jklein
37b76e353c
Sets seccompProfile.type: RuntimeDefault in the pod security context, so the container runtime's default syscall filter applies to every container in the pod. The value lives in the pod context rather than the container context because it covers init containers and any container added later without being repeated; a container that needs a different filter can still override it under securityContext.container, which wins over the pod value. Gotenberg is the chart where a syscall filter was most likely to bite: it drives headless Chromium and LibreOffice, and browser sandboxes are the classic casualty of a restrictive seccomp profile. Verified in k3d that both engines still work under the filter - Chromium HTML->PDF and LibreOffice document->PDF both return real, non-empty PDFs, and the kernel reports Seccomp: 2 (filter mode) inside the container. Major bump: runtime behavior changes. Refs #84
12 lines
227 B
YAML
12 lines
227 B
YAML
apiVersion: v2
|
|
name: gotenberg
|
|
description: A Helm chart to deploy Gotenberg on Kubernetes
|
|
icon: https://gotenberg.dev/img/logo.png
|
|
|
|
type: application
|
|
|
|
version: 8.0.0+up8.36.0
|
|
appVersion: "8.36.0"
|
|
|
|
maintainers:
|
|
- name: jklein |