From 7b8777c1e1052123cb262c33c1d6c3f3295856f8 Mon Sep 17 00:00:00 2001
From: Keith Jackson <keithallenjackson@gmail.com>
Date: Thu, 27 Aug 2026 16:58:17 -0500
Subject: [PATCH] fix(seerr): add fsGroup podSecurityContext to resolve
 non-root PVC CrashLoop
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Seerr v3.4.1 (ghcr.io/seerr-team/seerr) runs as the non-root user node:node
(UID/GID 1000), unlike the old root-running sctx/overseerr image. Its root-owned
Longhorn RWO config PVC at /app/config was not writable by UID 1000, so the pod
CrashLoopBackOff'd with:

  Error: EACCES: permission denied, mkdir '/app/config/logs/'

Add a podSecurityContext with fsGroup=1000 (plus runAsUser/runAsGroup/runAsNonRoot)
to the seerr ServiceDefinition — the same schema 1.3.0 mechanism semaphore uses.
Longhorn's CSIDriver fsGroupPolicy: ReadWriteOnceWithFSType applies fsGroup to this
RWO filesystem volume, group-owning the PVC to GID 1000 so the process can write.
Re-rendered apps/wave-2/seerr.yaml from the catalog source.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 apps/wave-2/seerr.yaml |  5 +++++
 catalog/seerr.yaml     | 14 ++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/apps/wave-2/seerr.yaml b/apps/wave-2/seerr.yaml
index 9ec49b6..3fdf212 100644
--- a/apps/wave-2/seerr.yaml
+++ b/apps/wave-2/seerr.yaml
@@ -81,6 +81,11 @@ spec:
         volumeMounts:
         - name: config
           mountPath: /app/config
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        fsGroup: 1000
       volumes:
       - name: config
         persistentVolumeClaim:
diff --git a/catalog/seerr.yaml b/catalog/seerr.yaml
index 77a4b3f..e5e2c31 100644
--- a/catalog/seerr.yaml
+++ b/catalog/seerr.yaml
@@ -25,6 +25,20 @@ name: seerr
 kind: container
 source:
   image: ghcr.io/seerr-team/seerr:v3.4.1   # Seerr: maintained Overseerr/Jellyseerr successor, Plex-native request UI (docs/13 row 5); served on 5055
+# The ghcr.io/seerr-team/seerr image runs as the non-root user `node:node` (UID 1000 / GID 1000 —
+# the standard node base-image user; confirmed from the image config's User field). On boot the app
+# creates /app/config/logs and writes its settings/DB under the mounted /app/config PVC. A fresh
+# Longhorn PVC is root:root, so UID 1000 cannot mkdir there -> the pod CrashLoopBackOffs with
+# "EACCES: permission denied, mkdir '/app/config/logs/'". (The old sctx/overseerr image ran as root
+# and never hit this.) fsGroup=1000 makes the kubelet group-own the mounted PVC to GID 1000 and add
+# it as a supplemental group so the process can write — Longhorn's CSIDriver
+# fsGroupPolicy: ReadWriteOnceWithFSType applies fsGroup to this RWO filesystem volume. runAsUser/
+# runAsGroup pin the image's own identity, runAsNonRoot asserts it (same pattern as semaphore; R-STATE-01/02).
+podSecurityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+  runAsNonRoot: true
+  fsGroup: 1000
 exposure: public                 # edge port-forward + public DNS (docs/09; R-DNS/R-NET)
 egress: internet                 # normal WAN egress (docs/03; R-NET-05) — TMDB/Plex.tv metadata over the internet
 storage: