nik/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-08-31 07:27:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

note the uid trade-off in user: mode

Browse Source
This commit is contained in:
Josh Hawkins 2026-08-30 12:44:59 -05:00
parent 688c1571e4
commit c602fe68c1
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docs/docs/configuration/non_root.md
View File

@ -265,7 +265,7 @@ What each device needs when you're setting it up by hand. The automatic grant co
## Hardened deployment
Docker's `user:` mode is the only run mode that supports `read_only: true`. Together they're the strongest supported configuration: the container never starts as root, and it can't modify its own filesystem.
Docker's `user:` mode is the only run mode that supports `read_only: true`. The container never starts as root and can't modify its own filesystem. The trade-off is that every service runs as the single uid you pass, so go2rtc no longer gets its own more restricted user the way it does in the default mode.
```yaml
services: