Update s6-overlay to 3.2.2.0 for Kubernetes non-root support

[morey-tech]

Summary

Update s6-overlay from 3.1.6.2 to 3.2.2.0 to enable running Home Assistant containers as non-root in Kubernetes/OpenShift environments.

Problem

Home Assistant containers fail to start on OpenShift (and other Kubernetes distributions that enforce non-root) with:

s6-chown: fatal: unable to chown /run: Operation not permitted

OpenShift runs containers with random UIDs (e.g., uid=1000780000) that cannot chown directories.

Solution

s6-overlay v3.2.1.0 added:

"tolerance for unprivileged containers with suboptimal permissions in /run (which happens a lot in Kubernetes)"

This release introduces S6_YES_I_WANT_A_WORLD_WRITABLE_RUN_BECAUSE_KUBERNETES environment variable support that allows s6-overlay to boot with world-writable /run owned by uid 0.

References

• s6-overlay release: https://github.com/just-containers/s6-overlay/releases/tag/v3.2.1.0
• OpenShift compatibility issue: Version 3: OpenShift compatibility? just-containers/s6-overlay#427

[home-assistant]

Hi @morey-tech

It seems you haven't yet signed a CLA. Please do so here.

Once you do that we will be able to review and accept this pull request.

Thanks!

[home-assistant]

Please take a look at the requested changes, and use the Ready for review button when you are done, thanks 👍

Learn more about our pull request process.

Stale

[agners]

Probably the biggest change with jumping to the S6 overlay v3.2.x.x train is that the services no longer timeout, from the release notes:

It also removes the default service startup timeout, which was causing more problems than it was solving. (Now if you need to make your container fail when it hangs, you need to manually specify a timeout in the S6_CMD_WAIT_FOR_SERVICES_MAXTIME variable.

From the pre-v3.2.x.x README.md it seems that before the default timeout was 5000. I don't think that we typically need a timeout, the default change seems sensible to me. But something to keep in mind, and if required, we still can use S6_CMD_WAIT_FOR_SERVICES_MAXTIME=5000 to revert to the default behavior.

It seems that meanwhile another minor release got released.

@morey-tech can you update the PR accordingly?