Tweaks (#24260)

* update versions in discussion templates

* make /run writable by the runtime user under docker's user

.github/DISCUSSION_TEMPLATE/beta-support.yml

@@ -26,8 +26,8 @@ body:
     id: version
     attributes:
       label: Beta Version
-      description: Visible on the System Metrics page in the Web UI. Please include the full version including the build identifier (eg. 0.18.0-beta1, 0.18.0-8b72c7a, etc.)
-      placeholder: "0.18.0-beta1"
+      description: Visible on the System Metrics page in the Web UI. Please include the full version including the build identifier (eg. 0.19.0-beta1, 0.19.0-8b72c7a, etc.)
+      placeholder: "0.19.0-beta1"
     validations:
       required: true
   - type: dropdown

.github/DISCUSSION_TEMPLATE/report-a-bug.yml

@@ -6,7 +6,9 @@ body:
       value: |
         Use this form to submit a reproducible bug in Frigate or Frigate's UI.
 
-        **⚠️ If you are running a beta version (0.18.0-beta or similar), please use the [Beta Support template](https://github.com/blakeblackshear/frigate/discussions/new?category=beta-support) instead.**
+        If you are running on Proxmox, please see the [Proxmox FAQ](https://github.com/blakeblackshear/frigate/discussions/23916) and reproduce the issue on a standard Docker install first (bare metal, or a VM running plain Debian/Ubuntu) before submitting here.
+
+        **⚠️ If you are running a beta version (0.19.0-beta or similar), please use the [Beta Support template](https://github.com/blakeblackshear/frigate/discussions/new?category=beta-support) instead.**
 
         Before submitting your bug report, please ask the AI with the "Ask AI" button on the [official documentation site][ai] about your issue, [search the discussions][discussions], look at recent open and closed [pull requests][prs], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your bug has already been fixed by the developers or reported by the community.
 

.github/workflows/ci.yml

@@ -303,7 +303,7 @@ jobs:
           # /run must allow exec: S6_READ_ONLY_ROOT has s6 copy its service
           # scripts there and run them, and --tmpfs defaults to noexec
           docker run -d --name frigate-ro --shm-size 256m \
-            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \
+            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755,uid=1000,gid=1000 \
             --user 1000:1000 \
             --security-opt no-new-privileges:true \
             -v /tmp/frigate-config-ro:/config \
@@ -405,7 +405,7 @@ jobs:
           # the config dir above now holds a go2rtc-owned go2rtc_homekit.yml,
           # which user: keeps readable but not writable (no supplementary groups)
           docker run -d --name frigate-rod-user --shm-size 256m \
-            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \
+            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755,uid=1000,gid=1000 \
             --user 1000:1000 \
             -v /tmp/frigate-config-rod:/config \
             -v /tmp/frigate-media-rod:/media/frigate \

docs/docs/configuration/non_root.md

@@ -313,8 +313,16 @@ To remove root from the container entirely, add Docker's `user:`:
 
 ```yaml
     user: "1000:1000" # NOT compatible with PUID/PGID, see the run modes table
+    tmpfs:
+      - /tmp:size=256m
+      - /tmp/cache:size=1000000000
+      - /run:exec,nosuid,nodev,mode=0755,uid=1000,gid=1000,size=16m # uid must match user:
 ```
 
+`/run` has to be owned by that uid as well. s6 writes its runtime state there before anything else starts, and with no root in the container a root-owned `/run` stops it during init with `cannot create /run/test of writability`. Keep `uid` and `gid` in the tmpfs options matching `user:`, and don't carry that pair back into the default mode, where a root-owned `/run` is what keeps the unprivileged services out of s6's runtime state.
+
+This only bites once root is genuinely gone. s6's init helper is setuid, so `user:` on its own still lets init regain root and correct `/run` itself. The `no-new-privileges:true` above is what blocks that, which is also what makes the `/run` ownership mandatory. Dropping it would hide the problem by handing init root again.
+
 Two things change, and the first one will break a working install if you skip it. The startup device grants can't run, because there is no root left to run them, so every device you pass stops working until you grant that uid access yourself with `group_add:` or a udev rule; see [Manual setup](#manual-setup). Expect this to surface as a driver error rather than a permission error, like `No VA display found` from VAAPI. And every service then runs as that one uid, so go2rtc no longer gets its own restricted user. `/config` and `/media/frigate` have to be owned by that uid already, since Frigate never adjusts ownership in this mode. Switching an existing install over also leaves `/config/go2rtc_homekit.yml` owned by the go2rtc user, which this mode can't write; `chown` it to your uid or HomeKit pairing changes stop persisting. Frigate warns and starts either way.
 
 This mode can also take `cap_drop: [ALL]`, which the default mode cannot: starting as root needs `CAP_CHOWN` for the ownership sweep, `CAP_SETUID` and `CAP_SETGID` to drop to the runtime user, and `CAP_FOWNER` for the device grants.