Image 0.3.9 baked socktop 1.60.1 because CI's registry layer cache reused
the apt-install layer from before the 1.60.2 release. 1.60.1 has no
--no-kill flag, so the restricted shell's invocation parsed it as the
positional websocket URL, breaking (and on overwrite, corrupting) the
local profile. Pinning the package version busts the cache and ties the
installed binary to the flags the restricted shell uses.
Also point the manifest's webterm container at the current tag so a
manual kubectl apply cannot roll the image back to 0.2.2.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Add init container to set up config files with correct ownership
- Run main container as socktop user (UID 100, GID 101) from the start
- Use fsGroup to ensure proper volume permissions
- Add emptyDir volume for /var/lib/socktop to avoid permission issues
- Create docker-entrypoint.sh wrapper to detect root vs non-root execution
- Root mode: uses init-config.sh for Docker/docker-compose
- Non-root mode: directly runs entrypoint.sh for K8s
- Update deployment command format to work with new entrypoint
This resolves 'Operation not permitted' errors when running in K8s
with security contexts that restrict user switching and ownership changes.
jasonwitty
jason