remove chown so that fsgroup can be applied to the security context

build/piefed/piefed-base/Dockerfile

@@ -60,11 +60,14 @@ RUN apk add --no-cache \
         bash
 
 # Create piefed user and set up directories in a single layer
+# Note: /app/app/static/media is volume-mounted in K8s, fsGroup handles permissions there
+# Other directories need explicit ownership for logging and temp files
 RUN addgroup -g 1000 piefed \
     && adduser -u 1000 -G piefed -s /bin/sh -D piefed \
     && mkdir -p /app/logs /app/app/static/tmp /app/app/static/media \
         /var/log/piefed /var/run/piefed \
-    && chown -R piefed:piefed /var/log/piefed /var/run/piefed
+    && chown -R piefed:piefed /app/logs /app/app/static/tmp \
+        /var/log/piefed /var/run/piefed
 
 # Set working directory
 WORKDIR /app
@@ -75,7 +78,7 @@ COPY --from=builder --chown=piefed:piefed /app /app
 # Compile translations and set permissions in a single layer
 RUN source /app/venv/bin/activate \
     && (pybabel compile -d app/translations || true) \
-    && chmod 755 /app/logs /app/app/static/tmp /app/app/static/media
+    && chmod 755 /app/logs /app/app/static/tmp
 
 # Copy shared entrypoint utilities
 COPY entrypoint-common.sh /usr/local/bin/entrypoint-common.sh

manifests/applications/piefed/deployment-web.yaml

@@ -20,6 +20,8 @@ spec:
         app.kubernetes.io/component: web
     spec:
       serviceAccountName: piefed-init-checker
+      securityContext:
+        fsGroup: 1000  # piefed group - ensures volume mounts are writable
       imagePullSecrets:
         - name: harbor-pull-secret
       initContainers:
@@ -67,7 +69,7 @@ spec:
               echo "✓ Migrations complete, starting web pod..."
       containers:
         - name: piefed-web
-        image: <YOUR_REGISTRY_URL>/library/piefed-web:latest
+          image: registry.keyboardvagabond.com/library/piefed-web:latest
           imagePullPolicy: Always
           ports:
             - containerPort: 80
@@ -146,4 +148,4 @@ spec:
         name: memory
         target:
           type: Utilization
-        averageUtilization: 90
+          averageUtilization: 200 #3GB of the 4 available

manifests/applications/piefed/deployment-worker.yaml

@@ -20,6 +20,8 @@ spec:
         app.kubernetes.io/component: worker
     spec:
       serviceAccountName: piefed-init-checker
+      securityContext:
+        fsGroup: 1000  # piefed group - ensures volume mounts are writable
       imagePullSecrets:
         - name: harbor-pull-secret
       initContainers:
@@ -67,7 +69,7 @@ spec:
               echo "✓ Migrations complete, starting worker pod..."
       containers:
         - name: piefed-worker
-        image: <YOUR_REGISTRY_URL>/library/piefed-worker:latest
+          image: registry.keyboardvagabond.com/library/piefed-worker:latest
           imagePullPolicy: Always
           envFrom:
             - configMapRef: