jklein
2de85ea30e
The chart mounted no volumes at all while running with readOnlyRootFilesystem: true, so every Next.js write to /app/apps/web/.next/cache failed. The image optimizer's failure even surfaced as an unhandledRejection, so this was more than log noise. The cache path is now a writable emptyDir; path and an optional sizeLimit are configurable under rallly.cache. The hardening is untouched — the pod's existing fsGroup (1000) is what makes the mounted volume writable for uid 20000. Verified in a throwaway k3d cluster which paths the app actually writes: with a fully writable root filesystem and the cache mounted, the only path the container touches is the cache directory itself. /tmp, $HOME (=/app) and the rest of the root filesystem stay untouched, so no second mount is needed. Also drops the vestigial "capabilities.add: []": Trivy's AVD-KSV-0022 for rallly (#84) comes from the older chart version deployed in the cluster, which rendered a null list entry under add:. Reproduced with trivy config against both renderings; the app needs no capabilities. Major bump: runtime behavior changes, a volume is added. Fixes #60
12 lines
283 B
YAML
12 lines
283 B
YAML
apiVersion: v2
|
|
name: rallly
|
|
description: A Helm chart to deploy Rallly on Kubernetes
|
|
icon: https://raw.githubusercontent.com/lukevella/rallly/main/apps/landing/public/apple-touch-icon.png
|
|
|
|
type: application
|
|
|
|
version: 5.0.0+up4.12.3
|
|
appVersion: "4.12.3"
|
|
|
|
maintainers:
|
|
- name: jklein |