Harden pod and container security contexts across all workloads

Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem,
capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads
that lacked it: apache-tika, cyberchef, gotenberg, homeassistant,
matrix-delegation-nginx, paperless-server, paperless-consume cronjob
(plus automountServiceAccountToken false), patchmon-frontend,
urlaubsverwaltung and zipline. All contexts are configurable via
securityContext.pod / securityContext.container in values.yaml; writable
paths are provided as emptyDirs. Image-forced deviations (Home Assistant
root start for s6-overlay + NET_RAW for discovery, paperless root init
container for /run ownership) are documented in the charts' values.yaml.
Major version bump for every changed published chart.

homeassistant/Chart.yaml

@@ -3,7 +3,7 @@ name: homeassistant
 description: A Helm chart to deploy Home Assistant on Kubernetes
 type: application
 
-version: 2.0.0+up2026.2.3
+version: 3.0.0+up2026.2.3
 
 appVersion: "2026.2.3"
 

homeassistant/templates/homeassistant.sfs.yaml

@@ -17,10 +17,14 @@ spec:
       name: "{{ .Release.Name }}-{{ .Chart.Name }}-sfs"
     spec:
       automountServiceAccountToken: false
+      securityContext:
+        {{- toYaml .Values.securityContext.pod | nindent 8 }}
       containers:
         - name: "{{ .Release.Name }}-{{ .Chart.Name }}"
           image: "ghcr.io/home-assistant/home-assistant:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
+          securityContext:
+            {{- toYaml .Values.securityContext.container | nindent 12 }}
           env:
             - name: TZ
               value: "{{ .Values.core.timezone }}"
@@ -56,7 +60,17 @@ spec:
             - mountPath: /config
               name: hass-volume
               subPath: hass-config
+            # Writable emptyDirs so the root filesystem can stay read-only:
+            # s6-overlay needs /run, Home Assistant writes temp files to /tmp.
+            - mountPath: /tmp
+              name: tmp
+            - mountPath: /run
+              name: run
       volumes:
+        - name: tmp
+          emptyDir: {}
+        - name: run
+          emptyDir: {}
         - name: core-config
           secret:
             secretName: {{ .Release.Name }}-{{ .Chart.Name }}-config-secret

homeassistant/values.yaml

@@ -22,6 +22,26 @@ ingress:
   #    hosts:
   #      - chart-example.local
 
+# Documented deviation from the repo-wide hardening standard: the official
+# Home Assistant container must start as root — it boots via the s6-overlay
+# init system, which performs its setup as uid 0 (the image supports no
+# non-root user), so runAsNonRoot/runAsUser are deliberately not set.
+# Everything else is hardened: no privilege escalation, all capabilities
+# dropped and a read-only root filesystem with writable emptyDirs for
+# /tmp and /run (s6-overlay state). NET_RAW is added back because Home
+# Assistant's device discovery (DHCP watcher, ping/arp integrations) uses
+# raw sockets and logs "Operation not permitted" without it.
+securityContext:
+  pod: {}
+  container:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop:
+        - ALL
+      add:
+        - NET_RAW
+
 resources:
    limits:
      cpu: 1