MakeMKV is your one-click solution to convert video that you own into free and patents-unencumbered format that can be played everywhere.
TrueCharts are designed to be installed as TrueNAS SCALE app only. We can not guarantee this charts works as a stand-alone helm installation.
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/apps/issues/new/choose)**
## Source Code
* <https://github.com/jlesage/docker-makemkv>
* <https://hub.docker.com/r/jlesage/makemkv>
## Requirements
Kubernetes: `>=1.16.0-0`
## Dependencies
| Repository | Name | Version |
|------------|------|---------|
| https://truecharts.org | common | 9.1.2 |
## Installing the Chart
To install this App on TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/03-Installing-an-App/).
## Uninstalling the Chart
To remove this App from TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/07-Deleting-an-App/).
TrueCharts is primarily build to supply TrueNAS SCALE Apps.
However, we also supply all Apps as standard Helm-Charts. In this document we aim to document the default values in our values.yaml file.
Most of our Apps also consume our "common" Helm Chart.
If this is the case, this means that all values.yaml values are set to the common chart values.yaml by default. This values.yaml file will only contain values that deviate from the common chart.
You will, however, be able to use all values referenced in the common chart here, besides the values listed in this document.
description:"Password needed to connect to the application's GUI. See the VNC Password section for more details."
schema:
type:string
private:true
default:""
- variable:makemkv
group:"Container Configuration"
label:"MakeMKV Configuration"
schema:
additional_attrs:true
type:dict
attrs:
- variable:KEEP_APP_RUNNING
label:"KEEP_APP_RUNNING"
description:"When set to true, the application will be automatically restarted if it crashes or if a user quits it."
schema:
type:boolean
default:false
- variable:SECURE_CONNECTION
label:"SECURE_CONNECTION"
description:"When set to true, an encrypted connection is used to access the application's GUI (either via a web browser or VNC client)."
schema:
type:boolean
default:false
- variable:DISPLAY_WIDTH
label:"DISPLAY_WIDTH"
description:"Width (in pixels) of the application's window."
schema:
type:int
default:1280
required:true
- variable:DISPLAY_HEIGHT
label:"DISPLAY_HEIGHT"
description:"Height (in pixels) of the application's window."
schema:
type:int
default:768
required:true
- variable:MAKEMKV_KEY
label:"MAKEMKV_KEY"
description:"MakeMKV registration key to use."
schema:
type:string
default:"BETA"
required:true
- variable:AUTO_DISC_RIPPER_INTERVAL
label:"AUTO_DISC_RIPPER_INTERVAL"
description:"Interval, in seconds, the automatic disc ripper checks for the presence of a DVD/Blu-ray discs."
schema:
type:int
default:5
required:true
- variable:AUTO_DISC_RIPPER_BD_MODE
label:"AUTO_DISC_RIPPER_BD_MODE"
description:"Rip mode of Blu-ray discs. mkv is the default mode, where a set of MKV files are produced. When set to backup, a copy of the (decrypted) file system is created instead. This applies to Blu-ray discs only. For DVD discs, MKV files are always produced."
schema:
type:string
default:"mkv"
required:true
- variable:AUTO_DISC_RIPPER_MAKEMKV_PROFILE
label:"AUTO_DISC_RIPPER_MAKEMKV_PROFILE"
description:"Filename of the custom MakeMKV profile the automatic disc ripper should use. The profile is expected to be found under the /config folder of the container."
schema:
type:string
default:""
- variable:AUTO_DISC_RIPPER
label:"AUTO_DISC_RIPPER"
description:"When set to true, disc is ejected from the drive when ripping is terminated."
schema:
type:boolean
default:false
- variable:AUTO_DISC_RIPPER_EJECT
label:"AUTO_DISC_RIPPER_EJECT"
description:"When set to true, disc is ejected from the drive when ripping is terminated."
schema:
type:boolean
default:false
- variable:AUTO_DISC_RIPPER_PARALLEL_RIP
label:"AUTO_DISC_RIPPER_PARALLEL_RIP"
description:"When set to true, discs from all available optical drives are ripped in parallel. Else, each disc from optical drives is ripped one at time."
schema:
type:boolean
default:false
- variable:AUTO_DISC_RIPPER_NO_GUI_PROGRESS
label:"AUTO_DISC_RIPPER_NO_GUI_PROGRESS"
description:"When set to true, progress of discs ripped by the automatic disc ripper is not shown in the MakeMKV GUI."
description:"When set to false, files are written to /output/DISC_LABEL/, where DISC_LABEL is the label/name of the disc. If this directory exists, then files are written to /output/DISC_LABEL-XXXXXX, where XXXXXX are random readable characters. When set to true, the /output/DISC_LABEL-XXXXXX pattern is always used."
schema:
type:boolean
default:false
# Include{containerConfig}
- variable:service
group:"Networking and Services"
label:"Configure Service(s)"
schema:
additional_attrs:true
type:dict
attrs:
- variable:main
label:"Main Service"
description:"The Primary service on which the healthcheck runs, often the webUI"
schema:
additional_attrs:true
type:dict
attrs:
# Include{serviceSelector}
- variable:main
label:"Main Service Port Configuration"
schema:
additional_attrs:true
type:dict
attrs:
- variable:port
label:"Port"
description:"This port exposes the container port on the service"
schema:
type:int
default:10180
required:true
- variable:advanced
label:"Show Advanced settings"
schema:
type:boolean
default:false
show_subquestions_if:true
subquestions:
- variable:protocol
label:"Port Type"
schema:
type:string
default:"HTTP"
enum:
- value:HTTP
description:"HTTP"
- value:"HTTPS"
description:"HTTPS"
- value:TCP
description:"TCP"
- value:"UDP"
description:"UDP"
- variable:nodePort
label:"Node Port (Optional)"
description:"This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer"
schema:
type:int
min:9000
max:65535
- variable:targetPort
label:"Target Port"
description:"The internal(!) port on the container the Application runs on"
schema:
type:int
default:5800
- variable:vnc
label:"VNC Service"
description:"VNC Service"
schema:
additional_attrs:true
type:dict
attrs:
# Include{serviceSelector}
- variable:vnc
label:"VNC Service Port Configuration"
schema:
additional_attrs:true
type:dict
attrs:
- variable:port
label:"Port"
description:"This port exposes the container port on the service"
schema:
type:int
default:10181
required:true
- variable:advanced
label:"Show Advanced settings"
schema:
type:boolean
default:false
show_subquestions_if:true
subquestions:
- variable:protocol
label:"Port Type"
schema:
type:string
default:"HTTP"
enum:
- value:HTTP
description:"HTTP"
- value:"HTTPS"
description:"HTTPS"
- value:TCP
description:"TCP"
- value:"UDP"
description:"UDP"
- variable:nodePort
label:"Node Port (Optional)"
description:"This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer"
schema:
type:int
min:9000
max:65535
- variable:targetPort
label:"Target Port"
description:"The internal(!) port on the container the Application runs on"
schema:
type:int
default:5900
- variable:serviceexpert
group:"Networking and Services"
label:"Show Expert Config"
schema:
type:boolean
default:false
show_subquestions_if:true
subquestions:
- variable:hostNetwork
group:"Networking and Services"
label:"Host-Networking (Complicated)"
schema:
type:boolean
default:false
# Include{serviceExpert}
# Include{serviceList}
- variable:persistence
label:"Integrated Persistent Storage"
description:"Integrated Persistent Storage"
group:"Storage and Persistence"
schema:
additional_attrs:true
type:dict
attrs:
- variable:config
label:"App Config Storage"
description:"Stores the Application Configuration."
schema:
additional_attrs:true
type:dict
attrs:
- variable:type
label:"Type of Storage"
description:"Sets the persistence type, Anything other than PVC could break rollback!"
schema:
type:string
default:"simplePVC"
enum:
- value:"simplePVC"
description:"PVC (simple)"
- value:"simpleHP"
description:"HostPath (simple)"
- value:"emptyDir"
description:"emptyDir"
- value:"pvc"
description:"pvc"
- value:"hostPath"
description:"hostPath"
# Include{persistenceBasic}
- variable:hostPath
label:"hostPath"
description:"Path inside the container the storage is mounted"
schema:
show_if:[["type","=","hostPath"]]
type:hostpath
- variable:medium
label:"EmptyDir Medium"
schema:
show_if:[["type","=","emptyDir"]]
type:string
default:""
enum:
- value:""
description:"Default"
- value:"Memory"
description:"Memory"
# Include{persistenceAdvanced}
- variable:storage
label:"App Storage"
description:"Application Storage."
schema:
additional_attrs:true
type:dict
attrs:
- variable:type
label:"Type of Storage"
description:"Sets the persistence type, Anything other than PVC could break rollback!"
schema:
type:string
default:"simplePVC"
enum:
- value:"simplePVC"
description:"PVC (simple)"
- value:"simpleHP"
description:"HostPath (simple)"
- value:"emptyDir"
description:"emptyDir"
- value:"pvc"
description:"pvc"
- value:"hostPath"
description:"hostPath"
# Include{persistenceBasic}
- variable:hostPath
label:"hostPath"
description:"Path inside the container the storage is mounted"
schema:
show_if:[["type","=","hostPath"]]
type:hostpath
- variable:medium
label:"EmptyDir Medium"
schema:
show_if:[["type","=","emptyDir"]]
type:string
default:""
enum:
- value:""
description:"Default"
- value:"Memory"
description:"Memory"
# Include{persistenceAdvanced}
- variable:output
label:"App Output Storage"
description:"Stores the Application Output."
schema:
additional_attrs:true
type:dict
attrs:
- variable:type
label:"Type of Storage"
description:"Sets the persistence type, Anything other than PVC could break rollback!"
schema:
type:string
default:"simplePVC"
enum:
- value:"simplePVC"
description:"PVC (simple)"
- value:"simpleHP"
description:"HostPath (simple)"
- value:"emptyDir"
description:"emptyDir"
- value:"pvc"
description:"pvc"
- value:"hostPath"
description:"hostPath"
# Include{persistenceBasic}
- variable:hostPath
label:"hostPath"
description:"Path inside the container the storage is mounted"
schema:
show_if:[["type","=","hostPath"]]
type:hostpath
- variable:medium
label:"EmptyDir Medium"
schema:
show_if:[["type","=","emptyDir"]]
type:string
default:""
enum:
- value:""
description:"Default"
- value:"Memory"
description:"Memory"
# Include{persistenceAdvanced}
# Include{persistenceList}
- variable:ingress
label:""
group:"Ingress"
schema:
additional_attrs:true
type:dict
attrs:
- variable:main
label:"Main Ingress"
schema:
additional_attrs:true
type:dict
attrs:
# Include{ingressDefault}
# Include{ingressTLS}
# Include{ingressTraefik}
# Include{ingressExpert}
# Include{ingressList}
# Include{security}
- variable:advancedSecurity
label:"Show Advanced Security Settings"
group:"Security and Permissions"
schema:
type:boolean
default:false
show_subquestions_if:true
subquestions:
- variable:securityContext
label:"Security Context"
schema:
additional_attrs:true
type:dict
attrs:
- variable:privileged
label:"Privileged mode"
schema:
type:boolean
default:false
- variable:readOnlyRootFilesystem
label:"ReadOnly Root Filesystem"
schema:
type:boolean
default:false
- variable:allowPrivilegeEscalation
label:"Allow Privilege Escalation"
schema:
type:boolean
default:false
- variable:runAsNonRoot
label:"runAsNonRoot"
schema:
type:boolean
default:false
# Include{securityContextAdvanced}
- variable:podSecurityContext
group:"Security and Permissions"
label:"Pod Security Context"
schema:
additional_attrs:true
type:dict
attrs:
- variable:runAsUser
label:"runAsUser"
description:"The UserID of the user running the application"
schema:
type:int
default:0
- variable:runAsGroup
label:"runAsGroup"
description:The groupID this App of the user running the application"
schema:
type:int
default:0
- variable:fsGroup
label:"fsGroup"
description:"The group that should own ALL storage."
| Kubernetes Security Check | KSV001 | Process can elevate its own privileges | MEDIUM | <details><summary>Expand...</summary> A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-makemkv' should set 'securityContext.allowPrivilegeEscalation' to false </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted">https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted</a><br><a href="https://avd.aquasec.com/appshield/ksv001">https://avd.aquasec.com/appshield/ksv001</a><br></details> |
| Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW | <details><summary>Expand...</summary> The container should drop all default capabilities and add only those that are needed for its execution. <br> <hr> <br> Container 'RELEASE-NAME-makemkv' of Deployment 'RELEASE-NAME-makemkv' should add 'ALL' to 'securityContext.capabilities.drop' </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/">https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/</a><br><a href="https://avd.aquasec.com/appshield/ksv003">https://avd.aquasec.com/appshield/ksv003</a><br></details> |
| Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW | <details><summary>Expand...</summary> The container should drop all default capabilities and add only those that are needed for its execution. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-makemkv' should add 'ALL' to 'securityContext.capabilities.drop' </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/">https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/</a><br><a href="https://avd.aquasec.com/appshield/ksv003">https://avd.aquasec.com/appshield/ksv003</a><br></details> |
| Kubernetes Security Check | KSV011 | CPU not limited | LOW | <details><summary>Expand...</summary> Enforcing CPU limits prevents DoS via resource exhaustion. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-makemkv' should set 'resources.limits.cpu' </details>| <details><summary>Expand...</summary><a href="https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits">https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits</a><br><a href="https://avd.aquasec.com/appshield/ksv011">https://avd.aquasec.com/appshield/ksv011</a><br></details> |
| Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM | <details><summary>Expand...</summary> 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges. <br> <hr> <br> Container 'RELEASE-NAME-makemkv' of Deployment 'RELEASE-NAME-makemkv' should set 'securityContext.runAsNonRoot' to true </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted">https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted</a><br><a href="https://avd.aquasec.com/appshield/ksv012">https://avd.aquasec.com/appshield/ksv012</a><br></details> |
| Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM | <details><summary>Expand...</summary> 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges. <br> <hr> <br> Container 'autopermissions' of Deployment 'RELEASE-NAME-makemkv' should set 'securityContext.runAsNonRoot' to true </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted">https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted</a><br><a href="https://avd.aquasec.com/appshield/ksv012">https://avd.aquasec.com/appshield/ksv012</a><br></details> |
| Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM | <details><summary>Expand...</summary> 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-makemkv' should set 'securityContext.runAsNonRoot' to true </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted">https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted</a><br><a href="https://avd.aquasec.com/appshield/ksv012">https://avd.aquasec.com/appshield/ksv012</a><br></details> |
| Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW | <details><summary>Expand...</summary> An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk. <br> <hr> <br> Container 'RELEASE-NAME-makemkv' of Deployment 'RELEASE-NAME-makemkv' should set 'securityContext.readOnlyRootFilesystem' to true </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/">https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/</a><br><a href="https://avd.aquasec.com/appshield/ksv014">https://avd.aquasec.com/appshield/ksv014</a><br></details> |
| Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW | <details><summary>Expand...</summary> An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk. <br> <hr> <br> Container 'autopermissions' of Deployment 'RELEASE-NAME-makemkv' should set 'securityContext.readOnlyRootFilesystem' to true </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/">https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/</a><br><a href="https://avd.aquasec.com/appshield/ksv014">https://avd.aquasec.com/appshield/ksv014</a><br></details> |
| Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW | <details><summary>Expand...</summary> An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-makemkv' should set 'securityContext.readOnlyRootFilesystem' to true </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/">https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/</a><br><a href="https://avd.aquasec.com/appshield/ksv014">https://avd.aquasec.com/appshield/ksv014</a><br></details> |
| Kubernetes Security Check | KSV015 | CPU requests not specified | LOW | <details><summary>Expand...</summary> When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-makemkv' should set 'resources.requests.cpu' </details>| <details><summary>Expand...</summary><a href="https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits">https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits</a><br><a href="https://avd.aquasec.com/appshield/ksv015">https://avd.aquasec.com/appshield/ksv015</a><br></details> |
| Kubernetes Security Check | KSV016 | Memory requests not specified | LOW | <details><summary>Expand...</summary> When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-makemkv' should set 'resources.requests.memory' </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-resources-limits-memory/">https://kubesec.io/basics/containers-resources-limits-memory/</a><br><a href="https://avd.aquasec.com/appshield/ksv016">https://avd.aquasec.com/appshield/ksv016</a><br></details> |
| Kubernetes Security Check | KSV017 | Privileged container | HIGH | <details><summary>Expand...</summary> Privileged containers share namespaces with the host system and do not offer any security. They should be used exclusively for system containers that require high privileges. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-makemkv' should set 'securityContext.privileged' to false </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline">https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline</a><br><a href="https://avd.aquasec.com/appshield/ksv017">https://avd.aquasec.com/appshield/ksv017</a><br></details> |
| Kubernetes Security Check | KSV018 | Memory not limited | LOW | <details><summary>Expand...</summary> Enforcing memory limits prevents DoS via resource exhaustion. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-makemkv' should set 'resources.limits.memory' </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-resources-limits-memory/">https://kubesec.io/basics/containers-resources-limits-memory/</a><br><a href="https://avd.aquasec.com/appshield/ksv018">https://avd.aquasec.com/appshield/ksv018</a><br></details> |
| Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM | <details><summary>Expand...</summary> Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table. <br> <hr> <br> Container 'RELEASE-NAME-makemkv' of Deployment 'RELEASE-NAME-makemkv' should set 'securityContext.runAsUser' > 10000 </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-runasuser/">https://kubesec.io/basics/containers-securitycontext-runasuser/</a><br><a href="https://avd.aquasec.com/appshield/ksv020">https://avd.aquasec.com/appshield/ksv020</a><br></details> |
| Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM | <details><summary>Expand...</summary> Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table. <br> <hr> <br> Container 'autopermissions' of Deployment 'RELEASE-NAME-makemkv' should set 'securityContext.runAsUser' > 10000 </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-runasuser/">https://kubesec.io/basics/containers-securitycontext-runasuser/</a><br><a href="https://avd.aquasec.com/appshield/ksv020">https://avd.aquasec.com/appshield/ksv020</a><br></details> |
| Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM | <details><summary>Expand...</summary> Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-makemkv' should set 'securityContext.runAsUser' > 10000 </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-runasuser/">https://kubesec.io/basics/containers-securitycontext-runasuser/</a><br><a href="https://avd.aquasec.com/appshield/ksv020">https://avd.aquasec.com/appshield/ksv020</a><br></details> |
| Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM | <details><summary>Expand...</summary> Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table. <br> <hr> <br> Container 'RELEASE-NAME-makemkv' of Deployment 'RELEASE-NAME-makemkv' should set 'securityContext.runAsGroup' > 10000 </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-runasuser/">https://kubesec.io/basics/containers-securitycontext-runasuser/</a><br><a href="https://avd.aquasec.com/appshield/ksv021">https://avd.aquasec.com/appshield/ksv021</a><br></details> |
| Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM | <details><summary>Expand...</summary> Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table. <br> <hr> <br> Container 'autopermissions' of Deployment 'RELEASE-NAME-makemkv' should set 'securityContext.runAsGroup' > 10000 </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-runasuser/">https://kubesec.io/basics/containers-securitycontext-runasuser/</a><br><a href="https://avd.aquasec.com/appshield/ksv021">https://avd.aquasec.com/appshield/ksv021</a><br></details> |
| Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM | <details><summary>Expand...</summary> Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-makemkv' should set 'securityContext.runAsGroup' > 10000 </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-runasuser/">https://kubesec.io/basics/containers-securitycontext-runasuser/</a><br><a href="https://avd.aquasec.com/appshield/ksv021">https://avd.aquasec.com/appshield/ksv021</a><br></details> |
| Kubernetes Security Check | KSV023 | hostPath volumes mounted | MEDIUM | <details><summary>Expand...</summary> HostPath volumes must be forbidden. <br> <hr> <br> Deployment 'RELEASE-NAME-makemkv' should not set 'spec.template.volumes.hostPath' </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline">https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline</a><br><a href="https://avd.aquasec.com/appshield/ksv023">https://avd.aquasec.com/appshield/ksv023</a><br></details> |
| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW | <details><summary>Expand...</summary> Containers should be forbidden from running with a root primary or supplementary GID. <br> <hr> <br> Deployment 'RELEASE-NAME-makemkv' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0 </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted">https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted</a><br><a href="https://avd.aquasec.com/appshield/ksv029">https://avd.aquasec.com/appshield/ksv029</a><br></details> |
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Stavros Kois