From d695bab679741d35b521c953c93ecdb5a6b59c2c Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Thu, 22 Oct 2026 10:43:06 +0200
Subject: [PATCH] Run Immich workloads as the library owner

---
 apps/immich/values.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/apps/immich/values.yaml b/apps/immich/values.yaml
index cbe0c33..d8e83c2 100644
--- a/apps/immich/values.yaml
+++ b/apps/immich/values.yaml
@@ -46,6 +46,10 @@ server:
             runAsGroup: 65534
       containers:
         main:
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
           env:
             DB_HOSTNAME: immich-postgresql-rw
             DB_DATABASE_NAME: immich
@@ -85,6 +89,12 @@ machine-learning:
           - key: node-role.kubernetes.io/control-plane
             operator: Exists
             effect: NoSchedule
+      containers:
+        main:
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
       initContainers:
         check-bcachefs-library:
           image: