lukaszraczylo/gohoarder
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/gohoarder.git synced 2026-07-06 04:04:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixup! chore(helm): enhance security context and volume handling

Browse Source
This commit is contained in:
Lukasz Raczylo
2026-01-03 01:10:49 +00:00
parent 6afa55b5f5
commit f03a288326
3 changed files with 15 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile.scanner
+3 -3
View File
@@ -53,7 +53,7 @@ ENV SCANNER_MODE=true \
SCANNER_INTERVAL=300 SCANNER_INTERVAL=300
# Run the scanner in background mode # Run the scanner in background mode
# Note: You may need to add a scanner-specific command to your CLI # The scanner runs the same serve command but uses SCANNER_MODE env var
# For now, this assumes the serve command can run in scanner mode # and configuration to determine its role
ENTRYPOINT ["/usr/local/bin/gohoarder"] ENTRYPOINT ["/usr/local/bin/gohoarder"]
CMD ["serve", "--scanner-only"] CMD ["serve"]
helm/gohoarder/templates/deployment-scanner.yaml
+6 -4
View File
@@ -37,10 +37,8 @@ spec:
mkdir -p /var/cache/gohoarder /var/lib/gohoarder/metadata /tmp/gohoarder mkdir -p /var/cache/gohoarder /var/lib/gohoarder/metadata /tmp/gohoarder
{{- if .Values.security.scanners.trivy.enabled }} {{- if .Values.security.scanners.trivy.enabled }}
mkdir -p {{ .Values.security.scanners.trivy.cacheDb }} mkdir -p {{ .Values.security.scanners.trivy.cacheDb }}
chown -R 1000:1000 {{ .Values.security.scanners.trivy.cacheDb }}
{{- end }} {{- end }}
chown -R 1000:1000 /var/cache/gohoarder /var/lib/gohoarder /tmp/gohoarder chmod 750 /var/cache/gohoarder /var/lib/gohoarder 2>/dev/null || true
chmod 750 /var/cache/gohoarder /var/lib/gohoarder
volumeMounts: volumeMounts:
- name: storage - name: storage
mountPath: /var/cache/gohoarder mountPath: /var/cache/gohoarder
@@ -53,7 +51,11 @@ spec:
- name: tmp - name: tmp
mountPath: /tmp/gohoarder mountPath: /tmp/gohoarder
securityContext: securityContext:
runAsUser: 0 runAsUser: 1000
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
containers: containers:
- name: scanner - name: scanner
securityContext: securityContext:
helm/gohoarder/templates/deployment-server.yaml
+6 -3
View File
@@ -36,8 +36,7 @@ spec:
args: args:
- | - |
mkdir -p /var/cache/gohoarder /var/lib/gohoarder/metadata /tmp/gohoarder mkdir -p /var/cache/gohoarder /var/lib/gohoarder/metadata /tmp/gohoarder
chown -R 1000:1000 /var/cache/gohoarder /var/lib/gohoarder /tmp/gohoarder chmod 750 /var/cache/gohoarder /var/lib/gohoarder 2>/dev/null || true
chmod 750 /var/cache/gohoarder /var/lib/gohoarder
volumeMounts: volumeMounts:
- name: storage - name: storage
mountPath: /var/cache/gohoarder mountPath: /var/cache/gohoarder
@@ -46,7 +45,11 @@ spec:
- name: tmp - name: tmp
mountPath: /tmp/gohoarder mountPath: /tmp/gohoarder
securityContext: securityContext:
runAsUser: 0 runAsUser: 1000
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
containers: containers:
- name: server - name: server
securityContext: securityContext: