image - see the qbittorrent securityContext comment.
   securityContext:
     allowPrivilegeEscalation: false
-    readOnlyRootFilesystem: true
+    readOnlyRootFilesystem: false
     capabilities:
       drop:
         - ALL
@@ -362,7 +367,7 @@ radarr:
   # linuxserver.io image - see the qbittorrent securityContext comment.
   securityContext:
     allowPrivilegeEscalation: false
-    readOnlyRootFilesystem: true
+    readOnlyRootFilesystem: false
     capabilities:
       drop:
         - ALL
@@ -467,7 +472,7 @@ sonarr:
   # linuxserver.io image - see the qbittorrent securityContext comment.
   securityContext:
     allowPrivilegeEscalation: false
-    readOnlyRootFilesystem: true
+    readOnlyRootFilesystem: false
     capabilities:
       drop:
         - ALL
@@ -571,7 +576,7 @@ bazarr:
   # linuxserver.io image - see the qbittorrent securityContext comment.
   securityContext:
     allowPrivilegeEscalation: false
-    readOnlyRootFilesystem: true
+    readOnlyRootFilesystem: false
     capabilities:
       drop:
         - ALL