This intentionally runs obsolete Chromium and Java for legacy BMC compatibility. Authentication and container/network isolation reduce exposure; they cannot make an obsolete browser safe against every exploit. Use a dedicated VM instead if sharing the Kubernetes host kernel is outside your risk tolerance.

The browser runs as UID/GID 1000 with a read-only root filesystem, zero Linux capabilities, no privilege escalation, RuntimeDefault seccomp, no service-account token, and bounded ephemeral writable mounts. A short init container runs as UID 0 with the same restrictions solely to copy bundled noVNC assets out of the upstream image's private /root directory. It downloads nothing. X11 TCP is disabled and VNC listens on localhost; only noVNC HTTP/WebSocket is served. Chromium retains upstream's --no-sandbox compatibility flag.

One shared desktop is used by every authorized visitor. Closing your tab does not log out of the BMC. Sign out in the legacy browser after use. Pod replacement clears the browser profile, downloads, and BMC sessions; there is no authoritative data or PVC to back up. Do not save BMC passwords in the browser.

NetworkPolicy denies all traffic by default. Supply networkPolicy.ingressFrom for the authenticated ingress controller and networkPolicy.egress or an additional platform policy for intended destinations. Public DNS is used without Kubernetes search suffixes. Never expose the Service directly or enable an Ingress without authentication. The chart does not install an identity provider.

Validate with ./test.py; use ./test.py --runtime for a Podman smoke test of the rendered container configuration, actual Chromium/X11 processes, HTTP and WebSocket/RFB handshake. It requires Helm, Python with PyYAML, and Podman. ./install.sh -f your-values.yaml is a manual homelab recovery entry point; normal deployments are owned by Argo CD.

Upstream publishes only the mutable latest tag. Chart.yaml.appVersion is its canonical image tag, consumed by both containers. The exact upstream tag latest is also the base Git tag. Since this is not SemVer, git describe --tags --long maps reversibly to 0.0.0-latest-<count>-g<commit>, including count zero. Chart.yaml.version is a packaging placeholder, never a release counter. CI tests, derives that immutable chart version, packages and publishes it, then promotes only bootstrap/oldipmi.yaml in homelab-gitops. Images pull anonymously. CI uses PACKAGE_USERNAME/PACKAGE_TOKEN and GITOPS_TOKEN, with no Kubernetes credentials, on the established Podman-capable linux_amd64 runner.

Homelab configuration selects the chart, domain, authentication middleware, and Cilium network policy.