xarmian be9a96ba21 chore: run containers as non-root + harden K8s securityContext (TASK-680) (#219) ...

First thing external reviewers flag on a public repo: "why does this
image run as root?". Fixes both Dockerfiles and the K8s deployment.

Dockerfiles (Dockerfile + Dockerfile.goreleaser):
- Add a non-login uid:1000 "pad" user via adduser
- chown /data so the app can write its SQLite DB as the unprivileged user
- Declare USER pad before the ENTRYPOINT

deploy/k8s/deployment.yaml:
- Pod-level securityContext: runAsNonRoot, runAsUser/Group 1000, fsGroup
  1000 (so the emptyDir volume is group-writable), seccompProfile
  RuntimeDefault
- Container-level securityContext: allowPrivilegeEscalation false,
  readOnlyRootFilesystem true, drop ALL capabilities

Verified:
- docker build succeeds; `docker inspect ... Config.User` = "pad"
- Container running as uid 1000 serves /api/v1/health successfully
- Container runs with --read-only rootfs + writable /data volume with no
  runtime errors (server only writes to /data, never /tmp)
- deploy/k8s/deployment.yaml parses via yq; securityContext block
  structurally correct

Parent: PLAN-644.

2026-04-22 20:23:14 -04:00

..

k8s

chore: run containers as non-root + harden K8s securityContext (TASK-680) (#219)

2026-04-22 20:23:14 -04:00

Caddyfile

docs: add deployment documentation, Docker Compose, and K8s manifests

2026-04-06 01:58:04 +00:00

nginx.conf

docs: add deployment documentation, Docker Compose, and K8s manifests

2026-04-06 01:58:04 +00:00