Configuration & cache handling issues with random securityContext

Hello everyone! Thanks for the great tool you’re providing! We would love to provide an internal ArtifactHub in our OpenShift cluster. Unfortunately we are facing some issues with the Helm chart and/or ArtifactHub’s configuration (and cache) handling in general.

When deploying ArtifactHub in an OpenShift cluster, it gets a random uid, which does not have a home directory in the container and does not have write permissions on /home/hub. This results in the following problems:

• The configuration files are not found (since $HOME is not set, but used when loading the configurations).
• The cache cannot be written.
  • Since $HOME is not set, it tries to write on /.cache (subdirectory of root), which of course fails due to the missing root permissions.
  • Even if $HOME is set, the .cache folder cannot be written (since the user which is running the container does not have write permissions on /home/hub).

In my opinion there are two options:

• The $HOME environment variable can be set in the Helm chart (maybe even by providing a generic extraEnv value) and /home/hub/.cache is mounted as a writable ephemeral volume (emptyDir).
• Configurations and cache are not in the home directory. The config could for example be mounted at /config, and the cache could be written in the tmp folder.

I can provide PRs, I just wanted to discuss the issue first (is it considered a problem, if so which approach would be preferred).

[tegioz]

Given that I did not provide a --cache-dir in the client, it must be using that one by default. Trivy allows overriding this using $TRIVY_CACHE_DIR, so we could allow this environment variable to be set and make sure it’s included in the environment passed to the trivy command by adding it here.

[tegioz]

No worries, my pleasure.

That sounds great to me, thanks! 👍