From 34e05725ddeb6efd598d04a87cb2e46e04da80e1 Mon Sep 17 00:00:00 2001
From: Hermes Agent service account
 <hermes@carousel-of-progress.local.mk-labs.cloud>
Date: Fri, 12 Jun 2026 15:55:49 -0500
Subject: [PATCH] fix(connections): Add security context and disable UID/GID
 modification

- Add container securityContext to satisfy PodSecurity policy
- Set SIGNAL_CLI_UID/GID to 0 to disable user modification attempts
- Fixes CrashLoopBackOff due to groupmod permission denied
---
 cluster/platform/connections/deployment.yaml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/cluster/platform/connections/deployment.yaml b/cluster/platform/connections/deployment.yaml
index 8a684ec..9b5370e 100644
--- a/cluster/platform/connections/deployment.yaml
+++ b/cluster/platform/connections/deployment.yaml
@@ -24,6 +24,13 @@ spec:
       - name: signal-cli-rest-api
         image: bbernhard/signal-cli-rest-api:0.85  # Pin version, test upgrades
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          seccompProfile:
+            type: RuntimeDefault
         ports:
         - containerPort: 8080
           name: http
@@ -31,6 +38,10 @@ spec:
         env:
         - name: MODE
           value: "json-rpc"  # json-rpc mode for API compatibility
+        - name: SIGNAL_CLI_UID
+          value: "0"  # Disable UID change
+        - name: SIGNAL_CLI_GID
+          value: "0"  # Disable GID change
         volumeMounts:
         - name: signal-data
           mountPath: /home/.local/share/signal-cli