DOCSEARCHbyAlgolia
Submit Docs

home-operations/containers

repository·main·Indexed 19 days ago

https://github.com/home-operations/containers

An opinionated collection of semantically versioned, rootless, and multi-architecture container images designed for home operations. Includes guidance on ensuring image immutability via SHA256 digests, configuring rootless containers in Docker Compose and Kubernetes, managing configuration volumes at /config, and verifying image signatures using cosign or the GitHub CLI.

Tokens
1.2K
Snippets
5
Records
6
Agent score
15%

What's inside home-operations/containers

  2. Ensure image immutability using SHA256 digests

    main

    To guarantee functional consistency and true immutability, do not rely on mutable tags (like :rolling or :2025.5.1). Instead, pin your container images to their specific sha256 digest. This ensures that the exact same image version is always pulled, even if a tag is updated upstream. Tools like Renovate can be configured to update these digests automatically.

    # Avoid this (mutable):
image: ghcr.io/home-operations/home-assistant:2025.5.1

# Use this (immutable):
image: ghcr.io/home-operations/home-assistant:2025.5.1@sha256:516ae5c85089b3f2960cf2a21dc3c105356969499964fabf0b0358e5f3a7e0a2

  3. Configure rootless containers in Docker Compose

    main

    Most containers in this repository run as a non-root user (65534:65534) by default. If you need to change the user or group, update the user field in your Docker Compose file. Ensure that the permissions on your mounted data volumes match the user:group you specify.

    services:
  home-assistant:
    image: ghcr.io/home-operations/home-assistant:2025.5.1@sha256:516ae5c85089b3f2960cf2a21dc3c105356969499964fabf0b0358e5f3a7e0a2
    container_name: home-assistant
    user: 1000:1000 # The data volume permissions must match this user:group
    read_only: true # May require mounting in additional dirs as tmpfs
    tmpfs:
      - /tmp:rw

  4. Verify container image signatures

    main

    Images are signed using attest-build-provenance. You can verify that an image was built by the official GitHub CI using either the GitHub CLI (gh) or cosign.

    # Using GitHub CLI
gh attestation verify --repo home-operations/containers oci://ghcr.io/home-operations/${APP}:${TAG}

  6. Configure rootless containers in Kubernetes

    main

    To run these containers securely in Kubernetes, use a securityContext to define the user and group. You may also need to set allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, and drop all capabilities. If using a read-only root filesystem, you must mount additional volumes (like emptyDir) for writable paths such as /tmp.

    apiVersion: apps/v1
kind: Deployment
metadata:
  name: home-assistant
spec:
  template:
    spec:
      containers:
        - name: home-assistant
          image: ghcr.io/home-operations/home-assistant:2025.5.1@sha256:516ae5c85089b3f2960cf2a21dc3c105356969499964fabf0b0358e5f3a7e0a2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
      volumes:
        - name: tmp
          emptyDir: {}