[lab] fix(k8s): fsGroup/non-root no overlay de lab #10

dalton.alvarenga · 2026-08-11T22:15:09Z

dalton.alvarenga commented

2026-08-11 22:15:09 +00:00

Corrige escrita do ChromaDB/CSV que quebrava com a imagem non-root (uid 10001) — adiciona securityContext/fsGroup ao overlay de lab, alinhando ao hml. Já aplicado e validado no hml2 (writes OK).

🤖 Generated with Claude Code

Corrige escrita do ChromaDB/CSV que quebrava com a imagem non-root (uid 10001) — adiciona securityContext/fsGroup ao overlay de lab, alinhando ao hml. Já aplicado e validado no hml2 (writes OK). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dalton.alvarenga added 1 commit 2026-08-11 22:15:09 +00:00

[lab] fix(k8s): fsGroup/non-root no overlay de lab p/ imagem uid 10001

CD / build (pull_request) Successful in 4m47s

Details

8a6b954b32

A imagem passou a rodar non-root (uid/gid 10001), mas o overlay de lab não
tinha securityContext/fsGroup — os dirs do PVC (chroma_db, data_storage)
ficavam root:root e a escrita do ChromaDB/CSV falhava com Permission denied
(pod subia e /health respondia, mas query quebraria). Alinha o lab ao hml:
- pod securityContext runAsNonRoot + runAsUser/Group/fsGroup 10001
- container: allowPrivilegeEscalation:false, drop ALL
- HOME=/home/app e cache ONNX montado em /home/app/.cache/chroma

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

dalton.alvarenga merged commit e95a513350 into main

2026-08-11 22:16:33 +00:00

dalton.alvarenga referenced this issue from a commit

2026-08-11 22:16:34 +00:00

Merge pull request '[lab] fix(k8s): fsGroup/non-root no overlay de lab' (#10) from fix/lab-nonroot-fsgroup into main

Sign in to join this conversation.

No reviewers

No Label

No Milestone

No project

No Assignees

1 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: Clubpetro-Lab/vanna-clubpetro#10