wallabag-image

A custom wallabag/wallabag image with a single permission fix so it runs under Kubernetes Pod Security Standards restricted (forced non-root, no extra capabilities).

Why

The stock image's entrypoint unconditionally writes a generated PHP ini file into /etc/php81/conf.d/ on every boot, but that directory ships 755 root:root — no group-write bit. Under PSS restricted the container runs as uid/gid 65534 (nobody), so that write fails and the entrypoint (set -e) crash-loops the pod. Full root-cause writeup: kube-charts/docs/wallabag-custom-image.md (in the sibling kube-charts repo). This repo is just the fix, verified to work — see the Dockerfile for the two-line change.

Build locally

docker build -t wallabag-image:local .
# or pin a specific upstream version:
docker build --build-arg WALLABAG_VERSION=2.6.14 -t wallabag-image:local .

Verify the fix (should print WRITE_OK, matching what the entrypoint does on every boot):

docker run --rm -u 65534:65534 wallabag-image:local sh -c \
  'envsubst < /etc/wallabag/php-wallabag.template.ini > /etc/php81/conf.d/50_wallabag.ini && echo WRITE_OK'

The same command against stock wallabag/wallabag:2.6.14 fails with Permission denied.

Release

Pushing a git tag (e.g. v2.6.14-1) triggers .woodpecker/release.yml, which builds, pushes to git.gnous.eu/gnouseu/wallabag, and cosign-signs the result per kube-charts/docs/image-signing.md.

Consumer

Once an image is pushed here, kube-charts' values/wallabag/values.yaml gets its image.repository/image.tag updated to point at git.gnous.eu/gnouseu/wallabag. That update, and un-pausing the wallabag migration, is a kube-charts-side follow-up — not part of this repo.