Commit Graph
3 Commits
Author SHA1 Message Date
Josh HawkinsandGitHub 2347f954bb Container security hardening (phase 2) (#24068)
* Create frigate and go2rtc runtime users in the image

* Add single fix-ownership helper for volume permission migration

* Add init-usermod oneshot for PUID and PGID remapping

* Chown newly created runtime directories to the frigate user

* Run sentinel-guarded ownership sweep during prepare

* Add host-side volume permission migration script

* Guard log directory ownership for user-mode startup

* Fall back to plain s6-log when running without root

* Assert PUID remapping and sweep sentinel in CI smoke test

* Skip the ownership sweep in the devcontainer

* Pin FRIGATE_RUN_AS_ROOT in ownership tests

* Do not record the sweep as complete when a chown failed

* Validate PUID and PGID in the migration script

* Treat a failed ownership scan as an incomplete sweep

* Reject PUID and PGID of 0 during remapping

* Handle symlinks, dry runs, and sentinel write failures in the sweep

* Treat an absent sweep root as an incomplete sweep
2026-08-23 14:40:32 -06:00
Felipe SantosandGitHub 52d94231c7 Avoid unhealthy container when Frigate is stopping (#18021) 2025-05-07 19:43:51 -05:00
f8b0329b37 Move database and config from homeassistant /config to addon /config (#16337)
* Move database and config from homeassistant /config to addon /config

* Re-implement config migration for the add-on

* Align some terms

* Improve function name

* Use local variables

* Add model.path migration

* Fix homeassistant config path

* Ensure migration scripts run before go2rtc and frigate

* Migrate all files I know

* Add ffmpeg.path migration

* Update docker/main/rootfs/etc/s6-overlay/s6-rc.d/prepare/run

Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>

* Improve some variable names and organization

* Update docs to reflect addon config dir

* Update live.md with /addon_configs

* Move addon config section to configuration doc

* Align several terminologies and improve text

* Fix webrtc example config title

* Capitalize Add-on in more places

* Improve specific add-on config dir docs

* Align bash and python scripts to prefer config.yml over config.yaml

* Support config.json in migration shell scripts

* Change docs to reflect config.yml is preferred over config.yaml

* If previous config was yaml, migrate to yaml

* Fix typo in edgetpu.md

* Fix formatting of Python files

* Remove HailoRT Beta add-on variant from docs

* Add migration for labelmap and certs

* Fix variable name

* Fix new_config_file var unset

* Fix addon config directories table

* Improve db migration to avoid migrating files like .db.bak

* Fix echo location

---------

Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
2025-03-24 09:05:59 -05:00