Instead of running as root, create a dedicated navidrome user (UID 1000)
in the container and use Kubernetes fsGroup to ensure PVC volumes are
writable. This provides defense-in-depth against container escape attacks.
- Dockerfile: add navidrome user/group (1000), set USER 1000
- Deployment: add pod securityContext (fsGroup, runAsUser, runAsGroup)
- Deployment: add container securityContext (runAsNonRoot, no privilege escalation)
- Bump image to v1.0.3 (v1.0.2 was built without these changes)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The v1.0.1 image was built before the USER 65534 removal,
causing SQLite write failures at runtime. v1.0.2 includes
both the zlib-dev build fix and the non-root user removal.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
