Release gohoarder 0.0.4

charts/gohoarder/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: gohoarder
 description: A universal package cache proxy supporting npm, PyPI, and Go modules with security scanning
 type: application
-version: 0.0.3
-appVersion: "0.0.3"
+version: 0.0.4
+appVersion: "0.0.4"
 keywords:
   - package-manager
   - cache

charts/gohoarder/templates/deployment-scanner.yaml

@@ -37,10 +37,8 @@ spec:
           mkdir -p /var/cache/gohoarder /var/lib/gohoarder/metadata /tmp/gohoarder
           {{- if .Values.security.scanners.trivy.enabled }}
           mkdir -p {{ .Values.security.scanners.trivy.cacheDb }}
-          chown -R 1000:1000 {{ .Values.security.scanners.trivy.cacheDb }}
           {{- end }}
-          chown -R 1000:1000 /var/cache/gohoarder /var/lib/gohoarder /tmp/gohoarder
-          chmod 750 /var/cache/gohoarder /var/lib/gohoarder
+          chmod 750 /var/cache/gohoarder /var/lib/gohoarder 2>/dev/null || true
         volumeMounts:
         - name: storage
           mountPath: /var/cache/gohoarder
@@ -53,7 +51,11 @@ spec:
         - name: tmp
           mountPath: /tmp/gohoarder
         securityContext:
-          runAsUser: 0
+          runAsUser: 1000
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
       containers:
       - name: scanner
         securityContext:

charts/gohoarder/templates/deployment-server.yaml

@@ -36,8 +36,7 @@ spec:
         args:
         - |
           mkdir -p /var/cache/gohoarder /var/lib/gohoarder/metadata /tmp/gohoarder
-          chown -R 1000:1000 /var/cache/gohoarder /var/lib/gohoarder /tmp/gohoarder
-          chmod 750 /var/cache/gohoarder /var/lib/gohoarder
+          chmod 750 /var/cache/gohoarder /var/lib/gohoarder 2>/dev/null || true
         volumeMounts:
         - name: storage
           mountPath: /var/cache/gohoarder
@@ -46,7 +45,11 @@ spec:
         - name: tmp
           mountPath: /tmp/gohoarder
         securityContext:
-          runAsUser: 0
+          runAsUser: 1000
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
       containers:
       - name: server
         securityContext:

charts/gohoarder/values.yaml

@@ -51,17 +51,17 @@ image:
   server:
     repository: ghcr.io/lukaszraczylo/gohoarder-server
     pullPolicy: IfNotPresent
-    tag: "0.0.3"
+    tag: "0.0.4"
 
   frontend:
     repository: ghcr.io/lukaszraczylo/gohoarder-frontend
     pullPolicy: IfNotPresent
-    tag: "0.0.3"
+    tag: "0.0.4"
 
   scanner:
     repository: ghcr.io/lukaszraczylo/gohoarder-scanner
     pullPolicy: IfNotPresent
-    tag: "0.0.3"
+    tag: "0.0.4"
 
 # Service Account
 serviceAccount: