Hardened Bazarr image — no s6-overlay, non-root, read-only root filesystem.
USER 1000:1000 default, overridable)readOnlyRootFilesystem compatibleamd64, arm64| Path | Purpose | Required |
|---|---|---|
/config | Persistent data — database, config.ini, logs | Always |
/tmp | Writable temporary files | Only with readOnlyRootFilesystem: true |
services:
bazarr:
image: ppaslan/bazarr:latest
restart: unless-stopped
user: "1000:1000"
read_only: true
security_opt:
- no-new-privileges:true
cap_drop:
- ALL
ports:
- "6767:6767"
volumes:
- ./config:/config
- /media:/media
tmpfs:
- /tmp:size=128m
spec:
securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
fsGroup: 1000
fsGroupChangePolicy: OnRootMismatch
seccompProfile:
type: RuntimeDefault
containers:
- name: bazarr
image: ppaslan/bazarr:latest
securityContext:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop: [ALL]
volumeMounts:
- name: config
mountPath: /config
- name: tmp
mountPath: /tmp
- name: media
mountPath: /media
volumes:
- name: config
persistentVolumeClaim:
claimName: bazarr-config
- name: tmp
emptyDir:
medium: Memory
sizeLimit: 128Mi
- name: media
persistentVolumeClaim:
claimName: media
docker buildx build \
--platform linux/amd64,linux/arm64 \
--build-arg BAZARR_VERSION=1.5.6 \
-t ppaslan/bazarr:1.5.6 \
images/bazarr/
Content type
Image
Digest
sha256:6e004e772…
Size
171.2 MB
Last updated
2 days ago
docker pull ppaslan/bazarr