Hardened Radarr image — no s6-overlay, non-root, read-only root filesystem.
USER 1000:1000 default, overridable)readOnlyRootFilesystem compatibleamd64, arm64| Variable | Description | Default |
|---|---|---|
XDG_CONFIG_HOME | Override config base path (Radarr uses $XDG_CONFIG_HOME/Radarr) |
Radarr reads its configuration from /config via the --data=/config flag.
| Path | Purpose | Required |
|---|---|---|
/config | Persistent data — database, config.xml, logs | Always |
/tmp | Writable temporary files | Only with readOnlyRootFilesystem: true |
services:
radarr:
image: ppaslan/radarr:latest
restart: unless-stopped
user: "1000:1000"
read_only: true
security_opt:
- no-new-privileges:true
cap_drop:
- ALL
ports:
- "7878:7878"
volumes:
- ./config:/config
- /media:/media
tmpfs:
- /tmp:size=128m
spec:
securityContext:
runAsUser: 1000
runAsGroup: 1000
runAsNonRoot: true
fsGroup: 1000
fsGroupChangePolicy: OnRootMismatch
seccompProfile:
type: RuntimeDefault
containers:
- name: radarr
image: ppaslan/radarr:latest
securityContext:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop: [ALL]
volumeMounts:
- name: config
mountPath: /config
- name: tmp
mountPath: /tmp
- name: media
mountPath: /media
volumes:
- name: config
persistentVolumeClaim:
claimName: radarr-config
- name: tmp
emptyDir:
medium: Memory
sizeLimit: 128Mi
- name: media
persistentVolumeClaim:
claimName: media
docker buildx build \
--platform linux/amd64,linux/arm64 \
--build-arg RADARR_VERSION=6.1.1.10360 \
-t ppaslan/radarr:6.1.1.10360 \
images/radarr/
Content type
Image
Digest
sha256:71ab675ce…
Size
107.1 MB
Last updated
3 days ago
docker pull ppaslan/radarr