billimek / k8s-gitops

GitOps principles to define kubernetes cluster state via code
Apache License 2.0
639 stars 84 forks source link

Running homeassistant as non root user #3929

Open rasmusson opened 1 month ago

rasmusson commented 1 month ago

I saw you are running homeassistant on k8s as a non root user. I trying to do the same but just get errors from s6 that it does not have root privilege.

How did you manage to get it working? I tried same set up as you with env and security context

billimek commented 1 month ago

I don't think I needed to do anything special to get it running, but I do wonder if there is an issue with the default data/config directory not being owned by the non-root user (i.e. UID/GID 1000 in my case). This may be the first thing to check.

To check out further details, I attached a debug container to the home-assistant container and do see that all of the processes are indeed running as the non-root user (1000).

k3s-e:/root$ ps auwx
PID   USER     TIME  COMMAND
    1 1000      0:00 /package/admin/s6/command/s6-svscan -d4 -- /run/service
   20 1000      0:00 s6-supervise s6-linux-init-shutdownd
   22 1000      0:00 /package/admin/s6-linux-init/command/s6-linux-init-shutdownd -d3 -c /run/s6/basedir -g 3000 -C -B
   29 1000      0:00 s6-supervise s6rc-fdholder
   30 1000      0:00 s6-supervise s6rc-oneshot-runner
   38 1000      0:00 /package/admin/s6/command/s6-ipcserverd -1 -- /package/admin/s6/command/s6-ipcserver-access -v0 -E -l0 -i data/rules -- /package/admin/s6/comman
   69 1000      0:00 s6-supervise home-assistant
   71 1000      1h55 python3 -m homeassistant --config /config
33258 1000      0:00 bash
33276 1000      0:00 ps auwx

Beyond that, I'm not sure what else would be special or different to get this to work!

rasmusson commented 2 weeks ago

Ok, I managed to solve it here, but I had to mount a emptydir volume in /var as s6 stopped saying it didnt have permission