Commit Graph

  • 8ab4024a27
    Merge 63903ff6e79af789954e698cce185ddec0a97e9b into ab208155845cfbdaabb39085392b09fd75e7a299 Josh Hawkins 2026-08-30 23:00:34 +00:00
  • 63903ff6e7 certsync watches whichever cert path nginx loaded security/read-only-rootfs Josh Hawkins 2026-08-30 17:57:53 -05:00
  • 04872c58c9 note that memryx writes models to the root filesystem Josh Hawkins 2026-08-30 17:24:23 -05:00
  • f8918c9cca refuse to write TLS material through a symlink as root Josh Hawkins 2026-08-30 17:23:04 -05:00
  • 058af89769 lead with the hardware consequence of switching to user: Josh Hawkins 2026-08-30 16:10:34 -05:00
  • 19303df041 don't take go2rtc down when the homekit file isn't writable Josh Hawkins 2026-08-30 16:07:40 -05:00
  • 51863b6ea4 support read_only in the default mode Josh Hawkins 2026-08-30 15:57:27 -05:00
  • 1dec5ac34c keep nosuid and nodev on the /run tmpfs Josh Hawkins 2026-08-30 15:53:46 -05:00
  • d04b14e304 fail fast when EXTRA_GROUPS or a missing media volume meets read_only Josh Hawkins 2026-08-30 15:37:31 -05:00
  • d8e521ef77
    Merge 0e1b45846fa4ed030d98ec0415d6975d92f280d7 into d37dff1b491e752d7bf6b0ca2c7efbaedca623cd dependabot[bot] 2026-08-30 16:31:32 -04:00
  • 67c2047b8e
    Merge 490f1b93f8cc2aa450e74e882aa31516d6c1078c into d37dff1b491e752d7bf6b0ca2c7efbaedca623cd Martin Weinelt 2026-08-30 15:00:00 -05:00
  • c602fe68c1 note the uid trade-off in user: mode Josh Hawkins 2026-08-30 12:44:59 -05:00
  • 688c1571e4 keep certsync's cert selection identical to nginx's Josh Hawkins 2026-08-30 12:43:23 -05:00
  • 2bd259b4f2 Document hardened read-only deployment Josh Hawkins 2026-08-30 12:32:59 -05:00
  • ae55a56e9d Assert read-only rootfs support in CI Josh Hawkins 2026-08-30 12:29:44 -05:00
  • 928d0bb116 Support read-only rootfs in s6 and pre-compile bytecode Josh Hawkins 2026-08-30 12:27:44 -05:00
  • 6d45df8db3 Support read-only rootfs with self-signed certs in /config/tls Josh Hawkins 2026-08-30 12:26:27 -05:00
  • 529b4d9ee9
    Merge 62db7c253b142281634a0431c7511fde90b731ab into ab208155845cfbdaabb39085392b09fd75e7a299 Josh Hawkins 2026-08-30 12:21:15 -05:00
  • ab20815584
    Fix NPU turbo key and priviledges set (#24138) 0.19 Nicolas Mowen 2026-08-30 11:15:49 -06:00
  • ce71b041ec Fix NPU turbo key and priviledges set Nicolas Mowen 2026-08-30 11:01:03 -06:00
  • 890512b054
    Container security hardening (phase 3, breaking) (#24081) Josh Hawkins 2026-08-30 09:14:43 -05:00
  • 656f74919e
    Merge 1d68ff0b4322982070bf3105bd12de66ecdbf8ca into d37dff1b491e752d7bf6b0ca2c7efbaedca623cd Weblate (bot) 2026-08-30 13:14:16 +00:00
  • 1d68ff0b43
    Translated using Weblate (Chinese (Simplified Han script)) Hosted Weblate 2026-08-30 15:14:11 +02:00
  • 24e832fc74
    Translated using Weblate (Chinese (Traditional Han script)) Hosted Weblate 2026-08-30 15:14:11 +02:00
  • 6f04f5d9c7
    Translated using Weblate (Korean) Hosted Weblate 2026-08-30 15:14:11 +02:00
  • d729a3a4d5
    Translated using Weblate (Italian) Hosted Weblate 2026-08-30 15:14:10 +02:00
  • ee92cfcb7b
    Translated using Weblate (Catalan) Hosted Weblate 2026-08-30 15:14:10 +02:00
  • 16138d4de5
    Translated using Weblate (Belarusian) Hosted Weblate 2026-08-30 15:14:10 +02:00
  • 9d560af954
    Translated using Weblate (Romanian) Hosted Weblate 2026-08-30 15:14:10 +02:00
  • 181eddeee8
    Translated using Weblate (Estonian) Hosted Weblate 2026-08-30 15:14:10 +02:00
  • dc7a621793
    Translated using Weblate (German) Hosted Weblate 2026-08-30 15:14:10 +02:00
  • 20d59ee3b9
    Translated using Weblate (Tamil) Hosted Weblate 2026-08-30 15:14:10 +02:00
  • e42cd63439 keep custom binaries out of root services only under granular root Josh Hawkins 2026-08-30 07:43:30 -05:00
  • 58a8e21fb9 stop the ownership sweep chasing entries other mechanisms own Josh Hawkins 2026-08-29 22:28:07 -05:00
  • 6a4995a1e7
    Merge eccf36f15eefcdbb36b07b77adb83a1b159bfe8a into d37dff1b491e752d7bf6b0ca2c7efbaedca623cd A. Ahmet 2026-08-29 23:06:27 +00:00
  • 0f733b5ee5 tweak docs Josh Hawkins 2026-08-29 17:30:28 -05:00
  • 46c189fced harden against symlink attacks Josh Hawkins 2026-08-29 17:26:17 -05:00
  • baa00147b4 group the manual device setup under one section Josh Hawkins 2026-08-29 16:41:43 -05:00
  • 24411fc4ab link the migration script to the repo Josh Hawkins 2026-08-29 16:38:05 -05:00
  • 92c4aae7d7 clarify the non-root docs Josh Hawkins 2026-08-29 16:31:10 -05:00
  • 496327985a stop telling users device access needs host side setup Josh Hawkins 2026-08-29 16:16:11 -05:00
  • 3f86876630 document automatic device access grants Josh Hawkins 2026-08-29 15:55:59 -05:00
  • 3c9e77ffb5 assert device access grants in CI Josh Hawkins 2026-08-29 15:54:45 -05:00
  • d5eca09797 grant runtime users access to mapped device nodes at boot Josh Hawkins 2026-08-29 15:53:36 -05:00
  • 49f520d3e5 install acl for device access grants Josh Hawkins 2026-08-29 15:50:24 -05:00
  • b9ce2988d8 clean up Josh Hawkins 2026-08-27 14:18:27 -05:00
  • 39d2883a87 clarify granular root services docs Josh Hawkins 2026-08-27 13:16:27 -05:00
  • a572936d91 skip missing media paths in the per-boot ownership sweep Josh Hawkins 2026-08-27 13:15:51 -05:00
  • 208f606d5a clear the cached runtime ids when ownership tests finish Josh Hawkins 2026-08-27 13:15:42 -05:00
  • 0c366aeace own every directory level created for a recording segment Josh Hawkins 2026-08-27 13:15:35 -05:00
  • 9b089c4bcb document FRIGATE_ROOT_SERVICES Josh Hawkins 2026-08-27 12:54:05 -05:00
  • f873933aab assert granular root services in CI Josh Hawkins 2026-08-27 12:51:39 -05:00
  • 576949f7c3 recommend FRIGATE_ROOT_SERVICES in the bandwidth stats warning Josh Hawkins 2026-08-27 12:45:37 -05:00
  • a2883a6509 chown the database files after init Josh Hawkins 2026-08-27 12:45:17 -05:00
  • 2f450ea661 chown recordings, previews, and exports to the runtime user at create Josh Hawkins 2026-08-27 12:43:51 -05:00
  • e8b2e06323 cache the runtime ids in the ownership helper Josh Hawkins 2026-08-27 12:37:46 -05:00
  • 903c59ff8c record the root-services mode in the sentinel and sweep small trees each boot Josh Hawkins 2026-08-27 12:35:50 -05:00
  • 9d3a38d234 let services listed in FRIGATE_ROOT_SERVICES skip the privilege drop Josh Hawkins 2026-08-27 12:32:06 -05:00
  • 53ffa72e28 validate FRIGATE_ROOT_SERVICES and fail fast on unknown names Josh Hawkins 2026-08-27 12:28:16 -05:00
  • dda3730a76 add a service-runs-as-root helper for granular root services Josh Hawkins 2026-08-27 12:26:39 -05:00
  • d2c9f18d49 collapse the duplicated sentinel comment Josh Hawkins 2026-08-27 09:30:56 -05:00
  • bc62eb4adc harden root writes into unprivileged-owned paths Josh Hawkins 2026-08-27 09:28:32 -05:00
  • 17b37a08a9 reload nginx by signaling the master instead of parsing its config as root Josh Hawkins 2026-08-27 09:21:24 -05:00
  • 2cd51a31a8 make bundled models readable by the runtime user Josh Hawkins 2026-08-27 09:05:59 -05:00
  • 93470c4ea5 hand /tmp/cache to the runtime user before services start Josh Hawkins 2026-08-27 08:54:48 -05:00
  • 9e356f1d3f skip lost+found during the ownership sweep Josh Hawkins 2026-08-27 08:42:54 -05:00
  • 890cd751ae document network storage ownership and the remaining detector hardware Josh Hawkins 2026-08-27 08:26:06 -05:00
  • 69e30ac3b6 expand the non-root device access docs with diagnosis steps and udev rules Josh Hawkins 2026-08-27 08:23:44 -05:00
  • 11db4a2756 document EXTRA_GROUPS as the only device access path for dropped services Josh Hawkins 2026-08-27 07:55:28 -05:00
  • 7f175e1a17 report progress during the ownership sweep Josh Hawkins 2026-08-24 11:04:06 -05:00
  • f776fffb9e unwrap hard-wrapped prose in the installation docs Josh Hawkins 2026-08-24 10:45:54 -05:00
  • e8987fc22c discard stdout for the unprivileged smoke nginx -t Josh Hawkins 2026-08-24 10:05:23 -05:00
  • 04bb2f4ed1 re-own the nginx shm cache on service restart Josh Hawkins 2026-08-24 10:01:38 -05:00
  • ab393c2cb2 run smoke nginx -t and the write probe as the runtime user Josh Hawkins 2026-08-24 10:01:38 -05:00
  • 1f68ba0cd4 set HOME to /config for non-root services Josh Hawkins 2026-08-24 10:01:38 -05:00
  • e7a0743ec0 chown the s6 log pipe so non-root nginx can reopen /dev/stdout Josh Hawkins 2026-08-24 09:52:59 -05:00
  • 8f5c441239 tolerate homekit config chown failures in the go2rtc run script Josh Hawkins 2026-08-23 18:26:13 -05:00
  • 8119bea0b3 only write the sweep sentinel when a media volume is mounted Josh Hawkins 2026-08-23 18:26:13 -05:00
  • b07e36237a Assert non-root services, JWT migration, and escape hatch in CI Josh Hawkins 2026-08-23 18:17:48 -05:00
  • 55a8672896 Create /media/frigate after the ownership sweep Josh Hawkins 2026-08-23 18:17:48 -05:00
  • cb5bfe1bd7 Document non-root operation and per-hardware device access Josh Hawkins 2026-08-23 18:03:02 -05:00
  • 944541f41c Hand TensorRT model cache ownership to the runtime user Josh Hawkins 2026-08-23 18:01:10 -05:00
  • 5d9f715c35 Disable bandwidth stats gracefully when not running as root Josh Hawkins 2026-08-23 17:59:37 -05:00
  • b7368197a2 Run nginx as the frigate user with writable state in /tmp/nginx Josh Hawkins 2026-08-23 17:59:19 -05:00
  • 7530590066 Run go2rtc as its own restricted user Josh Hawkins 2026-08-23 17:59:19 -05:00
  • 9ce146fd99 Run the frigate service as the frigate user Josh Hawkins 2026-08-23 17:59:19 -05:00
  • 20bab0695e
    Merge 10179b5cfbb70f335e55178c96c326e79fb3fd64 into d37dff1b491e752d7bf6b0ca2c7efbaedca623cd Bazyl Horsey 2026-08-29 12:29:25 -07:00
  • 32035f8a2b
    Merge d93f296691bba288e4e671c6c4cf13244d94d8d0 into d37dff1b491e752d7bf6b0ca2c7efbaedca623cd Mika 2026-08-29 12:27:52 -07:00
  • 20c7837b8c
    Merge c5dc511d004b223bc84a95e3b7110773e210a502 into d37dff1b491e752d7bf6b0ca2c7efbaedca623cd Chandan P 2026-08-29 22:01:50 +05:30
  • 0fc66858c1 Remove AI contribution policy Ersa Oktavian Ramadan 2026-08-29 21:16:53 +07:00
  • 0b626ba7ce
    Merge 410696ade376f0826356779653fa1a03409c37ea into d37dff1b491e752d7bf6b0ca2c7efbaedca623cd Patryk Orwat 2026-08-29 21:33:57 +08:00
  • d37dff1b49
    Docs update (#24131) dev Josh Hawkins 2026-08-29 08:01:11 -05:00
  • 84e836cfbd
    Merge 8161d930b5ebe080a70e0bd38e72854490269202 into a745070b76276ef7865bf6513d627196ff1c6d10 dependabot[bot] 2026-08-29 12:42:24 +05:30
  • bd317b1cb0
    Merge ea447e53e6791f6d933e502136902d4f61956df4 into a745070b76276ef7865bf6513d627196ff1c6d10 dependabot[bot] 2026-08-29 12:42:23 +05:30
  • 5cce0344eb
    Merge a05233a34b8e184e99eda2c852ce737b848bc67f into a745070b76276ef7865bf6513d627196ff1c6d10 dependabot[bot] 2026-08-29 12:42:23 +05:30
  • 9f93dc30b5
    Merge 3efb224f996a248ebf7bd498c7d24751a629f26c into a745070b76276ef7865bf6513d627196ff1c6d10 dependabot[bot] 2026-08-29 12:42:23 +05:30
  • cb6ac4bd01
    Merge c9a54d1bc414cc375889a9bebe6e5266a07a246b into a745070b76276ef7865bf6513d627196ff1c6d10 dependabot[bot] 2026-08-29 12:41:20 +05:30
  • d829526c8f
    Merge 34593dc2049163a126f0e23805a2ac4828d4a1b8 into a745070b76276ef7865bf6513d627196ff1c6d10 dependabot[bot] 2026-08-29 12:41:20 +05:30
  • fde5b0f32d
    Merge 5adc0f0b4ff9c4038d6c1b6da8b526d8a9eae1e7 into a745070b76276ef7865bf6513d627196ff1c6d10 dependabot[bot] 2026-08-29 12:41:20 +05:30
  • 4d3883e503
    Merge aaf0edc8ed0fa62bdd03e1e49c8ea98fd7ad1bba into a745070b76276ef7865bf6513d627196ff1c6d10 dependabot[bot] 2026-08-29 12:41:20 +05:30