admin c99070c105 komga + audiobookshelf: add no-new-privileges (root-fallback hardening) ...

Address security review: reverting to root removed the user:1000 boundary, so add
security_opt no-new-privileges:true to block SUID-based escalation. Full cap_drop
is intentionally NOT applied — the images' root-init needs CHOWN/SETUID/SETGID to
set up /config and /metadata (dropping them reproduces the crash we hit at user:1000).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-14 22:17:32 +02:00

..

actualbudget

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

adventurelog

adventurelog: mark SECRET_KEY as data_key (fail-closed restore annotation)

2026-06-13 10:20:36 +02:00

audiobookshelf

komga + audiobookshelf: add no-new-privileges (root-fallback hardening)

2026-06-14 22:17:32 +02:00

bentopdf

fix(bentopdf): remove empty volumes block that breaks docker compose validation

2026-02-25 15:13:19 +01:00

bookstack

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

calcom

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

calibre-web

userdata layout: repoint customer-content mounts to ${USERDATA_PATH}

2026-06-14 21:46:23 +02:00

claper

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

code-server

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

crafty-controller

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

docmost

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

emby

userdata layout: repoint customer-content mounts to ${USERDATA_PATH}

2026-06-14 21:46:23 +02:00

ghost

fix(ghost): fix healthchecks for Ghost 6.x (301 redirects to external URL)

2026-02-25 15:26:12 +01:00

gitea

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

glance

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

gokapi

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

grafana

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

gramps-web

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

home-assistant

home-assistant: fix initial config - remove !include directives

2026-02-25 19:12:44 +01:00

homebox

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

homepage

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

immich

userdata layout: repoint customer-content mounts to ${USERDATA_PATH}

2026-06-14 21:46:23 +02:00

jellyfin

userdata layout: repoint customer-content mounts to ${USERDATA_PATH}

2026-06-14 21:46:23 +02:00

kimai

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

komga

komga + audiobookshelf: add no-new-privileges (root-fallback hardening)

2026-06-14 22:17:32 +02:00

mealie

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

n8n

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

navidrome

userdata layout: repoint customer-content mounts to ${USERDATA_PATH}

2026-06-14 21:46:23 +02:00

nextcloud

fix: drop doubled felhom-data segment from HDD app compose templates

2026-06-13 09:23:48 +02:00

onlyoffice

Add X-Forwarded-Proto header middleware to OnlyOffice template

2026-02-25 21:04:31 +01:00

opengist

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

outline

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

paperless-ngx

userdata layout: repoint customer-content mounts to ${USERDATA_PATH}

2026-06-14 21:46:23 +02:00

papra

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

plant-it

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

plex

userdata layout: repoint customer-content mounts to ${USERDATA_PATH}

2026-06-14 21:46:23 +02:00

privatebin

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

radarr

userdata layout: repoint customer-content mounts to ${USERDATA_PATH}

2026-06-14 21:46:23 +02:00

rallly

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

recipe-importer

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

romm

userdata layout: repoint customer-content mounts to ${USERDATA_PATH}

2026-06-14 21:46:23 +02:00

seerr

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

sonarr

userdata layout: repoint customer-content mounts to ${USERDATA_PATH}

2026-06-14 21:46:23 +02:00

tandoor

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

termix

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

uptime-kuma

F5: fix uptime-kuma healthcheck (v2 uses compiled extra/healthcheck binary)

2026-06-14 09:51:40 +02:00

vaultwarden

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

vikunja

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

wanderer

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

wger

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

wishlist

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00

zipline

feat: add controller-side healthcheck configs to all 52 apps

2026-02-25 11:11:27 +01:00