diff options
Diffstat (limited to 'f3s/freshrss')
| -rw-r--r-- | f3s/freshrss/README.md | 4 | ||||
| -rw-r--r-- | f3s/freshrss/helm-chart/templates/deployment.yaml | 12 |
2 files changed, 10 insertions, 6 deletions
diff --git a/f3s/freshrss/README.md b/f3s/freshrss/README.md index a0295b2..1a88372 100644 --- a/f3s/freshrss/README.md +++ b/f3s/freshrss/README.md @@ -12,8 +12,8 @@ Example commands: ```bash sudo mkdir -p /data/nfs/k3svolumes/freshrss/data -# Optional: ensure write permissions for the container user (often UID/GID 33) -sudo chown -R 33:33 /data/nfs/k3svolumes/freshrss/data +# Ensure write permissions for the runtime user/group (nobody:nogroup = 65534:65534) +sudo chown -R 65534:65534 /data/nfs/k3svolumes/freshrss/data ``` ## Installing the Chart diff --git a/f3s/freshrss/helm-chart/templates/deployment.yaml b/f3s/freshrss/helm-chart/templates/deployment.yaml index 1277c62..99f114c 100644 --- a/f3s/freshrss/helm-chart/templates/deployment.yaml +++ b/f3s/freshrss/helm-chart/templates/deployment.yaml @@ -13,14 +13,19 @@ spec: labels: app: freshrss spec: + securityContext: + runAsUser: 65534 # nobody + runAsGroup: 65534 # nobody / nogroup + fsGroup: 65534 # ensure mounted volumes are group-writable + runAsNonRoot: true containers: - name: freshrss image: freshrss/freshrss:latest ports: - - containerPort: 80 + - containerPort: 80 volumeMounts: - - name: freshrss-data - mountPath: /var/www/FreshRSS/data + - name: freshrss-data + mountPath: /var/www/FreshRSS/data volumes: - name: freshrss-data persistentVolumeClaim: @@ -41,4 +46,3 @@ spec: targetPort: 80 selector: app: freshrss - |