Repository navigation
fix(palworld): fsGroup — it could not chmod its own install (92 restarts) - #23
Merged
Merged
Conversation
The image starts as root but its entrypoint DROPS privileges to PUID/PGID (1000). The data PVC is root-owned, so once dropped the server could not chmod the files SteamCMD had just installed: ./PalServer.sh is not executable. It then exited 0 and restart-looped — 92 times on the test cluster before SteamCMD's resume finally clawed through the install. Note the signature: a clean exit 0, not a crash, which is exactly how ARK's entrypoint bug hid. fsGroup makes the kubelet chown the volume to gid 1000. Deliberately NOT runAsUser: the image must START as root in order to drop. Also adds a validator rule (puid-image-needs-fsgroup) for the class. It is a WARN, not an ERROR, because a PUID image is a risk signal rather than proof of breakage — factorio, rust and terraria all chown the volume themselves while still root and run fine without fsGroup. Failing the build on those would be a false positive. Signed-off-by: valgulnecron <39313199+ValgulNecron@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The image starts as root but its entrypoint drops privileges to PUID/PGID (1000). The data PVC is root-owned, so once dropped the server could not chmod the files SteamCMD had just installed:
It then exited 0 and restart-looped — 92 times on the test cluster before SteamCMD's resume finally clawed through the install. Note the signature: a clean exit 0, not a crash — exactly how ARK's entrypoint bug hid.
fsGroupmakes the kubelet chown the volume to gid 1000. Deliberately notrunAsUser: the image must start as root in order to drop.New validator rule:
puid-image-needs-fsgroupThe existing rules all missed this, because the image's
Useris empty (root) — the privilege drop is invisible there and only shows up asPUID/PGIDinEnv.It is a WARN, not an ERROR: a PUID image is a risk signal, not proof of breakage. factorio, rust and terraria all chown the volume themselves while still root and run fine with no
fsGroup— failing the build on them would be a false positive. So it flags for a human instead.