fix(media): remove incompatible security context from kaizoku and flaresolverr #198

Merged

Exikle merged 1 commit from fix/media-puid-pgid-security into main

2026-06-03 12:11:41 +00:00

Exikle commented

2026-06-03 12:08:43 +00:00

Owner

No description provided.

Exikle added 1 commit

2026-06-03 12:08:43 +00:00

fix(media): remove incompatible security context from kaizoku and flaresolverr

Flate / Flate - Filter (pull_request) Successful in 13s

Details

Labeler / Labeler (pull_request_target) Successful in 34s

Details

Flate / Flate (helmrelease) (pull_request) Successful in 1m31s

Details

Flate / Flate (kustomization) (pull_request) Successful in 1m42s

Details

Flate / Flate - Comment (pull_request) Successful in 27s

Details

Flate - Success Flate checks success

Flate / Flate - Success (pull_request) Successful in 25s

Details

b561de8f53

kaizoku uses a PUID/PGID-style entrypoint that starts as root to create
its own user — runAsUser/runAsNonRoot/readOnlyRootFilesystem all break it.
flaresolverr runs Chromium which writes to its profile directory outside
/tmp — readOnlyRootFilesystem breaks it even with a /tmp emptyDir.

Also update review-app skill checklists with A19/A20 advisory items and
H8-H10/H22-H24 N/A exceptions so this class of image is handled correctly
in future reviews.

Exikle scheduled this pull request to auto merge when all checks succeed

2026-06-03 12:08:53 +00:00

Exikle added the

area/kubernetes

area/media

labels

2026-06-03 12:09:12 +00:00

dusk-bot commented

2026-06-03 12:11:09 +00:00

Collaborator

Kustomization diff


@@ spec.values.controllers.flaresolverr.containers.app.securityContext @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/media/flaresolverr
! - one map entry removed:
- readOnlyRootFilesystem: true

@@ spec.values.controllers.kaizoku.containers.app @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/media/kaizoku
! - one map entry removed:
- securityContext:
-   allowPrivilegeEscalation: false
-   capabilities:
-     drop:
-     - ALL
-   readOnlyRootFilesystem: true

@@ spec.values.defaultPodOptions.securityContext @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/media/kaizoku
! - three map entries removed:
- runAsGroup: 100
- runAsNonRoot: true
- runAsUser: 99

HelmRelease diff


@@ spec.template.spec.containers.app.securityContext @@
# apps/v1/Deployment/media/flaresolverr
! - one map entry removed:
- readOnlyRootFilesystem: true

@@ spec.template.spec.containers.app @@
# apps/v1/Deployment/media/kaizoku
! - one map entry removed:
- securityContext:
-   allowPrivilegeEscalation: false
-   capabilities:
-     drop:
-     - ALL
-   readOnlyRootFilesystem: true

@@ spec.template.spec.securityContext @@
# apps/v1/Deployment/media/kaizoku
! - three map entries removed:
- runAsGroup: 100
- runAsNonRoot: true
- runAsUser: 99

_{Diff created by flate — Workflow run}

<details open><summary>Kustomization diff</summary> ```diff @@ spec.values.controllers.flaresolverr.containers.app.securityContext @@ # helm.toolkit.fluxcd.io/v2/HelmRelease/media/flaresolverr ! - one map entry removed: - readOnlyRootFilesystem: true @@ spec.values.controllers.kaizoku.containers.app @@ # helm.toolkit.fluxcd.io/v2/HelmRelease/media/kaizoku ! - one map entry removed: - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true @@ spec.values.defaultPodOptions.securityContext @@ # helm.toolkit.fluxcd.io/v2/HelmRelease/media/kaizoku ! - three map entries removed: - runAsGroup: 100 - runAsNonRoot: true - runAsUser: 99 ``` </details> <details open><summary>HelmRelease diff</summary> ```diff @@ spec.template.spec.containers.app.securityContext @@ # apps/v1/Deployment/media/flaresolverr ! - one map entry removed: - readOnlyRootFilesystem: true @@ spec.template.spec.containers.app @@ # apps/v1/Deployment/media/kaizoku ! - one map entry removed: - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true @@ spec.template.spec.securityContext @@ # apps/v1/Deployment/media/kaizoku ! - three map entries removed: - runAsGroup: 100 - runAsNonRoot: true - runAsUser: 99 ``` </details> <sub>Diff created by [flate](https://github.com/home-operations/flate) — [Workflow run](https://git.dcunha.io/Exikle/Artemis-Cluster/actions/runs/754)</sub>

Exikle merged commit fcf8f8455c into main

2026-06-03 12:11:41 +00:00

Exikle deleted branch fix/media-puid-pgid-security

2026-06-03 12:11:42 +00:00

Exikle referenced this pull request from a commit

2026-06-03 12:11:43 +00:00

fix(media): remove incompatible security context from kaizoku and flaresolverr (#198)