From 0da1022f905c1ea8d45aaae4b7cd65df11c65a60 Mon Sep 17 00:00:00 2001
From: Laur IVAN <laur.ivan@ec.europa.eu>
Date: Thu, 26 Feb 2026 23:09:01 +0100
Subject: [PATCH] fix: Ensure Plex can write to its configuration and log
 directories by adding an init container and setting `readOnlyRootFilesystem`
 to false.

---
 .../apps/media/plex/app/helm-release.yaml       | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/kubernetes/apps/media/plex/app/helm-release.yaml b/kubernetes/apps/media/plex/app/helm-release.yaml
index 75a96a0..c39d1e2 100644
--- a/kubernetes/apps/media/plex/app/helm-release.yaml
+++ b/kubernetes/apps/media/plex/app/helm-release.yaml
@@ -17,6 +17,19 @@ spec:
       *app :
         annotations:
           reloader.stakater.com/auto: "true"
+        initContainers:
+          init-config:
+            image:
+              repository: busybox
+              tag: latest
+            command:
+              [
+                "sh",
+                "-c",
+                "mkdir -p '/config/Library/Application Support/Plex Media Server' && chown -R 1000:1000 '/config/Library/Application Support/Plex Media Server'",
+              ]
+            securityContext:
+              runAsUser: 1000
         containers:
           app:
             image:
@@ -44,7 +57,7 @@ spec:
                   periodSeconds: 10
             securityContext:
               allowPrivilegeEscalation: false
-              readOnlyRootFilesystem: true
+              readOnlyRootFilesystem: false
               capabilities: { drop: [ALL] }
             resources:
               requests:
@@ -102,9 +115,7 @@ spec:
         type: emptyDir
         globalMounts:
           - path: /config/Library/Application Support/Plex Media Server/Logs
-            subPath: logs
           - path: /tmp
-            subPath: tmp
       media:
         type: nfs
         server: 10.0.0.14