From 1f611efed0f672a52df944dbde620e0dfe4c7192 Mon Sep 17 00:00:00 2001
From: ACoolName <acoolname@acooldomain.co>
Date: Mon, 22 Jun 2026 20:01:03 +0000
Subject: [PATCH] fix(browser): set group mount policy

---
 internal/controller/servermanager_controller.go | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/internal/controller/servermanager_controller.go b/internal/controller/servermanager_controller.go
index d964b47..fcecd1d 100644
--- a/internal/controller/servermanager_controller.go
+++ b/internal/controller/servermanager_controller.go
@@ -528,6 +528,9 @@ func (r *ServerManagerReconciler) BrowserPod(s *servermanagerv1alpha1.ServerMana
 			Protocol:      port.Protocol,
 		}
 	}
+	var fsGroupValue int64 = 2000
+	var runAsUserValue int64 = 1000
+	policy := corev1.FSGroupChangeOnRootMismatch // Optimizes startup speed
 
 	pod := &corev1.Pod{
 		ObjectMeta: metav1.ObjectMeta{
@@ -536,6 +539,12 @@ func (r *ServerManagerReconciler) BrowserPod(s *servermanagerv1alpha1.ServerMana
 			Labels:    map[string]string{"browser": s.Name},
 		},
 		Spec: corev1.PodSpec{
+			SecurityContext: &corev1.PodSecurityContext{
+				FSGroup:             &fsGroupValue,
+				RunAsUser:           &runAsUserValue,
+				RunAsGroup:          &fsGroupValue,
+				FSGroupChangePolicy: &policy,
+			},
 			Volumes: []corev1.Volume{
 				{
 					Name: "volume",