3 Commits
Author SHA1 Message Date
volker.raschekandCopilot 562001dc0b fix(deployment): run plugin container as the reposilite user
Helm / helm-lint (push) Successful in 8s
Helm / helm-unittest (push) Successful in 27s
Generate README / generate-parameters (push) Successful in 42s
Markdown linter / markdown-link-checker (push) Successful in 38s
Markdown linter / markdown-lint (push) Successful in 42s
Release / publish-chart (push) Successful in 1m16s
The reposilite entrypoint chowns /app to 977:977 whenever it starts as root. The plugin container downloaded
the jar as its own image user (101), so after the first start the file was owned by 977:977 with mode 0644.
Since the plugins emptyDir survives a container restart within the same pod, a restarted plugin container
could no longer overwrite the existing jar and aborted with "Permission denied", which left the pod in a
permanent Init:CrashLoopBackOff until the pod itself was recreated.

Run the plugin container as 977:977 by default and expose the security context as
deployment.pluginContainer.securityContext, so it can be aligned when PUID/PGID are overridden.

Co-authored-by: Copilot <copilot@github.com>
2026-09-27 18:13:56 +02:00
CSRBot b2b9ab19a0 Merge pull request 'chore(deps): update docker.io/library/node docker tag to v26.10.0' (#48) from renovate/update-docker.iolibrarynode into master
Helm / helm-lint (push) Successful in 11s
Helm / helm-unittest (push) Successful in 14s
2026-09-22 22:18:31 +00:00
CSRBot efd7b694a3 chore(deps): update docker.io/library/node docker tag to v26.10.0
Helm / helm-lint (push) Successful in 7s
Helm / helm-unittest (push) Successful in 23s
Helm / helm-unittest (pull_request) Successful in 14s
Helm / helm-lint (pull_request) Successful in 7s
2026-09-22 22:18:12 +00:00
7 changed files with 64 additions and 46 deletions
+1 -1
View File
@@ -15,7 +15,7 @@ on:
jobs: jobs:
generate-parameters: generate-parameters:
container: container:
image: docker.io/library/node:26.9.0-alpine image: docker.io/library/node:26.10.0-alpine
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Install tooling - name: Install tooling
+2 -2
View File
@@ -15,7 +15,7 @@ on:
jobs: jobs:
markdown-link-checker: markdown-link-checker:
container: container:
image: docker.io/library/node:26.9.0-alpine image: docker.io/library/node:26.10.0-alpine
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Install tooling - name: Install tooling
@@ -30,7 +30,7 @@ jobs:
markdown-lint: markdown-lint:
container: container:
image: docker.io/library/node:26.9.0-alpine image: docker.io/library/node:26.10.0-alpine
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Install tooling - name: Install tooling
+1 -1
View File
@@ -8,7 +8,7 @@ on:
jobs: jobs:
publish-chart: publish-chart:
container: container:
image: docker.io/volkerraschek/helm:4.3.0 image: docker.io/volkerraschek/helm:3.19.2
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Install packages via apk - name: Install packages via apk
+43 -41
View File
@@ -270,47 +270,49 @@ spec:
### Deployment ### Deployment
| Name | Description | Value | | Name | Description | Value |
| -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------- | | ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
| `deployment.annotations` | Additional deployment annotations. | `{}` | | `deployment.annotations` | Additional deployment annotations. | `{}` |
| `deployment.labels` | Additional deployment labels. | `{}` | | `deployment.labels` | Additional deployment labels. | `{}` |
| `deployment.additionalContainers` | List of additional containers. | `[]` | | `deployment.additionalContainers` | List of additional containers. | `[]` |
| `deployment.affinity` | Affinity for the Reposilite deployment. | `{}` | | `deployment.affinity` | Affinity for the Reposilite deployment. | `{}` |
| `deployment.initContainers` | List of additional init containers. | `[]` | | `deployment.initContainers` | List of additional init containers. | `[]` |
| `deployment.dnsConfig` | dnsConfig of the Reposilite deployment. | `{}` | | `deployment.dnsConfig` | dnsConfig of the Reposilite deployment. | `{}` |
| `deployment.dnsPolicy` | dnsPolicy of the Reposilite deployment. | `""` | | `deployment.dnsPolicy` | dnsPolicy of the Reposilite deployment. | `""` |
| `deployment.hostname` | Individual hostname of the pod. | `""` | | `deployment.hostname` | Individual hostname of the pod. | `""` |
| `deployment.subdomain` | Individual domain of the pod. | `""` | | `deployment.subdomain` | Individual domain of the pod. | `""` |
| `deployment.hostNetwork` | Use the kernel network namespace of the host system. | `false` | | `deployment.hostNetwork` | Use the kernel network namespace of the host system. | `false` |
| `deployment.imagePullSecrets` | Secret to use for pulling the image. | `[]` | | `deployment.imagePullSecrets` | Secret to use for pulling the image. | `[]` |
| `deployment.reposilite.args` | Arguments passed to the Reposilite container. | `[]` | | `deployment.reposilite.args` | Arguments passed to the Reposilite container. | `[]` |
| `deployment.reposilite.command` | Command passed to the Reposilite container. | `[]` | | `deployment.reposilite.command` | Command passed to the Reposilite container. | `[]` |
| `deployment.reposilite.env` | List of environment variables for the Reposilite container. | | | `deployment.reposilite.env` | List of environment variables for the Reposilite container. | |
| `deployment.reposilite.envFrom` | List of environment variables mounted from configMaps or secrets for the Reposilite container. | `[]` | | `deployment.reposilite.envFrom` | List of environment variables mounted from configMaps or secrets for the Reposilite container. | `[]` |
| `deployment.reposilite.image.registry` | Image registry, eg. `docker.io`. | `docker.io` | | `deployment.reposilite.image.registry` | Image registry, eg. `docker.io`. | `docker.io` |
| `deployment.reposilite.image.repository` | Image repository, eg. `library/busybox`. | `dzikoysk/reposilite` | | `deployment.reposilite.image.repository` | Image repository, eg. `library/busybox`. | `dzikoysk/reposilite` |
| `deployment.reposilite.image.tag` | Custom image tag, eg. `0.1.0`. Defaults to `appVersion`. | `""` | | `deployment.reposilite.image.tag` | Custom image tag, eg. `0.1.0`. Defaults to `appVersion`. | `""` |
| `deployment.reposilite.image.pullPolicy` | Image pull policy. | `IfNotPresent` | | `deployment.reposilite.image.pullPolicy` | Image pull policy. | `IfNotPresent` |
| `deployment.reposilite.resources` | CPU and memory resources of the pod. | `{}` | | `deployment.reposilite.resources` | CPU and memory resources of the pod. | `{}` |
| `deployment.reposilite.securityContext` | Security context of the container of the deployment. | `{}` | | `deployment.reposilite.securityContext` | Security context of the container of the deployment. | `{}` |
| `deployment.reposilite.volumeMounts` | Additional volume mounts. | `[]` | | `deployment.reposilite.volumeMounts` | Additional volume mounts. | `[]` |
| `deployment.nodeSelector` | NodeSelector of the Reposilite deployment. | `{}` | | `deployment.nodeSelector` | NodeSelector of the Reposilite deployment. | `{}` |
| `deployment.pluginContainer.args` | Arguments passed to the plugin container. | `["--location","--fail","--max-time","60"]` | | `deployment.pluginContainer.args` | Arguments passed to the plugin container. | `["--location","--fail","--max-time","60"]` |
| `deployment.pluginContainer.image.registry` | Image registry, eg. `docker.io`. | `docker.io` | | `deployment.pluginContainer.image.registry` | Image registry, eg. `docker.io`. | `docker.io` |
| `deployment.pluginContainer.image.repository` | Image repository, eg. `curlimages/curl`. | `curlimages/curl` | | `deployment.pluginContainer.image.repository` | Image repository, eg. `curlimages/curl`. | `curlimages/curl` |
| `deployment.pluginContainer.image.tag` | Custom image tag, eg. `0.1.0`. | `8.22.0` | | `deployment.pluginContainer.image.tag` | Custom image tag, eg. `0.1.0`. | `8.22.0` |
| `deployment.pluginContainer.image.pullPolicy` | Image pull policy. | `IfNotPresent` | | `deployment.pluginContainer.image.pullPolicy` | Image pull policy. | `IfNotPresent` |
| `deployment.priorityClassName` | PriorityClassName of the Reposilite deployment. | `""` | | `deployment.pluginContainer.securityContext.runAsGroup` | Group id of the plugin container. | `977` |
| `deployment.replicas` | Number of replicas for the Reposilite deployment. | `1` | | `deployment.pluginContainer.securityContext.runAsUser` | User id of the plugin container. | `977` |
| `deployment.restartPolicy` | Restart policy of the Reposilite deployment. | `""` | | `deployment.priorityClassName` | PriorityClassName of the Reposilite deployment. | `""` |
| `deployment.securityContext` | Security context of the Reposilite deployment. | `{}` | | `deployment.replicas` | Number of replicas for the Reposilite deployment. | `1` |
| `deployment.strategy.type` | Strategy type - `Recreate` or `RollingUpdate`. | `RollingUpdate` | | `deployment.restartPolicy` | Restart policy of the Reposilite deployment. | `""` |
| `deployment.strategy.rollingUpdate.maxSurge` | The maximum number of pods that can be scheduled above the desired number of pods during a rolling update. | `1` | | `deployment.securityContext` | Security context of the Reposilite deployment. | `{}` |
| `deployment.strategy.rollingUpdate.maxUnavailable` | The maximum number of pods that can be unavailable during a rolling update. | `1` | | `deployment.strategy.type` | Strategy type - `Recreate` or `RollingUpdate`. | `RollingUpdate` |
| `deployment.terminationGracePeriodSeconds` | How long to wait until forcefully kill the pod. | `60` | | `deployment.strategy.rollingUpdate.maxSurge` | The maximum number of pods that can be scheduled above the desired number of pods during a rolling update. | `1` |
| `deployment.tolerations` | Tolerations of the Reposilite deployment. | `[]` | | `deployment.strategy.rollingUpdate.maxUnavailable` | The maximum number of pods that can be unavailable during a rolling update. | `1` |
| `deployment.topologySpreadConstraints` | TopologySpreadConstraints of the Reposilite deployment. | `[]` | | `deployment.terminationGracePeriodSeconds` | How long to wait until forcefully kill the pod. | `60` |
| `deployment.volumes` | Additional volumes to mount into the pods of the reposilite deployment. | `[]` | | `deployment.tolerations` | Tolerations of the Reposilite deployment. | `[]` |
| `deployment.topologySpreadConstraints` | TopologySpreadConstraints of the Reposilite deployment. | `[]` |
| `deployment.volumes` | Additional volumes to mount into the pods of the reposilite deployment. | `[]` |
### Horizontal Pod Autoscaler (HPA) ### Horizontal Pod Autoscaler (HPA)
+5 -1
View File
@@ -71,7 +71,11 @@
{{- if eq (include "reposilite.plugins.prometheus.enabled" $) "true" }} {{- if eq (include "reposilite.plugins.prometheus.enabled" $) "true" }}
{{- $fileName := splitList "/" (tpl .Values.config.plugins.prometheus.url $) | last }} {{- $fileName := splitList "/" (tpl .Values.config.plugins.prometheus.url $) | last }}
{{- $individualArgs := concat $pluginContainerArgs (list "--output" $fileName (tpl .Values.config.plugins.prometheus.url $)) }} {{- $individualArgs := concat $pluginContainerArgs (list "--output" $fileName (tpl .Values.config.plugins.prometheus.url $)) }}
{{- $initContainers = concat $initContainers (list (dict "args" $individualArgs "name" "download-prometheus-plugin" "image" $pluginContainerImage "volumeMounts" $pluginContainerVolumeMounts)) }} {{- $pluginContainer := dict "args" $individualArgs "name" "download-prometheus-plugin" "image" $pluginContainerImage "volumeMounts" $pluginContainerVolumeMounts }}
{{- with .Values.deployment.pluginContainer.securityContext }}
{{- $_ := set $pluginContainer "securityContext" . }}
{{- end }}
{{- $initContainers = concat $initContainers (list $pluginContainer) }}
{{- end }} {{- end }}
{{ toYaml (dict "initContainers" $initContainers) }} {{ toYaml (dict "initContainers" $initContainers) }}
+3
View File
@@ -30,6 +30,9 @@ tests:
- https://reposilite.com/plugins/prometheus.jar - https://reposilite.com/plugins/prometheus.jar
name: download-prometheus-plugin name: download-prometheus-plugin
image: docker.io/curlimages/curl:0.1.0 image: docker.io/curlimages/curl:0.1.0
securityContext:
runAsGroup: 977
runAsUser: 977
volumeMounts: volumeMounts:
- mountPath: /app/data/plugins - mountPath: /app/data/plugins
name: plugins name: plugins
+9
View File
@@ -178,6 +178,15 @@ deployment:
tag: "8.22.0" tag: "8.22.0"
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
## @param deployment.pluginContainer.securityContext.runAsGroup Group id of the plugin container.
## @param deployment.pluginContainer.securityContext.runAsUser User id of the plugin container.
# Reposilite chowns /app to 977:977 when its entrypoint starts as root. Downloading the plugin as a
# different user leaves behind a file the plugin container can no longer overwrite, which breaks every
# restart that reuses the emptyDir. Align this with PUID/PGID when those are overridden.
securityContext:
runAsGroup: 977
runAsUser: 977
## @param deployment.priorityClassName PriorityClassName of the Reposilite deployment. ## @param deployment.priorityClassName PriorityClassName of the Reposilite deployment.
priorityClassName: "" priorityClassName: ""