From ea236cd28f2054f5b0a6e8753790d7decc2dcfc6 Mon Sep 17 00:00:00 2001
From: Tim Haasdyk <tim_haasdyk@sil.org>
Date: Thu, 16 May 2024 15:24:43 +0200
Subject: [PATCH] Try to ensure we're always using the right user/group

---
 deployment/base/hg-deployment.yaml             | 1 +
 deployment/init-repos/hg-deployment-patch.yaml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/deployment/base/hg-deployment.yaml b/deployment/base/hg-deployment.yaml
index 8f2e1272b..027ce8f9b 100644
--- a/deployment/base/hg-deployment.yaml
+++ b/deployment/base/hg-deployment.yaml
@@ -176,6 +176,7 @@ spec:
         securityContext:
           runAsUser: 33
           runAsGroup: 33 # www-data
+          runAsNonRoot: true
         image: busybox:1.36.1
         command:
           - 'sh'
diff --git a/deployment/init-repos/hg-deployment-patch.yaml b/deployment/init-repos/hg-deployment-patch.yaml
index 82ac50d91..1fefc7d51 100644
--- a/deployment/init-repos/hg-deployment-patch.yaml
+++ b/deployment/init-repos/hg-deployment-patch.yaml
@@ -11,6 +11,7 @@ spec:
           securityContext:
             runAsUser: 33
             runAsGroup: 33 # www-data
+            runAsNonRoot: true
           image: busybox:1.36.1
           command:
             - 'sh'