fix(browser): set group mount policy

config/manager/manager.yaml

@@ -55,7 +55,7 @@ spec:
       containers:
         - command:
             - /manager
-          image: git.acooldomain.co/server-manager/kubernetes-operator:v0.0.8
+          image: git.acooldomain.co/server-manager/kubernetes-operator:v0.0.9
           env:
             - name: CONFIG_PATH
               value: /etc/server-manager/config.yaml

internal/controller/servermanager_controller.go

@@ -528,6 +528,9 @@ func (r *ServerManagerReconciler) BrowserPod(s *servermanagerv1alpha1.ServerMana
 			Protocol:      port.Protocol,
 		}
 	}
+	var fsGroupValue int64 = 2000
+	var runAsUserValue int64 = 1000
+	policy := corev1.FSGroupChangeOnRootMismatch // Optimizes startup speed
 
 	pod := &corev1.Pod{
 		ObjectMeta: metav1.ObjectMeta{
@@ -536,6 +539,12 @@ func (r *ServerManagerReconciler) BrowserPod(s *servermanagerv1alpha1.ServerMana
 			Labels:    map[string]string{"browser": s.Name},
 		},
 		Spec: corev1.PodSpec{
+			SecurityContext: &corev1.PodSecurityContext{
+				FSGroup:             &fsGroupValue,
+				RunAsUser:           &runAsUserValue,
+				RunAsGroup:          &fsGroupValue,
+				FSGroupChangePolicy: &policy,
+			},
 			Volumes: []corev1.Volume{
 				{
 					Name: "volume",
@@ -561,7 +570,7 @@ func (r *ServerManagerReconciler) BrowserPod(s *servermanagerv1alpha1.ServerMana
 					ImagePullPolicy: corev1.PullIfNotPresent,
 					Ports:           ports,
 					Command:         []string{"/bin/sh"},
-					Args:            []string{"-c", fmt.Sprintf("rm /tmp/database/filebrowser.db; /filebrowser config init -d /tmp/database/filebrowser.db && /filebrowser config set --auth.method=proxy --auth.header=%s -d /tmp/database/filebrowser.db", r.Config.Browser.AuthHeader)},
+					Args:            []string{"-c", fmt.Sprintf("rm /tmp/database/filebrowser.db; filebrowser config init -d /tmp/database/filebrowser.db && filebrowser config set --auth.method=proxy --auth.header=%s -d /tmp/database/filebrowser.db", r.Config.Browser.AuthHeader)},
 					VolumeMounts: []corev1.VolumeMount{
 						{
 							Name:      "browser-volume",
@@ -599,7 +608,7 @@ func (r *ServerManagerReconciler) BrowserPod(s *servermanagerv1alpha1.ServerMana
 func (r *ServerManagerReconciler) ServerService(s *servermanagerv1alpha1.ServerManager) *corev1.Service {
 	ports := make([]corev1.ServicePort, len(s.Spec.Server.Ports))
 	for i, port := range s.Spec.Server.Ports {
-		ports[i] = corev1.ServicePort{NodePort: 0, Port: port.Port, TargetPort: intstr.FromInt32(port.Port), Name: fmt.Sprintf("%s-%d", strings.ToLower(string(port.Protocol)), port.Port)}
+		ports[i] = corev1.ServicePort{NodePort: 0, Port: port.Port, TargetPort: intstr.FromInt32(port.Port), Name: fmt.Sprintf("%s-%d", strings.ToLower(string(port.Protocol)), port.Port), Protocol: port.Protocol}
 	}
 	service := &corev1.Service{
 		ObjectMeta: metav1.ObjectMeta{