From 0aa09dd91f0d81d60404509a3ab305e37b6218d0 Mon Sep 17 00:00:00 2001
From: feedc0de <feedc0de@users.noreply.code.brunner.ninja>
Date: Sun, 18 Oct 2026 19:40:13 +0200
Subject: [PATCH] Run Mosquitto with its non-root image user

---
 chart/mosquitto/templates/resources.yaml | 5 +++++
 test.sh                                  | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/chart/mosquitto/templates/resources.yaml b/chart/mosquitto/templates/resources.yaml
index d34d7c4..59b73b8 100644
--- a/chart/mosquitto/templates/resources.yaml
+++ b/chart/mosquitto/templates/resources.yaml
@@ -19,6 +19,11 @@ spec:
       labels: {app: mosquitto}
     spec:
       automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1883
+        runAsGroup: 1883
+        seccompProfile: {type: RuntimeDefault}
       containers:
       - name: mosquitto
         image: {{ printf "%s:%s" .Values.image.repository .Values.image.tag | quote }}
diff --git a/test.sh b/test.sh
index 258cc3a..4acb936 100755
--- a/test.sh
+++ b/test.sh
@@ -8,3 +8,5 @@ trap 'rm -f "$rendered"' EXIT
 helm template mosquitto "$chart" > "$rendered"
 grep -q '^kind: Deployment$' "$rendered"
 grep -q '^kind: Service$' "$rendered"
+grep -q 'runAsNonRoot: true' "$rendered"
+grep -q 'runAsUser: 1883' "$rendered"