bug: container can't run under a random uid (OpenShift)

[sebdanielsson]

Chart Version

0.5.0

Bug Description

I've been trying to get Homarr running on a OpenShift cluster. In OpenShift a container starts with a random UID for security reasons. Because of this the container can't start as it's trying to write to /etc/nginx/nginx.conf during runtime.

values.yaml

Relevant log output

[oben01]

Hello @sebdanielsson, thank you for opening this issue. I don’t think this is a chart related problem, as the Docker image already includes the Nginx proxy. @manuel-rw, what do you think?

[manuel-rw]

Agree, not a chart issue. Also, Homarr needs to be started as root but will "deescalate" afterwards:
https://github.com/homarr-labs/homarr/blob/dev/scripts/run.sh
https://github.com/homarr-labs/homarr/blob/dev/Dockerfile

[sebdanielsson]

Could it be modified to drop the requirement for running as root during initialization? In Kubernetes, it is generally recommended to avoid running containers as root, even during init, to prevent the need for higher SCC:s.

[steled]

I created a PR #204 that adds support for readOnlyRootFilesystem for the nginx component.
@sebdanielsson until it is merged you can update your deployment manually to get Homarr up and running.

[sebdanielsson]

I created a PR #204 that adds support for readOnlyRootFilesystem for the nginx component.
@sebdanielsson until it is merged you can update your deployment manually to get Homarr up and running.

That's awesome, thank you!🤩

[oben01]

@manuel-rw I’m not really a fan of having multiple NGINX configurations split between the app (Docker image) and the Helm chart it means there’s no single source of truth.
Is there a way to run the container without permission issues while keeping a single configuration? If not, I’ll need to take some time to properly review and rethink this approach.

[manuel-rw]

As far as I'm aware, no. @Meierschlumpf can you comment? I agree, we should not have multiple configs. I understand the security concern - and I generally agree, but we simply found no solution yet.
If anyone here can contribute a full non-root solution to the main repository, that'd be great.

[Meierschlumpf]

As far as I can tell there is no simple way to achieve this, no. Somebody posted a comment in the regard of starting it without root here